ConfigMap, Secret আর storage — PV, PVC আর StatefulSet

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  LOG_LEVEL: info
  app.conf: |
    greeting=salam
    max_items=20
---
apiVersion: v1
kind: Pod
metadata:
  name: cfg-demo
spec:
  containers:
    - name: app
      image: alpine:3.20
      command: ["sleep", "3600"]
      env:
        - name: LOG_LEVEL
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: LOG_LEVEL
      volumeMounts:
        - name: conf
          mountPath: /etc/app
        - name: conf
          mountPath: /etc/one/app.conf
          subPath: app.conf
      resources:
        requests: { cpu: 10m, memory: 16Mi }
        limits: { cpu: 100m, memory: 32Mi }
  volumes:
    - name: conf
      configMap:
        name: app-config

$ kubectl exec cfg-demo -- printenv LOG_LEVEL
info
$ kubectl exec cfg-demo -- cat /etc/app/LOG_LEVEL
info
$ kubectl exec cfg-demo -- ls -la /etc/app
…
drwxr-xr-x  2 root root 4096 Oct 30 19:15 ..2026_10_30_19_15_08.3481835902
lrwxrwxrwx  1 root root   32 Oct 30 19:15 ..data -> ..2026_10_30_19_15_08.3481835902
lrwxrwxrwx  1 root root   16 Oct 30 19:15 LOG_LEVEL -> ..data/LOG_LEVEL
lrwxrwxrwx  1 root root   15 Oct 30 19:15 app.conf -> ..data/app.conf

$ kubectl patch configmap app-config --type merge -p \
  '{"data":{"LOG_LEVEL":"debug","app.conf":"greeting=salam\nmax_items=50\n"}}'
configmap/app-config patched

# after the kubelet sync, same Pod, no restart
$ kubectl exec cfg-demo -- printenv LOG_LEVEL
info
$ kubectl exec cfg-demo -- cat /etc/app/LOG_LEVEL
debug
$ kubectl exec cfg-demo -- cat /etc/app/app.conf
greeting=salam
max_items=50
$ kubectl exec cfg-demo -- cat /etc/one/app.conf
greeting=salam
max_items=20

// Which value does the container see? Edit POD and CHANGE, then run.
const cm = {
  base:  { COLOR: "blue", SIZE: "small" },
  extra: { COLOR: "green" },
};
const POD = {
  envFrom: ["base", "extra"],          // later source wins
  env: { MODE: "fast", SIZE: "large" },// env beats every envFrom
  file: "base",                        // mounted at /etc/app
};
const CHANGE = { map: "base", key: "SIZE", value: "medium" };
function envAtStart(p, maps) {
  const out = {};
  for (const name of p.envFrom) Object.assign(out, maps[name]);
  return Object.assign(out, p.env);
}
const show = (o) => Object.keys(o).sort().map(k => k + "=" + o[k]).join(" ");
const running = envAtStart(POD, cm);    // fixed when the container starts
console.log("at start  env : " + show(running));
console.log("at start  file: " + show(cm[POD.file]));
const after = JSON.parse(JSON.stringify(cm));
after[CHANGE.map][CHANGE.key] = CHANGE.value;
console.log(`-- ConfigMap ${CHANGE.map}: ${CHANGE.key}=${CHANGE.value}`);
console.log("same Pod  env : " + show(running) + "   (frozen)");
console.log("same Pod  file: " + show(after[POD.file]) + "   (after kubelet sync)");
console.log("new Pod   env : " + show(envAtStart(POD, after)));
// The app, not Kubernetes, decides between a file and a variable.
const appReads = (key) => after[POD.file][key] ?? running[key] ?? "default";
console.log("app rule file > env > default: SIZE=" + appReads("SIZE") +
            " MODE=" + appReads("MODE") + " PORT=" + appReads("PORT"));

$ kubectl create secret generic db-cred \
    --from-literal=username=demo_user \
    --from-literal=password='fake-Passw0rd-123'
secret/db-cred created

$ kubectl get secret db-cred -o yaml
apiVersion: v1
data:
  password: ZmFrZS1QYXNzdzByZC0xMjM=
  username: ZGVtb191c2Vy
kind: Secret
…
type: Opaque

$ kubectl get secret db-cred -o jsonpath='{.data.password}' | base64 -d
fake-Passw0rd-123

$ kubectl describe secret db-cred
…
Data
====
password:  17 bytes
username:  9 bytes

$ kubectl exec sec-demo -- ls -lL /run/cred
total 8
-r--------  1 root root 17 Oct 30 19:20 password
-r--------  1 root root  9 Oct 30 19:20 username

# which filesystem holds the mount
tmpfs /run/cred tmpfs

$ kubectl auth can-i get secrets \
    --as=system:serviceaccount:abcl-kc:default
no

# Passed to kube-apiserver with --encryption-provider-config
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
      - secrets
    providers:
      - kms:
          apiVersion: v2
          name: example-kms
          endpoint: unix:///var/run/kmsplugin/socket.sock
      - identity: {}

