We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Kubernetes Containers
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Kubernetes Containers
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
You have a Deployment defined in Git: 3 replicas, 512MB memory limit, image v1.2.3. Everything matches. Then:
kubectl scale deployment api --replicas=5 during a traffic spike and forgets to update Gitkubectl set image deployment api api=v1.2.4 directlyThree months later, the cluster is running 5 replicas of v1.2.4 with a modified ConfigMap. Git says 3 replicas of v1.2.3 with the original ConfigMap. Nobody knows which is "correct." A new team member applies the Git config and accidentally reverts the production hotfix.
Configuration drift is the gradual divergence between your declared infrastructure (in Git, , Helm charts) and the actual running state. It's insidious because each individual change seems harmless, but the accumulated drift creates a system that nobody fully understands.
Prevention strategies:
| Strategy | How It Works | Tools |
|---|---|---|
| GitOps | Git is the ONLY way to change infrastructure | ArgoCD, Flux |
| Admission control | Reject manual kubectl changes | OPA Gatekeeper, Kyverno |
| Drift detection | Alert when cluster differs from Git | ArgoCD sync status, plan |
| Immutable infrastructure | Replace, never patch | Container images, Packer AMIs |
| RBAC restrictions | Limit who can make cluster changes | K8s RBAC, least privilege |
ArgoCD drift detection: ArgoCD continuously compares your Git repo to the cluster state. If they differ:
The cultural shift: Drift prevention requires discipline. "Quick fixes" via kubectl must be banned in production. Every change goes through Git, code review, merge, automated deployment. This feels slower in emergencies, but it prevents the drift that causes the next emergency.