풀스택 개발자를 위한 인프라 9강 — 쿠버네티스

┌──────────────────── Control Plane ────────────────────┐
│ kube-apiserver   ← 모든 요청의 입구 (kubectl, 컨트롤러) │
│ etcd             ← 클러스터 상태 저장소 (key-value)     │
│ kube-scheduler   ← 새 Pod를 어느 노드에 둘지 결정        │
│ controller-manager ← 원하는 상태를 유지하는 컨트롤러들   │
└───────────────────────────────────────────────────────┘
            │
┌───── Worker Node ─────┐   ┌───── Worker Node ─────┐
│ kubelet     ← Pod 실행 관리 │   │ kubelet               │
│ kube-proxy  ← Service 라우팅│   │ kube-proxy            │
│ containerd  ← 컨테이너 런타임│   │ containerd            │
│ [Pod] [Pod] [Pod]      │   │ [Pod] [Pod]           │
└────────────────────────┘   └───────────────────────┘
       + CNI 플러그인 (Pod 네트워크: Calico, Cilium, Flannel)
       + CoreDNS (클러스터 내부 DNS)

사용자: "replicas: 3 인 Deployment" 를 선언 → etcd에 저장
컨트롤러: 현재 2개 → 1개 생성
스케줄러: 새 Pod를 여유 있는 노드에 배치
kubelet: 컨테이너 실행
... Pod 하나 죽음 → 컨트롤러가 다시 감지 → 새로 생성

apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
  namespace: blog
data:
  LOG_LEVEL: info
  REDIS_URL: redis://redis:6379
---
apiVersion: v1
kind: Secret
metadata:
  name: api-secret
  namespace: blog
type: Opaque
stringData:
  DATABASE_URL: postgres://app:changeme@postgres:5432/app
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: blog
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # 교체 중 최대 1개 추가
      maxUnavailable: 0    # 가용 Pod가 줄지 않게
  template:
    metadata:
      labels:
        app: api
    spec:
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
      containers:
        - name: api
          image: ghcr.io/example/api:a1b2c3d
          ports:
            - containerPort: 3000
          envFrom:
            - configMapRef:
                name: api-config
            - secretRef:
                name: api-secret
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              memory: 512Mi
          startupProbe:
            httpGet: { path: /healthz, port: 3000 }
            failureThreshold: 30
            periodSeconds: 2
          livenessProbe:
            httpGet: { path: /healthz, port: 3000 }
            periodSeconds: 10
          readinessProbe:
            httpGet: { path: /readyz, port: 3000 }
            periodSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["sleep", "5"]
---
apiVersion: v1
kind: Service
metadata:
  name: api
  namespace: blog
spec:
  selector:
    app: api
  ports:
    - port: 80
      targetPort: 3000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api
  namespace: blog
spec:
  ingressClassName: traefik
  tls:
    - hosts: [api.example.com]
      secretName: api-tls
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 80

kubectl create namespace blog
kubectl apply -f app.yaml
kubectl -n blog get all

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api
  namespace: blog
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70     # requests 대비 비율

kubectl -n blog set image deployment/api api=ghcr.io/example/api:d4e5f6a
kubectl -n blog rollout status deployment/api
kubectl -n blog rollout history deployment/api
kubectl -n blog rollout undo deployment/api            # 직전 버전으로
kubectl -n blog rollout restart deployment/api         # 설정 변경 후 재시작

1. Pod 삭제 요청
2. 동시에: (a) Endpoint에서 제거 시작  (b) preStop 훅 실행
3. preStop 종료 후 컨테이너에 SIGTERM
4. terminationGracePeriodSeconds 초과 시 SIGKILL

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: api
  namespace: blog
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: api

kubectl config get-contexts / use-context prod      # 어느 클러스터인지 항상 확인
kubectl get pods -n blog -o wide
kubectl describe pod api-xxx -n blog                # Events 섹션이 핵심
kubectl logs api-xxx -n blog [-c 컨테이너] [--previous]   # --previous: 죽기 전 로그
kubectl logs -l app=api -n blog --tail=100          # 라벨로 여러 Pod
kubectl exec -it api-xxx -n blog -- sh
kubectl port-forward svc/api 8080:80 -n blog        # 로컬에서 서비스 접근
kubectl get events -n blog --sort-by=.lastTimestamp
kubectl top pods -n blog                            # metrics-server 필요
kubectl debug -it api-xxx -n blog --image=nicolaka/netshoot --target=api   # 디버그 컨테이너
kubectl get endpointslices -n blog                  # Service 대상 확인
kubectl explain deployment.spec.strategy            # 필드 설명
kubectl apply -f app.yaml --dry-run=server          # 서버 검증만
kubectl diff -f app.yaml                            # 적용 전 차이

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm install monitoring prometheus-community/kube-prometheus-stack -n monitoring --create-namespace -f values.yaml
helm upgrade / rollback / uninstall

k8s/
├── base/             deployment.yaml, service.yaml, kustomization.yaml
└── overlays/
    ├── dev/          kustomization.yaml (replicas 1, 이미지 태그)
    └── prod/         kustomization.yaml (replicas 3, 리소스 증가)

kubectl apply -k k8s/overlays/prod

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-allow-api-only
  namespace: blog
spec:
  podSelector:
    matchLabels: { app: postgres }
  ingress:
    - from:
        - podSelector:
            matchLabels: { app: api }
      ports:
        - port: 5432

# k3s 설치 (인터넷 환경)
curl -sfL https://get.k3s.io | sh -
sudo k3s kubectl get nodes