Kubernetes YAML
Master Guide

apiVersion: v1                      # Core API group
kind: Pod                             # Resource type
metadata:
  name: my-app-pod                   # Pod's unique name
  namespace: production              # Which namespace
  labels:
    app: my-app                      # Used by Services/Deployments
    version: v1
  annotations:
    description: "Main web server"

spec:
  containers:                         # List of containers
    - name: web                       # Container name
      image: nginx:1.21              # Docker image
      ports:
        - containerPort: 80          # Port container listens on
      env:                            # Environment variables
        - name: APP_ENV
          value: "production"
      resources:                      # CPU/memory limits
        requests:
          memory: "64Mi"
          cpu: "250m"
        limits:
          memory: "128Mi"
          cpu: "500m"
      livenessProbe:                  # Is container alive?
        httpGet:
          path: /health
          port: 80
        initialDelaySeconds: 15
      readinessProbe:                 # Is container ready for traffic?
        httpGet:
          path: /ready
          port: 80
      volumeMounts:
        - name: config-volume
          mountPath: /etc/config

  initContainers:                     # Run before main containers
    - name: init-db
      image: busybox
      command: ['sh', '-c', 'until nc -z db 5432; do sleep 1; done']

  volumes:                            # Storage volumes
    - name: config-volume
      configMapRef:
        name: app-config

  restartPolicy: Always              # Always|OnFailure|Never
  nodeSelector:                       # Run on specific nodes
    disktype: ssd

apiVersion: apps/v1
kind: Deployment
metadata:
  name: pathnex-deployment
  namespace: production
  labels:
    app: pathnex

spec:
  replicas: 3                         # Run 3 Pods at all times

  selector:                           # Which Pods this manages
    matchLabels:
      app: pathnex                   # MUST match template labels

  strategy:                           # How to update Pods
    type: RollingUpdate              # Replace Pods gradually
    rollingUpdate:
      maxUnavailable: 1             # Max Pods down during update
      maxSurge: 1                   # Max extra Pods during update

  template:                           # Pod blueprint (same as Pod spec)
    metadata:
      labels:
        app: pathnex                # MUST match selector
    spec:
      containers:
        - name: nginx
          image: nginx:latest
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "256Mi"
          livenessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /
              port: 80
            initialDelaySeconds: 5

apiVersion: apps/v1
kind: ReplicaSet
metadata:
  name: my-replicaset
spec:
  replicas: 3                         # Keep 3 pods always running
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: my-container
          image: nginx:latest

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mysql
spec:
  serviceName: "mysql"               # Headless service name (required!)
  replicas: 3
  selector:
    matchLabels:
      app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
        - name: mysql
          image: mysql:8.0
          env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-secret
                  key: password
          volumeMounts:
            - name: mysql-data
              mountPath: /var/lib/mysql

  volumeClaimTemplates:               # Creates unique PVC per Pod!
    - metadata:
        name: mysql-data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 10Gi

# Pod names will be: mysql-0, mysql-1, mysql-2
# DNS names:  mysql-0.mysql.default.svc.cluster.local

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: fluentd
  template:
    metadata:
      labels:
        name: fluentd
    spec:
      tolerations:                     # Allow running on control-plane nodes
        - key: node-role.kubernetes.io/control-plane
          operator: Exists
          effect: NoSchedule
      containers:
        - name: fluentd
          image: fluent/fluentd:v1.14
          volumeMounts:
            - name: varlog
              mountPath: /var/log     # Access node logs
      volumes:
        - name: varlog
          hostPath:
            path: /var/log            # Mount from the actual node

apiVersion: batch/v1
kind: Job
metadata:
  name: db-migration
spec:
  completions: 1                      # How many Pods must succeed
  parallelism: 1                      # How many run simultaneously
  backoffLimit: 4                     # Retry 4 times if fails
  activeDeadlineSeconds: 300         # Kill if not done in 5 min

  template:
    spec:
      restartPolicy: OnFailure        # Never | OnFailure (required for Jobs)
      containers:
        - name: migration
          image: my-app:latest
          command: ["python", "manage.py", "migrate"]
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: db-secret
                  key: url

