The one sentence
Kubernetes is a distributed system that stores a desired state, observes reality, and continuously runs control loops to reduce the difference.
When you apply a Deployment, you are not instructing a machine to “start three containers.” You are writing an object to the API. Controllers notice the object and create lower-level objects. The scheduler chooses nodes for unscheduled Pods. Each node's kubelet asks its container runtime to make those Pods real. If one dies, the system does not rewind history—it observes a mismatch and reconciles again.
This distinction explains almost everything: why a Deployment survives Pod deletion, why editing a running container is futile, why status can lag behind spec, and why troubleshooting starts with the API objects and events rather than an SSH session.
Follow one deployment
The API server is the hub, not a traffic proxy for your application. Cluster components act as API clients. The control plane stores cluster state and makes decisions; nodes run workload containers and node agents. In GKE, Google manages the control plane. In Autopilot, Google also manages the node infrastructure; in Standard, you manage node pools and their configuration.
The object ladder
| Object | Owns or selects | Job |
|---|---|---|
| Deployment | ReplicaSet | Declarative rollout for stateless replicas |
| ReplicaSet | Pods by labels | Keep a replica count |
| Pod | Containers | Smallest schedulable unit; shared network and volumes |
| Service | Pods by labels | Stable virtual endpoint over changing backends |
| Node | Scheduled Pods | Capacity and kubelet boundary |
Exam trap: a Service does not own Pods and does not create them. It selects endpoints. A Deployment does not directly restart a container; its controllers maintain objects until the kubelet can realize them.
Read YAML as a contract
apiVersion: apps/v1
kind: Deployment
metadata:
name: checkout
spec: # desired state
replicas: 3
selector:
matchLabels: {app: checkout}
template:
metadata:
labels: {app: checkout} # must match selector
spec:
containers:
- name: app
image: us-docker.pkg.dev/acme/apps/checkout:v4
resources:
requests: {cpu: 250m, memory: 256Mi}
readinessProbe:
httpGet: {path: /ready, port: 8080}
status: # observed state; written by controllers
availableReplicas: 3metadata gives identity, spec states intent, and status reports observation. The generation and observed-generation pattern helps you detect whether a controller has processed the latest spec. Labels create relationships; owner references encode lifecycle.