Kubernetes Objects — Enterprise Declarative Reference

🚀

Workload Objects pods · deployments · statefulsets · daemonsets · jobs

Namespace globalcorp-production Tenant isolation for multi-region, multi-team cluster ▾

// why it matters

Scope boundary — every resource lives inside a namespace. MNCs use one namespace per team/env/region.

LimitRange — set default CPU/memory so any pod without requests gets sane defaults.

ResourceQuota — cap total CPU, memory, and object count per team/namespace.

Labels — used by RBAC, NetworkPolicy, and cost allocation tools (e.g. Kubecost).

isolation quota multi-team

namespace.yaml

apiVersion: v1 kind: Namespace metadata: name: globalcorp-production labels: team: platform env: production cost-center: eng-001 region: us-east annotations: owner: platform-team@globalcorp.com --- apiVersion: v1 kind: ResourceQuota metadata: name: production-quota namespace: globalcorp-production spec: hard: requests.cpu: "100" requests.memory: 200Gi limits.cpu: "200" limits.memory: 400Gi pods: "500" services: "50"

Deployment payment-service Stateless service with rolling updates and resource limits ▾

// enterprise patterns

Rolling update — maxSurge 25% / maxUnavailable 0 ensures zero downtime deploys for SLA-critical services.

Pod affinity — spread replicas across AZs using topologySpreadConstraints for HA.

Resource limits — always set both requests and limits. Payment services use Guaranteed QoS (requests = limits).

Probes — liveness restarts crashed containers; readiness gates traffic until warm.

stateless rolling-update Guaranteed QoS

deployment-payment.yaml

apiVersion: apps/v1 kind: Deployment metadata: name: payment-service namespace: globalcorp-production labels: app: payment-service version: v3.2.1 tier: backend spec: replicas: 6 selector: matchLabels: app: payment-service strategy: type: RollingUpdate rollingUpdate: maxSurge: 25% maxUnavailable: 0 template: metadata: labels: app: payment-service spec: topologySpreadConstraints: - maxSkew: 1 topologyKey: topology.kubernetes.io/zone whenUnsatisfiable: DoNotSchedule labelSelector: matchLabels: app: payment-service containers: - name: payment-service image: gcr.io/globalcorp/payment-service:v3.2.1 ports: - containerPort: 8080 resources: requests: cpu: 500m memory: 512Mi limits: cpu: 500m memory: 512Mi livenessProbe: httpGet: path: /healthz port: 8080 initialDelaySeconds: 15 periodSeconds: 10 readinessProbe: httpGet: path: /ready port: 8080 initialDelaySeconds: 5 periodSeconds: 5 envFrom: - configMapRef: name: payment-config - secretRef: name: payment-secrets

StatefulSet postgres-cluster Ordered, stable-identity pods for stateful databases ▾

// key differences from Deployment

Stable network identity — pods get deterministic names (postgres-0, postgres-1) used by primary/replica replication.

Ordered startup — postgres-0 starts before postgres-1 ensuring primary is ready before replicas.

volumeClaimTemplates — each pod gets its own PVC that persists across restarts.

stateful persistent ordered

statefulset-postgres.yaml

apiVersion: apps/v1 kind: StatefulSet metadata: name: postgres-cluster namespace: globalcorp-production spec: serviceName: postgres-headless replicas: 3 selector: matchLabels: app: postgres template: metadata: labels: app: postgres spec: containers: - name: postgres image: postgres:15-alpine ports: - containerPort: 5432 resources: requests: cpu: 2 memory: 4Gi limits: cpu: 4 memory: 8Gi volumeMounts: - name: postgres-data mountPath: /var/lib/postgresql/data env: - name: POSTGRES_PASSWORD valueFrom: secretKeyRef: name: postgres-secret key: password volumeClaimTemplates: - metadata: name: postgres-data spec: accessModes: ["ReadWriteOnce"] storageClassName: gp3-encrypted resources: requests: storage: 100Gi

DaemonSet log-collector One pod per node — logging, monitoring, security agents ▾

// use cases

Log forwarding — Fluentd/Fluent Bit collects container logs from each node's /var/log.

Node monitoring — Prometheus node-exporter runs as DaemonSet for hardware metrics.

