❌ Manual restarts needed
❌ Manual load balancing
❌ Manual rolling updates
❌ Manual scaling
❌ Manual failover

✅ Auto-healing (restart failed pods)
✅ Auto load balancing
✅ Zero-downtime upgrades
✅ Automatic scaling
✅ Self-failover

apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
spec:
  containers:
  - name: nginx
    image: nginx:1.21
    ports:
    - containerPort: 80

apiVersion: v1
kind: Pod
metadata:
  name: complex-pod
spec:
  # Init container (runs once at startup)
  initContainers:
  - name: init-db
    image: busybox:1.28
    command: ['sh', '-c', 'until nslookup db; do echo waiting; sleep 2; done']
  
  # Main container
  containers:
  - name: app
    image: app:v1
    ports:
    - containerPort: 8080
  
  # Sidecar container (log collector)
  - name: logging
    image: fluentd:v1.14
    volumeMounts:
    - name: app-logs
      mountPath: /logs
  
  volumes:
  - name: app-logs
    emptyDir: {}

apiVersion: apps/v1
kind: ReplicaSet
metadata:
  name: nginx-rs
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.21

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deploy
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # Extra pod during update
      maxUnavailable: 0  # Never take down pods
  
  selector:
    matchLabels:
      app: nginx
  
  template:
    metadata:
      labels:
        app: nginx
        version: v1.21
    spec:
      containers:
      - name: nginx
        image: nginx:1.21
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "100m"
          limits:
            memory: "128Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 5

1. Update image: kubectl set image deployment/nginx nginx=nginx:1.22
2. New ReplicaSet created with v1.22
3. Pods gradually replaced (old removed, new added)
4. Rollback available if needed: kubectl rollout undo deployment/nginx

metadata:
  labels:
    app: my-app
    version: v1.0
    tier: frontend
    env: production
    owner: platform-team

kubectl get pods -l app=my-app
kubectl get pods -l env=production,version=v1.0
kubectl get pods -l 'env in (prod,staging)'

labels:
  app.kubernetes.io/name: my-app
  app.kubernetes.io/instance: my-app-prod
  app.kubernetes.io/version: "1.0"
  app.kubernetes.io/component: database
  app.kubernetes.io/part-of: platform
  app.kubernetes.io/managed-by: helm

apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  type: ClusterIP
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 8080

spec:
  type: NodePort
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 8080
    nodePort: 30080  # 30000-32767

spec:
  type: LoadBalancer
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 8080

spec:
  type: ExternalName
  externalName: rds.amazonaws.com
  ports:
  - port: 5432

Pod A → query DNS "nginx-service" → 10.0.0.5 (ClusterIP)
     → send request to 10.0.0.5:80
     → kube-proxy intercepts → load-balances to Pod B
     → Pod B responds through Service

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080
  
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-service
            port:
              number: 3000
  
  tls:
  - hosts:
    - api.example.com
    - app.example.com
    secretName: tls-certificate

External Client
    ├─ api.example.com/api
    │  → Ingress Controller
    │  → API Service
    │  → API Pods
    │
    └─ app.example.com/
       → Ingress Controller
       → App Service
       → App Pods

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  app.env: production
  log.level: info
  nginx.conf: |
    server {
      listen 80;
      location / {
        proxy_pass http://backend;
      }
    }
  config.json: |
    {
      "database": {
        "host": "postgres",
        "port": 5432
      }
    }

containers:
- name: app
  image: app:v1.0
  env:
  - name: DB_HOST
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: DB_HOST
  envFrom:
  - configMapRef:
      name: app-config

containers:
- name: app
  volumeMounts:
  - name: config
    mountPath: /etc/config
volumes:
- name: config
  configMap:
    name: app-config

kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-literal=password=secure-password-123

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YWRtaW4=  # base64(admin)
  password: c2VjdXJlLXBhc3N3b3JkLTEyMw==

containers:
- name: app
  env:
  - name: DB_USERNAME
    valueFrom:
      secretKeyRef:
        name: db-credentials
        key: username
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-credentials
        key: password

kubectl scale deployment nginx-deploy --replicas=5

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: nginx-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: nginx-deploy
  
  minReplicas: 2
  maxReplicas: 10
  
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70  # Scale up when CPU > 70%
  
