From kubectl apply to running Kubernetes in production

$ git clone https://github.com/georgesmomo/k8s-helm-lab && cd k8s-helm-lab
$ kind create cluster --name lab --config kind/cluster.yaml
$ docker build -t kubelab:1.0.0 --build-arg VERSION=1.0.0 app
$ docker build -t kubelab:1.1.0 --build-arg VERSION=1.1.0 app
$ kind load docker-image kubelab:1.0.0 kubelab:1.1.0 --name lab
$ kubectl get nodes

$ kind create cluster --name lab --image kindest/node:v1.37.1 --config sandbox/cluster.yaml1
Creating cluster "lab" ...
 • Ensuring node image (kindest/node:v1.37.1) 🖼️  ...
 ✓ Ensuring node image (kindest/node:v1.37.1) 🖼️
 • Preparing nodes 📦 📦 📦   ...
 ✓ Preparing nodes 📦 📦 📦 
 • Writing configuration 📜  ...
 ✓ Writing configuration 📜
 • Starting control-plane 🕹️  ...2
 ✓ Starting control-plane 🕹️
 • Installing CNI 🔌  ...3
 ✓ Installing CNI 🔌
 • Installing StorageClass 💾  ...
 ✓ Installing StorageClass 💾
 • Joining worker nodes 🚜  ...4
 ✓ Joining worker nodes 🚜
Set kubectl context to "kind-lab"5
You can now use your cluster with:

kubectl cluster-info --context kind-lab

Not sure what to do next? 😅  Check out https://kind.sigs.k8s.io/docs/user/quick-start/
$ kind load docker-image kubelab:1.0.0 --name lab
Image: "kubelab:1.0.0" with ID "sha256:43d4df4f6144d0c9566116de29de84574a2d4297e643b59266b14b9f6d2fb481" not yet present on node "lab-worker", loading...6
Image: "kubelab:1.0.0" with ID "sha256:43d4df4f6144d0c9566116de29de84574a2d4297e643b59266b14b9f6d2fb481" not yet present on node "lab-control-plane", loading...
Image: "kubelab:1.0.0" with ID "sha256:43d4df4f6144d0c9566116de29de84574a2d4297e643b59266b14b9f6d2fb481" not yet present on node "lab-worker2", loading...

# kind create cluster --name lab --config kind/cluster.yaml
# 1 control plane + 2 workers: enough to see scheduling, drains and PDBs in action.
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
    extraPortMappings:            # HTTP access from your machine to the cluster (NodePort 30080)
      - containerPort: 30080
        hostPort: 8080
  - role: worker
  - role: worker

$ kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
$ kubectl -n kube-system patch deployment metrics-server --type=json -p '[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'
$ kubectl top nodes

$ kubectl get nodes -o wide
NAME                STATUS   ROLES           AGE     VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE           KERNEL-VERSION            CONTAINER-RUNTIME1
lab-control-plane   Ready    control-plane   3m37s   v1.37.1   172.18.0.3    <none>        Ubuntu 24.04 LTS   6.18.44-fc-v139 (amd64)   containerd://2.3.62
lab-worker          Ready    <none>          3m26s   v1.37.1   172.18.0.4    <none>        Ubuntu 24.04 LTS   6.18.44-fc-v139 (amd64)   containerd://2.3.63
lab-worker2         Ready    <none>          3m26s   v1.37.1   172.18.0.2    <none>        Ubuntu 24.04 LTS   6.18.44-fc-v139 (amd64)   containerd://2.3.6

$ kubectl get pods -n kube-system -o wide
NAME                                        READY   STATUS    RESTARTS   AGE     IP           NODE                NOMINATED NODE   READINESS GATES
coredns-559f6c778d-s6929                    1/1     Running   0          3m27s   10.244.0.2   lab-control-plane   <none>           <none>1
coredns-559f6c778d-v8djj                    1/1     Running   0          3m27s   10.244.0.4   lab-control-plane   <none>           <none>
etcd-lab-control-plane                      1/1     Running   0          3m34s   172.18.0.3   lab-control-plane   <none>           <none>2
kindnet-lhdzr                               1/1     Running   0          3m26s   172.18.0.4   lab-worker          <none>           <none>3
kindnet-sf4p2                               1/1     Running   0          3m26s   172.18.0.2   lab-worker2         <none>           <none>
kindnet-tvmvn                               1/1     Running   0          3m28s   172.18.0.3   lab-control-plane   <none>           <none>
kube-apiserver-lab-control-plane            1/1     Running   0          3m34s   172.18.0.3   lab-control-plane   <none>           <none>
kube-controller-manager-lab-control-plane   1/1     Running   0          3m34s   172.18.0.3   lab-control-plane   <none>           <none>
kube-proxy-dx7f2                            1/1     Running   0          3m26s   172.18.0.4   lab-worker          <none>           <none>4
kube-proxy-lqv5z                            1/1     Running   0          3m28s   172.18.0.3   lab-control-plane   <none>           <none>
kube-proxy-x5zbp                            1/1     Running   0          3m26s   172.18.0.2   lab-worker2         <none>           <none>
kube-scheduler-lab-control-plane            1/1     Running   0          3m34s   172.18.0.3   lab-control-plane   <none>           <none>
metrics-server-84c99cb944-vz687             1/1     Running   0          2m30s   10.244.1.2   lab-worker2         <none>           <none>5

$ docker exec lab-control-plane ls -l /etc/kubernetes/manifests
total 16
-rw------- 1 root root 2602 Oct 19 15:32 etcd.yaml
-rw------- 1 root root 3968 Oct 19 15:32 kube-apiserver.yaml1
-rw------- 1 root root 3263 Oct 19 15:32 kube-controller-manager.yaml
-rw------- 1 root root 1726 Oct 19 15:32 kube-scheduler.yaml
$ docker exec lab-control-plane crictl ps --name kube-apiserver
CONTAINER           IMAGE               CREATED             STATE               NAME                ATTEMPT             POD ID              POD                                NAMESPACE
8db08e2d84ce5       4c77c50dd64d9       3 minutes ago       Running             kube-apiserver      0                   b65688f6e7a05       kube-apiserver-lab-control-plane   kube-system2
$ docker exec lab-control-plane sh -c "grep -E -- '--(etcd-servers|service-cluster-ip-range|authorization-mode|enable-admission-plugins)' /etc/kubernetes/manifests/kube-apiserver.yaml"
    - --authorization-mode=Node,RBAC3
    - --enable-admission-plugins=NodeRestriction
    - --etcd-servers=https://127.0.0.1:23794
    - --service-cluster-ip-range=10.96.0.0/165

$ kubectl config get-contexts
CURRENT   NAME       CLUSTER    AUTHINFO   NAMESPACE
*         kind-lab   kind-lab   kind-lab   1
$ kubectl cluster-info
Kubernetes control plane is running at https://127.0.0.1:431292
CoreDNS is running at https://127.0.0.1:43129/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

$ kubectl api-resources --api-group=apps
NAME                  SHORTNAMES   APIVERSION   NAMESPACED   KIND
controllerrevisions                apps/v1      true         ControllerRevision
daemonsets            ds           apps/v1      true         DaemonSet
deployments           deploy       apps/v1      true         Deployment1
replicasets           rs           apps/v1      true         ReplicaSet
statefulsets          sts          apps/v1      true         StatefulSet
$ kubectl api-resources --namespaced=false | head -12
NAME                                SHORTNAMES   APIVERSION                        NAMESPACED   KIND
componentstatuses                   cs           v1                                false        ComponentStatus
namespaces                          ns           v1                                false        Namespace
nodes                               no           v1                                false        Node2
persistentvolumes                   pv           v1                                false        PersistentVolume
mutatingadmissionpolicies                        admissionregistration.k8s.io/v1   false        MutatingAdmissionPolicy3
mutatingadmissionpolicybindings                  admissionregistration.k8s.io/v1   false        MutatingAdmissionPolicyBinding
mutatingwebhookconfigurations                    admissionregistration.k8s.io/v1   false        MutatingWebhookConfiguration
validatingadmissionpolicies                      admissionregistration.k8s.io/v1   false        ValidatingAdmissionPolicy
validatingadmissionpolicybindings                admissionregistration.k8s.io/v1   false        ValidatingAdmissionPolicyBinding
validatingwebhookconfigurations                  admissionregistration.k8s.io/v1   false        ValidatingWebhookConfiguration
customresourcedefinitions           crd,crds     apiextensions.k8s.io/v1           false        CustomResourceDefinition

$ kubectl explain deployment.spec.strategy.rollingUpdate
GROUP:      apps
KIND:       Deployment
VERSION:    v1

FIELD: rollingUpdate <RollingUpdateDeployment>


DESCRIPTION:
    Rolling update config params. Present only if DeploymentStrategyType =
    RollingUpdate.
    Spec to control the desired behavior of rolling update.
    
