KUBERNETES
HANDBOOK

apiVersion: apps/v1          # API group + version (apps/v1, v1, networking.k8s.io/v1)
kind: Deployment              # Object type
metadata:
  name: my-app                # Unique name within namespace
  namespace: production       # Logical grouping
  labels:                     # Key-value tags — used for selection
    app: my-app
    version: v2
    team: backend
  annotations:               # Non-identifying metadata (for tools/humans)
    deployment.kubernetes.io/revision: "3"
    description: "Main API service"
spec:                         # DESIRED STATE — what you want
  ...
status:                       # ACTUAL STATE — managed by K8s (read-only)
  ...

# Single container pod (basic)
apiVersion: v1
kind: Pod
metadata:
  name: my-api-pod
  labels:
    app: my-api
spec:
  containers:
  - name: api
    image: myrepo/my-api:v2.1.0
    ports:
    - containerPort: 8080
    env:
    - name: APP_ENV
      value: production
    resources:
      requests:
        cpu: "250m"      # 250 millicores = 0.25 vCPU
        memory: "256Mi"
      limits:
        cpu: "500m"
        memory: "512Mi"

# Multi-container pod — sidecar pattern
spec:
  containers:
  - name: app
    image: myapp:latest
    volumeMounts:
    - name: shared-logs
      mountPath: /var/log/app

  - name: log-shipper            # Sidecar container — same pod
    image: fluentd:v1.16
    volumeMounts:
    - name: shared-logs
      mountPath: /var/log/app

  volumes:
  - name: shared-logs
    emptyDir: {}               # Shared ephemeral volume

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-deployment
  namespace: production
  labels:
    app: api
    version: v2
spec:
  replicas: 3                         # Desired pod count
  selector:
    matchLabels:
      app: api                         # Must match template labels
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1                      # Max extra pods during update
      maxUnavailable: 0               # Zero downtime — never kill before ready
  template:
    metadata:
      labels:
        app: api
        version: v2
    spec:
      terminationGracePeriodSeconds: 30   # Time for graceful shutdown
      containers:
      - name: api
        image: gcr.io/my-project/api:v2.1.0
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
          protocol: TCP
        envFrom:
        - configMapRef:
            name: api-config            # All ConfigMap keys as env vars
        - secretRef:
            name: api-secrets           # All Secret keys as env vars
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name  # Downward API
        resources:
          requests:
            cpu: "250m"
            memory: "256Mi"
          limits:
            cpu: "1000m"
            memory: "512Mi"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 15
          periodSeconds: 10
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
      affinity:
        podAntiAffinity:               # Spread pods across nodes
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: api
              topologyKey: kubernetes.io/hostname

# Job — run to completion once
apiVersion: batch/v1
kind: Job
metadata:
  name: db-migration
spec:
  backoffLimit: 3         # Retry failed pods up to 3 times
  ttlSecondsAfterFinished: 3600  # Auto-delete 1hr after completion
  template:
    spec:
      restartPolicy: OnFailure
      containers:
      - name: migrate
        image: myapp:latest
        command: ["dotnet", "ef", "database", "update"]

# CronJob — scheduled jobs
apiVersion: batch/v1
kind: CronJob
metadata:
  name: nightly-report
spec:
  schedule: "0 2 * * *"    # 2 AM every night (cron syntax)
  concurrencyPolicy: Forbid  # Don't start if previous run still going
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
          - name: reporter
            image: myapp:latest
            command: ["python", "generate_report.py"]

# Create namespace
kubectl create namespace production
kubectl create namespace staging

# YAML approach
kubectl apply -f - <<EOF
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    env: production
    team: backend
EOF

# Work within a namespace
kubectl get pods -n production
kubectl get all -n staging

# Set default namespace for current context
kubectl config set-context --current --namespace=production

# List all namespaces
kubectl get namespaces

# Get resources across ALL namespaces
kubectl get pods -A
kubectl get deployments --all-namespaces

# Define ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  APP_ENV: production
  LOG_LEVEL: info
  MAX_CONNECTIONS: "100"
  app.conf: |            # Multi-line file content
    server.port=8080
    server.host=0.0.0.0
    db.pool.size=20

---
# Inject as individual env var
env:
- name: APP_ENV
  valueFrom:
    configMapKeyRef:
      name: api-config
      key: APP_ENV

