Pod — container-এর দল, lifecycle আর probe

apiVersion: v1
kind: Pod
metadata:
  name: duo
  labels:
    app: duo
spec:
  volumes:
    - name: shared
      emptyDir: {}
  containers:
    - name: web
      image: nginx:1.27-alpine
      imagePullPolicy: IfNotPresent
      ports:
        - containerPort: 80
      volumeMounts:
        - name: shared
          mountPath: /usr/share/nginx/html
      resources:
        requests: {cpu: 20m, memory: 32Mi}
        limits: {memory: 128Mi}
    - name: writer
      image: alpine:3.20
      imagePullPolicy: IfNotPresent
      command: ["sh", "-c"]
      args:
        - |
          n=0
          while true; do
            n=$((n + 1))
            echo "update $n from writer" > /data/index.html
            sleep 5
          done
      volumeMounts:
        - name: shared
          mountPath: /data
      resources:
        requests: {cpu: 10m, memory: 8Mi}
        limits: {memory: 32Mi}

$ kubectl apply -f duo.yaml
pod/duo created
$ kubectl get pod duo
NAME   READY   STATUS    RESTARTS   AGE
duo    2/2     Running   0          1s

# writer has no web server, yet localhost:80 answers
$ kubectl exec duo -c writer -- wget -qO- http://localhost:80/
update 2 from writer

# both containers see one hostname and one IP
$ kubectl exec duo -c writer -- sh -c 'hostname; ip -4 addr show eth0 | grep inet'
duo
    inet 10.1.0.44/16 brd 10.1.255.255 scope global eth0
$ kubectl exec duo -c web -- sh -c 'hostname; ip -4 addr show eth0 | grep inet'
duo
    inet 10.1.0.44/16 brd 10.1.255.255 scope global eth0

# same file through a different path
$ kubectl exec duo -c web -- cat /usr/share/nginx/html/index.html
update 20 from writer
$ kubectl exec duo -c writer -- ls /data
index.html

# filesystems stay separate: nginx folder does not exist in writer
$ kubectl exec duo -c writer -- ls /usr/share/nginx
ls: /usr/share/nginx: No such file or directory
command terminated with exit code 1

$ kubectl get pod clash
NAME    READY   STATUS             RESTARTS   AGE
clash   1/2     CrashLoopBackOff   …
$ kubectl logs clash -c second | tail -3
nginx: [emerg] bind() to [::]:80 failed (98: Address in use)
…
nginx: [emerg] still could not bind()

apiVersion: v1
kind: Pod
metadata:
  name: init-side
spec:
  restartPolicy: Never
  volumes:
    - name: logs
      emptyDir: {}
  initContainers:
    - name: check-config            # ordinary init: runs, then ends
      image: alpine:3.20
      imagePullPolicy: IfNotPresent
      command: ["sh", "-c", "echo checking config; sleep 3; echo config ok"]
      resources:
        requests: {cpu: 10m, memory: 8Mi}
        limits: {memory: 32Mi}
    - name: log-shipper             # native sidecar: keeps running
      image: alpine:3.20
      imagePullPolicy: IfNotPresent
      restartPolicy: Always
      command: ["sh", "-c"]
      args:
        - |
          touch /logs/app.log
          tail -F /logs/app.log &
          trap 'echo shipper stopping; exit 0' TERM
          wait
      volumeMounts:
        - name: logs
          mountPath: /logs
      resources:
        requests: {cpu: 10m, memory: 8Mi}
        limits: {memory: 32Mi}
  containers:
    - name: job
      image: alpine:3.20
      imagePullPolicy: IfNotPresent
      command: ["sh", "-c"]
      args:
        - |
          for i in 1 2 3; do
            echo "report part $i done" >> /logs/app.log
            sleep 2
          done
      volumeMounts:
        - name: logs
          mountPath: /logs
      resources:
        requests: {cpu: 10m, memory: 8Mi}
        limits: {memory: 32Mi}

$ kubectl get pod init-side         # repeated, one line per check
init-side   0/2   Init:0/2          0     3s
init-side   0/2   Init:1/2          0     4s
init-side   1/2   PodInitializing   0     6s
init-side   2/2   Running           0     7s
init-side   1/2   Completed         0     13s
init-side   0/2   Completed         0     20s

$ kubectl logs init-side -c log-shipper
report part 1 done
report part 2 done
report part 3 done
shipper stopping

# phase and exit times (trimmed)
Succeeded
job          exitCode 0   finishedAt 19:18:05
log-shipper  exitCode 0   finishedAt 19:18:06

# onfail-exit3: OnFailure, exit 3 · onfail-exit0: OnFailure, exit 0
# always-exit0: Always, exit 0
$ kubectl get pods onfail-exit3 onfail-exit0 always-exit0 \
    -o custom-columns=NAME:.metadata.name,PHASE:.status.phase,RESTARTS:.status.containerStatuses[0].restartCount
NAME           PHASE       RESTARTS
onfail-exit3   Running     2
onfail-exit0   Succeeded   0
always-exit0   Running     2