FIELDS:
  maxSurge	<IntOrString>1
    The maximum number of pods that can be scheduled above the desired number of
    pods. Value can be an absolute number (ex: 5) or a percentage of desired
    pods (ex: 10%). This can not be 0 if MaxUnavailable is 0. Absolute number is
    calculated from percentage by rounding up. Defaults to 25%. Example: when
    this is set to 30%, the new ReplicaSet can be scaled up immediately when the
    rolling update starts, such that the total number of old and new pods do not
    exceed 130% of desired pods. Once old pods have been killed, new ReplicaSet
    can be scaled up further, ensuring that total number of pods running at any
    time during the update is at most 130% of desired pods.

  maxUnavailable	<IntOrString>2
    The maximum number of pods that can be unavailable during the update. Value
    can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%).
    Absolute number is calculated from percentage by rounding down. This can not
    be 0 if MaxSurge is 0. Defaults to 25%. Example: when this is set to 30%,
    the old ReplicaSet can be scaled down to 70% of desired pods immediately
    when the rolling update starts. Once new pods are ready, old ReplicaSet can
    be scaled down further, followed by scaling up the new ReplicaSet, ensuring
    that the total number of pods available at all times during the update is at
    least 70% of desired pods.

          startupProbe:
            httpGet: {path: /healthz, port: http}
            periodSeconds: 2
            failureThreshold: 30
          readinessProbe:                 # removes the pod from the Service when it fails
            httpGet: {path: /readyz, port: http}
            periodSeconds: 5
          livenessProbe:                  # restarts the container when it fails
            httpGet: {path: /healthz, port: http}
            periodSeconds: 10
            failureThreshold: 3

# Job: run a task until it succeeds. CronJob: schedule it.
apiVersion: batch/v1
kind: Job
metadata: {name: smoke-test, namespace: kubelab}
spec:
  backoffLimit: 2
  activeDeadlineSeconds: 120
  ttlSecondsAfterFinished: 600
  template:
    metadata: {labels: {role: client}}
    spec:
      restartPolicy: Never
      containers:
        - name: check
          image: kubelab:1.0.0
          args: ["check", "http://kubelab.kubelab.svc.cluster.local/", "Bonjour"]
          resources: {requests: {cpu: 10m, memory: 16Mi}, limits: {memory: 64Mi}}
          securityContext: {runAsNonRoot: true, runAsUser: 65532, allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: [ALL]}, seccompProfile: {type: RuntimeDefault}}
---
apiVersion: batch/v1
kind: CronJob
metadata: {name: nightly-check, namespace: kubelab}
spec:
  schedule: "0 3 * * *"
  timeZone: Europe/Paris
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      backoffLimit: 1
      template:
        metadata: {labels: {role: client}}
        spec:
          restartPolicy: Never
          containers:
            - name: check
              image: kubelab:1.0.0
              args: ["check", "http://kubelab.kubelab.svc.cluster.local/healthz"]
              resources: {requests: {cpu: 10m, memory: 16Mi}, limits: {memory: 64Mi}}
              securityContext: {runAsNonRoot: true, runAsUser: 65532, allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: [ALL]}, seccompProfile: {type: RuntimeDefault}}

# Non-sensitive configuration: injected as environment variables and mounted as a file.
apiVersion: v1
kind: ConfigMap
metadata:
  name: kubelab-config
  namespace: kubelab
  labels:
    app.kubernetes.io/name: kubelab
data:
  MESSAGE: "Bonjour depuis Kubernetes"
  app.properties: |
    log.level=info
    feature.newCheckout=false

# Teaching example only. In a real company NEVER commit a plain-text Secret:
# use External Secrets Operator (Vault, AWS/GCP Secret Manager) or Sealed Secrets/SOPS.
apiVersion: v1
kind: Secret
metadata:
  name: kubelab-secret
  namespace: kubelab
  labels:
    app.kubernetes.io/name: kubelab
type: Opaque
stringData:
  DATABASE_URL: "postgres://kubelab:change-me@db.kubelab.svc:5432/kubelab"

# Stable address (virtual IP + DNS name kubelab.kubelab.svc.cluster.local) in front of the ready pods.
apiVersion: v1
kind: Service
metadata:
  name: kubelab
  namespace: kubelab
  labels:
    app.kubernetes.io/name: kubelab
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: kubelab
  ports:
    - name: http
      port: 80
      targetPort: http

# HTTP exposure with the Gateway API (the successor of Ingress). Requires a controller
# (Envoy Gateway, Traefik, Cilium, NGINX Gateway Fabric...) and a Gateway named "public".
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: kubelab
  namespace: kubelab
spec:
  parentRefs:
    - name: public
      namespace: gateway-system
  hostnames: ["kubelab.localtest.me"]
  rules:
    - matches:
        - path: {type: PathPrefix, value: /}
      backendRefs:
        - name: kubelab
          port: 80

# Zero-trust networking: deny all ingress, then open only what is needed.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: kubelab
spec:
  podSelector: {}
  policyTypes: [Ingress]
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-http-to-kubelab
  namespace: kubelab
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: kubelab
  policyTypes: [Ingress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kubelab
          podSelector:
            matchLabels:
              role: client
      ports:
        - port: 8080
          protocol: TCP

# StatefulSet: stable identity (kubelab-db-0, -1...), one volume per pod, guaranteed startup order.
apiVersion: v1
kind: Service
metadata: {name: kubelab-db, namespace: kubelab}
spec:
  clusterIP: None              # "headless" Service: one DNS record per pod
  selector: {app: kubelab-db}
  ports: [{name: http, port: 8080}]
---
apiVersion: apps/v1
kind: StatefulSet
metadata: {name: kubelab-db, namespace: kubelab}
spec:
  serviceName: kubelab-db
  replicas: 2
  selector: {matchLabels: {app: kubelab-db}}
  template:
    metadata: {labels: {app: kubelab-db}}
    spec:
      securityContext: {runAsNonRoot: true, runAsUser: 65532, fsGroup: 65532, seccompProfile: {type: RuntimeDefault}}
      containers:
        - name: app
          image: kubelab:1.0.0
          env:
            - {name: DATA_DIR, value: /data}
            - name: POD_NAME
              valueFrom: {fieldRef: {fieldPath: metadata.name}}
          ports: [{name: http, containerPort: 8080}]
          volumeMounts: [{name: data, mountPath: /data}]
          resources: {requests: {cpu: 10m, memory: 16Mi}, limits: {memory: 64Mi}}
          securityContext: {allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: [ALL]}}
  volumeClaimTemplates:
    - metadata: {name: data}
      spec:
        accessModes: [ReadWriteOnce]
        resources: {requests: {storage: 100Mi}}

$ kubectl apply -f workloads/statefulset.yaml
service/kubelab-db created
statefulset.apps/kubelab-db created
$ kubectl -n kubelab rollout status sts/kubelab-db --timeout=180s
Waiting for 2 pods to be ready...1
Waiting for 2 pods to be ready...
Waiting for 1 pods to be ready...
Waiting for 1 pods to be ready...
partitioned roll out complete: 2 new pods have been updated...
$ kubectl -n kubelab get sts kubelab-db
NAME         READY   AGE
kubelab-db   2/2     8s
$ kubectl -n kubelab get pods -l app=kubelab-db -o wide
NAME           READY   STATUS    RESTARTS   AGE   IP            NODE          NOMINATED NODE   READINESS GATES
kubelab-db-0   1/1     Running   0          8s    10.244.1.19   lab-worker2   <none>           <none>2
kubelab-db-1   1/1     Running   0          3s    10.244.2.37   lab-worker    <none>           <none>
$ kubectl -n kubelab get pvc
NAME                STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   VOLUMEATTRIBUTESCLASS   AGE
data-kubelab-db-0   Bound    pvc-6b687f17-ad35-4f93-a09c-dd82609b8536   100Mi      RWO            standard       <unset>                 8s3
data-kubelab-db-1   Bound    pvc-5eed3485-848e-427e-b0c7-97b860f4d476   100Mi      RWO            standard       <unset>                 4s
$ kubectl get pv
NAME                                       CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                       STORAGECLASS   VOLUMEATTRIBUTESCLASS   REASON   AGE4
pvc-5eed3485-848e-427e-b0c7-97b860f4d476   100Mi      RWO            Delete           Bound    kubelab/data-kubelab-db-1   standard       <unset>                          1s
pvc-6b687f17-ad35-4f93-a09c-dd82609b8536   100Mi      RWO            Delete           Bound    kubelab/data-kubelab-db-0   standard       <unset>                          5s

$ kubectl -n tools run dns --image=busybox:1.36 --restart=Never -- nslookup kubelab-db-0.kubelab-db.kubelab.svc.cluster.local
pod/dns created
$ kubectl -n tools logs dns
Server:		10.96.0.10
Address:	10.96.0.10:53


Name:	kubelab-db-0.kubelab-db.kubelab.svc.cluster.local1
Address: 10.244.1.192

# Horizontal autoscaling on CPU utilisation (requires metrics-server).
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: kubelab
  namespace: kubelab
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: kubelab
  minReplicas: 3
  maxReplicas: 6
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70        # % of the CPU requests
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 60

$ kubectl -n kubelab top pods -l app.kubernetes.io/name=kubelab
NAME                       CPU(cores)   MEMORY(bytes)   
kubelab-6b777469b9-4mn6b   297m         1Mi             1
kubelab-6b777469b9-5ws4r   317m         2Mi             
kubelab-6b777469b9-b5454   306m         1Mi             
kubelab-6b777469b9-gb5fz   265m         1Mi             
kubelab-6b777469b9-w9hj4   289m         2Mi             
kubelab-6b777469b9-xtcdh   313m         1Mi             
$ kubectl -n kubelab get hpa kubelab
NAME      REFERENCE            TARGETS         MINPODS   MAXPODS   REPLICAS   AGE
kubelab   Deployment/kubelab   cpu: 595%/70%   3         6         6          4m18s2
$ kubectl -n kubelab get deploy kubelab
NAME      READY   UP-TO-DATE   AVAILABLE   AGE
kubelab   6/6     6            6           4m18s3
$ kubectl -n kubelab get events --field-selector reason=SuccessfulRescale -o custom-columns=AGE:.lastTimestamp,OBJET:.involvedObject.name,MESSAGE:.message
AGE                    OBJET     MESSAGE
2026-10-19T15:38:45Z   kubelab   New size: 6; reason: cpu resource utilization (percentage of request) above target4

# During a node drain or a cluster upgrade: keep at least 2 pods running.
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: kubelab
  namespace: kubelab
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: kubelab

# Namespace guardrails: an overall ceiling (quota) and per-container defaults (LimitRange).
apiVersion: v1
kind: ResourceQuota
metadata:
  name: kubelab-quota
  namespace: kubelab
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 2Gi
    limits.memory: 4Gi
    pods: "20"
    persistentvolumeclaims: "5"
---
apiVersion: v1
kind: LimitRange
metadata:
  name: kubelab-defaults
  namespace: kubelab
spec:
  limits:
    - type: Container
      defaultRequest:
        cpu: 50m
        memory: 32Mi
      default:
        memory: 128Mi
      max:
        memory: 1Gi