# Inject ALL keys as env vars
envFrom:
- configMapRef:
    name: api-config

# Mount as files in container
volumeMounts:
- name: config-vol
  mountPath: /app/config
volumes:
- name: config-vol
  configMap:
    name: api-config
    items:
    - key: app.conf
      path: app.conf    # Mounts as /app/config/app.conf

# From literal values (kubectl encodes to base64 automatically)
kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-literal=password='S3cr3t!Pass'

# From file (e.g., TLS certificate)
kubectl create secret tls tls-secret \
  --cert=cert.pem --key=key.pem

# From env file
kubectl create secret generic app-secrets \
  --from-env-file=.env.prod

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YWRtaW4=      # base64("admin")
  password: UzNjcjN0IVBhc3M=  # base64("S3cr3t!Pass")
# stringData: allows plain text (K8s encodes it)
stringData:
  api_key: my-plain-text-api-key

resources:
  requests:
    cpu: "250m"        # 250 millicores = 0.25 vCPU
    memory: "256Mi"    # 256 Mebibytes
  limits:
    cpu: "1"           # 1 full vCPU (= 1000m)
    memory: "1Gi"     # 1 Gibibyte

# CPU units:
#   1     = 1 vCPU / 1 core / 1 AWS vCPU / 1 hyperthread
#   0.5   = 500m (half a core)
#   100m  = 0.1 core (1/10 of a core)

# Memory units:
#   Ki = Kibibyte (1024 bytes)
#   Mi = Mebibyte (1024 Ki)
#   Gi = Gibibyte (1024 Mi)
#   K, M, G = decimal units (avoid — use Ki/Mi/Gi)

# LimitRange — default limits for a namespace
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: production
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "256Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"

# ClusterIP — internal only (default)
apiVersion: v1
kind: Service
metadata:
  name: api-service
  namespace: production
spec:
  type: ClusterIP
  selector:
    app: api                  # Routes to pods with this label
  ports:
  - name: http
    protocol: TCP
    port: 80                  # Service port (what clients call)
    targetPort: 8080          # Pod port (what container listens on)

---
# LoadBalancer — public internet access
apiVersion: v1
kind: Service
metadata:
  name: api-lb
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
  type: LoadBalancer
  selector:
    app: api
  ports:
  - port: 443
    targetPort: 8080

---
# Headless — for StatefulSet pod-level DNS
apiVersion: v1
kind: Service
metadata:
  name: postgres-headless
spec:
  clusterIP: None             # No VIP — direct pod IPs
  selector:
    app: postgres

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: main-ingress
  namespace: production
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/rate-limit: "100"
    cert-manager.io/cluster-issuer: letsencrypt-prod  # Auto TLS
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - api.myapp.com
    - admin.myapp.com
    secretName: myapp-tls      # cert-manager populates this
  rules:
  - host: api.myapp.com
    http:
      paths:
      - path: /v1
        pathType: Prefix
        backend:
          service:
            name: api-v1-service
            port:
              number: 80
      - path: /v2
        pathType: Prefix
        backend:
          service:
            name: api-v2-service
            port:
              number: 80
  - host: admin.myapp.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: admin-service
            port:
              number: 80

# Helm (recommended)
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx --create-namespace

# Or kubectl apply
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.10.1/deploy/static/provider/cloud/deploy.yaml

# Verify
kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx    # Shows external IP

# Step 1: Deny all ingress + egress in a namespace (default deny)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}          # Applies to ALL pods in namespace
  policyTypes:
  - Ingress
  - Egress

---
# Step 2: Allow api-service to receive from frontend only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-api
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api                  # Policy applies to api pods
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend           # Only allow from frontend pods
    - namespaceSelector:
        matchLabels:
          name: production        # In production namespace only
    ports:
    - protocol: TCP
      port: 8080

---
# Step 3: Allow api pods EGRESS to database + external DNS
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-egress-rules
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Egress
  egress:
  - to:                         # Allow to database pods
    - podSelector:
        matchLabels:
          app: postgres
    ports:
    - port: 5432
  - to:                         # Allow DNS (kube-dns)
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
  - to:                         # Allow external HTTPS (payment API)
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8              # Block internal RFC1918
        - 172.16.0.0/12
        - 192.168.0.0/16
    ports:
    - port: 443

