Glossary

Terms used throughout the codebase, the Kubernetes API, and the contributor culture. Definitions point back to the source files where the term is anchored.

Core API objects

• Pod — the smallest deployable unit. One or more containers plus shared volumes and network namespace. Defined in staging/src/k8s.io/api/core/v1/types.go. See primitives/pod.md.
• Node — a worker machine. Registered by kubelet via pkg/kubelet/kubelet_node_status.go. See primitives/node.md.
• Namespace — a virtual cluster scope. Most resources are namespaced; cluster-scoped resources (Node, ClusterRole, PV) are not.
• Service — a stable network identity for a set of pods. Implemented by kube-proxy programming the data plane.
• EndpointSlice — the modern, scalable replacement for the legacy Endpoints resource. See pkg/registry/discovery/.
• Deployment / ReplicaSet / StatefulSet / DaemonSet / Job / CronJob — the workload controllers in pkg/controller/{deployment,replicaset,statefulset,daemon,job,cronjob}.
• PersistentVolume (PV) / PersistentVolumeClaim (PVC) — durable storage abstractions. Bound by the PV controller in pkg/controller/volume/.
• ConfigMap / Secret — key/value data, mounted into Pods or exposed via env vars.
• CustomResourceDefinition (CRD) — user-defined API objects. Implemented in the staging module apiextensions-apiserver.
• ResourceClaim / DeviceClass / ResourceSlice — Dynamic Resource Allocation (DRA) primitives. See staging/src/k8s.io/dynamic-resource-allocation.

Components

• kube-apiserver — the API front-door. Code in cmd/kube-apiserver and pkg/kubeapiserver, pkg/controlplane.
• kube-controller-manager (KCM) — the bag of controllers running off the API server. Code in cmd/kube-controller-manager and pkg/controller.
• kube-scheduler — the pod-to-node binder. Code in cmd/kube-scheduler and pkg/scheduler.
• kubelet — the per-node agent. Code in cmd/kubelet and pkg/kubelet.
• kube-proxy — the per-node service proxy. Code in cmd/kube-proxy and pkg/proxy.
• kubectl — the CLI. Code in cmd/kubectl and the staging library staging/src/k8s.io/kubectl.
• kubeadm — the cluster bootstrapper. Code in cmd/kubeadm.
• cloud-controller-manager (CCM) — the cloud-vendor controller binary. The library is staging/src/k8s.io/cloud-provider.

Concepts

• Reconcile loop — a controller pattern: observe current state, observe desired state, compute the diff, take action, repeat. Implemented via informers and work queues from staging/src/k8s.io/client-go.
• Informer — a list-watch loop with a local cache plus event handlers. See staging/src/k8s.io/client-go/tools/cache/.
• Workqueue — a deduplicated, rate-limited queue used by every controller. staging/src/k8s.io/client-go/util/workqueue.
• Lister / Indexer — read-only typed accessors on top of informer caches.
• Scheme / Codec — runtime.Scheme knows how to encode/decode/convert between API versions. Generated codecs live in zz_generated_conversion.go files.
• Strategy — per-resource validation / defaulting / status policy interface, used by the registry layer (pkg/registry/<group>/<resource>/strategy.go).
• Storage — the etcd-backed REST endpoint for a resource. Built by staging/src/k8s.io/apiserver/pkg/registry/generic.
• Admission — pluggable mutating + validating step run on every write. Built-ins in plugin/pkg/admission, dynamic in staging/src/k8s.io/apiserver/pkg/admission/plugin/webhook.
• Feature gate — boolean toggle for a named alpha/beta feature. Declared in pkg/features/kube_features.go and similar files.
• Conformance — the subset of API behaviour every certified Kubernetes distribution must implement. Tagged tests live in test/conformance/ and test/e2e/.