# RBAC: a developer can read everything and restart Deployments in kubelab, but cannot read Secrets.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: developer, namespace: kubelab}
rules:
  - apiGroups: ["", "apps", "batch", "autoscaling", "policy"]
    resources: ["pods", "pods/log", "services", "endpoints", "configmaps", "deployments", "replicasets", "statefulsets", "jobs", "cronjobs", "horizontalpodautoscalers", "poddisruptionbudgets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["patch"]               # kubectl rollout restart
  - apiGroups: [""]
    resources: ["pods/portforward"]
    verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: {name: developers, namespace: kubelab}
subjects:
  - kind: Group                    # group coming from the company OIDC provider (Entra ID, Keycloak, Okta...)
    name: team-kubelab
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer
  apiGroup: rbac.authorization.k8s.io

$ kubectl apply -f workloads/rbac-developer.yaml
role.rbac.authorization.k8s.io/developer created1
rolebinding.rbac.authorization.k8s.io/developers created
$ kubectl auth can-i list pods -n kubelab --as=jane --as-group=team-kubelab
yes
$ kubectl auth can-i patch deployments -n kubelab --as=jane --as-group=team-kubelab2
yes
$ kubectl auth can-i get secrets -n kubelab --as=jane --as-group=team-kubelab3
no
$ kubectl auth can-i delete pods -n kubelab --as=jane --as-group=team-kubelab
no
$ kubectl auth can-i list pods -n kube-system --as=jane --as-group=team-kubelab4
no

# The application's own identity. No token mounted: the app never calls the Kubernetes API.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kubelab
  namespace: kubelab
  labels:
    app.kubernetes.io/name: kubelab
automountServiceAccountToken: false

# One namespace per application and environment: isolates permissions, quotas and network policies.
apiVersion: v1
kind: Namespace
metadata:
  name: kubelab
  labels:
    # Pod Security Admission: rejects privileged pods, root, hostPath...
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/warn: restricted

$ kubectl apply -f workloads/psa-test.yaml
Error from server (Forbidden): error when creating "workloads/psa-test.yaml": pods "root-shell" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "sh" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "sh" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "sh" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "sh" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")1

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources: [secrets]
    providers:
      - aescbc:
          keys:
            - name: key1
              secret: <base64 of a random 32-byte key>
      - identity: {}        # still able to read old, unencrypted Secrets

$ kubectl get crd
NAME                                           SCOPE        VERSIONS              CREATED AT
backendtlspolicies.gateway.networking.k8s.io   Namespaced   v1(storage)           2026-10-19T15:40:19Z
gatewayclasses.gateway.networking.k8s.io       Cluster      v1(storage),v1beta1   2026-10-19T15:40:19Z
gateways.gateway.networking.k8s.io             Namespaced   v1(storage),v1beta1   2026-10-19T15:40:19Z
grpcroutes.gateway.networking.k8s.io           Namespaced   v1(storage)           2026-10-19T15:40:19Z
httproutes.gateway.networking.k8s.io           Namespaced   v1(storage),v1beta1   2026-10-19T15:40:20Z1
listenersets.gateway.networking.k8s.io         Namespaced   v1(storage)           2026-10-19T15:40:21Z
referencegrants.gateway.networking.k8s.io      Namespaced   v1,v1beta1(storage)   2026-10-19T15:40:21Z
tcproutes.gateway.networking.k8s.io            Namespaced   v1(storage)           2026-10-19T15:40:21Z
tlsroutes.gateway.networking.k8s.io            Namespaced   v1(storage)           2026-10-19T15:40:21Z
udproutes.gateway.networking.k8s.io            Namespaced   v1(storage)           2026-10-19T15:40:21Z
$ kubectl api-resources --api-group=gateway.networking.k8s.io
NAME                 SHORTNAMES   APIVERSION                     NAMESPACED   KIND
backendtlspolicies   btlspolicy   gateway.networking.k8s.io/v1   true         BackendTLSPolicy
gatewayclasses       gc           gateway.networking.k8s.io/v1   false        GatewayClass2
gateways             gtw          gateway.networking.k8s.io/v1   true         Gateway
grpcroutes                        gateway.networking.k8s.io/v1   true         GRPCRoute
httproutes                        gateway.networking.k8s.io/v1   true         HTTPRoute
listenersets         lset         gateway.networking.k8s.io/v1   true         ListenerSet
referencegrants      refgrant     gateway.networking.k8s.io/v1   true         ReferenceGrant
tlsroutes                         gateway.networking.k8s.io/v1   true         TLSRoute
$ kubectl explain httproute.spec.rules.backendRefs.weight
GROUP:      gateway.networking.k8s.io
KIND:       HTTPRoute
VERSION:    v1

FIELD: weight <integer>3


DESCRIPTION:
    Weight specifies the proportion of requests forwarded to the referenced
    backend. This is computed as weight/(sum of all weights in this
    BackendRefs list). For non-zero values, there may be some epsilon from
    the exact proportion defined here depending on the precision an
    implementation supports. Weight is not a percentage and the sum of
    weights does not need to equal 100.
    
    If only one backend is specified and it has a weight greater than 0, 100%
    of the traffic is forwarded to that backend. If weight is set to 0, no
    traffic should be forwarded for this entry. If unspecified, weight
    defaults to 1.
    
    Support for this field varies based on the context where used.
    

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kubelab
  namespace: kubelab
  labels:
    app.kubernetes.io/name: kubelab
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/part-of: k8s-helm-lab
spec:
  replicas: 3
  revisionHistoryLimit: 5
  selector:
    matchLabels:                      # immutable after creation: must match the template labels
      app.kubernetes.io/name: kubelab
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0               # never fewer than 3 ready pods during an update
      maxSurge: 1
  template:
    metadata:
      labels:
        app.kubernetes.io/name: kubelab
        app.kubernetes.io/version: "1.0.0"
    spec:
      serviceAccountName: kubelab
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:      # spread the replicas across nodes
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: kubelab
      containers:
        - name: kubelab
          image: kubelab:1.0.0   # loaded into kind; in a company: private registry + immutable tag or digest
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
          env:
            - name: MESSAGE
              valueFrom:
                configMapKeyRef:
                  name: kubelab-config
                  key: MESSAGE
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: kubelab-secret
                  key: DATABASE_URL
            - name: CONFIG_FILE
              value: /etc/kubelab/app.properties
            - name: POD_NAME              # Downward API: the pod knows its name and node
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          resources:
            requests:                     # what the scheduler reserves
              cpu: 50m
              memory: 32Mi
            limits:                       # ceiling: above the memory limit, OOMKilled
              memory: 128Mi
          startupProbe:
            httpGet: {path: /healthz, port: http}
            periodSeconds: 2
            failureThreshold: 30
          readinessProbe:                 # removes the pod from the Service when it fails
            httpGet: {path: /readyz, port: http}
            periodSeconds: 5
          livenessProbe:                  # restarts the container when it fails
            httpGet: {path: /healthz, port: http}
            periodSeconds: 10
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: config
              mountPath: /etc/kubelab
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: kubelab-config
            items:
              - key: app.properties
                path: app.properties

$ kubectl apply -k manifests/
$ kubectl -n kubelab rollout status deploy/kubelab --timeout=120s
$ kubectl -n kubelab get deploy,rs,svc,endpointslices,pdb,hpa,networkpolicy,resourcequota

$ kubectl apply -k manifests/
namespace/kubelab created1
resourcequota/kubelab-quota created
serviceaccount/kubelab created
configmap/kubelab-config created
secret/kubelab-secret created
service/kubelab created
limitrange/kubelab-defaults created
deployment.apps/kubelab created2
poddisruptionbudget.policy/kubelab created
horizontalpodautoscaler.autoscaling/kubelab created
networkpolicy.networking.k8s.io/allow-http-to-kubelab created
networkpolicy.networking.k8s.io/default-deny-ingress created3

$ kubectl -n kubelab rollout status deploy/kubelab --timeout=120s
Waiting for deployment "kubelab" rollout to finish: 1 of 3 updated replicas are available...1
Waiting for deployment "kubelab" rollout to finish: 2 of 3 updated replicas are available...
deployment "kubelab" successfully rolled out2
$ kubectl -n kubelab get pods -o wide
NAME                       READY   STATUS    RESTARTS   AGE   IP           NODE          NOMINATED NODE   READINESS GATES
kubelab-6b777469b9-hwdlc   1/1     Running   0          3s    10.244.1.3   lab-worker2   <none>           <none>3
kubelab-6b777469b9-jtkqn   1/1     Running   0          3s    10.244.2.2   lab-worker    <none>           <none>
kubelab-6b777469b9-p22xl   1/1     Running   0          3s    10.244.2.3   lab-worker    <none>           <none>

$ kubectl -n kubelab get deploy,rs,svc,endpointslices,pdb,hpa,networkpolicy,resourcequota
NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/kubelab   3/3     3            3           3s

NAME                                 DESIRED   CURRENT   READY   AGE
replicaset.apps/kubelab-6b777469b9   3         3         3       3s1

NAME              TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
service/kubelab   ClusterIP   10.96.10.133   <none>        80/TCP    3s2

NAME                                           ADDRESSTYPE   PORTS   ENDPOINTS                          AGE
endpointslice.discovery.k8s.io/kubelab-klsxs   IPv4          8080    10.244.1.3,10.244.2.2,10.244.2.3   3s3

NAME                                 MIN AVAILABLE   MAX UNAVAILABLE   ALLOWED DISRUPTIONS   AGE4
poddisruptionbudget.policy/kubelab   2               N/A               1                     3s