# Full DNS name format:
{service-name}.{namespace}.svc.cluster.local

# Examples:
api-service.production.svc.cluster.local  → api service in production namespace
postgres.production.svc.cluster.local     → postgres service
api-service.default.svc.cluster.local     → api in default namespace

# Shorthand within SAME namespace:
api-service                   → resolved to api-service.production.svc.cluster.local
postgres:5432                 → database connection string

# StatefulSet pod DNS (headless service required):
postgres-0.postgres-headless.production.svc.cluster.local
postgres-1.postgres-headless.production.svc.cluster.local
postgres-2.postgres-headless.production.svc.cluster.local

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-deployment     # Which deployment to scale
  minReplicas: 2             # Never go below 2 (HA guarantee)
  maxReplicas: 20            # Never exceed 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 50  # Scale when CPU avg > 50%
  - type: Resource
    resource:
      name: memory
      target:
        type: AverageValue
        averageValue: 400Mi     # Scale when avg mem > 400 Mi
  - type: Pods                # Custom metric from Prometheus adapter
    pods:
      metric:
        name: http_requests_per_second
      target:
        type: AverageValue
        averageValue: "100"     # 100 RPS per pod
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300  # Wait 5min before scale-down
      policies:
      - type: Pods
        value: 2
        periodSeconds: 60      # Max 2 pods removed per minute
    scaleUp:
      stabilizationWindowSeconds: 0    # Scale up immediately
      policies:
      - type: Percent
        value: 100
        periodSeconds: 15      # Double pods every 15 seconds

# Create HPA imperatively (quick)
kubectl autoscale deployment api-deployment \
  --cpu-percent=50 --min=2 --max=20

# Check HPA status
kubectl get hpa -n production
kubectl describe hpa api-hpa -n production

# Watch HPA in action
kubectl get hpa api-hpa -n production -w

# Install metrics-server (required for CPU/memory HPA)
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

# Check current pod resource usage
kubectl top pods -n production
kubectl top nodes

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: api-vpa
  namespace: production
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-deployment
  updatePolicy:
    updateMode: "Auto"         # Off | Initial | Recreate | Auto
    # Off        = only recommendations, no changes
    # Initial    = set only on new pods
    # Recreate   = evict and recreate pods to apply
    # Auto       = evict and recreate (default for production)
  resourcePolicy:
    containerPolicies:
    - containerName: api
      minAllowed:
        cpu: 100m
        memory: 128Mi
      maxAllowed:
        cpu: 2000m
        memory: 4Gi
      controlledResources: ["cpu", "memory"]

# Install VPA (from GitHub)
kubectl apply -f https://github.com/kubernetes/autoscaler/raw/master/vertical-pod-autoscaler/deploy/vpa-v1-crd-gen.yaml

# View VPA recommendations
kubectl describe vpa api-vpa -n production
# Look for:
# Recommendation:
#   Container Recommendations:
#     Container Name: api
#     Lower Bound:    cpu: 50m, memory: 128Mi
#     Target:         cpu: 240m, memory: 400Mi   ← apply this
#     Upper Bound:    cpu: 800m, memory: 1Gi

# Get VPA objects
kubectl get vpa -n production

# Enable when creating cluster
gcloud container clusters create my-cluster \
  --enable-autoscaling \
  --min-nodes=1 --max-nodes=10 \
  --zone=us-central1-a

# Enable on existing node pool
gcloud container clusters update my-cluster \
  --enable-autoscaling \
  --min-nodes=2 --max-nodes=20 \
  --node-pool=default-pool

# Add annotation to keep pod on specific node during scale-down
kubectl annotate pod my-pod \
  cluster-autoscaler.kubernetes.io/safe-to-evict=false

# PersistentVolumeClaim — request storage
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-pvc
  namespace: production
spec:
  accessModes:
  - ReadWriteOnce            # RWO: single node R/W
                              # ROX: many nodes read-only
                              # RWX: many nodes R/W (NFS)
  storageClassName: standard-rwo
  resources:
    requests:
      storage: 20Gi

---
# Use PVC in a Deployment
spec:
  containers:
  - name: postgres
    image: postgres:16
    volumeMounts:
    - name: data
      mountPath: /var/lib/postgresql/data
  volumes:
  - name: data
    persistentVolumeClaim:
      claimName: postgres-pvc   # Reference the PVC above

