Intermediate

apiVersion: v1 # => Core Kubernetes API
kind: Service # => Headless Service for StatefulSet
metadata:
 name:
 database # => Headless Service name
 # => Required for StatefulSet DNS
spec:
 # => Service specification
 clusterIP:
 None # => Headless (no cluster IP allocated)
 # => DNS returns Pod IPs directly
 # => Enables individual Pod addressing
 # => "None" is special value (not null)
 selector:
 # => Pod selector
 app:
 database # => Matches StatefulSet Pods
 # => Routes to StatefulSet Pods
 ports:
 # => Port configuration
 - port:
 5432 # => PostgreSQL port
 # => Standard PostgreSQL port
 name:
 postgres # => Named port for clarity
 # => Referenced by StatefulSet

---
apiVersion: apps/v1 # => Apps API for StatefulSets
kind: StatefulSet # => StatefulSet resource
metadata:
 name:
 database # => StatefulSet name
 # => Creates Pods with stable identities
spec:
 # => StatefulSet specification
 serviceName:
 database # => Associates with headless Service above
 # => Enables predictable DNS names
 # => Required field for StatefulSet
 # => Links to Service for DNS
 replicas:
 3 # => Creates 3 Pods: database-0, database-1, database-2
 # => Each Pod gets unique ordinal suffix
 # => Ordered creation and deletion
 selector:
 # => Pod selector (immutable)
 matchLabels:
 app:
 database # => Must match template labels
 # => Links StatefulSet to Pods
 template:
 # => Pod template
 metadata:
 labels:
 # => Pod labels
 app:
 database # => Labels for Service selector and Pod identity
 # => Must match selector
 spec:
 # => Pod specification
 containers:
 # => Container list
 - name:
 postgres # => Container name
 # => PostgreSQL database
 image:
 postgres:15 # => PostgreSQL 15 image
 # => Version-pinned
 ports:
 # => Container ports
 - containerPort:
 5432 # => PostgreSQL listening port
 # => Backend port
 name:
 postgres # => Named port matches Service
 # => Port name reference
 volumeMounts:
 # => Volume mount configuration
 - name:
 data # => References volumeClaimTemplate below
 # => Links to PVC template
 mountPath:
 /var/lib/postgresql/data # => PostgreSQL data directory
 # => Data persists across restarts
 # => Mount point for persistent storage
 env:
 # => Environment variables
 - name: POSTGRES_PASSWORD
 # => Postgres password env var
 value:
 "example" # => Database password
 # => Use Secret in production for security
 # => Hardcoded for demo only
 volumeClaimTemplates: # => Creates PVC per Pod automatically
 # => PVC template (one per Pod)
 - metadata:
 name:
 data # => PVC name pattern: data-database-0, data-database-1, data-database-2
 # => Unique PVC per Pod instance
 # => Persistent across Pod restarts
 spec:
 # => PVC specification
 accessModes:
 ["ReadWriteOnce"] # => Single node read-write access
 # => Most common for databases
 # => RWO: one node mounts read-write
 resources:
 # => Storage resource request
 requests:
 storage:
 10Gi # => Each Pod gets dedicated 10 GiB volume
 # => Independent storage per database instance
 # => Provisioned from StorageClass

# StatefulSet guarantees:
# => Pods created in order: database-0, then database-1, then database-2

# Scaling behavior:
# => Scale up: kubectl scale statefulset database --replicas=5

apiVersion: apps/v1 # => Apps API for StatefulSets
kind: StatefulSet # => StatefulSet resource
metadata:
 name:
 web-stateful # => StatefulSet name
 # => Manages web application Pods
spec:
 # => StatefulSet specification
 serviceName:
 web # => Headless Service name
 # => Required for DNS
 replicas:
 4 # => Total Pods: web-stateful-0, 1, 2, 3
 # => Four stateful instances
 updateStrategy:
 # => Update strategy configuration
 type:
 RollingUpdate # => Rolling update strategy (default)
 # => Updates Pods in reverse order: 3→2→1→0
 # => Alternative: OnDelete (manual Pod deletion)
 # => RollingUpdate is automatic and gradual
 rollingUpdate:
 # => Rolling update parameters
 partition:
 2 # => Only update Pods with ordinal >= partition
 # => Pods 2 and 3 get new version
 # => Pods 0 and 1 stay old version
 # => Useful for canary testing
 # => Default: 0 (all Pods updated)
 selector:
 # => Pod selector (immutable)
 matchLabels:
 app:
 web-stateful # => Must match template labels
 # => Links StatefulSet to Pods
 template:
 # => Pod template
 metadata:
 labels:
 # => Pod labels
 app:
 web-stateful # => Pod labels
 # => Must match selector
 spec:
 # => Pod specification
 containers:
 # => Container list
 - name:
 nginx # => Container name
 # => nginx web server
 image:
 nginx:1.24 # => Current version
 # => Update to nginx:1.25 to trigger rolling update
 # => Pod 3 updates first, then Pod 2
 # => Controlled by partition value
 ports:
 # => Container ports
 - containerPort:
 80 # => HTTP port
 # => Standard HTTP port

