Kubernetes: Zero to Hero

# Kubernetes (K8s) = Container Orchestration Platform
# Developed by Google, now maintained by CNCF

# The problem Kubernetes solves:
# - How do you manage 100s or 1000s of containers?
# - How do you ensure high availability?
# - How do you scale automatically?
# - How do you update without downtime?
# - How do you recover from failures?

# Kubernetes provides:
# ✓ Automatic container deployment
# ✓ Scaling (up/down based on load)
# ✓ Load balancing
# ✓ Self-healing (restart failed containers)
# ✓ Rolling updates & rollbacks
# ✓ Service discovery
# ✓ Secret & configuration management
# ✓ Storage orchestration

# Think of K8s as a "datacenter operating system"
# It manages your containers like an OS manages processes

# Kubernetes vs Docker - They're COMPLEMENTARY!

# DOCKER:
# - Builds container images
# - Runs individual containers
# - Great for development
# - Single host focus

# KUBERNETES:
# - Orchestrates containers across MULTIPLE hosts
# - Manages container lifecycle at scale
# - Production-grade features
# - Cluster management

# Analogy:
# Docker = A musician who can play instruments
# Kubernetes = The conductor of an orchestra

# Docker builds and runs containers
# Kubernetes tells containers WHERE and HOW to run

# You need BOTH:
# 1. Build images with Docker (or alternatives)
# 2. Deploy and manage with Kubernetes

# Essential Kubernetes Terminology

# CLUSTER
# - A set of machines (nodes) running Kubernetes
# - Has Control Plane + Worker Nodes

# NODE
# - A machine (physical or VM) in the cluster
# - Worker nodes run your containers
# - Control plane nodes manage the cluster

# POD
# - Smallest deployable unit in K8s
# - Contains one or more containers
# - Containers in a pod share network/storage
# - Pods are ephemeral (can be replaced anytime)

# DEPLOYMENT
# - Manages pods declaratively
# - Defines desired state (replicas, image, etc.)
# - Handles rolling updates & rollbacks

# SERVICE
# - Stable network endpoint for pods
# - Load balances traffic to pods
# - Types: ClusterIP, NodePort, LoadBalancer

# NAMESPACE
# - Virtual cluster within a cluster
# - Isolates resources (like folders)
# - Examples: dev, staging, production

# CONFIGMAP & SECRET
# - External configuration for pods
# - ConfigMap: non-sensitive data
# - Secret: sensitive data (encoded)

# Control Plane Components (Master Node)
# These manage the cluster state

# API SERVER (kube-apiserver)
# - Front door to Kubernetes
# - All communication goes through here
# - RESTful API
# - Validates and configures data

# ETCD
# - Distributed key-value store
# - Stores ALL cluster state
# - The "source of truth"
# - Highly available (usually 3+ replicas)

# SCHEDULER (kube-scheduler)
# - Assigns pods to nodes
# - Considers resources, constraints, affinity
# - "Where should this pod run?"

# CONTROLLER MANAGER (kube-controller-manager)
# - Runs controllers (control loops)
# - Node Controller: monitors node health
# - Replication Controller: maintains pod count
# - Endpoints Controller: populates Services
# - Service Account Controller: creates accounts

# CLOUD CONTROLLER MANAGER
# - Integrates with cloud providers
# - Manages load balancers, routes, volumes
# - Only in cloud deployments

# Worker Node Components
# These run on every worker node

# KUBELET
# - Agent that runs on each node
# - Ensures containers are running in pods
# - Communicates with API server
# - Reports node and pod status

# KUBE-PROXY
# - Network proxy on each node
# - Implements Service concept
# - Manages network rules (iptables/IPVS)
# - Enables pod-to-pod communication

# CONTAINER RUNTIME
# - Runs containers (Docker, containerd, CRI-O)
# - Kubernetes is container-runtime agnostic
# - containerd is most common today

# The flow:
# 1. You: kubectl apply -f deployment.yaml
# 2. API Server: validates and stores in etcd
# 3. Scheduler: assigns pods to nodes
# 4. Kubelet: pulls image, starts containers
# 5. Kube-proxy: sets up networking

# Install kubectl - The Kubernetes CLI

# macOS (Homebrew):
brew install kubectl

# macOS (curl):
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/

# Linux (curl):
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/

# Windows (Chocolatey):
choco install kubernetes-cli

# Verify installation:
kubectl version --client

# Output:
# Client Version: v1.29.0
# Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3

# Minikube - Local Kubernetes for Development

# macOS:
brew install minikube

# Linux:
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube

# Windows:
choco install minikube

# Start a cluster:
minikube start

# With specific resources:
minikube start --cpus=4 --memory=8192 --driver=docker

# Check status:
minikube status

# Access Kubernetes dashboard:
minikube dashboard

# Stop cluster:
minikube stop

# Delete cluster:
minikube delete

# Useful addons:
minikube addons enable ingress
minikube addons enable metrics-server
minikube addons list

# Kind - Kubernetes IN Docker (for CI/CD)

# Install Kind:
# macOS:
brew install kind

# Linux:
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.20.0/kind-linux-amd64
chmod +x ./kind
sudo mv ./kind /usr/local/bin/kind

