Kubernetes Completo: do Pod ao cluster de produção

apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    app: web
spec:
  containers:
    - name: nginx
      image: nginx:1.27-alpine
      ports:
        - containerPort: 80
      resources:
        requests: { cpu: 100m, memory: 64Mi }
        limits:   { cpu: 500m, memory: 256Mi }

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
spec:
  replicas: 3
  selector:
    matchLabels: { app: api }
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1            # 1 a mais pode existir durante o rollout
      maxUnavailable: 0      # nenhum pode estar indisponível
  template:
    metadata:
      labels: { app: api }
    spec:
      containers:
        - name: api
          image: ghcr.io/me/api:1.2.0
          ports: [{ containerPort: 3000 }]
          env:
            - name: DATABASE_URL
              valueFrom: { secretKeyRef: { name: api-secrets, key: db-url } }
          readinessProbe:
            httpGet: { path: /health, port: 3000 }
            initialDelaySeconds: 3
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /health, port: 3000 }
            initialDelaySeconds: 15
            periodSeconds: 20
          resources:
            requests: { cpu: 100m, memory: 128Mi }
            limits:   { cpu: 500m, memory: 512Mi }

apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  type: ClusterIP
  selector: { app: api }
  ports:
    - port: 80           # a porta do Service
      targetPort: 3000   # a porta do container nos Pods

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    - hosts: [api.meusite.com]
      secretName: api-tls
  rules:
    - host: api.meusite.com
      http:
        paths:
          - path: /v1
            pathType: Prefix
            backend:
              service: { name: api-v1, port: { number: 80 } }
          - path: /v2
            pathType: Prefix
            backend:
              service: { name: api-v2, port: { number: 80 } }

apiVersion: v1
kind: ConfigMap
metadata: { name: app-config }
data:
  LOG_LEVEL: info
  FEATURE_NEW_DASHBOARD: "true"
---
apiVersion: v1
kind: Secret
metadata: { name: app-secrets }
type: Opaque
stringData:
  db-url: postgres://user:pass@db:5432/app
  jwt-key: "super-secret-change-me"
---
# no Pod spec
spec:
  containers:
    - name: app
      image: me/app:1.0
      envFrom:
        - configMapRef: { name: app-config }
      env:
        - name: DB_URL
          valueFrom: { secretKeyRef: { name: app-secrets, key: db-url } }

# PVC dinâmico: o StorageClass provisiona o PV sozinho
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: pg-data }
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: gp3
  resources:
    requests: { storage: 20Gi }
---
apiVersion: v1
kind: Pod
metadata: { name: postgres }
spec:
  containers:
    - name: pg
      image: postgres:16-alpine
      volumeMounts:
        - { name: data, mountPath: /var/lib/postgresql/data }
  volumes:
    - name: data
      persistentVolumeClaim: { claimName: pg-data }

kubectl create namespace staging
kubectl apply -f deployment.yaml -n staging
kubectl get pods -n staging
kubectl config set-context --current --namespace=staging   # fica no ns

# Permite que o SA "deployer" faça qualquer coisa com Deployments em prod
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deployer
  namespace: prod
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployer-bind
  namespace: prod
subjects:
  - kind: ServiceAccount
    name: ci-bot
    namespace: ci
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: deployer

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata: { name: api-hpa }
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 70 }
    - type: Resource
      resource:
        name: memory
        target: { type: Utilization, averageUtilization: 80 }

# instalar um chart público (Postgres oficial do Bitnami)
helm repo add bitnami https://charts.bitnami.com/bitnami
helm install my-pg bitnami/postgresql \
  --namespace data \
  --set auth.postgresPassword=secret \
  --set primary.persistence.size=20Gi

# seu próprio chart
helm create minhaapp          # scaffolds templates/
helm install meuapp ./minhaapp -f values.prod.yaml
helm upgrade meuapp ./minhaapp -f values.prod.yaml
helm rollback meuapp 3        # volta pra revisão 3
helm uninstall meuapp

# Contexto e namespace
kubectl config get-contexts
kubectl config use-context prod
kubectl config set-context --current --namespace=default

# Inspeção
kubectl get pods                      # lista pods no ns atual
kubectl get pods -A                   # todos os namespaces
kubectl get pods -o wide              # + node, IP
kubectl get pods -w                   # watch (live)
kubectl describe pod api-xyz          # tudo sobre o pod (eventos!)
kubectl get events --sort-by=.lastTimestamp

# Logs e exec
kubectl logs -f deploy/api            # segue logs do Deployment
kubectl logs -p pod/api-xyz           # logs do container que morreu (--previous)
kubectl exec -it pod/api-xyz -- sh    # shell no container

# Debug de rede
kubectl run -it --rm curl --image=curlimages/curl -- sh
kubectl port-forward svc/api 8080:80  # acessa service local em http://localhost:8080

# Mudanças rápidas
kubectl scale deploy/api --replicas=5
kubectl set image deploy/api api=me/api:1.3.0
kubectl rollout status deploy/api
kubectl rollout undo deploy/api

# Apply, diff, explain
kubectl apply -f manifests/
kubectl diff -f manifests/            # o que vai mudar
kubectl explain deployment.spec.strategy  # docs do schema direto do cluster

# Copy e debug effêmero
kubectl cp api-xyz:/app/log.txt ./log.txt
kubectl debug pod/api-xyz --image=nicolaka/netshoot  # sidecar de debug