Manifest field cheat sheet

generation increments on every spec change; observedGeneration is the one a controller has acted on.

Equal means the controller has caught up. Generation ahead means your change is accepted and not yet applied, which is a sharper question than "is it ready".

Names the parent object. Drives garbage collection and controller adoption.

Deleting the parent deletes the children through this field. Nothing walks a list.

Holds an object in Terminating until a controller removes the entry.

The reason a namespace or PVC hangs in Terminating forever when the controller that owns the finalizer is gone.

What selectors match. The only thing selectors match.

Not names, not annotations. A Service with no endpoints or a NetworkPolicy that does nothing is nearly always a label that does not match.

Arbitrary metadata for tools. Never used for selection.

Capped at 256KB in total, which is what breaks `kubectl apply` on very large CRDs since it stores the manifest here.

What the scheduler reserves. Determines where the Pod can be placed.

Placement is by requests, not usage. A node at 5% CPU with 100% of requests allocated will not accept another Pod.

The ceiling. Exceeding a memory limit is an OOM kill; exceeding a CPU limit is throttling.

Absent limits mean the container can use the whole node. Memory is not compressible, so a memory limit is the one that terminates rather than slows.

Failing it restarts the container.

Without one, "the process is running" is the only health signal, so a deadlocked application stays Ready and keeps taking traffic.

Failing it removes the Pod from Service endpoints without restarting it.

The difference from liveness is restart versus remove. A Running Pod that is not Ready has a failing readiness probe.

Suspends the liveness probe until the application has started.

The fix for a slow-starting application being killed by liveness before it is ready, which otherwise loops forever.

How long between SIGTERM and SIGKILL. Default 30.

Refuse to start a container whose image runs as root.

Pod-level securityContext sets defaults; container-level overrides them. Read both when a setting appears not to apply.

Mount the container's filesystem read-only. Anything that needs to write gets an emptyDir.

Import every key in a ConfigMap as environment variables.

Environment variables are read once at container start. Editing the ConfigMap changes nothing until the Pod restarts.

Inject the Pod's own metadata, such as metadata.name or status.podIP.

The reliable way to give a container its own identity, rather than shelling out to hostname.

Run to completion, in order, before the app containers start.

A failing init container restarts the whole Pod, so the Pod never reaches Running. Read init container logs, not the app's.

Hard requirement on node labels. Simplest form, no expressions.

Hard node requirement with operators: In, NotIn, Exists, Gt, Lt.

IgnoredDuringExecution means a Pod already running is not evicted when the node stops matching.

A weighted preference. Never blocks scheduling.

If a Pod must not run somewhere, preferred is the wrong field; it will schedule there when nothing better is free.

Permission to be scheduled onto a tainted node. Does not attract, only permits.

A toleration with no key and operator Exists tolerates every taint, including the control plane's and NoExecute pressure taints.

Spread Pods across a topology key within maxSkew.

nodeTaintsPolicy: Honor matters: without it a tainted node counts as a domain holding zero Pods, and maxSkew caps how many can be placed anywhere.

Higher priority preempts lower when the cluster is full.

Preemption only works downward. A high-priority Pod that still will not fit stays Pending, having already evicted something.

Which Pods this controller owns. Immutable after creation.

Cannot be changed. A label transformer that touches it leaves an object only deletion can fix.

How many extra Pods may exist and how many may be missing during a rollout.

maxUnavailable: 0 with maxSurge: 1 is the safest and slowest. Both zero is rejected: nothing could ever change.

After this, Progressing flips to False with reason ProgressDeadlineExceeded. Default 600.

The only signal that distinguishes a stalled rollout from a slow one. Available=True can be true throughout a broken deploy.

How many old ReplicaSets to keep for rollback. Default 10.

The headless Service that gives each Pod a stable DNS name.

Required, and the Service must have clusterIP: None. Without it the per-Pod DNS names do not resolve.

One PVC per Pod, named <template>-<statefulset>-<ordinal>.

PVCs are not deleted when the StatefulSet is, deliberately. The names are generated and cannot be edited, which makes a restore awkward.