# Create a cluster:
kind create cluster

# Create with custom name:
kind create cluster --name my-cluster

# Multi-node cluster (create config file first):
cat <<EOF | kind create cluster --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
- role: worker
- role: worker
EOF

# List clusters:
kind get clusters

# Delete cluster:
kind delete cluster --name my-cluster

# Load local Docker image to Kind:
kind load docker-image my-app:latest

# K3s - Lightweight Kubernetes for Edge/IoT

# Install K3s (single command!):
curl -sfL https://get.k3s.io | sh -

# Check if running:
sudo systemctl status k3s

# Get kubeconfig:
sudo cat /etc/rancher/k3s/k3s.yaml

# Use kubectl (included with k3s):
sudo k3s kubectl get nodes

# Or copy config for regular kubectl:
mkdir -p ~/.kube
sudo cp /etc/rancher/k3s/k3s.yaml ~/.kube/config
sudo chown $(id -u):$(id -g) ~/.kube/config

# Add a worker node:
# On master, get token:
sudo cat /var/lib/rancher/k3s/server/node-token

# On worker:
curl -sfL https://get.k3s.io | K3S_URL=https://master-ip:6443 K3S_TOKEN=<token> sh -

# Uninstall:
/usr/local/bin/k3s-uninstall.sh

# kubectl Configuration

# View current context:
kubectl config current-context

# List all contexts:
kubectl config get-contexts

# Switch context:
kubectl config use-context my-cluster

# View config:
kubectl config view

# Set default namespace for context:
kubectl config set-context --current --namespace=my-namespace

# Create a new context:
kubectl config set-context my-context \
  --cluster=my-cluster \
  --user=my-user \
  --namespace=my-namespace

# Kubeconfig file location:
# Default: ~/.kube/config
# Override with: export KUBECONFIG=/path/to/config

# Merge multiple kubeconfig files:
export KUBECONFIG=~/.kube/config:~/.kube/other-config
kubectl config view --flatten > ~/.kube/merged-config

# Essential kubectl Commands

# ========== GET RESOURCES ==========
kubectl get pods                    # List pods in current namespace
kubectl get pods -A                 # List pods in ALL namespaces
kubectl get pods -o wide            # More details (IP, node)
kubectl get pods -o yaml            # Full YAML output
kubectl get pods -o json            # Full JSON output
kubectl get pods --watch            # Watch for changes
kubectl get pods -l app=nginx       # Filter by label

kubectl get nodes                   # List cluster nodes
kubectl get services                # List services
kubectl get deployments             # List deployments
kubectl get all                     # List common resources

# ========== DESCRIBE (detailed info) ==========
kubectl describe pod my-pod
kubectl describe node my-node
kubectl describe service my-service

# ========== CREATE / APPLY ==========
kubectl apply -f manifest.yaml      # Create/update from file
kubectl apply -f ./manifests/       # Apply all files in directory
kubectl apply -f https://url.com/manifest.yaml

kubectl create deployment nginx --image=nginx
kubectl create namespace my-ns

# ========== DELETE ==========
kubectl delete pod my-pod
kubectl delete -f manifest.yaml
kubectl delete deployment my-deploy
kubectl delete pods --all           # Delete all pods in namespace

# Advanced kubectl Commands

# ========== LOGS ==========
kubectl logs my-pod                 # View pod logs
kubectl logs my-pod -c my-container # Specific container
kubectl logs my-pod -f              # Follow logs (stream)
kubectl logs my-pod --tail=100      # Last 100 lines
kubectl logs my-pod --since=1h      # Last hour
kubectl logs -l app=nginx           # Logs by label

# ========== EXEC (run commands in pod) ==========
kubectl exec my-pod -- ls -la
kubectl exec my-pod -- cat /etc/config
kubectl exec -it my-pod -- /bin/bash    # Interactive shell
kubectl exec -it my-pod -c container -- sh

# ========== PORT FORWARD ==========
kubectl port-forward pod/my-pod 8080:80
kubectl port-forward svc/my-service 8080:80
kubectl port-forward deploy/my-deploy 8080:80

# ========== COPY FILES ==========
kubectl cp my-pod:/path/file ./local-file
kubectl cp ./local-file my-pod:/path/file

# ========== DEBUGGING ==========
kubectl get events                  # Cluster events
kubectl get events --sort-by='.lastTimestamp'
kubectl top pods                    # Resource usage
kubectl top nodes
kubectl api-resources               # List all resource types

# ========== DRY RUN (test without applying) ==========
kubectl apply -f manifest.yaml --dry-run=client
kubectl apply -f manifest.yaml --dry-run=server

