Kubernetes manifests cheatsheet

Kubernetes manifests: Scaling and access control

5 common Kubernetes manifests tasks.

Autoscale on CPU

Scale a Deployment between 2 and 10 replicas to keep CPU near 70%. Needs metrics-server.

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

PodDisruptionBudget

Keep at least two pods available during voluntary disruptions such as node drains.

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: web

ServiceAccount

Give pods an identity for API access.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app

Role and RoleBinding

Allow a service account to read pods in one namespace.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
subjects:
  - kind: ServiceAccount
    name: app
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Schedule onto matching nodes

Require nodes with a label, and tolerate a taint.

nodeSelector:
  disktype: ssd
tolerations:
  - key: dedicated
    operator: Equal
    value: gpu
    effect: NoSchedule