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: notes-data
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 16Mi
---
apiVersion: v1
kind: Pod
metadata:
  name: notes-1
spec:
  containers:
    - name: app
      image: alpine:3.20
      command: ["sleep", "3600"]
      volumeMounts:
        - name: data
          mountPath: /data
        - name: scratch
          mountPath: /scratch
      resources:
        requests: { cpu: 10m, memory: 16Mi }
        limits: { cpu: 100m, memory: 64Mi }
  volumes:
    - name: data
      persistentVolumeClaim:
        claimName: notes-data
    - name: scratch
      emptyDir: {}

$ kubectl exec notes-1 -- sh -c \
    'echo "order-1001 paid" > /data/orders.txt; echo "temp cache" > /scratch/tmp.txt'

$ kubectl delete pod notes-1
pod "notes-1" deleted from abcl-kc namespace

$ kubectl get pvc notes-data
NAME         STATUS   VOLUME           CAPACITY   ACCESS MODES   STORAGECLASS   …
notes-data   Bound    pvc-75471c50-…   16Mi       RWO            hostpath       …

# a new Pod notes-2 uses the same claim
$ kubectl exec notes-2 -- cat /data/orders.txt
order-1001 paid
$ kubectl exec notes-2 -- sh -c 'ls -la /scratch; cat /scratch/tmp.txt'
total 8
drwxrwxrwx  2 root root 4096 Oct 30 19:19 .
drwxr-xr-x  1 root root 4096 Oct 30 19:19 ..
cat: can't open '/scratch/tmp.txt': No such file or directory
command terminated with exit code 1

$ kubectl get storageclass
NAME                 PROVISIONER          RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   …
hostpath (default)   docker.io/hostpath   Delete          Immediate           false                  …

$ kubectl get storageclass abcl-kc-late
NAME           PROVISIONER          RECLAIMPOLICY   VOLUMEBINDINGMODE      …
abcl-kc-late   docker.io/hostpath   Retain          WaitForFirstConsumer   …

$ kubectl get pvc late-data
NAME        STATUS    VOLUME   CAPACITY   ACCESS MODES   STORAGECLASS   …
late-data   Pending                                      abcl-kc-late   …

# event on the claim
WaitForFirstConsumer  waiting for first consumer to be created before binding

# after a Pod that uses the claim is created
$ kubectl get pvc late-data
NAME        STATUS   VOLUME           CAPACITY   ACCESS MODES   STORAGECLASS   …
late-data   Bound    pvc-9065f351-…   16Mi       RWO            abcl-kc-late   …

# Policy Delete (class hostpath)
$ kubectl delete pvc notes-data
$ kubectl get pv pvc-75471c50-…
Error from server (NotFound): persistentvolumes "pvc-75471c50-…" not found

# Policy Retain (class abcl-kc-late)
$ kubectl delete pvc late-data
$ kubectl get pv
NAME             CAPACITY   …   RECLAIM POLICY   STATUS     CLAIM               …
pvc-8c4331f9-…   16Mi       …   Retain           Released   abcl-kc/late-data   …

# A new claim naming that PV does not bind yet
FailedBinding  volume "pvc-9065f351-…" already bound to a different claim.

# Remove the old claim reference, then bind again
$ kubectl patch pv pvc-8c4331f9-… --type json \
    -p '[{"op":"remove","path":"/spec/claimRef"}]'
$ kubectl get pv
NAME             CAPACITY   …   RECLAIM POLICY   STATUS      …
pvc-8c4331f9-…   16Mi       …   Retain           Available   …
$ kubectl get pvc late-new
NAME       STATUS   VOLUME           CAPACITY   …
late-new   Bound    pvc-8c4331f9-…   16Mi       …
$ kubectl exec late-pod2 -- cat /data/orders.txt
order-1001 paid

// What happens to the disk after a PVC is deleted. Edit CASES and run.
// RATE is an assumed round number for the arithmetic, not a real price.
const RATE = 0.10;                     // assumed $ per GiB per month
const CASES = [
  { name: "dev-cache",  policy: "Delete", gib: 20,  pvcDeleted: true,  admin: "" },
  { name: "orders-db",  policy: "Retain", gib: 100, pvcDeleted: true,  admin: "" },
  { name: "old-logs",   policy: "Retain", gib: 200, pvcDeleted: true,  admin: "pv" },
  { name: "old-report", policy: "Retain", gib: 50,  pvcDeleted: true,  admin: "pv+disk" },
  { name: "reports",    policy: "Delete", gib: 50,  pvcDeleted: false, admin: "" },
];
function outcome(c) {
  if (!c.pvcDeleted) return { pv: "Bound", disk: "in use", data: "safe" };
  if (c.policy === "Delete") return { pv: "gone", disk: "deleted", data: "LOST" };
  if (c.admin === "pv+disk") return { pv: "gone", disk: "deleted", data: "LOST" };
  if (c.admin === "pv") return { pv: "gone", disk: "orphan", data: "on disk, no PV" };
  return { pv: "Released", disk: "kept", data: "on disk, not reusable yet" };
}
let bill = 0, orphan = 0;
console.log("name        policy  PV        disk     data");
for (const c of CASES) {
  const o = outcome(c);
  const cost = o.disk === "deleted" ? 0 : c.gib * RATE;
  bill += cost;
  if (c.pvcDeleted && o.disk !== "deleted") orphan += cost;
  console.log(c.name.padEnd(12) + c.policy.padEnd(8) + o.pv.padEnd(10) +
    o.disk.padEnd(9) + o.data + "  ($" + cost.toFixed(2) + "/month)");
}
console.log("monthly disk bill: $" + bill.toFixed(2));
console.log("paid for disks no PVC uses: $" + orphan.toFixed(2));

apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  clusterIP: None        # headless: no virtual IP
  selector:
    app: web
  ports:
    - port: 80
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: web
spec:
  serviceName: web       # must name the headless Service
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: nginx
          image: nginx:1.27-alpine
          ports:
            - containerPort: 80
          readinessProbe:
            tcpSocket:
              port: 80
            periodSeconds: 2
          volumeMounts:
            - name: data
              mountPath: /usr/share/nginx/html
          resources:
            requests: { cpu: 20m, memory: 16Mi }
            limits: { cpu: 100m, memory: 48Mi }
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 16Mi

$ kubectl get pods -l app=web -w      # trimmed to one line per change
web-0   0/1   Pending             0     0s
web-0   0/1   ContainerCreating   0     0s
web-0   1/1   Running             0     2s
web-1   0/1   Pending             0     0s
web-1   0/1   ContainerCreating   0     0s
web-1   1/1   Running             0     2s
web-2   0/1   Pending             0     0s
web-2   0/1   ContainerCreating   0     0s
web-2   1/1   Running             0     2s

$ kubectl get pvc
NAME         STATUS   VOLUME           CAPACITY   …
data-web-0   Bound    pvc-045ec649-…   16Mi       …
data-web-1   Bound    pvc-23fc99da-…   16Mi       …
data-web-2   Bound    pvc-2f530807-…   16Mi       …

# from another Pod; each replica wrote its own name to its own disk
$ kubectl exec client -- nslookup -type=a web.abcl-kc.svc.cluster.local
…
Name:	web.abcl-kc.svc.cluster.local
Address: 10.1.0.241
Name:	web.abcl-kc.svc.cluster.local
Address: 10.1.0.242
Name:	web.abcl-kc.svc.cluster.local
Address: 10.1.0.245
$ kubectl exec client -- nslookup -type=a web-1.web.abcl-kc.svc.cluster.local
…
Address: 10.1.0.242
$ kubectl exec client -- wget -qO- http://web-1.web
I am web-1

$ kubectl scale sts web --replicas=1
# watch: web-2 Terminating first, then web-1
$ kubectl get pvc --no-headers
data-web-0   Bound   pvc-045ec649-…   16Mi   …
data-web-1   Bound   pvc-23fc99da-…   16Mi   …
data-web-2   Bound   pvc-2f530807-…   16Mi   …

$ kubectl scale sts web --replicas=3
$ kubectl exec client -- wget -qO- http://web-2.web
I am web-2

$ kubectl delete sts web
statefulset.apps "web" deleted from abcl-kc namespace
$ kubectl get pods -l app=web
No resources found in abcl-kc namespace.
$ kubectl get pvc --no-headers
data-web-0   Bound   pvc-045ec649-…   16Mi   …
data-web-1   Bound   pvc-23fc99da-…   16Mi   …
data-web-2   Bound   pvc-2f530807-…   16Mi   …

// StatefulSet create and rolling update on a simulated clock (seconds).
// Edit SET and run. broken = ordinal that never becomes Ready, -1 = none.
const SET = { replicas: 4, ready: 5, stop: 2, policy: "OrderedReady",
              partition: 0, broken: -1 };
function create(s) {
  let t = 0;
  console.log("-- create, policy " + s.policy);
  for (let i = 0; i < s.replicas; i++) {
    const at = s.policy === "Parallel" ? 0 : t;
    if (i === s.broken) {
      console.log(`t=${at}s web-${i} created, never Ready`);
      if (s.policy !== "Parallel") {
        console.log(`STOP: web-${i + 1} and later are not created`); return false;
      }
      continue;
    }
    console.log(`t=${at}s web-${i} created, Ready at t=${at + s.ready}s`);
    t = at + s.ready;
  }
  return s.broken < 0;
}
function update(s) {
  let t = 0;
  console.log(`-- rolling update, partition ${s.partition}`);
  for (let i = s.replicas - 1; i >= 0; i--) {
    if (i < s.partition) { console.log(`        web-${i} keeps the old revision`); continue; }
    const up = t + s.stop, done = up + s.ready;
    console.log(`t=${t}s web-${i} stops, new one at t=${up}s, Ready at t=${done}s`);
    t = done;
  }
  console.log(`rollout time: ${t}s`);
}
if (create(SET)) update(SET); else console.log("rolling update not started");