kubernetes-deploy

name	kubernetes-deploy
description	Kubernetes production deployment covering strategies, HPA/VPA autoscaling, resource requests/limits, ConfigMaps/Secrets, Helm charts, Kustomize overlays, Istio service mesh, ingress controllers, PVs, RBAC, network policies, PodDisruptionBudgets, and init containers/sidecar patterns. Use when this capability is needed.
metadata	{"author":"AniruddhaPKawarase"}

Enterprise Kubernetes Deployment (30+ Year Veteran)

Deployment Strategies

# Rolling Update: Default (sequential pod replacement)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # 1 extra pod during update (3 → 4 → 3)
      maxUnavailable: 0  # Don't remove old pods before new one ready
  template:
    spec:
      containers:
      - name: api
        image: myregistry.azurecr.io/api:v2.0.0
        readinessProbe:
          httpGet:
            path: /health
            port: 8000
          initialDelaySeconds: 5
          periodSeconds: 10
        livenessProbe:
          httpGet:
            path: /health
            port: 8000
          initialDelaySeconds: 15
          periodSeconds: 20

# Blue-Green: Two full deployments
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-blue
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
      version: blue
  template:
    metadata:
      labels:
        app: api
        version: blue
    spec:
      containers:
      - name: api
        image: myregistry.azurecr.io/api:v1.9.0
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-green
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
      version: green
  template:
    metadata:
      labels:
        app: api
        version: green
    spec:
      containers:
      - name: api
        image: myregistry.azurecr.io/api:v2.0.0
---
apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  selector:
    app: api
    version: blue  # Switch to "green" when ready
  ports:
  - port: 80
    targetPort: 8000

HPA: Horizontal Pod Autoscaling

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api
  minReplicas: 3
  maxReplicas: 100
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70  # Scale up if >70% CPU
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80  # Scale up if >80% memory
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300  # Wait 5min before scaling down
      policies:
      - type: Percent
        value: 50  
         
    
         
      
        
           
         

ConfigMaps & Secrets

apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  LOG_LEVEL: "info"
  MAX_CONNECTIONS: "100"
  cache_ttl: "3600"

---
apiVersion: v1
kind: Secret
metadata:
  name: api-secrets
type: Opaque
stringData:  # Values encoded to base64 when saved
  DATABASE_URL: "postgresql://user:pass@db:5432/mydb"
  API_KEY: "sk_live_..."

---
apiVersion: v1
kind: Pod
metadata:
  name: api
spec:
  containers:
  - name: api
    image: myapp
    env:
    # From ConfigMap
    - name: LOG_LEVEL
      valueFrom:
        configMapKeyRef:
          name: api-config
          key: LOG_LEVEL
    
      
      
        
           
           
    
      
       
    
      
       
  
    
    
       

Helm Charts: Templating & Deployment

# values.yaml
replicas: 3
image:
  repository: myregistry.azurecr.io/api
  tag: "2.0.0"
  pullPolicy: IfNotPresent

resources:
  requests:
    cpu: 500m
    memory: 256Mi
  limits:
    cpu: 1000m
    memory: 512Mi

ingress:
  enabled: true
  host: api.example.com

# templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "api.fullname" . }}
spec:
  replicas: {{ .Values.replicas }}
  template:
    spec:
      containers:
      - name: api
        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
        resources: {{ .Values.resources | toYaml | nindent  }}


   
     
     

RBAC: Role-Based Access Control

apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-service-account

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: api-role
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
  resourceNames: ["api-secrets"]  # Only this specific secret

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: api-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: api-role
subjects:
- kind: ServiceAccount
  name: api-service-account

Network Policies: Microsegmentation

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-network-policy
spec:
  podSelector:
    matchLabels:
      app: api
  policyTypes:
  - Ingress
  - Egress

  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: ingress  # Only ingress-controller can reach API
    ports:
    - protocol: TCP
      port: 8000

  egress:
  - to:
    - podSelector:
        matchLabels:
          app: db  # API can reach database
    ports:
    - protocol: TCP
      port: 5432
  - to:
    - podSelector:
        matchLabels:
          app: cache  # API can reach cache
    ports:
      
       
  

PodDisruptionBudget: High Availability

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: api-pdb
spec:
  minAvailable: 2  # Always have >=2 pods available
  selector:
    matchLabels:
      app: api

# Kubernetes respects this during:
# - Node maintenance (drain)
# - Cluster upgrades
# - Resource pressure
# Won't evict pods if it violates PDB

Init Containers: Setup Tasks

apiVersion: v1
kind: Pod
metadata:
  name: api
spec:
  containers:
  - name: api
    image: myapp
    volumeMounts:
    - name: shared
      mountPath: /data

  initContainers:  # Run before main containers
  - name: migrate-db
    image: myapp
    command: ["python", "-m", "alembic", "upgrade", "head"]
    env:
    - name: DATABASE_URL
      valueFrom:
        secretKeyRef:
          name: api-secrets
          key: DATABASE_URL

  - name: warm-cache
    image: redis:7
    command: ["redis-cli", "ping"]  # Wait for Redis

  volumes:
  - name: shared
     {}

Sidecar Pattern: Observability

apiVersion: v1
kind: Pod
metadata:
  name: api
spec:
  containers:
  - name: api
    image: myapp
    ports:
    - containerPort: 8000
    volumeMounts:
    - name: logs
      mountPath: /var/log

  - name: sidecar-logs  # Sidecar: tail logs
    image: fluent/fluent-bit:latest
    volumeMounts:
    - name: logs
      mountPath: /var/log
    # Ship logs to ELK/Splunk

  - name: sidecar-metrics  # Sidecar: export metrics
    image: prom/node-exporter:latest
    ports:
    - containerPort: 9100

  volumes:
  - name: logs
    emptyDir: {}

Kubernetes Checklist

# Kubernetes Checklist

## Deployment
- [ ] Rolling update or blue-green strategy
- [ ] Readiness & liveness probes configured
- [ ] Resource requests/limits set
- [ ] Health checks passing

## Scaling
- [ ] HPA configured (CPU/memory metrics)
- [ ] Min/max replicas appropriate
- [ ] Scaling policies tested under load

## Configuration
- [ ] ConfigMaps for non-sensitive config
- [ ] Secrets for sensitive data
- [ ] Environment variables populated
- [ ] Secrets never logged or exposed

## Security
- [ ] RBAC roles minimal (least privilege)
- [ ] Network policies restrict traffic
- [ ] Pod security policies enforced
- [ ] Image scanning for CVEs

## Reliability
- [ ] PodDisruptionBudgets set (>1 replica)
- [ ] Init containers run before main app
- [ ] Sidecars for observability/logging
- [ ] Persistent volumes backed up

## Monitoring
- [ ] Metrics exported (Prometheus)
- [ ] Logs centralized (ELK/Splunk)
- [ ] Alerts configured
- [ ] Dashboards created

Summary

Kubernetes orchestrates containers at scale. Use rolling updates or blue-green strategies for safety. Configure HPA for elasticity. Set resource limits. Use RBAC for security. Network policies enforce microsegmentation. Init containers perform setup. Sidecars add observability. PodDisruptionBudgets maintain availability during maintenance. Kubernetes is powerful and complex—automate everything with Helm/Kustomize.

---

Source: AniruddhaPKawarase/ai-agent-skills-toolkit — distributed by TomeVault.