kubectl 命令速查：100+ K8s 命令带常见坑与 YAML 模板

kubectl cluster-info

kubectl cluster-info dump

kubectl get nodes

kubectl get nodes -o wide

kubectl get nodes --show-labels

kubectl top nodes

kubectl top nodes --sort-by=memory

kubectl describe node ip-10-0-1-23

kubectl describe node | grep -A3 Taints

kubectl cordon ip-10-0-1-23

kubectl uncordon ip-10-0-1-23

kubectl drain ip-10-0-1-23 --ignore-daemonsets

kubectl drain ip-10-0-1-23 --ignore-daemonsets --delete-emptydir-data --force

kubectl config current-context

kubectl config get-contexts

kubectl config use-context prod

kubectx prod

kubectl config set-context --current --namespace=staging

kubens staging

kubectl version

kubectl version -o json

kubectl api-resources

kubectl api-resources --namespaced=true

kubectl api-resources --api-group=apps

kubectl explain pod

kubectl explain pod.spec.containers

kubectl explain deployment --recursive

kubectl get componentstatuses

kubectl get --raw=/livez?verbose

kubectl get --raw=/readyz?verbose

kubectl config view --minify

kubectl config view --flatten -o yaml

kubectl config view --raw

kubectl config get-contexts

kubectl config get-contexts -o name

kubectl config delete-context old-prod

kubectl config delete-cluster old-prod

kubectl config delete-user old-prod-admin

kubectl uncordon ip-10-0-1-23

kubectl get nodes | grep SchedulingDisabled

kubectl taint nodes ip-10-0-1-23 gpu=true:NoSchedule

kubectl taint nodes ip-10-0-1-23 gpu=true:NoSchedule-

kubectl describe node ip-10-0-1-23 | grep Taints

kubectl label nodes ip-10-0-1-23 disk=ssd

kubectl label nodes ip-10-0-1-23 disk-

kubectl get nodes -L disk,zone

kubectl get nodes -o wide

kubectl get nodes -o custom-columns=NAME:.metadata.name,RUNTIME:.status.nodeInfo.containerRuntimeVersion

kubectl get --raw=/readyz?verbose

kubectl get --raw=/livez?verbose

kubectl get --raw=/healthz

kubectl api-versions

kubectl api-versions | grep networking

kubectl get pods

kubectl get pods -A

kubectl get pods -o wide

kubectl get pods -w

kubectl get pods -l app=web

kubectl get pod web-7d5 -o yaml

kubectl get pod web-7d5 -o jsonpath="{.status.phase}"

kubectl get pod web-7d5 -o json | jq .status

kubectl describe pod web-7d5

kubectl describe pod web-7d5 | tail -30

kubectl logs web-7d5

kubectl logs web-7d5 -c sidecar

kubectl logs -l app=web --tail=50

kubectl logs -f web-7d5

kubectl logs -f web-7d5 --since=10m

kubectl logs -f deployment/web

kubectl logs --previous web-7d5

kubectl logs -p -c app web-7d5

kubectl exec -it web-7d5 -- bash

kubectl exec -it web-7d5 -- sh

kubectl exec web-7d5 -- ls /app

kubectl exec -it web-7d5 -c sidecar -- sh

kubectl port-forward pod/web-7d5 8080:80

kubectl port-forward svc/web 8080:80

kubectl port-forward deployment/web 8080:80

kubectl cp web-7d5:/var/log/app.log ./app.log

kubectl cp ./fix.patch web-7d5:/tmp/

kubectl cp web-7d5:/data ./data -c sidecar

kubectl attach web-7d5

kubectl attach -it web-7d5 -c app

kubectl delete pod web-7d5

kubectl delete pod web-7d5 --grace-period=0 --force

kubectl delete pods -l app=web

kubectl debug web-7d5 --image=busybox -it

kubectl debug web-7d5 --image=nicolaka/netshoot --target=app

kubectl debug node/ip-10-0-1-23 -it --image=busybox

kubectl run tmp --rm -it --image=busybox -- sh

kubectl run curl --rm -it --image=curlimages/curl -- curl http://web

kubectl run nginx --image=nginx

kubectl logs --since=15m web-7d5

kubectl logs --since=1h -f web-7d5

kubectl logs --since-time=2026-05-25T08:00:00Z web-7d5

kubectl logs --tail=100 web-7d5

kubectl logs --tail=-1 web-7d5 > app.log

kubectl logs --all-containers web-7d5

kubectl logs --all-containers --prefix -l app=web

kubectl logs --timestamps web-7d5

kubectl logs --timestamps --since=10m -f web-7d5

kubectl get pod web-7d5 -o jsonpath='{.status.podIP}'