apiVersion: batch/v1
kind: CronJob
metadata:
  name: daily-backup
spec:
  schedule: "0 2 * * *"              # Every day at 2:00 AM
  #           ┬ ┬ ┬ ┬ ┬
  #           │ │ │ │ └─ Day of week (0-7)
  #           │ │ │ └─── Month (1-12)
  #           │ │ └───── Day of month (1-31)
  #           │ └─────── Hour (0-23)
  #           └───────── Minute (0-59)

  successfulJobsHistoryLimit: 3      # Keep last 3 successful jobs
  failedJobsHistoryLimit: 1          # Keep last 1 failed job
  concurrencyPolicy: Forbid         # Don't run if previous still running

  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: backup
              image: my-backup-tool:latest
              command: ["sh", "-c", "backup.sh"]

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  type: ClusterIP                     # Only accessible inside cluster
  selector:
    app: pathnex                     # Forwards to Pods with this label
  ports:
    - port: 80                        # Service port (what others call)
      targetPort: 8080               # Pod port (what app listens on)

spec:
  type: NodePort                      # Accessible via NodeIP:NodePort
  selector:
    app: pathnex
  ports:
    - port: 80                        # ClusterIP port
      targetPort: 8080               # Pod port
      nodePort: 30080                # External port (30000-32767)
# Access: http://any-node-ip:30080

spec:
  type: LoadBalancer                  # Cloud creates external load balancer
  selector:
    app: pathnex
  ports:
    - port: 80
      targetPort: 8080
# AWS/GCP/Azure creates a real external IP automatically

spec:
  clusterIP: None                     # No virtual IP — direct Pod DNS
  selector:
    app: mysql
  ports:
    - port: 3306
# Access: mysql-0.mysql.default.svc.cluster.local
# Each Pod gets its own DNS entry. Used with StatefulSets.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx            # Which ingress controller to use

  tls:                                # HTTPS configuration
    - hosts:
        - myapp.com
        - api.myapp.com
      secretName: myapp-tls          # TLS cert stored here

  rules:
    - host: myapp.com                # Domain-based routing
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: frontend-service
                port:
                  number: 80

    - host: api.myapp.com            # Subdomain routing
      http:
        paths:
          - path: /v1               # Path-based routing
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 8080

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-allow-frontend
spec:
  podSelector:                        # Apply rules TO these Pods
    matchLabels:
      app: backend

  policyTypes:
    - Ingress                         # Control incoming traffic
    - Egress                          # Control outgoing traffic

  ingress:                            # Who can SEND traffic to backend
    - from:
        - podSelector:              # Only from frontend pods
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

  egress:                             # Where backend can SEND traffic
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - port: 5432

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  # Simple key-value pairs
  APP_ENV: "production"
  LOG_LEVEL: "info"
  MAX_CONNECTIONS: "100"

  # Entire config file as a value
  nginx.conf: |
    server {
      listen 80;
      location / {
        proxy_pass http://backend:8080;
      }
    }

  app.properties: |
    database.host=postgres
    database.port=5432
    cache.ttl=3600

---
# HOW TO USE IN A POD:
spec:
  containers:
    - name: app
      image: my-app:latest

      # Option 1: Single key as env var
      env:
        - name: APP_ENV
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: APP_ENV

      # Option 2: All keys as env vars
      envFrom:
        - configMapRef:
            name: app-config

      # Option 3: Mount as files
      volumeMounts:
        - name: config
          mountPath: /etc/nginx

  volumes:
    - name: config
      configMap:
        name: app-config             # nginx.conf becomes /etc/nginx/nginx.conf

# Type 1: Generic secret (most common)
apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque                         # Generic type
data:                                 # Values MUST be base64 encoded
  username: YWRtaW4=                 # echo -n 'admin' | base64
  password: cGFzc3dvcmQxMjM=        # echo -n 'password123' | base64

---
# Type 2: TLS secret (for HTTPS)
apiVersion: v1
kind: Secret
metadata:
  name: myapp-tls
type: kubernetes.io/tls
data:
  tls.crt: <base64-cert>
  tls.key: <base64-key>

