kubernetes

Kubernetes Core Knowledge

Deep Knowledge: Use mcp__documentation__fetch_docs with technology: kubernetes for comprehensive documentation.

Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
        - name: myapp
          image: myapp:1.0.0
          ports:
            - containerPort: 3000
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: myapp-secrets
                  key: database-url
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "256Mi"
              cpu: "500m"
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 3000

Service

apiVersion: v1
kind: Service
metadata:
  name: myapp
spec:
  selector:
    app: myapp
  ports:
    - port: 80
      targetPort: 3000
  type: ClusterIP
---
# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp
spec:
  rules:
    - host: myapp.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp
                port:
                  number: 80

ConfigMap & Secret

apiVersion: v1
kind: ConfigMap
metadata:
  name: myapp-config
data:
  LOG_LEVEL: "info"
  API_URL: "https://api.example.com"
---
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
type: Opaque
data:
  database-url: cG9zdGdyZXM6Ly8uLi4=  # base64

Common Commands

kubectl apply -f deployment.yaml
kubectl get pods
kubectl logs pod-name
kubectl exec -it pod-name -- sh
kubectl scale deployment myapp --replicas=5
kubectl rollout status deployment/myapp
kubectl rollout undo deployment/myapp

When NOT to Use This Skill

Skip this skill when:

• Setting up local development with multiple containers - use docker-compose skill
• Creating container images - use docker skill
• Managing CI/CD pipelines - use github-actions skill
• Running single-server deployments (VPS) - Docker Compose may be simpler
• Working with managed container services that abstract K8s (AWS Fargate, Google Cloud Run)

Anti-Patterns

Anti-Pattern	Problem	Solution
No resource limits	Resource exhaustion, noisy neighbors	Always set resources.requests and limits
Running as root	Security vulnerability	Set securityContext.runAsNonRoot: true
No readiness probes	Traffic sent to starting pods	Add readinessProbe for zero-downtime
Using latest image tag	Unpredictable deployments	Pin specific versions myapp:v1.2.3
Secrets in ConfigMaps	Exposed sensitive data	Use Secrets, External Secrets, or Sealed Secrets
No Pod Disruption Budget	Downtime during node maintenance	Add PDB with minAvailable
Single replica for critical services	Single point of failure	Use at least 2 replicas with anti-affinity
No network policies	All pods can talk to all pods	Restrict traffic with NetworkPolicy
Missing health checks	Unhealthy pods stay in rotation	Add livenessProbe and readinessProbe
maxUnavailable = maxSurge = 0	Rollout stuck	Set at least one > 0 for rolling updates

Quick Troubleshooting

Issue	Diagnosis	Fix
Pod stuck in Pending	Insufficient resources	Check kubectl describe pod, add nodes or reduce requests
Pod in CrashLoopBackOff	Container exits immediately	Check logs: kubectl logs pod-name --previous
ImagePullBackOff	Can't pull image	Verify image exists, check imagePullSecrets
Service not accessible	Wrong selector, no endpoints	Check kubectl get endpoints service-name
Readiness probe failing	App not ready on time	Increase initialDelaySeconds or fix app startup
OOMKilled status	Memory limit exceeded	Increase resources.limits.memory
Ingress returns 404	Wrong path, service not found	Verify ingress rules and backend service exists
ConfigMap changes not reflected	Pod not restarted	Trigger rolling update: change annotation or image
0/3 nodes available	Resource constraints, taints	Check node status: kubectl describe nodes
Persistent volume not mounting	PVC not bound, wrong storage class	Check PVC status: kubectl get pvc

Production Readiness

Security Configuration

# Pod Security Context
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: myapp
          image: myapp:1.0.0
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}

# Network Policy - Restrict traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: myapp-network-policy
spec:
  podSelector:
    matchLabels:
      app: myapp
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 3000
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432

Secrets Management

# External Secrets Operator (recommended)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: myapp-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: myapp-secrets
  data:
    - secretKey: database-url
      remoteRef:
        key: myapp/database
        property: url

# Sealed Secrets (alternative)
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: myapp-secrets
spec:
  encryptedData:
    database-url: AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq...

Resource Management

# Proper resource limits
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: myapp
          resources:
            requests:
              memory: "256Mi"
              cpu: "250m"
            limits:
              memory: "512Mi"
              cpu: "1000m"
          # Vertical Pod Autoscaler can optimize these

# Horizontal Pod Autoscaler
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

# Pod Disruption Budget
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: myapp-pdb
spec:
  minAvailable: 1  # Or maxUnavailable: 1
  selector:
    matchLabels:
      app: myapp

Health Probes

# Comprehensive health probes
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
        - name: myapp
          # Startup probe (for slow-starting apps)
          startupProbe:
            httpGet:
              path: /health
              port: 3000
            failureThreshold: 30
            periodSeconds: 10
          # Liveness probe (restart if unhealthy)
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 0
            periodSeconds: 10
            timeoutSeconds: 3
            failureThreshold: 3
          # Readiness probe (traffic routing)
          readinessProbe:
            httpGet:
              path: /ready
              port: 3000
            initialDelaySeconds: 0
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3

Rolling Updates

# Safe rolling update strategy
apiVersion: apps/v1
kind: Deployment
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # Max extra pods during update
      maxUnavailable: 0  # Zero downtime
  template:
    spec:
      terminationGracePeriodSeconds: 30
      containers:
        - name: myapp
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 10"]

Monitoring & Observability

# ServiceMonitor for Prometheus
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: myapp
spec:
  selector:
    matchLabels:
      app: myapp
  endpoints:
    - port: http
      path: /metrics
      interval: 30s

Monitoring Metrics

Metric	Alert Threshold
Pod restarts	> 3 in 15 minutes
CPU utilization	> 80% sustained
Memory utilization	> 85%
Pod pending time	> 5 minutes
Failed deployments	> 0
Certificate expiry	< 30 days

Ingress with TLS

# Ingress with cert-manager TLS
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - myapp.example.com
      secretName: myapp-tls
  rules:
    - host: myapp.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp
                port:
                  number: 80

Checklist

• Pod security context (non-root, read-only fs)
• Network policies defined
• Secrets via External Secrets/Sealed Secrets
• Resource requests and limits set
• HPA configured for auto-scaling
• PDB for high availability
• Liveness/readiness/startup probes
• Rolling update strategy (zero downtime)
• Graceful shutdown (preStop hook)
• TLS certificates via cert-manager
• Prometheus metrics exported
• Pod anti-affinity for distribution
• RBAC properly scoped
• Image pull policy: Always (for :latest) or IfNotPresent

Reference Documentation

• Deployments
• Secrets