Kubernetes
Dominio Total

# Instalar minikube en Linux
curl -LO https://storage.googleapis.com/minikube/releases/latest/minikube-linux-amd64
sudo install minikube-linux-amd64 /usr/local/bin/minikube

# Instalar kubectl
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

# Iniciar cluster local
minikube start --driver=docker --cpus=2 --memory=4096

# Verificar
kubectl cluster-info
kubectl get nodes

# Ver recursos del cluster
kubectl get nodes
kubectl get pods --all-namespaces
kubectl get services

# Información detallada
kubectl describe node <nombre-nodo>
kubectl describe pod <nombre-pod>

# Ver logs
kubectl logs <pod-name>
kubectl logs -f <pod-name>  # en tiempo real

# Ejecutar comando dentro de un pod
kubectl exec -it <pod-name> -- /bin/bash

apiVersion: v1
kind: Pod
metadata:
  name: mi-pod
  labels:
    app: web
    version: "1.0"
spec:
  containers:
  - name: nginx
    image: nginx:1.25
    ports:
    - containerPort: 80
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"

livenessProbe:   # reinicia el pod si falla
  httpGet:
    path: /healthz
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10
  failureThreshold: 3

readinessProbe:  # retira del balanceo si falla
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5

startupProbe:   # para apps lentas al arrancar
  httpGet:
    path: /healthz
    port: 8080
  failureThreshold: 30
  periodSeconds: 10

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mi-app
  namespace: production
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: mi-app
  template:
    metadata:
      labels:
        app: mi-app
    spec:
      containers:
      - name: app
        image: myrepo/mi-app:v2.0
        ports:
        - containerPort: 3000

# Escalar deployment
kubectl scale deployment mi-app --replicas=5

# Rolling update de imagen
kubectl set image deployment/mi-app app=myrepo/mi-app:v3.0

# Ver historial de rollouts
kubectl rollout history deployment/mi-app

# Rollback a versión anterior
kubectl rollout undo deployment/mi-app

# Rollback a revisión específica
kubectl rollout undo deployment/mi-app --to-revision=2

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  serviceName: "postgres"
  replicas: 3
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
      - name: postgres
        image: postgres:15
        volumeMounts:
        - name: data
          mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
  - metadata:
      name: data
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluentd-logging
spec:
  selector:
    matchLabels:
      name: fluentd
  template:
    metadata:
      labels:
        name: fluentd
    spec:
      containers:
      - name: fluentd
        image: fluent/fluentd-kubernetes-daemonset:v1
        volumeMounts:
        - name: varlog
          mountPath: /var/log
      volumes:
      - name: varlog
        hostPath:
          path: /var/log

apiVersion: batch/v1
kind: CronJob
metadata:
  name: backup-db
spec:
  schedule: "0 2 * * *"  # cada día a las 2am
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: backup
            image: postgres:15
            command: ["/bin/sh", "-c", "pg_dump $DATABASE_URL | gzip > /backup/db.sql.gz"]
          restartPolicy: OnFailure

# ClusterIP (por defecto)
apiVersion: v1
kind: Service
metadata:
  name: mi-servicio
spec:
  type: ClusterIP
  selector:
    app: mi-app
  ports:
  - protocol: TCP
    port: 80
    targetPort: 3000

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: mi-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
  - hosts: [app.midominio.com]
    secretName: tls-secret
  rules:
  - host: app.midominio.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend-service
            port:
              number: 80

# PersistentVolume
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-datos
spec:
  capacity:
    storage: 20Gi
  accessModes:
  - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: fast-ssd
  hostPath:
    path: /mnt/datos
---
# PersistentVolumeClaim
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mi-pvc
spec:
  accessModes:
  - ReadWriteOnce
  storageClassName: fast-ssd
  resources:
    requests:
      storage: 5Gi

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-ssd
provisioner: ebs.csi.aws.com  # AWS EBS
parameters:
  type: gp3
  iops: "3000"
  throughput: "125"
reclaimPolicy: Delete
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer

# Role (namespace-scoped)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
---
# RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: ServiceAccount
  name: mi-app-sa
  namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-ingress
spec:
  podSelector: {}  # aplica a todos los pods
  policyTypes:
  - Ingress
  # sin reglas = denegar todo ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-api
spec:
  podSelector:
    matchLabels:
      app: api
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: mi-app-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: mi-app
  minReplicas: 2
  maxReplicas: 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80

spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: kubernetes.io/arch
            operator: In
            values: [amd64]
          - key: node-type
            operator: In
            values: [gpu]
  tolerations:
  - key: gpu
    operator: Equal
    value: "true"
    effect: NoSchedule