# container command: date -u +%T >> /notes/starts; cat /notes/starts; exit 1
$ kubectl get pod crash2
NAME     READY   STATUS             RESTARTS      AGE
crash2   0/1     CrashLoopBackOff   2 (29s ago)   45s

$ kubectl logs crash2      # start times of every run
19:26:44
19:26:45
19:26:59
19:27:28
19:28:08
19:29:32
19:32:14
19:37:17

# waiting message from the same kind of Pod, in order
back-off 10s restarting failed container=app …
back-off 20s restarting failed container=app …
back-off 40s restarting failed container=app …
back-off 1m20s restarting failed container=app …
back-off 2m40s restarting failed container=app …
back-off 5m0s restarting failed container=app …
back-off 5m0s restarting failed container=app …
back-off 5m0s restarting failed container=app …

// CrashLoopBackOff delays, simulated clock in seconds.
// Model of what we measured: 1st restart at once, then 10 s doubling.
const BASE = 10, CAP = 300;  // kubelet defaults in this run
const RESET = 600;           // a run this long clears the backoff
// How long each start lived before it crashed. Edit and run again.
const LIVES = [0, 0, 0, 0, 0, 0, 0, 0, 0, 700, 0, 0, 0];

const mmss = s => `${String(Math.floor(s / 60)).padStart(3)}m${String(s % 60).padStart(2, "0")}s`;
let clock = 0, wait = 0;
console.log("start  at        lived  next wait");
LIVES.forEach((life, i) => {
  const at = clock;
  clock += life;
  let note = "";
  if (life >= RESET) {       // ran long enough: forget the history
    wait = 0;
    note = "  (backoff reset)";
  }
  console.log(`#${String(i).padEnd(5)} ${mmss(at)}  ${String(life).padStart(4)}s  ${wait}s${note}`);
  clock += wait;
  wait = wait === 0 ? BASE : Math.min(wait * 2, CAP);
});
console.log(`total time in this history: ${mmss(clock)}`);

$ kubectl get pod badimage
NAME       READY   STATUS             RESTARTS   AGE
badimage   0/1     ImagePullBackOff   0          2m9s

$ kubectl describe pod badimage | sed -n '/^Events/,$p'     # Age column removed
Events:
  Type     Reason     From      Message
  Normal   Pulling    kubelet   Pulling image "nginx:1.27-no-such-tag"
  Warning  Failed     kubelet   Failed to pull image "nginx:1.27-no-such-tag": Error response from daemon:
           failed to resolve reference "docker.io/library/nginx:1.27-no-such-tag": … not found
  Warning  Failed     kubelet   Error: ErrImagePull
  Normal   BackOff    kubelet   Back-off pulling image "nginx:1.27-no-such-tag"
  Warning  Failed     kubelet   Error: ImagePullBackOff

$ kubectl get pod oom
NAME   READY   STATUS      RESTARTS   AGE
oom    0/1     OOMKilled   0          12s
$ kubectl logs oom | tail -2
allocated 48 MiB
allocated 56 MiB
$ kubectl describe pod oom
…
    State:          Terminated
      Reason:       OOMKilled
      Exit Code:    137
…

# env DB_PASSWORD comes from secretKeyRef db-secret, which does not exist
$ kubectl get pod nosecret
NAME       READY   STATUS                       RESTARTS   AGE
nosecret   0/1     CreateContainerConfigError   0          6s
$ kubectl describe pod nosecret | sed -n '/^Events/,$p'     # Age column removed
…
  Warning  Failed     kubelet   Error: secret "db-secret" not found

# create the missing Secret and do nothing else
$ kubectl create secret generic db-secret --from-literal=password=not-a-real-password
secret/db-secret created
$ kubectl get pod nosecret        # a few seconds later
nosecret   1/1   Running   0     17s

apiVersion: v1
kind: Pod
metadata:
  name: live-bad
spec:
  containers:
    - name: web
      image: nginx:1.27-alpine
      imagePullPolicy: IfNotPresent
      livenessProbe:
        httpGet:
          path: /healthz
          port: 80
        periodSeconds: 5
        failureThreshold: 3
      resources:
        requests: {cpu: 10m, memory: 16Mi}
        limits: {memory: 64Mi}

$ kubectl get pod live-bad
NAME       READY   STATUS    RESTARTS     AGE
live-bad   1/1     Running   1 (8s ago)   23s

$ kubectl describe pod live-bad      # Age column removed
…
    Last State:     Terminated
      Reason:       Completed
      Exit Code:    0
…
  Warning  Unhealthy  kubelet   Liveness probe failed: HTTP probe failed with statuscode: 404
  Normal   Killing    kubelet   Container web failed liveness probe, will be restarted

