├── .gitignore ├── app-a ├── ch08 │ ├── kustomize │ │ ├── kustomization.yaml │ │ └── pod.yaml │ └── manifests │ │ ├── configmap.yaml │ │ └── pod.yaml ├── ch09 │ ├── namespace │ │ └── ckad-namespace.yaml │ ├── pod-nginx │ │ ├── nginx-pod.yaml │ │ └── nginx-pod-envs.yaml │ └── pod-command │ │ ├── pod-date.yaml │ │ └── pod-welcome.yaml ├── ch13 │ ├── resourcequota │ │ ├── namespace.yaml │ │ ├── resourcequota.yaml │ │ ├── pod-after.yaml │ │ └── pod-before.yaml │ ├── limitrange │ │ ├── pod-without-resource-requirements.yaml │ │ ├── setup.yaml │ │ ├── pod-with-more-cpu-resource-requirements.yaml │ │ └── pod-with-less-cpu-resource-requirements.yaml │ └── resource-requirements │ │ └── pod.yaml ├── ch18 │ ├── canary │ │ ├── namespace.yaml │ │ ├── blue-service.yaml │ │ ├── green-service.yaml │ │ ├── blue-ingress.yaml │ │ ├── green-ingress.yaml │ │ ├── blue-deployment.yaml │ │ └── green-deployment.yaml │ └── multiple-paths │ │ ├── namespace.yaml │ │ ├── api-service.yaml │ │ ├── frontend-service.yaml │ │ ├── api-deployment.yaml │ │ ├── frontend-deployment.yaml │ │ └── ingress.yaml ├── ch16 │ ├── dynamic-provisioning │ │ ├── persistence-namespace.yaml │ │ ├── db-pvc.yaml │ │ ├── alpine-pod.yaml │ │ └── local-path-storage-0.0.31.yaml │ └── static-provisioning │ │ ├── logs-pvc.yaml │ │ ├── logs-pv.yaml │ │ └── nginx-pod.yaml ├── ch10 │ ├── secret │ │ ├── secret.yaml │ │ └── pod.yaml │ └── configmap │ │ ├── application.yaml │ │ ├── configmap.yaml │ │ └── pod.yaml ├── ch22 │ ├── troubleshooting-worker-node │ │ └── setup.sh │ └── troubleshooting-control-plane-node │ │ └── setup.sh ├── ch07 │ ├── backup-crd │ │ ├── backup.yaml │ │ └── backup-resource.yaml │ └── mongodb-operator │ │ └── mongodbcommunity.mongodb.com_mongodbcommunity.yaml ├── ch04 │ ├── node-evict-pods │ │ └── nginx-pod.yaml │ └── upgrade-cluster-version │ │ ├── worker.sh │ │ ├── control-plane.sh │ │ ├── Vagrantfile │ │ └── common.sh ├── ch14 │ ├── nodeselector-affinity │ │ ├── pod-nodeselector.yaml │ │ └── pod-node-affinity.yaml │ └── toleration │ │ └── pod-toleration.yaml ├── ch20 │ ├── database-access-control │ │ ├── default-deny-all.yaml │ │ ├── database-policy.yaml │ │ ├── backend-policy.yaml │ │ └── setup.yaml │ └── cross-namespace-control │ │ ├── beta-app-policy.yaml │ │ ├── alpha-app-policy.yaml │ │ └── setup.yaml ├── ch17 │ ├── service-discovery │ │ ├── database-service.yaml │ │ ├── frontend-deployment.yaml │ │ └── database-deployment.yaml │ └── multi-port │ │ ├── service.yaml │ │ └── deployment.yaml ├── ch19 │ ├── basic-gateway │ │ ├── gateway.yaml │ │ ├── httproute.yaml │ │ └── setup.yaml │ └── cross-namespace-gateway │ │ ├── gateway.yaml │ │ ├── reference-grant.yaml │ │ ├── production-route.yaml │ │ ├── staging-route.yaml │ │ └── setup.yaml ├── ch11 │ ├── deployment │ │ └── nginx-deployment.yaml │ └── misconfigured-deployment │ │ ├── fix-me-deployment.yaml │ │ └── fixed-deployment.yaml ├── ch21 │ ├── troubleshooting-pod │ │ ├── setup.yaml │ │ └── setup-fixed.yaml │ ├── stress-test │ │ ├── stress-1-pod.yaml │ │ ├── stress-2-pod.yaml │ │ └── stress-3-pod.yaml │ └── troubleshooting-service │ │ ├── setup.yaml │ │ └── setup-fixed.yaml ├── ch12 │ ├── manual-scaling │ │ ├── hello-world-deployment-replicas-3.yaml │ │ └── hello-world-deployment-replicas-8.yaml │ └── auto-scaling │ │ ├── nginx-deployment.yaml │ │ └── nginx-hpa.yaml ├── ch05 │ └── etcd-backup-restore │ │ ├── worker.sh │ │ ├── etcdctl.sh │ │ ├── control-plane.sh │ │ ├── Vagrantfile │ │ └── common.sh ├── ch06 │ └── rbac-aggregation │ │ ├── worker.sh │ │ ├── setup.sh │ │ ├── control-plane.sh │ │ ├── Vagrantfile │ │ └── common.sh └── ch15 │ └── multi-container-alpine.yaml ├── ch08 └── kustomize │ ├── generating-resources │ ├── config │ │ ├── db-secret.properties │ │ └── db-config.properties │ ├── kustomization.yaml │ └── web-app-pod.yaml │ ├── composition │ ├── kustomization.yaml │ ├── web-app-service.yaml │ └── web-app-deployment.yaml │ ├── patching │ ├── kustomization.yaml │ ├── security-context.yaml │ └── nginx-deployment.yaml │ └── common-configuration │ ├── kustomization.yaml │ ├── web-app-service.yaml │ └── web-app-deployment.yaml ├── ch09 ├── namespace │ └── code-red-namespace.yaml └── pod │ ├── args │ └── pod.yaml │ ├── cmd-args │ └── pod.yaml │ ├── env-vars │ └── pod.yaml │ └── hazelcast-pod │ └── pod.yaml ├── ch20 ├── internal-tools-namespace.yaml ├── networkpolicy-deny-all.yaml ├── coffee-shop-pod.yaml ├── metrics-api-pod.yaml ├── grocery-store-pod.yaml ├── metrics-consumer-pod.yaml ├── payment-processor-pod.yaml ├── networkpolicy-api-allow.yaml └── networkpolicy-port-allow.yaml ├── ch06 └── rbac │ ├── serviceaccount │ ├── serviceaccount.yaml │ ├── role.yaml │ ├── rolebinding.yaml │ └── setup.yaml │ ├── aggregation │ ├── clusterrole-list-pods.yaml │ ├── clusterrole-delete-services.yaml │ └── clusterrole-pods-services-aggregation-rules.yaml │ └── user │ ├── rolebinding.yaml │ └── role.yaml ├── ch10 ├── configmap │ ├── db.json │ ├── configmap-simple.yaml │ ├── pod-env-vars.yaml │ ├── configmap-structured.yaml │ └── pod-volume.yaml └── secret │ ├── secret-opaque-data.yaml │ ├── secret-opaque-stringdata.yaml │ ├── secret-basic-auth.yaml │ ├── pod-env-vars.yaml │ └── pod-volume.yaml ├── ch03 └── object-management │ ├── web-app │ ├── config │ │ ├── db-secret.yaml │ │ └── db-configmap.yaml │ └── web-app-pod.yaml │ ├── app-stack │ ├── mysql-service.yaml │ ├── web-app-service.yaml │ ├── mysql-pod.yaml │ └── web-app-pod.yaml │ └── nginx-deployment.yaml ├── ch21 └── pods-containers │ ├── minimal-pod.yaml │ ├── err-image-pull.yaml │ ├── crash-loop-backoff.yaml │ ├── failing-pod.yaml │ ├── create-container-config-error.yaml │ └── missing-secret.yaml ├── ch07 ├── nginx │ ├── nginx-service.yaml │ └── nginx-deployment.yaml └── argo-cd │ └── nginx-application.yaml ├── ch13 ├── resourcequota │ ├── nginx-pod.yaml │ ├── awesome-quota.yaml │ ├── nginx-pod1.yaml │ └── nginx-pod2.yaml ├── limitrange │ ├── nginx-without-resource-requirements.yaml │ ├── nginx-with-resource-requirements.yaml │ └── cpu-resource-constraint.yaml └── resource-requirements │ ├── pod-rate-limiter-resource-limits.yaml │ ├── pod-rate-limiter-resource-requests.yaml │ └── pod-rate-limiter-resource-requests-limits.yaml ├── ch19 ├── gateway-class.yaml ├── gateway.yaml └── httproute.yaml ├── ch17 ├── service-default-type.yaml ├── service-clusterip-type.yaml ├── service-nodeport-type.yaml └── service-loadbalancer-type.yaml ├── ch14 ├── nodeselector │ └── pod-nodeselector.yaml ├── toleration │ └── pod-toleration.yaml ├── nodeaffinity │ ├── pod-node-affinity.yaml │ └── pod-node-anti-affinity.yaml └── topology-spread-constraint │ └── deployment-topology-spread-constraint.yaml ├── ch16 ├── dynamic-provisioning │ ├── fast-sc.yaml │ └── db-pvc.yaml ├── static-provisioning │ ├── db-pv.yaml │ ├── db-pvc.yaml │ └── app-consuming-pvc.yaml └── config-options │ ├── pvc-volume-name.yaml │ └── pv-node-affinity.yaml ├── ch18 ├── app-service.yaml ├── metrics-service.yaml ├── metrics-pod.yaml ├── app-pod.yaml └── ingress.yaml ├── ch15 ├── pod-with-volume-readonly.yaml └── pod-with-volume.yaml ├── ch11 ├── deployment │ └── app-cache-deployment.yaml └── statefulset │ └── redis-statefulset-service.yaml ├── ch12 └── hpa │ ├── app-cache-hpa-cpu.yaml │ ├── app-cache-deployment-cpu-resources.yaml │ ├── app-cache-hpa-cpu-memory.yaml │ └── app-cache-deployment-cpu-memory-resources.yaml ├── .github └── workflows │ └── validate-manifests.yml ├── README.adoc ├── app-b └── exam-review-guide.adoc └── LICENSE /.gitignore: -------------------------------------------------------------------------------- 1 | .DS_Store 2 | .vagrant 3 | kubeadm-init.out 4 | admin.conf 5 | *-console.log -------------------------------------------------------------------------------- /app-a/ch08/kustomize/kustomization.yaml: -------------------------------------------------------------------------------- 1 | namespace: t012 2 | resources: 3 | - pod.yaml -------------------------------------------------------------------------------- /ch08/kustomize/generating-resources/config/db-secret.properties: -------------------------------------------------------------------------------- 1 | DB_PASSWORD: cGFzc3dvcmQ= -------------------------------------------------------------------------------- /ch08/kustomize/generating-resources/config/db-config.properties: -------------------------------------------------------------------------------- 1 | DB_HOST: mysql-service 2 | DB_USER: root -------------------------------------------------------------------------------- /app-a/ch09/namespace/ckad-namespace.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: ckad -------------------------------------------------------------------------------- /app-a/ch13/resourcequota/namespace.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: rq-demo -------------------------------------------------------------------------------- /app-a/ch18/canary/namespace.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: production-apps -------------------------------------------------------------------------------- /app-a/ch18/multiple-paths/namespace.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: webapp -------------------------------------------------------------------------------- /ch09/namespace/code-red-namespace.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: code-red -------------------------------------------------------------------------------- /ch08/kustomize/composition/kustomization.yaml: -------------------------------------------------------------------------------- 1 | resources: 2 | - web-app-deployment.yaml 3 | - web-app-service.yaml -------------------------------------------------------------------------------- /ch20/internal-tools-namespace.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: internal-tools -------------------------------------------------------------------------------- /ch06/rbac/serviceaccount/serviceaccount.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ServiceAccount 3 | metadata: 4 | name: cicd-bot -------------------------------------------------------------------------------- /ch10/configmap/db.json: -------------------------------------------------------------------------------- 1 | { 2 | "db": { 3 | "host": "mysql-service", 4 | "user": "backend" 5 | } 6 | } -------------------------------------------------------------------------------- /app-a/ch16/dynamic-provisioning/persistence-namespace.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: persistence -------------------------------------------------------------------------------- /ch08/kustomize/patching/kustomization.yaml: -------------------------------------------------------------------------------- 1 | resources: 2 | - nginx-deployment.yaml 3 | patchesStrategicMerge: 4 | - security-context.yaml -------------------------------------------------------------------------------- /ch10/secret/secret-opaque-data.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Secret 3 | metadata: 4 | name: db-creds 5 | type: Opaque 6 | data: 7 | pwd: czNjcmUh -------------------------------------------------------------------------------- /app-a/ch08/manifests/configmap.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ConfigMap 3 | metadata: 4 | name: logs-config 5 | data: 6 | dir: "/etc/logs/traffic.log" -------------------------------------------------------------------------------- /app-a/ch10/secret/secret.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Secret 3 | metadata: 4 | name: db-credentials 5 | type: Opaque 6 | data: 7 | db-password: cGFzc3dk -------------------------------------------------------------------------------- /app-a/ch10/configmap/application.yaml: -------------------------------------------------------------------------------- 1 | dev: 2 | url: http://dev.bar.com 3 | name: Developer Setup 4 | prod: 5 | url: http://foo.bar.com 6 | name: My Cool App -------------------------------------------------------------------------------- /ch10/secret/secret-opaque-stringdata.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Secret 3 | metadata: 4 | name: db-creds 5 | type: Opaque 6 | stringData: 7 | pwd: s3cre! -------------------------------------------------------------------------------- /app-a/ch08/kustomize/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx 5 | spec: 6 | containers: 7 | - name: nginx 8 | image: nginx:1.21.1 -------------------------------------------------------------------------------- /app-a/ch08/manifests/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx 5 | spec: 6 | containers: 7 | - name: nginx 8 | image: nginx:1.21.1 -------------------------------------------------------------------------------- /ch10/configmap/configmap-simple.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ConfigMap 3 | metadata: 4 | name: db-config 5 | data: 6 | DB_HOST: mysql-service 7 | DB_USER: backend -------------------------------------------------------------------------------- /app-a/ch22/troubleshooting-worker-node/setup.sh: -------------------------------------------------------------------------------- 1 | # Simulate the problem 2 | # SSH into worker-node-2 and run: 3 | sudo systemctl stop kubelet 4 | kubectl cordon worker-node-2 -------------------------------------------------------------------------------- /ch03/object-management/web-app/config/db-secret.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Secret 3 | metadata: 4 | name: db-creds 5 | type: Opaque 6 | data: 7 | DB_PASSWORD: cGFzc3dvcmQ= -------------------------------------------------------------------------------- /ch03/object-management/web-app/config/db-configmap.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ConfigMap 3 | metadata: 4 | name: db-config 5 | data: 6 | DB_HOST: mysql-service 7 | DB_USER: root -------------------------------------------------------------------------------- /ch08/kustomize/common-configuration/kustomization.yaml: -------------------------------------------------------------------------------- 1 | namespace: persistence 2 | commonLabels: 3 | team: helix 4 | resources: 5 | - web-app-deployment.yaml 6 | - web-app-service.yaml -------------------------------------------------------------------------------- /ch21/pods-containers/minimal-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: minimal-pod 5 | spec: 6 | containers: 7 | - image: k8s.gcr.io/pause:3.1 8 | name: pause -------------------------------------------------------------------------------- /ch21/pods-containers/err-image-pull.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: misbehaving-pod 5 | spec: 6 | containers: 7 | - image: httpd:235 8 | name: http-server -------------------------------------------------------------------------------- /ch07/nginx/nginx-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: nginx 5 | spec: 6 | selector: 7 | app: nginx 8 | ports: 9 | - port: 80 10 | targetPort: 80 -------------------------------------------------------------------------------- /ch13/resourcequota/nginx-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx 5 | namespace: team-awesome 6 | spec: 7 | containers: 8 | - image: nginx:1.25.3 9 | name: nginx -------------------------------------------------------------------------------- /ch19/gateway-class.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1 2 | kind: GatewayClass 3 | metadata: 4 | name: envoy 5 | spec: 6 | controllerName: gateway.envoyproxy.io/gatewayclass-controller 7 | -------------------------------------------------------------------------------- /ch10/secret/secret-basic-auth.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Secret 3 | metadata: 4 | name: secret-basic-auth 5 | type: kubernetes.io/basic-auth 6 | stringData: 7 | username: bmuschko 8 | password: secret -------------------------------------------------------------------------------- /app-a/ch07/backup-crd/backup.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: example.com/v1 2 | kind: Backup 3 | metadata: 4 | name: nginx-backup 5 | spec: 6 | cronExpression: "0 0 * * *" 7 | podName: nginx 8 | path: /usr/local/nginx -------------------------------------------------------------------------------- /ch17/service-default-type.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: echoserver 5 | spec: 6 | selector: 7 | run: echoserver 8 | ports: 9 | - port: 80 10 | targetPort: 8080 -------------------------------------------------------------------------------- /ch14/nodeselector/pod-nodeselector.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app 5 | spec: 6 | nodeSelector: 7 | disk: ssd 8 | containers: 9 | - name: nginx 10 | image: nginx:1.27.1 -------------------------------------------------------------------------------- /app-a/ch09/pod-nginx/nginx-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx 5 | spec: 6 | containers: 7 | - name: nginx 8 | image: nginx:1.17.10 9 | ports: 10 | - containerPort: 80 -------------------------------------------------------------------------------- /ch13/limitrange/nginx-without-resource-requirements.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx-without-resource-requirements 5 | spec: 6 | containers: 7 | - image: nginx:1.25.3 8 | name: nginx 9 | -------------------------------------------------------------------------------- /ch16/dynamic-provisioning/fast-sc.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: storage.k8s.io/v1 2 | kind: StorageClass 3 | metadata: 4 | name: fast 5 | provisioner: kubernetes.io/gce-pd 6 | parameters: 7 | type: pd-ssd 8 | replication-type: regional-pd -------------------------------------------------------------------------------- /app-a/ch04/node-evict-pods/nginx-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx 5 | spec: 6 | containers: 7 | - name: nginx 8 | image: nginx:1.27.4-alpine 9 | ports: 10 | - containerPort: 80 -------------------------------------------------------------------------------- /app-a/ch13/resourcequota/resourcequota.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ResourceQuota 3 | metadata: 4 | name: app 5 | namespace: rq-demo 6 | spec: 7 | hard: 8 | pods: "2" 9 | requests.cpu: "2" 10 | requests.memory: 500Mi -------------------------------------------------------------------------------- /app-a/ch14/nodeselector-affinity/pod-nodeselector.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app 5 | spec: 6 | containers: 7 | - image: nginx:1.27.1 8 | name: nginx 9 | nodeSelector: 10 | color: green -------------------------------------------------------------------------------- /ch06/rbac/serviceaccount/role.