ConfigMaps store non-sensitive config, while Secrets are meant for sensitive values such as tokens or passwords.
- Both can be mounted or injected
- Secrets are not plain config by intent
- Still require cluster security controls
Docker packages an app with its runtime and dependencies into a portable container image.
- Image is a blueprint
- Container is a running instance
- Improves environment consistency
Kubernetes Deployments roll out new replicas gradually while keeping part of the old replica set available.
- Controlled by maxUnavailable and maxSurge
- Supports rollback
- Readiness affects safe rollout
Kubernetes orchestrates containers across machines and handles scheduling, scaling, and service discovery.
- Pod is smallest deployable unit
- Deployment manages replicas
- Service provides stable access
Liveness decides whether a container should be restarted, while readiness decides whether it should receive traffic.
- Liveness for stuck processes
- Readiness for traffic safety
- Misconfigured probes can cause outages
AWS offers load balancers for different layers, with ALB for HTTP/S, NLB for very high-performance TCP/UDP, and GWLB for network appliances.
- ALB is app-layer aware
- NLB is lower-level and fast
- Choose based on protocol and routing needs
Logs explain events, metrics show trends, and alerts tell you when user-impacting thresholds break.
- Use structured logs
- Track golden signals
- Alert on symptoms users feel
Affinity attracts workloads to certain nodes; taints repel workloads unless they have matching tolerations.
- Affinity is placement preference or rule
- Taints push workloads away
- Useful for GPU, critical, or isolated nodes
A Pod runs containers, a Deployment manages desired pod replicas, and a Service gives stable network access to pods.
- Pod is runtime unit
- Deployment handles rollout and replica count
- Service abstracts pod IP churn
Security groups are stateful instance-level firewalls, while NACLs are stateless subnet-level filters.
- Security groups attach to resources
- NACLs attach to subnets
- Stateful vs stateless is the big memory hook
Terraform declares desired infrastructure state and calculates a plan to move current state toward it.
- Providers talk to platforms
- State file matters
- Plan before apply
A rolling deployment replaces instances gradually so the app stays available during release.
- Update in batches
- Monitor error rate during rollout
- Rollback quickly if needed