kubernetes

Kubernetes manifests define containerized applications declaratively. Design production-ready deployments by specifying resource limits, health probes (liveness and readiness), rolling update strategies, and services for networking. Use kubectl to apply manifests across namespaces, ensuring high availability and safe updates.

Services expose Pods internally or externally; Ingress routes external traffic to services. Configure services by selecting Pod labels and defining ports. Ingress rules map hostnames and paths to services, enabling multi-tenant and multi-environment routing without redeploying workloads.

Role-based access control (RBAC) restricts who can perform actions on resources. Define Roles, ClusterRoles, and Bindings to enforce least-privilege access. Secrets store sensitive data (credentials, tokens) separately from manifests and inject them into Pods at runtime securely.

Helm packages Kubernetes manifests as reusable charts with parameterized values; Kustomize overlays manifests for environment-specific configurations. Both tools reduce duplication, enforce organizational policies, and validate configurations before deployment across multi-environment clusters.

Liveness probes restart failed containers; readiness probes route traffic only to healthy Pods. Rolling updates gradually replace old Pods with new ones, minimizing downtime. Together, they ensure reliable deployments and automatic recovery from transient failures.

Labels organize resources by environment, service, and tier; annotations store metadata for tooling. Configure Prometheus scrape targets and add metric endpoints to Pods to collect performance data. This enables monitoring, alerting, and cost tracking across namespaces and clusters.