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1 2 | kind: Role 3 | metadata: 4 | name: list-pods-role 5 | namespace: k97 6 | rules: 7 | - apiGroups: [""] 8 | resources: ["pods"] 9 | verbs: ["list"] 10 | -------------------------------------------------------------------------------- /ch16/static-provisioning/db-pv.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: PersistentVolume 3 | metadata: 4 | name: db-pv 5 | spec: 6 | capacity: 7 | storage: 1Gi 8 | accessModes: 9 | - ReadWriteOnce 10 | hostPath: 11 | path: /data/db -------------------------------------------------------------------------------- /app-a/ch13/limitrange/pod-without-resource-requirements.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: pod-without-resource-requirements 5 | namespace: d92 6 | spec: 7 | containers: 8 | - image: nginx:1.23.4-alpine 9 | name: nginx -------------------------------------------------------------------------------- /ch21/pods-containers/crash-loop-backoff.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: incorrect-cmd-pod 5 | spec: 6 | containers: 7 | - name: test-container 8 | image: busybox:1.36.1 9 | command: ["/bin/sh", "-c", "unknown"] -------------------------------------------------------------------------------- /app-a/ch20/database-access-control/default-deny-all.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | name: default-deny-ingress 5 | namespace: production 6 | spec: 7 | podSelector: {} 8 | policyTypes: 9 | - Ingress -------------------------------------------------------------------------------- /app-a/ch17/service-discovery/database-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: database-service 5 | spec: 6 | type: ClusterIP 7 | selector: 8 | app: database 9 | ports: 10 | - port: 3306 11 | targetPort: 3306 -------------------------------------------------------------------------------- /ch09/pod/args/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: mypod 5 | spec: 6 | containers: 7 | - name: mypod 8 | image: busybox:1.36.1 9 | args: 10 | - /bin/sh 11 | - -c 12 | - while true; do date; sleep 10; done -------------------------------------------------------------------------------- /ch09/pod/cmd-args/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: mypod 5 | spec: 6 | containers: 7 | - name: mypod 8 | image: busybox:1.36.1 9 | command: ["/bin/sh"] 10 | args: ["-c", "while true; do date; sleep 10; done"] -------------------------------------------------------------------------------- /ch10/configmap/pod-env-vars.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: backend 5 | spec: 6 | containers: 7 | - image: bmuschko/web-app:1.0.1 8 | name: backend 9 | envFrom: 10 | - configMapRef: 11 | name: db-config -------------------------------------------------------------------------------- /ch18/app-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: metrics-service 5 | spec: 6 | type: ClusterIP 7 | selector: 8 | app: metrics-service 9 | ports: 10 | - port: 9090 11 | targetPort: 8080 12 | protocol: TCP -------------------------------------------------------------------------------- /ch18/metrics-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: app-service 5 | spec: 6 | type: ClusterIP 7 | selector: 8 | app: app-service 9 | ports: 10 | - port: 8080 11 | targetPort: 8080 12 | protocol: TCP -------------------------------------------------------------------------------- /ch19/gateway.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1 2 | kind: Gateway 3 | metadata: 4 | name: hello-world-gateway 5 | spec: 6 | gatewayClassName: envoy 7 | listeners: 8 | - name: http 9 | protocol: HTTP 10 | port: 80 11 | -------------------------------------------------------------------------------- /ch20/networkpolicy-deny-all.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | name: default-deny-all 5 | namespace: internal-tools 6 | spec: 7 | podSelector: {} 8 | policyTypes: 9 | - Ingress 10 | - Egress 11 | -------------------------------------------------------------------------------- /ch10/secret/pod-env-vars.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: backend 5 | spec: 6 | containers: 7 | - image: bmuschko/web-app:1.0.1 8 | name: backend 9 | envFrom: 10 | - secretRef: 11 | name: secret-basic-auth -------------------------------------------------------------------------------- /ch16/static-provisioning/db-pvc.yaml: -------------------------------------------------------------------------------- 1 | kind: PersistentVolumeClaim 2 | apiVersion: v1 3 | metadata: 4 | name: db-pvc 5 | spec: 6 | accessModes: 7 | - ReadWriteOnce 8 | storageClassName: "" 9 | resources: 10 | requests: 11 | storage: 256Mi -------------------------------------------------------------------------------- /app-a/ch13/resourcequota/pod-after.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: mypod 5 | spec: 6 | containers: 7 | - image: nginx 8 | name: mypod 9 | resources: 10 | requests: 11 | cpu: "0.5" 12 | memory: "255Mi" -------------------------------------------------------------------------------- /ch16/config-options/pvc-volume-name.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: PersistentVolumeClaim 3 | metadata: 4 | name: specific-pvc 5 | spec: 6 | volumeName: db-pv 7 | accessModes: 8 | - ReadWriteOnce 9 | resources: 10 | requests: 11 | storage: 1Gi -------------------------------------------------------------------------------- /ch16/dynamic-provisioning/db-pvc.yaml: -------------------------------------------------------------------------------- 1 | kind: PersistentVolumeClaim 2 | apiVersion: v1 3 | metadata: 4 | name: db-pvc 5 | spec: 6 | accessModes: 7 | - ReadWriteOnce 8 | resources: 9 | requests: 10 | storage: 512Mi 11 | storageClassName: standard -------------------------------------------------------------------------------- /ch18/metrics-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app 5 | labels: 6 | app: app-service 7 | spec: 8 | containers: 9 | - name: echoserver 10 | image: k8s.gcr.io/echoserver:1.10 11 | ports: 12 | - containerPort: 8080 -------------------------------------------------------------------------------- /ch10/configmap/configmap-structured.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ConfigMap 3 | metadata: 4 | name: db-config 5 | data: 6 | db.json: |- 7 | { 8 | "db": { 9 | "host": "mysql-service", 10 | "user": "backend" 11 | } 12 | } -------------------------------------------------------------------------------- /ch18/app-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: metrics 5 | labels: 6 | app: metrics-service 7 | spec: 8 | containers: 9 | - name: echoserver 10 | image: k8s.gcr.io/echoserver:1.10 11 | ports: 12 | - containerPort: 8080 -------------------------------------------------------------------------------- /app-a/ch16/static-provisioning/logs-pvc.yaml: -------------------------------------------------------------------------------- 1 | kind: PersistentVolumeClaim 2 | apiVersion: v1 3 | metadata: 4 | name: logs-pvc 5 | spec: 6 | accessModes: 7 | - ReadWriteOnce 8 | resources: 9 | requests: 10 | storage: 2Gi 11 | storageClassName: "" 12 | -------------------------------------------------------------------------------- /ch08/kustomize/generating-resources/kustomization.yaml: -------------------------------------------------------------------------------- 1 | configMapGenerator: 2 | - name: db-config 3 | files: 4 | - config/db-config.properties 5 | secretGenerator: 6 | - name: db-creds 7 | files: 8 | - config/db-secret.properties 9 | resources: 10 | - web-app-pod.yaml -------------------------------------------------------------------------------- /app-a/ch16/static-provisioning/logs-pv.yaml: -------------------------------------------------------------------------------- 1 | kind: PersistentVolume 2 | apiVersion: v1 3 | metadata: 4 | name: logs-pv 5 | spec: 6 | capacity: 7 | storage: 5Gi 8 | accessModes: 9 | - ReadWriteOnce 10 | - ReadOnlyMany 11 | hostPath: 12 | path: /var/logs 13 | -------------------------------------------------------------------------------- /app-a/ch18/multiple-paths/api-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: api-service 5 | namespace: webapp 6 | spec: 7 | selector: 8 | app: api 9 | ports: 10 | - port: 80 11 | targetPort: 80 12 | protocol: TCP 13 | type: ClusterIP -------------------------------------------------------------------------------- /app-a/ch19/basic-gateway/gateway.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1 2 | kind: Gateway 3 | metadata: 4 | name: main-gateway 5 | spec: 6 | gatewayClassName: nginx 7 | listeners: 8 | - name: http 9 | port: 80 10 | protocol: HTTP 11 | hostname: example.local -------------------------------------------------------------------------------- /ch20/coffee-shop-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: coffee-shop 5 | labels: 6 | app: coffee-shop 7 | role: backend 8 | spec: 9 | containers: 10 | - name: nginx 11 | image: nginx:1.25.3-alpine 12 | ports: 13 | - containerPort: 80 -------------------------------------------------------------------------------- /ch20/metrics-api-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: metrics-api 5 | namespace: internal-tools 6 | labels: 7 | app: api 8 | spec: 9 | containers: 10 | - name: nginx 11 | image: nginx:1.25.3-alpine 12 | ports: 13 | - containerPort: 80 -------------------------------------------------------------------------------- /app-a/ch13/resourcequota/pod-before.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: mypod 5 | spec: 6 | containers: 7 | - image: nginx 8 | name: mypod 9 | resources: 10 | requests: 11 | cpu: "0.5" 12 | memory: "1Gi" 13 | restartPolicy: Never -------------------------------------------------------------------------------- /ch17/service-clusterip-type.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: echoserver 5 | spec: 6 | type: ClusterIP 7 | clusterIP: 10.96.254.0 8 | selector: 9 | app: echoserver 10 | ports: 11 | - port: 5005 12 | targetPort: 8080 13 | protocol: TCP -------------------------------------------------------------------------------- /ch20/grocery-store-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: grocery-store 5 | labels: 6 | app: grocery-store 7 | role: backend 8 | spec: 9 | containers: 10 | - name: nginx 11 | image: nginx:1.25.3-alpine 12 | ports: 13 | - containerPort: 80 -------------------------------------------------------------------------------- /ch14/toleration/pod-toleration.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app 5 | spec: 6 | tolerations: 7 | - key: "special" 8 | operator: "Equal" 9 | value: "true" 10 | effect: "NoSchedule" 11 | containers: 12 | - name: nginx 13 | image: nginx:1.27.1 -------------------------------------------------------------------------------- /app-a/ch14/toleration/pod-toleration.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app 5 | spec: 6 | containers: 7 | - image: nginx:1.27.1 8 | name: nginx 9 | tolerations: 10 | - key: "exclusive" 11 | operator: "Equal" 12 | value: "yes" 13 | effect: "NoExecute" -------------------------------------------------------------------------------- /app-a/ch18/multiple-paths/frontend-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: frontend-service 5 | namespace: webapp 6 | spec: 7 | selector: 8 | app: frontend 9 | ports: 10 | - port: 80 11 | targetPort: 80 12 | protocol: TCP 13 | type: ClusterIP -------------------------------------------------------------------------------- /ch13/resourcequota/awesome-quota.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ResourceQuota 3 | metadata: 4 | name: awesome-quota 5 | namespace: team-awesome 6 | spec: 7 | hard: 8 | pods: 2 9 | requests.cpu: "1" 10 | requests.memory: 1024Mi 11 | limits.cpu: "4" 12 | limits.memory: 4096Mi -------------------------------------------------------------------------------- /ch20/metrics-consumer-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: metrics-consumer 5 | namespace: internal-tools 6 | labels: 7 | app: consumer 8 | spec: 9 | containers: 10 | - name: nginx 11 | image: nginx:1.25.3-alpine 12 | ports: 13 | - containerPort: 80 -------------------------------------------------------------------------------- /ch20/payment-processor-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: payment-processor 5 | labels: 6 | app: payment-processor 7 | role: api 8 | spec: 9 | containers: 10 | - name: nginx 11 | image: nginx:1.25.3-alpine 12 | ports: 13 | - containerPort: 80 -------------------------------------------------------------------------------- /app-a/ch10/configmap/configmap.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ConfigMap 3 | metadata: 4 | name: app-config 5 | data: 6 | application.yaml: |- 7 | dev: 8 | url: http://dev.bar.com 9 | name: Developer Setup 10 | prod: 11 | url: http://foo.bar.com 12 | name: My Cool App -------------------------------------------------------------------------------- /app-a/ch16/dynamic-provisioning/db-pvc.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: PersistentVolumeClaim 3 | metadata: 4 | name: db-pvc 5 | namespace: persistence 6 | spec: 7 | accessModes: 8 | - ReadWriteOnce 9 | storageClassName: local-path 10 | resources: 11 | requests: 12 | storage: 128Mi 13 | -------------------------------------------------------------------------------- /ch17/service-nodeport-type.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: echoserver 5 | spec: 6 | type: NodePort 7 | clusterIP: 10.96.254.0 8 | selector: 9 | app: echoserver 10 | ports: 11 | - port: 5005 12 | nodePort: 30158 13 | targetPort: 8080 14 | protocol: TCP -------------------------------------------------------------------------------- /ch06/rbac/aggregation/clusterrole-list-pods.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1 2 | kind: ClusterRole 3 | metadata: 4 | name: list-pods 5 | namespace: rbac-example 6 | labels: 7 | rbac-pod-list: "true" 8 | rules: 9 | - apiGroups: 10 | - "" 11 | resources: 12 | - pods 13 | verbs: 14 | - list -------------------------------------------------------------------------------- /ch21/pods-containers/failing-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: failing-pod 5 | spec: 6 | containers: 7 | - args: 8 | - /bin/sh 9 | - -c 10 | - while true; do echo $(date) >> ~/tmp/curr-date.txt; sleep 11 | 5; done; 12 | image: busybox:1.36.1 13 | name: failing-pod -------------------------------------------------------------------------------- /app-a/ch13/limitrange/setup.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: d92 5 | --- 6 | apiVersion: v1 7 | kind: LimitRange 8 | metadata: 9 | name: cpu-limit-range 10 | namespace: d92 11 | spec: 12 | limits: 13 | - min: 14 | cpu: 200m 15 | max: 16 | cpu: 500m 17 | type: Container -------------------------------------------------------------------------------- /ch06/rbac/user/rolebinding.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1 2 | kind: RoleBinding 3 | metadata: 4 | name: read-only-binding 5 | roleRef: 6 | apiGroup: rbac.authorization.k8s.io 7 | kind: Role 8 | name: read-only 9 | subjects: 10 | - apiGroup: rbac.authorization.k8s.io 11 | kind: User 12 | name: bmuschko -------------------------------------------------------------------------------- /ch13/limitrange/nginx-with-resource-requirements.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx-with-resource-requirements 5 | spec: 6 | containers: 7 | - image: nginx:1.25.3 8 | name: nginx 9 | resources: 10 | requests: 11 | cpu: "50m" 12 | limits: 13 | cpu: "3" 14 | -------------------------------------------------------------------------------- /ch09/pod/env-vars/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: spring-boot-app 5 | spec: 6 | containers: 7 | - name: spring-boot-app 8 | image: springio/gs-spring-boot-docker 9 | env: 10 | - name: SPRING_PROFILES_ACTIVE 11 | value: dev 12 | - name: VERSION 13 | value: '1.5.3' 14 | -------------------------------------------------------------------------------- /ch08/kustomize/patching/security-context.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: nginx-deployment 5 | spec: 6 | template: 7 | spec: 8 | containers: 9 | - name: nginx 10 | securityContext: 11 | runAsUser: 1000 12 | runAsGroup: 3000 13 | fsGroup: 2000 -------------------------------------------------------------------------------- /ch13/limitrange/cpu-resource-constraint.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: LimitRange 3 | metadata: 4 | name: cpu-resource-constraint 5 | spec: 6 | limits: 7 | - type: Container 8 | defaultRequest: 9 | cpu: 200m 10 | default: 11 | cpu: 200m 12 | min: 13 | cpu: 100m 14 | max: 15 | cpu: "2" 16 | -------------------------------------------------------------------------------- /app-a/ch17/multi-port/service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: webapp-service 5 | spec: 6 | type: NodePort 7 | selector: 8 | app: webapp 9 | ports: 10 | - name: web 11 | port: 80 12 | targetPort: 80 13 | nodePort: 30080 14 | - name: metrics 15 | port: 9090 16 | targetPort: 9090 -------------------------------------------------------------------------------- /ch06/rbac/aggregation/clusterrole-delete-services.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1 2 | kind: ClusterRole 3 | metadata: 4 | name: delete-services 5 | namespace: rbac-example 6 | labels: 7 | rbac-service-delete: "true" 8 | rules: 9 | - apiGroups: 10 | - "" 11 | resources: 12 | - services 13 | verbs: 14 | - delete -------------------------------------------------------------------------------- /app-a/ch18/canary/blue-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: app-blue-svc 5 | namespace: production-apps 6 | labels: 7 | version: blue 8 | spec: 9 | selector: 10 | app: app-blue 11 | ports: 12 | - protocol: TCP 13 | port: 80 14 | targetPort: 80 15 | name: http 16 | type: ClusterIP -------------------------------------------------------------------------------- /ch06/rbac/serviceaccount/rolebinding.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1 2 | kind: RoleBinding 3 | metadata: 4 | name: serviceaccount-pod-rolebinding 5 | namespace: k97 6 | subjects: 7 | - kind: ServiceAccount 8 | name: sa-api 9 | roleRef: 10 | kind: Role 11 | name: list-pods-role 12 | apiGroup: rbac.authorization.k8s.io 13 | -------------------------------------------------------------------------------- /ch20/networkpolicy-api-allow.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | name: api-allow 5 | spec: 6 | podSelector: 7 | matchLabels: 8 | app: payment-processor 9 | role: api 10 | ingress: 11 | - from: 12 | - podSelector: 13 | matchLabels: 14 | app: coffee-shop 15 | -------------------------------------------------------------------------------- /app-a/ch09/pod-nginx/nginx-pod-envs.