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

1. Metrics collector samples CPU/memory every 30s
2. HPA controller queries metrics
3. Calculates: desired = current * (metric / target)
4. Updates deployment replicas

Example: Current 3 pods, CPU 85%, target 70%
         Desired = 3 * (85/70) = 3.64 ≈ 4 pods

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 0

# Blue (v1.21) - currently serving traffic
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-blue
spec:
  # ... config for v1.21

---

# Green (v1.22) - ready but not serving
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-green
spec:
  # ... config for v1.22

---

# Service routes to Blue initially
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
    version: blue  # Change to 'green' to switch traffic

# Only 1 pod with new version (v1.22)
# Other 3 pods still running old version (v1.21)
# Service matches both → 1/4 = 25% traffic to canary

apiVersion: v1
kind: Namespace
metadata:
  name: production

kubectl apply -f deployment.yaml -n production
kubectl get pods -n production
kubectl get namespaces

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-cross-namespace
  namespace: production
spec:
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: production

resources:
  requests:
    cpu: "100m"        # Minimum reserved
    memory: "128Mi"
  limits:
    cpu: "500m"        # Maximum allowed
    memory: "512Mi"

livenessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5

labels:
  app.kubernetes.io/name: my-app
  app.kubernetes.io/instance: my-app-prod
  app.kubernetes.io/version: "1.0"
  app.kubernetes.io/component: api
  team: platform
  env: production

# Deployments
kubectl create deployment nginx --image=nginx:1.21
kubectl apply -f deployment.yaml
kubectl get deployments
kubectl describe deployment nginx
kubectl edit deployment nginx
kubectl delete deployment nginx

# Pods
kubectl get pods -n default
kubectl get pods --all-namespaces
kubectl logs pod-name
kubectl exec -it pod-name -- /bin/bash
kubectl port-forward pod-name 8080:80

# Services
kubectl get services
kubectl create service clusterip nginx-svc --tcp=80:8080
kubectl expose deployment nginx --type=ClusterIP --port=80

# Scaling
kubectl scale deployment nginx --replicas=5
kubectl autoscale deployment nginx --min=2 --max=10 --cpu-percent=70

# Updates & Rollouts
kubectl set image deployment/nginx nginx=nginx:1.22
kubectl rollout status deployment/nginx
kubectl rollout history deployment/nginx
kubectl rollout undo deployment/nginx
kubectl rollout undo deployment/nginx --to-revision=2

# Configuration
kubectl create configmap app-config --from-literal=KEY=VALUE
kubectl create secret generic db-creds --from-literal=password=secret
kubectl get configmaps
kubectl get secrets

# Debugging
kubectl top nodes
kubectl top pods
kubectl describe node node-name
kubectl get events

External Client
    ↓
Cloud TCP Load Balancer (port 80/443)
    ↓
Node Port (e.g., 32365) — NodePort Service
    ↓
Ingress-nginx Pod
    ↓
Service (ClusterIP)
    ↓
Application Pods

apiVersion: v1
kind: Service
metadata:
  name: nginx-public-controller
  namespace: foundation
spec:
  type: LoadBalancer
  externalTrafficPolicy: local  # Optional: pass traffic to local node
  ports:
  - name: http
    port: 80
    targetPort: 80
    nodePort: 32365
  - name: https
    port: 443
    targetPort: 443
    nodePort: 31380
  selector:
    app.kubernetes.io/name: nginx-public
    app.kubernetes.io/instance: foundation

External Client
    ↓
Cloud HTTP(S) Load Balancer (auto-provisioned by controller)
    ↓
Service (ClusterIP)
    ↓
Application Pods

1. ACME client requests cert via HTTP-01
2. Client creates file at http://<domain>/.well-known/acme-challenge/<TOKEN>
3. ACME provider validates file
4. ACME provider issues certificate

Pros: Simple, no DNS access needed
Cons: Doesn't work for wildcards, requires public web server

