Containers package an application and dependencies while sharing the host kernel. Kubernetes reconciles desired state. Deployments manage stateless replicas; StatefulSets provide stable identities and storage association; Services provide stable discovery and routing; Ingress or Gateway resources expose HTTP traffic.

Readiness determines whether an instance should receive traffic. Liveness detects a process that may need restarting. Aggressive liveness checks can create restart loops during transient overload, while incorrect readiness can route requests to an instance that cannot serve them. Startup probes help applications with long initialization.

Running a database in Kubernetes does not automatically make it highly available. Stateful workloads require storage guarantees, backups, upgrade plans, failover testing, and operational expertise. A managed database may be a better trade-off when its constraints fit the use case.

CPU and memory requests influence scheduling; limits constrain resource use and can cause throttling or termination when configured poorly. Horizontal autoscaling reacts to metrics, but adding application replicas can worsen database overload if the shared dependency is the bottleneck.

Queue consumers may scale on lag age or queue depth, with controls to avoid rapid oscillation. Pod disruption budgets and topology spread reduce the risk that maintenance removes too much capacity, but they cannot create spare nodes or repair a single shared dependency.

Test node loss, rolling upgrades, startup delays, and scale-out under load. Monitor capacity before and after autoscaling, and ensure connection pools and external quotas are adjusted for the maximum replica count.

Infrastructure as Code makes infrastructure changes reviewable and reproducible. Protect Terraform state, use locking, review plans, restrict permissions, and avoid exposing secrets in state. State maps declared resources to real infrastructure and is operationally sensitive.

Cloud networking includes VPCs, subnets, routes, security groups, private endpoints, NAT, and load balancers. Distinguish public ingress from private service/database paths, and define egress controls, DNS, certificates, and workload identity.

A service mesh can provide workload identity, mutual TLS, traffic policy, and telemetry through data-plane proxies and a control plane. It also adds configuration and debugging complexity. Do not enable mesh retries blindly; they can duplicate side effects or multiply traffic. Establish ownership for mesh policies and understand their interaction with application deadlines.