# Update behavior with partition=2:
# => kubectl set image statefulset/web-stateful nginx=nginx:1.25

# Partition use cases:
# => Canary deployments: test new version on subset

apiVersion: apps/v1 # => Apps API for StatefulSets
kind: StatefulSet # => StatefulSet resource
metadata:
 name:
 redis-cluster # => StatefulSet name
 # => Redis cluster management
spec:
 # => StatefulSet specification
 serviceName:
 redis # => Headless Service for cluster
 # => Required for DNS
 replicas:
 3 # => Three Redis instances: redis-cluster-0, 1, 2
 # => Clustered Redis deployment
 selector:
 # => Pod selector (immutable)
 matchLabels:
 app:
 redis # => Must match template labels
 # => Links StatefulSet to Pods
 template:
 # => Pod template
 metadata:
 labels:
 # => Pod labels
 app:
 redis # => Pod labels
 # => Must match selector
 spec:
 # => Pod specification
 initContainers:
 # => Init containers (run before main containers)
 - name:
 init-redis # => Init container name
 # => Prepares Redis configuration before main container
 image:
 redis:7 # => Same image as main container
 # => Ensures tooling compatibility
 command:
 # => Init container command
 - sh # => Shell interpreter
 - -c # => Execute following script
 - | # => Multi-line script
 # => Pipe preserves newlines
 echo "Initializing Redis config for Pod $POD_NAME"
 # => Log initialization
 cp /config/redis.conf /data/redis.conf
 # => Copy template to writable volume
 sed -i "s/POD_NAME/${POD_NAME}/g" /data/redis.conf
 # => Copies template config to data volume
 # => Replaces POD_NAME placeholder with actual Pod name
 # => Customizes config per Pod
 env:
 # => Environment variables
 - name: POD_NAME
 # => Pod name variable
 valueFrom:
 # => Value from Downward API
 fieldRef:
 # => Field reference
 fieldPath:
 metadata.name # => Gets Pod name: redis-cluster-0
 # => Uses Downward API
 # => Unique per Pod
 volumeMounts:
 # => Volume mounts for init container
 - name:
 config # => Reads from ConfigMap
 # => Template source
 mountPath:
 /config # => Mount point for config template
 # => Read-only ConfigMap
 - name:
 data # => Writes to PVC
 # => Persistent storage
 mountPath:
 /data # => Shared with main container
 # => Writable volume

 containers:
 # => Main containers
 - name:
 redis # => Main Redis container
 # => Redis server
 image:
 redis:7 # => Redis 7 image
 # => Version-pinned
 command:
 # => Container startup command
 ["redis-server", "/data/redis.conf"] # => Starts with custom config
 # => Config prepared by init container
 # => Uses customized configuration
 ports:
 # => Container ports
 - containerPort:
 6379 # => Redis port
 # => Standard Redis port
 volumeMounts:
 # => Volume mounts
 - name:
 data # => Same volume as init container
 # => Shared PVC
 mountPath:
 /data # => Reads config prepared by init
 # => Stores Redis data
 # => Persistent across restarts

 volumes:
 # => Volume definitions
 - name:
 config # => ConfigMap volume
 # => Template volume
 configMap:
 # => ConfigMap volume source
 name:
 redis-config # => References ConfigMap with template
 # => Contains redis.conf template
 # => Must exist before Pod creation

 volumeClaimTemplates:
 # => PVC template (one per Pod)
 - metadata:
 name:
 data # => PVC name pattern: data-redis-cluster-0, 1, 2
 # => Unique PVC per Pod
 spec:
 # => PVC specification
 accessModes:
 ["ReadWriteOnce"] # => Single node access
 # => Standard for StatefulSets
 resources:
 # => Storage resource request
 requests:
 storage:
 5Gi # => Each Redis instance gets 5 GiB
 # => Per-Pod storage allocation