NAME                                          REFERENCE            TARGETS              MINPODS   MAXPODS   REPLICAS   AGE
horizontalpodautoscaler.autoscaling/kubelab   Deployment/kubelab   cpu: <unknown>/70%   3         6         3          3s5

NAME                                                    POD-SELECTOR                     AGE
networkpolicy.networking.k8s.io/allow-http-to-kubelab   app.kubernetes.io/name=kubelab   3s
networkpolicy.networking.k8s.io/default-deny-ingress    <none>                           3s

NAME                          REQUEST                                                                                    LIMIT                      AGE
resourcequota/kubelab-quota   persistentvolumeclaims: 0/5, pods: 3/20, requests.cpu: 150m/2, requests.memory: 96Mi/2Gi   limits.memory: 384Mi/4Gi   3s6

$ kubectl apply -f workloads/job-cronjob.yaml
job.batch/smoke-test created
cronjob.batch/nightly-check created
$ kubectl -n kubelab wait --for=condition=complete job/smoke-test --timeout=120s
job.batch/smoke-test condition met
$ kubectl -n kubelab get jobs,cronjobs
NAME                   STATUS     COMPLETIONS   DURATION   AGE
job.batch/smoke-test   Complete   1/1           3s         3s1

NAME                          SCHEDULE    TIMEZONE       SUSPEND   ACTIVE   LAST SCHEDULE   AGE
cronjob.batch/nightly-check   0 3 * * *   Europe/Paris   False     0        <none>          3s2
$ kubectl -n kubelab logs job/smoke-test
{"time":"2026-10-19T15:55:34.353214468Z","level":"INFO","msg":"check OK","url":"http://kubelab.kubelab.svc.cluster.local/","status":200,"body":"{\"message\":\"Bonjour depuis Kubernetes\",\"node\":\"lab-worker\",\"pod\":\"kubelab-6b777469b9-5ws4r\",\"version\":\"1.0.0\",\"visits\":305}"}3

# Two identical test pods, except for the label role: client.
# With the lab NetworkPolicy, only probe-allowed may reach the kubelab Service.
apiVersion: v1
kind: Pod
metadata:
  name: probe-allowed
  namespace: kubelab
  labels: {role: client}
spec:
  restartPolicy: Never
  securityContext: {runAsNonRoot: true, runAsUser: 65532, seccompProfile: {type: RuntimeDefault}}
  containers:
    - name: check
      image: kubelab:1.0.0
      args: ["check", "http://kubelab/healthz"]
      resources: {requests: {cpu: 10m, memory: 16Mi}, limits: {memory: 64Mi}}
      securityContext: {allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: [ALL]}}
---
apiVersion: v1
kind: Pod
metadata:
  name: probe-denied
  namespace: kubelab
spec:
  restartPolicy: Never
  securityContext: {runAsNonRoot: true, runAsUser: 65532, seccompProfile: {type: RuntimeDefault}}
  containers:
    - name: check
      image: kubelab:1.0.0
      args: ["check", "http://kubelab/healthz"]
      resources: {requests: {cpu: 10m, memory: 16Mi}, limits: {memory: 64Mi}}
      securityContext: {allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities: {drop: [ALL]}}

$ kubectl apply -f workloads/netpol-test.yaml
pod/probe-allowed created
pod/probe-denied created
$ kubectl -n kubelab wait --for=jsonpath='{.status.phase}'=Succeeded pod/probe-allowed --timeout=120s
pod/probe-allowed condition met1
$ kubectl -n kubelab wait --for=jsonpath='{.status.phase}'=Failed pod/probe-denied --timeout=240s
pod/probe-denied condition met2
$ kubectl -n kubelab logs probe-allowed
{"time":"2026-10-19T15:59:34.888417485Z","level":"INFO","msg":"check OK","url":"http://kubelab/healthz","status":200,"body":"ok"}
$ kubectl -n kubelab logs probe-denied
{"time":"2026-10-19T16:00:43.914955553Z","level":"ERROR","msg":"check KO","url":"http://kubelab/healthz","err":"Get \"http://kubelab/healthz\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}3

$ kubectl -n kubelab set image deploy/kubelab kubelab=kubelab:1.1.0
$ kubectl -n kubelab rollout status deploy/kubelab --timeout=180s
$ kubectl -n kubelab rollout undo deploy/kubelab

$ kubectl -n kubelab set image deploy/kubelab kubelab=kubelab:1.1.0
deployment.apps/kubelab image updated1
$ kubectl -n kubelab rollout status deploy/kubelab --timeout=180s
Waiting for deployment "kubelab" rollout to finish: 1 out of 3 new replicas have been updated...2
Waiting for deployment "kubelab" rollout to finish: 1 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 1 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 1 old replicas are pending termination...
Waiting for deployment "kubelab" rollout to finish: 1 old replicas are pending termination...
Waiting for deployment "kubelab" rollout to finish: 1 old replicas are pending termination...
deployment "kubelab" successfully rolled out
$ kubectl -n kubelab get rs -o wide
NAME                 DESIRED   CURRENT   READY   AGE    CONTAINERS   IMAGES          SELECTOR
kubelab-6b777469b9   0         0         0       117s   kubelab      kubelab:1.0.0   app.kubernetes.io/name=kubelab,pod-template-hash=6b777469b93
kubelab-9bc495dc8    3         3         3       9s     kubelab      kubelab:1.1.0   app.kubernetes.io/name=kubelab,pod-template-hash=9bc495dc84
$ kubectl -n kubelab rollout history deploy/kubelab
deployment.apps/kubelab 
REVISION  CHANGE-CAUSE5
1         <none>
2         <none>

$ kubectl -n kubelab rollout undo deploy/kubelab
deployment.apps/kubelab rolled back1
Warning: resource deployments/kubelab was previously managed with 'kubectl apply'. Rolling back will not update the kubectl.kubernetes.io/last-applied-configuration annotation, which may cause unexpected behavior on future 'kubectl apply' operations. Consider using 'kubectl apply' with your previous configuration file instead.2
$ kubectl -n kubelab rollout status deploy/kubelab --timeout=180s
Waiting for deployment "kubelab" rollout to finish: 1 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 1 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 1 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 2 out of 3 new replicas have been updated...
Waiting for deployment "kubelab" rollout to finish: 1 old replicas are pending termination...
Waiting for deployment "kubelab" rollout to finish: 1 old replicas are pending termination...
deployment "kubelab" successfully rolled out
$ kubectl -n kubelab get rs
NAME                 DESIRED   CURRENT   READY   AGE
kubelab-6b777469b9   3         3         3       2m6s3
kubelab-9bc495dc8    0         0         0       18s
$ kubectl -n kubelab get deploy kubelab -o jsonpath='{.spec.template.spec.containers[0].image}{"\n"}'
kubelab:1.0.04

apiVersion: v2
name: kubelab
description: The kubelab API packaged with enterprise best practices (probes, security, HPA, PDB, NetworkPolicy, hooks, tests).
type: application
version: 0.1.0          # version of the CHART (bump it on every chart change)
appVersion: "1.0.0"     # version of the APPLICATION (default image tag)
kubeVersion: ">=1.29.0-0"
keywords: [kubernetes, helm, lab]
maintainers:
  - name: Georges MOMO
annotations:
  artifacthub.io/license: MIT

{{/* Short app name (truncated to 63 characters: the DNS limit for Kubernetes names). */}}
{{- define "kubelab.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/* Full name: <release>-<chart>, unless the release name already contains the chart name. */}}
{{- define "kubelab.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}

{{- define "kubelab.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}

{{/* Recommended labels (app.kubernetes.io/*) set on every resource. */}}
{{- define "kubelab.labels" -}}
helm.sh/chart: {{ include "kubelab.chart" . }}
{{ include "kubelab.selectorLabels" . }}
app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/part-of: k8s-helm-lab
{{- end }}

{{/* Selector labels: stable, never put the version here (a Deployment selector is immutable). */}}
{{- define "kubelab.selectorLabels" -}}
app.kubernetes.io/name: {{ include "kubelab.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

{{- define "kubelab.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "kubelab.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}

{{- define "kubelab.secretName" -}}
{{- if .Values.secret.existingSecret }}{{ .Values.secret.existingSecret }}{{ else }}{{ include "kubelab.fullname" . }}{{ end }}
{{- end }}

{{/* Image: the digest, when provided, wins over the tag (immutable deployment). */}}
{{- define "kubelab.image" -}}
{{- if .Values.image.digest }}
{{- printf "%s@%s" .Values.image.repository .Values.image.digest }}
{{- else }}
{{- printf "%s:%s" .Values.image.repository (.Values.image.tag | default .Chart.AppVersion) }}
{{- end }}
{{- end }}

$ helm lint chart/kubelab
==> Linting chart/kubelab
[INFO] Chart.yaml: icon is recommended

1 chart(s) linted, 0 chart(s) failed1
$ helm lint chart/kubelab --set image.digest=sha256:abc
==> Linting chart/kubelab
[INFO] Chart.yaml: icon is recommended
[ERROR] values.yaml: - at '/image/digest': 'sha256:abc' does not match pattern '^(sha256:[a-f0-9]{64})?$'2

[ERROR] templates/: values don't meet the specifications of the schema(s) in the following chart(s):
kubelab:
- at '/image/digest': 'sha256:abc' does not match pattern '^(sha256:[a-f0-9]{64})?$'


Error: 1 chart(s) linted, 1 chart(s) failed

$ helm template demo chart/kubelab -n kubelab-helm -s templates/deployment.yaml | head -45
---
# Source: kubelab/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-kubelab1
  labels:
    helm.sh/chart: kubelab-0.1.0
    app.kubernetes.io/name: kubelab
    app.kubernetes.io/instance: demo
    app.kubernetes.io/version: "1.0.0"
    app.kubernetes.io/managed-by: Helm2
    app.kubernetes.io/part-of: k8s-helm-lab
spec:
  replicas: 2
  revisionHistoryLimit: 5
  selector:
    matchLabels:3
      app.kubernetes.io/name: kubelab
      app.kubernetes.io/instance: demo
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 0
      maxSurge: 1
  template:
    metadata:
      annotations:
        # Change quand la ConfigMap change : force un rolling update (sinon les pods gardent l'ancienne config).
        checksum/config: 7510d67ee6d29dc984ee7d962aecdb70cfb23ac984939e91e9336fdf630184994
      labels:
        helm.sh/chart: kubelab-0.1.0
        app.kubernetes.io/name: kubelab
        app.kubernetes.io/instance: demo
        app.kubernetes.io/version: "1.0.0"
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/part-of: k8s-helm-lab
    spec:
      serviceAccountName: demo-kubelab
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 65532
        runAsGroup: 65532
        runAsNonRoot: true
        runAsUser: 65532

$ helm install demo chart/kubelab -n kubelab-helm --create-namespace --wait --timeout 3m
$ helm test demo -n kubelab-helm --logs

$ helm install demo chart/kubelab -n kubelab-helm --create-namespace --wait --timeout 3m
NAME: demo
LAST DEPLOYED: Mon Oct 19 17:40:23 2026
NAMESPACE: kubelab-helm
STATUS: deployed1
REVISION: 12
DESCRIPTION: Install complete
NOTES:3
kubelab 1.0.0 déployé dans le namespace kubelab-helm (release « demo », révision 1).