kubectl get pod web-7d5 -o jsonpath='{range .spec.containers[*]}{.name}{"\t"}{.image}{"\n"}{end}'

kubectl get pods -o jsonpath='{.items[*].metadata.name}'

kubectl exec web-7d5 -- env

kubectl exec web-7d5 -- env | grep DATABASE

kubectl exec web-7d5 -c app -- printenv LOG_LEVEL

kubectl exec web-7d5 -- cat /etc/resolv.conf

kubectl exec web-7d5 -- nslookup kubernetes.default

kubectl get svc -n kube-system kube-dns

kubectl debug node/ip-10-0-1-23 -it --image=busybox

kubectl debug node/ip-10-0-1-23 -it --image=ubuntu -- chroot /host

kubectl debug web-7d5 --copy-to=web-debug --set-image=app=busybox -it -- sh

kubectl debug web-7d5 --copy-to=web-debug --container=app -- sleep 1d

kubectl get pods --sort-by=.status.startTime

kubectl get pods --sort-by=.status.containerStatuses[0].restartCount

kubectl get pods -o custom-columns=NAME:.metadata.name,NODE:.spec.nodeName,RESTARTS:.status.containerStatuses[0].restartCount

kubectl get pods -o custom-columns=POD:.metadata.name,IMAGE:.spec.containers[*].image

kubectl get pod web-7d5 -o yaml | kubectl neat

kubectl krew install neat

kubectl create deployment web --image=nginx

kubectl create deployment web --image=nginx --replicas=3 --port=80

kubectl get deployments

kubectl get deploy -A

kubectl get deploy web -o yaml

kubectl scale deployment web --replicas=3

kubectl scale deployment web --replicas=0

kubectl scale --replicas=5 -f deployment.yaml

kubectl rollout status deployment/web

kubectl rollout status deployment/web --timeout=2m

kubectl rollout history deployment/web

kubectl rollout history deployment/web --revision=3

kubectl rollout undo deployment/web

kubectl rollout undo deployment/web --to-revision=3

kubectl rollout restart deployment/web

kubectl rollout restart statefulset/db

kubectl rollout restart daemonset/log-agent

kubectl autoscale deployment web --min=2 --max=10 --cpu-percent=70

kubectl get hpa

kubectl describe hpa web

kubectl get rs

kubectl get rs -l app=web

kubectl describe rs web-7d5f44

kubectl get sts

kubectl describe sts db

kubectl delete sts db --cascade=orphan

kubectl get ds

kubectl get ds -A

kubectl rollout restart ds/log-agent

kubectl get jobs

kubectl get cronjobs

kubectl create job manual-job --from=cronjob/backup

kubectl expose deployment web --port=80 --target-port=8080

kubectl expose deployment web --type=NodePort --port=80

kubectl expose deployment web --type=LoadBalancer --port=80

kubectl get hpa

kubectl describe hpa web

kubectl delete hpa web

kubectl get pdb

kubectl create pdb web-pdb --selector=app=web --min-available=2

kubectl describe deployment web

kubectl describe deploy web | grep -A5 Conditions

kubectl set env deployment/web LOG_LEVEL=debug

kubectl set env deployment/web LOG_LEVEL-

kubectl set env deployment/web --from=configmap/app-config

kubectl set resources deployment/web --limits=cpu=1,memory=512Mi --requests=cpu=200m,memory=256Mi

kubectl set resources deployment/web -c=app --limits=memory=1Gi

kubectl create cronjob backup --image=backup:latest --schedule="0 2 * * *" -- /backup.sh

kubectl create cronjob ping --image=busybox --schedule="*/5 * * * *" -- echo hello

