Kubernetes Best Practices (Brendan Burns, Eddie Villalba, Dave Strebel etc.)（Z-Library）

# Kubernetes Best Practices: Blueprints for Building Successful Applications on Kubernetes ## 【One-Line Pitch】 A practical, field-tested reference for developers and operators who already know Kubernetes basics and want to deploy production-grade applications using proven patterns from real-world experience. If you're about to put your first workload into production—or have been running clusters for years—this book distills hard-won lessons from four Kubernetes veterans into actionable blueprints. ## 【Book Arc】 - **Opening (~0%–9%)**: The authors frame the book as a collection of standalone chapters rather than a linear tutorial. They assume readers already understand Kubernetes fundamentals and position the book as a reference to dip into per topic—covering development workflows, operations, cluster management, and independent topics like machine learning and external service integration. - **Early (~9%–25%)**: Chapter 1 walks through setting up a basic multitier application (a journal service with a Redis backend and NGINX static file server). The focus is on foundational practices: organizing YAML files in version control, treating Kubernetes configuration with the same rigor as source code, and adopting GitOps principles where production deployments come only from a specific branch via CI/CD automation. - **Early (~25%–34%)**: The book dives into image management and Deployment best practices. Key lessons include guarding against supply-chain attacks by using trusted base images, treating image version tags as immutable (using semantic version + commit SHA), and setting resource Requests equal to Limits for predictable behavior—trading maximal utilization for stability. - **Middle (~34%–47%)**: The focus shifts to exposing applications externally and managing configuration. The authors explain why an Ingress resource (rather than just a Service) is worth the complexity for HTTP routing flexibility, and they introduce ConfigMaps for feature flags and configuration. A critical insight: never edit a ConfigMap in place—version it (e.g., `frontend-config-v1` → `v2`) to trigger proper Deployment rollouts and enable clean rollbacks. - **Middle (~47%–53%)**: The book covers secrets management, warning against storing passwords in source code or images. The excerpts show the authors advocating for external key management services (like cloud KMS or HashiCorp Vault) with tighter Kubernetes integration, while noting that Kubernetes Secrets are stored unencrypted by default—a critical security caveat. ## 【Key Takeaways】 - **Treat Kubernetes configuration like source code** (Early): Store YAML in Git, use code review, and organize files by application service with subdirectories for components. This enables auditing, rollback, and collaboration—the same benefits you get from version control in software development. - **Adopt GitOps for deployment reliability** (Early): Deploy to production only from a specific branch using CI/CD automation to guarantee that source control and cluster state match exactly. The authors stress that retrofitting CI/CD into an existing imperative deployment is extremely difficult, so start early. - **Guard against supply-chain attacks in images** (Early): Base your container images only on well-known, trusted providers, or build from scratch (easier with static binaries like Go, harder with interpreted languages). This is a critical security practice for production workloads. - **Treat image tags as immutable** (Early): Use a combination of semantic version and commit SHA (e.g., `v1.0.1-bfeda01f`) rather than relying on `latest`. This ensures reproducibility and makes rollbacks predictable. - **Set resource Requests equal to Limits initially** (Early): This gives the most predictable application behavior at the cost of resource utilization. Only advanced users should tune them independently—most teams find stability worth the trade-off. - **Version your ConfigMaps for safe rollouts** (Middle): Never edit a ConfigMap in place—create a new version (e.g., `frontend-config-v2`) and update the Deployment to reference it. This triggers a health-checked rollout and makes rollback trivial since the old version remains in the cluster. - **Use Ingress for HTTP flexibility** (Middle): Even for simple applications, an Ingress resource provides intelligent HTTP routing based on paths and hosts, enabling future expansion and serving multiple services from a single entry point. - **Never store secrets in source or images** (Middle): Use external key management services (cloud KMS or HashiCorp Vault) with tighter Kubernetes integration. Be aware that Kubernetes Secrets are stored unencrypted by default—a significant security consideration. ## 【Reading Tips】 - **Use this as a reference, not a cover-to-cover read**: The authors explicitly designed chapters to be standalone. Skim the table of contents and jump directly to the topic you need—whether it's monitoring (Ch. 3), networking (Ch. 9), or pod security (Ch. 10). - **Deep-read Chapter 1 for the foundational patterns**: The journal application example establishes the core practices (version control, GitOps, resource management, Ingress) that later chapters build on. Even if your app is more complex, this is the best orientation to the book's approach. - **Pay special attention to the ConfigMap versioning pattern**: This is one of the most practical and frequently overlooked best practices. The distinction between updating a ConfigMap in place versus creating a new version is subtle but critical for safe rollouts. - **Skim the code examples but focus on the reasoning**: The YAML snippets are illustrative, but the real value is in the "why" behind each practice—like why Request=Limit is a good starting point or why Ingress beats a simple Service. - **Note the book's limitations**: The excerpts don't cover the later chapters on monitoring, networking policies, service mesh, multi-cluster management, or machine learning in detail. If those are your primary interest, you'll need to consult the full book. ## 【Coverage Limits】 This guide synthesizes the opening chapters (roughly the first half of the book) covering basic service setup, image management, configuration, and secrets. The excerpts do not cover later topics like monitoring, networking, security policies, multi-cluster management, or machine learning chapters in detail. ##