# Apply single file
kubectl apply -f deployment.yaml

# Apply all files in directory
kubectl apply -f k8s/

# Apply with recursive subdirectories
kubectl apply -f k8s/ --recursive

# Dry run — see what would change
kubectl apply -f deployment.yaml --dry-run=client
kubectl apply -f deployment.yaml --dry-run=server  # More accurate

# Diff — show changes before applying
kubectl diff -f deployment.yaml

# Update image (triggers rolling update)
kubectl set image deployment/api-deployment \
  api=gcr.io/my-project/api:v2.2.0

# Scale replicas manually
kubectl scale deployment api-deployment --replicas=5

# Watch rollout progress
kubectl rollout status deployment/api-deployment -n production -w

# See rollout history
kubectl rollout history deployment/api-deployment

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 1          # Allow 1 extra pod (4 running during update on 3 replicas)
    maxUnavailable: 0    # Never have less than 3 ready pods (zero downtime)

# High-availability config (more surge, faster update):
#   maxSurge: 25%
#   maxUnavailable: 25%

# Zero-downtime absolute guarantee:
#   maxSurge: 1
#   maxUnavailable: 0

# View rollout history (shows revision numbers)
kubectl rollout history deployment/api-deployment -n production
# REVISION  CHANGE-CAUSE
# 1         Initial deploy
# 2         kubectl set image ... api=v2.0
# 3         kubectl set image ... api=v2.1  ← current

# View details of a specific revision
kubectl rollout history deployment/api-deployment --revision=2

# Rollback to immediately previous revision
kubectl rollout undo deployment/api-deployment -n production

# Rollback to specific revision
kubectl rollout undo deployment/api-deployment --to-revision=1

# Pause a rollout (to manually verify)
kubectl rollout pause deployment/api-deployment

# Resume paused rollout
kubectl rollout resume deployment/api-deployment

# Keep revision history (default: 10)
# Set in deployment spec:
#   revisionHistoryLimit: 5

# Annotate deployment (shows in history CHANGE-CAUSE)
kubectl annotate deployment api-deployment \
  kubernetes.io/change-cause="Deploy v2.1.0 - fix memory leak"

# HTTP probe (most common — checks /health endpoint)
livenessProbe:
  httpGet:
    path: /health/live
    port: 8080
    httpHeaders:
    - name: X-Health-Check
      value: kubernetes
  initialDelaySeconds: 20    # Wait 20s before first probe
  periodSeconds: 10          # Probe every 10s
  timeoutSeconds: 5          # Fail after 5s no response
  failureThreshold: 3        # Kill after 3 consecutive failures
  successThreshold: 1

readinessProbe:
  httpGet:
    path: /health/ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5
  failureThreshold: 2        # Remove from LB after 2 failures (fast)

startupProbe:
  httpGet:
    path: /health/live
    port: 8080
  failureThreshold: 30       # 30 × 10s = 5min to start
  periodSeconds: 10

---
# TCP probe (for databases, non-HTTP services)
livenessProbe:
  tcpSocket:
    port: 5432
  initialDelaySeconds: 30
  periodSeconds: 10

# Exec probe (run command inside container)
livenessProbe:
  exec:
    command:
    - /bin/sh
    - -c
    - "redis-cli ping | grep PONG"
  initialDelaySeconds: 5
  periodSeconds: 10

# gRPC probe (.NET 8+ with gRPC health check)
livenessProbe:
  grpc:
    port: 8080
    service: grpc.health.v1.Health

# Get resources — basic
kubectl get pods
kubectl get pods -n production
kubectl get pods -A                          # All namespaces
kubectl get pods -o wide                     # Shows node, IP
kubectl get pods -l app=api                  # Label selector
kubectl get pods --field-selector status.phase=Running

# Get with output formats
kubectl get deployment api-deployment -o yaml    # Full YAML spec
kubectl get deployment api-deployment -o json    # Full JSON
kubectl get pods -o jsonpath='{.items[*].metadata.name}'  # Specific field
kubectl get pods -o custom-columns=NAME:.metadata.name,STATUS:.status.phase