kubectl create job manual-backup --from=cronjob/backup

kubectl get jobs -l job-name=manual-backup

kubectl rollout status statefulset/db

kubectl rollout status sts/db --timeout=5m

kubectl scale statefulset db --replicas=5

kubectl scale sts db --replicas=1

kubectl get cronjob

kubectl patch cronjob backup -p '{"spec":{"suspend":true}}'

kubectl get cronjob backup -o jsonpath='{.status.lastScheduleTime}'

kubectl describe hpa web

kubectl get hpa web -o yaml | grep -A10 conditions

kubectl rollout undo statefulset/db

kubectl rollout history statefulset/db

kubectl get svc

kubectl get svc -A

kubectl get svc -o wide

kubectl get endpoints web

kubectl get endpointslices -l kubernetes.io/service-name=web

kubectl port-forward svc/web 8080:80

kubectl port-forward svc/db 5432:5432 -n staging

kubectl get ingress

kubectl describe ingress web

kubectl get ingressclass

kubectl get netpol

kubectl describe netpol deny-all

kubectl get netpol -A

kubectl proxy

kubectl proxy --port=9090

curl http://127.0.0.1:8001/api/v1/namespaces

kubectl describe ingress web

kubectl get ingress web -o jsonpath='{.status.loadBalancer.ingress[0].ip}'

kubectl get endpointslices

kubectl get endpointslices -l kubernetes.io/service-name=web

kubectl describe endpointslice web-abc12

kubectl get svc web -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

kubectl get svc web -o jsonpath='{.spec.clusterIP}'

kubectl get svc web -o jsonpath='{.spec.ports[0].nodePort}'

kubectl create service clusterip web --tcp=80:8080

kubectl create service nodeport web --tcp=80:8080 --node-port=30080

kubectl get ingressclass

kubectl get ingressclass -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.annotations.ingressclass\.kubernetes\.io/is-default-class}{"\n"}{end}'

kubectl create configmap app-config --from-literal=LOG_LEVEL=info --from-literal=DEBUG=1

kubectl create configmap app-config --from-literal=DATABASE_HOST=db.local

kubectl create configmap nginx-conf --from-file=./nginx.conf

kubectl create configmap site-conf --from-file=./conf.d/

kubectl get cm

kubectl get cm app-config -o yaml

kubectl get cm -A

kubectl create secret generic db --from-literal=password=s3cret

kubectl create secret generic api --from-literal=token=abc123

kubectl create secret docker-registry ghcr-pull --docker-server=ghcr.io --docker-username=user --docker-password=$TOKEN

kubectl create secret docker-registry ecr-pull --docker-server=123.dkr.ecr.us-east-1.amazonaws.com --docker-username=AWS --docker-password=$(aws ecr get-login-password)

kubectl get secret db -o jsonpath="{.data.password}" | base64 -d

kubectl get secret api -o json | jq -r ".data.token | @base64d"

kubectl get secret

kubectl get secret -A

kubectl get secret db -o yaml

kubectl create secret tls web-tls --cert=tls.crt --key=tls.key

kubectl get secret web-tls -o yaml

kubectl get pvc

kubectl get pv

kubectl describe pvc data-db-0

kubectl create configmap app-env --from-env-file=.env

kubectl create secret generic app-env --from-env-file=.env.production

kubectl get configmap app-config -o jsonpath='{.data.LOG_LEVEL}'

kubectl get cm app-config -o jsonpath='{.data}'

kubectl edit secret db

echo -n "newpass" | base64

kubectl create secret generic ssh-key --from-file=id_rsa=/home/me/.ssh/id_rsa

kubectl create secret generic kubeconfig --from-file=config=/home/me/.kube/config

kubectl describe pvc data-db-0

kubectl get storageclass

kubectl get pvc -o wide

kubectl get storageclass

kubectl get sc

kubectl patch storageclass gp2 -p '{"metadata":{"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'

kubectl get pv

kubectl get pv -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,CLAIM:.spec.claimRef.name

kubectl patch pv pv-001 -p '{"spec":{"claimRef":null}}'

