Kubernetes Cheatsheet: kubectl, Pods, Services and Helm

# Install
brew install kubectl helm kind kustomize
brew install --cask docker          # docker desktop has built-in single-node cluster

# Spin up a local cluster
kind create cluster --name dev
# or
minikube start --driver=docker

# Connect to a remote cluster
kubectl config view
kubectl config get-contexts
kubectl config use-context my-prod-cluster
kubectl config set-context --current --namespace=team-a

# Sanity check
kubectl cluster-info
kubectl get nodes -o wide
kubectl version --short

# Useful aliases
alias k=kubectl
alias kgp='kubectl get pods'
alias kdp='kubectl describe pod'
alias klog='kubectl logs -f --tail=200'

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  labels: { app: api }
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxUnavailable: 1, maxSurge: 1 }
  selector:
    matchLabels: { app: api }
  template:
    metadata:
      labels: { app: api }
    spec:
      containers:
        - name: api
          image: ghcr.io/me/api:0.4.1
          ports:
            - containerPort: 8000
          envFrom:
            - configMapRef: { name: api-config }
            - secretRef:    { name: api-secrets }
          resources:
            requests: { cpu: 100m, memory: 256Mi }
            limits:   { cpu: 500m, memory: 512Mi }
          readinessProbe:
            httpGet: { path: /healthz, port: 8000 }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /healthz, port: 8000 }
            initialDelaySeconds: 15
            periodSeconds: 20

---
apiVersion: v1
kind: Service
metadata: { name: api }
spec:
  type: ClusterIP                       # internal-only; default
  selector: { app: api }
  ports:
    - name: http
      port: 80                          # service port
      targetPort: 8000                  # container port
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "8m"
spec:
  ingressClassName: nginx
  tls:
    - hosts: ["api.example.com"]
      secretName: api-tls
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api
                port: { number: 80 }

---
apiVersion: v1
kind: ConfigMap
metadata: { name: api-config }
data:
  LOG_LEVEL: "info"
  FEATURE_X:  "true"
---
apiVersion: v1
kind: Secret
metadata: { name: api-secrets }
type: Opaque
stringData:                             # plain values; encoded automatically
  DATABASE_URL: "postgres://user:pw@db:5432/app"
  JWT_KEY:      "supersecret"
---
# Mount a ConfigMap as files
apiVersion: v1
kind: Pod
metadata: { name: cfg-demo }
spec:
  containers:
    - name: app
      image: alpine
      command: ["sleep", "3600"]
      volumeMounts:
        - { name: cfg, mountPath: /etc/app, readOnly: true }
  volumes:
    - name: cfg
      configMap:
        name: api-config
        items:
          - { key: LOG_LEVEL, path: log_level }

# Full app: namespace -> config -> secret -> deployment -> service -> ingress.

kubectl create namespace team-a --dry-run=client -o yaml | kubectl apply -f -

kubectl create configmap api-config -n team-a \
  --from-literal=LOG_LEVEL=info \
  --from-literal=FEATURE_X=true \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl create secret generic api-secrets -n team-a \
  --from-literal=DATABASE_URL='postgres://...' \
  --dry-run=client -o yaml | kubectl apply -f -

kubectl apply -n team-a -f deployment.yaml
kubectl apply -n team-a -f service.yaml
kubectl apply -n team-a -f ingress.yaml

kubectl -n team-a rollout status deploy/api --timeout=120s
kubectl -n team-a get pods,svc,ingress -o wide
kubectl -n team-a logs -f deploy/api --tail=100

# Roll back if things go bad
kubectl -n team-a rollout undo deploy/api
kubectl -n team-a rollout history deploy/api