kubernetes-containers

Kubernetes & Containers

Core Concepts

• Pods: Smallest deployable units
• Deployments: Declarative pod management
• Services: Network abstraction
• ConfigMaps/Secrets: Configuration injection
• RBAC: Access control

Essential Commands

# Context & Namespace
kubectl config get-contexts
kubectl config use-context prod
kubectl get pods -n my-namespace

# Pod Operations
kubectl get pods -o wide
kubectl describe pod <pod-name>
kubectl logs <pod-name> -f --tail=100
kubectl exec -it <pod-name> -- /bin/sh

# Apply & Delete
kubectl apply -f manifest.yaml
kubectl delete -f manifest.yaml
kubectl rollout restart deployment/<name>

# Kustomize
kubectl kustomize overlays/dev
kubectl diff -k overlays/dev
kubectl apply -k overlays/dev

# Debugging
kubectl get events --sort-by='.lastTimestamp'
kubectl top pods
kubectl port-forward svc/my-service 8080:80

# Podtrace runtime diagnostics
podtrace -n my-namespace my-pod
podtrace -n my-namespace my-pod --diagnose 20s
podtrace -n my-namespace my-pod --metrics

Podtrace

Use podtrace for on-demand eBPF diagnostics when kubectl describe, logs, and standard metrics do not explain pod behavior.

• Prefer short runs such as --diagnose 20s
• Treat captured application-layer fields as sensitive
• See Podtrace reference (${HANDBOOK_ROOT}/skills/kubernetes-containers/references/podtrace.md) for workflow, prerequisites, and command examples

Deployment Pattern

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
  labels:
    app: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      serviceAccountName: app-sa
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
      containers:
        - name: app
          image: myapp:1.0.0
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true