Object	Purpose
Pod	Smallest unit, one or more containers
Deployment	Manages ReplicaSet, rolling updates
Service	Stable network endpoint for pods
Ingress	HTTP routing + TLS termination
ConfigMap	Non-sensitive configuration
Secret	Sensitive data (base64 encoded)
HPA	Horizontal Pod Autoscaler
PVC	Persistent Volume Claim
CronJob	Scheduled jobs
ServiceAccount	Pod identity for RBAC

2. Production Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0       # Zero-downtime
  template:
    metadata:
      labels:
        app: api
        version: "1.2.0"
    spec:
      serviceAccountName: api-sa
      containers:
        - name: api
          image: ghcr.io/myorg/api:sha-abc123  # Pin to SHA, not :latest
          ports:
            - containerPort: 3000
          env:
            - name: NODE_ENV
              value: production
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: db-secret
                  key: url
          resources:
            requests:           # Scheduler uses these
              cpu: "100m"
              memory: "128Mi"
            limits:             # Hard cap
              cpu: "500m"
              memory: "512Mi"
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /health/live
              port: 3000
            initialDelaySeconds: 15
            periodSeconds: 20
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 5"]  # Drain connections
      terminationGracePeriodSeconds: 30

3. Service + Ingress

apiVersion: v1
kind: Service
metadata:
  name: api-service
spec:
  selector:
    app: api
  ports:
    - port: 80
      targetPort: 3000
  type: ClusterIP  # Use LoadBalancer for cloud LB

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    nginx.ingress.kubernetes.io/rate-limit: "100"
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    - hosts: [api.example.com]
      secretName: api-tls
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 80

4. Horizontal Pod Autoscaler

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api
  minReplicas: 2
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

5. Config & Secrets

# ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  LOG_LEVEL: "info"
  CACHE_TTL: "3600"

# Secret (use External Secrets Operator in real clusters)
apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
  url: cG9zdGdyZXNxbDovLy4uLg==  # base64

6. Health Check Endpoints

// Express
app.get("/health/live", (req, res) => {
  res.json({ status: "ok" });
});

app.get("/health/ready", async (req, res) => {
  try {
    await db.$queryRaw`SELECT 1`;
    await redis.ping();
    res.json({ status: "ready" });
  } catch (err) {
    res.status(503).json({ status: "not ready", error: err.message });
  }
});

7. Useful Commands

# Deploy
kubectl apply -f k8s/
kubectl rollout status deployment/api

# Debug
kubectl get pods -n production
kubectl describe pod <pod-name>
kubectl logs <pod-name> --previous  # last crash logs
kubectl exec -it <pod-name> -- sh

# Rollback
kubectl rollout undo deployment/api
kubectl rollout history deployment/api

# Scale
kubectl scale deployment/api --replicas=5

8. Anti-Patterns

❌ Don't	✅ Do
Use :latest tag	Pin to SHA
No resource limits	Always set requests + limits
No health probes	readiness + liveness required
Secrets in ConfigMap	Use Secret or External Secrets
Single replica in prod	Minimum 2 for HA
No PodDisruptionBudget	Protect against node drains

kubernetes-expert

Kubernetes Expert

1. Core Objects