The error ‘Insufficient cpu’ indicates the cluster scheduler cannot find a node with enough allocatable CPU to satisfy the pod’s requests. Scaling up the node pool (adding more nodes or larger nodes) directly addresses the resource shortage at the cluster level. Simply recreating the pod or adding a nodeSelector won’t create new capacity, and editing requests might compromise the application’s needs.

The Endpoints object is automatically populated by the control plane based on label selectors. If the Endpoints list is empty, it means the Service’s selector is not finding any Pods with matching labels. This is a fundamental and common configuration issue. While other issues could prevent traffic flow, they would not result in an empty Endpoints list if the selector matches.

In a Service definition, `port` is the Service’s own port, while `targetPort` is the port on the Pod’s container(s) where the application is actually listening. This command creates a Service that listens on port 80 and forwards traffic to the Pods’ container port 9376.

The `–disable-eviction` flag (or its older form `–disable-eviction=true`) instructs `kubectl drain` to use the older, slower deletion method instead of the Eviction API. This is necessary because the Eviction API respects PodDisruptionBudgets (PDBs). If draining with eviction is stuck due to a PDB, you might use `–disable-eviction` cautiously, but the safer standard practice is to let the drain command respect the PDB, which it does by default using the Eviction API. The key point tested is understanding that `kubectl drain` uses the Eviction API which respects PDBs. The correct action for safe draining is to *not* bypass it, so the most crucial aspect is knowing the default behavior. Among the listed options, `–disable-eviction` is the one that relates to the PDB/eviction mechanism, even though using it would be a workaround, not the primary safe method.

The `subPath` field is used to mount a single file or a specific subdirectory from a volume (like a ConfigMap) instead of the entire volume. This prevents the mount from hiding other files that might exist at the destination directory (`/etc/config`). The other options use non-existent fields (`key`, `file`, `configFile`) in the `volumeMounts` context.

`kubectl cordon ` marks a node as unschedulable. This prevents new Pods from being scheduled onto the node but does not affect existing Pods. It is the correct first step before a drain operation or for temporary isolation. `kubectl drain` also cordons but then proceeds to evict Pods. A taint could achieve a similar effect but is not the standard command for this temporary operational task.

When a Pod is stuck in `ContainerCreating`, the problem is almost always at the Pod specification level: image pull errors (wrong name, permissions), missing volumes (e.g., referenced ConfigMap/Secret doesn’t exist), or resource issues. `kubectl describe pod` on one of the stuck Pods will show detailed status, events, and error messages specific to that Pod’s scheduling and creation phase, providing the most direct diagnostic information.

After creating the Pod from `pod.yaml`, the cluster may mutate the specification (adding default fields, status, etc.). The command `kubectl get pod -o yaml` fetches the complete, live object configuration as stored by the API server. Redirecting this output to a file (`> applied-pod.yaml`) gives you an exact record of what was applied and is now active. `–dry-run` only simulates, `–record` is for tracking rollout causes, and `–save-config` is not a valid flag for `apply`.

Mounting Secrets as volumes is generally preferred over environment variables. Volumes support dynamic updates (if the Secret is updated, the mounted file can be updated). More importantly, they are less likely to be accidentally exposed in log files, shell histories, or debugging tools compared to environment variables, which are often visible in process listings. It also aligns with the principle of treating secrets as files, similar to traditional applications.

The error ‘Insufficient cpu’ indicates the cluster scheduler cannot find a node with enough allocatable CPU to satisfy the pod’s requests. Scaling up the node pool (adding more nodes or larger nodes) directly addresses the resource shortage at the cluster level. Simply recreating the pod or adding a nodeSelector won’t create new capacity, and editing requests might compromise the application’s needs.0