# Init container execution:
# => Init containers run before main containers

apiVersion: apps/v1 # => Apps API for StatefulSets
kind: StatefulSet # => StatefulSet resource
metadata:
 name:
 parallel-stateful # => StatefulSet name
 # => Uses parallel Pod management
spec:
 # => StatefulSet specification
 serviceName:
 parallel # => Headless Service name
 # => Required for DNS
 replicas:
 10 # => Pods: parallel-stateful-0 through parallel-stateful-9
 # => Ten parallel instances
 podManagementPolicy:
 Parallel # => Parallel Pod creation/deletion
 # => Default: OrderedReady (sequential)
 # => Parallel: all Pods created simultaneously
 # => Faster scaling but no ordering guarantee
 # => Use for independent workloads
 # => No sequential dependency
 selector:
 # => Pod selector (immutable)
 matchLabels:
 app:
 parallel # => Must match template labels
 # => Links StatefulSet to Pods
 template:
 # => Pod template
 metadata:
 labels:
 # => Pod labels
 app:
 parallel # => Pod labels
 # => Must match selector
 spec:
 # => Pod specification
 containers:
 # => Container list
 - name:
 nginx # => Container name
 # => nginx web server
 image:
 nginx:1.24 # => Nginx web server
 # => Version-pinned

# OrderedReady (default):
# => Scale 0→10: creates Pods 0,1,2,3,4,5,6,7,8,9 sequentially

# Parallel:
# => Scale 0→10: creates all 10 Pods simultaneously

# Performance comparison:
# => OrderedReady scaling 0→10: ~10-20 minutes (sequential)

apiVersion: apps/v1 # => Apps API for StatefulSets
kind: StatefulSet # => StatefulSet resource
metadata:
 name:
 retained-stateful # => StatefulSet name
 # => PVC retention configuration
spec:
 # => StatefulSet specification
 serviceName:
 retained # => Headless Service name
 # => Required for DNS
 replicas:
 3 # => Three Pods with persistent storage
 # => Each with dedicated PVC
 persistentVolumeClaimRetentionPolicy:
 # => PVC retention policy (Kubernetes 1.23+)
 whenDeleted:
 Retain # => Retain PVCs when StatefulSet deleted
 # => Prevents accidental data loss
 # => Alternative: Delete (removes PVCs automatically)
 # => Production safety mechanism
 whenScaled:
 Retain # => Retain PVCs when scaling down
 # => PVCs persist for scale-up reattachment
 # => Alternative: Delete (removes PVCs of deleted Pods)
 # => Enables data recovery on scale-up
 selector:
 # => Pod selector (immutable)
 matchLabels:
 app:
 retained # => Must match template labels
 # => Links StatefulSet to Pods
 template:
 # => Pod template
 metadata:
 labels:
 # => Pod labels
 app:
 retained # => Pod labels
 # => Must match selector
 spec:
 # => Pod specification
 containers:
 # => Container list
 - name:
 nginx # => Container name
 # => nginx web server
 image:
 nginx:1.24 # => Nginx web server
 # => Version-pinned
 volumeMounts:
 # => Volume mounts
 - name:
 data # => References volumeClaimTemplate
 # => Links to PVC template
 mountPath:
 /usr/share/nginx/html # => Web root directory
 # => Data persists across restarts
 # => Nginx serves content from here

 volumeClaimTemplates:
 # => PVC template (one per Pod)
 - metadata:
 name:
 data # => PVC name pattern: data-retained-stateful-0, 1, 2
 # => Unique PVC per Pod
 spec:
 # => PVC specification
 accessModes:
 ["ReadWriteOnce"] # => Single node access
 # => Standard for StatefulSets
 resources:
 # => Storage resource request
 requests:
 storage:
 5Gi # => Each Pod gets 5 GiB persistent storage
 # => Per-Pod allocation

# Retention behavior:
# => Scale 3→1: Pods 2 and 1 deleted, but PVCs data-retained-stateful-2 and data-retained-stateful-1 retained

# Policy combinations:
# => whenDeleted=Retain, whenScaled=Retain: Maximum safety (production default)

apiVersion: apps/v1 # => Apps API for DaemonSets
kind: DaemonSet # => DaemonSet resource
metadata:
 name:
 log-collector # => DaemonSet name
 # => Log collection agent
 labels:
 # => DaemonSet labels
 app:
 log-collector # => DaemonSet labels
 # => Organizational metadata
spec:
 # => DaemonSet specification
 selector:
 # => Pod selector
 matchLabels:
 app:
 log-collector # => Must match template labels
 # => Links DaemonSet to Pods
 template:
 # => Pod template (one per node)
 metadata:
 labels:
 # => Pod labels
 app:
 log-collector # => Pod labels
 # => Must match selector
 spec:
 # => Pod specification
 containers:
 # => Container list
 - name:
 fluentd # => Container name
 # => Fluentd log aggregator
 image:
 fluent/fluentd:v1.16 # => Log forwarding agent
 # => Fluentd version 1.16
 # => Lightweight log shipper
 volumeMounts:
 # => Volume mount configuration
 - name:
 varlog # => Mounts node's /var/log
 # => System logs volume
 mountPath:
 /var/log # => Container path
 # => Reads node's /var/log directory
 readOnly:
 true # => Read-only access for safety
 # => Prevents accidental log modification
 # => Security best practice
 - name:
 varlibdockercontainers # => Mounts Docker container logs
 # => Container logs volume
 mountPath:
 /var/lib/docker/containers # => Docker log directory
 # => Container stdout/stderr logs
 readOnly:
 true # => Read-only access
 # => No write permissions needed
 resources:
 # => Resource constraints
 limits:
 # => Maximum resource usage
 memory:
 200Mi # => Maximum memory usage
 # => OOM kill if exceeded
 # => Prevents node resource exhaustion
 requests:
 # => Guaranteed resource allocation
 cpu:
 100m # => Minimum CPU allocation
 # => 0.1 CPU cores guaranteed
 # => Scheduler guarantee
 memory:
 200Mi # => Minimum memory allocation
 # => Scheduling guarantee
 # => Reserved on node

 volumes:
 # => Volume definitions (hostPath for node access)
 - name:
 varlog # => Volume name
 # => System logs volume
 hostPath:
 # => Host filesystem mount
 path:
 /var/log # => Node's /var/log directory
 # => Accesses node filesystem
 # => Direct node access
 - name:
 varlibdockercontainers # => Volume name
 # => Container logs volume
 hostPath:
 # => Host filesystem mount
 path:
 /var/lib/docker/containers # => Node's container logs
 # => Docker/containerd logs
 # => Runtime-specific path

# DaemonSet behavior:
# => Creates 1 Pod per node automatically

# DaemonSet use cases:
# => Log collectors (Fluentd, Filebeat)

apiVersion:
 apps/v1 # => Apps API for DaemonSets
 # => Stable workload API
kind:
 DaemonSet # => DaemonSet resource
 # => Node-level Pod deployment
metadata:
 # => DaemonSet metadata
 name:
 gpu-monitor # => DaemonSet name
 # => Unique cluster identifier
spec:
 # => DaemonSet specification
 selector:
 # => Pod selector
 # => Links DaemonSet to Pods
 matchLabels:
 # => Equality-based selector
 app:
 gpu-monitor # => Must match template labels
 # => Pod ownership identification
 template:
 # => Pod template (one per matching node)
 metadata:
 # => Pod template metadata
 labels:
 # => Labels for created Pods
 app:
 gpu-monitor # => Pod labels
 # => Must match selector
 spec:
 # => Pod specification
 nodeSelector:
 # => Node label selector
 # => Restricts Pod placement
 accelerator:
 nvidia-gpu # => Only runs on nodes with this label
 # => kubectl label nodes node-1 accelerator=nvidia-gpu
 # => Filters nodes for GPU-equipped hosts
 # => Node targeting mechanism
 containers:
 # => Container list
 - name:
 dcgm-exporter # => NVIDIA GPU monitoring
 # => Data Center GPU Manager exporter
 # => Container identifier
 image:
 nvidia/dcgm-exporter:3.1.3 # => NVIDIA official image
 # => Version 3.1.3
 # => GPU metrics collection
 ports:
 # => Port definitions
 - containerPort:
 9400 # => Prometheus metrics port
 # => Exposes GPU metrics
 # => Scrape endpoint for monitoring
 securityContext:
 # => Container security settings
 privileged:
 true # => Required for GPU access
 # => Allows device access
 # => Security trade-off for hardware monitoring
 # => Full host access granted

# DaemonSet with node selector:
# => Only creates Pods on nodes matching nodeSelector

apiVersion:
 batch/v1 # => Batch API for Jobs
 # => Stable Job API
kind:
 Job # => Job resource
 # => One-time task execution
metadata:
 # => Job metadata
 name:
 data-migration # => Job name
 # => Unique identifier for batch task
 # => Job completion tracking name
spec:
 # => Job specification
 completions:
 1 # => Number of successful completions required
 # => Job completes after 1 successful Pod
 # => completions=5 requires 5 successful Pods
 # => Total work items to process
 # => Desired completion count
 parallelism:
 1 # => Number of Pods running in parallel
 # => parallelism=3 runs 3 Pods simultaneously
 # => parallelism ≤ completions
 # => Controls concurrency
 # => Concurrent Pod execution limit
 backoffLimit:
 3 # => Maximum retries before marking Job failed
 # => Retries with exponential backoff
 # => Default: 6 retries
 # => Prevents infinite retry loops
 # => Failure tolerance threshold
 template:
 # => Pod template for Job
 # => Blueprint for Job Pods
 metadata:
 # => Pod template metadata
 labels:
 # => Pod labels
 app:
 migration # => Pod labels for tracking
 # => Used for monitoring and querying
 # => Job Pod identification
 spec:
 # => Pod specification
 restartPolicy:
 Never # => Never or OnFailure (not Always)
 # => Always invalid for Jobs
 # => Never creates new Pod on failure
 # => OnFailure restarts container in same Pod
 # => Required field for Jobs
 # => Failure handling strategy
 containers:
 # => Container list
 - name:
 migrator # => Container name
 # => Migration task executor
 # => Container identifier
 image:
 busybox:1.36 # => Lightweight Linux utilities
 # => Minimal image for shell scripts
 # => Version 1.36 pinned
 command:
 # => Container command
 # => Override entrypoint
 - sh # => Shell interpreter
 # => Bourne shell
 - -c # => Execute following script
 # => Interpret as shell script
 - | # => Multi-line script
 # => Pipe preserves newlines
 # => YAML literal block scalar
 echo "Starting data migration.."
 # => Log start
 # => Stdout logging
 sleep 10
 # => Simulate migration work
 # => 10 second task duration
 echo "Migration completed successfully"
 # => Log completion
 # => Success message
 exit 0 # => Exit 0 signals success
 # => Exit 1+ triggers retry (up to backoffLimit)
 # => Job controller creates new Pod on failure
 # => Exit code determines success/failure
 # => Zero exit = Job completion

# Job lifecycle:
# => Pod created and runs to completion

# Completion calculation:
# => completions=5, parallelism=2

apiVersion: batch/v1 # => Batch API for Jobs
kind: Job # => Job resource
metadata:
 name:
 parallel-processing # => Job name
 # => Parallel batch task
spec:
 # => Job specification
 completions:
 10 # => Total successful Pods required: 10
 # => Job completes after 10 Pods succeed
 # => Work items to process
 parallelism:
 3 # => Run 3 Pods in parallel
 # => Creates Pods in batches: 3, then 3, then 3, then 1
 # => Maintains max 3 Pods running simultaneously
 # => Controls concurrency
 template:
 # => Pod template
 spec:
 # => Pod specification
 restartPolicy:
 OnFailure # => Retry failed Pods within same Pod object
 # => Never creates new Pod for each retry
 # => Container restarts in same Pod
 # => Reduces Pod churn
 containers:
 # => Container list
 - name:
 worker # => Container name
 # => Task worker
 image:
 busybox:1.36 # => Lightweight Linux utilities
 # => Minimal shell environment
 command:
 # => Container command
 - sh # => Shell interpreter
 - -c # => Execute following script
 - | # => Multi-line script
 # => Pipe preserves newlines
 TASK_ID=$((RANDOM % 1000))
 # => Generate unique task ID
 echo "Processing task $TASK_ID"
 # => Log start
 sleep $((5 + RANDOM % 10))
 # => Simulate work (5-15 seconds)
 echo "Task $TASK_ID completed"
 # => Log completion
 # => Simulates variable-duration work
 # => Each Pod processes independent task
 # => Exit 0 implicit (success)

# Parallel execution:
# => Pods 1,2,3 start immediately (parallelism=3)

# Scaling parallelism:
# => kubectl patch job parallel-processing -p '{"spec":{"parallelism":5}}'

apiVersion: batch/v1 # => Batch API for CronJobs
kind: CronJob # => CronJob resource
metadata:
 name:
 backup-job # => CronJob name
 # => Scheduled backup task
spec:
 # => CronJob specification
 schedule:
 "0 2 * * *" # => Cron syntax: minute hour day month weekday
 # => "0 2 * * *" = 2:00 AM daily
 # => "*/5 * * * *" = every 5 minutes
 # => "0 */2 * * *" = every 2 hours
 # => Standard Unix cron format
 concurrencyPolicy:
 Forbid # => Prevents concurrent Job runs
 # => Allow: permits concurrent executions
 # => Replace: cancels current and starts new
 # => Use Forbid for backups to prevent conflicts
 # => Ensures single execution at a time
 successfulJobsHistoryLimit:
 3 # => Keeps 3 successful Jobs
 # => Older successful Jobs auto-deleted
 # => Limits resource consumption
 # => Audit trail for recent runs
 failedJobsHistoryLimit:
 1 # => Keeps 1 failed Job
 # => Enables debugging recent failures
 # => Only most recent failure kept
 jobTemplate:
 # => Job template (nested Job spec)
 spec:
 # => Job specification
 template:
 # => Pod template (nested Pod spec)
 spec:
 # => Pod specification
 restartPolicy:
 OnFailure # => Retry on container failure
 # => Container restarts in same Pod
 containers:
 # => Container list
 - name:
 backup # => Container name
 # => Backup executor
 image:
 busybox:1.36 # => Lightweight Linux utilities
 # => Minimal shell environment
 command:
 # => Container command
 - sh # => Shell interpreter
 - -c # => Execute following script
 - | # => Multi-line script
 # => Pipe preserves newlines
 echo "Starting backup at $(date)"
 # => Log start time
 # Backup logic here
 # => Replace with actual backup commands
 sleep 30
 # => Simulate backup duration
 echo "Backup completed at $(date)"
 # => Log completion time
 # => Simulates backup operation
 # => Exit 0 implicit (success)

# CronJob behavior:
# => Creates Job at scheduled time (2:00 AM daily)

# Timezone handling:
# => Default: Controller manager timezone (usually UTC)

# First, install Ingress Controller (nginx example):
# => kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml

apiVersion: networking.k8s.io/v1 # => Networking API for Ingress
kind: Ingress # => Ingress resource
metadata:
 name:
 app-ingress # => Ingress name
 # => Routing rules identifier
 annotations:
 # => Ingress Controller-specific annotations
 nginx.ingress.kubernetes.io/rewrite-target:
 / # => Rewrites /api/users → /users before forwarding
 # => Strips path prefix
 # => Backend receives /users
 # => nginx-specific annotation
spec:
 # => Ingress specification
 ingressClassName:
 nginx # => Uses nginx Ingress Controller
 # => Required in Kubernetes 1.18+
 # => Multiple controllers can coexist
 # => Selects which controller processes this Ingress
 rules:
 # => Routing rules
 - host:
 app.example.com # => Host-based routing
 # => Matches Host header in requests
 # => DNS must point to Ingress Controller IP
 # => Virtual hosting
 http:
 # => HTTP routing rules
 paths:
 # => Path-based routing
 - path:
 /api # => Path-based routing
 # => Matches requests starting with /api
 pathType:
 Prefix # => Matches /api, /api/, /api/users
 # => Exact: exact match only
 # => ImplementationSpecific: controller-dependent
 # => Prefix is most common
 backend:
 # => Backend service routing
 service:
 name:
 api-service # => Routes to api-service
 # => Service name in same namespace
 port:
 number:
 80 # => Service port (not targetPort)
 # => Ingress routes to Service port
 - path:
 /web # => Different path
 # => Separate routing rule
 pathType:
 Prefix # => Matches /web, /web/, /web/home
 # => Prefix match type
 backend:
 # => Backend service routing
 service:
 name:
 web-service # => Routes to web-service
 # => Different backend service
 port:
 number:
 80 # => Service port
 # => Standard HTTP port

# Access patterns:
# => http://app.example.com/api/users → api-service (path rewritten to /users)

# Ingress Controller behavior:
# => LoadBalancer Service receives external traffic

# Create TLS Secret:
# => kubectl create secret tls tls-secret --cert=tls.crt --key=tls.key

apiVersion: networking.k8s.io/v1 # => Networking API for Ingress
kind: Ingress # => Ingress resource
metadata:
 name:
 tls-ingress # => Ingress name
 # => TLS-enabled routing
spec:
 # => Ingress specification
 ingressClassName:
 nginx # => Ingress Controller to use
 # => nginx Ingress Controller
 tls:
 # => TLS configuration
 - hosts:
 # => Hosts for TLS
 - secure.example.com # => TLS applies to this host
 # => Certificate must match this domain
 # => SAN (Subject Alternative Name) or CN (Common Name)
 secretName:
 tls-secret # => References TLS Secret
 # => Secret must exist in same namespace
 # => Contains tls.crt and tls.key
 # => Ingress Controller reads certificate from Secret
 # => Auto-reloads on Secret update
 rules:
 # => Routing rules
 - host:
 secure.example.com # => Must match TLS hosts
 # => Host consistency required
 http:
 # => HTTP routing
 paths:
 # => Path rules
 - path:
 / # => Root path
 # => Catch-all route
 pathType:
 Prefix # => Matches all paths
 # => Root prefix matches everything
 backend:
 # => Backend service
 service:
 name:
 web-service # => Backend service
 # => Service in same namespace
 port:
 number:
 80 # => HTTP port (TLS already terminated)
 # => Plain HTTP to backend

# TLS behavior:
# => https://secure.example.com → TLS termination at Ingress Controller

# cert-manager integration (automated certificates):
# => Install cert-manager: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml

apiVersion:
 networking.k8s.io/v1 # => Networking API group
 # => Stable v1 Ingress API
kind:
 Ingress # => Ingress resource for routing
 # => HTTP/HTTPS routing rules
metadata:
 name:
 multi-host-ingress # => Ingress name
 # => Unique identifier
spec:
 # => Ingress specification
 ingressClassName:
 nginx # => Ingress Controller type
 # => Uses nginx Ingress Controller
 # => Alternative: traefik, haproxy, aws-alb
 rules:
 # => Routing rules (multiple hosts)
 - host:
 api.example.com # => First host
 # => API subdomain
 # => Virtual host routing
 http:
 # => HTTP routing configuration
 paths:
 # => Path-based routes
 - path:
 / # => Root path matcher
 # => Matches all requests
 pathType:
 Prefix # => Prefix matching type
 # => /anything matches
 # => Alternative: Exact, ImplementationSpecific
 backend:
 # => Backend Service configuration
 service:
 # => Service-based backend
 name:
 api-service # => API Service name
 # => Routes to api-service
 port:
 # => Target port
 number:
 80 # => Service port 80
 # => HTTP port

 - host:
 admin.example.com # => Second host
 # => Admin subdomain
 # => Separate virtual host
 http:
 # => HTTP configuration
 paths:
 # => Path routes
 - path:
 / # => Root path
 # => All admin requests
 pathType:
 Prefix # => Prefix matching
 # => Matches /*, /dashboard, etc.
 backend:
 # => Admin backend
 service:
 # => Admin Service
 name:
 admin-service # => Admin Service name
 # => Different Service than API
 port:
 # => Port configuration
 number:
 80 # => HTTP port
 # => Standard HTTP

 - host:
 static.example.com # => Third host
 # => Static content subdomain
 # => CDN-like routing
 http:
 # => HTTP configuration
 paths:
 # => Path routing
 - path:
 / # => Root path
 # => All static assets
 pathType:
 Prefix # => Prefix match
 # => /images, /js, /css all match
 backend:
 # => Static backend
 service:
 # => Static asset Service
 name:
 static-service # => Static Service name
 # => Serves static files
 port:
 # => Port number
 number:
 80 # => HTTP port
 # => nginx serving static

# Multi-host routing:
# => http://api.example.com → api-service

apiVersion:
 networking.k8s.io/v1 # => Networking API group
 # => Stable Ingress API
kind:
 Ingress # => Ingress resource with annotations
 # => Advanced feature configuration
metadata:
 name:
 annotated-ingress # => Ingress name
 # => Unique identifier
 annotations:
 # => Controller-specific annotations
 # => nginx Ingress Controller specific
 nginx.ingress.kubernetes.io/rewrite-target:
 /$2 # => URL rewriting with capture groups
 # => Rewrites /api/users to /users
 # => $2 references second capture group in path
 # => Removes /api prefix before backend
 nginx.ingress.kubernetes.io/ssl-redirect:
 "true" # => Force HTTPS redirect
 # => HTTP requests → 308 redirect to HTTPS
 # => Enforces encrypted traffic
 # => String value required
 nginx.ingress.kubernetes.io/rate-limit:
 "100" # => 100 requests per second per IP
 # => Rate limiting per client IP
 # => Exceeding limit returns 503
 # => DDoS protection
 nginx.ingress.kubernetes.io/enable-cors:
 "true" # => Enable CORS headers
 # => Adds Access-Control-Allow-Origin header
 # => Required for cross-origin requests
 # => Browser CORS policy compliance
 nginx.ingress.kubernetes.io/cors-allow-origin:
 "https://example.com" # => Allowed CORS origin
 # => Only this origin permitted
 # => Restricts cross-origin access
 # => Security control
 nginx.ingress.kubernetes.io/auth-type:
 basic # => Basic authentication
 # => HTTP Basic Auth
 # => Username/password authentication
 # => Not recommended for production (use OAuth)
 nginx.ingress.kubernetes.io/auth-secret:
 basic-auth # => References Secret with credentials
 # => Secret contains htpasswd data
 # => Must exist in same namespace
 # => Credentials for Basic Auth
spec:
 # => Ingress specification
 ingressClassName:
 nginx # => nginx Ingress Controller
 # => Controller processes this Ingress
 # => Annotations are nginx-specific
 rules:
 # => Routing rules
 - host:
 protected.example.com # => Host for this rule
 # => Virtual host routing
 http:
 # => HTTP configuration
 paths:
 # => Path routing
 - path:
 /api(/|$)(.*) # => Capture group for rewrite
 # => Regex captures everything after /api
 # => $2 in rewrite-target uses second group
 pathType:
 ImplementationSpecific # => Controller-specific matching
 # => nginx interprets as regex
 backend:
 # => Backend Service
 service:
 # => Service target
 name:
 api-service # => Backend Service name
 # => Routes to api-service
 port:
 # => Service port
 number:
 80 # => HTTP port
 # => Standard HTTP

# Annotation effects:
# => Request: /api/users → rewritten to /users

apiVersion:
 networking.k8s.io/v1 # => Networking API group
 # => Stable Ingress API
kind:
 Ingress # => Ingress with default backend
 # => Catch-all routing pattern
metadata:
 name:
 default-backend-ingress # => Ingress name
 # => Unique identifier
spec:
 # => Ingress specification
 ingressClassName:
 nginx # => nginx Ingress Controller
 # => Controller type
 defaultBackend:
 # => Default backend for unmatched requests
 # => Fallback Service
 service:
 # => Service configuration
 name:
 default-service # => Serves unmatched requests
 # => Custom 404 Service
 # => Handles all non-matching traffic
 port:
 # => Service port
 number:
 80 # => HTTP port
 # => Default backend port
 rules:
 # => Routing rules (specific routes)
 - host:
 app.example.com # => Host for specific routing
 # => Virtual host
 http:
 # => HTTP routing
 paths:
 # => Path-based routes
 - path:
 /api # => API path prefix
 # => Matches /api/*
 pathType:
 Prefix # => Prefix matching
 # => /api, /api/users, etc.
 backend:
 # => API backend
 service:
 # => API Service
 name:
 api-service # => API Service name
 # => Primary application backend
 port:
 # => Service port
 number:
 80 # => HTTP port
 # => API Service port

# Default backend routing:
# => http://app.example.com/api → api-service (matches rule)

apiVersion: v1
kind: PersistentVolume
metadata:
 name: pv-example # => PV name (cluster-wide resource)
spec:
 capacity:
 storage:
 10Gi # => Total storage capacity available
 # => PVC can request up to this size
 accessModes:
 - ReadWriteOnce # => Single node read-write
 # => ReadOnlyMany: multiple nodes read-only
 # => ReadWriteMany: multiple nodes read-write
 # => Most common: ReadWriteOnce
 persistentVolumeReclaimPolicy:
 Retain # => Manual reclamation after PVC deletion
 # => PV not auto-deleted
 # => Delete: auto-delete storage (cloud volumes)
 # => Recycle: deprecated (use Delete)
 storageClassName:
 manual # => Storage class name for binding
 # => PVC must match this class
 hostPath: # => Host path volume (testing only)
 path: /mnt/data # => Directory on node
 type:
 DirectoryOrCreate # => Create if doesn't exist
 # => Not for production (node-specific)

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
 name: pvc-example # => PVC name (namespace resource)
spec:
 accessModes:
 - ReadWriteOnce # => Must match PV access mode
 # => Binds to PV with compatible mode
 resources:
 requests:
 storage:
 5Gi # => Requests 5 GiB (PV has 10 GiB)
 # => PVC gets full 10 GiB (PV indivisible)
 storageClassName:
 manual # => Binds to PV with same storage class
 # => Empty string binds to no-class PVs

---
apiVersion: v1
kind: Pod
metadata:
 name: pv-pod # => Pod name
spec:
 containers:
 - name: app # => Container name
 image: nginx:1.24 # => Nginx web server
 volumeMounts:
 - name: storage # => References volume below
 mountPath:
 /usr/share/nginx/html # => Mount point in container
 # => Nginx serves from this directory
 volumes:
 - name: storage # => Volume name
 persistentVolumeClaim:
 claimName:
 pvc-example # => References PVC above
 # => Kubernetes binds PVC to PV

# PV/PVC lifecycle:
# => kubectl get pv → shows PV status (Available → Bound)

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
 name: fast-storage # => StorageClass name
provisioner:
 kubernetes.io/aws-ebs # => Cloud provider provisioner
 # => kubernetes.io/gce-pd (GCP)
 # => kubernetes.io/azure-disk (Azure)
 # => Talks to cloud API to create volumes
parameters:
 type:
 gp3 # => AWS EBS type: gp3 (SSD)
 # => gp2, io1, io2, sc1, st1
 # => gp3: latest generation SSD
 iops:
 "3000" # => Provisioned IOPS (input/output per second)
 # => gp3 default: 3000, max: 16000
 throughput:
 "125" # => Throughput in MiB/s
 # => gp3 default: 125, max: 1000
 encrypted:
 "true" # => Encrypt volume at rest
 # => AWS KMS encryption
reclaimPolicy:
 Delete # => Delete PV when PVC deleted
 # => Prevents orphaned volumes
 # => Retain: keep PV after PVC deletion
volumeBindingMode:
 WaitForFirstConsumer # => Delay PV binding until Pod scheduled
 # => Ensures PV created in same zone as Pod
 # => Prevents cross-zone attach failures
 # => Immediate: bind PV immediately
allowVolumeExpansion:
 true # => Allow PVC size increase
 # => Resize PVC without recreating
 # => Requires CSI driver support

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
 name: dynamic-pvc # => PVC name
spec:
 accessModes:
 - ReadWriteOnce # => Single node access
 storageClassName:
 fast-storage # => References StorageClass above
 # => Triggers dynamic provisioning
 # => No manual PV creation
 resources:
 requests:
 storage:
 20Gi # => Requests 20 GiB
 # => StorageClass creates PV with this size

# Dynamic provisioning:
# => PVC created → StorageClass provisions new PV automatically