kubectl get ns

kubectl create ns staging

kubectl delete ns old-staging

kubectl get sa

kubectl create sa ci-bot

kubectl get sa default -o yaml

kubectl create role pod-reader --verb=get,list,watch --resource=pods

kubectl create role app-admin --verb=* --resource=deployments,services

kubectl create rolebinding ci-pods --role=pod-reader --serviceaccount=ci:ci-bot

kubectl create rolebinding admin-binding --clusterrole=admin --user=alice

kubectl create clusterrole node-reader --verb=get,list --resource=nodes

kubectl create clusterrolebinding viewer --clusterrole=view --user=alice

kubectl auth can-i delete pods

kubectl auth can-i --list -n staging

kubectl auth can-i get secrets --as system:serviceaccount:default:my-bot

kubectl create token ci-bot

kubectl create token ci-bot --duration=1h

kubectl create token default -n ci > /tmp/token

kubectl create ns staging

kubectl create ns prod --dry-run=client -o yaml > ns.yaml

kubectl auth can-i --list

kubectl auth can-i --list -n kube-system

kubectl auth can-i --list --as=system:serviceaccount:ci:ci-bot

kubectl auth whoami

kubectl auth whoami -o yaml

kubectl get clusterrolebinding

kubectl get clusterrolebinding -o jsonpath='{range .items[?(@.roleRef.name=="cluster-admin")]}{.metadata.name}{"\n"}{end}'

kubectl describe clusterrole view

kubectl describe clusterrole edit

kubectl get clusterrole admin -o yaml

kubectl create rolebinding ci-edit --clusterrole=edit --serviceaccount=ci:ci-bot -n ci

kubectl create rolebinding read-only --clusterrole=view --user=alice -n staging

kubectl get rolebinding,clusterrolebinding -A -o wide

kubectl get clusterrolebinding -o wide | grep alice

kubectl top pods

kubectl top pods --sort-by=memory

kubectl top pods --containers -A

kubectl get events --sort-by=.lastTimestamp

kubectl get events -A --sort-by=.lastTimestamp

kubectl get events --field-selector involvedObject.name=web-7d5

kubectl wait --for=condition=Ready pod/web-7d5 --timeout=60s

kubectl wait --for=condition=Available deployment/web --timeout=2m

kubectl wait --for=delete pod/old-7d5 --timeout=30s

kubectl get pods -w

kubectl get pods -w -l app=web

kubectl get pods -w -o wide

kubectl get pods --field-selector=status.phase=Failed -A

kubectl get pods --field-selector=status.phase=Pending

kubectl get pods --field-selector=spec.nodeName=ip-10-0-1-23

kubectl get all

kubectl get all -A

kubectl get all -n staging -o wide

kubectl top pod web-7d5 --containers

kubectl top pod -l app=web --containers --sort-by=memory

kubectl get events --field-selector type=Warning --sort-by=.lastTimestamp

kubectl get events -A --field-selector type=Warning --sort-by=.lastTimestamp

kubectl get events --field-selector involvedObject.name=web-7d5

kubectl get events --field-selector involvedObject.kind=Deployment,involvedObject.name=web

kubectl get pods -A -o wide --field-selector spec.nodeName=ip-10-0-1-23

kubectl get pods -A --field-selector spec.nodeName=ip-10-0-1-23 -o name | wc -l

kubectl wait --for=jsonpath='{.status.phase}'=Running pod/web-7d5 --timeout=60s

kubectl wait --for=jsonpath='{.status.loadBalancer.ingress}' svc/web --timeout=5m

kubectl get pods --watch-only

kubectl get pods --watch-only -o json | jq .status.phase

kubectl top node --sort-by=cpu

kubectl top node --sort-by=memory

kubectl apply -f deployment.yaml

kubectl apply -f ./k8s/

kubectl apply -f - <<EOF
apiVersion: v1
kind: ConfigMap
...
EOF

kubectl apply -k ./overlays/prod

kubectl kustomize ./overlays/prod | kubectl apply -f -

kubectl create -f job.yaml

kubectl create -f - <<EOF
...
EOF

kubectl replace -f svc.yaml

kubectl replace --force -f pod.yaml

kubectl patch deployment web -p '{"spec":{"replicas":5}}'

kubectl patch pod web -p '{"metadata":{"labels":{"env":"prod"}}}'

