Hosting & CloudGlossaryPart 4 of 17
Kubernetes Glossary
140 terms from the Hosting & Cloud book's Kubernetes part, each defined in a line and linked to the chapter that explains it.
- Admission (Kubernetes): the API server stage after authorization where mutating and then validating admission (built-in plugins, webhooks and in-process CEL policies) can change or reject a request (Kubernetes Architecture).
- Admission webhook: a remote call the API server makes on every matching write, allowing any logic, but a network service in the request path; with failure policy
Failit becomes a dependency of every write (Kubernetes Architecture). - Aggregated API server: a separate API server proxied through an
APIService, with its own storage and validation, for APIs whose data isn't a key-value document (Kubernetes Architecture). - AKS Automatic: an AKS Standard-tier cluster preconfigured with node auto-provisioning, the
stableupgrade channel and node auto-repair, adding a pod readiness SLA (Managed Kubernetes). - AKS cost analysis: Azure's cost allocation add-on built on OpenCost and reconciled with the Azure invoice, on Standard and Premium tiers (Autoscaling & Cost).
- AKS Pod Sandboxing: AKS's sandboxed runtime, running Kata Containers on Azure Linux node pools, selected with
runtimeClassName: kata-vm-isolation(Multi-Tenancy, Policy & Security). - API Priority and Fairness (APF): the API server's self-protection that divides its request concurrency among priority levels, so classes of request can't starve each other, with fair queuing within a level (Kubernetes Architecture).
- API server: the Kubernetes component every client talks to, which passes each request through transport, authentication, authorization, admission and validation before writing it to etcd (Kubernetes Architecture).
- Application (Argo CD): Argo CD's central object, naming a source (repository, revision and path or chart) and a destination cluster and namespace, with a sync status and a health status (Packaging & GitOps).
- ApplicationSet: the Argo CD object that generates Applications from a template and generators (List, Cluster, Git, Matrix), how one manifest deploys to a fleet (Packaging & GitOps).
- AppProject: Argo CD's tenancy boundary, limiting the repositories an application may pull from, the clusters and namespaces it may deploy to and the kinds it may create (Packaging & GitOps).
- Argo CD: a hub GitOps controller with a UI, Applications and AppProjects that pulls desired state from Git and reconciles clusters to it; the hub holds credentials for every cluster it manages (Packaging & GitOps).
- Argo Rollouts: a progressive delivery controller that replaces Deployments with Rollouts, adding steps, analysis, blue-green and canary (Packaging & GitOps).
- AWS split cost allocation data: AWS's addition of ECS task and EKS pod line items to the Cost and Usage Report, with usage records per pod for CPU and memory (Autoscaling & Cost).
- Azure Container Apps: Microsoft's serverless container service, scaling on HTTP traffic, events, CPU, memory and KEDA's scalers, with most apps able to scale to zero (Distributions & Alternatives).
- Base and overlay (Kustomize): a base is a directory with a
kustomization.yamlof resources and customization; an overlay refers to other kustomization directories and changes them with transformers, while the base knows nothing of its overlays (Packaging & GitOps). - Binding (scheduler): the scheduler's final step, telling the API server which node it picked for a pod (Kubernetes Architecture).
- Bottlerocket: AWS's open-source Linux built to run containers, updating by downloading a whole filesystem image to the inactive of two partition sets and rebooting into it (Distributions & Alternatives).
- Calico: Tigera's Apache 2.0 networking and network policy project for Kubernetes, with a full eBPF data plane beside nftables (Cluster Networking).
- Capsule: a multi-tenancy project that groups namespaces into a Tenant with inherited quotas, RBAC and policies, using its own policy engine (Multi-Tenancy, Policy & Security).
- Chart (Helm): a directory with a required
Chart.yamland reserved subdirectories for templates, dependencies and CRDs, plus default values, the unit Helm packages and installs (Packaging & GitOps). - Cilium: an eBPF networking project that began as a CNI and grew into network policy, kube-proxy replacement, encryption, BGP, multi-cluster, a sidecarless mesh and observability (Cluster Networking).
