Requests guide placement and resource sharing; limits constrain runtime consumption. They are related inputs, not a universal floor-and-ceiling guarantee for application performance. Choose them from workload behavior, contention risk and recovery requirements. Inspect the admitted Pod because defaults and policy can change the resource values submitted in a manifest. ...
A NodePort Service allocates a cluster-wide port and arranges forwarding through eligible node addresses. It is useful for external load balancers, development environments and deliberately exposed services. It does not make every address on every machine reachable, nor does it promise an application-level listening socket on each node. Network routing, firewalls, proxy implementation and traffic policy remain part of the path. ...
A PodDisruptionBudget limits eviction-based disruption for a selected group of Pods. It can help preserve serving capacity or quorum during maintenance, but cannot guarantee either. Its protection depends on the caller using the Eviction API, the selector identifying the intended members, and Ready conditions meaning something useful for the application. ...
A Deployment targets a replica count; a DaemonSet targets coverage of eligible nodes. That is useful for node-level log collectors, network agents, and device plugins. A newly eligible node creates reconciliation work, not an immediate guarantee that its agent is running or ready. Selection rules, scheduling, image pulls, startup, and node health can all delay useful coverage. ...
Pod anti-affinity expresses where a Pod should avoid selected peers. A hostname topology can reduce shared-node exposure; a zone topology can address a broader failure domain. The rule does not create extra capacity or prove application availability. It shapes placement, while replication, readiness, storage, and failure recovery remain separate responsibilities. ...
Annotations attach non-identifying metadata to Kubernetes objects. They can record provenance, ownership notes, or information consumed by a tool. Standard label selectors do not select objects by annotation values, but that does not make annotations inert. A controller, admission component, or deployment tool can interpret a documented annotation and change behavior accordingly. Know the consumer before deciding that a metadata edit is harmless. ...
A taint repels Pods that do not tolerate its effect. A toleration removes that obstacle; it does not force placement onto specialized hardware. Dedicated-node designs usually combine a taint with a label and required node affinity, then check capacity and admission policy separately. ...
The selector turns the Service from a fixed Endpoint into a live view: refresh happens in the background, and a client never edits its config when pods restart. The Service object lifetime bounds address stability. Membership, routing convergence and successful traffic remain separate. The exact allocator model passed again; no Kubernetes execution was added. Declared, then given an address An ordinary ClusterIP Service provides a virtual address and, with cluster DNS, a stable discovery name for its lifetime. A selector-based Service also declares which Pods in its namespace are intended backends. Other forms differ: headless Services allocate no virtual IP, ExternalName uses DNS indirection, and selectorless Services can use separately managed EndpointSlices. ...