# Get multiple resource types
kubectl get pods,services,deployments -n production

# Watch (live updates)
kubectl get pods -w
kubectl get pods -n production -w

kubectl describe pod api-pod-abc123
kubectl describe deployment api-deployment -n production
kubectl describe node my-node
kubectl describe service api-service
kubectl describe pvc postgres-pvc

# Basic logs
kubectl logs pod-name
kubectl logs pod-name -n production
kubectl logs pod-name -c container-name      # Specific container in multi-container pod

# Stream live logs
kubectl logs -f pod-name
kubectl logs -f deployment/api-deployment    # From deployment (picks one pod)

# Previous container instance (after crash)
kubectl logs pod-name --previous

# Tail last N lines
kubectl logs pod-name --tail=100
kubectl logs pod-name --since=1h             # Last 1 hour
kubectl logs pod-name --since-time=2025-01-01T00:00:00Z

# Logs from all pods with label (requires stern or manual loop)
kubectl logs -l app=api --prefix=true --all-containers=true -f

# Open interactive shell
kubectl exec -it pod-name -- /bin/bash
kubectl exec -it pod-name -- /bin/sh         # If bash not available
kubectl exec -it pod-name -c container-name -- /bin/bash

# Run single command
kubectl exec pod-name -- env
kubectl exec pod-name -- cat /etc/config/app.conf
kubectl exec pod-name -- curl http://localhost:8080/health

# Copy files to/from pod
kubectl cp pod-name:/app/logs/error.log ./error.log
kubectl cp ./config.json pod-name:/app/config.json

# Forward localhost:8080 → pod:8080
kubectl port-forward pod/api-pod-abc123 8080:8080

# Forward to service (recommended — picks a healthy pod)
kubectl port-forward service/api-service 8080:80 -n production

# Forward to deployment
kubectl port-forward deployment/api-deployment 8080:8080

# Multiple ports
kubectl port-forward service/api-service 8080:80 8443:443

# Access Kubernetes Dashboard
kubectl port-forward -n kubernetes-dashboard service/kubernetes-dashboard 8443:443

# Declarative (preferred — idempotent)
kubectl apply -f manifest.yaml
kubectl apply -f k8s/ --recursive

# Imperative creates (good for quick testing)
kubectl create deployment nginx --image=nginx:latest --replicas=2
kubectl create service clusterip my-svc --tcp=80:8080
kubectl create configmap app-config --from-literal=ENV=prod --from-file=config.properties
kubectl create secret generic db-creds --from-literal=pw=secret123

# Edit live object in editor
kubectl edit deployment api-deployment -n production

# Patch — surgical update without full YAML
kubectl patch deployment api-deployment \
  --patch '{"spec":{"replicas":5}}'

kubectl patch deployment api-deployment \
  --type=json \
  -p='[{"op":"replace","path":"/spec/template/spec/containers/0/image","value":"myapp:v3"}]'

# Label / Annotate
kubectl label pod my-pod environment=production
kubectl annotate deployment api-deployment version="2.1.0"

# Debug pod with ephemeral container (K8s 1.23+)
kubectl debug -it pod-name --image=busybox:latest --target=app

# Debug with a copy of the pod (preserves original)
kubectl debug pod-name --copy-to=pod-name-debug --image=ubuntu

# Describe events for a pod (most useful for scheduling issues)
kubectl describe pod pod-name | grep -A 20 Events

# Get all events in namespace sorted by time
kubectl get events -n production --sort-by=.metadata.creationTimestamp

# Get only Warning events
kubectl get events -n production --field-selector type=Warning

# Check resource usage
kubectl top pods -n production
kubectl top pods -n production --sort-by=memory
kubectl top nodes

# Check why pod is pending
kubectl describe pod pending-pod | grep -A 10 "Events:"
# Common causes: Insufficient CPU/Memory, No nodes match selector,
#                PVC not bound, Image pull error

# Check node conditions
kubectl describe node my-node | grep -A 10 "Conditions:"

# View API server audit logs
kubectl get events --all-namespaces | grep Warning | head -20

# Validate YAML manifest
kubectl apply -f manifest.yaml --dry-run=server --validate=true

# Delete by name
kubectl delete pod my-pod
kubectl delete deployment api-deployment -n production
kubectl delete service api-service -n production

