Kubernetes Recipes

Production-grade Kubernetes patterns for SRE teams running real clusters — the cookbook we hand to new engineers on day one. Skip the months of trial and error.

What's inside:

• Cluster layout templates: namespaces, ResourceQuota, LimitRange, default-deny NetworkPolicy, scoped RBAC, GitOps repo structure.

• Workload decision matrix: Deployment vs StatefulSet vs DaemonSet vs Job vs CronJob with full examples.

• Hardened pod templates compliant with the restricted Pod Security Standard (runAsNonRoot, read-only rootfs, dropped capabilities, seccomp RuntimeDefault).

• Rollout playbooks: RollingUpdate tuning, Blue-Green via Service selector switch, Canary with Argo Rollouts and analysis templates.

• Autoscaling stack: HPA on CPU + custom metrics, VPA, Cluster Autoscaler, KEDA ScaledObject for queue-driven workloads.

• Configuration patterns: immutable ConfigMaps, External Secrets Operator, Vault Agent Injector, secret rotation.

• Ingress + Gateway API + cert-manager with Let's Encrypt (HTTP-01 and DNS-01 wildcard) recipes.

• Helm chart anatomy, Sprig idioms, hooks; Kustomize base + overlays + components; Argo CD Application and Flux Kustomization / HelmRelease templates.

• Observability: kube-prometheus-stack, ServiceMonitor, PrometheusRule, SLO-driven alerting, Alertmanager routing.

• OpenTelemetry Collector daemonset with OTLP -> Tempo / Jaeger pipeline.

• Debugging runbook: CrashLoopBackOff, OOMKilled, ImagePullBackOff, DNS, Pending pods, kubectl debug ephemeral containers.

• Cluster operations: etcd snapshot + verified restore, drain with PodDisruptionBudget, upgrade order.

• Supply chain hardening: Trivy CI gates, SBOM generation, cosign keyless signing, Kyverno verify-images policies.

Tested against Kubernetes 1.29, 1.30, and 1.31 on EKS, GKE, AKS, DOKS, and kubeadm clusters. Lifetime updates while the book is maintained, delivered via /library.