Security scanning — Falco or Datadog agent runs on every node for runtime threat detection.

per-node observability

daemonset-log-collector.yaml

apiVersion: apps/v1 kind: DaemonSet metadata: name: log-collector namespace: globalcorp-production spec: selector: matchLabels: app: log-collector template: metadata: labels: app: log-collector spec: tolerations: - key: node-role.kubernetes.io/control-plane effect: NoSchedule containers: - name: fluent-bit image: fluent/fluent-bit:2.1 resources: requests: cpu: 100m memory: 128Mi limits: cpu: 200m memory: 256Mi volumeMounts: - name: varlog mountPath: /var/log readOnly: true volumes: - name: varlog hostPath: path: /var/log

CronJob invoice-batch-processor Scheduled financial batch jobs across regions and time zones ▾

// enterprise scheduling

concurrencyPolicy: Forbid — prevents invoice double-processing if a batch run overruns.

startingDeadlineSeconds — if cluster was down during scheduled time, skip the missed run.

backoffLimit — retry failed jobs exactly N times before marking as Failed.

scheduled batch

cronjob-invoice.yaml

apiVersion: batch/v1 kind: CronJob metadata: name: invoice-batch-processor namespace: globalcorp-production spec: schedule: "0 2 * * *" # 2am UTC daily concurrencyPolicy: Forbid startingDeadlineSeconds: 3600 successfulJobsHistoryLimit: 3 failedJobsHistoryLimit: 5 jobTemplate: spec: backoffLimit: 2 activeDeadlineSeconds: 7200 template: spec: restartPolicy: OnFailure serviceAccountName: invoice-processor-sa containers: - name: invoice-processor image: gcr.io/globalcorp/invoice-processor:latest command: ["python", "-m", "invoice.batch"] resources: requests: cpu: 2 memory: 4Gi limits: cpu: 4 memory: 8Gi

🌐

Networking Objects service · ingress · networkpolicy · gateway

Service payment-service-svc Stable DNS + load balancing for internal and external traffic ▾

// service types

ClusterIP (default) — internal-only stable IP. Use for service-to-service calls.

LoadBalancer — provisions cloud LB. Use for external entry points requiring raw TCP/UDP (e.g. gRPC at edge).

Headless (clusterIP: None) — direct pod DNS for StatefulSets like Kafka, Postgres.

ClusterIP stable DNS

service-payment.yaml

apiVersion: v1 kind: Service metadata: name: payment-service-svc namespace: globalcorp-production annotations: service.beta.kubernetes.io/aws-load-balancer-type: nlb spec: type: ClusterIP selector: app: payment-service ports: - name: http port: 80 targetPort: 8080 protocol: TCP - name: grpc port: 9090 targetPort: 9090 protocol: TCP sessionAffinity: None --- # Headless service for StatefulSet DNS apiVersion: v1 kind: Service metadata: name: postgres-headless namespace: globalcorp-production spec: clusterIP: None selector: app: postgres ports: - port: 5432

Ingress globalcorp-ingress TLS termination, host-based routing, canary annotations ▾

// production ingress essentials

TLS termination — cert-manager automatically provisions and renews Let's Encrypt or internal CA certs.

Path-based routing — /api → backend; /app → frontend SPA; /webhooks → event-processor.

Rate limiting annotations — nginx limits req/s per IP to prevent abuse at edge.

TLS routing rate-limit

ingress-globalcorp.yaml

apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: globalcorp-ingress namespace: globalcorp-production annotations: kubernetes.io/ingress.class: nginx cert-manager.io/cluster-issuer: letsencrypt-prod nginx.ingress.kubernetes.io/rate-limit: "200" nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/proxy-body-size: 10m spec: tls: - hosts: - api.globalcorp.com - app.globalcorp.com secretName: globalcorp-tls rules: - host: api.globalcorp.com http: paths: - path: /payment pathType: Prefix backend: service: name: payment-service-svc port: number: 80 - path: /user pathType: Prefix backend: service: name: user-service-svc port: number: 80

NetworkPolicy payment-isolation-policy Zero-trust pod-to-pod firewall rules for PCI-DSS compliance ▾

// compliance patterns

Default-deny — apply a deny-all policy first, then selectively allow. Required for PCI-DSS and SOC2.

Ingress rules — only api-gateway pods on port 8080 can reach payment pods.

Egress rules — payment pods can only egress to postgres and external payment processors.

