Kubernetes 完整教學手冊
從零開始，把所有技術都講給你聽

apiVersion: v1
kind: Pod
metadata:
  name: nginx-demo
spec:
  containers:
  - name: nginx
    image: nginx:1.14.2
    ports:
    - containerPort: 80

apiVersion: v1
kind: Pod
metadata:
  name: myapp-pod
spec:
  containers:
  - name: myapp-container
    image: busybox:1.28
    command: ['sh', '-c', 'echo The app is running! && sleep 3600']
  initContainers:               # 主容器啟動前先跑這些
  - name: init-myservice
    image: busybox:1.28
    command: ['sh', '-c', "until nslookup myservice; do echo waiting; sleep 2; done"]

spec:
  containers:
    - name: myapp
      image: alpine:latest
  initContainers:
    - name: logshipper
      image: alpine:latest
      restartPolicy: Always   # 👈 設成 Always 就變成 sidecar
      command: ['sh', '-c', 'tail -F /opt/logs.txt']

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 3            # 👈 我要 3 個副本，K8s 幫我維持
  selector:
    matchLabels:
      app: nginx
  template:               # 👇 每個 Pod 長什麼樣
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

$ kubectl set image deployment/nginx-deployment nginx=nginx:1.16.1
$ kubectl rollout status deployment/nginx-deployment   # 看更新進度
$ kubectl rollout undo deployment/nginx-deployment     # 退回上一版
$ kubectl rollout history deployment/nginx-deployment  # 看版本歷史

apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  clusterIP: None          # Headless Service：給每個 Pod 穩定 DNS
  selector:
    app: nginx
  ports:
  - port: 80
    name: web
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  serviceName: "nginx"
  replicas: 3             # 會建立 web-0, web-1, web-2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: registry.k8s.io/nginx-slim:0.24
        volumeMounts:
        - name: www
          mountPath: /usr/share/nginx/html
  volumeClaimTemplates:        # 👈 每個 Pod 自動獲得專屬硬碟
  - metadata:
      name: www
    spec:
      accessModes: [ "ReadWriteOnce" ]
      resources:
        requests:
          storage: 1Gi

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd-elasticsearch
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: fluentd-elasticsearch
  template:
    metadata:
      labels:
        name: fluentd-elasticsearch
    spec:
      containers:
      - name: fluentd-elasticsearch
        image: quay.io/fluentd_elasticsearch/fluentd:v5.0.1
        volumeMounts:
        - name: varlog
          mountPath: /var/log
      volumes:
      - name: varlog
        hostPath:
          path: /var/log

apiVersion: batch/v1
kind: Job
metadata:
  name: distributed-training
spec:
  parallelism: 8
  completions: 8
  completionMode: Indexed
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: trainer
        image: training-image:latest

apiVersion: batch/v1
kind: CronJob
metadata:
  name: daily-backup
spec:
  schedule: "0 2 * * *"      # 每天 02:00 觸發
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
          - name: backup
            image: backup-tool:1.0

apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app.kubernetes.io/name: MyApp   # 撈這個標籤的 Pod
  ports:
    - protocol: TCP
      port: 80         # Service 對外的埠
      targetPort: 9376 # 轉接到 Pod 的埠
  type: LoadBalancer

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minimal-ingress
spec:
  ingressClassName: nginx-example
  rules:
  - http:
      paths:
      - path: /testpath
        pathType: Prefix
        backend:
          service:
            name: test
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
spec:
  podSelector:
    matchLabels:
      role: db          # 這條規則套用在 role=db 的 Pod
  policyTypes:
  - Ingress
  - Egress
  ingress:                # 誰可以連進來
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 6379
  egress:                 # 可以連出去哪
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24

# 完整：<service>.<namespace>.svc.cluster.local
my-service.default.svc.cluster.local
# 同一個 namespace 內可直接用短名：
my-service

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: myclaim
spec:
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
      storage: 8Gi
  storageClassName: slow

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: low-latency
provisioner: csi-driver.example-vendor.example
reclaimPolicy: Retain          # 預設是 Delete
allowVolumeExpansion: true      # 允許之後擴大容量
volumeBindingMode: WaitForFirstConsumer

apiVersion: v1
kind: Pod
metadata:
  name: envvars-multiple-secrets
spec:
  containers:
  - name: envars-test-container
    image: nginx
    env:
    - name: BACKEND_USERNAME
      valueFrom:
        secretKeyRef:
          name: backend-user
          key: backend-username

resources:
  requests:
    cpu: "100m"      # 100 milliCPU = 0.1 顆 CPU
    memory: "200Mi"
  limits:
    cpu: "2"
    memory: "200Mi"

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 5   # 啟動後等幾秒才開始檢查
  periodSeconds: 10       # 每 10 秒檢查一次
readinessProbe:
  httpGet:
    path: /ready
    port: 8080

tolerations:
- key: "key1"
  operator: "Equal"
  value: "value1"
  effect: "NoSchedule"

$ kubectl taint nodes node1 key1=value1:NoSchedule
$ kubectl taint nodes node1 key1=value1:NoSchedule-   # 結尾加 - 移除

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]   # 只能讀 Pod
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]

apiVersion: v1
kind: Namespace
metadata:
  name: my-baseline-namespace
  labels:
    pod-security.kubernetes.io/enforce: baseline
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/audit: restricted

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: php-apache
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: php-apache
  minReplicas: 1
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 50   # 平均 CPU 超過 50% 就擴展

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: crontabs.example.com   # 格式：<複數>.<群組>
spec:
  group: example.com
  scope: Namespaced
  names:
    plural: crontabs
    singular: crontab
    kind: CronTab
    shortNames: [ct]
  versions:
  - name: v1
    served: true
    storage: true
    schema:
      openAPIV3Schema:
        type: object
        properties:
          host: { type: string }

$ helm repo add bitnami https://charts.bitnami.com/bitnami
$ helm install my-db bitnami/mysql      # 一鍵安裝 MySQL
$ helm list                             # 看已安裝的 release
$ helm upgrade my-db bitnami/mysql      # 升級
$ helm uninstall my-db                  # 移除