kubectl patch deployment web --type=json -p='[{"op":"replace","path":"/spec/replicas","value":3}]'

kubectl edit deployment web

KUBE_EDITOR="code -w" kubectl edit cm app-config

kubectl diff -f deployment.yaml

kubectl diff -k ./overlays/prod

kubectl label pods web-7d5 env=prod

kubectl label pods web-7d5 env-

kubectl label nodes ip-10-0-1-23 disk=ssd

kubectl annotate pods web-7d5 owner=team-foo

kubectl annotate svc web service.beta.kubernetes.io/aws-load-balancer-type=nlb

kubectl delete -f deployment.yaml

kubectl delete -k ./overlays/staging

kubectl apply --server-side -f deployment.yaml

kubectl apply --server-side --force-conflicts -f deployment.yaml

kubectl rollout pause deployment/web

kubectl set image deployment/web app=nginx:1.27 && kubectl set env deployment/web LOG=info && kubectl rollout resume deployment/web

kubectl set image deployment/web app=nginx:1.27

kubectl set image deploy/web app=myorg/app@sha256:abc123

kubectl rollout status deployment/web -w

kubectl apply -f deploy.yaml && kubectl rollout status deployment/web --timeout=3m

kubectl apply -f deployment.yaml --dry-run=server

kubectl apply -f deployment.yaml --dry-run=client -o yaml

kubectl apply -f ./k8s/ --prune -l app=web

kubectl apply -f ./k8s/ --prune -l app=web --dry-run=client

kubectl create deployment web --image=nginx --dry-run=client -o yaml > deploy.yaml

kubectl create configmap c --from-literal=k=v --dry-run=client -o yaml

kubectl get deployment web -o yaml --show-managed-fields

kubectl get deployment web -o jsonpath='{.metadata.managedFields[*].manager}'

kubectl delete pods --all -n staging

kubectl delete jobs --all -n batch

kubectl delete pods --all --grace-period=0 --force -n staging

kubectl delete deployment web --cascade=orphan

kubectl delete statefulset db --cascade=orphan

kubectl rollout resume deployment/web

kubectl rollout pause deploy/web && kubectl set image deploy/web app=nginx:1.27 && kubectl set resources deploy/web --limits=memory=512Mi && kubectl rollout resume deploy/web

kubectl kustomize ./overlays/prod

kubectl kustomize ./overlays/prod | kubectl diff -f -

kubectl annotate deployment web kubectl.kubernetes.io/last-applied-configuration-

kubectl apply --server-side --force-conflicts -f deployment.yaml

kubectl describe pod web-7d5 | tail -20

kubectl get events --sort-by=.lastTimestamp -n default

kubectl create secret docker-registry ghcr --docker-server=ghcr.io --docker-username=user --docker-password=$TOKEN

kubectl logs web-7d5 --previous

kubectl describe pod web-7d5 | grep -A2 "Last State"

kubectl get pod web-7d5 -o jsonpath="{.status.containerStatuses[*].lastState}"

kubectl get pods --field-selector=status.phase=Failed -A

kubectl delete pods --field-selector=status.phase=Failed -A

kubectl describe node ip-10-0-1-23 | grep -A5 Conditions

kubectl get pod web-7d5 -o jsonpath="{.status.containerStatuses[*].lastState.terminated.reason}"

kubectl describe pod web-7d5 | grep -A2 "Limits:"

kubectl top pod web-7d5 --containers

kubectl describe pod web-7d5 | grep -A5 Events

kubectl get nodes -o custom-columns=NAME:.metadata.name,CPU:.status.allocatable.cpu,MEM:.status.allocatable.memory

kubectl get nodes --show-labels

kubectl delete pod web-7d5 --grace-period=0 --force

kubectl patch pod web-7d5 -p '{"metadata":{"finalizers":null}}' --type=merge

kubectl get pod web-7d5 -o yaml | grep finalizers -A3

kubectl logs web-7d5 -c wait-for-db

kubectl describe pod web-7d5 | grep -A5 "Init Containers"

