Kubernetes basics: Pod, Deployment, Service, ConfigMap, Secret?

apiVersion: v1
kind: Pod
metadata:
  name: orders-api-debug
  labels: { app: orders-api }
spec:
  containers:
    - name: orders-api
      image: registry.example.uz/orders-api:1.4.2
      ports: [{ containerPort: 8080 }]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders-api
  namespace: shop
spec:
  replicas: 3
  selector:
    matchLabels: { app: orders-api }
  strategy:
    type: RollingUpdate
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }     # не уменьшать число работающих реплик при раскатке
  template:
    metadata:
      labels: { app: orders-api, version: "1.4.2" }
    spec:
      containers:
        - name: orders-api
          image: registry.example.uz/orders-api:1.4.2
          ports: [{ containerPort: 8080 }]
          envFrom:
            - configMapRef: { name: orders-config }
          env:
            - name: ConnectionStrings__Default
              valueFrom: { secretKeyRef: { name: orders-secrets, key: db-connection } }
          resources:
            requests: { cpu: "250m", memory: "256Mi" }    # для планировщика: сколько гарантировать
            limits:   { memory: "512Mi" }                  # превышение памяти → OOMKilled
          readinessProbe:
            httpGet: { path: /health/ready, port: 8080 }
          livenessProbe:
            httpGet: { path: /health/live, port: 8080 }
          securityContext:
            runAsNonRoot: true
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false

apiVersion: v1
kind: Service
metadata: { name: orders-api, namespace: shop }
spec:
  type: ClusterIP
  selector: { app: orders-api }          # все поды с этой меткой — бэкенды сервиса
  ports:
    - port: 80                           # порт сервиса
      targetPort: 8080                   # порт контейнера

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop
  annotations: { cert-manager.io/cluster-issuer: letsencrypt }
spec:
  ingressClassName: nginx
  tls: [{ hosts: [shop.example.uz], secretName: shop-tls }]
  rules:
    - host: shop.example.uz
      http:
        paths:
          - { path: /api/orders, pathType: Prefix, backend: { service: { name: orders-api, port: { number: 80 } } } }
          - { path: /, pathType: Prefix, backend: { service: { name: web, port: { number: 80 } } } }

apiVersion: v1
kind: ConfigMap
metadata: { name: orders-config, namespace: shop }
data:
  ASPNETCORE_ENVIRONMENT: Production
  Features__NewCheckout: "true"
  appsettings.Production.json: |          # можно смонтировать как файл
    { "Logging": { "LogLevel": { "Default": "Information" } } }
---
apiVersion: v1
kind: Secret
metadata: { name: orders-secrets, namespace: shop }
type: Opaque
stringData:                                # в etcd хранится base64 — это НЕ шифрование
  db-connection: "Host=pg;Database=orders;Username=orders;Password=***"

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata: { name: orders-api }
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: orders-api }
  minReplicas: 3
  maxReplicas: 10
  metrics:
    - type: Resource
      resource: { name: cpu, target: { type: Utilization, averageUtilization: 70 } }

kubectl apply -f k8s/                              # применить манифесты
kubectl get pods -n shop -o wide                    # поды, ноды, IP
kubectl describe pod orders-api-7d9f -n shop        # события: почему не стартует (ImagePullBackOff, OOMKilled)
kubectl logs -f deploy/orders-api -n shop           # логи
kubectl rollout status deploy/orders-api -n shop    # ход раскатки
kubectl rollout undo deploy/orders-api -n shop      # откат
kubectl port-forward svc/orders-api 8080:80 -n shop # доступ локально
kubectl exec -it orders-api-7d9f -n shop -- sh      # (если в образе есть shell)