Requests guide placement and resource sharing; limits constrain runtime consumption. They are related inputs, not a universal floor-and-ceiling guarantee for application performance. Choose them from workload behavior, contention risk and recovery requirements. Inspect the admitted Pod because defaults and policy can change the resource values submitted in a manifest. ...
A NodePort Service allocates a cluster-wide port and arranges forwarding through eligible node addresses. It is useful for external load balancers, development environments and deliberately exposed services. It does not make every address on every machine reachable, nor does it promise an application-level listening socket on each node. Network routing, firewalls, proxy implementation and traffic policy remain part of the path. ...
A PodDisruptionBudget limits eviction-based disruption for a selected group of Pods. It can help preserve serving capacity or quorum during maintenance, but cannot guarantee either. Its protection depends on the caller using the Eviction API, the selector identifying the intended members, and Ready conditions meaning something useful for the application. ...
Where a Deployment cares about total count, a DaemonSet cares about coverage: a new node immediately gains the same service. Node-level concerns — shipping logs, exposing hardware metrics, running the network fabric, enforcing policy — must exist everywhere or they exist nowhere useful. A per-node script or a sidecar in every pod approximates this and rots immediately: new nodes miss it, version skew creeps in, and nobody can answer “which nodes run the agent” without an audit. ...
Pod anti-affinity expresses where a Pod should avoid selected peers. A hostname topology can reduce shared-node exposure; a zone topology can address a broader failure domain. The rule does not create extra capacity or prove application availability. It shapes placement, while replication, readiness, storage, and failure recovery remain separate responsibilities. ...
Annotations attach non-identifying metadata to Kubernetes objects. They can record provenance, ownership notes, or information consumed by a tool. Standard label selectors do not select objects by annotation values, but that does not make annotations inert. A controller, admission component, or deployment tool can interpret a documented annotation and change behavior accordingly. Know the consumer before deciding that a metadata edit is harmless. ...
A taint repels Pods that do not tolerate its effect. A toleration removes that obstacle; it does not force placement onto specialized hardware. Dedicated-node designs usually combine a taint with a label and required node affinity, then check capacity and admission policy separately. ...
The selector turns the Service from a fixed Endpoint into a live view: refresh happens in the background, and a client never edits its config when pods restart. Declared, then given an address An ordinary ClusterIP Service provides a virtual address and, with cluster DNS, a stable discovery name for its lifetime. A selector-based Service also declares which Pods in its namespace are intended backends. Other forms differ: headless Services allocate no virtual IP, ExternalName uses DNS indirection, and selectorless Services can use separately managed EndpointSlices. ...