120 minutes / 17 tasks                          = 7.0 min per task
- 10 minutes of final review                    = 6.4 min per task
- ~30 s reading the statement and switching context = 5.9 min per task

kubectl config use-context rutas-norte-dev
kubectl config set-context --current --namespace=rutas-norte-dev

apiVersion: v1
kind: Pod
metadata:
  name: bookings-api-with-sidecar
  namespace: rutas-norte-dev
spec:
  initContainers:
  - name: wait-for-postgres         # classic initContainer: blocks until it finishes
    image: busybox:1.36
    command: ['sh', '-c', 'until nc -z bookings-postgres 5432; do sleep 2; done']
  - name: log-collector             # NATIVE sidecar (1.29+): never finishes
    image: busybox:1.36
    restartPolicy: Always
    command: ['sh', '-c', 'tail -F /var/log/api/app.log']
    volumeMounts:
    - { name: logs, mountPath: /var/log/api }
  containers:
  - name: api
    image: node:20-alpine
    command: ['sh', '-c', 'while true; do date >> /var/log/api/app.log; sleep 5; done']
    volumeMounts:
    - { name: logs, mountPath: /var/log/api }
  volumes:
  - name: logs
    emptyDir: {}

apiVersion: batch/v1
kind: CronJob
metadata: { name: occupancy-reports, namespace: rutas-norte-pro }
spec:
  schedule: "0 3 * * *"
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 1800
      template:
        spec:
          restartPolicy: OnFailure        # mandatory: never "Always"
          containers:
          - name: reports
            image: rutas-norte/reports:1.4

    startupProbe:
      httpGet: { path: /healthz, port: 3000 }
      failureThreshold: 30
      periodSeconds: 5          # up to 150 s of headroom to start
    readinessProbe:
      httpGet: { path: /ready, port: 3000 }
      periodSeconds: 10
    livenessProbe:
      httpGet: { path: /healthz, port: 3000 }
      periodSeconds: 15
      failureThreshold: 3

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    fsGroup: 2000
  containers:
  - name: api
    image: rutas-norte/bookings-api:2.3
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
        add: ["NET_BIND_SERVICE"]

    env:
    - name: LOG_LEVEL                      # 1. individual variable
      valueFrom:
        configMapKeyRef: { name: api-config, key: log_level }
    - name: DB_PASSWORD                    # 1b. from a Secret
      valueFrom:
        secretKeyRef: { name: bookings-postgres-credentials, key: password }
    envFrom:
    - configMapRef: { name: api-config }   # 2. all the keys
    - secretRef: { name: bookings-postgres-credentials }
    volumeMounts:
    - { name: config, mountPath: /etc/config, readOnly: true }
  volumes:
  - name: config
    configMap:
      name: api-config
      items:                               # 4. only one key (without items → way 3)
      - { key: app.conf, path: app.conf }

k create configmap api-config --from-literal=log_level=info --from-literal=timeout=30
k create configmap file-config --from-file=app.conf
k create secret generic bookings-postgres-credentials \
  --from-literal=username=bookings --from-literal=password='S3cr3t!'
k create secret docker-registry regcred --docker-server=registry.rutasnorte.es \
  --docker-username=ci --docker-password=xxx
k create secret tls web-store-tls --cert=tls.crt --key=tls.key

k set image deployment/bookings-api api=rutas-norte/bookings-api:2.4
k rollout status deployment/bookings-api
k rollout history deployment/bookings-api
k rollout history deployment/bookings-api --revision=3
k rollout undo deployment/bookings-api                  # to the PREVIOUS revision
k rollout undo deployment/bookings-api --to-revision=2

# Pause to group several changes into a single rollout
k rollout pause deployment/bookings-api
k set resources deployment/bookings-api -c=api --limits=memory=512Mi
k rollout resume deployment/bookings-api

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # extra pods allowed above replicas
      maxUnavailable: 0    # none may be missing → deployment with no downtime

# Deny everything in the namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: deny-all, namespace: rutas-norte-pro }
spec:
  podSelector: {}          # {} = every pod in the namespace
  policyTypes: [Ingress, Egress]
---
# Allow bookings-api to talk to postgres and resolve DNS
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: api-egress, namespace: rutas-norte-pro }
spec:
  podSelector:
    matchLabels: { app: bookings-api }
  policyTypes: [Egress]
  egress:
  - to:
    - podSelector:
        matchLabels: { app: bookings-postgres }
    ports:
    - { protocol: TCP, port: 5432 }
  - to:                          # DNS: you almost always have to allow it
    - namespaceSelector:
        matchLabels: { kubernetes.io/metadata.name: kube-system }
    ports:
    - { protocol: UDP, port: 53 }

