Kubernetes — Container Orchestration

কেন Kubernetes?

• Container scaling, self-healing
• Service discovery, load balance
• Rolling update, rollback
• Multi-cloud portable

Architecture

Control Plane:
  API Server, etcd, Scheduler, Controller Manager

Worker Node:
  kubelet, kube-proxy, Container Runtime (containerd)
  Pods → Containers

Pod ⭐

Smallest unit — 1+ container, shared network/storage।

apiVersion: v1
kind: Pod
metadata: { name: app-pod }
spec:
  containers:
  - name: web
    image: myapp:1.0
    ports: [{ containerPort: 3000 }]

Normally Pod সরাসরি create না — Deployment use।

Deployment ⭐

apiVersion: apps/v1
kind: Deployment
metadata: { name: app }
spec:
  replicas: 3
  selector: { matchLabels: { app: web } }
  template:
    metadata: { labels: { app: web } }
    spec:
      containers:
      - name: web
        image: myapp:1.0
        resources:
          requests: { cpu: 100m, memory: 128Mi }
          limits: { cpu: 500m, memory: 512Mi }
        livenessProbe:
          httpGet: { path: /health, port: 3000 }
        readinessProbe:
          httpGet: { path: /ready, port: 3000 }

Service

apiVersion: v1
kind: Service
metadata: { name: web-svc }
spec:
  selector: { app: web }
  ports:
  - port: 80
    targetPort: 3000
  type: ClusterIP   # ClusterIP | NodePort | LoadBalancer

Ingress ⭐

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts: [app.com]
    secretName: app-tls
  rules:
  - host: app.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend: { service: { name: web-svc, port: { number: 80 } } }

ConfigMap & Secret

apiVersion: v1
kind: ConfigMap
metadata: { name: app-config }
data:
  DATABASE_HOST: postgres.svc
  LOG_LEVEL: info

---
apiVersion: v1
kind: Secret
metadata: { name: app-secret }
type: Opaque
data:
  DB_PASSWORD: <base64>

# Use in Pod
env:
  - name: DB_HOST
    valueFrom: { configMapKeyRef: { name: app-config, key: DATABASE_HOST } }
  - name: DB_PASSWORD
    valueFrom: { secretKeyRef: { name: app-secret, key: DB_PASSWORD } }

kubectl Commands

kubectl apply -f deployment.yaml
kubectl get pods, kubectl get svc
kubectl describe pod <name>
kubectl logs -f <pod>
kubectl exec -it <pod> -- sh
kubectl scale deployment app --replicas=5
kubectl rollout status deployment/app
kubectl rollout undo deployment/app
kubectl port-forward svc/app 8080:80

Helm ⭐

Kubernetes package manager। Template + values.yaml।

myapp-chart/
├── Chart.yaml
├── values.yaml
└── templates/
    ├── deployment.yaml
    ├── service.yaml
    └── ingress.yaml

# Install
helm install myapp ./myapp-chart -f values.prod.yaml
helm upgrade myapp ./myapp-chart
helm rollback myapp 1
helm uninstall myapp

HPA (Horizontal Pod Autoscaler)

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
spec:
  scaleTargetRef: { kind: Deployment, name: app }
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target: { type: Utilization, averageUtilization: 70 }

Zero Downtime Deployment

Rolling update + readiness probe + PodDisruptionBudget। MaxSurge/MaxUnavailable tune করুন।

Security ⭐

• RBAC — Role, RoleBinding
• Network Policy — pod-to-pod firewall
• Pod Security Standards (baseline, restricted)
• Run as non-root, read-only FS
• Resource limits (prevent noisy neighbor)
• Image scan (Trivy)
• Secrets — external (Vault, cloud KMS)
• mTLS (Istio, Linkerd)

Managed k8s

EKS (AWS), AKS (Azure), GKE (Google) — best-in-class, recommended over self-hosted।