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx 5 | spec: 6 | containers: 7 | - name: nginx 8 | image: nginx:1.17.10 9 | ports: 10 | - containerPort: 80 11 | env: 12 | - name: DB_URL 13 | value: postgresql://mydb:5432 14 | - name: DB_USERNAME 15 | value: admin -------------------------------------------------------------------------------- /app-a/ch18/canary/green-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: app-green-svc 5 | namespace: production-apps 6 | labels: 7 | version: green 8 | spec: 9 | selector: 10 | app: app-green 11 | ports: 12 | - protocol: TCP 13 | port: 80 14 | targetPort: 80 15 | name: http 16 | type: ClusterIP -------------------------------------------------------------------------------- /ch08/kustomize/composition/web-app-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | labels: 5 | app: web-app-service 6 | name: web-app-service 7 | spec: 8 | ports: 9 | - name: web-app-port 10 | port: 3000 11 | protocol: TCP 12 | targetPort: 3000 13 | selector: 14 | app: web-app 15 | type: NodePort 16 | -------------------------------------------------------------------------------- /ch17/service-loadbalancer-type.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: echoserver 5 | spec: 6 | type: LoadBalancer 7 | clusterIP: 10.96.254.0 8 | loadBalancer: 10.109.76.157 9 | selector: 10 | app: echoserver 11 | ports: 12 | - port: 5005 13 | targetPort: 8080 14 | nodePort: 30158 15 | protocol: TCP -------------------------------------------------------------------------------- /ch03/object-management/app-stack/mysql-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | labels: 5 | app: mysql-service 6 | name: mysql-service 7 | spec: 8 | ports: 9 | - name: mysql-port 10 | port: 3306 11 | protocol: TCP 12 | targetPort: 3306 13 | selector: 14 | app: mysql-db 15 | type: ClusterIP 16 | 17 | -------------------------------------------------------------------------------- /ch03/object-management/app-stack/web-app-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | labels: 5 | app: web-app-service 6 | name: web-app-service 7 | spec: 8 | ports: 9 | - name: web-app-port 10 | port: 3000 11 | protocol: TCP 12 | targetPort: 3000 13 | selector: 14 | app: web-app 15 | type: NodePort 16 | -------------------------------------------------------------------------------- /ch08/kustomize/common-configuration/web-app-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | labels: 5 | app: web-app-service 6 | name: web-app-service 7 | spec: 8 | ports: 9 | - name: web-app-port 10 | port: 3000 11 | protocol: TCP 12 | targetPort: 3000 13 | selector: 14 | app: web-app 15 | type: NodePort 16 | -------------------------------------------------------------------------------- /ch09/pod/hazelcast-pod/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: hazelcast 5 | labels: 6 | app: hazelcast 7 | env: prod 8 | spec: 9 | containers: 10 | - name: hazelcast 11 | image: hazelcast/hazelcast:5.1.7 12 | env: 13 | - name: DNS_DOMAIN 14 | value: cluster 15 | ports: 16 | - containerPort: 5701 -------------------------------------------------------------------------------- /ch15/pod-with-volume-readonly.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: business-app 5 | spec: 6 | volumes: 7 | - name: shared-data 8 | emptyDir: {} 9 | containers: 10 | - name: nginx 11 | image: nginx:1.27.1 12 | volumeMounts: 13 | - name: shared-data 14 | mountPath: /usr/share/nginx/html 15 | readOnly: true -------------------------------------------------------------------------------- /app-a/ch13/limitrange/pod-with-more-cpu-resource-requirements.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: pod-with-more-cpu-resource-requirements 5 | namespace: d92 6 | spec: 7 | containers: 8 | - image: nginx:1.23.4-alpine 9 | name: nginx 10 | resources: 11 | requests: 12 | cpu: 400m 13 | limits: 14 | cpu: 1.5 -------------------------------------------------------------------------------- /ch10/configmap/pod-volume.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: backend 5 | spec: 6 | containers: 7 | - image: bmuschko/web-app:1.0.1 8 | name: backend 9 | volumeMounts: 10 | - name: db-config-volume 11 | mountPath: /etc/config 12 | volumes: 13 | - name: db-config-volume 14 | configMap: 15 | name: db-config -------------------------------------------------------------------------------- /ch13/resourcequota/nginx-pod1.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx1 5 | namespace: team-awesome 6 | spec: 7 | containers: 8 | - image: nginx:1.25.3 9 | name: nginx 10 | resources: 11 | requests: 12 | cpu: "0.5" 13 | memory: "512Mi" 14 | limits: 15 | cpu: "1" 16 | memory: "1024Mi" -------------------------------------------------------------------------------- /ch13/resourcequota/nginx-pod2.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: nginx2 5 | namespace: team-awesome 6 | spec: 7 | containers: 8 | - image: nginx:1.25.3 9 | name: nginx 10 | resources: 11 | requests: 12 | cpu: "0.5" 13 | memory: "512Mi" 14 | limits: 15 | cpu: "1" 16 | memory: "1024Mi" -------------------------------------------------------------------------------- /app-a/ch13/limitrange/pod-with-less-cpu-resource-requirements.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: pod-with-less-cpu-resource-requirements 5 | namespace: d92 6 | spec: 7 | containers: 8 | - image: nginx:1.23.4-alpine 9 | name: nginx 10 | resources: 11 | requests: 12 | cpu: 350m 13 | limits: 14 | cpu: 400m -------------------------------------------------------------------------------- /app-a/ch10/secret/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | labels: 5 | run: backend 6 | name: backend 7 | spec: 8 | containers: 9 | - image: nginx:1.23.4-alpine 10 | name: backend 11 | env: 12 | - name: DB_PASSWORD 13 | valueFrom: 14 | secretKeyRef: 15 | name: db-credentials 16 | key: db-password -------------------------------------------------------------------------------- /ch10/secret/pod-volume.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: backend 5 | spec: 6 | containers: 7 | - image: bmuschko/web-app:1.0.1 8 | name: backend 9 | volumeMounts: 10 | - name: ssh-volume 11 | mountPath: /var/app 12 | readOnly: true 13 | volumes: 14 | - name: ssh-volume 15 | secret: 16 | secretName: secret-ssh-auth -------------------------------------------------------------------------------- /app-a/ch19/cross-namespace-gateway/gateway.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1 2 | kind: Gateway 3 | metadata: 4 | name: gateway 5 | namespace: production 6 | spec: 7 | gatewayClassName: nginx 8 | listeners: 9 | - name: http 10 | port: 80 11 | protocol: HTTP 12 | hostname: example.com 13 | allowedRoutes: 14 | namespaces: 15 | from: All -------------------------------------------------------------------------------- /ch06/rbac/user/role.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1 2 | kind: Role 3 | metadata: 4 | name: read-only 5 | rules: 6 | - apiGroups: 7 | - "" 8 | resources: 9 | - pods 10 | - services 11 | verbs: 12 | - list 13 | - get 14 | - watch 15 | - apiGroups: 16 | - apps 17 | resources: 18 | - deployments 19 | verbs: 20 | - list 21 | - get 22 | - watch -------------------------------------------------------------------------------- /ch07/argo-cd/nginx-application.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: argoproj.io/v1alpha1 2 | kind: Application 3 | metadata: 4 | name: nginx 5 | spec: 6 | project: default 7 | source: 8 | repoURL: https://github.com/bmuschko/cka-study-guide.git 9 | targetRevision: HEAD 10 | path: ./ch07/nginx 11 | destination: 12 | server: https://kubernetes.default.svc 13 | namespace: default -------------------------------------------------------------------------------- /app-a/ch10/configmap/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | labels: 5 | run: backend 6 | name: backend 7 | spec: 8 | containers: 9 | - image: nginx:1.23.4-alpine 10 | name: backend 11 | volumeMounts: 12 | - name: config-volume 13 | mountPath: /etc/config 14 | volumes: 15 | - name: config-volume 16 | configMap: 17 | name: app-config -------------------------------------------------------------------------------- /ch21/pods-containers/create-container-config-error.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: misbehaving-pod 5 | spec: 6 | containers: 7 | - name: app 8 | image: busybox:1.36.1 9 | command: ["/bin/sh", "-c", "env"] 10 | env: 11 | - name: MY_KEY 12 | valueFrom: 13 | configMapKeyRef: 14 | name: my-config 15 | key: my.key -------------------------------------------------------------------------------- /ch06/rbac/aggregation/clusterrole-pods-services-aggregation-rules.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: rbac.authorization.k8s.io/v1 2 | kind: ClusterRole 3 | metadata: 4 | name: pods-services-aggregation-rules 5 | namespace: rbac-example 6 | aggregationRule: 7 | clusterRoleSelectors: 8 | - matchLabels: 9 | rbac-pod-list: "true" 10 | - matchLabels: 11 | rbac-service-delete: "true" 12 | rules: [] -------------------------------------------------------------------------------- /ch20/networkpolicy-port-allow.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | name: port-allow 5 | namespace: internal-tools 6 | spec: 7 | podSelector: 8 | matchLabels: 9 | app: api 10 | ingress: 11 | - from: 12 | - podSelector: 13 | matchLabels: 14 | app: consumer 15 | ports: 16 | - protocol: TCP 17 | port: 80 -------------------------------------------------------------------------------- /app-a/ch11/deployment/nginx-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: nginx 5 | labels: 6 | tier: backend 7 | spec: 8 | replicas: 3 9 | selector: 10 | matchLabels: 11 | app: v1 12 | template: 13 | metadata: 14 | labels: 15 | app: v1 16 | spec: 17 | containers: 18 | - image: nginx:1.23.0 19 | name: nginx -------------------------------------------------------------------------------- /ch03/object-management/app-stack/mysql-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | labels: 5 | app: mysql-db 6 | name: mysql-db 7 | spec: 8 | containers: 9 | - image: mysql:5.6 10 | name: mysql-db 11 | env: 12 | - name: MYSQL_ROOT_PASSWORD 13 | value: password 14 | ports: 15 | - containerPort: 3306 16 | protocol: TCP 17 | restartPolicy: Always 18 | -------------------------------------------------------------------------------- /ch21/pods-containers/missing-secret.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: secret-pod 5 | spec: 6 | containers: 7 | - name: test-container 8 | image: busybox:1.36.1 9 | command: ["/bin/sh", "-c", "env"] 10 | volumeMounts: 11 | - mountPath: /tmp/secret 12 | name: mysecret 13 | volumes: 14 | - name: mysecret 15 | secret: 16 | secretName: mysecret -------------------------------------------------------------------------------- /app-a/ch19/cross-namespace-gateway/reference-grant.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1beta1 2 | kind: ReferenceGrant 3 | metadata: 4 | name: allow-staging-to-gateway 5 | namespace: production 6 | spec: 7 | from: 8 | - group: gateway.networking.k8s.io 9 | kind: HTTPRoute 10 | namespace: staging 11 | to: 12 | - group: gateway.networking.k8s.io 13 | kind: Gateway 14 | name: gateway -------------------------------------------------------------------------------- /app-a/ch09/pod-command/pod-date.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | creationTimestamp: null 5 | labels: 6 | run: loop 7 | name: loop 8 | spec: 9 | containers: 10 | - args: 11 | - /bin/sh 12 | - -c 13 | - while true; do date; sleep 10; done 14 | image: busybox 15 | name: loop 16 | resources: {} 17 | dnsPolicy: ClusterFirst 18 | restartPolicy: Never 19 | status: {} -------------------------------------------------------------------------------- /app-a/ch21/troubleshooting-pod/setup.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: date-recorder 5 | spec: 6 | containers: 7 | - name: debian 8 | image: gcr.io/distroless/nodejs20-debian11 9 | command: ["/nodejs/bin/node", "-e", "const fs = require('fs'); let timestamp = Date.now(); fs.writeFile('/root/tmp/startup-marker.txt', timestamp.toString(), err => { if (err) { console.error(err); } while(true) {} });"] -------------------------------------------------------------------------------- /ch07/nginx/nginx-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: nginx 5 | spec: 6 | replicas: 3 7 | selector: 8 | matchLabels: 9 | app: nginx 10 | template: 11 | metadata: 12 | labels: 13 | app: nginx 14 | spec: 15 | containers: 16 | - image: nginx:1.25.3-alpine 17 | name: nginx 18 | ports: 19 | - containerPort: 80 -------------------------------------------------------------------------------- /app-a/ch21/stress-test/stress-1-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: stress-1 5 | namespace: stress-test 6 | spec: 7 | containers: 8 | - image: polinux/stress:1.0.4 9 | name: consumer 10 | args: [/bin/sh, -c, 'stress --vm 1 --vm-bytes $(shuf -i 20-200 -n 1)M --vm-hang 1'] 11 | resources: 12 | limits: 13 | memory: "250Mi" 14 | requests: 15 | memory: "250Mi" -------------------------------------------------------------------------------- /app-a/ch21/stress-test/stress-2-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: stress-2 5 | namespace: stress-test 6 | spec: 7 | containers: 8 | - image: polinux/stress:1.0.4 9 | name: consumer 10 | args: [/bin/sh, -c, 'stress --vm 1 --vm-bytes $(shuf -i 20-200 -n 1)M --vm-hang 1'] 11 | resources: 12 | limits: 13 | memory: "250Mi" 14 | requests: 15 | memory: "250Mi" -------------------------------------------------------------------------------- /app-a/ch21/stress-test/stress-3-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: stress-3 5 | namespace: stress-test 6 | spec: 7 | containers: 8 | - image: polinux/stress:1.0.4 9 | name: consumer 10 | args: [/bin/sh, -c, 'stress --vm 1 --vm-bytes $(shuf -i 20-200 -n 1)M --vm-hang 1'] 11 | resources: 12 | limits: 13 | memory: "250Mi" 14 | requests: 15 | memory: "250Mi" -------------------------------------------------------------------------------- /ch11/deployment/app-cache-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: app-cache 5 | labels: 6 | app: app-cache 7 | spec: 8 | replicas: 4 9 | selector: 10 | matchLabels: 11 | app: app-cache 12 | template: 13 | metadata: 14 | labels: 15 | app: app-cache 16 | spec: 17 | containers: 18 | - name: memcached 19 | image: memcached:1.6.8 -------------------------------------------------------------------------------- /app-a/ch12/manual-scaling/hello-world-deployment-replicas-3.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: hello-world 5 | spec: 6 | replicas: 3 7 | selector: 8 | matchLabels: 9 | run: hello-world 10 | template: 11 | metadata: 12 | labels: 13 | run: hello-world 14 | spec: 15 | containers: 16 | - image: bmuschko/nodejs-hello-world:1.0.0 17 | name: hello-world -------------------------------------------------------------------------------- /app-a/ch12/manual-scaling/hello-world-deployment-replicas-8.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: hello-world 5 | spec: 6 | replicas: 8 7 | selector: 8 | matchLabels: 9 | run: hello-world 10 | template: 11 | metadata: 12 | labels: 13 | run: hello-world 14 | spec: 15 | containers: 16 | - image: bmuschko/nodejs-hello-world:1.0.0 17 | name: hello-world -------------------------------------------------------------------------------- /app-a/ch22/troubleshooting-control-plane-node/setup.sh: -------------------------------------------------------------------------------- 1 | # On the control-plane node, corrupt the scheduler manifest: 2 | sudo mv /etc/kubernetes/manifests/kube-scheduler.yaml /etc/kubernetes/manifests/kube-scheduler.yaml.backup 3 | sudo bash -c 'cat /etc/kubernetes/manifests/kube-scheduler.yaml.backup | sed "s/image: registry.k8s.io\/kube-scheduler:.*/image: registry.k8s.io\/kube-scheduler:v1.99.0/" > /etc/kubernetes/manifests/kube-scheduler.yaml' -------------------------------------------------------------------------------- /ch12/hpa/app-cache-hpa-cpu.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: autoscaling/v2 2 | kind: HorizontalPodAutoscaler 3 | metadata: 4 | name: app-cache 5 | spec: 6 | scaleTargetRef: 7 | apiVersion: apps/v1 8 | kind: Deployment 9 | name: app-cache 10 | minReplicas: 3 11 | maxReplicas: 5 12 | metrics: 13 | - resource: 14 | name: cpu 15 | target: 16 | averageUtilization: 80 17 | type: Utilization 18 | type: Resource -------------------------------------------------------------------------------- /app-a/ch09/pod-command/pod-welcome.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | creationTimestamp: null 5 | labels: 6 | run: loop 7 | name: loop 8 | spec: 9 | containers: 10 | - args: 11 | - /bin/sh 12 | - -c 13 | - for i in 1 2 3 4 5 6 7 8 9 10; do echo "Welcome $i times"; done 14 | image: busybox 15 | name: loop 16 | resources: {} 17 | dnsPolicy: ClusterFirst 18 | restartPolicy: Never 19 | status: {} 20 | -------------------------------------------------------------------------------- /app-a/ch18/multiple-paths/api-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: api 5 | namespace: webapp 6 | spec: 7 | replicas: 2 8 | selector: 9 | matchLabels: 10 | app: api 11 | template: 12 | metadata: 13 | labels: 14 | app: api 15 | spec: 16 | containers: 17 | - name: api 18 | image: httpd:2.4.65-alpine 19 | ports: 20 | - containerPort: 80 -------------------------------------------------------------------------------- /ch03/object-management/web-app/web-app-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | labels: 5 | app: web-app 6 | name: web-app 7 | spec: 8 | containers: 9 | - image: bmuschko/web-app:1.0.1 10 | name: web-app 11 | envFrom: 12 | - configMapRef: 13 | name: db-config 14 | - secretRef: 15 | name: db-creds 16 | ports: 17 | - containerPort: 3000 18 | protocol: TCP 19 | restartPolicy: Always 20 | -------------------------------------------------------------------------------- /ch15/pod-with-volume.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: business-app 5 | spec: 6 | volumes: 7 | - name: shared-data 8 | emptyDir: {} 9 | containers: 10 | - name: nginx 11 | image: nginx:1.27.1 12 | volumeMounts: 13 | - name: shared-data 14 | mountPath: /usr/share/nginx/html 15 | - name: sidecar 16 | image: busybox:1.37.0 17 | volumeMounts: 18 | - name: shared-data 19 | mountPath: /data -------------------------------------------------------------------------------- /app-a/ch20/cross-namespace-control/beta-app-policy.