  # A) ONE entry with two selectors (AND): pods app=api IN namespaces environment=pro
  - namespaceSelector: { matchLabels: { environment: pro } }
    podSelector: { matchLabels: { app: api } }

  # B) TWO entries (OR): any pod in namespaces environment=pro, PLUS
  #    the app=api pods of the policy's own namespace
  - namespaceSelector: { matchLabels: { environment: pro } }
  - podSelector: { matchLabels: { app: api } }

alias k=kubectl
export do='--dry-run=client -o yaml'
export now='--force --grace-period=0'
source <(kubectl completion bash)
complete -o default -F __start_kubectl k

# Pods
k run web-store --image=nginx:1.27-alpine $do > pod.yaml
k run debug --image=busybox:1.36 $do --command -- sleep 3600 > debug.yaml
k run api --image=node:20 --labels=app=api,tier=backend --port=3000 \
  --env=LOG_LEVEL=debug $do > api.yaml

# Deployments and Services
k create deployment bookings-api --image=rutas-norte/api:2.3 --replicas=3 $do > deploy.yaml
k expose deployment bookings-api --port=80 --target-port=3000 --name=api-svc $do > svc.yaml
k create service clusterip api-svc --tcp=80:3000 $do > svc.yaml
k create service nodeport store-svc --tcp=80:80 --node-port=30080 $do > svc.yaml

# Configuration, jobs, Ingress and RBAC
k create configmap api-config --from-literal=level=info $do > cm.yaml
k create secret generic cred --from-literal=pass=xxx $do > sec.yaml
k create job migration --image=rutas-norte/migrate:1.0 $do > job.yaml
k create cronjob reports --image=rutas-norte/reports:1.4 --schedule="0 3 * * *" $do \
  -- /bin/sh -c "reports.sh" > cj.yaml
k create ingress store --rule="www.rutasnorte.es/*=web-store-svc:80" $do > ing.yaml
k create serviceaccount support $do > sa.yaml
k create role reader --verb=get,list --resource=pods $do > role.yaml
k create rolebinding reader-b --role=reader --serviceaccount=ns:support $do > rb.yaml
k create quota qa-quota --hard=cpu=4,memory=8Gi,pods=20 $do > quota.yaml
k create poddisruptionbudget api-pdb --selector=app=api --min-available=2 $do > pdb.yaml

k explain pod.spec.containers.livenessProbe --recursive
k explain pod.spec.securityContext --recursive
k explain cronjob.spec --recursive
k explain networkpolicy | head -3        # recall the correct apiVersion
k api-resources | grep -i policy

# One-shot pods, to check connectivity or DNS
k run test --image=busybox:1.36 --rm -it --restart=Never -- wget -qO- api-svc:80
k run dns  --image=busybox:1.36 --rm -it --restart=Never -- nslookup api-svc

# Modify existing objects without touching YAML
k scale deployment bookings-api --replicas=5
k autoscale deployment bookings-api --min=2 --max=10 --cpu-percent=70
k set image deployment/bookings-api api=rutas-norte/api:2.4
k set resources deployment/bookings-api -c=api --limits=cpu=500m,memory=512Mi
k set serviceaccount deployment/bookings-api support
k set env deployment/bookings-api LOG_LEVEL=debug
k set env deployment/bookings-api --from=configmap/api-config
k label pod web-store environment=pro --overwrite
k annotate deployment bookings-api kubernetes.io/change-cause="bump to 2.4"
k cp rutas-norte-pro/bookings-api-abc:/var/log/app.log ./app.log

k get events -n rutas-norte-pro --sort-by=.lastTimestamp     # the most useful when debugging
k get pods -A --sort-by=.status.containerStatuses[0].restartCount
k get pods -o name
k get pod bookings-api-abc -o jsonpath='{.status.podIP}'
k get pods -o custom-columns=NAME:.metadata.name,NODE:.spec.nodeName,STATUS:.status.phase
k get pods --field-selector status.phase=Running
k get pods -l 'environment in (pre,pro)'
k get pods -l '!app'                                  # pods WITHOUT the app label
k logs -l app=bookings-api --tail=50 --all-containers=true
k logs bookings-api-abc -c sidecar --previous          # the container before the crash

cat <<'EOF' > ~/.vimrc
set number
set expandtab
set tabstop=2
set shiftwidth=2
set softtabstop=2
set autoindent
set paste
EOF

