Jon Chery
d1aa5daf2b
---ci--- project: atelier phase: 5 milestone: v0.2 status: complete requirements: covered: [ATELIER-36, ATELIER-37, ATELIER-38, ATELIER-39, ATELIER-40, ATELIER-41, ATELIER-42, ATELIER-43, ATELIER-44, ATELIER-45, ATELIER-46, ATELIER-47, ATELIER-48, ATELIER-49, ATELIER-50, ATELIER-51, ATELIER-52, ATELIER-53, ATELIER-54, ATELIER-55, ATELIER-56, ATELIER-57, ATELIER-58, ATELIER-59] partial: [] ---/ci---
67 lines
2.8 KiB
Markdown
67 lines
2.8 KiB
Markdown
# Kubernetes — First Principles
|
|
|
|
## 1. The Principles
|
|
|
|
### P1. Declarative Desired State
|
|
You declare the desired state; controllers reconcile current →
|
|
desired. Imperative `kubectl` is for inspection and incident
|
|
response, not for the steady state. The cluster's job is to make
|
|
reality match the manifest.
|
|
|
|
### P2. Pods are Mortal
|
|
A pod is born, runs, and dies. Never assume its identity, its IP,
|
|
or its lifetime. Use controllers (Deployment, StatefulSet,
|
|
DaemonSet), not bare pods. A bare pod has no recovery, no
|
|
scaling, no rollback.
|
|
|
|
### P3. Labels Select
|
|
Labels and selectors are the join mechanism of the platform —
|
|
workloads to services, policies to workloads, workloads to nodes.
|
|
Label by intent (`app`, `tier`, `env`), not by infrastructure
|
|
(`node-3`, `ip-10.0.0.5`). Selectors compose; ad-hoc naming does
|
|
not.
|
|
|
|
### P4. Requests and Limits are Contracts
|
|
Resource requests drive scheduling; limits drive quality of
|
|
service. A workload with no requests is `BestEffort` — first
|
|
evicted under pressure. A workload with no limits is unbounded.
|
|
Specifying requests is not optional in production.
|
|
|
|
### P5. Probes Drive Health
|
|
Liveness, readiness, and startup probes are how the platform
|
|
sees your workload. Without a readiness probe, traffic routes to
|
|
a pod that is not ready. Without a liveness probe, a wedged
|
|
container runs forever. The platform cannot heal what it cannot
|
|
see.
|
|
|
|
### P6. Namespaces Bound Blast Radius
|
|
Namespaces are the unit of quota, RBAC, network policy, and
|
|
cleanup. A namespace is the boundary of "this thing and all its
|
|
parts." Default namespace is for nothing in production; every
|
|
workload gets a named namespace sized to its blast radius.
|
|
|
|
### P7. RBAC by Intent, Not Identity
|
|
Bind roles to service accounts by the workload's purpose, not to
|
|
user identities. Least privilege: the role grants the minimum
|
|
the workload needs. `cluster-admin` is a smell, not a shortcut.
|
|
Cross-link `domains/security/authorization.md`.
|
|
|
|
### P8. Storage is Explicit
|
|
Storage is ephemeral by default. Persistence requires a
|
|
PVC, a StorageClass, and a reclaim policy decision. `emptyDir`
|
|
for state that must survive is a bug. The choice of
|
|
reclaim policy (`Retain`, `Delete`) is a data-safety decision,
|
|
not a default.
|
|
|
|
### P9. Config and Secrets are Separate
|
|
ConfigMaps are non-sensitive configuration; Secrets are
|
|
sensitive configuration. Both are injected at runtime, never
|
|
baked into the image. A configuration change should not require
|
|
a rebuild; a secret rotation should not require a redeploy of the
|
|
image. Cross-link `domains/security/secrets.md`.
|
|
|
|
### P10. Roll Forward, Roll Back
|
|
Every Deployment has a rolling update strategy and a rollout
|
|
history. A deploy is reversible: `kubectl rollout undo`. A deploy
|
|
without a tested rollback is a prototype. Canary and blue-green
|
|
are the k8s expression of `domains/devops/P5 Progressive Delivery`. |