1. Suivre le déploiement :
   kubectl -n kubelab-helm rollout status deploy/demo-kubelab

2. Tester en local :
   kubectl -n kubelab-helm port-forward svc/demo-kubelab 8080:80
   curl http://localhost:8080/

3. Lancer les tests du chart :
   helm test demo -n kubelab-helm

$ helm test demo -n kubelab-helm --logs
NAME: demo
LAST DEPLOYED: Mon Oct 19 17:40:23 2026
NAMESPACE: kubelab-helm
STATUS: deployed
REVISION: 1
DESCRIPTION: Install complete
TEST SUITE:     demo-kubelab-test
Last Started:   Mon Oct 19 17:40:35 2026
Last Completed: Mon Oct 19 17:40:39 2026
Phase:          Succeeded1

POD LOGS: demo-kubelab-test
{"time":"2026-10-19T15:40:38.18790639Z","level":"INFO","msg":"check OK","url":"http://demo-kubelab:80/","status":200,"body":"{\"message\":\"Bonjour depuis Helm\",\"node\":\"lab-worker2\",\"pod\":\"demo-kubelab-5b77db878d-sm4bq\",\"version\":\"1.0.0\",\"visits\":3}"}2

$ helm list -n kubelab-helm
NAME	NAMESPACE   	REVISION	UPDATED                                 	STATUS  	CHART        	APP VERSION
demo	kubelab-helm	1       	2026-10-19 17:40:23.462594653 +0200 CEST	deployed	kubelab-0.1.0	1.0.0      1
$ kubectl -n kubelab-helm get all -l app.kubernetes.io/instance=demo
NAME                                READY   STATUS    RESTARTS   AGE
pod/demo-kubelab-5b77db878d-ffgjp   1/1     Running   0          9s
pod/demo-kubelab-5b77db878d-sm4bq   1/1     Running   0          9s

NAME                   TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
service/demo-kubelab   ClusterIP   10.96.229.73   <none>        80/TCP    9s

NAME                           READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/demo-kubelab   2/2     2            2           9s2

NAME                                      DESIRED   CURRENT   READY   AGE
replicaset.apps/demo-kubelab-5b77db878d   2         2         2       9s
$ kubectl -n kubelab-helm get secrets -l owner=helm
NAME                         TYPE                 DATA   AGE
sh.helm.release.v1.demo.v1   helm.sh/release.v1   1      16s3
$ helm get values demo -n kubelab-helm --all | head -12
COMPUTED VALUES:4
affinity: {}
autoscaling:
  enabled: false
  maxReplicas: 6
  minReplicas: 2
  targetCPUUtilizationPercentage: 70
config:
  app.properties: |
    log.level=info
    feature.newCheckout=false
fullnameOverride: ""

{{- if .Values.migrations.enabled }}
# Hook: Helm creates this Job BEFORE installing/upgrading the Deployment and waits for it to succeed.
# If the migration fails, the release fails and the new pods are not rolled out.
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ include "kubelab.fullname" . }}-migrate
  labels:
    {{- include "kubelab.labels" . | nindent 4 }}
  annotations:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
  backoffLimit: 1
  ttlSecondsAfterFinished: 300
  template:
    metadata:
      labels:
        {{- include "kubelab.selectorLabels" . | nindent 8 }}
        app.kubernetes.io/component: migration
    spec:
      restartPolicy: Never
      automountServiceAccountToken: false
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: migrate
          image: {{ include "kubelab.image" . | quote }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args: ["migrate"]
          env:
            - name: FROM_VERSION
              value: {{ .Release.Revision | quote }}
          resources:
            requests: {cpu: 10m, memory: 16Mi}
            limits: {memory: 64Mi}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
{{- end }}

$ kubectl -n kubelab-helm get events --field-selector involvedObject.kind=Job --sort-by=.lastTimestamp
LAST SEEN   TYPE     REASON             OBJECT                     MESSAGE
16m         Normal   SuccessfulCreate   job/demo-kubelab-migrate   Created pod: demo-kubelab-migrate-28mbs1
16m         Normal   Completed          job/demo-kubelab-migrate   Job completed
15m         Normal   SuccessfulCreate   job/demo-kubelab-migrate   Created pod: demo-kubelab-migrate-qhrlb
15m         Normal   Completed          job/demo-kubelab-migrate   Job completed

$ helm upgrade demo chart/kubelab -n kubelab-helm --set message="Version 2" --wait
Release "demo" has been upgraded. Happy Helming!1
NAME: demo
LAST DEPLOYED: Mon Oct 19 17:40:40 2026
NAMESPACE: kubelab-helm
STATUS: deployed
REVISION: 2
DESCRIPTION: Upgrade complete
NOTES:
kubelab 1.0.0 déployé dans le namespace kubelab-helm (release « demo », révision 2).

1. Suivre le déploiement :
   kubectl -n kubelab-helm rollout status deploy/demo-kubelab

2. Tester en local :
   kubectl -n kubelab-helm port-forward svc/demo-kubelab 8080:80
   curl http://localhost:8080/

3. Lancer les tests du chart :
   helm test demo -n kubelab-helm
$ helm history demo -n kubelab-helm
REVISION	UPDATED                 	STATUS    	CHART        	APP VERSION	DESCRIPTION     
1       	Mon Oct 19 17:40:23 2026	superseded	kubelab-0.1.0	1.0.0      	Install complete
2       	Mon Oct 19 17:40:40 2026	deployed  	kubelab-0.1.0	1.0.0      	Upgrade complete2
$ kubectl -n kubelab-helm get rs
NAME                      DESIRED   CURRENT   READY   AGE
demo-kubelab-5b77db878d   0         0         0       24s
demo-kubelab-76949d8956   2         2         2       6s3

$ helm rollback demo 1 -n kubelab-helm --wait
Rollback was a success! Happy Helming!1
$ helm history demo -n kubelab-helm
REVISION	UPDATED                 	STATUS    	CHART        	APP VERSION	DESCRIPTION     
1       	Mon Oct 19 17:40:23 2026	superseded	kubelab-0.1.0	1.0.0      	Install complete
2       	Mon Oct 19 17:40:40 2026	superseded	kubelab-0.1.0	1.0.0      	Upgrade complete
3       	Mon Oct 19 17:40:55 2026	deployed  	kubelab-0.1.0	1.0.0      	Rollback to 1   2
$ kubectl -n kubelab-helm get cm demo-kubelab -o jsonpath='{.data.MESSAGE}{"\n"}'
Bonjour depuis Helm3

$ helm package chart/kubelab -d /tmp
Successfully packaged chart and saved it to: /tmp/kubelab-0.1.0.tgz1
$ helm push /tmp/kubelab-0.1.0.tgz oci://localhost:5001/charts --plain-http
Pushed: localhost:5001/charts/kubelab:0.1.02
Digest: sha256:c2c9080d4a8d908bcf8b8f45e6631bd8912cfcac8f7d8503e44a104903ec8e3b3
$ helm show chart oci://localhost:5001/charts/kubelab --version 0.1.0 --plain-http
Pulled: localhost:5001/charts/kubelab:0.1.0
Digest: sha256:c2c9080d4a8d908bcf8b8f45e6631bd8912cfcac8f7d8503e44a104903ec8e3b
annotations:
  artifacthub.io/license: MIT
apiVersion: v2
appVersion: 1.0.0
description: API kubelab packagée avec les bonnes pratiques d'entreprise (sondes,
  sécurité, HPA, PDB, NetworkPolicy, hooks, tests).
keywords:
- kubernetes
- helm
- lab
kubeVersion: '>=1.29.0-0'
maintainers:
- name: Georges MOMO
name: kubelab
type: application
version: 0.1.0

$ kubectl apply -f debug/00-namespace.yaml
$ kubectl apply -f debug/02-crashloopbackoff.yaml
$ kubectl -n debug get pods -w

$ kubectl -n debug get pods -l app=bad-image
NAME                         READY   STATUS             RESTARTS   AGE
bad-image-57b9b799f6-7xbsn   0/1     ImagePullBackOff   0          83s1
$ kubectl -n debug describe pod -l app=bad-image | sed -n '/^Events:/,$p'
Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  83s                default-scheduler  Successfully assigned debug/bad-image-57b9b799f6-7xbsn to lab-worker
  Normal   Pulling    38s (x3 over 81s)  kubelet            spec.containers{app}: Pulling image "kubelab:9.9.9"
  Warning  Failed     38s (x3 over 81s)  kubelet            spec.containers{app}: Failed to pull image "kubelab:9.9.9": rpc error: code = NotFound desc = failed to pull and unpack image "docker.io/library/kubelab:9.9.9": failed to resolve reference "docker.io/library/kubelab:9.9.9": docker.io/library/kubelab:9.9.9: not found2
  Warning  Failed     38s (x3 over 81s)  kubelet            spec.containers{app}: Error: ErrImagePull
  Normal   BackOff    11s (x4 over 80s)  kubelet            spec.containers{app}: Back-off pulling image "kubelab:9.9.9"3
  Warning  Failed     11s (x4 over 80s)  kubelet            spec.containers{app}: Error: ImagePullBackOff

