أسئلة مقابلة Kubernetes 2026: البودات والخدمات وRBAC وHPA

# ConfigMap — non-sensitive configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  APP_ENV: production
  DB_HOST: postgres-service
  LOG_LEVEL: info

# Secret — sensitive data (base64 encoded, not encrypted by default!)
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
data:
  DB_PASSWORD: c2VjcmV0cGFzcw==  # base64 encoded

# Use in Pod
env:
  - name: APP_ENV
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: APP_ENV
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: app-secrets
        key: DB_PASSWORD

# ClusterIP (default) — only accessible within cluster
apiVersion: v1
kind: Service
spec:
  type: ClusterIP
  selector:
    app: backend
  ports:
    - port: 8000
      targetPort: 8000

# NodePort — exposes on each node's IP at static port
spec:
  type: NodePort
  ports:
    - port: 80
      nodePort: 30080  # 30000-32767 range

# LoadBalancer — cloud provider creates LB
spec:
  type: LoadBalancer
  # Creates AWS ALB, GCP Load Balancer, Azure LB automatically

# Headless — no virtual IP, returns pod IPs directly (for StatefulSet)
spec:
  clusterIP: None
  selector:
    app: kafka

containers:
  - name: app
    livenessProbe:       # Is the container alive? If fails: RESTART container
      httpGet:
        path: /health
        port: 8000
      initialDelaySeconds: 30
      periodSeconds: 10
      failureThreshold: 3

    readinessProbe:      # Is the container ready for traffic? If fails: remove from load balancer
      httpGet:
        path: /ready
        port: 8000
      initialDelaySeconds: 5
      periodSeconds: 5

    startupProbe:        # For slow-starting apps — delays liveness check
      httpGet:
        path: /startup
        port: 8000
      failureThreshold: 30   # gives 5*30=150s for startup
      periodSeconds: 5

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 2
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70  # scale when avg CPU > 70%
    - type: Resource
      resource:
        name: memory
        target:
          type: AverageValue
          averageValue: 500Mi
    # Custom metrics (requires metrics-server + Prometheus adapter)
    - type: Pods
      pods:
        metric:
          name: requests_per_second
        target:
          type: AverageValue
          averageValue: 100

# ServiceAccount — identity for pods
apiVersion: v1
kind: ServiceAccount
metadata:
  name: myapp-sa

# Role — permissions within a namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/logs"]
    verbs: ["get", "list", "watch"]

# ClusterRole — cluster-wide permissions
kind: ClusterRole
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "create", "update", "delete"]

# RoleBinding — attach role to service account
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: myapp-pod-reader
subjects:
  - kind: ServiceAccount
    name: myapp-sa
    namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io