1. ACME client requests cert via DNS-01
2. Client creates TXT record at _acme-challenge.<domain>
3. ACME provider queries DNS to validate
4. ACME provider issues certificate (supports wildcards)

Pros: Supports wildcards, works with private servers
Cons: Need DNS API access (mitigated with workload identity)

# Define which CA to use
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - dns01:
        cloudDNS:
          project: my-gcp-project

---

# Request certificate
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: api-cert
spec:
  secretName: api-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - api.example.com
  - "*.api.example.com"

# Using nmap
nmap -p 443 --script ssl-cert api.example.com

# Using openssl
openssl s_client -servername api.example.com -connect api.example.com:443 </dev/null 2>/dev/null | openssl x509 -text

# Using curl
curl -v https://api.example.com 2>&1 | grep "subject\|issuer\|valid"

resource "vault_kubernetes_auth_backend_role" "external_secrets" {
  backend                       = "kubernetes"
  role_name                     = "service-external-secrets"
  bound_service_account_names   = ["external-secrets"]
  bound_service_account_namespaces = ["service-foobar"]
  token_ttl                     = 3600
  token_policies                = ["default", "admin"]
}

kubectl -n service-foobar create serviceaccount external-secrets

Service Account Token → Vault API
↓
Vault validates token via Kubernetes Token Reviewer
↓
Checks: SA name, SA namespace match Vault role
↓
Issues token if valid

apiVersion: external-secrets.io/v1alpha1
kind: SecretStore
metadata:
  name: vault-kubernetes-provider
  namespace: service-foobar
spec:
  provider:
    vault:
      server: https://vault.company-internal.com:8200
      path: kubernetes
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: service-foobar-external-secrets
          serviceAccountRef:
            name: external-secrets

apiVersion: external-secrets.io/v1alpha1
kind: ExternalSecret
metadata:
  name: datadog-secrets
  namespace: foundation
spec:
  dataFrom:
  - key: foundation/datadog  # Path in Vault
  secretStoreRef:
    kind: SecretStore
    name: vault-kubernetes-provider
  target:
    name: datadog-secrets    # K8s secret name
    template:
      type: Opaque

apiVersion: v1
kind: Secret
metadata:
  name: datadog-secrets
  namespace: foundation
type: Opaque
data:
  api-key: <REDACTED>
  app-key: <REDACTED>
  token: <REDACTED>

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
spec:
  rules:
  - host: api.example.com
    # ❌ DNS record must be manually created in DNS provider

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
spec:
  rules:
  - host: api.example.com
    # ✅ External DNS automatically creates DNS A record
    # pointing to Ingress IP

1. User creates Ingress with hostname: api.example.com
2. External DNS controller watches for new Ingresses
3. Detects hostname: api.example.com
4. Queries Ingress IP (e.g., 10.224.0.104)
5. Creates DNS A record: api.example.com → 10.224.0.104
6. DNS propagates globally
7. Users can now access https://api.example.com

Application
    ↓ writes to stdout/stderr
Kubelet (node agent)
    ↓ captures logs
/var/log/pods/<namespace>_<pod>_<id>/<container>/
    ↓ read by filebeat/fluentd DaemonSet
Elasticsearch/OpenSearch
    ↓ indexed for search
OpenSearch Dashboard (Kibana)
    ↓ visualized by operators

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: filebeat
  namespace: logging
spec:
  selector:
    matchLabels:
      beat.k8s.elastic.co/name: filebeat
  template:
    metadata:
      labels:
        beat.k8s.elastic.co/name: filebeat
    spec:
      containers:
      - name: filebeat
        image: docker.elastic.co/beats/filebeat:7.16.3
        volumeMounts:
        - name: varlogpods
          mountPath: /var/log/pods  # Read pod logs from node
      volumes:
      - name: varlogpods
        hostPath:
          path: /var/log/pods

❌ Bad: "Error occurred while processing"
✅ Good: {"level":"error", "msg":"processing failed", "request_id":"123"}

env:
- name: LOG_LEVEL
  value: "info"
- name: LOG_FORMAT
  value: "json"

❌ Bad: "Connecting to DB with password: secret123"
✅ Good: "Connecting to DB"