Container runtime / network / storage interfaces

• CRI (Container Runtime Interface) — gRPC contract between kubelet and a runtime (containerd, CRI-O). Lives in staging/src/k8s.io/cri-api/. Implemented on the kubelet side in pkg/kubelet/kuberuntime/.
• CNI (Container Network Interface) — the plugin spec the kubelet uses to attach pods to a network. Consumed via pkg/kubelet/network/ and bootstrapped by the chosen network plugin (Calico, Cilium, etc.).
• CSI (Container Storage Interface) — gRPC contract for volume drivers. Kubelet integration in pkg/volume/csi/. Library at staging/src/k8s.io/csi-translation-lib.
• OCI image / runtime — Open Container Initiative formats consumed via the runtime.

Authentication and authorization

• RBAC — Role-Based Access Control. Resources Role, ClusterRole, RoleBinding, ClusterRoleBinding. Authorizer in staging/src/k8s.io/apiserver/pkg/authorization/rbac/.
• ABAC — legacy attribute-based authorizer.
• Node authorizer — restricts kubelets to only objects related to their own node. plugin/pkg/auth/authorizer/node/.
• Service account — a machine identity used by pods. Tokens minted via pkg/serviceaccount/.
• OIDC — OpenID Connect token authentication. staging/src/k8s.io/apiserver/pkg/authentication/token/oidc.
• Webhook (authn/authz) — delegate the decision to an external service.

Scheduling

• Scheduling framework — pluggable extension points (PreFilter, Filter, PostFilter, Score, NormalizeScore, PreBind, Bind, Reserve, Permit). See pkg/scheduler/framework/interface.go.
• Profile — a named bundle of plugins with optional weights, configured via KubeSchedulerConfiguration.
• Predicate / Priority — the legacy names for filter (yes/no fit) and score (0-100). Now split into framework plugins.
• Preemption — evicting lower-priority pods to make room. Implemented by pkg/scheduler/framework/preemption/ and pkg/scheduler/framework/plugins/defaultpreemption.
• Topology Spread / Inter-pod Affinity / Taints / Tolerations / NodeAffinity — first-class scheduling constraints, each with its own plugin under pkg/scheduler/framework/plugins/.
• DRA (Dynamic Resource Allocation) — schedule pods that need named devices (GPUs, accelerators). pkg/scheduler/framework/plugins/dynamicresources/, plus staging/src/k8s.io/dynamic-resource-allocation.

Build and release

• SIG (Special Interest Group) — a group of contributors who own a chunk of the project (e.g. SIG Node, SIG Storage). Owners files declare SIG membership.
• OWNERS file — a YAML file in any directory listing approvers and reviewers. Bot-driven review uses these.
• Prow / Tide — the CI bots that gate every PR. Tracked at kubernetes/test-infra (separate repo).
• bazel — used historically; no longer the active build system. The current build is Go modules + make.
• vendor/ — the committed dependency tree. Updated via hack/update-vendor.sh.

Internal jargon

• kubeadm phase — a unit of cluster bootstrap. cmd/kubeadm/app/phases/.
• kubelet PLEG — Pod Lifecycle Event Generator. pkg/kubelet/pleg/.
• CGroup driver — kubelet's choice between systemd and cgroupfs to drive container resource limits.
• PodSandbox — the CRI concept that owns the network namespace and IP for a pod.
• InfraContainer / pause container — the implementation detail behind a PodSandbox.
• eviction — kubelet kicking pods off a node under resource pressure. pkg/kubelet/eviction/.
• Watchdog — kubelet's self-monitoring goroutine. pkg/kubelet/watchdog/.
• HollowNode / kubemark — fake kubelet/proxy used for scale testing. pkg/kubelet/kubemark/, pkg/proxy/kubemark/, cmd/kubemark/.
• Hollow proxy / hollow kubelet — components inside kubemark.
• Skew — a supported version gap (e.g. kubelet up to two minors behind kube-apiserver).
• Static pod — a pod managed by kubelet from a manifest on disk, not via the API server. Used by kubeadm to bootstrap the control plane.
• kubelet config drop-in — extension files that override /var/lib/kubelet/config.yaml.