- Cilium kube-proxy replacement: Cilium's eBPF implementation of
ClusterIP,NodePort,LoadBalancerand external IPs, with socket-level load balancing that connects a socket straight to a backend (Cluster Networking). - cloud-controller-manager: the Kubernetes component that integrates with the cloud provider, whose controllers turn Node objects into machines and
type: LoadBalancerServices into the provider's load balancers (Kubernetes Architecture). - CloudNativePG: an Apache 2.0 Postgres operator in the CNCF that declares a database cluster as a
Clusterresource and relies on Postgres's own replication rather than storage-level replication (Storage & Stateful Workloads). - Cluster API: a Kubernetes project in which a management cluster reconciles
Cluster,Machine,MachineDeploymentand control plane objects through infrastructure, bootstrap and control plane providers (Managed Kubernetes). - Cluster Autoscaler: the node autoscaler that scales node groups it is told about (sets of identical machines, usually one cloud group each) and never creates a group (Autoscaling & Cost).
- Cluster idle cost: capacity no workload claimed, which OpenCost defines as asset costs minus workload costs and keeps separate, to be distributed among tenants optionally (Autoscaling & Cost).
- Cluster per tenant: the hardest Kubernetes tenancy model, a whole cluster per tenant, isolating everything Kubernetes shares at the cost of a control plane fee and unshared capacity (Multi-Tenancy, Policy & Security).
- Cluster-scoped objects: Kubernetes objects outside any namespace (CRDs, StorageClasses, webhooks, ClusterRoles, PersistentVolumes, Namespaces), which namespace-per-tenant isolation doesn't separate (Multi-Tenancy, Policy & Security).
- CNI (Container Network Interface): the plugin specification through which container runtimes implement the Kubernetes network model; interface plugins create a pod's interface and chained plugins adjust an existing one (Cluster Networking).
- Compaction and defragmentation (etcd): etcd maintenance that discards old revisions to avoid performance degradation and space exhaustion, then reclaims the freed space per member (Kubernetes Architecture).
- Config Sync: Google's in-cluster GitOps reconciler driven by
RootSyncandRepoSyncobjects, bundled with GKE and fleets (Packaging & GitOps). - Conformance (Certified Kubernetes): the check that a managed service or distribution implements the Kubernetes API, which lets customers move manifests in and out; it covers only the API, not add-ons (Kubernetes Architecture).
- Container Runtime Interface (CRI): the gRPC protocol between the kubelet and the container runtime; Docker never implemented it, which led to dockershim and its removal (Kubernetes Architecture).
- Controller (Kubernetes): a control loop that moves the cluster's current state toward the desired state written in the API, usually reading one kind and writing another (Kubernetes Architecture).
- CRD with a controller: extending Kubernetes by adding a kind's schema to the main API server and a controller that reconciles it, so kubectl, RBAC, watch and GitOps work unchanged (Kubernetes Architecture).
- CRDs in Helm: CustomResourceDefinitions shipped in a chart's
crds/directory, installed before the rest and then never reinstalled, upgraded or deleted by Helm (Packaging & GitOps). - CSI (Container Storage Interface): the plugin interface for Kubernetes storage, with Identity, Controller (create, attach, snapshot, expand) and Node (stage and publish mounts) services (Storage & Stateful Workloads).
- D2iQ: formerly Mesosphere, the company whose Kubernetes platform (DKP) and engineers Nutanix acquired (Distributions & Alternatives).
- EKS add-ons: EKS's managed set of cluster components: AWS add-ons built and supported by AWS, Marketplace add-ons supported by partners, and community add-ons validated only for version compatibility (Managed Kubernetes).
- EKS Auto Mode: EKS mode where AWS manages compute selection and scaling, OS patching, load balancing, storage, networking and core add-ons, with those controllers on AWS-owned infrastructure (Managed Kubernetes).
- EKS Hybrid Nodes: attaching on-premises and edge machines to an EKS cluster, with AWS running the control plane and the customer managing and upgrading the nodes (Managed Kubernetes).
- EKS on Fargate: running each EKS pod on its own Fargate node selected by a Fargate profile, a VM per pod by construction, not upgraded with the control plane (Managed Kubernetes).
- Encryption at rest (etcd): encrypting resources such as Secrets before the API server writes them to etcd, which is plain text by default, ideally through a KMS v2 provider with a recorded key owner (Kubernetes Architecture).
- etcd: the consistent, highly available key-value store for all Kubernetes API server data, using Raft and needing a quorum of an odd number of members, the part that decides a control plane's availability and recovery (Kubernetes Architecture).
