Level 3 — Application delivery · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Build it
kubectl create namespace shop-web | A home for the app |
kubectl apply -f deploy.yaml -f svc.yaml -f ingress.yaml -n shop-web | Deployment → Service → Ingress |
kubectl rollout status deploy/podinfo -n shop-web | Wait for a rollout |
kubectl set image deploy/podinfo podinfo=ghcr.io/stefanprodan/podinfo:6.7.1 -n shop-web | Roll out a new version |
kubectl rollout undo deploy/podinfo -n shop-web | Roll back |
Debug hop by hop
kubectl get pods -n shop-web -o wide | 1. Pods Running and READY? |
kubectl get endpointslices -n shop-web | 2. Service has endpoints? |
kubectl run t --rm -it --image=busybox -- wget -qO- http://podinfo.shop-web | 3. Service works inside the cluster? |
kubectl describe ingress podinfo -n shop-web | 4. Ingress rule, class, address? |
curl -v http://podinfo.127.0.0.1.nip.io/ | 5. From outside? |
Namespaces & DNS
<service>.<namespace>.svc.cluster.local | Full DNS name of a Service |
postgres.shop-data (from another namespace) | Short form that works across namespaces |
kubectl get all -n shop-data | What's in a namespace |
Secrets and ConfigMaps are namespaced | Create them where the pods run |
Database pieces
StatefulSet + volumeClaimTemplates | Stable name (postgres-0) and its own PVC |
Service with clusterIP: None | Headless: DNS for each StatefulSet pod |
initContainer: pg_isready -h postgres.shop-data | Wait for the DB before starting the app |
NetworkPolicy (namespaceSelector + podSelector) | Only the app may reach port 5432 |
Certificates
openssl req -x509 -nodes -newkey rsa:2048 -days 30 -keyout tls.key -out tls.crt -subj '/CN=shop.127.0.0.1.nip.io' -addext 'subjectAltName=DNS:shop.127.0.0.1.nip.io' | Self-signed cert for a lab |
kubectl create secret tls shop-tls --cert=tls.crt --key=tls.key -n shop-web | Store it as a TLS Secret |
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.2/cert-manager.yaml | Install cert-manager (pick a current release) |
kubectl get certificate,certificaterequest -A | cert-manager status |
ingress-nginx annotations
cert-manager.io/cluster-issuer: lab-ca | Ask cert-manager for this Ingress's certificate |
nginx.ingress.kubernetes.io/ssl-redirect: "true" | HTTP → HTTPS (default when TLS is set for the host) |
nginx.ingress.kubernetes.io/ssl-passthrough: "true" | Passthrough (controller needs --enable-ssl-passthrough) |
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" | Re-encrypt to the pod |
Ingress gateway (Gateway API)
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml | Gateway API CRDs (pick a current release) |
GatewayClass → Gateway (listeners) → HTTPRoute (rules) | Platform owns Gateways, teams own Routes |
kubectl get gatewayclass,gateway,httproute -A | Status of each layer |
Egress control
NetworkPolicy podSelector: {} + policyTypes: [Egress] | Default-deny egress for a namespace |
Allow kube-dns on UDP/TCP 53 | Don't forget DNS |
CiliumNetworkPolicy toFQDNs | Allow by DNS name (Cilium) |
CiliumEgressGatewayPolicy / Istio egress gateway | Fixed exit point and source IP |
Rolling & blue-green
strategy.rollingUpdate: { maxSurge: 1, maxUnavailable: 0 } | Rolling: capacity never drops |
strategy.type: Recreate | Stop all old pods, then start new (downtime) |
kubectl patch svc shop -p '{"spec":{"selector":{"app":"shop","version":"green"}}}' | Blue-green: switch the Service |
Canary
nginx.ingress.kubernetes.io/canary: "true" + canary-weight: "10" | ingress-nginx canary Ingress |
HTTPRoute backendRefs weights 90 / 10 | Gateway API canary |
Argo Rollouts: steps [ setWeight: 20, pause, analysis ] | Automated progressive delivery |
kubectl argo rollouts promote|abort <name> | Move forward or roll back |
