This page is part of the ForgeSDLC knowledge base — an AI-assisted, human-directed methodology for taking product work from concept to production. For the core operating model and vocabulary, see Forge SDLC overview and What is ForgeSDLC?.
Containers package applications with dependencies. Orchestration schedules, networks, and heals those workloads at scale. Platform engineering builds internal abstractions (golden paths, self-service) so product teams ship faster without owning every low-level knob. This guide sits beside ../practices/ci-cd.md and ../practices/iac-gitops.md for deploy and cluster operations.
Heuristic: default Kubernetes when you need portability and a rich extension ecosystem; choose managed control planes unless you have strong reasons to self-host.
4. Kubernetes core concepts
Resource
Purpose
Pod
Smallest deployable unit; one or more containers sharing network/storage
Deployment
Declarative rollout and rollback of stateless apps
Service
Stable network endpoint for a set of pods
Ingress
HTTP(S) routing into cluster (often with controller)
ConfigMap
Non-secret configuration injection
Secret
Sensitive data (prefer external secret sync in prod)
PersistentVolume
Durable storage claim for stateful workloads
Namespace
Logical isolation, quotas, RBAC scope
RBAC
Roles and bindings for API access control
5. Kubernetes architecture (simplified)
flowchart TB
subgraph CP["Control plane"]
API[API server]
SCH[Scheduler]
CM[Controller manager]
ETCD[(etcd)]
end
subgraph NODE["Worker node"]
KUBELET[kubelet]
PROXY[kube-proxy]
subgraph POD["Pod"]
C1[Container]
end
end
API --> KUBELET
API --> ETCD
KUBELET --> POD
6. Workload APIs: when to use which
Workload
Use when
Deployment
Stateless HTTP services, workers with external state
StatefulSet
Stable identity, ordered rollout, persistent storage per replica
DaemonSet
One pod per node — agents, log collectors, CNI helpers
Job
Run-to-completion batch
CronJob
Scheduled jobs
7. Service mesh comparison
Mesh
Traffic management
Observability
Security
Istio
Rich (VirtualService, DestinationRule)
Telemetry, WASM extensibility
mTLS, authz policies
Linkerd
Simpler defaults
Golden metrics focus
mTLS
Consul Connect
Integrates with Consul service discovery
Via proxies and integrations
mTLS intentions
Trade-off: operational complexity vs uniform mTLS and L7 policy — adopt when multiple languages/teams need consistent policy.