- Extended support: a provider's paid support for a Kubernetes minor after standard support ends (EKS extended support, GKE's Extended channel, AKS long-term support), priced well above the standard control plane fee and ending in a forced upgrade (Managed Kubernetes).
- External etcd: an HA topology with a dedicated etcd cluster separate from the control plane nodes, separating failure domains at the cost of twice the hosts (Kubernetes Architecture).
- Falco: a CNCF runtime detection tool that watches system calls and audit logs for behavior admission control can't see, raising alerts only (Multi-Tenancy, Policy & Security).
- Filtering and scoring: the Kubernetes scheduler's two steps: filtering finds nodes where a pod can feasibly run (leaving it
Pendingif none), and scoring ranks them, with ties broken at random (Kubernetes Architecture). - Finalizers: namespaced keys on an object that make Kubernetes wait for conditions before deleting it, leaving it terminating until every finalizer is removed (Kubernetes Architecture).
- Flagger: a progressive delivery controller in the Flux project that wraps existing Deployments for canary and blue-green without changing workload manifests (Packaging & GitOps).
- FlowSchema: the API Priority and Fairness object that classifies each request by its attributes into a priority level with its own concurrency limit (Kubernetes Architecture).
- Flux: a CNCF-graduated set of per-cluster GitOps controllers (source, kustomize, helm, notification and image automation) that pull and apply with impersonation, holding no central credentials (Packaging & GitOps).
- Flux Kustomization: the Flux object (not Kustomize's file) that applies a path from a source on an interval, detecting and by default reverting drift, as an impersonated service account (Packaging & GitOps).
- Fly Machines: Fly.io's VMs with a fast REST API, Firecracker microVMs built from Docker images and placed on specific hardware, the clearest case of a provider building below Kubernetes (Distributions & Alternatives).
- Forced upgrade (Kubernetes): a provider's upgrade of a cluster at the end of its support, standard or paid, whatever the customer's settings; the notice and what it overrides are where providers differ (Managed Kubernetes).
- Gateway API: the successor to Ingress that splits routing into roles: a GatewayClass names an implementation, a Gateway requests listeners on an address, routes such as HTTPRoute attach rules, and ReferenceGrant authorizes cross-namespace references (Cluster Networking).
- GKE Autopilot: GKE's node-less mode where Google SREs manage the nodes and the customer sees pods and is billed for their requests (Managed Kubernetes).
- GKE cost allocation: GKE's export of cluster, namespace, workload and promoted label dimensions into the detailed BigQuery billing export (Autoscaling & Cost).
- GKE Sandbox: GKE's sandboxed runtime, enabling gVisor or microVMs on node pools selected through RuntimeClass, with feature restrictions such as no privileged containers (Multi-Tenancy, Policy & Security).
- Health (Argo CD): an Application's status saying whether its objects work (
Healthy,Progressing,Degraded,Suspended,Missing,Unknown), separate from sync status (Packaging & GitOps). - Helm: the Kubernetes package manager of Go templates plus values and releases with history, the distribution format for third-party software, which hides what is applied behind templates (Packaging & GitOps).
- Helm 4: the Helm release that kept the chart format and added server-side apply, kstatus waiting, WebAssembly plugins and content-cached charts (Packaging & GitOps).
- Helm hooks: objects run at points in a release lifecycle (pre- and post-install, upgrade, rollback, delete, and test) set by an annotation, which the release doesn't track afterward (Packaging & GitOps).
- HelmRelease: the Flux object that installs a chart through Helm actions, merging values from ConfigMaps, Secrets and inline values (Packaging & GitOps).
- Horizontal Pod Autoscaler (HPA): the control loop in
kube-controller-managerthat sets a workload's replica count from utilization of requests or from custom or external metrics (Autoscaling & Cost). - Immutable node operating system: a node OS taken out of the customer's hands and upgraded as a whole image with Kubernetes, such as Talos Linux, Bottlerocket and RHEL CoreOS (Distributions & Alternatives).
- Impersonation (Flux): a Flux controller acting as the service account named in
serviceAccountName, which limits what a Kustomization can change (Packaging & GitOps). - In-process CEL admission:
ValidatingAdmissionPolicyandMutatingAdmissionPolicyevaluated in the API server, with no process to secure or network hop but only the request and its context as inputs (Kubernetes Architecture). - Informers: the client-library pattern that lists and watches a kind through a Reflector, stores changes in a local indexed cache and calls the controller's handlers (Kubernetes Architecture).
