$ kubectl run ckad-basic-pod --image=nginx:latest

Container resource requests and limits

Resource requests and limits are set on a per-container basis within a pod. By specifying a resource request we tell the Kubernetes scheduler the _minimum_ amount of each resource (CPU and memory) a container will need. By specifying limits, we set up cgroup constraints on the node where the process runs. An example of setting requests/limits looks like:

apiVersion: v1

kind: Pod

metadata:

  name: ckad-resource-pod

spec:

  containers:

  - name: ckad-resource-container

  image: my-app:v3.3

  resources:

  limits:

  cpu: "1"

  memory: “1Gi”

  requests:

  cpu: "0.5"

  memory: “500Mi”

ConfigMaps

ConfigMaps are decoupled configuration artifacts keeping containerized applications portable.

The ConfigMap API resource provides mechanisms to inject containers with configuration data while keeping containers agnostic of Kubernetes. A ConfigMap can be used to store fine-grained information like individual properties or coarse-grained information like entire config files or JSON blobs.

There are multiple ways to create a ConfigMap: from a directory upload, a file, or from literal values in command line as shown in the following example:

$ kubectl create configmap ckad-example-config --from-literal foo=bar

Secrets

Secrets hold sensitive information, such as passwords, OAuth tokens, and SSH keys. Putting this information in a secret is safer and more flexible than putting it verbatim in a pod definition or a Docker image!



There are three types of secrets, explained by the --help flag:

$ kubectl create secret --help

Create a secret using specified subcommand.

Available Commands:

  docker-registry Create a secret for use with a Docker registry

  generic Create a secret from a local file, directory or literal value

  tls Create a TLS secret 

Example of creating a secret imperatively:

$ kubectl create secret generic my-secret \

--from-literal=username=ckad-user \

--from-literal=password=Char1!3-K!10-Alpha-D31ta 

Mounting ConfigMaps/Secrets as volumes or environment variables

ConfigMaps and Secrets are mounted by Pods as either volumes or environment variables to be used by a container in a Pod.
 
ConfigMaps and Secrets can be used with a pod in two ways:

• Files in a volume
• Environment variables

 
Secrets can also be used by the kubelet when pulling images for a pod, called an imagePullSecret
 
The following Pod manifest mounts the ConfigMap ckad-example-config as a volume to the /etc/myapp directory in the container and uses a secret called “ ckad-training-docker-token ” as an imagePullSecret :

apiVersion: v1

kind: Pod

metadata:

  name: pod-config

spec:

  containers:

  - name: nginx

  image: nginx:latest

  imagePullSecrets:

  - name: ckad-training-docker-token

  volumeMounts:

  - name: config

  mountPath: /etc/myapp

  volumes:

  - name: config

  configMap:

  name: ckad-example-config

Practice Drill

Create a pod that runs the nginx image and uses a service account called my-sa .