# kubectl Shortcuts & Aliases

# Built-in short names:
kubectl get po          # pods
kubectl get svc         # services
kubectl get deploy      # deployments
kubectl get ns          # namespaces
kubectl get no          # nodes
kubectl get cm          # configmaps
kubectl get secret      # secrets
kubectl get pv          # persistentvolumes
kubectl get pvc         # persistentvolumeclaims
kubectl get ing         # ingresses
kubectl get ds          # daemonsets
kubectl get sts         # statefulsets
kubectl get rs          # replicasets
kubectl get ep          # endpoints
kubectl get sa          # serviceaccounts

# Recommended bash aliases (~/.bashrc or ~/.zshrc):
alias k='kubectl'
alias kgp='kubectl get pods'
alias kgpa='kubectl get pods -A'
alias kgs='kubectl get services'
alias kgd='kubectl get deployments'
alias kgn='kubectl get nodes'
alias kdp='kubectl describe pod'
alias kl='kubectl logs'
alias klf='kubectl logs -f'
alias ke='kubectl exec -it'
alias kaf='kubectl apply -f'
alias kdf='kubectl delete -f'

# Enable kubectl autocompletion:
# Bash:
echo 'source <(kubectl completion bash)' >> ~/.bashrc

# Zsh:
echo 'source <(kubectl completion zsh)' >> ~/.zshrc

# Pods - The Smallest Deployable Unit

# A Pod is:
# - One or more containers that share:
#   - Network namespace (same IP, localhost)
#   - Storage volumes
#   - Lifecycle (created/deleted together)
# - Ephemeral - can be replaced anytime
# - Usually managed by a controller (Deployment)

# When to use multi-container pods:
# - Sidecar pattern (logging, proxies)
# - Adapter pattern (format conversion)
# - Ambassador pattern (connection proxying)

# Pod lifecycle states:
# - Pending: scheduled, waiting for resources
# - Running: at least one container running
# - Succeeded: all containers completed successfully
# - Failed: at least one container failed
# - Unknown: cannot determine state

# pod.yaml - Simple Pod definition
apiVersion: v1
kind: Pod
metadata:
  name: my-nginx
  labels:
    app: nginx
    environment: development
  annotations:
    description: "Demo nginx pod"
spec:
  containers:
  - name: nginx
    image: nginx:1.25-alpine
    ports:
    - containerPort: 80
      name: http
    resources:
      requests:
        memory: "64Mi"
        cpu: "100m"
      limits:
        memory: "128Mi"
        cpu: "200m"
    env:
    - name: NGINX_HOST
      value: "localhost"
    volumeMounts:
    - name: html-volume
      mountPath: /usr/share/nginx/html
  volumes:
  - name: html-volume
    emptyDir: {}
  restartPolicy: Always

# Multi-container Pod (Sidecar Pattern)
apiVersion: v1
kind: Pod
metadata:
  name: web-with-sidecar
spec:
  containers:
  # Main application container
  - name: web-app
    image: nginx:alpine
    ports:
    - containerPort: 80
    volumeMounts:
    - name: shared-logs
      mountPath: /var/log/nginx

  # Sidecar: Log shipper
  - name: log-shipper
    image: fluent/fluent-bit:latest
    volumeMounts:
    - name: shared-logs
      mountPath: /var/log/nginx
      readOnly: true
    - name: fluent-config
      mountPath: /fluent-bit/etc/

  # Sidecar: Metrics exporter
  - name: metrics-exporter
    image: nginx/nginx-prometheus-exporter:latest
    args:
    - "-nginx.scrape-uri=http://localhost/nginx_status"
    ports:
    - containerPort: 9113
      name: metrics

  volumes:
  - name: shared-logs
    emptyDir: {}
  - name: fluent-config
    configMap:
      name: fluent-bit-config

# Pod Lifecycle Hooks & Probes
apiVersion: v1
kind: Pod
metadata:
  name: lifecycle-demo
spec:
  containers:
  - name: app
    image: my-app:latest

    # Startup Probe - for slow-starting containers
    startupProbe:
      httpGet:
        path: /healthz
        port: 8080
      failureThreshold: 30
      periodSeconds: 10

    # Liveness Probe - restart if unhealthy
    livenessProbe:
      httpGet:
        path: /healthz
        port: 8080
      initialDelaySeconds: 10
      periodSeconds: 5
      failureThreshold: 3

    # Readiness Probe - remove from service if not ready
    readinessProbe:
      httpGet:
        path: /ready
        port: 8080
      initialDelaySeconds: 5
      periodSeconds: 3

    # Lifecycle hooks
    lifecycle:
      postStart:
        exec:
          command: ["/bin/sh", "-c", "echo Started > /tmp/started"]
      preStop:
        exec:
          command: ["/bin/sh", "-c", "nginx -s quit; sleep 10"]

# Deployments - Declarative Pod Management

# A Deployment:
# - Manages ReplicaSets (which manage Pods)
# - Ensures desired number of pods are running
# - Handles rolling updates
# - Supports rollbacks
# - Self-healing (replaces failed pods)