- Istio: a CNCF-graduated service mesh built on the Envoy proxy, classically a sidecar in every pod and now also ambient mode with a ztunnel per node and optional waypoints (Cluster Networking).
- k3s: Kubernetes cut down for small machines in one binary, a distribution rather than a fork, defaulting to an SQLite datastore through Kine (Distributions & Alternatives).
- Kamal: 37signals' MIT-licensed deploy tool (introduced as MRSK) that deploys web apps in containers to any servers, with kamal-proxy switching traffic, a deploy tool rather than a scheduler (Distributions & Alternatives).
- Karpenter: a node autoscaler that drops node groups, watching unschedulable pods and launching individual instances that fit their requirements under
NodePoolconstraints (Autoscaling & Cost). - Karpenter NodePool, NodeClass and NodeClaim: Karpenter's objects: a
NodePoolsays what may be launched and how it may be disrupted, anEC2NodeClass(orAKSNodeClass) holds provider specifics, and aNodeClaimrecords one requested node (Autoscaling & Cost). - KEDA: an event-driven autoscaler that scales workloads between zero and one itself and serves event-source metrics so an HPA it owns scales from one to N (Autoscaling & Cost).
- Kine: an etcd shim that provides an etcd-compatible API over SQL databases (MySQL, PostgreSQL) or SQLite, letting many clusters share a managed database or a small one embed its store (Kubernetes Architecture).
- kOps: a Kubernetes SIG CLI that provisions HA clusters on supported clouds, leaving everything after provisioning to the operator (Managed Kubernetes).
- kube-proxy: the per-node proxy that programs the kernel to rewrite traffic for a Service's virtual IP to a ready pod, in iptables, nftables or the deprecated IPVS mode (Cluster Networking).
- kubeadm: the Kubernetes tool that bootstraps a minimum viable, best-practice cluster, the building block under other installers, with no machines or day-2 lifecycle of its own (Managed Kubernetes).
- Kubecost: IBM's commercial Kubernetes cost product built on OpenCost, with multi-cluster views and recommendations (Autoscaling & Cost).
- Kustomize: template-free Kubernetes configuration of bases and overlays in plain YAML, built into kubectl (Packaging & GitOps).
- Kyverno: a CNCF-graduated Kubernetes policy engine whose policies are Kubernetes resources, including
verifyImagesrules that check image signatures and attestations (Multi-Tenancy, Policy & Security). - LimitRange: a namespace object, enforced by the LimitRanger admission plugin, that checks pods against minimums and maximums and applies default requests to pods that specify none (Multi-Tenancy, Policy & Security).
- Linkerd: the service mesh created by Buoyant, the first to graduate in the CNCF, for which Buoyant stopped publishing open source release artifacts from 2.15 (Cluster Networking).
- List, then watch: the Kubernetes client pattern of listing a kind and then watching from the returned
resourceVersion, to get the current state and every later change (Kubernetes Architecture). - Managed Kubernetes: a provider-run control plane (EKS, GKE, AKS, DOKS, LKE, OKE) with customer or provider nodes, a conformant API with forced upgrades and extended-support fees (Distributions & Alternatives).
- Multi-team and multi-customer tenancy: the two Kubernetes tenancy cases: multi-team, where tenants are teams using the API with RBAC, quotas and network policies, and multi-customer, where customers never see the cluster (Multi-Tenancy, Policy & Security).
- MutatingAdmissionPolicy: the in-process counterpart to mutating webhooks, CEL expressions in the API server that produce an apply configuration or a JSON patch (Multi-Tenancy, Policy & Security).
- Namespace per tenant: the soft Kubernetes tenancy model of namespaces with Roles, quotas and network policies, cheap but leaving cluster-scoped objects, nodes, the API server and DNS shared (Multi-Tenancy, Policy & Security).
- Node controller: the controller that assigns pod CIDRs, reconciles nodes with the cloud's machines and monitors node health, deciding what happens when a provider's machine fails (Kubernetes Architecture).
- Node pool: a group of identical nodes in a managed cluster that owns its upgrade parameters (surge, unavailability, drain timeout, soak), set per pool by every provider (Managed Kubernetes).
