Day 14: CKA/CKS 真题演练 + 14 天 Bootcamp 终极总结

spec:
  template:
    spec:
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: DoNotSchedule    # 严格,不行就 Pending
        labelSelector:
          matchLabels: {app: my-app}

spec:
  template:
    spec:
      nodeSelector:
        accelerator: gpu             # 节点 label
      tolerations:
      - key: nvidia.com/gpu
        operator: Exists
        effect: NoSchedule
      containers:
      - resources:
          limits:
            nvidia.com/gpu: 1        # 申请 1 个 GPU

apiVersion: v1
kind: ResourceQuota
metadata: {name: cpu-limit, namespace: my-ns}
spec:
  hard:
    requests.cpu: "5"
    limits.cpu: "10"

# deny-all 时也要 allow egress to DNS (kube-system/kube-dns)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  podSelector: {}
  policyTypes: [Egress]
  egress:
  - to:
    - namespaceSelector:
        matchLabels: {kubernetes.io/metadata.name: kube-system}
      podSelector:
        matchLabels: {k8s-app: kube-dns}
    ports:
    - {protocol: UDP, port: 53}
    - {protocol: TCP, port: 53}

apiVersion: snapshot.storage.k8s.io/v1
kind: VolumeSnapshot
metadata: {name: my-snapshot}
spec:
  volumeSnapshotClassName: longhorn-snapshot-class
  source: {persistentVolumeClaimName: my-pvc}
---
# 从 snapshot 恢复
apiVersion: v1
kind: PersistentVolumeClaim
metadata: {name: restored-pvc}
spec:
  storageClassName: longhorn
  dataSource:
    name: my-snapshot
    kind: VolumeSnapshot
    apiGroup: snapshot.storage.k8s.io

---
apiVersion: v1
kind: ServiceAccount
metadata: {name: only-view, namespace: my-ns}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-cm-reader, namespace: my-ns}
rules:
- apiGroups: [""]
  resources: ["pods", "configmaps"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: {name: only-view-binding, namespace: my-ns}
subjects:
- kind: ServiceAccount
  name: only-view
  namespace: my-ns
roleRef:
  kind: Role
  name: pod-cm-reader
  apiGroup: rbac.authorization.k8s.io

spec:
  securityContext:                  # Pod 级
    runAsNonRoot: true
    runAsUser: 65534
    seccompProfile: {type: RuntimeDefault}
  containers:
  - securityContext:                # 容器级
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      runAsUser: 65534
      readOnlyRootFilesystem: true
      capabilities: {drop: [ALL]}

# /etc/kubernetes/encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources: [secrets]
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: <base64 32-byte 密钥>
  - identity: {}    # 兜底读旧 Secret

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: {name: disallow-latest-tag}
spec:
  validationFailureAction: Enforce
  rules:
  - name: require-image-tag
    match:
      any:
      - resources: {kinds: [Pod]}
    validate:
      message: "Image must have tag (not :latest)"
      pattern:
        spec:
          containers:
          - image: "!*:latest & *:*"

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: my-app
  namespace: my-app-ns
  labels:
    release: kps              # ⚠️ kube-prometheus-stack 抓这 label
spec:
  selector:
    matchLabels: {app: my-app}
  endpoints:
  - port: metrics             # Service.ports.name 必须匹配
    interval: 15s
    path: /metrics

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  labels: {release: kps}
spec:
  groups:
  - name: bootcamp
    rules:
    - alert: NodeCPUHigh
      expr: 100 - (avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
      for: 2m
      labels: {severity: warning}
      annotations:
        summary: 'Node CPU > 80%'

apiVersion: monitoring.coreos.com/v1alpha1
kind: AlertmanagerConfig
metadata:
  name: dingtalk-routes
  labels: {alertmanagerConfig: my-org}
spec:
  route:
    receiver: dingtalk
    routes:
    - matchers: [{name: severity, value: critical}]
      receiver: dingtalk
  receivers:
  - name: dingtalk
    webhookConfigs:
    - url: http://prometheus-webhook-dingtalk.monitoring:8060/dingtalk/critical/send
      sendResolved: true

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata: {name: my-app, namespace: argocd}
spec:
  project: default
  source:
    repoURL: http://gitea.gitea.svc:3000/team/manifest.git
    targetRevision: HEAD
    path: prod
  destination:
    server: https://kubernetes.default.svc
    namespace: prod
  syncPolicy:
    automated: {prune: true, selfHeal: true}
    syncOptions: [CreateNamespace=true]

apiVersion: v1
kind: Secret
metadata:
  name: gitea-repo
  namespace: argocd
  labels: {argocd.argoproj.io/secret-type: repository}
stringData:
  type: git
  url: http://gitea.gitea.svc:3000/team/repo.git
  username: u
  password: p
  insecure: "true"