Kubernetes Crash Course

# Build image.
FROM golang:1.17-bullseye as build

WORKDIR /go/src/app

COPY go.* ./
RUN go mod download

COPY . ./
RUN --mount=type=cache,target=/root/.cache/go-build make linux

# Distroless is a lightweight base image.
FROM gcr.io/distroless/base-debian11
COPY --from=build /go/src/app/fizzbuzz /
CMD ["/fizzbuzz"]

docker build . -t nfinstana/fizzbuzz:1.0.0-85d759de && \
docker push nfinstana/fizzbuzz:1.0.0-85d759de

apiVersion: $(API_VERSION)      # e.g. batch/v1, apps/v1, v1
kind: $(RESOURCE_KIND)          # e.g. Pod, CronJob, Deployment
metadata:
  name: $(UNIQUE_NAME)          # unique name for the resource kind
  namespace: $(NAMESPACE)       # namespace, some kinds are global, otherwise defaulted
  labels:
    $(LABEL_MAP)                # key-value pairs
  annotations:
    $(ANNOTATION_MAP)           # key-value pairs
spec:
  # ... resource definition

apiVersion: v1
kind: Pod
metadata:
  name: fizzbuzz
  namespace: instana-dev
  labels:
    # Standard labels - https://helm.sh/docs/chart_best_practices/labels/#standard-labels
    app.kubernetes.io/name: "fizzbuzz"
    app.kubernetes.io/version: "1.0.0-85d759de"
spec:
  containers:
  - name: fizbuzz
    image: nfinstana/fizzbuzz:1.0.0-85d759de

apiVersion: v1
kind: Pod
# ...
spec:
  containers:
  - name: fizbuzz
    resources:
      requests:
        cpu: "10m"
        memory: "64Mi"
      limits:
        cpu: "100m"
        memory: "128Mi"
    # ...

kubectl taint nodes node01 role=ingress:NoSchedule

apiVersion: v1
kind: Pod
# ...
spec:
  containers:
  # ...
  tolerations:
  - key: "role"
    operator: "Equal"
    value: "ingress"
    effect: "NoSchedule"

apiVersion: v1
kind: Pod
# ...
spec:
  containers:
  # ...
  affinity:
    nodeAffinity:
      requiredDuringSchedulingRequiredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: "role"
            operator: "Equal"
            value: "ingress"
            effect: "NoSchedule"

apiVersion: v1
kind: Pod
# ...
spec:
  containers:
  # ...
  affinity:
    # ...
    podAntiAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
      - labelSelector:
          matchExpressions:
          - key: "app.kubernetes.io/name"
            operator: In
            values:
            - fizzbuzz
        topologyKey: "kubernetes.io/hostname"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: fizzbuzz
  namespace: instana-dev
  labels:
    app.kubernetes.io/name: "fizzbuzz"
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: "fizzbuzz"
  template:
    metadata:
      labels:
        app.kubernetes.io/name: "fizzbuzz"
        app.kubernetes.io/version: "1.0.0-85d759de"
    spec:
      containers:
      - name: fizbuzz
        image: gcr.io/google_containers/pause-amd64:3.0

kubectl scale --replicas=2 -n instana-dev deployment/fizzbuzz 

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: fizzbuzz
  namespace: instana-dev
spec:
  minReplicas: 3
  maxReplicas: 10
  metrics:
  - resource:
      name: cpu
      target:
        averageUtilization: 50
        type: Utilization
    type: Resource
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: fizzbuzz

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: local-storage
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer

apiVersion: v1
kind: PersistentVolume
metadata:
  name: local-pv
  labels:
    type: local
spec:
  storageClassName: local-storage
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt"

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: nginx
  serviceName: "nginx"
  template:
    metadata:
      labels:
        app: nginx
    spec:
      terminationGracePeriodSeconds: 10
      containers:
      - name: nginx
        image: nginx

# ...
spec:
  containers:
  - name: nginx
    image: nginx
    volumeMounts:
    - name: www
      mountPath: /usr/share/nginx/html

# ...
      volumeMounts:
      - name: www
        mountPath: /usr/share/nginx/html
volumeClaimTemplates:
- metadata:
    name: www
  spec:
    accessModes: [ "ReadWriteOnce" ]
    storageClassName: "local-storage"
    resources:
      requests:
        storage: 1Gi

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd-elasticsearch
spec:
  selector:
    matchLabels:
      name: fluentd-elasticsearch
  template:
    metadata:
      labels:
        name: fluentd-elasticsearch
    spec:
      containers:
      - name: fluentd-elasticsearch
        image: quay.io/fluentd_elasticsearch/fluentd:v2.5.2
        volumeMounts:
        - name: varlog
          mountPath: /var/log
      volumes:
      - name: varlog
        hostPath:
          path: /var/log

apiVersion: batch/v1
kind: CronJob
metadata:
  name: hello2
spec:
  schedule: "* * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: hello2
            image: busybox
            command: ["/bin/sh", "-c", "sleep 10"]
          restartPolicy: OnFailure

apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: kube-dns
  name: kube-dns
spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: dns
    port: 53
    protocol: UDP
    targetPort: 53
  selector:
    k8s-app: kube-dns
  sessionAffinity: None
  type: ClusterIP

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 172.17.0.0/16
    - namespaceSelector:
        matchLabels:
          project: instana-dev
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 8080