- Node-less mode: a managed Kubernetes mode where the provider runs the nodes as well as the control plane (Autopilot, Auto Mode, AKS Automatic, Fargate, virtual nodes), with less hardware control (Managed Kubernetes).
- OKE virtual nodes: Oracle's serverless node pools on enhanced clusters, charged per virtual node-hour with pods paying for the compute they consume (Managed Kubernetes).
- Omni: Sidero Labs' fleet manager for Talos clusters, source-available under the Business Source License, free for non-production use (Distributions & Alternatives).
- OPA Gatekeeper: the Kubernetes policy engine based on Open Policy Agent, where a ConstraintTemplate holds Rego logic and a schema and a Constraint instantiates it; the engine behind GKE's and AKS's policy products (Multi-Tenancy, Policy & Security).
- OpenCost: a CNCF vendor-neutral Kubernetes cost allocation specification and agent that bills workloads at the larger of request and usage and keeps idle and overhead explicit (Autoscaling & Cost).
- OpenShift: Red Hat's Kubernetes distribution, whose operators upgrade every component including Kubernetes and the RHEL CoreOS host (Distributions & Alternatives).
- Operator pattern: combining custom resources and custom controllers to encode domain knowledge for an application into an extension of the Kubernetes API (Kubernetes Architecture).
- Optimistic concurrency (Kubernetes): updates carry the
resourceVersionthey were based on, and the API server returns409 Conflictif the object changed, so controllers reread and retry instead of locking (Kubernetes Architecture). - Overlay CNI: pod networking on a private range with SNAT on egress (Azure CNI Overlay, flannel, Calico IP-in-IP or VXLAN), conserving VPC space but hiding pods behind node IPs (Cluster Networking).
- Owner references: links that tell the control plane which objects depend on others, so deleting an owner cascades to its dependents (Kubernetes Architecture).
- Packaging and delivery: the two problems of shipping to Kubernetes: describing, parameterizing and versioning a set of objects (Helm, Kustomize), and getting them from a repository into a running cluster with drift noticed (Argo CD, Flux) (Packaging & GitOps).
- PersistentVolume (PV): a cluster-scoped piece of storage, created statically or dynamically by a driver, bound one-to-one to a claim (Storage & Stateful Workloads).
- PersistentVolumeClaim (PVC): a workload's request for storage in its namespace (size, access modes, volume mode and class), a claim check on a volume (Storage & Stateful Workloads).
- Pod Security Admission: the built-in admission controller that enforces the Pod Security Standards levels (
privileged,baseline,restricted) per namespace through labels (Multi-Tenancy, Policy & Security). - Pod-billed modes: cluster billing where the provider runs nodes and the customer pays for pod requests or pod-sized compute (Autopilot, Fargate, OKE virtual nodes), moving the packing gap to the provider (Autoscaling & Cost).
- PriorityClass: an object mapping a name to an integer priority, so the scheduler can preempt lower-priority pods when the cluster is full, with higher values reserved for system-critical classes (Kubernetes Architecture).
- Provider VPC CNI: pod networking where pods get VPC addresses (Amazon VPC CNI, GKE alias IPs, Azure Pod Subnet, OKE VCN-native), routable and attributable but subject to address exhaustion (Cluster Networking).
- Provisioned control plane: EKS's tiers of pinned control plane capacity sold on top of the cluster fee for very large or bursty clusters (Managed Kubernetes).
- Rancher: SUSE's management plane for many Kubernetes clusters rather than a single distribution (Distributions & Alternatives).
- Reclaim policy: a StorageClass's setting (defaulting to
Delete) for whether a volume's data survives when its claim is released, in effect a data-loss setting (Storage & Stateful Workloads). - Release (Helm): one installation of a chart in a namespace under a name, with a numbered history of revisions, upgraded by three-way merges and acting with the caller's permissions (Packaging & GitOps).
- Request gap: the waste between what pods request and what they use, plus space left over on nodes and node overhead, which node autoscalers buy capacity for (Autoscaling & Cost).
- Requests (Kubernetes): the CPU and memory a pod reserves, which the scheduler and every autoscaler decide on instead of usage, so a cluster can be fully booked and mostly idle (Autoscaling & Cost).