$ kubectl -n debug get pods -l app=crashloop
NAME                        READY   STATUS             RESTARTS        AGE
crashloop-d6d7fcb65-hgfm7   0/1     CrashLoopBackOff   7 (3m33s ago)   14m1
$ kubectl -n debug logs deploy/crashloop --previous
{"time":"2026-10-19T15:51:59.38233263Z","level":"ERROR","msg":"variable DATABASE_URL absente","hint":"vérifie le Secret référencé par le Deployment"}2
$ kubectl -n debug describe pod -l app=crashloop | grep -A6 'Last State'
    Last State:     Terminated
      Reason:       Error
      Exit Code:    23
      Started:      Mon, 19 Oct 2026 17:51:59 +0200
      Finished:     Mon, 19 Oct 2026 17:51:59 +0200
    Ready:          False
    Restart Count:  7

$ kubectl -n debug exec deploy/oom -- /kubelab check 'http://localhost:8080/stress/memory?mb=100'
command terminated with exit code 1371
$ kubectl -n debug get pods -l app=oom
NAME                   READY   STATUS    RESTARTS      AGE
oom-66c5d4b56b-bfdvw   1/1     Running   1 (20s ago)   82s2
$ kubectl -n debug describe pod -l app=oom | grep -A6 'Last State'
    Last State:     Terminated
      Reason:       OOMKilled3
      Exit Code:    137
      Started:      Mon, 19 Oct 2026 17:41:08 +0200
      Finished:     Mon, 19 Oct 2026 17:42:07 +0200
    Ready:          True
    Restart Count:  1

$ kubectl -n debug get pods -l app=too-big
NAME                      READY   STATUS    RESTARTS   AGE
too-big-774d56759-lp89m   0/1     Pending   0          83s1
$ kubectl -n debug describe pod -l app=too-big | sed -n '/^Events:/,$p'
Events:
  Type     Reason            Age   From               Message
  ----     ------            ----  ----               -------
  Warning  FailedScheduling  83s   default-scheduler  0/3 nodes are available: 1 node(s) had untolerated taint(s), 2 Insufficient cpu. preemption: 0/3 nodes are available: 3 Preemption is not helpful for scheduling.2
$ kubectl describe node lab-worker | sed -n '/Allocated resources/,/Events/p'
Allocated resources:
  (Total limits may be over 100 percent, i.e., overcommitted.)
  Resource           Requests    Limits
  --------           --------    ------
  cpu                380m (19%)  0 (0%)3
  memory             306Mi (3%)  1008Mi (12%)
  ephemeral-storage  0 (0%)      0 (0%)
  hugepages-1Gi      0 (0%)      0 (0%)
  hugepages-2Mi      0 (0%)      0 (0%)
Events:

$ kubectl -n debug get pods -l app=not-ready
NAME                        READY   STATUS    RESTARTS   AGE
not-ready-ff679bbcb-fgtbt   0/1     Running   0          83s1
$ kubectl -n debug describe pod -l app=not-ready | sed -n '/^Events:/,$p'
Events:
  Type     Reason     Age                 From               Message
  ----     ------     ----                ----               -------
  Normal   Scheduled  83s                 default-scheduler  Successfully assigned debug/not-ready-ff679bbcb-fgtbt to lab-worker
  Normal   Pulled     81s                 kubelet            spec.containers{app}: Container image "kubelab:1.0.0" already present on machine and can be accessed by the pod
  Normal   Created    81s                 kubelet            spec.containers{app}: Container created
  Normal   Started    81s                 kubelet            spec.containers{app}: Container started
  Warning  Unhealthy  81s                 kubelet            spec.containers{app}: Readiness probe failed: Get "http://10.244.2.26:8080/ready": dial tcp 10.244.2.26:8080: connect: connection refused
  Warning  Unhealthy  11s (x24 over 80s)  kubelet            spec.containers{app}: Readiness probe failed: HTTP probe failed with statuscode: 4042

$ kubectl -n debug get svc web
NAME   TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
web    ClusterIP   10.96.139.124   <none>        80/TCP    83s
$ kubectl -n debug get endpointslices -l kubernetes.io/service-name=web
NAME        ADDRESSTYPE   PORTS     ENDPOINTS   AGE
web-sdrhs   IPv4          <unset>   <unset>     83s1
$ kubectl -n debug get pods -l app=web --show-labels
NAME                   READY   STATUS    RESTARTS   AGE   LABELS
web-5b97c5d84d-5n7ls   1/1     Running   0          83s   app=web,pod-template-hash=5b97c5d84d2
web-5b97c5d84d-bmp6f   1/1     Running   0          83s   app=web,pod-template-hash=5b97c5d84d
$ kubectl -n debug get svc web -o jsonpath='{.spec.selector}{"\n"}'
{"app":"website"}3
$ kubectl -n debug patch svc web -p '{"spec":{"selector":{"app":"web"}}}'
service/web patched
$ kubectl -n debug get endpointslices -l kubernetes.io/service-name=web
NAME        ADDRESSTYPE   PORTS   ENDPOINTS                 AGE
web-sdrhs   IPv4          8080    10.244.1.13,10.244.2.25   83s4

$ kubectl -n debug get pods -l app=no-config
NAME                         READY   STATUS                       RESTARTS   AGE
no-config-5484465b65-bxx2z   0/1     CreateContainerConfigError   0          82s1
$ kubectl -n debug describe pod -l app=no-config | sed -n '/^Events:/,$p'
Events:
  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Normal   Scheduled  82s               default-scheduler  Successfully assigned debug/no-config-5484465b65-bxx2z to lab-worker
  Normal   Pulled     4s (x8 over 80s)  kubelet            spec.containers{app}: Container image "kubelab:1.0.0" already present on machine and can be accessed by the pod
  Warning  Failed     4s (x8 over 80s)  kubelet            spec.containers{app}: Error: configmap "app-settings" not found2

$ kubectl -n debug get pvc data
NAME   STATUS    VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   VOLUMEATTRIBUTESCLASS   AGE
data   Pending                                      fast-ssd       <unset>                 14m1
$ kubectl -n debug get pod needs-volume
NAME           READY   STATUS    RESTARTS   AGE
needs-volume   0/1     Pending   0          14m2
$ kubectl -n debug describe pvc data | sed -n '/^Events:/,$p'
Events:
  Type     Reason              Age                   From                         Message
  ----     ------              ----                  ----                         -------
  Warning  ProvisioningFailed  4m18s (x42 over 14m)  persistentvolume-controller  storageclass.storage.k8s.io "fast-ssd" not found3
$ kubectl get storageclass
NAME                 PROVISIONER             RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE
standard (default)   rancher.io/local-path   Delete          WaitForFirstConsumer   false                  23m

$ kubectl get pods -n debug --as=system:serviceaccount:debug:reader
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:debug:reader" cannot list resource "pods" in API group "" in the namespace "debug"1
$ kubectl auth can-i list pods -n debug --as=system:serviceaccount:debug:reader
no
$ kubectl apply -f debug/fixes/09-rbac.yaml
role.rbac.authorization.k8s.io/pod-reader created2
rolebinding.rbac.authorization.k8s.io/reader-can-read-pods created
$ kubectl auth can-i list pods -n debug --as=system:serviceaccount:debug:reader
yes
$ kubectl auth can-i delete pods -n debug --as=system:serviceaccount:debug:reader3
no

$ kubectl -n debug get pods -l app=slow-start
NAME                          READY   STATUS             RESTARTS      AGE
slow-start-7b95c566f8-hvphb   0/1     CrashLoopBackOff   4 (26s ago)   82s1
$ kubectl -n debug describe pod -l app=slow-start | sed -n '/^Events:/,$p'
Events:
  Type     Reason     Age                 From               Message
  ----     ------     ----                ----               -------
  Normal   Scheduled  82s                 default-scheduler  Successfully assigned debug/slow-start-7b95c566f8-hvphb to lab-worker
  Normal   Pulled     28s (x5 over 81s)   kubelet            spec.containers{app}: Container image "kubelab:1.0.0" already present on machine and can be accessed by the pod
  Normal   Created    28s (x5 over 81s)   kubelet            spec.containers{app}: Container created
  Normal   Started    28s (x5 over 81s)   kubelet            spec.containers{app}: Container started
  Warning  Unhealthy  26s (x10 over 80s)  kubelet            spec.containers{app}: Liveness probe failed: HTTP probe failed with statuscode: 5032
  Normal   Killing    26s (x5 over 78s)   kubelet            spec.containers{app}: Container app failed liveness probe, will be restarted3
  Warning  BackOff    25s (x6 over 70s)   kubelet            spec.containers{app}: Back-off restarting failed container app in pod slow-start-7b95c566f8-hvphb_debug(dc3ef925-c9b6-49ea-aff0-f1ae6397bcf3)

# Symptom: regular restarts although the app is fine. Cause: an aggressive liveness probe
# (1 s timeout, no startupProbe) on an app that takes 8 s to start.
apiVersion: apps/v1
kind: Deployment
metadata: {name: slow-start, namespace: debug}
spec:
  replicas: 1
  selector: {matchLabels: {app: slow-start}}
  template:
    metadata: {labels: {app: slow-start}}
    spec:
      containers:
        - name: app
          image: kubelab:1.0.0
          env: [{name: STARTUP_DELAY_SECONDS, value: "8"}]
          livenessProbe:
            httpGet: {path: /readyz, port: 8080}   # mistake: liveness on /readyz
            initialDelaySeconds: 0
            periodSeconds: 2
            failureThreshold: 2
          resources: {requests: {cpu: 10m, memory: 16Mi}, limits: {memory: 64Mi}}