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | name: beta-app-policy 5 | namespace: team-beta 6 | spec: 7 | podSelector: 8 | matchLabels: 9 | app: beta-app 10 | policyTypes: 11 | - Ingress 12 | ingress: 13 | - from: 14 | - namespaceSelector: 15 | matchLabels: 16 | team: alpha 17 | ports: 18 | - protocol: TCP 19 | port: 80 -------------------------------------------------------------------------------- /app-a/ch20/database-access-control/database-policy.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | name: database-policy 5 | namespace: production 6 | spec: 7 | podSelector: 8 | matchLabels: 9 | tier: database 10 | policyTypes: 11 | - Ingress 12 | ingress: 13 | - from: 14 | - podSelector: 15 | matchLabels: 16 | tier: backend 17 | ports: 18 | - protocol: TCP 19 | port: 6379 -------------------------------------------------------------------------------- /ch08/kustomize/generating-resources/web-app-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | labels: 5 | app: web-app 6 | name: web-app 7 | spec: 8 | containers: 9 | - image: bmuschko/web-app:1.0.1 10 | name: web-app 11 | envFrom: 12 | - configMapRef: 13 | name: db-config 14 | - secretRef: 15 | name: db-creds 16 | ports: 17 | - containerPort: 3000 18 | protocol: TCP 19 | restartPolicy: Always 20 | -------------------------------------------------------------------------------- /ch14/nodeaffinity/pod-node-affinity.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app 5 | spec: 6 | affinity: 7 | nodeAffinity: 8 | requiredDuringSchedulingIgnoredDuringExecution: 9 | nodeSelectorTerms: 10 | - matchExpressions: 11 | - key: disk 12 | operator: In 13 | values: 14 | - ssd 15 | - hdd 16 | containers: 17 | - name: nginx 18 | image: nginx:1.27.1 -------------------------------------------------------------------------------- /ch14/nodeaffinity/pod-node-anti-affinity.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app 5 | spec: 6 | affinity: 7 | nodeAffinity: 8 | requiredDuringSchedulingIgnoredDuringExecution: 9 | nodeSelectorTerms: 10 | - matchExpressions: 11 | - key: disk 12 | operator: NotIn 13 | values: 14 | - ssd 15 | - ebs 16 | containers: 17 | - name: nginx 18 | image: nginx:1.27.1 -------------------------------------------------------------------------------- /ch16/static-provisioning/app-consuming-pvc.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app-consuming-pvc 5 | spec: 6 | volumes: 7 | - name: app-storage 8 | persistentVolumeClaim: 9 | claimName: db-pvc 10 | containers: 11 | - image: alpine:3.18.2 12 | name: app 13 | command: ["/bin/sh"] 14 | args: ["-c", "while true; do sleep 60; done;"] 15 | volumeMounts: 16 | - mountPath: "/mnt/data" 17 | name: app-storage 18 | -------------------------------------------------------------------------------- /app-a/ch14/nodeselector-affinity/pod-node-affinity.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app 5 | spec: 6 | containers: 7 | - image: nginx:1.27.1 8 | name: nginx 9 | affinity: 10 | nodeAffinity: 11 | requiredDuringSchedulingIgnoredDuringExecution: 12 | nodeSelectorTerms: 13 | - matchExpressions: 14 | - key: color 15 | operator: In 16 | values: 17 | - green 18 | - red -------------------------------------------------------------------------------- /app-a/ch17/multi-port/deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: webapp 5 | spec: 6 | replicas: 3 7 | selector: 8 | matchLabels: 9 | app: webapp 10 | template: 11 | metadata: 12 | labels: 13 | app: webapp 14 | spec: 15 | containers: 16 | - name: webapp 17 | image: nginxdemos/hello:0.4-plain-text 18 | ports: 19 | - containerPort: 80 20 | - containerPort: 9090 -------------------------------------------------------------------------------- /app-a/ch18/multiple-paths/frontend-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: frontend 5 | namespace: webapp 6 | spec: 7 | replicas: 2 8 | selector: 9 | matchLabels: 10 | app: frontend 11 | template: 12 | metadata: 13 | labels: 14 | app: frontend 15 | spec: 16 | containers: 17 | - name: frontend 18 | image: nginx:1.29.1-alpine 19 | ports: 20 | - containerPort: 80 -------------------------------------------------------------------------------- /ch03/object-management/nginx-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: nginx-deployment 5 | labels: 6 | app: nginx 7 | spec: 8 | replicas: 3 9 | selector: 10 | matchLabels: 11 | app: nginx 12 | template: 13 | metadata: 14 | labels: 15 | app: nginx 16 | spec: 17 | containers: 18 | - name: nginx 19 | image: nginx:1.14.2 20 | ports: 21 | - containerPort: 80 22 | -------------------------------------------------------------------------------- /ch08/kustomize/patching/nginx-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: nginx-deployment 5 | labels: 6 | app: nginx 7 | spec: 8 | replicas: 3 9 | selector: 10 | matchLabels: 11 | app: nginx 12 | template: 13 | metadata: 14 | labels: 15 | app: nginx 16 | spec: 17 | containers: 18 | - name: nginx 19 | image: nginx:1.14.2 20 | ports: 21 | - containerPort: 80 22 | -------------------------------------------------------------------------------- /app-a/ch11/misconfigured-deployment/fix-me-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: nginx-deployment 5 | labels: 6 | app: nginx 7 | spec: 8 | replicas: 3 9 | selector: 10 | matchLabels: 11 | run: server 12 | template: 13 | metadata: 14 | labels: 15 | app: nginx 16 | spec: 17 | containers: 18 | - name: nginx 19 | image: nginx:1.14.2 20 | ports: 21 | - containerPort: 80 -------------------------------------------------------------------------------- /app-a/ch11/misconfigured-deployment/fixed-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: nginx-deployment 5 | labels: 6 | app: nginx 7 | spec: 8 | replicas: 3 9 | selector: 10 | matchLabels: 11 | run: server 12 | template: 13 | metadata: 14 | labels: 15 | run: server 16 | spec: 17 | containers: 18 | - name: nginx 19 | image: nginx:1.14.2 20 | ports: 21 | - containerPort: 80 -------------------------------------------------------------------------------- /ch03/object-management/app-stack/web-app-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | labels: 5 | app: web-app 6 | name: web-app 7 | spec: 8 | containers: 9 | - image: bmuschko/web-app:1.0.1 10 | name: web-app 11 | env: 12 | - name: DB_HOST 13 | value: mysql-service 14 | - name: DB_USER 15 | value: root 16 | - name: DB_PASSWORD 17 | value: password 18 | ports: 19 | - containerPort: 3000 20 | protocol: TCP 21 | restartPolicy: Always 22 | -------------------------------------------------------------------------------- /ch19/httproute.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1 2 | kind: HTTPRoute 3 | metadata: 4 | name: hello-world-httproute 5 | spec: 6 | parentRefs: 7 | - name: hello-world-gateway 8 | hostnames: 9 | - "hello-world.exposed" 10 | rules: 11 | - backendRefs: 12 | - group: "" 13 | kind: Service 14 | name: web 15 | port: 3000 16 | weight: 1 17 | matches: 18 | - path: 19 | type: PathPrefix 20 | value: / 21 | -------------------------------------------------------------------------------- /app-a/ch17/service-discovery/frontend-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: frontend 5 | spec: 6 | replicas: 2 7 | selector: 8 | matchLabels: 9 | app: frontend 10 | template: 11 | metadata: 12 | labels: 13 | app: frontend 14 | spec: 15 | containers: 16 | - name: frontend 17 | image: busybox:1.35 18 | command: 19 | - sh 20 | - -c 21 | - "while true; do nc -zv database-service 3306; sleep 5; done" -------------------------------------------------------------------------------- /app-a/ch18/canary/blue-ingress.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: Ingress 3 | metadata: 4 | name: app-main 5 | namespace: production-apps 6 | annotations: 7 | nginx.ingress.kubernetes.io/rewrite-target: / 8 | spec: 9 | ingressClassName: nginx 10 | rules: 11 | - host: app.production.com 12 | http: 13 | paths: 14 | - path: / 15 | pathType: Prefix 16 | backend: 17 | service: 18 | name: app-blue-svc 19 | port: 20 | number: 80 -------------------------------------------------------------------------------- /ch13/resource-requirements/pod-rate-limiter-resource-limits.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: rate-limiter 5 | spec: 6 | containers: 7 | - name: business-app 8 | image: bmuschko/nodejs-business-app:1.0.0 9 | ports: 10 | - containerPort: 8080 11 | resources: 12 | limits: 13 | memory: "256Mi" 14 | - name: ambassador 15 | image: bmuschko/nodejs-ambassador:1.0.0 16 | ports: 17 | - containerPort: 8081 18 | resources: 19 | limits: 20 | memory: "64Mi" -------------------------------------------------------------------------------- /app-a/ch12/auto-scaling/nginx-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: nginx 5 | spec: 6 | replicas: 1 7 | selector: 8 | matchLabels: 9 | app: nginx 10 | template: 11 | metadata: 12 | labels: 13 | app: nginx 14 | spec: 15 | containers: 16 | - image: nginx:1.23.4 17 | name: nginx 18 | resources: 19 | requests: 20 | cpu: "0.5" 21 | memory: "500Mi" 22 | limits: 23 | memory: "500Mi" -------------------------------------------------------------------------------- /app-a/ch16/dynamic-provisioning/alpine-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: app-consuming-pvc 5 | namespace: persistence 6 | spec: 7 | volumes: 8 | - name: app-storage 9 | persistentVolumeClaim: 10 | claimName: db-pvc 11 | containers: 12 | - image: alpine:3.21.3 13 | name: app 14 | command: ["/bin/sh"] 15 | args: ["-c", "while true; do sleep 60; done;"] 16 | volumeMounts: 17 | - mountPath: "/mnt/data" 18 | name: app-storage 19 | restartPolicy: Never 20 | -------------------------------------------------------------------------------- /app-a/ch16/static-provisioning/nginx-pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | creationTimestamp: null 5 | labels: 6 | run: nginx 7 | name: nginx 8 | spec: 9 | volumes: 10 | - name: logs-volume 11 | persistentVolumeClaim: 12 | claimName: logs-pvc 13 | containers: 14 | - image: nginx:1.25.1 15 | name: nginx 16 | volumeMounts: 17 | - mountPath: "/var/log/nginx" 18 | name: logs-volume 19 | resources: {} 20 | dnsPolicy: ClusterFirst 21 | restartPolicy: Never 22 | status: {} 23 | -------------------------------------------------------------------------------- /app-a/ch19/basic-gateway/httproute.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1 2 | kind: HTTPRoute 3 | metadata: 4 | name: app-routes 5 | spec: 6 | parentRefs: 7 | - name: main-gateway 8 | hostnames: 9 | - example.local 10 | rules: 11 | - matches: 12 | - path: 13 | type: PathPrefix 14 | value: /web 15 | backendRefs: 16 | - name: web-app 17 | port: 80 18 | - matches: 19 | - path: 20 | type: PathPrefix 21 | value: /api 22 | backendRefs: 23 | - name: api-app 24 | port: 80 -------------------------------------------------------------------------------- /ch12/hpa/app-cache-deployment-cpu-resources.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: app-cache 5 | labels: 6 | app: app-cache 7 | spec: 8 | replicas: 4 9 | selector: 10 | matchLabels: 11 | app: app-cache 12 | template: 13 | metadata: 14 | labels: 15 | app: app-cache 16 | spec: 17 | containers: 18 | - name: memcached 19 | image: memcached:1.6.8 20 | resources: 21 | requests: 22 | cpu: 250m 23 | limits: 24 | cpu: 500m -------------------------------------------------------------------------------- /app-a/ch20/cross-namespace-control/alpha-app-policy.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | name: alpha-app-policy 5 | namespace: team-alpha 6 | spec: 7 | podSelector: 8 | matchLabels: 9 | app: alpha-app 10 | policyTypes: 11 | - Egress 12 | egress: 13 | # To team-beta namespace 14 | - to: 15 | - namespaceSelector: 16 | matchLabels: 17 | team: beta 18 | # Allow DNS 19 | - to: 20 | ports: 21 | - protocol: UDP 22 | port: 53 23 | - protocol: TCP 24 | port: 53 -------------------------------------------------------------------------------- /ch16/config-options/pv-node-affinity.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: PersistentVolume 3 | metadata: 4 | name: local-pv 5 | spec: 6 | capacity: 7 | storage: 10Gi 8 | accessModes: 9 | - ReadWriteOnce 10 | persistentVolumeReclaimPolicy: Retain 11 | storageClassName: local-storage 12 | local: 13 | path: /mnt/data 14 | nodeAffinity: 15 | required: 16 | nodeSelectorTerms: 17 | - matchExpressions: 18 | - key: kubernetes.io/hostname 19 | operator: In 20 | values: 21 | - node01 22 | - node02 -------------------------------------------------------------------------------- /app-a/ch05/etcd-backup-restore/worker.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | NODE=$1 4 | NODE_HOST_IP="192.168.56.$((20+$NODE))" 5 | 6 | $(cat /vagrant/kubeadm-init.out | grep -A 2 "kubeadm join" | sed -e 's/^[ \t]*//' | tr '\n' ' ' | sed -e 's/ \\ / /g') 7 | 8 | systemctl daemon-reload 9 | echo "KUBELET_EXTRA_ARGS=--node-ip=$NODE_HOST_IP --cgroup-driver=systemd" > /etc/default/kubelet 10 | systemctl restart kubelet 11 | 12 | cp /vagrant/admin.conf /etc/kubernetes/admin.conf 13 | chmod ugo+r /etc/kubernetes/admin.conf 14 | echo "KUBECONFIG=/etc/kubernetes/admin.conf" >> /etc/environment -------------------------------------------------------------------------------- /app-a/ch06/rbac-aggregation/worker.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | NODE=$1 4 | NODE_HOST_IP="192.168.56.$((20+$NODE))" 5 | 6 | $(cat /vagrant/kubeadm-init.out | grep -A 2 "kubeadm join" | sed -e 's/^[ \t]*//' | tr '\n' ' ' | sed -e 's/ \\ / /g') 7 | 8 | systemctl daemon-reload 9 | echo "KUBELET_EXTRA_ARGS=--node-ip=$NODE_HOST_IP --cgroup-driver=systemd" > /etc/default/kubelet 10 | systemctl restart kubelet 11 | 12 | cp /vagrant/admin.conf /etc/kubernetes/admin.conf 13 | chmod ugo+r /etc/kubernetes/admin.conf 14 | echo "KUBECONFIG=/etc/kubernetes/admin.conf" >> /etc/environment -------------------------------------------------------------------------------- /app-a/ch04/upgrade-cluster-version/worker.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | NODE=$1 4 | NODE_HOST_IP="192.168.56.$((20+$NODE))" 5 | 6 | $(cat /vagrant/kubeadm-init.out | grep -A 2 "kubeadm join" | sed -e 's/^[ \t]*//' | tr '\n' ' ' | sed -e 's/ \\ / /g') 7 | 8 | systemctl daemon-reload 9 | echo "KUBELET_EXTRA_ARGS=--node-ip=$NODE_HOST_IP --cgroup-driver=systemd" > /etc/default/kubelet 10 | systemctl restart kubelet 11 | 12 | cp /vagrant/admin.conf /etc/kubernetes/admin.conf 13 | chmod ugo+r /etc/kubernetes/admin.conf 14 | echo "KUBECONFIG=/etc/kubernetes/admin.conf" >> /etc/environment -------------------------------------------------------------------------------- /ch13/resource-requirements/pod-rate-limiter-resource-requests.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: rate-limiter 5 | spec: 6 | containers: 7 | - name: business-app 8 | image: bmuschko/nodejs-business-app:1.0.0 9 | ports: 10 | - containerPort: 8080 11 | resources: 12 | requests: 13 | memory: "256Mi" 14 | cpu: "1" 15 | - name: ambassador 16 | image: bmuschko/nodejs-ambassador:1.0.0 17 | ports: 18 | - containerPort: 8081 19 | resources: 20 | requests: 21 | memory: "64Mi" 22 | cpu: "250m" -------------------------------------------------------------------------------- /app-a/ch21/troubleshooting-pod/setup-fixed.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: date-recorder 5 | spec: 6 | containers: 7 | - name: debian 8 | image: gcr.io/distroless/nodejs20-debian11 9 | command: ["/nodejs/bin/node", "-e", "const fs = require('fs'); let timestamp = Date.now(); fs.writeFile('/var/startup/startup-marker.txt', timestamp.toString(), err => { if (err) { console.error(err); } while(true) {} });"] 10 | volumeMounts: 11 | - mountPath: /var/startup 12 | name: init-volume 13 | volumes: 14 | - name: init-volume 15 | emptyDir: {} -------------------------------------------------------------------------------- /app-a/ch12/auto-scaling/nginx-hpa.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: autoscaling/v2 2 | kind: HorizontalPodAutoscaler 3 | metadata: 4 | name: nginx-hpa 5 | spec: 6 | scaleTargetRef: 7 | apiVersion: apps/v1 8 | kind: Deployment 9 | name: nginx 10 | minReplicas: 3 11 | maxReplicas: 8 12 | metrics: 13 | - type: Resource 14 | resource: 15 | name: cpu 16 | target: 17 | type: Utilization 18 | averageUtilization: 75 19 | - type: Resource 20 | resource: 21 | name: memory 22 | target: 23 | type: Utilization 24 | averageUtilization: 60 -------------------------------------------------------------------------------- /ch12/hpa/app-cache-hpa-cpu-memory.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: autoscaling/v2 2 | kind: HorizontalPodAutoscaler 3 | metadata: 4 | name: app-cache 5 | spec: 6 | scaleTargetRef: 7 | apiVersion: apps/v1 8 | kind: Deployment 9 | name: app-cache 10 | minReplicas: 3 11 | maxReplicas: 5 12 | metrics: 13 | - type: Resource 14 | resource: 15 | name: cpu 16 | target: 17 | type: Utilization 18 | averageUtilization: 80 19 | - type: Resource 20 | resource: 21 | name: memory 22 | target: 23 | type: AverageValue 24 | averageValue: 500Mi -------------------------------------------------------------------------------- /app-a/ch17/service-discovery/database-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: database 5 | spec: 6 | replicas: 1 7 | selector: 8 | matchLabels: 9 | app: database 10 | template: 11 | metadata: 12 | labels: 13 | app: database 14 | spec: 15 | containers: 16 | - name: mysql 17 | image: mysql:9.4.0 18 | env: 19 | - name: MYSQL_ROOT_PASSWORD 20 | value: secretpass 21 | - name: MYSQL_DATABASE 22 | value: myapp 23 | ports: 24 | - containerPort: 3306 -------------------------------------------------------------------------------- /app-a/ch13/resource-requirements/pod.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: hello 5 | spec: 6 | containers: 7 | - image: bmuschko/nodejs-hello-world:1.0.0 8 | name: hello 9 | ports: 10 | - name: nodejs-port 11 | containerPort: 3000 12 | volumeMounts: 13 | - name: log-volume 14 | mountPath: "/var/log" 15 | resources: 16 | requests: 17 | cpu: 100m 18 | memory: 500Mi 19 | ephemeral-storage: 1Gi 20 | limits: 21 | memory: 500Mi 22 | ephemeral-storage: 2Gi 23 | volumes: 24 | - name: log-volume 25 | emptyDir: {} -------------------------------------------------------------------------------- /ch12/hpa/app-cache-deployment-cpu-memory-resources.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: app-cache 5 | labels: 6 | app: app-cache 7 | spec: 8 | replicas: 4 9 | selector: 10 | matchLabels: 11 | app: app-cache 12 | template: 13 | metadata: 14 | labels: 15 | app: app-cache 16 | spec: 17 | containers: 18 | - name: memcached 19 | image: memcached:1.6.8 20 | resources: 21 | requests: 22 | cpu: 250m 23 | memory: 100Mi 24 | limits: 25 | cpu: 500m 26 | memory: 500Mi -------------------------------------------------------------------------------- /app-a/ch15/multi-container-alpine.