Kubernetes Intermediate ⎈

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web-hpa
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web-deployment     # The Deployment to autoscale
  minReplicas: 2             # Never go below 2 (for availability)
  maxReplicas: 20            # Never exceed 20 (cost ceiling)
  metrics:
    # Scale when average CPU across all pods exceeds 60%
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 60
    # Also scale when average memory exceeds 512Mi per pod
    - type: Resource
      resource:
        name: memory
        target:
          type: AverageValue
          averageValue: 512Mi
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300  # Wait 5min before scaling down (prevents flapping)
      policies:
        - type: Pods
          value: 2                         # Remove at most 2 pods per minute
          periodSeconds: 60
    scaleUp:
      stabilizationWindowSeconds: 0    # Scale up immediately — don't wait
      policies:
        - type: Percent
          value: 100                       # Can double replica count per 15s
          periodSeconds: 15

# Create an HPA imperatively (quick way — good for the CKAD exam)
kubectl autoscale deployment web-deployment \
  --min=2 --max=20 --cpu-percent=60

# Watch the HPA in real time (see current vs desired replicas)
kubectl get hpa -w

# Output columns:
# NAME      REFERENCE            TARGETS   MINPODS MAXPODS REPLICAS
# web-hpa   Deployment/web       45%/60%   2       20      3

# See resource usage per pod (requires Metrics Server)
kubectl top pods -n production
kubectl top nodes

# Generate load to test autoscaling (run in a separate terminal)
kubectl run load-generator \
  --image=busybox --rm -it --restart=Never -- \
  /bin/sh -c "while true; do wget -q -O- http://web-service; done"

# Watch pods scale up in another terminal
kubectl get pods -w

apiVersion: batch/v1
kind: Job
metadata:
  name: db-migration-v2
spec:
  completions: 1          # How many pods must succeed (default 1)
  parallelism: 1          # How many pods to run simultaneously
  backoffLimit: 4         # Retry failed pods up to 4 times before Job fails
  activeDeadlineSeconds: 300 # Kill the Job if it hasn't finished in 5 minutes
  ttlSecondsAfterFinished: 3600 # Auto-delete the Job 1 hour after it completes
  template:
    spec:
      restartPolicy: OnFailure  # REQUIRED for Jobs — Never or OnFailure only
      containers:
        - name: migrate
          image: myapp:v2.0
          command: ["python", "manage.py", "migrate"]
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: url

apiVersion: batch/v1
kind: CronJob
metadata:
  name: nightly-report
spec:
  schedule: "0 2 * * *"      # Run every day at 2:00 AM UTC
  timeZone: "America/Chicago" # K8s 1.27+ supports timezone spec
  concurrencyPolicy: Forbid  # Don't start a new job if the previous is still running
  successfulJobsHistoryLimit: 3  # Keep last 3 successful Job objects
  failedJobsHistoryLimit: 1     # Keep last 1 failed Job for debugging
  startingDeadlineSeconds: 120  # Skip if can't start within 2min of scheduled time
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: report-generator
              image: myapp:v2.0
              command: ["python", "generate_report.py", "--upload-s3"]

# Apply and watch a Job run to completion
kubectl apply -f job.yaml
kubectl get jobs -w

# See which pods the Job created
kubectl get pods --selector=job-name=db-migration-v2

# Read the logs from the completed job pod
kubectl logs job/db-migration-v2

# Manually trigger a CronJob immediately (useful for testing)
kubectl create job manual-run --from=cronjob/nightly-report

# List CronJobs and their last schedule time
kubectl get cronjobs

# Suspend a CronJob (stops future runs without deleting it)
kubectl patch cronjob nightly-report -p '{"spec":{"suspend":true}}'

# POLICY 1: Default-deny all ingress in the production namespace
# Apply this FIRST, then selectively open traffic below
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: production
spec:
  podSelector: {}   # Empty selector = select ALL pods in this namespace
  policyTypes:
    - Ingress
  # No ingress rules defined = deny all ingress

---
# POLICY 2: Only allow the web Pods to reach the database Pods
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-web-to-db
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database        # This policy applies to database pods
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: web       # Only Pods labeled app=web can connect
      ports:
        - protocol: TCP
          port: 5432         # Only on the PostgreSQL port

---
# POLICY 3: Allow ingress from a specific namespace (e.g., monitoring)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-monitoring
  namespace: production
spec:
  podSelector: {}           # All pods in production
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: monitoring   # From the monitoring namespace

