Kubernetes Manifests Cheat Sheet
Quick reference for writing Kubernetes YAML: Pod, Deployment, Service, Ingress, ConfigMap, and common kubectl apply patterns.
Kubernetes manifests are declarative YAML documents that describe desired cluster state. Every manifest has apiVersion, kind, metadata, and a spec whose shape depends on the kind.
Pod
The smallest deployable unit. In practice you usually manage Pods through a Deployment, but a bare Pod is the simplest manifest.
apiVersion: v1
kind: Pod
metadata:
name: web-0
labels:
app: web
tier: frontend
spec:
containers:
- name: web
image: nginx:1.27-alpine
ports:
- containerPort: 80
resources:
requests: { cpu: "100m", memory: "128Mi" }
limits: { cpu: "500m", memory: "256Mi" }
env:
- name: LOG_LEVEL
value: info
Deployment
Deployments give you replica management, rolling updates, and self-healing. Use selector.matchLabels — it is immutable after creation.
apiVersion: apps/v1
kind: Deployment
metadata:
name: web
labels: { app: web }
spec:
replicas: 3
selector:
matchLabels: { app: web }
template:
metadata:
labels: { app: web }
spec:
containers:
- name: web
image: myregistry/web:2.4.1
ports:
- containerPort: 8080
readinessProbe:
httpGet: { path: /healthz, port: 8080 }
initialDelaySeconds: 5
Service
Services provide a stable network endpoint for a set of Pods selected by labels.
spec.type | Purpose | Example use |
|---|---|---|
ClusterIP (default) | Internal-only virtual IP | Microservice-to-microservice calls |
NodePort | Expose on a static port on every node | Quick external access in dev |
LoadBalancer | Cloud load balancer in front | Production HTTP(S) ingress underlay |
ExternalName | DNS alias to an external host | Pointing at a legacy/outside service |
apiVersion: v1
kind: Service
metadata:
name: web
spec:
selector:
app: web
ports:
- port: 80
targetPort: 8080
type: ClusterIP
Ingress
Ingress routes external HTTP/S traffic to Services. The exact fields depend on the ingress controller (NGINX Ingress, Traefik, etc.).
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: api.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web
port:
number: 80
tls:
- hosts: [api.example.com]
secretName: api-tls
ConfigMap & Secret
ConfigMaps hold non-sensitive config; Secrets hold base64-encoded sensitive values. Both are injected as env vars, files, or volumes.
apiVersion: v1
kind: ConfigMap
metadata:
name: app-config
data:
LOG_LEVEL: info
FEATURE_FLAGS: "true"
---
apiVersion: v1
kind: Secret
metadata:
name: app-secrets
type: Opaque
stringData:
API_KEY: sk-live-123 # stringData base64-encodes for you
kubectl apply & Debugging
kubectl apply -f manifests/ # Apply whole directory
kubectl apply -f deployment.yaml # Apply a single file
kubectl get pods -l app=web -w # Watch pods by label
kubectl logs -f deploy/web # Follow logs of a deployment
kubectl exec -it deploy/web -- sh # Open a shell in a pod
kubectl describe pod web-abc123 # Events + status details
kubectl rollout status deploy/web # Wait for rollout to finish
kubectl delete -f manifests/ # Delete applied resources
Common Pitfalls
[!WARNING] Never edit a Deployment's
selector.matchLabelsafter creation — it is immutable. Delete and recreate instead.
[!TIP] Pin image tags (
2.4.1) or digests in production and avoidlatest; addimagePullPolicy: Alwaysonly for mutable tags.