# a fresh run of the same Pod, about a minute later
$ kubectl get pod live-bad
NAME       READY   STATUS             RESTARTS     AGE
live-bad   0/1     CrashLoopBackOff   3 (8s ago)   69s

$ kubectl get pods -l app=shop
NAME     READY   STATUS    RESTARTS   AGE
shop-a   0/1     Running   0          14s
shop-b   1/1     Running   0          14s

$ kubectl get endpointslice -l kubernetes.io/service-name=shop
NAME         ADDRESSTYPE   PORTS   ENDPOINTS               AGE
shop-2frp8   IPv4          80      10.1.0.142,10.1.0.143   14s

# the column above is not the whole story: read each endpoint
$ kubectl get endpointslice -l kubernetes.io/service-name=shop -o jsonpath='…'
shop-a 10.1.0.142 ready=false serving=false
shop-b 10.1.0.143 ready=true serving=true

$ kubectl get pods slow-bad slow-ok
NAME       READY   STATUS    RESTARTS     AGE
slow-bad   0/1     Running   1 (8s ago)   26s
slow-ok    0/1     Running   0            26s

$ kubectl describe pod slow-bad      # Age column removed
…
  Warning  Unhealthy  kubelet   Startup probe failed: dial tcp 10.1.0.153:8000: connect: connection refused
  Normal   Killing    kubelet   Container app failed startup probe, will be restarted

$ kubectl get pods slow-bad slow-ok     # 30 seconds later
NAME       READY   STATUS    RESTARTS     AGE
slow-bad   0/1     Running   3 (4s ago)   56s
slow-ok    1/1     Running   0            56s

// Probe evaluator on a simulated clock (seconds). Edit the scenarios.
// ok(t) says whether the app would pass a probe at time t.
const SCENARIOS = [
  { name: "liveness, app hangs at 32 s", kind: "liveness",
    period: 5, threshold: 3, end: 60, ok: t => t < 32 },
  { name: "readiness, blip 20..26 s", kind: "readiness",
    period: 3, threshold: 2, end: 36, ok: t => t < 20 || t >= 27 },
  { name: "liveness only, app needs 40 s to boot", kind: "liveness",
    period: 5, threshold: 3, end: 60, ok: t => t >= 40 },
  { name: "startup budget 3 x 20, app needs 40 s", kind: "startup",
    period: 3, threshold: 20, end: 60, ok: t => t >= 40 },
];
for (const s of SCENARIOS) {
  let fails = 0, marks = "", events = [], ready = true;
  // kubelet adds a little jitter; here the first probe is at one period
  for (let t = s.period; t <= s.end; t += s.period) {
    const pass = s.ok(t);
    fails = pass ? 0 : fails + 1;
    marks += pass ? "." : "x";
    if (s.kind === "startup" && pass) { events.push(`started at ${t}s`); break; }
    if (s.kind === "readiness") {
      if (fails === s.threshold) { ready = false; events.push(`not ready at ${t}s`); }
      if (pass && !ready) { ready = true; events.push(`ready again at ${t}s`); }
    } else if (fails === s.threshold) {
      events.push(`container killed at ${t}s`);
      break;
    }
  }
  console.log(s.name);
  console.log(`  ${marks}  ${events.join(", ") || "no action"}`);
}

$ kubectl get pod slow-health
NAME          READY   STATUS    RESTARTS     AGE
slow-health   1/1     Running   1 (4s ago)   24s

$ kubectl describe pod slow-health      # Age column removed
…
    Last State:     Terminated
      Reason:       Error
      Exit Code:    137
…
  Warning  Unhealthy  kubelet   Liveness probe failed: Get "http://10.1.0.123:8000/healthz":
           context deadline exceeded (Client.Timeout exceeded while awaiting headers)
  Normal   Killing    kubelet   Container app failed liveness probe, will be restarted

apiVersion: v1
kind: Pod
metadata:
  name: term-good
spec:
  terminationGracePeriodSeconds: 30
  containers:
    - name: app
      image: alpine:3.20
      imagePullPolicy: IfNotPresent
      command: ["sh", "-c"]
      args:
        - |
          trap 'echo "SIGTERM received, finishing work"; sleep 3; echo "clean exit"; exit 0' TERM
          echo "serving"
          while true; do sleep 1; done
      lifecycle:
        preStop:
          exec:
            command: ["sh", "-c", "echo 'preStop started' > /proc/1/fd/1; sleep 5; echo 'preStop done' > /proc/1/fd/1"]
      resources:
        requests: {cpu: 10m, memory: 8Mi}
        limits: {memory: 32Mi}

