La Guida Definitiva ai Comandi Rapidi di kubectl CLI: Supera il Tuo Esame CKA

# 1. Alias principale per kubectl
alias k=kubectl

# 2. Generatore rapido di manifest YAML
export do="--dry-run=client -o yaml"

# Imposta il namespace predefinito per il contesto attivo
k config set-context --current --namespace=finance

# Verifica il contesto corrente e il namespace attivo
k config get-contexts
k config current-context

# Pod Nginx base
k run nginx-pod --image=nginx $do > pod.yaml

# Pod con comando e argomenti personalizzati
k run busybox-pod --image=busybox --restart=Never $do -- /bin/sh -c "sleep 3600" > pod.yaml

# Pod con label e porta del container esposta
k run web --image=httpd:alpine --port=80 --labels="tier=frontend,app=web" $do > web-pod.yaml

# Crea un Deployment con 3 repliche
k create deployment web-deploy --image=nginx:1.25 --replicas=3 $do > deploy.yaml

# Scala il deployment al volo
k scale deployment web-deploy --replicas=5

# Aggiorna l'immagine e controlla la cronologia del rollout
k set image deployment/web-deploy nginx=nginx:1.26
k rollout status deployment/web-deploy
k rollout undo deployment/web-deploy

# Esponi un Deployment come ClusterIP (Porta 80 -> TargetPort 8080)
k expose deployment web-deploy --port=80 --target-port=8080 --name=web-service

# Esponi come NodePort esportando il manifest YAML
k expose deployment web-deploy --type=NodePort --port=80 --target-port=80 --name=web-np $do > svc-nodeport.yaml

# Creazione diretta del Service
k create service clusterip backend-svc --tcp=8080:8080 $do > svc.yaml

# Ingress base con regole di routing per host e percorso
k create ingress web-ingress   --rule="app.example.com/api*=backend-svc:8080"   --rule="app.example.com/*=web-service:80"   $do > ingress.yaml

# Ingress con backend predefinito
k create ingress simple-ingress   --default-backend=fallback-svc:8080   $do > ingress-default.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: secure-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
  - hosts:
      - secure.example.com
    secretName: tls-secret
  rules:
  - host: secure.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

# 1. Definizione del Gateway
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: prod-gateway
spec:
  gatewayClassName: eg-gateway-class
  listeners:
  - name: http
    protocol: HTTP
    port: 80
---
# 2. Definizione di HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-route
spec:
  parentRefs:
  - name: prod-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api
    backendRefs:
    - name: backend-svc
      port: 8080

# ConfigMap da valori letterali
k create configmap app-config --from-literal=DB_HOST=10.0.0.5 --from-literal=DB_PORT=5432

# ConfigMap da un file di configurazione esistente
k create configmap nginx-conf --from-file=nginx.conf

# Secret da password letterale o file .env
k create secret generic db-secret --from-literal=password=SuperSecret123
k create secret generic app-secret --from-env-file=.env

# Inietta ConfigMap o Secret direttamente nelle variabili d'ambiente di un Deployment
k set env deployment/web-deploy --from=configmap/app-config
k set env deployment/web-deploy --from=secret/db-secret

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
  storageClassName: standard

spec:
  volumes:
  - name: storage-vol
    persistentVolumeClaim:
      claimName: data-pvc
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - name: storage-vol
      mountPath: /var/data

# 1. Crea un ServiceAccount
k create serviceaccount app-sa

# 2. Crea un Ruolo con permessi specifici su determinate risorse
k create role pod-reader --verb=get,list,watch --resource=pods,pods/log

# 3. Associa il Ruolo al ServiceAccount nel namespace
k create rolebinding read-pods-binding --role=pod-reader --serviceaccount=default:app-sa

# 4. Permessi a livello di intero cluster (ClusterRole e ClusterRoleBinding)
k create clusterrole node-viewer --verb=get,list --resource=nodes
k create clusterrolebinding view-nodes-binding --clusterrole=node-viewer --serviceaccount=default:app-sa

# 5. Verifica dei permessi (Posso eseguire questa azione?)
k auth can-i create deployments --as=system:serviceaccount:default:app-sa
k auth can-i delete pods -n production

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: backend
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 80

# Estrai gli IP interni di tutti i Worker Node
k get nodes -o jsonpath='{.items[*].status.addresses[?(@.type=="InternalIP")].address}'

# Mostra i nomi dei Pod e i rispettivi Nodi di esecuzione in colonne dedicate
k get pods -o custom-columns=POD:.metadata.name,NODE:.spec.nodeName,STATUS:.status.phase

# Decodifica il valore di un Secret senza passaggi manuali con base64
k get secret db-secret -o jsonpath='{.data.password}' | base64 -d

# Avvia un container temporaneo di debug nella rete del cluster
k run net-debug --rm -i --tty --image=curlimages/curl -- /bin/sh

# Segui i log in streaming con timestamp e limite di righe
k logs -f deployment/web-deploy --tail=50 --timestamps

# Visualizza l'utilizzo delle risorse nei nodi e nei pod
k top nodes
k top pods -A --sort-by=cpu
k top pods -A --sort-by=memory

# Ispeziona gli eventi ordinati per data di creazione recente
k get events -A --sort-by='.metadata.creationTimestamp'