# Why use Deployments instead of Pods?
# - Pods are ephemeral, no self-healing
# - Deployments maintain desired state
# - Easy scaling (kubectl scale)
# - Rolling updates without downtime
# - Rollback to previous versions

# Deployment → ReplicaSet → Pods
# The Deployment creates ReplicaSets
# ReplicaSets ensure pod count
# You rarely interact with ReplicaSets directly

# deployment.yaml - Production-ready example
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx

  # Update strategy
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1      # Max pods that can be unavailable
      maxSurge: 1            # Max pods above desired count

  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.25-alpine
        ports:
        - containerPort: 80

        resources:
          requests:
            memory: "64Mi"
            cpu: "100m"
          limits:
            memory: "128Mi"
            cpu: "200m"

        livenessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 10
          periodSeconds: 5

        readinessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 5
          periodSeconds: 3

# Deployment Commands

# Create deployment imperatively:
kubectl create deployment nginx --image=nginx:1.25
kubectl create deployment nginx --image=nginx --replicas=3

# Apply from file:
kubectl apply -f deployment.yaml

# View deployments:
kubectl get deployments
kubectl get deploy nginx-deployment -o yaml
kubectl describe deployment nginx-deployment

# ========== SCALING ==========
kubectl scale deployment nginx-deployment --replicas=5

# Autoscaling (HPA):
kubectl autoscale deployment nginx-deployment \
  --min=2 --max=10 --cpu-percent=80

# ========== UPDATES ==========
# Update image:
kubectl set image deployment/nginx-deployment nginx=nginx:1.26

# Update via edit (opens editor):
kubectl edit deployment nginx-deployment

# ========== ROLLOUT STATUS ==========
kubectl rollout status deployment/nginx-deployment
kubectl rollout history deployment/nginx-deployment

# ========== ROLLBACK ==========
kubectl rollout undo deployment/nginx-deployment
kubectl rollout undo deployment/nginx-deployment --to-revision=2

# Pause/resume rollout:
kubectl rollout pause deployment/nginx-deployment
kubectl rollout resume deployment/nginx-deployment

# ========== DELETE ==========
kubectl delete deployment nginx-deployment

# Services - Stable Network Endpoints

# Problem: Pods are ephemeral
# - Pods get new IPs when recreated
# - How do other pods find them?
# - How does external traffic reach them?

# Solution: Services
# - Stable DNS name and IP
# - Load balances to healthy pods
# - Uses labels to select pods

# Service Types:
# 1. ClusterIP (default)
#    - Internal cluster IP only
#    - Only reachable within cluster
#    - Use for internal communication

# 2. NodePort
#    - Exposes on each node's IP
#    - Port range: 30000-32767
#    - External access without load balancer

# 3. LoadBalancer
#    - Provisions cloud load balancer
#    - External IP assigned by cloud provider
#    - Most common for production

# 4. ExternalName
#    - Maps to external DNS name
#    - No proxying, just DNS CNAME

# ClusterIP Service (default)
apiVersion: v1
kind: Service
metadata:
  name: backend-service
spec:
  type: ClusterIP           # Optional, this is default
  selector:
    app: backend            # Selects pods with this label
  ports:
  - name: http
    port: 80                # Service port
    targetPort: 8080        # Container port
    protocol: TCP

---
# Headless Service (no load balancing, direct pod DNS)
apiVersion: v1
kind: Service
metadata:
  name: database-headless
spec:
  clusterIP: None           # Makes it headless
  selector:
    app: database
  ports:
  - port: 5432
    targetPort: 5432

# DNS resolution:
# ClusterIP:  backend-service.namespace.svc.cluster.local
# Headless:   pod-name.database-headless.namespace.svc.cluster.local

# NodePort Service
apiVersion: v1
kind: Service
metadata:
  name: web-nodeport
spec:
  type: NodePort
  selector:
    app: web
  ports:
  - name: http
    port: 80                # Internal cluster port
    targetPort: 8080        # Container port
    nodePort: 30080         # External port (30000-32767)
    # If not specified, K8s assigns random port

---
# Access the service:
# http://<any-node-ip>:30080

# Get node IPs:
# kubectl get nodes -o wide

# With Minikube:
# minikube service web-nodeport --url

# LoadBalancer Service
apiVersion: v1
kind: Service
metadata:
  name: web-loadbalancer
  annotations:
    # Cloud-specific annotations
    service.beta.kubernetes.io/aws-load-balancer-type: nlb
    service.beta.kubernetes.io/aws-load-balancer-internal: "false"
spec:
  type: LoadBalancer
  selector:
    app: web
  ports:
  - name: http
    port: 80
    targetPort: 8080
  - name: https
    port: 443
    targetPort: 8443

  # Optional: specify desired external IP
  # loadBalancerIP: 1.2.3.4

  # Optional: limit source IPs
  # loadBalancerSourceRanges:
  # - 10.0.0.0/8

---
# Check external IP:
# kubectl get svc web-loadbalancer
# NAME               TYPE           EXTERNAL-IP     PORT(S)
# web-loadbalancer   LoadBalancer   203.0.113.10    80:31234/TCP