# Delete by file (opposite of apply)
kubectl delete -f deployment.yaml
kubectl delete -f k8s/ --recursive

# Delete by label selector
kubectl delete pods -l app=api -n production
kubectl delete all -l app=my-app -n production

# Delete all pods in namespace (they will restart if managed by Deployment)
kubectl delete pods --all -n production

# Delete all resources in namespace (use with caution!)
kubectl delete all --all -n staging
# Note: "all" doesn't include PVCs, Secrets, ConfigMaps

# Delete EVERYTHING in namespace including PVCs, ConfigMaps, Secrets
kubectl delete namespace staging          # ⚠️ DESTRUCTIVE - deletes everything inside

# Force delete stuck pod (last resort — may cause split-brain)
kubectl delete pod stuck-pod --force --grace-period=0

# Delete completed/failed jobs
kubectl delete jobs --field-selector status.successful=1
kubectl delete pods --field-selector status.phase=Succeeded
kubectl delete pods --field-selector status.phase=Failed

# Delete evicted pods
kubectl get pods -A | grep Evicted | awk '{print $2 " -n " $1}' | xargs kubectl delete pod

# Drain a node (for maintenance)
kubectl drain my-node --ignore-daemonsets --delete-emptydir-data
kubectl cordon my-node        # Mark unschedulable but don't evict
kubectl uncordon my-node      # Return to schedulable

# Remove node from cluster
kubectl drain my-node --ignore-daemonsets
kubectl delete node my-node

# View all contexts (clusters you can connect to)
kubectl config get-contexts

# Switch context
kubectl config use-context my-prod-cluster
kubectl config use-context gke_project_zone_cluster

# View current context
kubectl config current-context

# Set default namespace for context
kubectl config set-context --current --namespace=production

# Rename a context
kubectl config rename-context old-name new-name

# Delete a context
kubectl config delete-context old-cluster

# Role — permissions within a namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
- apiGroups: [""]               # "" = core group
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list"]

---
# ClusterRole — cluster-wide permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]

---
# RoleBinding — bind Role to user/group/serviceaccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods-binding
  namespace: production
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader
subjects:
- kind: User
  name: alice@company.com    # GCP IAM user (on GKE)
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: ci-service-account
  namespace: production

# Pending — pod not scheduled to a node
# → Insufficient CPU/memory on nodes
# → No nodes match nodeSelector/affinity
# → PVC not bound
kubectl describe pod <pod> | grep -A 15 Events

# CrashLoopBackOff — container starting and crashing repeatedly
# → Application error on startup
# → Bad config / missing env var
# → Memory limit too low (OOMKilled)
kubectl logs <pod> --previous      # Logs from previous crash
kubectl describe pod <pod> | grep "Last State"

# ImagePullBackOff / ErrImagePull
# → Wrong image name/tag
# → Private registry — imagePullSecret not configured
kubectl describe pod <pod> | grep -A 5 "Failed to pull"

# OOMKilled — container exceeded memory limit
kubectl describe pod <pod> | grep -A 3 "OOM"
# Fix: increase memory limit, or investigate memory leak

# Terminating (stuck)
# → Finalizers preventing deletion
kubectl patch pod <pod> -p '{"metadata":{"finalizers":[]}}' --type=merge
kubectl delete pod <pod> --force --grace-period=0

# Service not routing traffic
# → Selector doesn't match pod labels
kubectl get endpoints <service-name>   # Should show pod IPs — if empty, selector is wrong
kubectl get pods -l app=my-app          # Check labels match service selector

# DNS resolution failing inside pod
kubectl exec -it <pod> -- nslookup api-service
kubectl exec -it <pod> -- curl http://api-service.production.svc.cluster.local/health

# kubectl shorthand
alias k='kubectl'
alias kgp='kubectl get pods'
alias kgpa='kubectl get pods -A'
alias kgs='kubectl get services'
alias kgd='kubectl get deployments'
alias kgn='kubectl get nodes'
alias kdp='kubectl describe pod'
alias kdd='kubectl describe deployment'
alias kl='kubectl logs'
alias klf='kubectl logs -f'
alias kaf='kubectl apply -f'
alias kdf='kubectl delete -f'
alias kns='kubectl config set-context --current --namespace'
alias kctx='kubectl config use-context'
alias ktc='kubectl top pods'

# Switch namespace quickly
function kn() { kubectl config set-context --current --namespace=$1 }

# Watch pods
alias kwatch='kubectl get pods -w'