# A Headless Service is required — it provides the stable DNS entries
# ClusterIP: None means no load balancing — each pod gets its own DNS record
apiVersion: v1
kind: Service
metadata:
  name: postgres
spec:
  clusterIP: None           # Headless! No load balancing.
  selector:
    app: postgres
  ports:
    - port: 5432

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  serviceName: "postgres"    # Must match the Headless Service name above
  replicas: 3
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:16-alpine
          ports:
            - containerPort: 5432
          env:
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-secret
                  key: password
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
  # volumeClaimTemplates creates a dedicated PVC per Pod automatically!
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: standard
        resources:
          requests:
            storage: 10Gi
  # Result: creates data-postgres-0, data-postgres-1, data-postgres-2

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-payments-quota
  namespace: team-payments
spec:
  hard:
    # Compute resources (requests = guaranteed, limits = maximum)
    requests.cpu: "4"          # Total CPU requests across all pods: 4 cores
    requests.memory: 8Gi      # Total memory requests: 8 GiB
    limits.cpu: "8"            # Total CPU limits: 8 cores
    limits.memory: 16Gi

    # Object count limits
    pods: "20"                 # Max 20 pods in this namespace
    services: "10"
    persistentvolumeclaims: "5"

    # Storage limits
    requests.storage: 50Gi   # Total storage across all PVCs

# See current quota usage vs limits for a namespace
kubectl describe resourcequota -n team-payments

# Output:
# Name:              team-payments-quota
# Namespace:         team-payments
# Resource           Used    Hard
# --------           ----    ----
# limits.cpu         3       8
# limits.memory      6Gi     16Gi
# pods               7       20
# requests.cpu       1500m   4
# requests.memory    3Gi     8Gi
# requests.storage   20Gi    50Gi

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: team-payments
spec:
  limits:
    - type: Container
      default:                  # Applied if container has no limits set
        cpu: 500m
        memory: 256Mi
      defaultRequest:           # Applied if container has no requests set
        cpu: 100m
        memory: 128Mi
      min:                      # Container must request at least this much
        cpu: 50m
        memory: 64Mi
      max:                      # Container cannot claim more than this
        cpu: "2"
        memory: 2Gi
      maxLimitRequestRatio:
        cpu: 4                  # Limit can be at most 4× the request
    - type: PersistentVolumeClaim
      min:
        storage: 1Gi
      max:
        storage: 20Gi           # No single PVC can claim more than 20Gi

apiVersion: v1
kind: Pod
metadata:
  name: app-with-init
spec:
  initContainers:

    # Init 1: Wait until PostgreSQL is ready to accept connections
    - name: wait-for-db
      image: busybox
      command: ['sh', '-c',
        'until nc -z postgres-service 5432; do echo waiting for db; sleep 2; done']

    # Init 2: Run database migrations (only after DB is ready)
    - name: run-migrations
      image: myapp:v2.0
      command: ["python", "manage.py", "migrate"]
      env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: db-secret
              key: url

  containers:
    # Main container only starts after BOTH init containers succeed
    - name: web
      image: myapp:v2.0
      ports:
        - containerPort: 8080

apiVersion: v1
kind: Pod
metadata:
  name: app-with-sidecar
spec:
  volumes:
    # A shared in-memory volume both containers can read/write
    - name: shared-logs
      emptyDir: {}

  containers:
    # Main container: writes application logs to the shared volume
    - name: web-app
      image: myapp:v2.0
      volumeMounts:
        - name: shared-logs
          mountPath: /var/log/app

    # Sidecar: reads from the shared volume and ships to Loki
    # The main app has NO IDEA this is happening
    - name: log-shipper
      image: grafana/promtail:latest
      args:
        - -config.file=/etc/promtail/config.yaml
      volumeMounts:
        - name: shared-logs
          mountPath: /var/log/app
          readOnly: true
      resources:
        requests:
          cpu: 50m
          memory: 32Mi
        limits:
          cpu: 100m
          memory: 64Mi

# Add a chart repository
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

# Search for charts in a repo
helm search repo bitnami/postgresql

# See all configurable values for a chart
helm show values bitnami/postgresql

# Install a chart as a release named "my-db" into the "production" namespace
helm install my-db bitnami/postgresql \
  -n production \
  --set auth.postgresPassword=mysecret \
  --set primary.persistence.size=20Gi

# Install using a values file (better than --set for many values)
helm install my-db bitnami/postgresql -f values-prod.yaml