# ConfigMaps - External Configuration

# ConfigMaps store non-sensitive configuration:
# - Environment variables
# - Configuration files
# - Command-line arguments

# Benefits:
# - Separate config from container image
# - Update config without rebuilding
# - Share config across multiple pods
# - Environment-specific values

# ConfigMap Examples

# From literal values:
kubectl create configmap app-config \
  --from-literal=DATABASE_HOST=postgres \
  --from-literal=LOG_LEVEL=info

# From file:
kubectl create configmap nginx-config --from-file=nginx.conf

# From directory:
kubectl create configmap configs --from-file=./config-dir/

---
# configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  # Simple key-value pairs
  DATABASE_HOST: "postgres.default.svc.cluster.local"
  DATABASE_PORT: "5432"
  LOG_LEVEL: "info"

  # Multi-line configuration file
  app.properties: |
    server.port=8080
    server.host=0.0.0.0
    feature.enabled=true

  nginx.conf: |
    server {
      listen 80;
      location / {
        proxy_pass http://backend:8080;
      }
    }

# Using ConfigMaps in Pods
apiVersion: v1
kind: Pod
metadata:
  name: app-with-config
spec:
  containers:
  - name: app
    image: my-app:latest

    # Method 1: Environment variables from ConfigMap
    env:
    - name: DB_HOST
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: DATABASE_HOST

    # Method 2: All keys as environment variables
    envFrom:
    - configMapRef:
        name: app-config
        # optional: true  # Don't fail if ConfigMap missing

    # Method 3: Mount as files
    volumeMounts:
    - name: config-volume
      mountPath: /etc/config
      readOnly: true

    # Method 4: Mount specific key as file
    - name: nginx-config
      mountPath: /etc/nginx/nginx.conf
      subPath: nginx.conf

  volumes:
  - name: config-volume
    configMap:
      name: app-config
  - name: nginx-config
    configMap:
      name: app-config
      items:
      - key: nginx.conf
        path: nginx.conf

# Secrets - Sensitive Data Storage

# Secrets store sensitive data:
# - Passwords
# - API keys
# - TLS certificates
# - SSH keys

# Important security notes:
# - Secrets are base64 encoded (NOT encrypted!)
# - Enable encryption at rest in etcd
# - Use RBAC to limit access
# - Consider external secret managers
#   (HashiCorp Vault, AWS Secrets Manager)

# Secret types:
# - Opaque: arbitrary user-defined data
# - kubernetes.io/tls: TLS certificates
# - kubernetes.io/dockerconfigjson: Docker registry credentials
# - kubernetes.io/basic-auth: basic authentication
# - kubernetes.io/ssh-auth: SSH authentication

# Secret Examples

# Create from literal (auto base64 encodes):
kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-literal=password='S3cr3tP@ssw0rd!'

# Create TLS secret:
kubectl create secret tls my-tls \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key

# Create Docker registry secret:
kubectl create secret docker-registry regcred \
  --docker-server=ghcr.io \
  --docker-username=user \
  --docker-password=token \
  --docker-email=user@example.com

---
# secret.yaml (values must be base64 encoded)
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  # echo -n 'admin' | base64
  username: YWRtaW4=
  # echo -n 'password123' | base64
  password: cGFzc3dvcmQxMjM=

---
# Using stringData (auto-encodes, easier to read)
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
stringData:
  username: admin
  password: password123

# Using Secrets in Pods
apiVersion: v1
kind: Pod
metadata:
  name: app-with-secrets
spec:
  containers:
  - name: app
    image: my-app:latest

    # Method 1: Environment variable from Secret
    env:
    - name: DB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: db-credentials
          key: password

    # Method 2: All keys as environment variables
    envFrom:
    - secretRef:
        name: db-credentials

    # Method 3: Mount as files
    volumeMounts:
    - name: secret-volume
      mountPath: /etc/secrets
      readOnly: true

  volumes:
  - name: secret-volume
    secret:
      secretName: db-credentials
      # Optional: set file permissions
      defaultMode: 0400

---
# Using Docker registry secret
apiVersion: v1
kind: Pod
metadata:
  name: private-image-pod
spec:
  containers:
  - name: app
    image: ghcr.io/myorg/private-app:latest
  imagePullSecrets:
  - name: regcred

# Kubernetes Storage Concepts

# VOLUMES - Temporary or persistent storage for pods

# Volume Types:
# 1. emptyDir - temporary, deleted with pod
# 2. hostPath - mounts host filesystem (dangerous!)
# 3. configMap/secret - configuration data
# 4. persistentVolumeClaim - persistent storage
# 5. nfs - Network File System
# 6. cloud volumes - AWS EBS, GCE PD, Azure Disk

# PERSISTENT VOLUMES (PV)
# - Cluster-level storage resource
# - Provisioned by admin or dynamically
# - Independent of pod lifecycle

# PERSISTENT VOLUME CLAIMS (PVC)
# - Request for storage by user
# - Binds to a matching PV
# - Used by pods to access storage

