Kubernetes YAML Manifests - CodeSwordsman

Copy-ready Kubernetes manifests: Deployment with probes and limits, Service and Ingress, ConfigMap and Secret, PVC storage, HPA and ResourceQuota for deploy-to-scale workflows.

Kubernetes 1.28+Updated 2026-10-3020 commands

Workloads

Minimal Deployment; pin a version tag instead of latest

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: web
          image: registry.example.com/web:1.0.0
          ports:
            - containerPort: 8080

Declare requests and limits so one Pod cannot starve a node; requests drive scheduling

          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi

Readiness gates traffic, liveness restarts the container; use distinct endpoints

          readinessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 30
            failureThreshold: 3

Start new Pods before stopping old ones for zero downtime, at the cost of extra capacity

  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0

Scheduled job using a standard cron expression; timezone follows the controller

apiVersion: batch/v1
kind: CronJob
metadata:
  name: report
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: Never
          containers:
            - name: report
              image: registry.example.com/report:1.0.0

Service & Ingress

In-cluster entry; the selector must match Pod labels or Endpoints stay empty

apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  selector:
    app: web
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP

Expose through a node port; nodePort must fall in 30000-32767

  type: NodePort
  ports:
    - port: 80
      targetPort: 8080
      nodePort: 30080

Host and TLS entry; create the certificate Secret before applying

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - app.example.com
      secretName: app-tls
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80

When a Service is unreachable, check Endpoints first, then the Ingress address

kubectl get endpoints web -n <NS>
kubectl get ingress web -n <NS>

ConfigMap & Secret

Store a config file in a ConfigMap and mount it as a file

kubectl create configmap app-config --from-file=app.conf -n <NS>

Inject every key from a ConfigMap and Secret as environment variables

          envFrom:
            - configMapRef:
                name: app-config
            - secretRef:
                name: app-secret

Mount a Secret as read-only files for certificates and keys

          volumeMounts:
            - name: tls
              mountPath: /etc/tls
              readOnly: true
      volumes:
        - name: tls
          secret:
            secretName: app-tls

stringData accepts plaintext; inject it externally rather than committing it

apiVersion: v1
kind: Secret
metadata:
  name: app-secret
stringData:
  password: <PASSWORD>
type: Opaque

Secrets are base64-encoded, not encrypted; pair with RBAC and encryption at rest.

Storage

Request persistent storage; accessModes control multi-attach behavior

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: app-data
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: standard
  resources:
    requests:
      storage: 10Gi

Custom StorageClass; Retain keeps data when the PVC is deleted

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ssd
provisioner: kubernetes.io/aws-ebs
reclaimPolicy: Retain
allowVolumeExpansion: true

Mount the PVC into the container; replicas needing shared writes require RWX storage

          volumeMounts:
            - name: data
              mountPath: /var/lib/app
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: app-data

Operations

Create a namespace and apply manifests with -n <NS>

kubectl create namespace <NS>

Cap total namespace resources so one team cannot exhaust the cluster

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-quota
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi

Scale on CPU utilization; containers must declare requests first

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

Layer environment differences with kustomize instead of duplicating manifests

kubectl apply -k overlays/prod -n <NS>