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  DATABASE_HOST: postgres-service
  APP_PORT: "3000"
  LOG_LEVEL: info
  nginx.conf: |
    server {
      listen 80;
      location / { proxy_pass http://app:3000; }
    }
---
# Usar ConfigMap en un Pod
envFrom:
- configMapRef:
    name: app-config

# O variable específica:
env:
- name: DB_HOST
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: DATABASE_HOST

# Crear secret desde literales
kubectl create secret generic db-credentials \
  --from-literal=username=admin \
  --from-literal=password=S3cur3P@ss!

# Crear secret desde archivo
kubectl create secret generic tls-secret \
  --from-file=tls.crt=./cert.pem \
  --from-file=tls.key=./key.pem

apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
stringData:  # se encripta automáticamente en base64
  username: admin
  password: S3cur3P@ss!

# Instalar Helm
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# Agregar repositorio
helm repo add stable https://charts.helm.sh/stable
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

# Buscar charts
helm search repo nginx

# Instalar un chart
helm install mi-nginx bitnami/nginx \
  --namespace web \
  --create-namespace \
  --set service.type=LoadBalancer \
  --set replicaCount=3

# Listar releases
helm list --all-namespaces

# Actualizar release
helm upgrade mi-nginx bitnami/nginx --set replicaCount=5

# Rollback
helm rollback mi-nginx 1

# Desinstalar
helm uninstall mi-nginx

helm create mi-app
# Estructura generada:
# mi-app/
# ├── Chart.yaml        # metadata del chart
# ├── values.yaml       # valores por defecto
# ├── templates/        # plantillas YAML
# │   ├── deployment.yaml
# │   ├── service.yaml
# │   └── ingress.yaml
# └── charts/           # dependencias

# Validar chart
helm lint mi-app

# Ver los YAMLs generados
helm template mi-app ./mi-app --values mi-app/values.yaml

replicaCount: 2

image:
  repository: myrepo/mi-app
  tag: "1.0.0"
  pullPolicy: IfNotPresent

service:
  type: ClusterIP
  port: 80

ingress:
  enabled: true
  host: app.midominio.com

resources:
  limits:
    cpu: 500m
    memory: 512Mi
  requests:
    cpu: 100m
    memory: 128Mi

autoscaling:
  enabled: true
  minReplicas: 2
  maxReplicas: 10
  targetCPUUtilizationPercentage: 70

# Instalar kube-prometheus-stack via Helm
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

helm install monitoring prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace \
  --set grafana.adminPassword=admin123 \
  --set prometheus.prometheusSpec.retention=30d

# Ver pods del stack
kubectl get pods -n monitoring

# Acceder a Grafana (port-forward)
kubectl port-forward -n monitoring svc/monitoring-grafana 3000:80

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: mi-app-monitor
  namespace: monitoring
spec:
  selector:
    matchLabels:
      app: mi-app
  endpoints:
  - port: metrics
    interval: 15s
    path: /metrics

helm repo add grafana https://grafana.github.io/helm-charts
helm install loki grafana/loki-stack \
  --namespace monitoring \
  --set grafana.enabled=false \
  --set promtail.enabled=true

# En Grafana, agregar datasource Loki:
# URL: http://loki:3100
# Query ejemplo LogQL:
# {namespace="production", app="mi-app"} |= "error"

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: alertas-app
spec:
  groups:
  - name: app.rules
    rules:
    - alert: PodCrashLooping
      expr: rate(kube_pod_container_status_restarts_total[5m]) > 0.1
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: "Pod {{ $labels.pod }} en CrashLoopBackOff"

kubectl create namespace argocd
kubectl apply -n argocd \
  -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Obtener contraseña inicial
kubectl get secret argocd-initial-admin-secret \
  -n argocd -o jsonpath="{.data.password}" | base64 -d

# Port-forward para acceder a la UI
kubectl port-forward svc/argocd-server -n argocd 8080:443

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: mi-app-prod
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/mi-org/mi-app-k8s
    targetRevision: HEAD
    path: manifests/production
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: mi-app-rollout
spec:
  replicas: 10
  strategy:
    canary:
      steps:
      - setWeight: 10    # 10% del tráfico
      - pause: {duration: 5m}
      - setWeight: 25
      - pause: {duration: 10m}
      - setWeight: 50
      - pause: {}        # aprobación manual
      - setWeight: 100