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: alpine 5 | spec: 6 | volumes: 7 | - name: shared-vol 8 | emptyDir: {} 9 | containers: 10 | - args: 11 | - /bin/sh 12 | - -c 13 | - while true; do sleep 60; done; 14 | image: alpine:3.12.0 15 | name: container1 16 | volumeMounts: 17 | - name: shared-vol 18 | mountPath: /etc/a 19 | - args: 20 | - /bin/sh 21 | - -c 22 | - while true; do sleep 60; done; 23 | image: alpine:3.12.0 24 | name: container2 25 | volumeMounts: 26 | - name: shared-vol 27 | mountPath: /etc/b -------------------------------------------------------------------------------- /ch14/topology-spread-constraint/deployment-topology-spread-constraint.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: web 5 | spec: 6 | replicas: 6 7 | selector: 8 | matchLabels: 9 | app: web 10 | template: 11 | metadata: 12 | labels: 13 | app: web 14 | spec: 15 | topologySpreadConstraints: 16 | - maxSkew: 1 17 | topologyKey: topology.kubernetes.io/zone 18 | whenUnsatisfiable: DoNotSchedule 19 | labelSelector: 20 | matchLabels: 21 | app: web 22 | containers: 23 | - name: nginx 24 | image: nginx:1.27.1 -------------------------------------------------------------------------------- /app-a/ch18/canary/green-ingress.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: Ingress 3 | metadata: 4 | name: app-canary-weight 5 | namespace: production-apps 6 | annotations: 7 | nginx.ingress.kubernetes.io/rewrite-target: / 8 | nginx.ingress.kubernetes.io/canary: "true" 9 | nginx.ingress.kubernetes.io/canary-weight: "20" 10 | spec: 11 | ingressClassName: nginx 12 | rules: 13 | - host: app.production.com 14 | http: 15 | paths: 16 | - path: / 17 | pathType: Prefix 18 | backend: 19 | service: 20 | name: app-green-svc 21 | port: 22 | number: 80 -------------------------------------------------------------------------------- /ch13/resource-requirements/pod-rate-limiter-resource-requests-limits.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Pod 3 | metadata: 4 | name: rate-limiter 5 | spec: 6 | containers: 7 | - name: business-app 8 | image: bmuschko/nodejs-business-app:1.0.0 9 | ports: 10 | - containerPort: 8080 11 | resources: 12 | requests: 13 | memory: "256Mi" 14 | cpu: "1" 15 | limits: 16 | memory: "256Mi" 17 | - name: ambassador 18 | image: bmuschko/nodejs-ambassador:1.0.0 19 | ports: 20 | - containerPort: 8081 21 | resources: 22 | requests: 23 | memory: "64Mi" 24 | cpu: "250m" 25 | limits: 26 | memory: "64Mi" -------------------------------------------------------------------------------- /ch18/ingress.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: Ingress 3 | metadata: 4 | name: next-app 5 | annotations: 6 | nginx.ingress.kubernetes.io/rewrite-target: /$1 7 | spec: 8 | rules: 9 | - host: next.example.com 10 | http: 11 | paths: 12 | - backend: 13 | service: 14 | name: app-service 15 | port: 16 | number: 8080 17 | path: /app 18 | pathType: Exact 19 | - host: next.example.com 20 | http: 21 | paths: 22 | - backend: 23 | service: 24 | name: metrics-service 25 | port: 26 | number: 9090 27 | path: /metrics 28 | pathType: Exact -------------------------------------------------------------------------------- /ch08/kustomize/composition/web-app-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: web-app-deployment 5 | labels: 6 | app: web-app-deployment 7 | spec: 8 | replicas: 3 9 | selector: 10 | matchLabels: 11 | app: web-app 12 | template: 13 | metadata: 14 | labels: 15 | app: web-app 16 | spec: 17 | containers: 18 | - image: bmuschko/web-app:1.0.1 19 | name: web-app 20 | env: 21 | - name: DB_HOST 22 | value: mysql-service 23 | - name: DB_USER 24 | value: root 25 | - name: DB_PASSWORD 26 | value: password 27 | ports: 28 | - containerPort: 3000 29 | -------------------------------------------------------------------------------- /app-a/ch06/rbac-aggregation/setup.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # Create SSL cert 4 | mkdir cert && cd cert 5 | sudo openssl genrsa -out ellasmith.key 2048 6 | sudo openssl req -new -key ellasmith.key -out ellasmith.csr -subj "/CN=ellasmith/O=cka-study-guide" 7 | sudo openssl x509 -req -in ellasmith.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out ellasmith.crt -days 364 8 | 9 | # Create user and context 10 | sudo kubectl config set-credentials ellasmith --client-certificate=ellasmith.crt --client-key=ellasmith.key 11 | sudo kubectl config set-context ellasmith-context --cluster=kubernetes --user=ellasmith 12 | 13 | # Create namespace 14 | kubectl create namespace development -------------------------------------------------------------------------------- /ch08/kustomize/common-configuration/web-app-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: web-app-deployment 5 | labels: 6 | app: web-app-deployment 7 | spec: 8 | replicas: 3 9 | selector: 10 | matchLabels: 11 | app: web-app 12 | template: 13 | metadata: 14 | labels: 15 | app: web-app 16 | spec: 17 | containers: 18 | - image: bmuschko/web-app:1.0.1 19 | name: web-app 20 | env: 21 | - name: DB_HOST 22 | value: mysql-service 23 | - name: DB_USER 24 | value: root 25 | - name: DB_PASSWORD 26 | value: password 27 | ports: 28 | - containerPort: 3000 29 | -------------------------------------------------------------------------------- /app-a/ch19/cross-namespace-gateway/production-route.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1 2 | kind: HTTPRoute 3 | metadata: 4 | name: prod-route 5 | namespace: production 6 | spec: 7 | parentRefs: 8 | - name: gateway 9 | hostnames: 10 | - example.com 11 | rules: 12 | - matches: 13 | - path: 14 | type: Exact 15 | value: /app 16 | backendRefs: 17 | - name: prod-web 18 | port: 80 19 | filters: 20 | - type: URLRewrite 21 | urlRewrite: 22 | path: 23 | type: ReplaceFullPath 24 | replaceFullPath: / 25 | - type: RequestHeaderModifier 26 | requestHeaderModifier: 27 | set: 28 | - name: X-Environment 29 | value: production -------------------------------------------------------------------------------- /app-a/ch20/database-access-control/backend-policy.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: NetworkPolicy 3 | metadata: 4 | name: backend-policy 5 | namespace: production 6 | spec: 7 | podSelector: 8 | matchLabels: 9 | tier: backend 10 | policyTypes: 11 | - Ingress 12 | - Egress 13 | ingress: 14 | - from: 15 | - podSelector: 16 | matchLabels: 17 | tier: frontend 18 | ports: 19 | - protocol: TCP 20 | port: 80 21 | egress: 22 | - to: 23 | - podSelector: 24 | matchLabels: 25 | tier: database 26 | ports: 27 | - protocol: TCP 28 | port: 6379 29 | - to: 30 | ports: 31 | - protocol: UDP 32 | port: 53 33 | - protocol: TCP 34 | port: 53 -------------------------------------------------------------------------------- /app-a/ch18/canary/blue-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: app-blue 5 | namespace: production-apps 6 | labels: 7 | version: blue 8 | app: main-app 9 | spec: 10 | replicas: 3 11 | selector: 12 | matchLabels: 13 | app: app-blue 14 | version: v1.0 15 | template: 16 | metadata: 17 | labels: 18 | app: app-blue 19 | version: v1.0 20 | environment: production 21 | spec: 22 | containers: 23 | - name: app 24 | image: nginxdemos/hello:0.3-plain-text 25 | ports: 26 | - containerPort: 80 27 | env: 28 | - name: VERSION 29 | value: "v1.0-blue" 30 | - name: DEPLOYMENT 31 | value: "blue" -------------------------------------------------------------------------------- /app-a/ch07/backup-crd/backup-resource.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apiextensions.k8s.io/v1 2 | kind: CustomResourceDefinition 3 | metadata: 4 | name: backups.example.com 5 | spec: 6 | group: example.com 7 | versions: 8 | - name: v1 9 | served: true 10 | storage: true 11 | schema: 12 | openAPIV3Schema: 13 | type: object 14 | properties: 15 | spec: 16 | type: object 17 | properties: 18 | cronExpression: 19 | type: string 20 | podName: 21 | type: string 22 | path: 23 | type: string 24 | scope: Namespaced 25 | names: 26 | kind: Backup 27 | singular: backup 28 | plural: backups 29 | shortNames: 30 | - bu -------------------------------------------------------------------------------- /app-a/ch18/canary/green-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | name: app-green 5 | namespace: production-apps 6 | labels: 7 | version: green 8 | app: main-app 9 | spec: 10 | replicas: 3 11 | selector: 12 | matchLabels: 13 | app: app-green 14 | version: v2.0 15 | template: 16 | metadata: 17 | labels: 18 | app: app-green 19 | version: v2.0 20 | environment: production 21 | spec: 22 | containers: 23 | - name: app 24 | image: nginxdemos/hello:0.4-plain-text 25 | ports: 26 | - containerPort: 80 27 | env: 28 | - name: VERSION 29 | value: "v2.0-green" 30 | - name: DEPLOYMENT 31 | value: "green" -------------------------------------------------------------------------------- /app-a/ch05/etcd-backup-restore/etcdctl.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # Install etcdctl 4 | ETCD_VERSION="v3.5.16" 5 | 6 | ARCH=$(uname -m) 7 | if [ "$ARCH" == "x86_64" ]; then 8 | ARCH="amd64" 9 | elif [ "$ARCH" == "aarch64" ]; then 10 | ARCH="arm64" 11 | elif [ "$ARCH" == "armv7l" ]; then 12 | ARCH="arm" 13 | else 14 | echo "Unsupported architecture: $ARCH" 15 | exit 1 16 | fi 17 | 18 | wget https://github.com/etcd-io/etcd/releases/download/$ETCD_VERSION/etcd-$ETCD_VERSION-linux-$ARCH.tar.gz -O /tmp/etcd-$ETCD_VERSION-linux-$ARCH.tar.gz 19 | tar xvf /tmp/etcd-$ETCD_VERSION-linux-$ARCH.tar.gz -C /tmp 20 | sudo mv /tmp/etcd-$ETCD_VERSION-linux-$ARCH/etcd /tmp/etcd-$ETCD_VERSION-linux-$ARCH/etcdctl /tmp/etcd-$ETCD_VERSION-linux-$ARCH/etcdutl /usr/local/bin -------------------------------------------------------------------------------- /app-a/ch19/cross-namespace-gateway/staging-route.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: gateway.networking.k8s.io/v1 2 | kind: HTTPRoute 3 | metadata: 4 | name: staging-route 5 | namespace: staging 6 | spec: 7 | parentRefs: 8 | - name: gateway 9 | namespace: production 10 | hostnames: 11 | - example.com 12 | rules: 13 | - matches: 14 | - path: 15 | type: PathPrefix 16 | value: /staging 17 | backendRefs: 18 | - name: staging-web 19 | port: 80 20 | filters: 21 | - type: URLRewrite 22 | urlRewrite: 23 | path: 24 | type: ReplacePrefixMatch 25 | replacePrefixMatch: / 26 | - type: RequestHeaderModifier 27 | requestHeaderModifier: 28 | set: 29 | - name: X-Environment 30 | value: staging -------------------------------------------------------------------------------- /app-a/ch21/troubleshooting-service/setup.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: y72 5 | --- 6 | apiVersion: apps/v1 7 | kind: Deployment 8 | metadata: 9 | name: web-app 10 | namespace: y72 11 | spec: 12 | replicas: 2 13 | selector: 14 | matchLabels: 15 | app: web-app 16 | template: 17 | metadata: 18 | labels: 19 | app: web-app 20 | spec: 21 | containers: 22 | - image: bmuschko/nodejs-hello-world:1.0.0 23 | name: web-app 24 | ports: 25 | - containerPort: 3000 26 | protocol: TCP 27 | --- 28 | apiVersion: v1 29 | kind: Service 30 | metadata: 31 | name: web-app 32 | namespace: y72 33 | spec: 34 | type: ClusterIP 35 | selector: 36 | run: myapp 37 | ports: 38 | - port: 80 39 | protocol: TCP 40 | targetPort: 3001 -------------------------------------------------------------------------------- /app-a/ch21/troubleshooting-service/setup-fixed.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: y72 5 | --- 6 | apiVersion: apps/v1 7 | kind: Deployment 8 | metadata: 9 | name: web-app 10 | namespace: y72 11 | spec: 12 | replicas: 2 13 | selector: 14 | matchLabels: 15 | app: web-app 16 | template: 17 | metadata: 18 | labels: 19 | app: web-app 20 | spec: 21 | containers: 22 | - image: bmuschko/nodejs-hello-world:1.0.0 23 | name: web-app 24 | ports: 25 | - containerPort: 3000 26 | protocol: TCP 27 | --- 28 | apiVersion: v1 29 | kind: Service 30 | metadata: 31 | name: web-app 32 | namespace: y72 33 | spec: 34 | type: ClusterIP 35 | selector: 36 | app: web-app 37 | ports: 38 | - port: 80 39 | protocol: TCP 40 | targetPort: 3000 -------------------------------------------------------------------------------- /app-a/ch18/multiple-paths/ingress.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: networking.k8s.io/v1 2 | kind: Ingress 3 | metadata: 4 | name: webapp-ingress 5 | namespace: webapp 6 | annotations: 7 | nginx.ingress.kubernetes.io/rewrite-target: / 8 | spec: 9 | ingressClassName: nginx 10 | rules: 11 | - host: app.example.com 12 | http: 13 | paths: 14 | - path: / 15 | pathType: Prefix 16 | backend: 17 | service: 18 | name: frontend-service 19 | port: 20 | number: 80 21 | - path: /app 22 | pathType: Prefix 23 | backend: 24 | service: 25 | name: frontend-service 26 | port: 27 | number: 80 28 | - path: /api 29 | pathType: Prefix 30 | backend: 31 | service: 32 | name: api-service 33 | port: 34 | number: 80 -------------------------------------------------------------------------------- /.github/workflows/validate-manifests.yml: -------------------------------------------------------------------------------- 1 | name: Validate Manifests 2 | on: 3 | pull_request: 4 | push: 5 | branches: 6 | - master 7 | paths: 8 | - '**/*.yaml' 9 | - '**/*.yml' 10 | 11 | jobs: 12 | build: 13 | name: Validate Manifests 14 | runs-on: ubuntu-24.04 15 | steps: 16 | - name: Checkout 17 | uses: actions/checkout@v4 18 | - name: Set up Kubeconform 19 | uses: bmuschko/setup-kubeconform@v1 20 | - name: Validate Against Kubernetes Schema 21 | run: kubeconform -kubernetes-version=1.33.3 -ignore-filename-pattern=.github/workflows -ignore-filename-pattern=.json$ -ignore-filename-pattern=kustomize -ignore-filename-pattern=helm -ignore-filename-pattern=ch07/argo-cd -ignore-filename-pattern=app-a/ch10/configmap/application.yaml -ignore-filename-pattern=ch19 -ignore-filename-pattern=app-a/ch07 -ignore-filename-pattern=app-a/ch19 -summary . -------------------------------------------------------------------------------- /ch06/rbac/serviceaccount/setup.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: k97 5 | --- 6 | apiVersion: v1 7 | kind: ServiceAccount 8 | metadata: 9 | name: sa-api 10 | namespace: k97 11 | --- 12 | apiVersion: v1 13 | kind: Pod 14 | metadata: 15 | name: list-objects 16 | namespace: k97 17 | spec: 18 | serviceAccountName: sa-api 19 | containers: 20 | - name: pods 21 | image: alpine/curl:3.14 22 | command: ['sh', '-c', 'while true; do curl -s -k -m 5 -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://kubernetes.default.svc.cluster.local/api/v1/namespaces/k97/pods; sleep 10; done'] 23 | - name: deployments 24 | image: alpine/curl:3.14 25 | command: ['sh', '-c', 'while true; do curl -s -k -m 5 -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://kubernetes.default.svc.cluster.local/apis/apps/v1/namespaces/k97/deployments; sleep 10; done'] -------------------------------------------------------------------------------- /app-a/ch06/rbac-aggregation/control-plane.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | POD_CIDR=$1 4 | API_ADV_ADDRESS=$2 5 | 6 | kubeadm init --pod-network-cidr $POD_CIDR --apiserver-advertise-address $API_ADV_ADDRESS | tee /vagrant/kubeadm-init.out 7 | 8 | systemctl daemon-reload 9 | echo "KUBELET_EXTRA_ARGS=--node-ip=$API_ADV_ADDRESS --cgroup-driver=systemd" > /etc/default/kubelet 10 | systemctl restart kubelet 11 | 12 | mkdir -p /home/vagrant/.kube 13 | cp -i /etc/kubernetes/admin.conf /home/vagrant/.kube/config 14 | chown vagrant:vagrant /home/vagrant/.kube/config 15 | mkdir -p /root/.kube 16 | cp -i /etc/kubernetes/admin.conf /root/.kube/config 17 | 18 | kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.29.1/manifests/tigera-operator.yaml 19 | wget https://raw.githubusercontent.com/projectcalico/calico/v3.29.1/manifests/custom-resources.yaml 20 | sed -i 's~cidr: 192\.168\.0\.0/16~cidr: 172\.18\.0\.0/16~g' custom-resources.yaml 21 | kubectl create -f custom-resources.yaml 22 | rm custom-resources.yaml 23 | 24 | cp /etc/kubernetes/admin.conf /vagrant/admin.conf -------------------------------------------------------------------------------- /app-a/ch05/etcd-backup-restore/control-plane.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | POD_CIDR=$1 4 | API_ADV_ADDRESS=$2 5 | 6 | kubeadm init --pod-network-cidr $POD_CIDR --apiserver-advertise-address $API_ADV_ADDRESS | tee /vagrant/kubeadm-init.out 7 | 8 | systemctl daemon-reload 9 | echo "KUBELET_EXTRA_ARGS=--node-ip=$API_ADV_ADDRESS --cgroup-driver=systemd" > /etc/default/kubelet 10 | systemctl restart kubelet 11 | 12 | mkdir -p /home/vagrant/.kube 13 | cp -i /etc/kubernetes/admin.conf /home/vagrant/.kube/config 14 | chown vagrant:vagrant /home/vagrant/.kube/config 15 | mkdir -p /root/.kube 16 | cp -i /etc/kubernetes/admin.conf /root/.kube/config 17 | 18 | kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.29.1/manifests/tigera-operator.yaml 19 | wget https://raw.githubusercontent.com/projectcalico/calico/v3.29.1/manifests/custom-resources.yaml 20 | sed -i 's~cidr: 192\.168\.0\.0/16~cidr: 172\.18\.0\.0/16~g' custom-resources.yaml 21 | kubectl create -f custom-resources.yaml 22 | rm custom-resources.yaml 23 | 24 | cp /etc/kubernetes/admin.conf /vagrant/admin.conf -------------------------------------------------------------------------------- /app-a/ch04/upgrade-cluster-version/control-plane.