Kubernetes Cookbook
“How would you do X?” — practical, production-ready recipes with the approach, full code, pitfalls and variations.
Kubernetes
- Autoscale a Deployment on CPU and memoryAdd and remove replicas automatically as load changes, without flapping.
- Debug a distroless pod with an ephemeral containerThe pod has no shell or tools; inspect it without changing the image.
- Default-deny network policies that keep DNS workingLock down pod traffic in a namespace without breaking name resolution.
- Enforce the restricted Pod Security StandardStop anyone from deploying privileged or root containers into application namespaces.
- Expose a service over HTTPS with automatic certificatesServe an app on a domain with TLS certificates that renew themselves.
- Give a CI pipeline least-privilege deploy accessCI deploys with cluster-admin; restrict it to one namespace and the resources it manages.
- Handle SIGTERM in your application for KubernetesPods drop in-flight requests or jobs when they're terminated.
- Manage dev, staging and prod with Kustomize overlaysCopies of manifests per environment drift apart.
- Restart pods automatically when configuration changesEdited ConfigMaps don't reach running pods; make configuration changes roll out like code.
- Right-size requests with VPA recommendationsRequests were guessed at launch; find better values from real usage without risking restarts.
- Roll out without dropping requestsDeploys and scale-downs cause a burst of 502 errors.
- Run a stateful service with stable identitiesPods of a clustered system need stable names and their own storage.
- Run database migrations as a Job before the new versionMigrations race with new pods, or run once per replica from the entrypoint.
- Run scheduled jobs reliably with CronJobsNightly jobs sometimes run twice, overlap, or silently stop running.
- Send a percentage of traffic to a new version with the Gateway APIRelease a new version to 10% of users first, then increase.
- Set namespace quotas and default resourcesTeams deploy pods without requests, and one namespace can consume the whole cluster.
- Survive node drains and zone outagesNode upgrades or a zone failure take all replicas of a service down at once.
- Sync secrets from a cloud secret managerKeep secret values out of Git while workloads still get Kubernetes Secrets.
- Wait for dependencies at startup without init container hacksPods crash-loop while a database or another service is still starting.
- Write a production-ready DeploymentStart new services from a Deployment that has the probes, resources and security settings production needs.