loom-kubernetes

Kubernetes

Overview

Production Kubernetes resource design, security hardening, Helm, and operations. The annotated examples below and the Expert Practices section carry the load-bearing knowledge — most production failures here are silent (no API error, no event), surfacing only under load, node maintenance, or a hardened cluster.

Workload & Identity Cheatsheet

Kind	Identity guarantee	Use for
Deployment	Fungible pods, random names, no ordering	Stateless services
StatefulSet	Stable ordinal identity + DNS + per-pod PVC; ordered rollout (OrderedReady)	Databases, quorum systems, sharded stores
DaemonSet	One pod per (matching) node	Node agents: logging, CNI, node-exporter
Job/CronJob	Run-to-completion / scheduled	Batch, migrations, backups

Rollout knobs: strategy.rollingUpdate.maxSurge/maxUnavailable (Deployment); maxUnavailable + partition (StatefulSet). imagePullPolicy: IfNotPresent for immutable tags/digests; Always only for mutable tags (adds a registry round-trip per start).

Examples

Production Deployment (annotated)

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-server
  namespace: production
  labels: {app: api-server, version: v1.2.0}
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate: {maxSurge: 1, maxUnavailable: 0}
  selector:
    matchLabels: {app: api-server}
  template:
    metadata:
      labels: {app: api-server, version: v1.2.0}
      annotations: {prometheus.io/scrape: "true", prometheus.io/port: "8080"}
    spec:
      serviceAccountName: api-server
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault          # REQUIRED by Restricted PSS; omitting it = pod rejected
      containers:
        - name: api
          image: myregistry.io/api-server:v1.2.0
          imagePullPolicy: IfNotPresent
          ports: [{name: http, containerPort: 8080}]
          env:
            - name: DATABASE_URL
              valueFrom: {secretKeyRef: {name: api-secrets, key: database-url}}
          resources:
            requests: {cpu: 100m, memory: 128Mi}
            limits: {memory: 512Mi}      # memory limit kept; CPU limit omitted (see CFS throttling)
          # startupProbe gates liveness/readiness — prefer over a large initialDelaySeconds
          startupProbe:
            httpGet: {path: /health/live, port: http}
            failureThreshold: 30         # 30 * 10s = 5 min startup budget
            periodSeconds: 10
          livenessProbe:
            httpGet: {path: /health/live, port: http}   # process health ONLY — no DB/cache/upstream
            periodSeconds: 20
            failureThreshold: 3
          readinessProbe:
            httpGet: {path: /health/ready, port: http}  # may check dependencies; drains, not restarts
            periodSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: {drop: [ALL]}
          volumeMounts:
            - {name: tmp, mountPath: /tmp}
      volumes:
        - {name: tmp, emptyDir: {}}
      # soft node spread + hard zone spread with per-revision isolation (see Expert Practices)
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector: {matchLabels: {app: api-server}}
                topologyKey: kubernetes.io/hostname
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector: {matchLabels: {app: api-server}}
          matchLabelKeys: [pod-template-hash]   # each rollout revision spreads independently (1.27+)