Mastering Kubernetes Architecture & Troubleshooting
Kubernetes architecture relies on a decoupled control plane interacting with node worker daemons via the kube-apiserver REST endpoint. When interviewing for Senior SRE or Kubernetes Platform Architect roles, candidates must demonstrate deep knowledge of quorum recovery, ETCD raft logs, CNI packet traversal, and OOMKilled container diagnosis.
1. Control Plane Quorum & ETCD State Sync
ETCD uses Raft consensus requiring a majority of (N/2)+1 nodes. In a 3-node cluster, loss of 2 nodes causes ETCD to reject all write transactions with HTTP 503.
$ kubectl get nodes -o wide
$ etcdctl endpoint health --cluster
$ kubectl get pods -n kube-system -l component=kube-apiserver2. Container Network Interface (CNI) Packet Flow
When a Pod sends a packet to a ClusterIP service, iptables (or eBPF maps in Cilium) rewrites the destination IP (DNAT) to the target Pod IP. Troubleshooting pod connection timeouts requires inspecting network namespaces:
$ crictl pods
$ ip netns exec <POD_NETNS> tcpdump -i eth0 port 80 -nAlways distinguish between CrashLoopBackOff (application layer runtime crash) and ImagePullBackOff (container registry auth/tag failure).