Kubernetes YAML Cheat Sheet

apiVersion: v1
kind: Pod
metadata:
  name: demo-pod
  labels:
    app: demo
spec:
  containers:
    - name: app
      image: nginx:1.27
      ports:
        - containerPort: 80

# Smallest practical Pod YAML shape.

apiVersion: v1
kind: Namespace
metadata:
  name: demo

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: demo
data:
  APP_ENV: production

# Separate resources with `---`.

kubectl apply -f app.yaml

# Create or update resources from a YAML file.

kubectl apply -f k8s/

# Apply all manifests in a directory.

kubectl diff -f app.yaml

# See what apply would change.

metadata:
  name: api
  namespace: prod
  labels:
    app.kubernetes.io/name: api
    app.kubernetes.io/component: backend
    app.kubernetes.io/part-of: storefront
    tier: web
  annotations:
    kubectl.kubernetes.io/default-container: api
    reloader.stakater.com/auto: "true"

# Common metadata block for selectors and tooling.

kubectl get pods -l app.kubernetes.io/name=api

# Use labels to query related objects.

kubectl label deployment api tier=web --overwrite

# Patch a label onto a resource.

kubectl annotate deployment api owner=platform-team --overwrite

# Write metadata without affecting selectors.

apiVersion: v1
kind: Pod
metadata:
  name: args-demo
spec:
  containers:
    - name: app
      image: busybox:1.36
      command: ["sh", "-c"]
      args: ["echo hello && sleep 3600"]

# Set entrypoint-style command in YAML.

env:
  - name: APP_ENV
    value: production
  - name: LOG_LEVEL
    value: info

# Define environment variables with `env`.

envFrom:
  - configMapRef:
      name: app-config
  - secretRef:
      name: app-secrets

# Import environment values into a container.

ports:
  - name: http
    containerPort: 8080
  - name: metrics
    containerPort: 9090

# Name ports for Service targeting and probes.

spec:
  imagePullSecrets:
    - name: regcred
  containers:
    - name: app
      image: registry.example.com/app:1.2.3

# Authenticate to a private registry.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
        - name: api
          image: ghcr.io/example/api:1.0.0
          ports:
            - containerPort: 8080

# Run a replicated stateless workload.

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxUnavailable: 1
    maxSurge: 1

# Tune availability during rollout.

progressDeadlineSeconds: 600
minReadySeconds: 10
revisionHistoryLimit: 5

# Mark failed rollouts sooner.

kubectl apply -f deployment.yaml

# Create or update the Deployment.

kubectl rollout status deployment/api

# See whether the new ReplicaSet becomes ready.

livenessProbe:
  httpGet:
    path: /healthz
    port: http
  initialDelaySeconds: 10
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /ready
    port: http
  initialDelaySeconds: 5
  periodSeconds: 5

startupProbe:
  httpGet:
    path: /startup
    port: http
  failureThreshold: 30
  periodSeconds: 10

# Use health checks to control traffic and restarts.

resources:
  requests:
    cpu: "250m"
    memory: "256Mi"
  limits:
    cpu: "500m"
    memory: "512Mi"

# Define scheduler reservations and hard caps.

securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]

# Drop privileges and run as non-root.

nodeSelector:
  node.kubernetes.io/instance-type: c6i.large

# Require a simple node label match.

affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
        - matchExpressions:
            - key: topology.kubernetes.io/zone
              operator: In
              values: ["us-west1-a", "us-west1-b"]

# More expressive scheduling constraints.

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
      - weight: 100
        podAffinityTerm:
          labelSelector:
            matchLabels:
              app: api
          topologyKey: kubernetes.io/hostname

# Avoid colocating the same app on one node.

tolerations:
  - key: "dedicated"
    operator: "Equal"
    value: "batch"
    effect: "NoSchedule"

# Allow pods onto special-purpose nodes.

kubectl apply --dry-run=server -f deployment.yaml -o yaml

# Validate a manifest against the API server without persisting it.

kubectl explain deployment.spec.template.spec.containers

# Discover valid YAML fields from kubectl.

kubectl apply view-last-applied deployment/api

# Inspect the apply annotation on a live resource.