Kubernetes graphs
Common setups drawn as the objects they're made of. Search them, or pick a resource type to find every setup that uses it.
- Kubernetes13 resources
Deployment, Service and Ingress: how a request reaches your Pods
Every object between a browser and a container in a classic Kubernetes web app: Deployment, ReplicaSet, Pods, Service, EndpointSlice, Ingress, TLS Secret and HPA.
- Deployment
- IngressClass
- Ingress
- Secret
- Service
- EndpointSlice
- ReplicaSet
- +3 more
- Kubernetes14 resources
Gateway API: GatewayClass, Gateway and HTTPRoute with a canary split
How Gateway API splits ownership between the platform team and app teams: GatewayClass, a shared Gateway, a ReferenceGrant for a cross-namespace certificate, and an HTTPRoute that sends 10% of traffic to v2.
- GatewayClass
- Deployment
- Gateway
- Service
- ReferenceGrant
- Secret
- HTTPRoute
- +2 more
- Kubernetes11 resources
PVC, StorageClass and CSI: how a cloud disk ends up in your Pod
Dynamic provisioning with the AWS EBS CSI driver, object by object: StatefulSet, PVC, StorageClass, PV, CSIDriver, VolumeAttachment and the controller and node plugins that create, attach and mount the disk.
- StatefulSet
- Pod
- PersistentVolumeClaim
- StorageClass
- CSIDriver
- Deployment
- PersistentVolume
- +3 more
- Kubernetes10 resources
RBAC: how a ServiceAccount gets its permissions
A CI deployer's permissions traced through RBAC: ServiceAccount, projected token, Role and RoleBinding, a ClusterRole reused in one namespace, and a ClusterRoleBinding for cluster-wide reads.
- Pod
- ServiceAccount
- Projected token
- API server
- Role
- RoleBinding
- ClusterRole
- +1 more
- cert-manager10 resources
cert-manager with Let's Encrypt: Certificate, CertificateRequest, Order and Challenge
Every object cert-manager creates to get a Let's Encrypt certificate through an HTTP-01 challenge: ClusterIssuer, Certificate, CertificateRequest with its CSR, ACME Order, Challenge, solver Pod and the final TLS Secret.
- ClusterIssuer
- Secret
- Ingress
- Certificate
- CertificateRequest
- Order
- Challenge
- +1 more
- cert-manager11 resources
A private CA with cert-manager and trust-manager
Run your own certificate authority inside the cluster: a self-signed root, a CA ClusterIssuer, leaf certificates for internal services, and trust-manager copying the root to every namespace so clients trust it.
- ClusterIssuer
- Certificate
- Secret
- CertificateRequest
- Deployment
- Bundle
- ConfigMap
- Istio13 resources
Istio traffic management: Gateway, VirtualService, DestinationRule and policies
The Istio objects behind a canary release in a sidecar mesh: ingress Gateway, VirtualService routing, DestinationRule subsets, strict mTLS with PeerAuthentication, AuthorizationPolicy and an EnvoyFilter.
- Deployment
- Gateway
- Secret
- EnvoyFilter
- VirtualService
- DestinationRule
- Service
- +2 more
- Flux CD14 resources
Flux dependencies: Git and OCI sources, Kustomizations and HelmReleases
How Flux objects depend on each other: a GitRepository feeding two Kustomizations ordered with dependsOn, a HelmRelease from a HelmRepository, another from an OCIRepository, variable substitution and Slack alerts.
- Secret
- GitRepository
- Kustomization
- ConfigMap
- HelmRepository
- HelmRelease
- HelmChart
- +4 more
- Argo CD10 resources
Argo CD: ApplicationSet, AppProject and the Applications it generates
How Argo CD turns one ApplicationSet into an Application per app directory, which AppProject limits what they may deploy, and where the repository and cluster credentials live.
- Secret
- AppProject
- ApplicationSet
- Application
- StatefulSet
- Deployment
- Kubernetes13 resources
Inside an OCI image: tag, index, manifests, config and layers
How a registry stores a multi-platform container image, with its attestations and a signature, and how containerd walks from a tag to a running container's root filesystem.
- Pod
- Container runtime
- Tag
- Image index
- Image manifest
- Attestation manifest
- Image config
- +3 more
- Helm12 resources
OCI artifacts: Helm charts, Flux artifacts and image volumes
Three kinds of content in one registry, each a manifest with its own media types: a Helm chart pulled by helm, a Flux artifact pulled by an OCIRepository, and a data image mounted into a Pod as an image volume.
- Image manifest
- Config
- Layer
- Kustomization
- OCIRepository
- Pod
- Container runtime