PCI-DSS zero-trust

networkpolicy-payment.yaml

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: payment-isolation-policy namespace: globalcorp-production spec: podSelector: matchLabels: app: payment-service policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: api-gateway ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: postgres ports: - protocol: TCP port: 5432 - to: # external payment processor - ipBlock: cidr: 0.0.0.0/0 except: - 10.0.0.0/8 ports: - protocol: TCP port: 443

⚙️

Configuration Objects configmap · secret · externalSecret

ConfigMap payment-config Non-sensitive environment config, feature flags, and runtime tuning ▾

// best practices

Never store secrets here — ConfigMaps are plaintext. Use Secret or ExternalSecret for credentials.

Mount as file or env — large config files (nginx.conf, app.properties) mount as volumes; small values as envFrom.

Immutable: true — prevents accidental live edits in production. Requires rollout to change.

non-sensitive feature flags

configmap-payment.yaml

apiVersion: v1 kind: ConfigMap metadata: name: payment-config namespace: globalcorp-production immutable: true data: ENVIRONMENT: production LOG_LEVEL: info PAYMENT_TIMEOUT_MS: "5000" MAX_RETRY_COUNT: "3" FEATURE_3DS_ENABLED: "true" FEATURE_BNPL_ENABLED: "false" REGION: us-east-1 DB_POOL_SIZE: "20" OTEL_EXPORTER_ENDPOINT: http://otel-collector:4317 app.properties: | spring.datasource.pool-size=20 spring.cache.type=redis management.endpoints.web.exposure.include=*

Secret payment-secrets Base64 credentials + ExternalSecret from AWS Secrets Manager ▾

// enterprise secret management

External Secrets Operator — syncs secrets from AWS Secrets Manager, Vault, or GCP Secret Manager. Never commit secrets to Git.

Sealed Secrets — encrypt secrets in Git using Bitnami Sealed Secrets for GitOps workflows.

RBAC restriction — only the service's ServiceAccount can read its own secret.

sensitive ESO vault

externalsecret-payment.yaml

# External Secrets Operator — syncs from AWS apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: payment-secrets namespace: globalcorp-production spec: refreshInterval: 1h secretStoreRef: name: aws-secrets-manager kind: ClusterSecretStore target: name: payment-secrets creationPolicy: Owner data: - secretKey: DB_PASSWORD remoteRef: key: prod/payment/db property: password - secretKey: STRIPE_API_KEY remoteRef: key: prod/payment/stripe property: api-key - secretKey: JWT_SECRET remoteRef: key: prod/auth/jwt property: signing-key

💾

Storage Objects pvc · storageclass · pv

PersistentVolumeClaim media-storage-pvc Encrypted, retain-policy storage for media and document uploads ▾

// storage patterns

StorageClass gp3-encrypted — custom class using AWS EBS gp3 with KMS encryption. Required for GDPR data at rest.

reclaimPolicy: Retain — don't auto-delete PVs when PVC is deleted. Protects production data.

ReadWriteMany — use EFS (AWS) or Filestore (GCP) for shared storage across pods.

encrypted GDPR retain

pvc-and-storageclass.yaml

apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: gp3-encrypted annotations: storageclass.kubernetes.io/is-default-class: "true" provisioner: ebs.csi.aws.com reclaimPolicy: Retain volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true parameters: type: gp3 encrypted: "true" kmsKeyId: arn:aws:kms:us-east-1:123456:key/abc-xyz --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: media-storage-pvc namespace: globalcorp-production labels: data-classification: confidential spec: accessModes: - ReadWriteOnce storageClassName: gp3-encrypted resources: requests: storage: 500Gi

🔐

Security & RBAC serviceaccount · role · clusterrole · rolebinding · podsecurity

RBAC payment-service-rbac Least-privilege service account with scoped role and binding ▾

// least privilege principle

Dedicated ServiceAccount — never use the default SA. Each service gets its own identity with minimal permissions.

Role (namespaced) — prefer Role over ClusterRole unless the service genuinely needs cluster-wide access.

