# Create a pod imperatively (useful for quick debugging)
kubectl run nginx-pod --image=nginx:alpine --port=80

# Watch it come up
kubectl get pod nginx-pod -w

# Inspect it
kubectl describe pod nginx-pod

# Get shell access
kubectl exec -it nginx-pod -- sh

apiVersion: v1
kind: Pod
metadata:
  name: my-nginx
  labels:
    app: nginx
    env: dev
spec:
  containers:
  - name: nginx
    image: nginx:alpine
    ports:
    - containerPort: 80
    resources:
      requests:
        cpu: "100m"      # 0.1 CPU cores
        memory: "64Mi"
      limits:
        cpu: "250m"
        memory: "128Mi"
    readinessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 5
      periodSeconds: 10
    livenessProbe:
      httpGet:
        path: /
        port: 80
      failureThreshold: 3

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app           # must match template labels
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # extra pods during update
      maxUnavailable: 0  # zero downtime
  template:
    metadata:
      labels:
        app: web-app
    spec:
      containers:
      - name: web
        image: nginx:1.25
        ports:
        - containerPort: 80
        resources:
          requests: { cpu: "100m", memory: "64Mi" }
          limits:   { cpu: "500m", memory: "256Mi" }

# Trigger a rolling update (new image)
kubectl set image deployment/web-app web=nginx:1.26

# Watch the rollout
kubectl rollout status deployment/web-app

# Inspect revision history
kubectl rollout history deployment/web-app

# Roll back to previous revision
kubectl rollout undo deployment/web-app

# Roll back to specific revision
kubectl rollout undo deployment/web-app --to-revision=2

# Scale manually
kubectl scale deployment/web-app --replicas=5

# Imperative
kubectl autoscale deployment/web-app --cpu-percent=70 --min=2 --max=10

# Declarative (HPA v2)
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

apiVersion: v1
kind: Service
metadata:
  name: web-svc
spec:
  selector:
    app: web-app     # matches Deployment pod labels
  ports:
  - port: 80         # Service port (ClusterIP)
    targetPort: 80  # container port
    protocol: TCP
  type: ClusterIP

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-svc
            port: { number: 80 }

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_ENV: "production"
  LOG_LEVEL: "info"
  app.conf: |
    server.port=8080
    db.pool.size=10

apiVersion: v1
kind: Secret
metadata:
  name: db-secret
type: Opaque
data:
    # values must be base64-encoded: echo -n 'mypassword' | base64
  DB_PASSWORD: bXlwYXNzd29yZA==
  DB_USER: YWRtaW4=
stringData:          # alternative: plain text (K8s encodes it)
  API_KEY: "my-api-key-plain"

spec:
  containers:
  - name: app
    image: myapp:v1
    env:
    - name: LOG_LEVEL             # single key from ConfigMap
      valueFrom:
        configMapKeyRef:
          name: app-config
          key: LOG_LEVEL
    - name: DB_PASSWORD           # single key from Secret
      valueFrom:
        secretKeyRef:
          name: db-secret
          key: DB_PASSWORD
    envFrom:                       # ALL keys as env vars
    - configMapRef:
        name: app-config
    volumeMounts:
    - name: config-vol
      mountPath: /etc/app        # mount as files
  volumes:
  - name: config-vol
    configMap:
      name: app-config

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data-pvc
spec:
  accessModes:
  - ReadWriteOnce      # RWO: one node; RWX: many nodes (NFS)
  storageClassName: standard
  resources:
    requests:
      storage: 10Gi

---  # Mount in a pod
spec:
  containers:
  - name: db
    image: postgres:16
    volumeMounts:
    - name: pgdata
      mountPath: /var/lib/postgresql/data
  volumes:
  - name: pgdata
    persistentVolumeClaim:
      claimName: data-pvc

# Role: read-only access to pods in 'dev' namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: dev
rules:
- apiGroups: [""]            # "" = core API group
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
---
kind: RoleBinding
metadata:
  name: read-pods
  namespace: dev
subjects:
- kind: User
  name: alice
  apiGroup: rbac.authorization.k8s.io
- kind: ServiceAccount
  name: ci-runner
  namespace: dev
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

# Can alice delete pods in dev?
kubectl auth can-i delete pods -n dev --as=alice
# no

# Can ci-runner serviceaccount list pods?
kubectl auth can-i list pods -n dev --as=system:serviceaccount:dev:ci-runner
# yes

# What can I do? (verbose)
kubectl auth can-i --list -n dev

# Requires metrics-server installed
kubectl top nodes
kubectl top pods -A --sort-by=memory

# Events across all resources (sorted)
kubectl get events -A --sort-by=.lastTimestamp

# Check API server health
kubectl get componentstatuses  # deprecated but sometimes useful
kubectl get --raw=/healthz