$ kubectl logs -f term-good --timestamps &       # keep watching
$ kubectl delete pod term-good --wait=false
pod "term-good" deleted from abcl-kp namespace
$ kubectl get pod term-good
NAME        READY   STATUS        RESTARTS   AGE
term-good   1/1     Terminating   0          5s
$ kubectl get pod term-good -o jsonpath='{.metadata.deletionTimestamp} {.metadata.deletionGracePeriodSeconds}'
2026-10-30T19:22:28Z 30

# log lines (date removed from the timestamps)
19:21:56.202  serving
19:21:58.513  preStop started
19:22:03.514  preStop done
19:22:05.344  SIGTERM received, finishing work
19:22:08.345  clean exit

$ kubectl delete pod term-deaf --wait=false
$ kubectl get pod term-deaf     # repeated every second
term-deaf   1/1   Terminating   0     17s
term-deaf   1/1   Terminating   0     18s
term-deaf   1/1   Terminating   0     19s
term-deaf   0/1   Error         0     21s
Error from server (NotFound): pods "term-deaf" not found

# a second run of the same Pod, read just before it vanished
$ kubectl get pod term-deaf -o jsonpath='…'
137 Error

// Pod termination timeline, simulated seconds. Edit CASES.
// grace: terminationGracePeriodSeconds, hook: preStop duration,
// app: seconds the app needs after SIGTERM (Infinity = ignores it).
const CASES = [
  { name: "term-good", grace: 30, hook: 5, app: 3 },
  { name: "term-deaf", grace: 5, hook: 0, app: Infinity },
  { name: "hook eats the budget", grace: 30, hook: 25, app: 10 },
  { name: "hook too long", grace: 10, hook: 15, app: 3 },
];
const MIN_LEFT = 2;  // kubelet keeps at least this after the hook
for (const c of CASES) {
  const hookEnd = Math.min(c.hook, c.grace);
  const left = Math.max(c.grace - hookEnd, MIN_LEFT);
  const clean = c.app <= left;
  const end = hookEnd + (clean ? c.app : left);
  console.log(`${c.name}: grace ${c.grace}s`);
  const at = t => `t=${t}`.padEnd(6);
  console.log(`  ${at(0)}delete, deletionTimestamp set`);
  if (c.hook > 0) {
    const cut = c.hook > c.grace ? " (cut short)" : "";
    console.log(`  ${at(0)}preStop starts, ends t=${hookEnd}${cut}`);
  }
  console.log(`  ${at(hookEnd)}SIGTERM, ${left}s left`);
  console.log(`  ${at(end)}` + (clean ? "app exits cleanly, code 0" : "SIGKILL, exit code 137"));
}

apiVersion: v1
kind: Pod
metadata:
  name: prestop-sleep
spec:
  containers:
    - name: app
      image: alpine:3.20
      imagePullPolicy: IfNotPresent
      command: ["sleep", "3600"]
      lifecycle:
        preStop:
          sleep:
            seconds: 5
      resources:
        requests: {cpu: 10m, memory: 8Mi}
        limits: {memory: 32Mi}

$ kubectl get pod crash
NAME    READY   STATUS             RESTARTS      AGE
crash   0/1     CrashLoopBackOff   9 (16s ago)   21m

$ kubectl describe pod crash      # Age column removed
…
    State:          Waiting
      Reason:       CrashLoopBackOff
    Last State:     Terminated
      Reason:       Error
      Exit Code:    1
…
    Restart Count:  9
…
  Warning  BackOff   kubelet   Back-off restarting failed container app in pod crash

$ kubectl logs crash --previous
cannot connect to db

$ kubectl exec nosh -- sh
OCI runtime exec failed: exec failed: unable to start container process: exec: "sh":
executable file not found in $PATH
command terminated with exit code 127

$ kubectl debug nosh --image=alpine:3.20 --target=app --container=dbg \
    --attach=false --profile=general -- sh -c 'ps; ls -l /proc/1/exe'
Targeting container "app". If you don't see processes from this container …
$ kubectl logs nosh -c dbg
PID   USER     TIME  COMMAND
    1 65535     0:00 /pause
   13 root      0:00 sh -c ps; ls -l /proc/1/exe
   19 root      0:00 ps
lrwxrwxrwx    1 65535    root    0 … /proc/1/exe -> /pause

$ kubectl get pod nosh
NAME   READY   STATUS    RESTARTS   AGE
nosh   1/1     Running   0          6s

$ kubectl delete pod bare
pod "bare" deleted from abcl-kp namespace
$ kubectl delete pod demo-84d45bf8fb-9dg99
pod "demo-84d45bf8fb-9dg99" deleted from abcl-kp namespace
$ kubectl get pods       # 3 seconds later, other Pods trimmed
NAME                    READY   STATUS    RESTARTS   AGE
demo-84d45bf8fb-bb4xd   1/1     Running   0          4s