kubernetes-orchestration

When to Use

• Deploying containerized applications to Kubernetes clusters.
• Writing or reviewing Deployment, Service, Ingress, or other K8s manifests.
• Configuring health probes, resource limits, autoscaling, or rolling updates.
• Troubleshooting pod scheduling, networking, or configuration issues.
• Setting up Kustomize overlays for multi-environment deployments.

Critical Patterns

• Resource Limits Are Mandatory: ALWAYS set both requests and limits for CPU and memory. Without them, a single pod can starve the entire node.
• Health Probes on Every Workload: ALWAYS define readinessProbe and livenessProbe. Without readiness probes, traffic routes to unready pods. Without liveness probes, stuck containers are never restarted.
• Startup Probes for Slow Init: Use startupProbe for applications with long initialization ( JVM, large model loading) to avoid premature liveness kills.
• Never Use latest Tag: Pin image tags to immutable versions or digests. latest causes unpredictable deployments and breaks rollback.
• Namespaces for Isolation: Separate workloads by team, environment, or domain using namespaces. Apply ResourceQuotas per namespace.
• Secrets Are Not Encrypted at Rest by Default: Enable encryption at rest or use external secret managers (Vault, Sealed Secrets, External Secrets Operator).
• Pod Disruption Budgets: Always set PDBs for production workloads to prevent all replicas from being evicted during node maintenance.

Code Examples

Pod Spec with Complete Health Probes

apiVersion: v1
kind: Pod
metadata:
  name: api-server
  labels:
    app: api-server
    version: v1.2.0
spec:
  containers:
    - name: api
      image: myregistry/api-server:1.2.0
      ports:
        - containerPort: 8080
          protocol: TCP
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 500m
          memory: 512Mi
      startupProbe:
        httpGet:
          path: /healthz
          port: 8080
        failureThreshold: 30
        periodSeconds: 10
      readinessProbe:
        httpGet:
          path: /ready
          port: 8080
        initialDelaySeconds: 5
        periodSeconds: 10
        timeoutSeconds: 3
        failureThreshold: 3
      livenessProbe:
        httpGet:
          path: /healthz
          port: 8080
        initialDelaySeconds: 15
        periodSeconds: 20
        timeoutSeconds: 5
        failureThreshold: 3
      env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: db-credentials
              key: url
        - name: LOG_LEVEL
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: log-level
  restartPolicy: Always