# STORAGE CLASSES
# - Define "classes" of storage
# - Enable dynamic provisioning
# - Examples: fast-ssd, standard, slow-hdd

# Volume Examples
apiVersion: v1
kind: Pod
metadata:
  name: volume-demo
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    # emptyDir - shared between containers
    - name: cache
      mountPath: /cache

    # hostPath - access host filesystem
    - name: host-logs
      mountPath: /var/log/host

    # configMap as volume
    - name: config
      mountPath: /etc/config
      readOnly: true

  volumes:
  # Temporary storage, deleted with pod
  - name: cache
    emptyDir:
      sizeLimit: 500Mi

  # Mount host directory (use with caution!)
  - name: host-logs
    hostPath:
      path: /var/log
      type: Directory

  # ConfigMap as files
  - name: config
    configMap:
      name: my-config

# PersistentVolume (cluster resource)
apiVersion: v1
kind: PersistentVolume
metadata:
  name: my-pv
spec:
  capacity:
    storage: 10Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce       # RWO - single node
    # - ReadOnlyMany      # ROX - multiple nodes read-only
    # - ReadWriteMany     # RWX - multiple nodes read-write
  persistentVolumeReclaimPolicy: Retain
    # Retain: keep data after PVC deleted
    # Delete: delete volume after PVC deleted
    # Recycle: deprecated
  storageClassName: standard
  hostPath:
    path: /data/my-pv

---
# PersistentVolumeClaim (user request)
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi
  storageClassName: standard

---
# Using PVC in Pod
apiVersion: v1
kind: Pod
metadata:
  name: app-with-pvc
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: data
      mountPath: /data
  volumes:
  - name: data
    persistentVolumeClaim:
      claimName: my-pvc

# StorageClass for dynamic provisioning
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: kubernetes.io/aws-ebs  # Cloud-specific
parameters:
  type: gp3
  iopsPerGB: "50"
  fsType: ext4
reclaimPolicy: Delete
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer

---
# AWS EBS StorageClass
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ebs-sc
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  encrypted: "true"
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer

---
# GKE StorageClass
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ssd-sc
provisioner: pd.csi.storage.gke.io
parameters:
  type: pd-ssd
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer

---
# PVC using StorageClass (dynamic provisioning)
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: dynamic-pvc
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: fast-ssd
  resources:
    requests:
      storage: 20Gi

# Kubernetes Networking Model

# Fundamental rules:
# 1. All pods can communicate with all other pods (no NAT)
# 2. All nodes can communicate with all pods (no NAT)
# 3. Pod sees itself with same IP others see it

# Network implementations (CNI plugins):
# - Calico: most popular, network policies
# - Cilium: eBPF-based, advanced features
# - Flannel: simple, overlay network
# - Weave: mesh network
# - AWS VPC CNI: native AWS networking

# Service Discovery:
# - DNS: my-service.my-namespace.svc.cluster.local
# - Environment variables: MY_SERVICE_HOST, MY_SERVICE_PORT

# Network Policies:
# - Firewall rules for pods
# - Control ingress/egress traffic
# - Require CNI that supports them

# NetworkPolicy Examples
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}           # Applies to all pods
  policyTypes:
  - Ingress
  - Egress
  # No rules = deny all traffic

---
# Allow ingress from specific pods
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

---
# Allow egress to specific external IPs
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-external-api
spec:
  podSelector:
    matchLabels:
      app: my-app
  policyTypes:
  - Egress
  egress:
  - to:
    - ipBlock:
        cidr: 203.0.113.0/24
    ports:
    - protocol: TCP
      port: 443

# Ingress - HTTP/HTTPS Routing

# Ingress provides:
# - External access to services
# - URL-based routing
# - SSL/TLS termination
# - Name-based virtual hosting
# - Load balancing

# Requires an Ingress Controller:
# - NGINX Ingress (most popular)
# - Traefik
# - HAProxy
# - AWS ALB Ingress Controller
# - GKE Ingress
# - Istio Gateway

# Without Ingress:
# External → LoadBalancer → Service → Pods

# With Ingress:
# External → Ingress → Service → Pods
#         ↘ Ingress → Service → Pods

# Ingress Examples
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: simple-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

---
# Multiple hosts and paths
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-path-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /v1
        pathType: Prefix
        backend:
          service:
            name: api-v1
            port:
              number: 80
      - path: /v2
        pathType: Prefix
        backend:
          service:
            name: api-v2
            port:
              number: 80
  - host: web.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-frontend
            port:
              number: 80

# Ingress with TLS
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-ingress
  annotations:
    # Redirect HTTP to HTTPS
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    # Use cert-manager for auto-renewal
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls-secret
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

---
# Create TLS secret manually:
# kubectl create secret tls myapp-tls-secret \
#   --cert=tls.crt --key=tls.key

# Or use cert-manager for automatic Let's Encrypt:
# 1. Install cert-manager
# 2. Create ClusterIssuer for Let's Encrypt
# 3. Add annotation to Ingress

