Kubernetes

apiVersion: apps/v1
kind: Deployment
metadata:
  name: messaging-api
  labels:
    app: messaging-api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: messaging-api
  template:
    metadata:
      labels:
        app: messaging-api
    spec:
      containers:
        - name: api
          image: registry.example.com/messaging-api:1.2.0
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: messaging-api
spec:
  selector:
    app: messaging-api
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: messaging-api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: messaging-api
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

## Diagnostics

```bash
kubectl get pods -A -o wide
kubectl describe pod <name> -n <namespace>
kubectl logs <pod> -c <container> --tail=100 -f
kubectl exec -it <pod> -- /bin/bash
kubectl top pods -n <namespace>
```

## Troubleshooting CrashLoopBackOff

1. `kubectl logs <pod> --previous` — check last crash output
2. `kubectl describe pod <pod>` — look at Events section
3. Verify image pull secrets and resource limits
4. Check liveness/readiness probe endpoints

## Rolling Updates

```bash
kubectl set image deployment/myapp app=myapp:v2.0
kubectl rollout status deployment/myapp
kubectl rollout undo deployment/myapp  # rollback
```

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              name: database
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53