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | POD_CIDR=$1 4 | API_ADV_ADDRESS=$2 5 | 6 | kubeadm init --pod-network-cidr $POD_CIDR --apiserver-advertise-address $API_ADV_ADDRESS | tee /vagrant/kubeadm-init.out 7 | 8 | systemctl daemon-reload 9 | echo "KUBELET_EXTRA_ARGS=--node-ip=$API_ADV_ADDRESS --cgroup-driver=systemd" > /etc/default/kubelet 10 | systemctl restart kubelet 11 | 12 | mkdir -p /home/vagrant/.kube 13 | cp -i /etc/kubernetes/admin.conf /home/vagrant/.kube/config 14 | chown vagrant:vagrant /home/vagrant/.kube/config 15 | mkdir -p /root/.kube 16 | cp -i /etc/kubernetes/admin.conf /root/.kube/config 17 | 18 | kubectl create -f https://raw.githubusercontent.com/projectcalico/calico/v3.29.1/manifests/tigera-operator.yaml 19 | wget https://raw.githubusercontent.com/projectcalico/calico/v3.29.1/manifests/custom-resources.yaml 20 | sed -i 's~cidr: 192\.168\.0\.0/16~cidr: 172\.18\.0\.0/16~g' custom-resources.yaml 21 | kubectl create -f custom-resources.yaml 22 | rm custom-resources.yaml 23 | 24 | cp /etc/kubernetes/admin.conf /vagrant/admin.conf -------------------------------------------------------------------------------- /ch11/statefulset/redis-statefulset-service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | name: redis 5 | labels: 6 | app: redis 7 | spec: 8 | ports: 9 | - port: 6379 10 | protocol: TCP 11 | selector: 12 | app: redis 13 | type: ClusterIP 14 | clusterIP: None 15 | --- 16 | apiVersion: apps/v1 17 | kind: StatefulSet 18 | metadata: 19 | name: redis 20 | spec: 21 | selector: 22 | matchLabels: 23 | app: redis 24 | replicas: 1 25 | serviceName: "redis" 26 | template: 27 | metadata: 28 | labels: 29 | app: redis 30 | spec: 31 | containers: 32 | - name: redis 33 | image: redis:6.2.5 34 | command: ["redis-server", "--appendonly", "yes"] 35 | ports: 36 | - containerPort: 6379 37 | name: web 38 | volumeMounts: 39 | - name: redis-vol 40 | mountPath: /data 41 | volumeClaimTemplates: 42 | - metadata: 43 | name: redis-vol 44 | spec: 45 | accessModes: ["ReadWriteOnce"] 46 | resources: 47 | requests: 48 | storage: 1Gi -------------------------------------------------------------------------------- /app-a/ch20/cross-namespace-control/setup.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: team-alpha 5 | labels: 6 | team: alpha 7 | --- 8 | apiVersion: v1 9 | kind: Namespace 10 | metadata: 11 | name: team-beta 12 | labels: 13 | team: beta 14 | --- 15 | apiVersion: v1 16 | kind: Pod 17 | metadata: 18 | name: alpha-app 19 | namespace: team-alpha 20 | labels: 21 | app: alpha-app 22 | team: alpha 23 | spec: 24 | containers: 25 | - name: app 26 | image: alpine/curl:8.14.1 27 | command: ["/bin/sh"] 28 | args: ["-c", "while true; do echo 'Alpha app running'; sleep 3600; done"] 29 | --- 30 | apiVersion: v1 31 | kind: Pod 32 | metadata: 33 | name: beta-app 34 | namespace: team-beta 35 | labels: 36 | app: beta-app 37 | team: beta 38 | spec: 39 | containers: 40 | - name: app 41 | image: nginx:1.27.3-alpine 42 | ports: 43 | - containerPort: 80 44 | --- 45 | apiVersion: v1 46 | kind: Service 47 | metadata: 48 | name: beta-app 49 | namespace: team-beta 50 | spec: 51 | selector: 52 | app: beta-app 53 | team: beta 54 | ports: 55 | - port: 8080 56 | targetPort: 80 -------------------------------------------------------------------------------- /app-a/ch04/upgrade-cluster-version/Vagrantfile: -------------------------------------------------------------------------------- 1 | BOX_IMAGE = "gutehall/ubuntu24-10" 2 | WORKER_COUNT = 1 3 | POD_CIDR = "172.18.0.0/16" 4 | API_ADV_ADDRESS = "192.168.56.10" 5 | 6 | Vagrant.configure("2") do |config| 7 | config.vm.box = BOX_IMAGE 8 | 9 | config.vm.define "kube-control-plane" do |node| 10 | node.vm.hostname = "kube-control-plane" 11 | node.vm.network :private_network, ip: "192.168.56.10" 12 | node.vm.provider "vmware_desktop" do |vwd| 13 | vwd.ssh_info_public = true 14 | vwd.vmx["memsize"] = "2048" 15 | vwd.vmx["numvcpus"] = "2" 16 | end 17 | node.vm.provision "shell", path: "common.sh" 18 | node.vm.provision "shell", path: "control-plane.sh", args: "#{POD_CIDR} #{API_ADV_ADDRESS}" 19 | end 20 | 21 | (1..WORKER_COUNT).each do |i| 22 | config.vm.define "kube-worker-#{i}" do |node| 23 | node.vm.hostname = "kube-worker-#{i}" 24 | node.vm.network :private_network, ip: "192.168.56.#{i + 20}" 25 | node.vm.provider "vmware_desktop" do |vwd| 26 | vwd.ssh_info_public = true 27 | vwd.vmx["memsize"] = "2048" 28 | vwd.vmx["numvcpus"] = "2" 29 | end 30 | node.vm.provision "shell", path: "common.sh" 31 | node.vm.provision "shell", path: "worker.sh", args: "#{i}" 32 | end 33 | end 34 | 35 | config.vm.provision "shell", 36 | run: "always", 37 | inline: "swapoff -a" 38 | end 39 | -------------------------------------------------------------------------------- /app-a/ch06/rbac-aggregation/Vagrantfile: -------------------------------------------------------------------------------- 1 | BOX_IMAGE = "gutehall/ubuntu24-10" 2 | WORKER_COUNT = 1 3 | POD_CIDR = "172.18.0.0/16" 4 | API_ADV_ADDRESS = "192.168.56.10" 5 | 6 | Vagrant.configure("2") do |config| 7 | config.vm.box = BOX_IMAGE 8 | 9 | config.vm.define "kube-control-plane" do |node| 10 | node.vm.hostname = "kube-control-plane" 11 | node.vm.network :private_network, ip: "192.168.56.10" 12 | node.vm.provider "vmware_desktop" do |vwd| 13 | vwd.ssh_info_public = true 14 | vwd.vmx["memsize"] = "2048" 15 | vwd.vmx["numvcpus"] = "2" 16 | end 17 | node.vm.provision "shell", path: "common.sh" 18 | node.vm.provision "shell", path: "control-plane.sh", args: "#{POD_CIDR} #{API_ADV_ADDRESS}" 19 | node.vm.provision "shell", path: "setup.sh" 20 | end 21 | 22 | (1..WORKER_COUNT).each do |i| 23 | config.vm.define "kube-worker-#{i}" do |node| 24 | node.vm.hostname = "kube-worker-#{i}" 25 | node.vm.network :private_network, ip: "192.168.56.#{i + 20}" 26 | node.vm.provider "vmware_desktop" do |vwd| 27 | vwd.ssh_info_public = true 28 | vwd.vmx["memsize"] = "2048" 29 | vwd.vmx["numvcpus"] = "2" 30 | end 31 | node.vm.provision "shell", path: "common.sh" 32 | node.vm.provision "shell", path: "worker.sh", args: "#{i}" 33 | end 34 | end 35 | 36 | config.vm.provision "shell", 37 | run: "always", 38 | inline: "swapoff -a" 39 | end -------------------------------------------------------------------------------- /app-a/ch05/etcd-backup-restore/Vagrantfile: -------------------------------------------------------------------------------- 1 | BOX_IMAGE = "gutehall/ubuntu24-10" 2 | WORKER_COUNT = 1 3 | POD_CIDR = "172.18.0.0/16" 4 | API_ADV_ADDRESS = "192.168.56.10" 5 | 6 | Vagrant.configure("2") do |config| 7 | config.vm.box = BOX_IMAGE 8 | 9 | config.vm.define "kube-control-plane" do |node| 10 | node.vm.hostname = "kube-control-plane" 11 | node.vm.network :private_network, ip: "192.168.56.10" 12 | node.vm.provider "vmware_desktop" do |vwd| 13 | vwd.ssh_info_public = true 14 | vwd.vmx["memsize"] = "2048" 15 | vwd.vmx["numvcpus"] = "2" 16 | end 17 | node.vm.provision "shell", path: "common.sh" 18 | node.vm.provision "shell", path: "control-plane.sh", args: "#{POD_CIDR} #{API_ADV_ADDRESS}" 19 | node.vm.provision "shell", path: "etcdctl.sh" 20 | end 21 | 22 | (1..WORKER_COUNT).each do |i| 23 | config.vm.define "kube-worker-#{i}" do |node| 24 | node.vm.hostname = "kube-worker-#{i}" 25 | node.vm.network :private_network, ip: "192.168.56.#{i + 20}" 26 | node.vm.provider "vmware_desktop" do |vwd| 27 | vwd.ssh_info_public = true 28 | vwd.vmx["memsize"] = "2048" 29 | vwd.vmx["numvcpus"] = "2" 30 | end 31 | node.vm.provision "shell", path: "common.sh" 32 | node.vm.provision "shell", path: "worker.sh", args: "#{i}" 33 | end 34 | end 35 | 36 | config.vm.provision "shell", 37 | run: "always", 38 | inline: "swapoff -a" 39 | end -------------------------------------------------------------------------------- /app-a/ch19/cross-namespace-gateway/setup.yaml: -------------------------------------------------------------------------------- 1 | # Namespaces 2 | --- 3 | apiVersion: v1 4 | kind: Namespace 5 | metadata: 6 | name: staging 7 | --- 8 | apiVersion: v1 9 | kind: Namespace 10 | metadata: 11 | name: production 12 | --- 13 | # Staging Application 14 | --- 15 | apiVersion: apps/v1 16 | kind: Deployment 17 | metadata: 18 | name: app 19 | namespace: staging 20 | spec: 21 | replicas: 1 22 | selector: 23 | matchLabels: 24 | app: web 25 | template: 26 | metadata: 27 | labels: 28 | app: web 29 | spec: 30 | containers: 31 | - name: app 32 | image: nginx:latest 33 | ports: 34 | - containerPort: 80 35 | --- 36 | apiVersion: v1 37 | kind: Service 38 | metadata: 39 | name: staging-web 40 | namespace: staging 41 | spec: 42 | selector: 43 | app: web 44 | ports: 45 | - port: 80 46 | targetPort: 80 47 | --- 48 | # Production Application 49 | --- 50 | apiVersion: apps/v1 51 | kind: Deployment 52 | metadata: 53 | name: app 54 | namespace: production 55 | spec: 56 | replicas: 3 57 | selector: 58 | matchLabels: 59 | app: web 60 | template: 61 | metadata: 62 | labels: 63 | app: web 64 | spec: 65 | containers: 66 | - name: app 67 | image: nginx:latest 68 | ports: 69 | - containerPort: 80 70 | --- 71 | apiVersion: v1 72 | kind: Service 73 | metadata: 74 | name: prod-web 75 | namespace: production 76 | spec: 77 | selector: 78 | app: web 79 | ports: 80 | - port: 80 81 | targetPort: 80 -------------------------------------------------------------------------------- /app-a/ch20/database-access-control/setup.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: production 5 | --- 6 | apiVersion: v1 7 | kind: Pod 8 | metadata: 9 | name: database 10 | namespace: production 11 | labels: 12 | tier: database 13 | app: myapp 14 | spec: 15 | containers: 16 | - name: redis 17 | image: redis:7-alpine 18 | ports: 19 | - containerPort: 6379 20 | --- 21 | apiVersion: v1 22 | kind: Service 23 | metadata: 24 | name: database 25 | namespace: production 26 | spec: 27 | selector: 28 | tier: database 29 | app: myapp 30 | ports: 31 | - port: 3306 32 | targetPort: 6379 33 | protocol: TCP 34 | --- 35 | apiVersion: v1 36 | kind: Pod 37 | metadata: 38 | name: backend 39 | namespace: production 40 | labels: 41 | tier: backend 42 | app: myapp 43 | spec: 44 | containers: 45 | - name: backend 46 | image: nginx:1.27.3-alpine 47 | ports: 48 | - containerPort: 80 49 | --- 50 | apiVersion: v1 51 | kind: Service 52 | metadata: 53 | name: backend 54 | namespace: production 55 | spec: 56 | selector: 57 | tier: backend 58 | app: myapp 59 | ports: 60 | - port: 80 61 | targetPort: 80 62 | --- 63 | apiVersion: v1 64 | kind: Pod 65 | metadata: 66 | name: frontend 67 | namespace: production 68 | labels: 69 | tier: frontend 70 | app: myapp 71 | spec: 72 | containers: 73 | - name: frontend 74 | image: alpine/curl:8.14.1 75 | command: ["/bin/sh"] 76 | args: ["-c", "while true; do echo 'Frontend running'; sleep 3600; done"] -------------------------------------------------------------------------------- /README.adoc: -------------------------------------------------------------------------------- 1 | = Certified Kubernetes Administrator (CKA) Study Guide, 2nd Edition 2 | 3 | ++++ 4 |
5 | Book Cover 6 | ++++ 7 | Source code for book https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9798341608399/["Certified Kubernetes Administrator (CKA) Study Guide, 2nd Edition"], In-Depth Guidance and Practice, published by Benjamin Muschko for O'Reilly Media Inc. 8 | 9 | This study guide walks you through all the topics you need to fully prepare for the exam covering Kubernetes 1.33. Author Benjamin Muschko also shares his personal experience with preparing for all aspects of the exam. 10 | 11 | > **_NOTE:_** The source code for the 1st edition of the book is available https://github.com/bmuschko/cka-study-guide/tree/1st-edition[here]. 12 | 13 | == Source Code by Chapters 14 | 15 | . Introduction 16 | * Exam Details and Resources 17 | * Kubernetes in a Nutshell 18 | * link:./ch03[Interacting with Kubernetes] 19 | . Cluster Architecture, Installation and Configuration 20 | * link:./ch04[Cluster Installation and Upgrade] 21 | * link:./ch05[Backing Up and Restoring etcd] 22 | * link:./ch06[Authentication, Authorization, and Admission Control] 23 | * link:./ch07[Operators and Custom Resource Definitions (CRDs)] 24 | * link:./ch08[Helm and Kustomize] 25 | . Workloads and Scheduling 26 | * link:./ch09[Pods and Namespaces] 27 | * link:./ch10[ConfigMaps and Secrets] 28 | * link:./ch11[Deployments and ReplicaSets] 29 | * link:./ch12[Scaling Workloads] 30 | * link:./ch13[Resource Requirements, Limits, and Quotas] 31 | * link:./ch14[Pod Scheduling] 32 | . Storage 33 | * link:./ch15[Volumes] 34 | * link:./ch16[Persistent Volumes] 35 | . Servicing and Networking 36 | * link:./ch17[Services] 37 | * link:./ch18[Ingresses] 38 | * link:./ch19[Gateway API] 39 | * link:./ch20[Network Policies] 40 | . Troubleshooting 41 | * link:./ch21[Troubleshooting Applications] 42 | * link:./ch22[Troubleshooting Clusters] 43 | . Appendixes 44 | * link:./app-a[Appendix A: Answers to Review Questions] 45 | * link:./app-b[Appendix B: Exam Review Guide] -------------------------------------------------------------------------------- /app-a/ch06/rbac-aggregation/common.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | if [ -z ${K8S_VERSION+x} ]; then 4 | K8S_VERSION=1.32.1-1.1 5 | fi 6 | 7 | # Install containerd container runtime 8 | sudo apt install \ 9 | ca-certificates \ 10 | curl \ 11 | gnupg \ 12 | lsb-release 13 | sudo mkdir -p /etc/apt/keyrings 14 | curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg 15 | echo \ 16 | "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \ 17 | $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null 18 | sudo apt update 19 | sudo apt install containerd.io 20 | sudo systemctl start containerd 21 | sudo systemctl enable containerd 22 | sudo systemctl status containerd 23 | sudo mv etc/containerd/config.toml etc/containerd/config.toml.orig 24 | containerd config default | sudo tee /etc/containerd/config.toml 25 | sudo sed -i 's/SystemdCgroup \= false/SystemdCgroup \= true/g' /etc/containerd/config.toml 26 | 27 | ARCH=$(uname -m) 28 | if [ "$ARCH" == "x86_64" ]; then 29 | ARCH="amd64" 30 | elif [ "$ARCH" == "aarch64" ]; then 31 | ARCH="arm64" 32 | elif [ "$ARCH" == "armv7l" ]; then 33 | ARCH="arm" 34 | else 35 | echo "Unsupported architecture: $ARCH" 36 | exit 1 37 | fi 38 | 39 | wget "https://github.com/containernetworking/plugins/releases/download/v1.1.1/cni-plugins-linux-${ARCH}-v1.1.1.tgz" 40 | mkdir -p /opt/cni/bin 41 | tar Cxzvf /opt/cni/bin "cni-plugins-linux-${ARCH}-v1.1.1.tgz" 42 | sudo systemctl restart containerd 43 | 44 | sudo apt-get update 45 | sudo apt-get install -y apt-transport-https ca-certificates curl 46 | sudo curl -fsSL "https://pkgs.k8s.io/core:/stable:/v${K8S_VERSION:0:4}/deb/Release.key" | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg 47 | echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v${K8S_VERSION:0:4}/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list 48 | 49 | # Install Kubernetes binaries 50 | sudo apt-get update 51 | sudo apt-get install -y \ 52 | kubeadm=$K8S_VERSION \ 53 | kubelet=$K8S_VERSION \ 54 | kubectl=$K8S_VERSION 55 | sudo apt-mark hold kubelet kubeadm kubectl 56 | 57 | # Required for kubeadm preinstall checks 58 | modprobe br_netfilter 59 | echo '1' > /proc/sys/net/ipv4/ip_forward 60 | sudo apt-get -y install socat 61 | 62 | # Set alias for kubectl command 63 | echo "alias k=kubectl" >> /home/vagrant/.bashrc -------------------------------------------------------------------------------- /app-a/ch05/etcd-backup-restore/common.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | if [ -z ${K8S_VERSION+x} ]; then 4 | K8S_VERSION=1.32.1-1.1 5 | fi 6 | 7 | # Install containerd container runtime 8 | sudo apt install \ 9 | ca-certificates \ 10 | curl \ 11 | gnupg \ 12 | lsb-release 13 | sudo mkdir -p /etc/apt/keyrings 14 | curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg 15 | echo \ 16 | "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \ 17 | $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null 18 | sudo apt update 19 | sudo apt install containerd.io 20 | sudo systemctl start containerd 21 | sudo systemctl enable containerd 22 | sudo systemctl status containerd 23 | sudo mv etc/containerd/config.toml etc/containerd/config.toml.orig 24 | containerd config default | sudo tee /etc/containerd/config.toml 25 | sudo sed -i 's/SystemdCgroup \= false/SystemdCgroup \= true/g' /etc/containerd/config.toml 26 | 27 | ARCH=$(uname -m) 28 | if [ "$ARCH" == "x86_64" ]; then 29 | ARCH="amd64" 30 | elif [ "$ARCH" == "aarch64" ]; then 31 | ARCH="arm64" 32 | elif [ "$ARCH" == "armv7l" ]; then 33 | ARCH="arm" 34 | else 35 | echo "Unsupported architecture: $ARCH" 36 | exit 1 37 | fi 38 | 39 | wget "https://github.com/containernetworking/plugins/releases/download/v1.1.1/cni-plugins-linux-${ARCH}-v1.1.1.tgz" 40 | mkdir -p /opt/cni/bin 41 | tar Cxzvf /opt/cni/bin "cni-plugins-linux-${ARCH}-v1.1.1.tgz" 42 | sudo systemctl restart containerd 43 | 44 | sudo apt-get update 45 | sudo apt-get install -y apt-transport-https ca-certificates curl 46 | sudo curl -fsSL "https://pkgs.k8s.io/core:/stable:/v${K8S_VERSION:0:4}/deb/Release.key" | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg 47 | echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v${K8S_VERSION:0:4}/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list 48 | 49 | # Install Kubernetes binaries 50 | sudo apt-get update 51 | sudo apt-get install -y \ 52 | kubeadm=$K8S_VERSION \ 53 | kubelet=$K8S_VERSION \ 54 | kubectl=$K8S_VERSION 55 | sudo apt-mark hold kubelet kubeadm kubectl 56 | 57 | # Required for kubeadm preinstall checks 58 | modprobe br_netfilter 59 | echo '1' > /proc/sys/net/ipv4/ip_forward 60 | sudo apt-get -y install socat 61 | 62 | # Set alias for kubectl command 63 | echo "alias k=kubectl" >> /home/vagrant/.bashrc -------------------------------------------------------------------------------- /app-a/ch04/upgrade-cluster-version/common.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | if [ -z ${K8S_VERSION+x} ]; then 4 | K8S_VERSION=1.32.1-1.1 5 | fi 6 | 7 | # Install containerd container runtime 8 | sudo apt install \ 9 | ca-certificates \ 10 | curl \ 11 | gnupg \ 12 | lsb-release 13 | sudo mkdir -p /etc/apt/keyrings 14 | curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg 15 | echo \ 16 | "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \ 17 | $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null 18 | sudo apt update 19 | sudo apt install containerd.io 20 | sudo systemctl start containerd 21 | sudo systemctl enable containerd 22 | sudo systemctl status containerd 23 | sudo mv etc/containerd/config.toml etc/containerd/config.toml.orig 24 | containerd config default | sudo tee /etc/containerd/config.toml 25 | sudo sed -i 's/SystemdCgroup \= false/SystemdCgroup \= true/g' /etc/containerd/config.toml 26 | 27 | ARCH=$(uname -m) 28 | if [ "$ARCH" == "x86_64" ]; then 29 | ARCH="amd64" 30 | elif [ "$ARCH" == "aarch64" ]; then 31 | ARCH="arm64" 32 | elif [ "$ARCH" == "armv7l" ]; then 33 | ARCH="arm" 34 | else 35 | echo "Unsupported architecture: $ARCH" 36 | exit 1 37 | fi 38 | 39 | wget "https://github.com/containernetworking/plugins/releases/download/v1.1.1/cni-plugins-linux-${ARCH}-v1.1.1.tgz" 40 | mkdir -p /opt/cni/bin 41 | tar Cxzvf /opt/cni/bin "cni-plugins-linux-${ARCH}-v1.1.1.tgz" 42 | sudo systemctl restart containerd 43 | 44 | sudo apt-get update 45 | sudo apt-get install -y apt-transport-https ca-certificates curl 46 | sudo curl -fsSL "https://pkgs.k8s.io/core:/stable:/v${K8S_VERSION:0:4}/deb/Release.key" | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg 47 | echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v${K8S_VERSION:0:4}/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list 48 | 49 | # Install Kubernetes binaries 50 | sudo apt-get update 51 | sudo apt-get install -y \ 52 | kubeadm=$K8S_VERSION \ 53 | kubelet=$K8S_VERSION \ 54 | kubectl=$K8S_VERSION 55 | sudo apt-mark hold kubelet kubeadm kubectl 56 | 57 | # Required for kubeadm preinstall checks 58 | modprobe br_netfilter 59 | echo '1' > /proc/sys/net/ipv4/ip_forward 60 | sudo apt-get -y install socat 61 | 62 | # Set alias for kubectl command 63 | echo "alias k=kubectl" >> /home/vagrant/.bashrc -------------------------------------------------------------------------------- /app-a/ch19/basic-gateway/setup.yaml: -------------------------------------------------------------------------------- 1 | # Web Application ConfigMap 2 | apiVersion: v1 3 | kind: ConfigMap 4 | metadata: 5 | name: web-content 6 | namespace: default 7 | data: 8 | index.html: | 9 | 10 | 11 | 12 | Web Application 13 | 14 | 15 |