# List all deployed Helm releases
helm list -A

# Upgrade a release (like applying new config or a new chart version)
helm upgrade my-db bitnami/postgresql -f values-prod.yaml

# Roll back a release to the previous revision
helm rollback my-db 1

# See revision history for a release
helm history my-db

# Uninstall a release (removes all K8s objects it created)
helm uninstall my-db -n production

# Preview what a chart will generate without installing (dry run)
helm install my-db bitnami/postgresql --dry-run --debug

# values.yaml — the defaults, overridable at install time
replicaCount: 3
image:
  repository: myapp
  tag: "v1.2.0"
service:
  port: 80
resources:
  limits:
    cpu: 500m
    memory: 256Mi
autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10

---
# templates/deployment.yaml — uses Go template syntax to inject values
apiVersion: apps/v1
kind: Deployment
spec:
  replicas: {{ .Values.replicaCount }}
  template:
    spec:
      containers:
        - name: {{ .Chart.Name }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
          resources:
            {{- toYaml .Values.resources | nindent 12 }}

# Override at install: helm install prod . --set image.tag=v2.0.0 --set replicaCount=5

# The single most important alias — type k instead of kubectl everywhere
alias k=kubectl

# Enable kubectl autocomplete (tab-complete resource names and types)
source <(kubectl completion bash)
complete -F __start_kubectl k

# Set your default namespace to whatever the question specifies
k config set-context --current --namespace=target-namespace

# Dry-run shortcut — generate YAML without creating anything
export DO="--dry-run=client -o yaml"
# Usage: k run mypod --image=nginx $DO > pod.yaml
# Usage: k create deploy web --image=nginx $DO > deploy.yaml

# Set your editor to vim (faster than nano for YAML editing)
export KUBE_EDITOR="vim"

# Generate Pod YAML
k run web --image=nginx:alpine --port=80 --labels=app=web \
  --dry-run=client -o yaml > pod.yaml

# Generate Deployment YAML
k create deploy web --image=nginx:alpine --replicas=3 \
  --dry-run=client -o yaml > deploy.yaml

# Generate Service YAML (expose a deployment)
k expose deploy web --port=80 --target-port=80 --type=ClusterIP \
  --dry-run=client -o yaml > svc.yaml

# Generate ConfigMap
k create configmap app-config --from-literal=LOG_LEVEL=info \
  --dry-run=client -o yaml > cm.yaml

# Generate Secret
k create secret generic db-secret --from-literal=password=s3cr3t \
  --dry-run=client -o yaml > secret.yaml

# Generate ServiceAccount
k create serviceaccount deployer --dry-run=client -o yaml > sa.yaml

# Generate Role + RoleBinding (can't dry-run bind, but can generate each)
k create role pod-reader \
  --verb=get,list,watch --resource=pods \
  --dry-run=client -o yaml > role.yaml

k create rolebinding read-pods \
  --role=pod-reader --serviceaccount=default:deployer \
  --dry-run=client -o yaml > rb.yaml

# Generate CronJob
k create cronjob cleanup \
  --image=busybox --schedule="0 2 * * *" \
  -- /bin/sh -c "echo cleaning up" \
  --dry-run=client -o yaml > cj.yaml

# Look up ANY field you forget — this is like man pages for K8s
k explain pod.spec.initContainers
k explain deployment.spec.strategy.rollingUpdate
k explain networkpolicy.spec.ingress

# Step 1: Get the big picture
k get all -n target-namespace

# Step 2: What's the Pod status? (CrashLoopBackOff? Pending? OOMKilled?)
k get pods -n target-namespace

# Step 3: Describe the failing Pod — look at Events at the bottom!
# "Back-off restarting failed container" → check logs
# "Insufficient cpu/memory" → quota or node capacity issue
# "Failed to pull image" → wrong image name or tag
# "Readiness probe failed" → app not ready on that port/path
k describe pod failing-pod-name

# Step 4: Check the logs
k logs failing-pod-name
k logs failing-pod-name --previous    # logs from the crashed previous container

# Step 5: Get a shell in a running (or debug) pod
k exec -it pod-name -- sh

# Step 6: Run a temporary debug pod
k run debug --image=busybox --rm -it --restart=Never -- sh

# Step 7: Test connectivity from inside the cluster
k run curl-test --image=curlimages/curl --rm -it --restart=Never -- \
  curl -s http://web-service.default.svc.cluster.local

# Step 8: Edit the broken resource in place
k edit pod failing-pod-name
k edit deployment web