Workload Identity — bind SA to cloud IAM (AWS IRSA / GCP Workload Identity) for cloud API access without static keys.

least-privilege IRSA

rbac-payment.yaml

apiVersion: v1 kind: ServiceAccount metadata: name: payment-service-sa namespace: globalcorp-production annotations: # AWS IRSA — maps SA to IAM role eks.amazonaws.com/role-arn: arn:aws:iam::123456:role/payment-service-role --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: payment-service-role namespace: globalcorp-production rules: - apiGroups: [""] resources: ["secrets"] resourceNames: ["payment-secrets"] verbs: ["get"] - apiGroups: [""] resources: ["configmaps"] resourceNames: ["payment-config"] verbs: ["get", "list"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: payment-service-rb namespace: globalcorp-production subjects: - kind: ServiceAccount name: payment-service-sa namespace: globalcorp-production roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: payment-service-role

📈

Autoscaling Objects hpa · vpa · pdb · keda

HorizontalPodAutoscaler payment-hpa Scale pods on CPU, memory, and custom Prometheus metrics ▾

// scale strategies

CPU + memory — dual-metric HPA. Scale out when either threshold is crossed; scale in only when both drop.

KEDA — event-driven autoscaler for queue-depth-based scaling (Kafka lag, SQS queue length).

stabilizationWindowSeconds — prevents flapping by requiring metrics to stabilize before scaling in.

HPA v2 anti-flap

hpa-payment.yaml

apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: name: payment-hpa namespace: globalcorp-production spec: scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: payment-service minReplicas: 6 maxReplicas: 50 metrics: - type: Resource resource: name: cpu target: type: Utilization averageUtilization: 60 - type: Resource resource: name: memory target: type: Utilization averageUtilization: 70 behavior: scaleDown: stabilizationWindowSeconds: 300 policies: - type: Pods value: 2 periodSeconds: 60 scaleUp: stabilizationWindowSeconds: 30 policies: - type: Percent value: 100 periodSeconds: 15

PodDisruptionBudget payment-pdb Guarantee minimum availability during node drains and upgrades ▾

// why PDB matters

Node drains — without PDB, cluster autoscaler or kubectl drain can take down too many payment pods simultaneously.

minAvailable: 80% — at least 80% of pods must be running during any voluntary disruption.

Required with HPA — if minReplicas changes, PDB ensures you never dip below a safe floor.

HA SLA

pdb-payment.yaml

apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: payment-pdb namespace: globalcorp-production spec: minAvailable: "80%" selector: matchLabels: app: payment-service

🔭

Observability Objects servicemonitor · prometheusrule · podmonitor

ServiceMonitor payment-metrics Prometheus scrape config for golden signals + SLO alerting ▾

// observability stack

ServiceMonitor — tells kube-prometheus-stack which services to scrape. Requires a /metrics endpoint.

PrometheusRule — defines SLO alerts. Payment latency p99 > 500ms fires a PagerDuty alert.

Golden signals — monitor latency, traffic, errors, and saturation per Google SRE book for every service.

prometheus SLO grafana

servicemonitor-payment.yaml

apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: payment-metrics namespace: globalcorp-production labels: team: payments spec: selector: matchLabels: app: payment-service endpoints: - port: http path: /metrics interval: 15s scrapeTimeout: 10s --- apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: payment-slo-alerts namespace: globalcorp-production spec: groups: - name: payment.slo rules: - alert: PaymentLatencyHigh expr: | histogram_quantile(0.99, rate(http_request_duration_seconds_bucket {app="payment-service"}[5m])) > 0.5 for: 2m labels: severity: critical team: payments annotations: summary: Payment p99 latency exceeds 500ms

🔄

Enterprise Deployment Lifecycle from commit to production

📦

Namespace

Team + env isolation, quota enforcement

🚀

Deployment

Stateless workloads, rolling updates

💽

StatefulSet

Databases, message brokers, stable IDs

👁

DaemonSet

Per-node agents, log collectors

⏰

CronJob

Scheduled batch, financial processing

🌐

Service

Stable DNS, load balancing, ClusterIP

🔀

Ingress

TLS, routing, rate-limiting at edge

🧱

NetworkPolicy

Pod firewall, PCI-DSS zero-trust

📋

ConfigMap

Feature flags, runtime config

🔑

ExternalSecret

Vault / AWS Secrets Manager sync

💾

PVC + StorageClass

Encrypted persistent volumes, GDPR

🔐

RBAC

Least-privilege, IRSA, Workload Identity

📈

HPA + PDB

Autoscale + disruption protection

🔭

ServiceMonitor

Prometheus scrape, SLO alerting

Kubernetes Objectsfor Enterprise Scale