Web Application

16 |

This is the web application served at /web

17 | 18 | 19 | --- 20 | # API Application ConfigMap 21 | apiVersion: v1 22 | kind: ConfigMap 23 | metadata: 24 | name: api-content 25 | namespace: default 26 | data: 27 | index.html: | 28 | 29 | 30 | 31 | API Application 32 | 33 | 34 |

API Application

35 |

This is the API application served at /api

36 | 37 | 38 | --- 39 | # Web Application Deployment 40 | apiVersion: apps/v1 41 | kind: Deployment 42 | metadata: 43 | name: web-app 44 | namespace: default 45 | labels: 46 | app: web-app 47 | spec: 48 | replicas: 2 49 | selector: 50 | matchLabels: 51 | app: web-app 52 | template: 53 | metadata: 54 | labels: 55 | app: web-app 56 | spec: 57 | containers: 58 | - name: nginx 59 | image: nginx:1.21 60 | ports: 61 | - containerPort: 80 62 | volumeMounts: 63 | - name: web-content 64 | mountPath: /usr/share/nginx/html/web 65 | volumes: 66 | - name: web-content 67 | configMap: 68 | name: web-content 69 | --- 70 | # Web Application Service 71 | apiVersion: v1 72 | kind: Service 73 | metadata: 74 | name: web-app 75 | namespace: default 76 | spec: 77 | selector: 78 | app: web-app 79 | ports: 80 | - port: 80 81 | targetPort: 80 82 | protocol: TCP 83 | type: ClusterIP 84 | --- 85 | # API Application Deployment 86 | apiVersion: apps/v1 87 | kind: Deployment 88 | metadata: 89 | name: api-app 90 | namespace: default 91 | labels: 92 | app: api-app 93 | spec: 94 | replicas: 2 95 | selector: 96 | matchLabels: 97 | app: api-app 98 | template: 99 | metadata: 100 | labels: 101 | app: api-app 102 | spec: 103 | containers: 104 | - name: httpd 105 | image: httpd:2.4 106 | ports: 107 | - containerPort: 80 108 | volumeMounts: 109 | - name: api-content 110 | mountPath: /usr/local/apache2/htdocs/api 111 | volumes: 112 | - name: api-content 113 | configMap: 114 | name: api-content 115 | --- 116 | # API Application Service 117 | apiVersion: v1 118 | kind: Service 119 | metadata: 120 | name: api-app 121 | namespace: default 122 | spec: 123 | selector: 124 | app: api-app 125 | ports: 126 | - port: 80 127 | targetPort: 80 128 | protocol: TCP 129 | type: ClusterIP -------------------------------------------------------------------------------- /app-a/ch16/dynamic-provisioning/local-path-storage-0.0.31.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Namespace 3 | metadata: 4 | name: local-path-storage 5 | 6 | --- 7 | apiVersion: v1 8 | kind: ServiceAccount 9 | metadata: 10 | name: local-path-provisioner-service-account 11 | namespace: local-path-storage 12 | 13 | --- 14 | apiVersion: rbac.authorization.k8s.io/v1 15 | kind: Role 16 | metadata: 17 | name: local-path-provisioner-role 18 | namespace: local-path-storage 19 | rules: 20 | - apiGroups: [""] 21 | resources: ["pods"] 22 | verbs: ["get", "list", "watch", "create", "patch", "update", "delete"] 23 | 24 | --- 25 | apiVersion: rbac.authorization.k8s.io/v1 26 | kind: ClusterRole 27 | metadata: 28 | name: local-path-provisioner-role 29 | rules: 30 | - apiGroups: [""] 31 | resources: ["nodes", "persistentvolumeclaims", "configmaps", "pods", "pods/log"] 32 | verbs: ["get", "list", "watch"] 33 | - apiGroups: [""] 34 | resources: ["persistentvolumes"] 35 | verbs: ["get", "list", "watch", "create", "patch", "update", "delete"] 36 | - apiGroups: [""] 37 | resources: ["events"] 38 | verbs: ["create", "patch"] 39 | - apiGroups: ["storage.k8s.io"] 40 | resources: ["storageclasses"] 41 | verbs: ["get", "list", "watch"] 42 | 43 | --- 44 | apiVersion: rbac.authorization.k8s.io/v1 45 | kind: RoleBinding 46 | metadata: 47 | name: local-path-provisioner-bind 48 | namespace: local-path-storage 49 | roleRef: 50 | apiGroup: rbac.authorization.k8s.io 51 | kind: Role 52 | name: local-path-provisioner-role 53 | subjects: 54 | - kind: ServiceAccount 55 | name: local-path-provisioner-service-account 56 | namespace: local-path-storage 57 | 58 | --- 59 | apiVersion: rbac.authorization.k8s.io/v1 60 | kind: ClusterRoleBinding 61 | metadata: 62 | name: local-path-provisioner-bind 63 | roleRef: 64 | apiGroup: rbac.authorization.k8s.io 65 | kind: ClusterRole 66 | name: local-path-provisioner-role 67 | subjects: 68 | - kind: ServiceAccount 69 | name: local-path-provisioner-service-account 70 | namespace: local-path-storage 71 | 72 | --- 73 | apiVersion: apps/v1 74 | kind: Deployment 75 | metadata: 76 | name: local-path-provisioner 77 | namespace: local-path-storage 78 | spec: 79 | replicas: 1 80 | selector: 81 | matchLabels: 82 | app: local-path-provisioner 83 | template: 84 | metadata: 85 | labels: 86 | app: local-path-provisioner 87 | spec: 88 | serviceAccountName: local-path-provisioner-service-account 89 | containers: 90 | - name: local-path-provisioner 91 | image: rancher/local-path-provisioner:v0.0.31 92 | imagePullPolicy: IfNotPresent 93 | command: 94 | - local-path-provisioner 95 | - --debug 96 | - start 97 | - --config 98 | - /etc/config/config.json 99 | volumeMounts: 100 | - name: config-volume 101 | mountPath: /etc/config/ 102 | env: 103 | - name: POD_NAMESPACE 104 | valueFrom: 105 | fieldRef: 106 | fieldPath: metadata.namespace 107 | - name: CONFIG_MOUNT_PATH 108 | value: /etc/config/ 109 | volumes: 110 | - name: config-volume 111 | configMap: 112 | name: local-path-config 113 | 114 | --- 115 | apiVersion: storage.k8s.io/v1 116 | kind: StorageClass 117 | metadata: 118 | name: local-path 119 | provisioner: rancher.io/local-path 120 | volumeBindingMode: WaitForFirstConsumer 121 | reclaimPolicy: Delete 122 | 123 | --- 124 | kind: ConfigMap 125 | apiVersion: v1 126 | metadata: 127 | name: local-path-config 128 | namespace: local-path-storage 129 | data: 130 | config.json: |- 131 | { 132 | "nodePathMap":[ 133 | { 134 | "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES", 135 | "paths":["/opt/local-path-provisioner"] 136 | } 137 | ] 138 | } 139 | setup: |- 140 | #!/bin/sh 141 | set -eu 142 | mkdir -m 0777 -p "$VOL_DIR" 143 | teardown: |- 144 | #!/bin/sh 145 | set -eu 146 | rm -rf "$VOL_DIR" 147 | helperPod.yaml: |- 148 | apiVersion: v1 149 | kind: Pod 150 | metadata: 151 | name: helper-pod 152 | spec: 153 | priorityClassName: system-node-critical 154 | tolerations: 155 | - key: node.kubernetes.io/disk-pressure 156 | operator: Exists 157 | effect: NoSchedule 158 | containers: 159 | - name: helper-pod 160 | image: busybox 161 | imagePullPolicy: IfNotPresent -------------------------------------------------------------------------------- /app-b/exam-review-guide.adoc: -------------------------------------------------------------------------------- 1 | == Exam Review Guide 2 | 3 | This book covers https://github.com/cncf/curriculum[all objectives relevant to the exam] and more. The tables below map the exam objective to the corresponding book chapter. Furthermore, you will also find a reference to the Kubernetes documentation. You can use the mapping as a reference to review specific objectives in more detail. 4 | 5 | === Cluster Architecture, Installation & Configuration 6 | 7 | [options="header"] 8 | |======= 9 | |Exam Objective |Chapter |Reference Documentation |Tutorial 10 | |Manage role based access control (RBAC) |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch02.html#idm45322734131824[Role-Based Access Control] |https://kubernetes.io/docs/reference/access-authn-authz/rbac/[Using RBAC Authorization] |N/A 11 | |Prepare underlying infrastructure for installing a Kubernetes cluster |N/A |N/A |N/A 12 | |Create and manage Kubernetes clusters using kubeadm |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch02.html#idm45322727594240[Installing a Cluster], https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch02.html#idm45322727528320[Upgrading a Cluster Version]|https://kubernetes.io/docs/reference/setup-tools/kubeadm/[kubeadm] |https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/[Creating a cluster with kubeadm], https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/[Upgrading kubeadm clusters] 13 | |Manage the lifecycle of Kubernetes clusters|https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch02.html#idm45322727435776[Backing Up and Restoring etcd]| https://etcd.io/docs/latest/[etcd] |https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/#backing-up-an-etcd-cluster[Backing up an etcd cluster] 14 | |Implement and configure a highly-available control plane |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch02.html#managing_ha_cluster[Managing a Highly Available Cluster] |https://kubernetes.io/docs/reference/setup-tools/kubeadm/[kubeadm], https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/ha-topology/[Options for Highly Available Topology] |https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/high-availability/[Creating Highly Available Clusters with kubeadm] 15 | |Use Helm and Kustomize to install cluster components|https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch04.html#idm45322719788400[Managing Objects], https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch04.html#idm45322719680368[Common Templating Tools]| https://helm.sh/[Helm], https://kustomize.io/[Kustomize] | https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/[Declarative Management of Kubernetes Objects Using Kustomize] 16 | |Understand extension interfaces (CNI, CSI, CRI, etc.)|N/A | https://kubernetes.io/docs/concepts/extend-kubernetes/#infrastructure-extensions[Infrastructure extensions] | N/A 17 | |Understand CRDs, install and configure operators |N/A |https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/[Custom Resources], https://kubernetes.io/docs/concepts/extend-kubernetes/operator/[Operator pattern] |https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/[Use Custom Resources] 18 | |======= 19 | 20 | === Workloads & Scheduling 21 | 22 | [options="header"] 23 | |======= 24 | |Exam Objective |Chapter |Reference Documentation |Tutorial 25 | |Understand application deployments and how to perform rolling update and rollbacks |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch03.html#idm45322727094752[Performing Rolling Updates and Rollbacks] |https://kubernetes.io/docs/concepts/workloads/controllers/deployment/[Deployments] |https://kubernetes.io/docs/tutorials/kubernetes-basics/update/update-intro/[Performing a Rolling Update] 26 | |Use ConfigMaps and Secrets to configure applications |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch03.html#defining_consuming_configuration_data[Defining and Consuming Configuration Data] |https://kubernetes.io/docs/concepts/configuration/configmap/[ConfigMaps], https://kubernetes.io/docs/concepts/configuration/secret/[Secrets] |https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/[Configure a Pod to Use a ConfigMap], https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/[Managing Secrets using kubectl], https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-config-file/[Managing Secrets using Configuration File] 27 | |Configure workload autoscaling |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch03.html#idm45322727064736[Scaling Workloads] |https://kubernetes.io/docs/concepts/workloads/controllers/deployment/[Deployments] |https://kubernetes.io/docs/tutorials/kubernetes-basics/scale/scale-intro/[Running Multiple Instances of Your App], https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/[Horizontal Pod Autoscaling] 28 | |Understand the primitives used to create robust, self-healing, application deployments |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch03.html#idm45322727299248[Managing Workloads with Deployments] |https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/[ReplicaSet] |N/A 29 | |Configure Pod admission and scheduling (limits, node affinity, etc.)|https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch04.html[Understanding How Resource Limits Affect Pod Scheduling] |https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/[Resource Management for Pods and Containers], https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/[Assigning Pods to Nodes] |N/A 30 | |======= 31 | 32 | === Servicing & Networking 33 | 34 | [options="header"] 35 | |======= 36 | |Exam Objective |Chapter |Reference Documentation |Tutorial 37 | |Understand connectivity between Pods|https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch05.html#connectivity_between_pods[Connectivity Between Pods] |https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/[DNS for Services and Pods] |N/A 38 | |Define and enforce Network Policies |N/A | https://kubernetes.io/docs/concepts/services-networking/network-policies/[Network Policies] | https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy/[Declare Network Policy] 39 | |Understand ClusterIP, NodePort, LoadBalancer service types and endpoints |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch05.html#understanding_services[Understanding Services] |https://kubernetes.io/docs/concepts/services-networking/service/[Service] |https://kubernetes.io/docs/tutorials/services/connect-applications-service/[Connecting Applications with Services] 40 | |Use the Gateway API to manage Ingress traffic|N/A |https://kubernetes.io/docs/concepts/services-networking/gateway/[Gateway API]|N/A 41 | |Know how to use Ingress controllers and Ingress resources|https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch05.html#idm45322718330000[Understanding Ingress] |https://kubernetes.io/docs/concepts/services-networking/ingress/[Ingress], https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/[Ingress Controllers] |https://kubernetes.io/docs/tasks/access-application-cluster/ingress-minikube/[Set up Ingress on Minikube with the NGINX Ingress Controller] 42 | |Understand and use CoreDNS |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch05.html#idm45322718103248[Using and Configuring CoreDNS] |https://coredns.io/[CoreDNS] |N/A 43 | |======= 44 | 45 | === Storage 46 | 47 | [options="header"] 48 | |======= 49 | |Exam Objective |Chapter |Reference Documentation |Tutorial 50 | |Implement storage classes and dynamic volume provisioning |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch06.html#idm45322717437712[Understanding Persistent Volumes], https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch06.html#idm45322717428976[Static vs. Dynamic Provisioning] |https://kubernetes.io/docs/concepts/storage/persistent-volumes/[Persistent Volumes], https://kubernetes.io/docs/concepts/storage/storage-classes/[Storage Classes] |N/A 51 | |Configure volume types, access modes and reclaim policies |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch06.html#idm45322717345296[Configuration Options for a PersistentVolume] |https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistent-volumes[Persistent Volumes] |N/A 52 | |Manage persistent volumes and persistent volume claims |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch06.html#creating_pv[Creating PersistentVolumes], https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch06.html#creating_pvc[Creating PersistentVolumeClaims], https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch06.html#mounting_persistent_volume[Mounting PersistentVolumeClaims in a Pod] |https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims[PersistentVolumeClaims] |https://kubernetes.io/docs/tasks/configure-pod-container/configure-persistent-volume-storage/[Configure a Pod to Use a PersistentVolume for Storage] 53 | |======= 54 | 55 | === Troubleshooting 56 | 57 | [options="header"] 58 | |======= 59 | |Exam Objective |Chapter |Reference Documentation |Tutorial 60 | |Troubleshoot clusters and nodes |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch07.html#idm45322716437792[Troubleshooting Cluster Failures] |https://kubernetes.io/docs/tasks/debug/debug-cluster/[Troubleshooting Clusters] |N/A 61 | |Troubleshoot cluster components |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch07.html#idm45322716437792[Troubleshooting Cluster Failures] |https://kubernetes.io/docs/tasks/debug/debug-cluster/[Troubleshooting Clusters] |N/A 62 | |Monitor cluster and application resource usage |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch07.html#idm45322716722240[Monitoring Cluster Components and Applications] |https://github.com/kubernetes-sigs/metrics-server[Metrics Server], https://kubernetes.io/docs/reference/kubectl/generated/kubectl_top/[kubectl top] |N/A 63 | |Manage and evaluate container output streams |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch07.html#idm45322716701616[Troubleshooting Application Failures] |https://kubernetes.io/docs/concepts/cluster-administration/logging/#basic-logging-in-kubernetes[Pod and container logs] |N/A 64 | |Troubleshoot services and networking |https://learning.oreilly.com/library/view/certified-kubernetes-administrator/9781098107215/ch07.html#idm45322716701616[Troubleshooting Application Failures] |https://kubernetes.io/docs/tasks/debug/debug-application/[Troubleshooting Applications] |N/A 65 | |======= 66 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. -------------------------------------------------------------------------------- /app-a/ch07/mongodb-operator/mongodbcommunity.mongodb.com_mongodbcommunity.