# Replicas
k patch deployment bookings-api -p '{"spec":{"replicas":5}}'

# Image of a specific container (strategic merge)
k patch deployment bookings-api \
  -p '{"spec":{"template":{"spec":{"containers":[{"name":"api","image":"rutas-norte/api:2.4"}]}}}}'

# Type of a Service
k patch svc web-store-svc -p '{"spec":{"type":"NodePort"}}'

# JSON patch to replace one exact field
k patch pv pv-reports --type='json' \
  -p='[{"op":"replace","path":"/spec/persistentVolumeReclaimPolicy","value":"Retain"}]'

# Multi-line YAML (handy for lists)
k patch deployment notifications-worker --type='strategic' -p '
spec:
  template:
    spec:
      tolerations:
      - { key: dedicated, operator: Equal, value: batch, effect: NoSchedule }'

k get job migration -o yaml > job.yaml   # edit, remove status and volatile metadata
k delete job migration && k apply -f job.yaml

apiVersion: v1
kind: Pod
metadata: { name: occupancy-reports, namespace: rutas-norte-dev }
spec:
  containers:
  - name: generator
    image: busybox:1.36
    command: ['sh', '-c', 'while true; do date >> /data/occupancy.log; sleep 5; done']
    volumeMounts: [{ name: data, mountPath: /data }]
  - name: reader
    image: busybox:1.36
    command: ['sh', '-c', 'tail -F /data/occupancy.log']
    volumeMounts: [{ name: data, mountPath: /data }]
  volumes:
  - name: data
    emptyDir: {}

k logs occupancy-reports -c reader -n rutas-norte-dev

Wed Aug  6 09:14:22 UTC 2026
Wed Aug  6 09:14:27 UTC 2026

k create configmap api-config --from-literal=log_level=debug \
  --from-literal=max_connections=50 -n rutas-norte-dev
k create secret generic bookings-postgres-credentials --from-literal=username=bookings \
  --from-literal=password='Nort3!2026' -n rutas-norte-dev
k run bookings-api --image=nginx:1.27-alpine $do -n rutas-norte-dev > api.yaml

spec:
  containers:
  - name: bookings-api
    image: nginx:1.27-alpine
    envFrom:
    - configMapRef: { name: api-config }
    volumeMounts:
    - { name: secrets, mountPath: /etc/secrets, readOnly: true }
  volumes:
  - name: secrets
    secret: { secretName: bookings-postgres-credentials }

k exec bookings-api -n rutas-norte-dev -- env | grep -E 'log_level|max_connections'
k exec bookings-api -n rutas-norte-dev -- cat /etc/secrets/username

log_level=debug
max_connections=50
bookings

k create cronjob nightly-reports --image=busybox:1.36 --schedule="0 3 * * *" \
  -n rutas-norte-pro $do -- /bin/sh -c "echo report generated" > cj.yaml

spec:
  schedule: "0 3 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: OnFailure
          containers:
          - name: nightly-reports
            image: busybox:1.36
            command: ["/bin/sh", "-c", "echo report generated"]

k create job test --from=cronjob/nightly-reports -n rutas-norte-pro
k logs job/test -n rutas-norte-pro

report generated

        startupProbe:
          httpGet: { path: /healthz, port: 3000 }
          periodSeconds: 10
          failureThreshold: 12        # 12 x 10s = 120 s of headroom
        readinessProbe:
          httpGet: { path: /ready, port: 3000 }
          periodSeconds: 10
        livenessProbe:
          httpGet: { path: /healthz, port: 3000 }
          periodSeconds: 10
          failureThreshold: 3

k rollout status deployment/bookings-api -n rutas-norte-pre
k describe pod -l app=bookings-api -n rutas-norte-pre | grep -E 'Liveness|Readiness|Startup'

k patch deployment web-store -n rutas-norte-pro -p '
spec:
  strategy:
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }'

k set image deployment/web-store web-store=nginx:1.27.2-alpine -n rutas-norte-pro
k annotate deployment web-store -n rutas-norte-pro \
  kubernetes.io/change-cause="update to nginx 1.27.2" --overwrite
k rollout status deployment/web-store -n rutas-norte-pro
k rollout history deployment/web-store -n rutas-norte-pro