$ kubectl -n debug debug pod/web-5b97c5d84d-5n7ls -c dbg --image=busybox:1.36 --target=app -- sh -c "ps; wget -qO- localhost:8080/; nslookup web.debug.svc.cluster.local"1
Targeting container "app". If you don't see processes from this container it may be because the container runtime doesn't support this feature.
$ kubectl -n debug logs pod/web-5b97c5d84d-5n7ls -c dbg
PID   USER     COMMAND
    1 65532    /kubelab2
   18 root     sh -c ps; wget -qO- localhost:8080/; nslookup web.debug.svc.cluster.local
   28 root     {ps} sh -c ps; wget -qO- localhost:8080/; nslookup web.debug.svc.cluster.local
{"message":"Hello from kubelab","node":"","pod":"web-5b97c5d84d-5n7ls","version":"1.0.0","visits":1}3
Server:		10.96.0.10
Address:	10.96.0.10:53


Name:	web.debug.svc.cluster.local
Address: 10.96.139.1244

$ kubectl get events -n debug --field-selector type=Warning --sort-by=.lastTimestamp | tail -14
LAST SEEN   TYPE      REASON               OBJECT                            MESSAGE
95s         Warning   FailedScheduling     pod/too-big-774d56759-lp89m       0/3 nodes are available: 1 node(s) had untolerated taint(s), 2 Insufficient cpu. preemption: 0/3 nodes are available: 3 Preemption is not helpful for scheduling.1
94s         Warning   FailedScheduling     pod/needs-volume                  0/3 nodes are available: pod has unbound immediate PersistentVolumeClaims. not found
93s         Warning   Unhealthy            pod/not-ready-ff679bbcb-fgtbt     Readiness probe failed: Get "http://10.244.2.26:8080/ready": dial tcp 10.244.2.26:8080: connect: connection refused2
49s         Warning   BackOff              pod/crashloop-d6d7fcb65-hgfm7     Back-off restarting failed container app in pod crashloop-d6d7fcb65-hgfm7_debug(912fa39c-38f6-4196-8115-a2a6d38c2fbf)
37s         Warning   Unhealthy            pod/slow-start-7b95c566f8-hvphb   Liveness probe failed: HTTP probe failed with statuscode: 503
36s         Warning   BackOff              pod/slow-start-7b95c566f8-hvphb   Back-off restarting failed container app in pod slow-start-7b95c566f8-hvphb_debug(dc3ef925-c9b6-49ea-aff0-f1ae6397bcf3)
24s         Warning   Failed               pod/bad-image-57b9b799f6-7xbsn    Error: ImagePullBackOff
23s         Warning   Unhealthy            pod/not-ready-ff679bbcb-fgtbt     Readiness probe failed: HTTP probe failed with statuscode: 404
12s         Warning   BackOff              pod/oom-66c5d4b56b-bfdvw          Back-off restarting failed container app in pod oom-66c5d4b56b-bfdvw_debug(8c34a5b5-25b1-434e-b2f9-3748075f391d)
11s         Warning   ProvisioningFailed   persistentvolumeclaim/data        storageclass.storage.k8s.io "fast-ssd" not found3
10s         Warning   Failed               pod/bad-image-57b9b799f6-7xbsn    Failed to pull image "kubelab:9.9.9": rpc error: code = NotFound desc = failed to pull and unpack image "docker.io/library/kubelab:9.9.9": failed to resolve reference "docker.io/library/kubelab:9.9.9": docker.io/library/kubelab:9.9.9: not found
10s         Warning   Failed               pod/bad-image-57b9b799f6-7xbsn    Error: ErrImagePull
3s          Warning   Failed               pod/no-config-5484465b65-bxx2z    Error: configmap "app-settings" not found4

$ kubectl -n kubelab get pods -l app.kubernetes.io/name=kubelab -o wide
NAME                       READY   STATUS    RESTARTS   AGE     IP            NODE          NOMINATED NODE   READINESS GATES
kubelab-6b777469b9-4mn6b   1/1     Running   0          4m43s   10.244.2.8    lab-worker    <none>           <none>
kubelab-6b777469b9-5ws4r   1/1     Running   0          3m55s   10.244.2.14   lab-worker    <none>           <none>
kubelab-6b777469b9-b5454   1/1     Running   0          3m55s   10.244.1.10   lab-worker2   <none>           <none>
kubelab-6b777469b9-gb5fz   1/1     Running   0          3m55s   10.244.2.13   lab-worker    <none>           <none>
kubelab-6b777469b9-w9hj4   1/1     Running   0          4m40s   10.244.1.6    lab-worker2   <none>           <none>
kubelab-6b777469b9-xtcdh   1/1     Running   0          4m37s   10.244.1.7    lab-worker2   <none>           <none>
$ kubectl -n kubelab get pdb kubelab
NAME      MIN AVAILABLE   MAX UNAVAILABLE   ALLOWED DISRUPTIONS   AGE
kubelab   2               N/A               4                     6m40s
$ kubectl drain lab-worker2 --ignore-daemonsets --delete-emptydir-data --timeout=180s
node/lab-worker2 cordoned1
evicting pod debug/web-5b97c5d84d-bmp6f
evicting pod kubelab/kubelab-6b777469b9-xtcdh2
evicting pod kubelab/kubelab-db-1
evicting pod kube-system/metrics-server-84c99cb944-vz687
evicting pod kubelab-helm/demo-kubelab-5b77db878d-f2bb8
evicting pod kubelab/kubelab-6b777469b9-b5454
evicting pod kubelab/kubelab-6b777469b9-w9hj4
pod/kubelab-db-1 evicted
pod/kubelab-6b777469b9-xtcdh evicted
pod/metrics-server-84c99cb944-vz687 evicted
pod/demo-kubelab-5b77db878d-f2bb8 evicted
pod/web-5b97c5d84d-bmp6f evicted
pod/kubelab-6b777469b9-b5454 evicted
pod/kubelab-6b777469b9-w9hj4 evicted
node/lab-worker2 drained
Warning: ignoring DaemonSet-managed Pods: kube-system/kindnet-sf4p2, kube-system/kube-proxy-x5zbp3
$ kubectl get nodes
NAME                STATUS                     ROLES           AGE   VERSION
lab-control-plane   Ready                      control-plane   10m   v1.37.1
lab-worker          Ready                      <none>          10m   v1.37.1
lab-worker2         Ready,SchedulingDisabled   <none>          10m   v1.37.14
$ kubectl -n kubelab get pods -l app.kubernetes.io/name=kubelab -o wide
NAME                       READY   STATUS    RESTARTS   AGE     IP            NODE         NOMINATED NODE   READINESS GATES
kubelab-6b777469b9-4mn6b   1/1     Running   0          4m46s   10.244.2.8    lab-worker   <none>           <none>
kubelab-6b777469b9-59bch   0/1     Running   0          2s      10.244.2.34   lab-worker   <none>           <none>5
kubelab-6b777469b9-5ws4r   1/1     Running   0          3m58s   10.244.2.14   lab-worker   <none>           <none>
kubelab-6b777469b9-g5ljw   1/1     Running   0          3s      10.244.2.30   lab-worker   <none>           <none>
kubelab-6b777469b9-gb5fz   1/1     Running   0          3m58s   10.244.2.13   lab-worker   <none>           <none>
kubelab-6b777469b9-pk6zq   0/1     Running   0          3s      10.244.2.33   lab-worker   <none>           <none>

$ kubectl uncordon lab-worker2
node/lab-worker2 uncordoned1
$ kubectl get nodes
NAME                STATUS   ROLES           AGE   VERSION
lab-control-plane   Ready    control-plane   10m   v1.37.1
lab-worker          Ready    <none>          10m   v1.37.1
lab-worker2         Ready    <none>          10m   v1.37.1