# K9s - Terminal UI for Kubernetes

# Install K9s:
# macOS:
brew install derailed/k9s/k9s

# Linux (via curl):
curl -sS https://webinstall.dev/k9s | bash

# Linux (via snap):
sudo snap install k9s

# Windows (via chocolatey):
choco install k9s

# Verify installation:
k9s version

# Launch k9s (uses current kubectl context):
k9s

# Launch with specific context:
k9s --context my-cluster

# Launch with specific namespace:
k9s -n my-namespace

# Launch in read-only mode:
k9s --readonly

# K9s Navigation & Shortcuts

# GLOBAL SHORTCUTS
# :           Command mode (type resource name)
# /           Filter/search
# ?           Help
# Ctrl+a      Show all resources
# Ctrl+d      Delete resource
# Esc         Back / Cancel
# q           Quit k9s

# NAVIGATION
# :pods       Switch to pods view
# :svc        Switch to services view
# :deploy     Switch to deployments view
# :ns         Switch to namespaces view
# :nodes      Switch to nodes view
# :secrets    Switch to secrets view
# :cm         Switch to configmaps view
# :pv         Switch to persistent volumes
# :pvc        Switch to persistent volume claims

# ON A RESOURCE
# Enter       View details
# d           Describe
# l           View logs
# s           Shell into container
# y           View YAML
# e           Edit resource
# k           Kill/delete
# Ctrl+k      Kill pod (force)

# LOGS VIEW
# w           Toggle wrap
# s           Toggle auto-scroll
# 0           Jump to start
# Shift+g     Jump to end
# /           Search in logs

# K9s Advanced Features

# FILTERING
# /nginx          Filter by name containing "nginx"
# /app=web        Filter by label
# /-n default     Filter by namespace
# /!running       Exclude "running" from results

# CONTEXT SWITCHING
# :ctx            List contexts
# Enter on ctx    Switch to that context

# BENCHMARKING
# :be             HTTP benchmarks view
# (on a pod)      b to run benchmark

# PORT FORWARDING
# (on a pod)      Shift+f to port forward

# XRAY VIEW
# :xray deploy    Shows deployment tree
# :xray svc       Shows service endpoints

# PULSE VIEW
# :pulse          Cluster health metrics

# CONFIGURATION (~/.config/k9s/config.yml)
# k9s:
#   refreshRate: 2
#   maxConnRetry: 5
#   readOnly: false
#   noIcons: false
#   logger:
#     tail: 100
#     buffer: 5000
#     sinceSeconds: 60
#   currentContext: minikube
#   currentCluster: minikube

# K9s Custom Hotkeys (~/.config/k9s/hotkey.yml)

# Define custom hotkeys:
hotKey:
  # Shift-1: Switch to pods in all namespaces
  shift-1:
    shortCut: Shift-1
    description: View all pods
    command: pods

  # Shift-2: Switch to deployments
  shift-2:
    shortCut: Shift-2
    description: View deployments
    command: deploy

  # Shift-3: Switch to services
  shift-3:
    shortCut: Shift-3
    description: View services
    command: svc

  # Shift-4: Show node resources
  shift-4:
    shortCut: Shift-4
    description: View nodes
    command: nodes

  # Shift-l: Logs with timestamps
  shift-l:
    shortCut: Shift-L
    description: Logs with timestamps
    command: "pods -c <pod>"

# Helm - The Package Manager for Kubernetes

# What is Helm?
# - Package manager for Kubernetes
# - Uses "charts" (packages of K8s resources)
# - Templating engine for YAML
# - Release management & upgrades
# - Rollback capability

# Key concepts:
# - Chart: Package of K8s resources
# - Release: Instance of a chart
# - Repository: Collection of charts
# - Values: Configuration for a chart

# Why use Helm?
# - Avoid repetitive YAML
# - Parameterize deployments
# - Share configurations
# - Version control releases
# - Easy upgrades and rollbacks

# Install Helm

# macOS:
brew install helm

# Linux (script):
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# Linux (snap):
sudo snap install helm --classic

# Windows:
choco install kubernetes-helm

# Verify installation:
helm version

# Add popular chart repositories:
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo add jetstack https://charts.jetstack.io
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts

# Update repositories:
helm repo update

# Search for charts:
helm search repo nginx
helm search hub wordpress

# Essential Helm Commands

# ========== REPOSITORY MANAGEMENT ==========
helm repo list                      # List repos
helm repo add name url              # Add repo
helm repo remove name               # Remove repo
helm repo update                    # Update all repos

# ========== SEARCH ==========
helm search repo nginx              # Search in repos
helm search hub wordpress           # Search Helm Hub

# ========== INSTALL ==========
helm install release-name chart     # Install chart
helm install my-nginx bitnami/nginx

# With custom values:
helm install my-nginx bitnami/nginx -f values.yaml
helm install my-nginx bitnami/nginx --set replicas=3