REVISION  CHANGE-CAUSE
1         <none>
2         update to nginx 1.27.2

k rollout undo deployment/web-store -n rutas-norte-pro
k get deployment web-store -n rutas-norte-pro \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

nginx:1.27-alpine

apiVersion: v1
kind: Pod
metadata: { name: notifications-worker, namespace: rutas-norte-pro }
spec:
  securityContext:
    runAsUser: 10001
    runAsGroup: 3000
    runAsNonRoot: true
  containers:
  - name: worker
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities: { drop: ["ALL"] }

k exec notifications-worker -n rutas-norte-pro -- id
k exec notifications-worker -n rutas-norte-pro -- touch /test

uid=10001 gid=3000
touch: /test: Read-only file system

k expose deployment web-store --name=web-store-svc --port=80 --target-port=80 \
  -n rutas-norte-pro
k create ingress store-ingress -n rutas-norte-pro --class=nginx \
  --rule="www.rutasnorte.es/*=web-store-svc:80"

k describe ingress store-ingress -n rutas-norte-pro | grep -A4 Rules
k get endpoints web-store-svc -n rutas-norte-pro

Rules:
  Host                Path  Backends
  ----                ----  --------
  www.rutasnorte.es   /     web-store-svc:80 (10.244.1.9:80,10.244.2.4:80)

k get pods -n rutas-norte-dev

NAME          READY   STATUS                       RESTARTS   AGE
redis-cache   0/1     CreateContainerConfigError   0          4m

k describe pod redis-cache -n rutas-norte-dev | tail -6

Events:
  Warning  Failed  2m (x12 over 4m)  kubelet
    Error: configmap "redis-config" not found

k create configmap redis-config --from-literal=maxmemory=256mb -n rutas-norte-dev
k get pods -n rutas-norte-dev
echo "The pod referenced the ConfigMap redis-config, which does not exist in the namespace" \
  > /opt/diagnosis.txt

# 1 (≈90 s)
k create deployment web-store --image=nginx:1.27-alpine --replicas=4
k create service nodeport web-store --tcp=80:80 --node-port=30080

# 2 (≈60 s)
k create configmap web-config --from-literal=environment=dev --from-literal=cache=on
k set env deployment/web-store --from=configmap/web-config

# 3 (≈150 s): generate and add completions/parallelism
k create job db-migration --image=busybox:1.36 $do -- /bin/sh -c "echo migrated" > job.yaml

spec:
  completions: 3
  parallelism: 2
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: db-migration
        image: busybox:1.36
        command: ["/bin/sh", "-c", "echo migrated"]

k apply -f job.yaml
# 4 (≈30 s)
k autoscale deployment web-store --min=2 --max=8 --cpu-percent=70
# 5 (≈30 s)
k get pods --sort-by=.metadata.name -o name > /opt/pods.txt

apiVersion: v1
kind: Pod
metadata: { name: bookings-api-full, namespace: rutas-norte-pre }
spec:
  securityContext: { runAsNonRoot: true, runAsUser: 10001 }
  initContainers:
  - name: wait-for-db
    image: busybox:1.36
    command: ['sh', '-c', 'until nc -z bookings-postgres 5432; do sleep 2; done']
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  - name: logs
    image: busybox:1.36
    restartPolicy: Always            # native sidecar (1.29+)
    command: ['sh', '-c', 'tail -F /var/log/nginx/access.log']
    volumeMounts: [{ name: nginx-logs, mountPath: /var/log/nginx }]
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  containers:
  - name: api
    image: nginx:1.27-alpine
    ports: [{ containerPort: 80 }]
    resources:
      requests: { cpu: 100m, memory: 128Mi }
      limits:   { cpu: 200m, memory: 256Mi }
    readinessProbe:
      httpGet: { path: /, port: 80 }
      initialDelaySeconds: 5
    livenessProbe:
      httpGet: { path: /, port: 80 }
      periodSeconds: 15
      failureThreshold: 3
    volumeMounts: [{ name: nginx-logs, mountPath: /var/log/nginx }]
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  volumes:
  - name: nginx-logs
    emptyDir: {}

k get pods -n rutas-norte-dev -o wide                    # 1. what is not Running
k describe pod <name> -n rutas-norte-dev | tail -20      # 2. the events: 80 % of cases
k logs <name> -n rutas-norte-dev --previous              # 3. if it starts and dies
k get endpoints -n rutas-norte-dev                       # 4. if the problem is the Service
k get pods --show-labels -n rutas-norte-dev              #    do they match the selector?
k get events -n rutas-norte-dev --sort-by=.lastTimestamp | tail -20

cat <<'EOF' > /opt/diagnosis.txt
1. web-store: ErrImagePull due to nonexistent tag nginx:9.9 -> corrected to 1.27-alpine
2. bookings-api: CreateContainerConfigError, the Secret bookings-postgres-credentials was missing -> created
3. redis-cache-svc: no endpoints, selector app=redis against label app=redis-cache -> corrected
EOF