kubectl run dnsutils --rm -it --image=busybox -- nslookup ghcr.io

kubectl logs -n kube-system -l k8s-app=kube-dns --tail=50

kubectl get pods -n kube-system -l k8s-app=kube-dns

kubectl describe pod web-7d5 | grep -A3 Events

kubectl get secret db -o jsonpath='{.data}'

kubectl get cm app-config -o jsonpath='{.data}'

kubectl describe pod web-7d5 | grep -A2 "State:"

kubectl get pod web-7d5 -o jsonpath='{.status.containerStatuses[0].state.waiting.message}'

kubectl describe pod web-7d5 | grep -A5 Events

kubectl get pvc

kubectl get volumeattachment

kubectl logs web-7d5 --previous

kubectl get pod web-7d5 -o jsonpath='{.spec.nodeName}'

kubectl get node ip-10-0-1-23 -o jsonpath='{.status.nodeInfo.architecture}'

kubectl describe pod web-7d5 | grep -A3 -i probe

kubectl get pod web-7d5 -o jsonpath='{.spec.containers[0].readinessProbe}'

kubectl exec web-7d5 -- wget -qO- localhost:8080/healthz

kubectl describe pod web-7d5 | grep -A5 Events

kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.taints}{"\n"}{end}'

kubectl get node ip-10-0-1-23

kubectl describe node ip-10-0-1-23 | grep -A5 Conditions

kubectl get pods -A --field-selector spec.nodeName=ip-10-0-1-23

kubectl get nodes

kubectl describe node ip-10-0-1-23 | grep -A8 Conditions

kubectl get pods -A -o wide --field-selector spec.nodeName=ip-10-0-1-23

apiVersion: v1
kind: Pod
metadata:
  name: web
  labels:
    app: web
spec:
  containers:
  - name: app
    image: nginx:1.27-alpine
    ports:
    - containerPort: 80
    resources:
      requests: { cpu: 100m, memory: 128Mi }
      limits:   { cpu: 500m, memory: 256Mi }

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
  labels: { app: web }
spec:
  replicas: 3
  selector:
    matchLabels: { app: web }
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }
  template:
    metadata:
      labels: { app: web }
    spec:
      containers:
      - name: app
        image: nginx:1.27-alpine
        ports: [{ containerPort: 80 }]
        readinessProbe:
          httpGet: { path: /, port: 80 }
          periodSeconds: 5
        livenessProbe:
          httpGet: { path: /, port: 80 }
          periodSeconds: 30
        resources:
          requests: { cpu: 100m, memory: 128Mi }
          limits:   { cpu: 500m, memory: 256Mi }

apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  type: ClusterIP
  selector: { app: web }
  ports:
  - name: http
    port: 80
    targetPort: 80

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  LOG_LEVEL: info
  DATABASE_HOST: db.local
---
# In your Deployment template.spec.containers[0]:
envFrom:
- configMapRef:
    name: app-config

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
spec:
  ingressClassName: nginx
  rules:
  - host: web.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web
            port:
              number: 80

apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup
spec:
  schedule: "0 2 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: Never
          containers:
          - name: backup
            image: backup:1.0
            command: ["/backup.sh"]

apiVersion: batch/v1
kind: Job
metadata:
  name: migrate
spec:
  completions: 1
  parallelism: 1
  backoffLimit: 3
  activeDeadlineSeconds: 600
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: migrate
        image: migrate:1.0
        command: ["/run-migration.sh"]

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web
  minReplicas: 2
  maxReplicas: 10
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
  metrics:
  - type: Resource
    resource:
      name: cpu
      target: { type: Utilization, averageUtilization: 70 }
  - type: Resource
    resource:
      name: memory
      target: { type: Utilization, averageUtilization: 80 }

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: gp3
  resources:
    requests:
      storage: 10Gi

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes: ["Ingress"]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
spec:
  podSelector:
    matchLabels: { app: web }
  policyTypes: ["Ingress"]
  ingress:
  - from:
    - podSelector:
        matchLabels: { role: frontend }
    ports:
    - protocol: TCP
      port: 8080

apiVersion: v1
kind: ServiceAccount
metadata:
  name: pod-reader
  namespace: app
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: app
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-reader
  namespace: app
subjects:
- kind: ServiceAccount
  name: pod-reader
  namespace: app
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io