# Install in namespace:
helm install my-nginx bitnami/nginx -n my-namespace

# Dry run (preview):
helm install my-nginx bitnami/nginx --dry-run

# ========== MANAGE RELEASES ==========
helm list                           # List releases
helm list -A                        # All namespaces
helm status my-nginx                # Release status
helm history my-nginx               # Release history

# ========== UPGRADE ==========
helm upgrade my-nginx bitnami/nginx
helm upgrade my-nginx bitnami/nginx -f new-values.yaml

# ========== ROLLBACK ==========
helm rollback my-nginx              # Rollback to previous
helm rollback my-nginx 2            # Rollback to revision 2

# ========== UNINSTALL ==========
helm uninstall my-nginx

# Helm Chart Structure

my-chart/
├── Chart.yaml          # Chart metadata
├── values.yaml         # Default values
├── charts/             # Chart dependencies
├── templates/          # K8s manifests (templates)
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── ingress.yaml
│   ├── configmap.yaml
│   ├── secret.yaml
│   ├── _helpers.tpl    # Template helpers
│   ├── NOTES.txt       # Post-install notes
│   └── tests/          # Test hooks
└── .helmignore         # Files to ignore

# Chart.yaml example:
apiVersion: v2
name: my-app
description: My application chart
type: application
version: 1.0.0           # Chart version
appVersion: "2.0.0"      # App version
dependencies:
  - name: postgresql
    version: "12.1.0"
    repository: "https://charts.bitnami.com/bitnami"
    condition: postgresql.enabled

# Helm Template Example

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "my-app.fullname" . }}
  labels:
    {{- include "my-app.labels" . | nindent 4 }}
spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "my-app.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      labels:
        {{- include "my-app.selectorLabels" . | nindent 8 }}
    spec:
      containers:
      - name: {{ .Chart.Name }}
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        ports:
        - containerPort: {{ .Values.service.port }}
        {{- if .Values.resources }}
        resources:
          {{- toYaml .Values.resources | nindent 10 }}
        {{- end }}
        env:
        {{- range $key, $value := .Values.env }}
        - name: {{ $key }}
          value: {{ $value | quote }}
        {{- end }}

# values.yaml (defaults)
replicaCount: 2

image:
  repository: nginx
  tag: "1.25"

service:
  port: 80

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 200m
    memory: 256Mi

env:
  LOG_LEVEL: info

# Namespaces - Virtual Clusters

# Namespaces provide:
# - Resource isolation
# - Access control boundaries
# - Resource quotas per namespace
# - Network policy scoping

# Default namespaces:
# - default: for resources without namespace
# - kube-system: K8s system components
# - kube-public: publicly readable
# - kube-node-lease: node heartbeats

# When to use namespaces:
# - Separate environments (dev/staging/prod)
# - Separate teams or projects
# - Separate customers (multi-tenancy)
# - Resource quota enforcement

# Namespace Commands

# Create namespace:
kubectl create namespace my-namespace

# From YAML:
kubectl apply -f - <<EOF
apiVersion: v1
kind: Namespace
metadata:
  name: my-namespace
  labels:
    environment: development
EOF

# List namespaces:
kubectl get namespaces
kubectl get ns

# Switch default namespace:
kubectl config set-context --current --namespace=my-namespace

# Run command in namespace:
kubectl get pods -n my-namespace
kubectl get all -n my-namespace

# Delete namespace (DELETES ALL RESOURCES IN IT):
kubectl delete namespace my-namespace

# ResourceQuota - Limit namespace resources
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: development
spec:
  hard:
    # Compute resources
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi

    # Object counts
    pods: "20"
    services: "10"
    secrets: "20"
    configmaps: "20"
    persistentvolumeclaims: "5"

---
# LimitRange - Default limits for pods
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: development
spec:
  limits:
  - type: Container
    default:
      cpu: 200m
      memory: 256Mi
    defaultRequest:
      cpu: 100m
      memory: 128Mi
    max:
      cpu: "2"
      memory: 2Gi
    min:
      cpu: 50m
      memory: 64Mi

# RBAC - Role-Based Access Control

# RBAC controls WHO can do WHAT on WHICH resources

# Key concepts:
# - Subject: user, group, or service account
# - Role: set of permissions (verbs on resources)
# - RoleBinding: binds role to subject

# Role types:
# - Role: namespace-scoped
# - ClusterRole: cluster-scoped

# Binding types:
# - RoleBinding: binds to namespace
# - ClusterRoleBinding: binds cluster-wide

# Verbs (actions):
# get, list, watch, create, update, patch, delete

# Common ClusterRoles:
# - view: read-only access
# - edit: read/write (no RBAC)
# - admin: full access (no RBAC)
# - cluster-admin: superuser

# RBAC Examples

# Role - namespace permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: development
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]

---
# RoleBinding - bind role to user
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: development
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: my-app
  namespace: development
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

---
# ClusterRole - cluster-wide permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]

---
# ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-secrets-global
subjects:
- kind: Group
  name: developers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io