---
# HOW TO USE IN POD:
env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password

apiVersion: v1
kind: PersistentVolume
metadata:
  name: my-pv
spec:
  capacity:
    storage: 10Gi                   # Total disk size

  accessModes:                       # How Pods can access it
    - ReadWriteOnce                   # One node reads+writes (typical)
    # - ReadOnlyMany     # Many nodes read-only
    # - ReadWriteMany    # Many nodes read+write (NFS)

  reclaimPolicy: Retain             # Retain|Delete|Recycle
  storageClassName: standard        # Must match PVC's storageClass

  hostPath:                          # Local disk (dev only)
    path: /mnt/data

  # For AWS EBS:
  # awsElasticBlockStore:
  #   volumeID: vol-xxxx
  #   fsType: ext4

  # For NFS:
  # nfs:
  #   path: /exports/data
  #   server: nfs-server.example.com

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: standard        # Must match PV or StorageClass
  resources:
    requests:
      storage: 5Gi                  # Request 5GB of storage

---
# USE IN A POD:
spec:
  containers:
    - name: app
      volumeMounts:
        - mountPath: /data
          name: storage
  volumes:
    - name: storage
      persistentVolumeClaim:
        claimName: my-pvc           # Reference the PVC

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: kubernetes.io/aws-ebs  # Cloud provider plugin
parameters:
  type: gp3                          # AWS EBS type (SSD)
  fsType: ext4
reclaimPolicy: Delete              # Delete disk when PVC deleted
allowVolumeExpansion: true         # Allow resizing volumes

---
# GCP example:
provisioner: kubernetes.io/gce-pd
parameters:
  type: pd-ssd

---
# Azure example:
provisioner: kubernetes.io/azure-disk
parameters:
  skuName: Premium_LRS

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    env: prod
    team: platform

---
apiVersion: v1
kind: Namespace
metadata:
  name: staging

# Default namespaces created by Kubernetes:
# default          - Where resources go if no namespace specified
# kube-system      - Kubernetes system components
# kube-public      - Publicly readable resources
# kube-node-lease  - Node heartbeat tracking

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: production

---
# USE IN A POD:
spec:
  serviceAccountName: my-app-sa    # Pod uses this identity
  containers:
    - name: app
      image: my-app:latest
# Token automatically mounted at:
# /var/run/secrets/kubernetes.io/serviceaccount/token

# ROLE: What actions are allowed
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production             # Only in this namespace
rules:
  - apiGroups: [""]                 # "" = core API group
    resources: ["pods", "pods/log"]  # Which resources
    verbs: ["get", "list", "watch"]  # What actions allowed
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "update"]

---
# ROLEBINDING: Assign Role to someone
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods-binding
  namespace: production
subjects:                            # Who gets this role
  - kind: ServiceAccount
    name: my-app-sa
    namespace: production
  - kind: User
    name: jane@company.com
roleRef:                             # Which role to bind
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

# All verbs: get, list, watch, create, update, patch, delete
# ClusterRole = same but cluster-wide (no namespace)

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: pathnex-hpa
spec:
  scaleTargetRef:                    # What to scale
    apiVersion: apps/v1
    kind: Deployment
    name: pathnex-deployment

  minReplicas: 2                    # Never go below 2
  maxReplicas: 10                   # Never go above 10

  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70   # Scale up if CPU > 70%

    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80   # Scale up if memory > 80%

# Flow: 2 pods → traffic spike → CPU 70% → HPA adds pods → up to 10
# Requires: metrics-server installed in cluster

apiVersion: v1
kind: ResourceQuota
metadata:
  name: production-quota
  namespace: production
spec:
  hard:
    # Compute
    requests.cpu: "4"               # Total CPU requests in namespace
    requests.memory: 8Gi
    limits.cpu: "8"                 # Total CPU limits in namespace
    limits.memory: 16Gi

    # Object counts
    pods: "20"                      # Max 20 Pods
    services: "10"                  # Max 10 Services
    secrets: "20"
    configmaps: "20"
    persistentvolumeclaims: "5"

---
# LimitRange: Default limits per Pod (companion to ResourceQuota)
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: production
spec:
  limits:
    - type: Container
      default:                      # Applied if not specified
        cpu: 200m
        memory: 256Mi
      defaultRequest:
        cpu: 100m
        memory: 128Mi