k8s YAML examples

The app runs in a Pod. One or more containers, one node. If it dies, it stays dead.

Deployment — A dead Pod is replaced. You want 3, it keeps 3.

Each new Pod gets a new IP. Nothing can call the app by address.

Service — One address that does not change. It finds Pods by label, not by IP.

A public Service is a load balancer. Ten public Services is ten load balancers.

Ingress — One load balancer. Host and path choose the Service.

Ingress is only rules. Nothing in the cluster executes them.

Ingress Controller — nginx, Traefik, or the cloud one. It reads the rules and routes.

The database host is still in the image. Changing it means rebuilding the image.

ConfigMap — Config lives outside the image and is injected when the Pod starts. Same image, every environment.

A password in a ConfigMap is just another key. Anyone who can get the object can read it.

Secret — Credentials in their own object, with their own access. The image never holds them.

Some hours need 2 Pods, some hours need 20. A fixed replica count is wrong both ways.

HPA — CPU crosses a percent of the request, Pods are added. Load drops, they come off.

The HPA added Pods. The nodes are full. The new Pods stay Pending.

Karpenter — A Pending Pod gets a node. The load is gone, the node is gone.

One Pod can take the whole node if Kubernetes was never told how much it needs, or how much it may use.

Requests and Limits — requests is what the scheduler reserves. limits is the cap at runtime.

The YAML

1. Container Images FROM, build, tag, push. Then point a Pod at the tag — never :latest on the exam.
2. Pod One container. Create with kubectl run, then edit.
3. Deployment Replicas and rolling updates. Selector must match the template.
4. DaemonSet One Pod per matching node. No replicas field.
5. StatefulSet Pods get a stable name and their own volume. A Deployment does not do that.
6. Job Run to completion. Labels go on the Pod template.
7. Volumes emptyDir dies with the Pod. A PVC outlives it.
8. Probes startup, then liveness (restart) and readiness (Service).
9. Service Stable IP in front of Pods. selector must match Pod labels.
10. ConfigMap Non-secret config. One key as env, every key as envFrom, or a file mount.
11. Secret Credentials. Use stringData in YAML. Same inject patterns as a ConfigMap.
12. NetworkPolicy Deny by default for selected Pods. Then open the paths you need.
13. SecurityContext Take root-like powers off the process. drop ALL, then add NET_BIND_SERVICE to bind :80 as non-root.
14. Helm Search the repo, install repo/chart, --set. A path works too.
15. Sidecar Init runs first. A sidecar shares the Pod — usually via emptyDir.
16. Ingress HTTP from outside to a Service. Host + path + backend. Needs a controller.
17. Kustomize Patch a folder of YAML without Helm. kubectl apply -k .
18. Debug logs → describe → events → exec. --previous after a crash.
19. ServiceAccount Identity the Pod uses to talk to the API. Set serviceAccountName.
20. HPA Scale a Deployment when CPU crosses a percent of the request.
21. Requests & Limits requests schedule the Pod. limits cap it. Memory over → OOMKilled.
22. Namespace A scope. Set the context or pass -n. Cluster objects ignore it.
23. RBAC A Role is verbs on resources. A Binding points it at a ServiceAccount.
24. Quota Quota caps the namespace. LimitRange fills in missing requests and sets max.
25. CRD Adds a new kind. Find it with api-resources, then kubectl get that name.
26. Gateway The successor to Ingress. A Gateway is the listener. An HTTPRoute is the rule.
27. Karpenter Pending pods get a node. Load drops, the node goes away. Not on the CKAD.
28. Terraform Write the infra you want in a .tf file, plan shows the diff, apply makes it real. Not on the CKAD.

Practice these objects on a live cluster →