$ kubectl -n kube-system exec etcd-lab-control-plane -- etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key member list -w table
┌──────────────────┬─────────┬───────────────────┬─────────────────────────┬─────────────────────────┬────────────┐
│        ID        │ STATUS  │       NAME        │       PEER ADDRS        │      CLIENT ADDRS       │ IS LEARNER │
├──────────────────┼─────────┼───────────────────┼─────────────────────────┼─────────────────────────┼────────────┤
│ 23da9c3f2594532a │ started │ lab-control-plane │ https://172.18.0.3:2380 │ https://172.18.0.3:2379 │      false │1
└──────────────────┴─────────┴───────────────────┴─────────────────────────┴─────────────────────────┴────────────┘
$ kubectl -n kube-system exec etcd-lab-control-plane -- etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key endpoint status -w table
┌────────────────────────┬──────────────────┬─────────┬─────────────────┬─────────┬────────┬───────────────────────┬────────┬───────────┬────────────┬───────────┬────────────┬────────────────────┬────────┬──────────────────────────┬───────────────────┐
│        ENDPOINT        │        ID        │ VERSION │ STORAGE VERSION │ DB SIZE │ IN USE │ PERCENTAGE NOT IN USE │ QUOTA  │ IS LEADER │ IS LEARNER │ RAFT TERM │ RAFT INDEX │ RAFT APPLIED INDEX │ ERRORS │ DOWNGRADE TARGET VERSION │ DOWNGRADE ENABLED │2
├────────────────────────┼──────────────────┼─────────┼─────────────────┼─────────┼────────┼───────────────────────┼────────┼───────────┼────────────┼───────────┼────────────┼────────────────────┼────────┼──────────────────────────┼───────────────────┤
│ https://127.0.0.1:2379 │ 23da9c3f2594532a │   3.7.0 │           3.7.0 │   13 MB │  12 MB │                    7% │ 2.1 GB │      true │      false │         2 │       3586 │               3586 │        │                          │             false │
└────────────────────────┴──────────────────┴─────────┴─────────────────┴─────────┴────────┴───────────────────────┴────────┴───────────┴────────────┴───────────┴────────────┴────────────────────┴────────┴──────────────────────────┴───────────────────┘
$ kubectl -n kube-system exec etcd-lab-control-plane -- etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /var/lib/etcd/snapshot-2026-10-19.db
Snapshot saved at /var/lib/etcd/snapshot-2026-10-19.db3
Server version 3.7.0
{"level":"info","ts":"2026-10-19T15:42:44.934515Z","caller":"snapshot/v3_snapshot.go:83","msg":"created temporary db file","path":"/var/lib/etcd/snapshot-2026-10-19.db.part"}
{"level":"info","ts":"2026-10-19T15:42:44.950032Z","logger":"client","caller":"v3@v3.7.0/maintenance.go:236","msg":"opened snapshot stream; downloading"}
{"level":"info","ts":"2026-10-19T15:42:44.953240Z","caller":"snapshot/v3_snapshot.go:96","msg":"fetching snapshot","endpoint":"https://127.0.0.1:2379"}
{"level":"info","ts":"2026-10-19T15:42:45.065011Z","logger":"client","caller":"v3@v3.7.0/maintenance.go:302","msg":"completed snapshot read; closing"}
{"level":"info","ts":"2026-10-19T15:42:45.084731Z","caller":"snapshot/v3_snapshot.go:111","msg":"fetched snapshot","endpoint":"https://127.0.0.1:2379","size":"13 MB","took":"149.890332ms","etcd-version":"3.7.0"}
{"level":"info","ts":"2026-10-19T15:42:45.084839Z","caller":"snapshot/v3_snapshot.go:121","msg":"saved","path":"/var/lib/etcd/snapshot-2026-10-19.db"}
$ kubectl -n kube-system exec etcd-lab-control-plane -- etcdutl snapshot status /var/lib/etcd/snapshot-2026-10-19.db -w table
┌──────────┬──────────┬────────────┬────────────┬─────────┐
│   HASH   │ REVISION │ TOTAL KEYS │ TOTAL SIZE │ VERSION │4
├──────────┼──────────┼────────────┼────────────┼─────────┤
│ c9a1ed62 │     3311 │        866 │      13 MB │   3.7.0 │
└──────────┴──────────┴────────────┴────────────┴─────────┘

$ docker exec lab-control-plane kubeadm certs check-expiration
[check-expiration] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[check-expiration] Use 'kubeadm init phase upload-config kubeadm --config your-config-file' to re-upload it.

CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
admin.conf                 Oct 19, 2027 15:32 UTC   364d            ca                      no      
apiserver                  Oct 19, 2027 15:32 UTC   364d            ca                      no      1
apiserver-etcd-client      Oct 19, 2027 15:32 UTC   364d            etcd-ca                 no      
apiserver-kubelet-client   Oct 19, 2027 15:32 UTC   364d            ca                      no      
controller-manager.conf    Oct 19, 2027 15:32 UTC   364d            ca                      no      
etcd-healthcheck-client    Oct 19, 2027 15:32 UTC   364d            etcd-ca                 no      
etcd-peer                  Oct 19, 2027 15:32 UTC   364d            etcd-ca                 no      
etcd-server                Oct 19, 2027 15:32 UTC   364d            etcd-ca                 no      
front-proxy-client         Oct 19, 2027 15:32 UTC   364d            front-proxy-ca          no      
scheduler.conf             Oct 19, 2027 15:32 UTC   364d            ca                      no      
super-admin.conf           Oct 19, 2027 15:32 UTC   364d            ca                      no      

CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
ca                      Oct 16, 2036 15:32 UTC   9y              no      2
etcd-ca                 Oct 16, 2036 15:32 UTC   9y              no      
front-proxy-ca          Oct 16, 2036 15:32 UTC   9y              no      

$ docker exec lab-control-plane kubeadm upgrade plan
[preflight] Running pre-flight checks.
[upgrade/config] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...
[upgrade/config] Use 'kubeadm init phase upload-config kubeadm --config your-config-file' to re-upload it.
[upgrade] Running cluster health checks1
[upgrade] Fetching available versions to upgrade to
[upgrade/versions] Cluster version: 1.37.1
[upgrade/versions] kubeadm version: v1.37.1
[upgrade/versions] Target version: v1.37.1
[upgrade/versions] Latest version in the v1.37 series: v1.37.12

W1019 15:56:05.022755    2043 version.go:108] could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable.txt": Get "https://dl.k8s.io/release/stable.txt": dial tcp: lookup dl.k8s.io on 172.18.0.1:53: no such host3
W1019 15:56:05.022803    2043 version.go:109] falling back to the local client version: v1.37.1
W1019 15:56:05.036592    2043 version.go:108] could not fetch a Kubernetes version from the internet: unable to get URL "https://dl.k8s.io/release/stable-1.37.txt": Get "https://dl.k8s.io/release/stable-1.37.txt": dial tcp: lookup dl.k8s.io on 172.18.0.1:53: no such host
W1019 15:56:05.036614    2043 version.go:109] falling back to the local client version: v1.37.1

$ docker exec lab-worker systemctl status kubelet --no-pager | head -12
● kubelet.service - kubelet: The Kubernetes Node Agent
     Loaded: loaded (/etc/systemd/system/kubelet.service; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/kubelet.service.d
             └─10-kubeadm.conf, 11-kind.conf1
     Active: active (running) since Mon 2026-10-19 15:32:31 UTC; 11min ago2
       Docs: http://kubernetes.io/docs/
    Process: 296 ExecStartPre=/bin/sh -euc if [ -f /sys/fs/cgroup/cgroup.controllers ]; then /kind/bin/create-kubelet-cgroup-v2.sh; fi (code=exited, status=0/SUCCESS)
    Process: 298 ExecStartPre=/bin/sh -euc if [ ! -f /sys/fs/cgroup/cgroup.controllers ] && [ ! -d /sys/fs/cgroup/systemd/kubelet ]; then mkdir -p /sys/fs/cgroup/systemd/kubelet; fi (code=exited, status=0/SUCCESS)
   Main PID: 299 (kubelet)
      Tasks: 13 (limit: 9612)
     Memory: 43.7M ()
     CGroup: /kubelet.slice/kubelet.service
$ docker exec lab-worker crictl ps | head -8
CONTAINER           IMAGE               CREATED              STATE               NAME                ATTEMPT             POD ID              POD                               NAMESPACE3
fccc3c407c33e       5a7252c143818       About a minute ago   Running             app                 2                   ff2a00c1575f0       oom-66c5d4b56b-bfdvw              debug
e1ce2e5abdba6       5a7252c143818       About a minute ago   Running             app                 0                   1a2a110981629       web-5b97c5d84d-k974s              debug
af264cd065170       5a7252c143818       About a minute ago   Running             kubelab             0                   976227241e7ef       demo-kubelab-5b77db878d-z26jx     kubelab-helm
d604c0a9d953b       1dd431a517ec3       About a minute ago   Running             metrics-server      0                   b9f42dd5eacc4       metrics-server-84c99cb944-rgzff   kube-system
b6f868efd345c       5a7252c143818       2 minutes ago        Running             app                 0                   83cf833a708f2       web-5b97c5d84d-5n7ls              debug
7438a3188f810       5a7252c143818       2 minutes ago        Running             app                 0                   34067b7af8e37       not-ready-ff679bbcb-fgtbt         debug
f79b0c7e2609c       5a7252c143818       2 minutes ago        Running             kubelab             0                   a28a484336258       demo-kubelab-5b77db878d-d98xk     kubelab-helm

$ kubectl top nodes
NAME                CPU(cores)   CPU(%)   MEMORY(bytes)   MEMORY(%)   
lab-control-plane   134m         6%       1008Mi          12%         1
lab-worker          86m          4%       366Mi           4%          
lab-worker2         59m          2%       243Mi           3%          
$ kubectl top pods -A --sort-by=memory | head -10
NAMESPACE            NAME                                        CPU(cores)   MEMORY(bytes)   
kube-system          kube-apiserver-lab-control-plane            40m          372Mi           2
kube-system          etcd-lab-control-plane                      26m          106Mi           
kube-system          kube-controller-manager-lab-control-plane   14m          73Mi            
kube-system          kube-proxy-x5zbp                            1m           46Mi            
kube-system          kube-proxy-dx7f2                            1m           46Mi            
kube-system          kindnet-sf4p2                               3m           42Mi            
kube-system          kindnet-lhdzr                               4m           41Mi            
kube-system          kube-scheduler-lab-control-plane            8m           30Mi            
kube-system          metrics-server-84c99cb944-rgzff             3m           16Mi            
$ kubectl describe node lab-worker | sed -n '/Conditions:/,/Addresses:/p'
Conditions:
  Type             Status  LastHeartbeatTime                 LastTransitionTime                Reason                       Message
  ----             ------  -----------------                 ------------------                ------                       -------
  MemoryPressure   False   Mon, 19 Oct 2026 17:39:42 +0200   Mon, 19 Oct 2026 17:32:32 +0200   KubeletHasSufficientMemory   kubelet has sufficient memory available3
  DiskPressure     False   Mon, 19 Oct 2026 17:39:42 +0200   Mon, 19 Oct 2026 17:32:32 +0200   KubeletHasNoDiskPressure     kubelet has no disk pressure
  PIDPressure      False   Mon, 19 Oct 2026 17:39:42 +0200   Mon, 19 Oct 2026 17:32:32 +0200   KubeletHasSufficientPID      kubelet has sufficient PID available
  Ready            True    Mon, 19 Oct 2026 17:39:42 +0200   Mon, 19 Oct 2026 17:32:54 +0200   KubeletReady                 kubelet is posting ready status
Addresses: