Kubernetes（K8s）入門から実践まで

開発者 / CI
     |
  kubectl
     |
  kube-apiserver ── etcd
     |        (Control Plane)
     +── scheduler
     +── controller-manager
     |
     +-----------------------------+
     |                             |
 Worker Node A                Worker Node B
 kubelet / containerd         kubelet / containerd
    Pod A / Pod B                Pod C / Pod D

apiVersion: v1
kind: Pod
metadata:
  name: hello-pod
  labels:
    app: hello
spec:
  containers:
    - name: nginx
      image: nginx:alpine
      ports:
        - containerPort: 80

kubectl apply -f pod.yaml
kubectl get pods -o wide
kubectl describe pod hello-pod
kubectl delete -f pod.yaml
kubectl explain pod.spec

brew install kind kubectl
kind version
kubectl version --client
kind create cluster --name k8s-study
kubectl cluster-info
kubectl get nodes

kubectl config get-contexts
kubectl config current-context
kubectl config use-context kind-k8s-study

docker build -t demo-api:v1 .
kind load docker-image demo-api:v1 --name k8s-study

kind delete cluster --name k8s-study

Pod A： [Node.js:3000] [sidecar:9000]  → localhostを共有
Pod B： [MySQL:3306]                  → 別のlocalhost

kubectl get pods
kubectl logs hello-pod
kubectl exec -it hello-pod -- sh
kubectl port-forward pod/hello-pod 8080:80

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
        - name: nginx
          image: nginx:1.27-alpine
          ports:
            - containerPort: 80

kubectl apply -f deployment.yaml
kubectl get deploy,rs,pods
kubectl scale deployment/web --replicas=5
kubectl rollout status deployment/web
kubectl rollout history deployment/web
kubectl rollout undo deployment/web

kubectl set image deployment/web nginx=nginx:1.29-alpine
kubectl rollout status deployment/web

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 0

apiVersion: v1
kind: Service
metadata:
  name: web-svc
spec:
  selector:
    app: web
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 80

HTTPクライアント → web-svc:80 → app=web のPod:80

apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  NODE_ENV: "production"
  API_MESSAGE: "Hello from Kubernetes"

kubectl create secret generic api-secret \
  --from-literal=API_KEY='local-demo-only'

env:
  - name: API_MESSAGE
    valueFrom:
      configMapKeyRef:
        name: api-config
        key: API_MESSAGE
  - name: API_KEY
    valueFrom:
      secretKeyRef:
        name: api-secret
        key: API_KEY

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: demo-data
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

volumes:
  - name: data
    persistentVolumeClaim:
      claimName: demo-data

volumeMounts:
  - name: data
    mountPath: /data

apiVersion: batch/v1
kind: CronJob
metadata:
  name: heartbeat
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: job
              image: busybox:1.36
              command: ["sh", "-c", "date; echo heartbeat"]

kubectl create namespace study
kubectl get pods -n study
kubectl get pods -A

resources:
  requests:
    cpu: "100m"
    memory: "128Mi"
  limits:
    cpu: "500m"
    memory: "256Mi"

startupProbe:
  httpGet:
    path: /healthz
    port: 3000
  failureThreshold: 30
  periodSeconds: 2
readinessProbe:
  httpGet:
    path: /readyz
    port: 3000
  periodSeconds: 5
livenessProbe:
  httpGet:
    path: /healthz
    port: 3000
  periodSeconds: 10

kubectl autoscale deployment web --min=2 --max=6 --cpu=70%
kubectl get hpa

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
spec:
  ingressClassName: nginx
  rules:
    - host: demo.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-svc
                port:
                  number: 80

apiVersion: v1
kind: ServiceAccount
metadata:
  name: readonly-bot
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
subjects:
  - kind: ServiceAccount
    name: readonly-bot
    namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

kubectl auth can-i list pods \
  --as=system:serviceaccount:default:readonly-bot

kubectl apply -k overlays/dev
helm list -A
helm upgrade --install demo ./chart -n study --create-namespace
helm history demo -n study

kubectl get nodes
kubectl get pods -A -o wide
kubectl describe pod <pod-name>
kubectl logs <pod-name> --all-containers=true --tail=100
kubectl logs <pod-name> --previous
kubectl get events --sort-by=.lastTimestamp
kubectl get svc,endpointslices
kubectl rollout status deployment/<name>
kubectl top pods

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: demo-nginx
  template:
    metadata:
      labels:
        app: demo-nginx
    spec:
      containers:
        - name: nginx
          image: nginx:alpine
          ports:
            - containerPort: 80
          readinessProbe:
            httpGet:
              path: /
              port: 80
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: demo-nginx
spec:
  selector:
    app: demo-nginx
  ports:
    - port: 80
      targetPort: 80

kubectl apply -f 01-nginx.yaml
kubectl rollout status deployment/demo-nginx
kubectl get pods -l app=demo-nginx
kubectl get svc demo-nginx
kubectl port-forward svc/demo-nginx 8080:80

curl -I http://localhost:8080

kubectl scale deployment/demo-nginx --replicas=5
kubectl get pods -l app=demo-nginx
kubectl delete pod <実在するPod名>
kubectl get pods -w

k8s-api/
├── package.json
├── server.js
├── Dockerfile
└── 02-api.yaml

{
  "name": "k8s-api-demo",
  "version": "1.0.0",
  "private": true,
  "scripts": { "start": "node server.js" }
}

const http = require('node:http');
const server = http.createServer((req, res) => {
  const healthy = ['/healthz', '/readyz'].includes(req.url);
  res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' });
  res.end(JSON.stringify(healthy
    ? { status: 'ok' }
    : { message: process.env.API_MESSAGE || 'Hello K8s', version: process.env.APP_VERSION || 'v1' }));
});
server.listen(3000, '0.0.0.0', () => console.log('API started'));

FROM node:22-alpine
WORKDIR /app
COPY package.json server.js ./
USER node
EXPOSE 3000
CMD ["node", "server.js"]

apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  API_MESSAGE: "Hello from Kubernetes"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-api
spec:
  replicas: 2
  selector:
    matchLabels:
      app: demo-api
  template:
    metadata:
      labels:
        app: demo-api
    spec:
      containers:
        - name: api
          image: demo-api:v1
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 3000
          env:
            - name: API_MESSAGE
              valueFrom:
                configMapKeyRef:
                  name: api-config
                  key: API_MESSAGE
            - name: API_KEY
              valueFrom:
                secretKeyRef:
                  name: api-secret
                  key: API_KEY
          readinessProbe:
            httpGet:
              path: /readyz
              port: 3000
            initialDelaySeconds: 2
          livenessProbe:
            httpGet:
              path: /healthz
              port: 3000
            initialDelaySeconds: 5
          resources:
            requests:
              cpu: 50m
              memory: 64Mi
            limits:
              cpu: 250m
              memory: 128Mi
---
apiVersion: v1
kind: Service
metadata:
  name: demo-api
spec:
  selector:
    app: demo-api
  ports:
    - port: 3000
      targetPort: 3000

docker build -t demo-api:v1 .
kind load docker-image demo-api:v1 --name k8s-study
kubectl create secret generic api-secret --from-literal=API_KEY=dev-secret
kubectl apply -f 02-api.yaml
kubectl rollout status deployment/demo-api
kubectl port-forward svc/demo-api 3000:3000

curl http://localhost:3000
# {"message":"Hello from Kubernetes","version":"v1"}

docker build -t demo-api:v2 .
kind load docker-image demo-api:v2 --name k8s-study
kubectl set image deployment/demo-api api=demo-api:v2
kubectl rollout status deployment/demo-api
kubectl rollout history deployment/demo-api
kubectl rollout undo deployment/demo-api

server {
  listen 80;
  server_name _;
  root /usr/share/nginx/html;
  index index.html;

  location /api/ {
    proxy_pass http://demo-api:3000/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
  }
  location /assets/ {
    try_files $uri =404;
    expires 1y;
    add_header Cache-Control "public, immutable";
  }
  location / {
    try_files $uri $uri/ /index.html;
  }
}

FROM node:22-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
FROM nginx:alpine
COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY --from=build /app/dist /usr/share/nginx/html
EXPOSE 80

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-front
spec:
  replicas: 2
  selector:
    matchLabels:
      app: demo-front
  template:
    metadata:
      labels:
        app: demo-front
    spec:
      containers:
        - name: nginx
          image: demo-front:v1
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
          readinessProbe:
            httpGet:
              path: /
              port: 80
---
apiVersion: v1
kind: Service
metadata:
  name: demo-front
spec:
  selector:
    app: demo-front
  ports:
    - port: 80
      targetPort: 80

docker build -t demo-front:v1 .
kind load docker-image demo-front:v1 --name k8s-study
kubectl apply -f 03-front.yaml
kubectl rollout status deployment/demo-front
kubectl port-forward svc/demo-front 8080:80

curl http://localhost:8080/api/healthz
curl http://localhost:8080/

kubectl get storageclass

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pvc
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 2Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: mysql-lab
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: mysql-lab
  template:
    metadata:
      labels:
        app: mysql-lab
    spec:
      containers:
        - name: mysql
          image: mysql:8.4
          env:
            - name: MYSQL_ROOT_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: mysql-lab-secret
                  key: root-password
          ports:
            - containerPort: 3306
          volumeMounts:
            - name: data
              mountPath: /var/lib/mysql
          resources:
            requests:
              memory: 512Mi
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: mysql-pvc
---
apiVersion: v1
kind: Service
metadata:
  name: mysql-lab
spec:
  selector:
    app: mysql-lab
  ports:
    - port: 3306
      targetPort: 3306

kubectl create secret generic mysql-lab-secret --from-literal=root-password=local-only
kubectl apply -f 04-db.yaml
kubectl get pvc,pods
kubectl logs deployment/mysql-lab
kubectl exec -it deployment/mysql-lab -- mysql -uroot -p

CREATE DATABASE demo;
USE demo;
CREATE TABLE notes (id INT PRIMARY KEY, body VARCHAR(100));
INSERT INTO notes VALUES (1, 'data survives pod replacement');
SELECT * FROM notes;

kubectl rollout restart deployment/mysql-lab
kubectl rollout status deployment/mysql-lab
kubectl exec -it deployment/mysql-lab -- mysql -uroot -p