- ResourceQuota: a namespace object that caps what the namespace can consume and create, rejecting requests that would exceed it and requiring pods to set requests or limits for capped resources (Multi-Tenancy, Policy & Security).
- RHEL CoreOS: OpenShift's fully immutable, container-optimized host operating system, upgraded by OpenShift's operators (Distributions & Alternatives).
- Rook: the open-source cloud-native storage orchestrator for Kubernetes, in practice the Ceph operator that deploys and runs Ceph for block, file and object storage on the cluster's nodes (Storage & Stateful Workloads).
- RuntimeClass: the cluster-scoped Kubernetes object that selects a CRI runtime configuration such as a sandbox, adding its overhead to every pod and steering pods to nodes that support it (Multi-Tenancy, Policy & Security).
- Scheduling framework: the plugin architecture of the Kubernetes scheduler, with ordered extension points from
PreEnqueuethroughFilter,ScoreandReservetoBindandPostBind(Kubernetes Architecture). - Service (Kubernetes): a stable virtual IP for a selector of pods, typed
ClusterIP,NodePortorLoadBalancer, wheretype: LoadBalancerbuys a billed provider load balancer (Cluster Networking). - ServiceExport and ServiceImport: the Multi-Cluster Services API objects that declare a Service exported to other clusters in a clusterset and describe a service imported from it (Cluster Networking).
- sigstore policy-controller: an admission controller that validates images in opted-in namespaces against
ClusterImagePolicysignature and attestation rules (Multi-Tenancy, Policy & Security). - Skew policy: the Kubernetes version skew policy, saying which components may differ in version and by how much, and so the order in which a cluster must upgrade (Kubernetes Architecture).
- Stacked etcd: the HA topology with an etcd member on each control plane node, fewest machines but with failed coupling, so a lost node is an API server and a member together (Kubernetes Architecture).
- StatefulSet: the workload kind giving pods a stable identity (ordinal names and DNS under a headless Service), stable storage through per-pod claims, and ordered rollout, without database logic (Storage & Stateful Workloads).
- StorageClass: how Kubernetes makes volumes: a provisioner (the CSI driver), its parameters, a reclaim policy, expansion and binding mode (Storage & Stateful Workloads).
- Sync phases and waves (Argo CD): the ordering of an Argo CD sync through hooks in
PreSync,Sync,PostSync,SyncFailandPostDeletephases and numbered waves (Packaging & GitOps). - Sync status (Argo CD): whether an Application's live objects match its rendered source (Packaging & GitOps).
- Talos Linux: Sidero Labs' immutable, API-driven OS for Kubernetes with no SSH, shell or package manager, managed over mutual-TLS gRPC and upgraded with Kubernetes as one atomic image (Distributions & Alternatives).
- Tanzu (after Broadcom): VMware's Kubernetes line restructured by Broadcom, with standalone TKG ended and Kubernetes moved into vSphere Supervisor and VKS inside VMware Cloud Foundation (Distributions & Alternatives).
- ValidatingAdmissionPolicy: a declarative alternative to validating webhooks, CEL expressions evaluated inside the API server with no webhook process or network hop (Multi-Tenancy, Policy & Security).
- Values (Helm): a chart's interface: defaults in
values.yaml, overridden field by field by user files and--setflags (Packaging & GitOps). - vCluster: a virtual control plane per tenant on a host cluster; with shared nodes it is not a security boundary for untrusted tenants, while private nodes give each tenant its own CNI, CSI and compute (Multi-Tenancy, Policy & Security).
- Velero: an Apache 2.0 cluster backup tool that saves API objects to object storage and volumes by snapshot or file copy, for backup, restore and migration (Storage & Stateful Workloads).
- Vertical Pod Autoscaler (VPA): a recommender, updater and admission controller outside core Kubernetes that computes and applies pod requests, closing the request gap (Autoscaling & Cost).
- Virtual control plane per tenant: a tenancy model giving each tenant its own API server, controller manager and etcd synced to shared nodes, isolating the control plane but not the data plane (Multi-Tenancy, Policy & Security).
WaitForFirstConsumer: the late volume binding mode every provider's default class uses, so a zone-bound disk is created only after the scheduler picks the pod's node (Storage & Stateful Workloads).- Watch cache: the API server's in-memory mirror of etcd data that serves lists and watches, keeping thousands of watchers off etcd (Kubernetes Architecture).