• -o wide adds node and Pod IP — often the whole answer
• RESTARTS with an age in brackets means a crash loop, not history
• Query by label, never by remembered Pod name
• Check the chain: Deployment → ReplicaSet → Pod → Endpoints

kubectl -n pinboard get pods -o wide
kubectl -n pinboard get deploy,rs,svc,endpointslice

# by label, not by name
kubectl -n pinboard get pods \
  -l app.kubernetes.io/name=pinboard-api

# the whole object, as the API server sees it
kubectl -n pinboard get pod pinboard-api-7d9f4-2xk9 \
  -o yaml

# every namespace, when you don't know where it is
kubectl get pods -A --field-selector \
  status.phase!=Running

• --previous reads the dead container — the only way to see why it crashed
• Address a Deployment, not a Pod, and kubectl picks one for you
• -l plus --all-containers tails a whole tier at once
• Pinboard: set LOG_FORMAT=json so a log stack can parse it

kubectl -n pinboard logs -f deploy/pinboard-api

# the container that already died
kubectl -n pinboard logs pinboard-api-7d9f4-2xk9 \
  --previous

# a whole tier, last 20 lines each
kubectl -n pinboard logs --tail=20 --all-containers \
  -l app.kubernetes.io/name=pinboard-api

kubectl -n pinboard logs deploy/pinboard-api \
  --since=10m --timestamps

• Scales replicas, never the Pod's own size
• Utilisation is a percentage of requests.cpu: no requests, no HPA
• v2 also takes memory, Pod and external metrics
• Never set replicas: in a Deployment that an HPA owns

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata: {name: pinboard-api, namespace: pinboard}
spec:
  scaleTargetRef: {apiVersion: apps/v1, kind: Deployment,
                   name: pinboard-api}
  minReplicas: 2
  maxReplicas: 6
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: {type: Utilization, averageUtilization: 50}

• Protects against voluntary disruption: kubectl drain, node upgrades, the cluster autoscaler
• It does not protect against a crash, an OOM kill or a node dying
• minAvailable or maxUnavailable — never both
• A PDB that can never be satisfied blocks node drains forever

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: pinboard-api
  namespace: pinboard
spec:
  minAvailable: 2          # or maxUnavailable: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: pinboard-api

• ResourceQuota caps the whole namespace — the sum of all requests and limits, and object counts
• With a quota on cpu/memory, a Pod without requests is rejected outright
• LimitRange injects defaults and enforces min/max per container
• Together: nobody can starve the cluster, and nobody has to remember to type requests

kind: ResourceQuota        # apiVersion: v1
metadata: {name: pinboard-quota, namespace: pinboard}
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 2Gi
    pods: "20"
---
kind: LimitRange           # apiVersion: v1
metadata: {name: pinboard-defaults, namespace: pinboard}
spec:
  limits:
    - type: Container
      defaultRequest: {cpu: 50m, memory: 32Mi}

• Subject — a ServiceAccount (in-cluster) or a user/group (from the auth provider)
• Role = verbs on resources in one namespace; ClusterRole = cluster-wide or reusable
• Purely additive: there is no "deny" rule

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: pinboard
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]

• RoleBinding glues a subject to a Role
• It may also bind a ClusterRole — still scoped to that namespace
• Test with kubectl auth can-i, adding --as to impersonate the ServiceAccount

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: pinboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader
subjects:
  - kind: ServiceAccount
    name: pinboard-reader
    namespace: pinboard

• runAsNonRoot — refuse to start an image that runs as UID 0
• readOnlyRootFilesystem — mount an emptyDir anywhere it must write
• capabilities.drop: ["ALL"] — no NET_ADMIN, no CHOWN, nothing
• seccompProfile: RuntimeDefault — the runtime's syscall filter, on by choice
• Plus allowPrivilegeEscalation: false — no setuid surprises

spec:
  securityContext:              # Pod-level
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: api
      securityContext:          # container-level wins
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]

• privileged — no restrictions; for system namespaces only
• baseline — blocks the well-known escapes: hostPath, hostNetwork, privileged
• restricted — also demands non-root, dropped capabilities and RuntimeDefault seccomp
• Three modes per level: enforce, audit, warn — roll out with warn first

apiVersion: v1
kind: Namespace
metadata:
  name: pinboard
  labels:
    app.kubernetes.io/part-of: pinboard
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted