High-value Kubernetes YAML patterns for Pods, Deployments, Services, probes, resources, scheduling, and day-to-day manifest authoring.
Structure every object with apiVersion, kind, metadata, and spec.
apiVersion: v1
kind: Pod
metadata:
name: demo-pod
labels:
app: demo
spec:
containers:
- name: app
image: nginx:1.27
ports:
- containerPort: 80A Kubernetes object is typically expressed as YAML with `apiVersion`, `kind`, `metadata`, and `spec`. Pods are usually used directly only for debugging or one-off workloads; Deployments are better for managed application Pods.
apiVersion: v1
kind: Namespace
metadata:
name: demo
---
apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
namespace: demo
data:
APP_ENV: productionGrouping related objects into one manifest is convenient for app-level deployment and review.
kubectl apply -f app.yaml`kubectl apply` accepts YAML or JSON and creates the resource if it does not exist yet. `kubectl diff -f ...` is useful before applying changes.
kubectl apply -f k8s/A common declarative workflow is to keep configuration files in a directory and apply them together.
kubectl diff -f app.yamlUse this before apply in CI or during review-heavy workflows.
Use labels for selection and annotations for non-identifying metadata.
metadata:
name: api
namespace: prod
labels:
app.kubernetes.io/name: api
app.kubernetes.io/component: backend
app.kubernetes.io/part-of: storefront
tier: web
annotations:
kubectl.kubernetes.io/default-container: api
reloader.stakater.com/auto: "true"Labels are queryable and support selectors; annotations hold arbitrary metadata that tools and operators consume.
kubectl get pods -l app.kubernetes.io/name=apikubectl label deployment api tier=web --overwritekubectl annotate deployment api owner=platform-team --overwriteContainer command, args, env, mounts, and restart behavior.
apiVersion: v1
kind: Pod
metadata:
name: args-demo
spec:
containers:
- name: app
image: busybox:1.36
command: ["sh", "-c"]
args: ["echo hello && sleep 3600"]Use `command` and `args` to define commands and arguments for a container in a Pod spec.
env:
- name: APP_ENV
value: production
- name: LOG_LEVEL
value: infoUse `env` for individual variables; use `envFrom` when importing all keys from a ConfigMap or Secret.
envFrom:
- configMapRef:
name: app-config
- secretRef:
name: app-secrets`envFrom` is concise for app-style configuration but can make exact variable origins less explicit than `env`.
ports:
- name: http
containerPort: 8080
- name: metrics
containerPort: 9090spec:
imagePullSecrets:
- name: regcred
containers:
- name: app
image: registry.example.com/app:1.2.3Declarative rolling workloads for stateless applications.
apiVersion: apps/v1
kind: Deployment
metadata:
name: api
spec:
replicas: 3
selector:
matchLabels:
app: api
template:
metadata:
labels:
app: api
spec:
containers:
- name: api
image: ghcr.io/example/api:1.0.0
ports:
- containerPort: 8080Deployments manage ReplicaSets and provide declarative rollout behavior for Pods.
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 1
maxSurge: 1progressDeadlineSeconds: 600
minReadySeconds: 10
revisionHistoryLimit: 5kubectl apply -f deployment.yamlkubectl rollout status deployment/apiHealth checks and resource management fields.
livenessProbe:
httpGet:
path: /healthz
port: http
initialDelaySeconds: 10
periodSeconds: 10
readinessProbe:
httpGet:
path: /ready
port: http
initialDelaySeconds: 5
periodSeconds: 5
startupProbe:
httpGet:
path: /startup
port: http
failureThreshold: 30
periodSeconds: 10resources:
requests:
cpu: "250m"
memory: "256Mi"
limits:
cpu: "500m"
memory: "512Mi"Requests influence scheduling; limits constrain runtime resource use.
securityContext:
runAsNonRoot: true
runAsUser: 10001
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]Node selectors, affinity, tolerations, and topology spread.
nodeSelector:
node.kubernetes.io/instance-type: c6i.largeaffinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: topology.kubernetes.io/zone
operator: In
values: ["us-west1-a", "us-west1-b"]affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchLabels:
app: api
topologyKey: kubernetes.io/hostnametolerations:
- key: "dedicated"
operator: "Equal"
value: "batch"
effect: "NoSchedule"Check generated manifests before deploying.
kubectl apply --dry-run=server -f deployment.yaml -o yamlGreat for CI and schema validation when the cluster has the CRDs and admission rules you care about.
kubectl explain deployment.spec.template.spec.containerskubectl apply view-last-applied deployment/api