How Kubernetes Enforces kubectl Version Compatibility

▶ Watch (2:40)

The first question: a cluster runs API server version 1.44. Which kubectl versions are valid? The version skew policy allows kubectl to be at most one minor version older or newer than the API server. Versions 1.43, 1.44, and 1.45 all work. Vache also demoed the kube-scheduler finding a suitable node and placing the pod. That scheduling behavior holds across minor versions, which is the practical implication of the skew rule.

Three Secret Types and the view-secret Plugin

▶ Watch (5:08)

Question two covers the three Kubernetes secret types. Vache creates a generic secret with a password, a docker-registry secret with login credentials and registry URL, and a TLS secret with a key and certificate. In a live cluster, the data field stores each value as base64. Retrieving plaintext requires decoding manually or using the kubectl view-secret plugin. The plugin decodes the value automatically and, for a TLS secret, extracts both key and certificate without any manual step.

Why Namespaces Get Stuck on Deletion

▶ Watch (8:35)

A cluster with zero nodes can still host a namespace. Vache confirmed it live: the namespace became Active within seconds. The problem arrives at deletion. Attempting to delete the namespace left it stuck in Terminating. The cause: metrics-server was in a pending state, so the namespace controller could not complete the finalizer. Without metrics-server, the namespace never clears. This trap appears often in minimal clusters where metrics-server is not deployed before cleanup runs.

What the API Server Does When CPU Requests Are Missing

▶ Watch (11:12)

An HPA targeting CPU usage works even if the pod spec defines only a CPU limit and no CPU request. Vache deployed an app with only a CPU limit, then checked the pod with kubectl get. The API server had already set the CPU request equal to the limit. The HPA targeted 40% average CPU consumption. Under simulated load, it adjusted the pod count. The API server fills in the missing field without any annotation or admission webhook.

Topology-Aware Traffic Routing via EndpointSlices

▶ Watch (17:27)

Question six asks how a service routes traffic: to any ready pod cluster-wide, to pods in the same zone, or to pods on the same node. EndpointSlices expose each pod’s node and zone. Using that metadata, a service can route to a specific zone. The trafficDistribution field lets operators set preferences. For Cilium users, preferClose (an alias for PreferSameZone) was nearly merged at talk time. Vache’s demo confirmed traffic from a pod in zone A stayed within zone A.

Notable Quotes

yes but no you have to get the secret Aurélie Vache · ▶ 7:25

it is easy to get the value of secret Aurélie Vache · ▶ 7:58

Quick, be fast and accurate. Aurélie Vache · ▶ 23:50

Key Takeaways

  • kubectl must stay within one minor version of the API server to remain in the supported skew window.
  • Kubernetes secrets store values as base64; the view-secret plugin decodes them without a manual step.
  • A namespace stuck in Terminating often means metrics-server is pending and the controller has no finalizer path.
  • The API server sets CPU request equal to CPU limit when only a limit is defined, letting HPA scale normally.
  • EndpointSlices expose pod zone and node, enabling topology-aware routing without any custom controller.

About the Speaker(s)

Aurélie Vache is a Developer Advocate at OVHcloud, CNCF Ambassador, Docker Captain, and GDE. She has worked in development and operations for over 20 years, created and maintains developers.events, and has organized conferences since 2016. She is also a technical writer, book author and reviewer, sketchnoter, and international speaker.