OrderedReady creates Pods one at a time; Parallel creates them together.

How many failures before the Job is marked Failed. Default 6.

Allow, Forbid or Replace when a run is still going at the next scheduled time.

Allow is the default and the usual cause of runs piling up on top of each other.

How late a missed run may still start. Beyond it the run is skipped.

The container port traffic is sent to. `port` is what clients use.

A mismatch here is a 502 through an Ingress and a connection refused directly. Endpoints exist, so it does not look like a Service problem.

Headless: no virtual IP, DNS returns the Pod addresses.

Required for a StatefulSet's per-Pod names, and the right shape for a client that does its own balancing.

Cluster forwards to any node and SNATs; Local keeps the client IP and only uses local Pods.

Local preserves the source IP and makes the address dead on a node with no ready endpoint.

Which controller handles this Ingress.

Naming a class nothing implements is accepted silently: an empty ADDRESS and 404 for everything, with no status explaining it.

Prefix matches whole path elements; Exact is literal; ImplementationSpecific allows regexes.

Prefix /blue never matches /bluefish. A rewrite with a capture group needs ImplementationSpecific.

Rewrite the path before forwarding, using capture groups from the path regex.

Without it the full path is forwarded, and the 404 you get is the backend's, not the controller's. Read the response body for a server footer.

Hosts and the Secret covering them. The Secret must be type kubernetes.io/tls in the same namespace.

Adding this turns on an implicit HTTPS redirect, so plain HTTP starts returning 308.

Which namespaces may attach routes: Same, All or Selector.

The enforcement point for the platform-versus-application split. A refused route says Accepted=False(NotAllowedByListeners).

Relative weights across backends. Traffic splitting with no annotations.

Relative, not percentages: 1 and 3 is a 25/75 split. weight: 0 keeps a backend configured and sends it nothing.

An empty selector matches every Pod in the namespace, not none.

With policyTypes and no rules, that is a namespace-wide deny. Two characters from something that has no effect.

Select another namespace. A bare podSelector only ever matches the policy's own namespace.

Two selectors in one list element are ANDed; separate elements are ORed. One hyphen changes the meaning substantially.

ReadWriteOnce is one node, ReadWriteOncePod is one Pod, ReadWriteMany is many nodes.

ReadWriteOnce is per node, not per Pod: two Pods on the same node can share it. Most block storage cannot do ReadWriteMany at all.

Which provisioner handles the claim. Empty string means no dynamic provisioning.

Naming a class that does not exist leaves the PVC Pending forever, and the visible symptom is an unschedulable Pod.

Immediate creates the volume at once; WaitForFirstConsumer waits for a Pod so the scheduler picks the node first.

For topology-constrained storage, WaitForFirstConsumer avoids `volume node affinity conflict`.

Delete removes the backing volume with the PVC; Retain keeps it.

Retain for anything whose loss matters, and accept that cleanup becomes manual.

Whether a PVC's size may be increased. Default false.

Only increased. A resize often stops at FileSystemResizePending until the Pod restarts.

Populate a new volume from a VolumeSnapshot.

A restore is a new volume, not a rewind. The workload has to be pointed at the new claim by hand.

Delete removes the backend snapshot with the object; Retain keeps it.

With Delete, deleting the namespace destroys the snapshots in it, backend data included.

Caps totals in a namespace: CPU, memory, object counts.

A quota on requests.cpu makes a Pod without a request invalid, which surprises people until a LimitRange supplies defaults.

Default and maximum requests and limits for Pods that do not set their own.

What is permitted. The core group is the empty string.

A new CRD is not covered by existing roles unless they use wildcards, in which case adding a CRD silently widens them.

The Role or ClusterRole being granted. Immutable.

A RoleBinding to a ClusterRole grants it within one namespace only, which is the usual way to reuse the built-in roles safely.

Stop mounting an API token into Pods that do not call the API.

Set on the ServiceAccount or the Pod. Most workloads never talk to the API and should not carry a credential.