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | apiVersion: apiextensions.k8s.io/v1 3 | kind: CustomResourceDefinition 4 | metadata: 5 | annotations: 6 | controller-gen.kubebuilder.io/version: v0.11.3 7 | service.binding: path={.metadata.name}-{.spec.users[0].db}-{.spec.users[0].name},objectType=Secret 8 | service.binding/connectionString: path={.metadata.name}-{.spec.users[0].db}-{.spec.users[0].name},objectType=Secret,sourceKey=connectionString.standardSrv 9 | service.binding/password: path={.metadata.name}-{.spec.users[0].db}-{.spec.users[0].name},objectType=Secret,sourceKey=password 10 | service.binding/provider: community 11 | service.binding/type: mongodb 12 | service.binding/username: path={.metadata.name}-{.spec.users[0].db}-{.spec.users[0].name},objectType=Secret,sourceKey=username 13 | creationTimestamp: null 14 | name: mongodbcommunity.mongodbcommunity.mongodb.com 15 | spec: 16 | group: mongodbcommunity.mongodb.com 17 | names: 18 | kind: MongoDBCommunity 19 | listKind: MongoDBCommunityList 20 | plural: mongodbcommunity 21 | shortNames: 22 | - mdbc 23 | singular: mongodbcommunity 24 | scope: Namespaced 25 | versions: 26 | - additionalPrinterColumns: 27 | - description: Current state of the MongoDB deployment 28 | jsonPath: .status.phase 29 | name: Phase 30 | type: string 31 | - description: Version of MongoDB server 32 | jsonPath: .status.version 33 | name: Version 34 | type: string 35 | name: v1 36 | schema: 37 | openAPIV3Schema: 38 | description: MongoDBCommunity is the Schema for the mongodbs API 39 | properties: 40 | apiVersion: 41 | description: 'APIVersion defines the versioned schema of this representation 42 | of an object. Servers should convert recognized schemas to the latest 43 | internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' 44 | type: string 45 | kind: 46 | description: 'Kind is a string value representing the REST resource this 47 | object represents. Servers may infer this from the endpoint the client 48 | submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' 49 | type: string 50 | metadata: 51 | type: object 52 | spec: 53 | description: MongoDBCommunitySpec defines the desired state of MongoDB 54 | properties: 55 | additionalConnectionStringConfig: 56 | description: Additional options to be appended to the connection string. 57 | These options apply to the entire resource and to each user. 58 | nullable: true 59 | type: object 60 | x-kubernetes-preserve-unknown-fields: true 61 | additionalMongodConfig: 62 | description: 'AdditionalMongodConfig is additional configuration that 63 | can be passed to each data-bearing mongod at runtime. Uses the same 64 | structure as the mongod configuration file: https://www.mongodb.com/docs/manual/reference/configuration-options/' 65 | nullable: true 66 | type: object 67 | x-kubernetes-preserve-unknown-fields: true 68 | agent: 69 | description: AgentConfiguration sets options for the MongoDB automation 70 | agent 71 | properties: 72 | logFile: 73 | type: string 74 | logLevel: 75 | type: string 76 | logRotate: 77 | description: LogRotate if enabled, will enable LogRotate for all 78 | processes. 79 | properties: 80 | includeAuditLogsWithMongoDBLogs: 81 | description: set to 'true' to have the Automation Agent rotate 82 | the audit files along with mongodb log files 83 | type: boolean 84 | numTotal: 85 | description: maximum number of log files to have total 86 | type: integer 87 | numUncompressed: 88 | description: maximum number of log files to leave uncompressed 89 | type: integer 90 | percentOfDiskspace: 91 | description: Maximum percentage of the total disk space these 92 | log files should take up. The string needs to be able to 93 | be converted to float64 94 | type: string 95 | sizeThresholdMB: 96 | description: Maximum size for an individual log file before 97 | rotation. The string needs to be able to be converted to 98 | float64. Fractional values of MB are supported. 99 | type: string 100 | timeThresholdHrs: 101 | description: maximum hours for an individual log file before 102 | rotation 103 | type: integer 104 | required: 105 | - sizeThresholdMB 106 | - timeThresholdHrs 107 | type: object 108 | maxLogFileDurationHours: 109 | type: integer 110 | systemLog: 111 | description: SystemLog configures system log of mongod 112 | properties: 113 | destination: 114 | type: string 115 | logAppend: 116 | type: boolean 117 | path: 118 | type: string 119 | required: 120 | - destination 121 | - logAppend 122 | - path 123 | type: object 124 | type: object 125 | arbiters: 126 | description: 'Arbiters is the number of arbiters to add to the Replica 127 | Set. It is not recommended to have more than one arbiter per Replica 128 | Set. More info: https://www.mongodb.com/docs/manual/tutorial/add-replica-set-arbiter/' 129 | type: integer 130 | automationConfig: 131 | description: AutomationConfigOverride is merged on top of the operator 132 | created automation config. Processes are merged by name. Currently 133 | Only the process.disabled field is supported. 134 | properties: 135 | processes: 136 | items: 137 | description: OverrideProcess contains fields that we can override 138 | on the AutomationConfig processes. 139 | properties: 140 | disabled: 141 | type: boolean 142 | logRotate: 143 | description: CrdLogRotate is the crd definition of LogRotate 144 | including fields in strings while the agent supports them 145 | as float64 146 | properties: 147 | includeAuditLogsWithMongoDBLogs: 148 | description: set to 'true' to have the Automation Agent 149 | rotate the audit files along with mongodb log files 150 | type: boolean 151 | numTotal: 152 | description: maximum number of log files to have total 153 | type: integer 154 | numUncompressed: 155 | description: maximum number of log files to leave uncompressed 156 | type: integer 157 | percentOfDiskspace: 158 | description: Maximum percentage of the total disk space 159 | these log files should take up. The string needs to 160 | be able to be converted to float64 161 | type: string 162 | sizeThresholdMB: 163 | description: Maximum size for an individual log file 164 | before rotation. The string needs to be able to be 165 | converted to float64. Fractional values of MB are 166 | supported. 167 | type: string 168 | timeThresholdHrs: 169 | description: maximum hours for an individual log file 170 | before rotation 171 | type: integer 172 | required: 173 | - sizeThresholdMB 174 | - timeThresholdHrs 175 | type: object 176 | name: 177 | type: string 178 | required: 179 | - disabled 180 | - name 181 | type: object 182 | type: array 183 | required: 184 | - processes 185 | type: object 186 | featureCompatibilityVersion: 187 | description: FeatureCompatibilityVersion configures the feature compatibility 188 | version that will be set for the deployment 189 | type: string 190 | members: 191 | description: Members is the number of members in the replica set 192 | type: integer 193 | prometheus: 194 | description: Prometheus configurations. 195 | properties: 196 | metricsPath: 197 | description: Indicates path to the metrics endpoint. 198 | pattern: ^\/[a-z0-9]+$ 199 | type: string 200 | passwordSecretRef: 201 | description: Name of a Secret containing a HTTP Basic Auth Password. 202 | properties: 203 | key: 204 | description: Key is the key in the secret storing this password. 205 | Defaults to "password" 206 | type: string 207 | name: 208 | description: Name is the name of the secret storing this user's 209 | password 210 | type: string 211 | required: 212 | - name 213 | type: object 214 | port: 215 | description: Port where metrics endpoint will bind to. Defaults 216 | to 9216. 217 | type: integer 218 | tlsSecretKeyRef: 219 | description: Name of a Secret (type kubernetes.io/tls) holding 220 | the certificates to use in the Prometheus endpoint. 221 | properties: 222 | key: 223 | description: Key is the key in the secret storing this password. 224 | Defaults to "password" 225 | type: string 226 | name: 227 | description: Name is the name of the secret storing this user's 228 | password 229 | type: string 230 | required: 231 | - name 232 | type: object 233 | username: 234 | description: HTTP Basic Auth Username for metrics endpoint. 235 | type: string 236 | required: 237 | - passwordSecretRef 238 | - username 239 | type: object 240 | replicaSetHorizons: 241 | description: ReplicaSetHorizons Add this parameter and values if you 242 | need your database to be accessed outside of Kubernetes. This setting 243 | allows you to provide different DNS settings within the Kubernetes 244 | cluster and to the Kubernetes cluster. The Kubernetes Operator uses 245 | split horizon DNS for replica set members. This feature allows communication 246 | both within the Kubernetes cluster and from outside Kubernetes. 247 | items: 248 | additionalProperties: 249 | type: string 250 | type: object 251 | type: array 252 | security: 253 | description: Security configures security features, such as TLS, and 254 | authentication settings for a deployment 255 | properties: 256 | authentication: 257 | properties: 258 | agentCertificateSecretRef: 259 | description: 'AgentCertificateSecret is a reference to a Secret 260 | containing the certificate and the key for the automation 261 | agent The secret needs to have available: - certificate 262 | under key: "tls.crt" - private key under key: "tls.key" 263 | If additionally, tls.pem is present, then it needs to be 264 | equal to the concatenation of tls.crt and tls.key' 265 | properties: 266 | name: 267 | description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names 268 | TODO: Add other useful fields. apiVersion, kind, uid?' 269 | type: string 270 | type: object 271 | x-kubernetes-map-type: atomic 272 | agentMode: 273 | description: AgentMode contains the authentication mode used 274 | by the automation agent. 275 | enum: 276 | - SCRAM 277 | - SCRAM-SHA-256 278 | - SCRAM-SHA-1 279 | - X509 280 | type: string 281 | ignoreUnknownUsers: 282 | default: true 283 | nullable: true 284 | type: boolean 285 | modes: 286 | description: Modes is an array specifying which authentication 287 | methods should be enabled. 288 | items: 289 | enum: 290 | - SCRAM 291 | - SCRAM-SHA-256 292 | - SCRAM-SHA-1 293 | - X509 294 | type: string 295 | type: array 296 | required: 297 | - modes 298 | type: object 299 | roles: 300 | description: User-specified custom MongoDB roles that should be 301 | configured in the deployment. 302 | items: 303 | description: CustomRole defines a custom MongoDB role. 304 | properties: 305 | authenticationRestrictions: 306 | description: The authentication restrictions the server 307 | enforces on the role. 308 | items: 309 | description: AuthenticationRestriction specifies a list 310 | of IP addresses and CIDR ranges users are allowed to 311 | connect to or from. 312 | properties: 313 | clientSource: 314 | items: 315 | type: string 316 | type: array 317 | serverAddress: 318 | items: 319 | type: string 320 | type: array 321 | required: 322 | - clientSource 323 | - serverAddress 324 | type: object 325 | type: array 326 | db: 327 | description: The database of the role. 328 | type: string 329 | privileges: 330 | description: The privileges to grant the role. 331 | items: 332 | description: Privilege defines the actions a role is allowed 333 | to perform on a given resource. 334 | properties: 335 | actions: 336 | items: 337 | type: string 338 | type: array 339 | resource: 340 | description: Resource specifies specifies the resources 341 | upon which a privilege permits actions. See https://www.mongodb.com/docs/manual/reference/resource-document 342 | for more. 343 | properties: 344 | anyResource: 345 | type: boolean 346 | cluster: 347 | type: boolean 348 | collection: 349 | type: string 350 | db: 351 | type: string 352 | type: object 353 | required: 354 | - actions 355 | - resource 356 | type: object 357 | type: array 358 | role: 359 | description: The name of the role. 360 | type: string 361 | roles: 362 | description: An array of roles from which this role inherits 363 | privileges. 364 | items: 365 | description: Role is the database role this user should 366 | have 367 | properties: 368 | db: 369 | description: DB is the database the role can act on 370 | type: string 371 | name: 372 | description: Name is the name of the role 373 | type: string 374 | required: 375 | - db 376 | - name 377 | type: object 378 | type: array 379 | required: 380 | - db 381 | - privileges 382 | - role 383 | type: object 384 | type: array 385 | tls: 386 | description: TLS configuration for both client-server and server-server 387 | communication 388 | properties: 389 | caCertificateSecretRef: 390 | description: CaCertificateSecret is a reference to a Secret 391 | containing the certificate for the CA which signed the server 392 | certificates The certificate is expected to be available 393 | under the key "ca.crt" 394 | properties: 395 | name: 396 | description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names 397 | TODO: Add other useful fields. apiVersion, kind, uid?' 398 | type: string 399 | type: object 400 | x-kubernetes-map-type: atomic 401 | caConfigMapRef: 402 | description: CaConfigMap is a reference to a ConfigMap containing 403 | the certificate for the CA which signed the server certificates 404 | The certificate is expected to be available under the key 405 | "ca.crt" This field is ignored when CaCertificateSecretRef 406 | is configured 407 | properties: 408 | name: 409 | description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names 410 | TODO: Add other useful fields. apiVersion, kind, uid?' 411 | type: string 412 | type: object 413 | x-kubernetes-map-type: atomic 414 | certificateKeySecretRef: 415 | description: CertificateKeySecret is a reference to a Secret 416 | containing a private key and certificate to use for TLS. 417 | The key and cert are expected to be PEM encoded and available 418 | at "tls.key" and "tls.crt". This is the same format used 419 | for the standard "kubernetes.io/tls" Secret type, but no 420 | specific type is required. Alternatively, an entry tls.pem, 421 | containing the concatenation of cert and key, can be provided. 422 | If all of tls.pem, tls.crt and tls.key are present, the 423 | tls.pem one needs to be equal to the concatenation of tls.crt 424 | and tls.key 425 | properties: 426 | name: 427 | description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names 428 | TODO: Add other useful fields. apiVersion, kind, uid?' 429 | type: string 430 | type: object 431 | x-kubernetes-map-type: atomic 432 | enabled: 433 | type: boolean 434 | optional: 435 | description: Optional configures if TLS should be required 436 | or optional for connections 437 | type: boolean 438 | required: 439 | - enabled 440 | type: object 441 | type: object 442 | statefulSet: 443 | description: StatefulSetConfiguration holds the optional custom StatefulSet 444 | that should be merged into the operator created one. 445 | properties: 446 | metadata: 447 | description: StatefulSetMetadataWrapper is a wrapper around Labels 448 | and Annotations 449 | properties: 450 | annotations: 451 | additionalProperties: 452 | type: string 453 | type: object 454 | labels: 455 | additionalProperties: 456 | type: string 457 | type: object 458 | type: object 459 | spec: 460 | type: object 461 | x-kubernetes-preserve-unknown-fields: true 462 | required: 463 | - spec 464 | type: object 465 | type: 466 | description: Type defines which type of MongoDB deployment the resource 467 | should create 468 | enum: 469 | - ReplicaSet 470 | type: string 471 | users: 472 | description: Users specifies the MongoDB users that should be configured 473 | in your deployment 474 | items: 475 | properties: 476 | additionalConnectionStringConfig: 477 | description: Additional options to be appended to the connection 478 | string. These options apply only to this user and will override 479 | any existing options in the resource. 480 | nullable: true 481 | type: object 482 | x-kubernetes-preserve-unknown-fields: true 483 | connectionStringSecretName: 484 | description: ConnectionStringSecretName is the name of the secret 485 | object created by the operator which exposes the connection 486 | strings for the user. If provided, this secret must be different 487 | for each user in a deployment. 488 | type: string 489 | db: 490 | default: admin 491 | description: DB is the database the user is stored in. Defaults 492 | to "admin" 493 | type: string 494 | name: 495 | description: Name is the username of the user 496 | type: string 497 | passwordSecretRef: 498 | description: PasswordSecretRef is a reference to the secret 499 | containing this user's password 500 | properties: 501 | key: 502 | description: Key is the key in the secret storing this password. 503 | Defaults to "password" 504 | type: string 505 | name: 506 | description: Name is the name of the secret storing this 507 | user's password 508 | type: string 509 | required: 510 | - name 511 | type: object 512 | roles: 513 | description: Roles is an array of roles assigned to this user 514 | items: 515 | description: Role is the database role this user should have 516 | properties: 517 | db: 518 | description: DB is the database the role can act on 519 | type: string 520 | name: 521 | description: Name is the name of the role 522 | type: string 523 | required: 524 | - db 525 | - name 526 | type: object 527 | type: array 528 | scramCredentialsSecretName: 529 | description: ScramCredentialsSecretName appended by string "scram-credentials" 530 | is the name of the secret object created by the mongoDB operator 531 | for storing SCRAM credentials These secrets names must be 532 | different for each user in a deployment. 533 | pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ 534 | type: string 535 | required: 536 | - name 537 | - roles 538 | type: object 539 | type: array 540 | version: 541 | description: Version defines which version of MongoDB will be used 542 | type: string 543 | required: 544 | - security 545 | - type 546 | - users 547 | type: object 548 | status: 549 | description: MongoDBCommunityStatus defines the observed state of MongoDB 550 | properties: 551 | currentMongoDBArbiters: 552 | type: integer 553 | currentMongoDBMembers: 554 | type: integer 555 | currentStatefulSetArbitersReplicas: 556 | type: integer 557 | currentStatefulSetReplicas: 558 | type: integer 559 | message: 560 | type: string 561 | mongoUri: 562 | type: string 563 | phase: 564 | type: string 565 | version: 566 | type: string 567 | required: 568 | - currentMongoDBMembers 569 | - currentStatefulSetReplicas 570 | - mongoUri 571 | - phase 572 | type: object 573 | type: object 574 | served: true 575 | storage: true 576 | subresources: 577 | status: {} --------------------------------------------------------------------------------