Kubernetes YAML Cheat Sheet: Every Manifest You Need
Kubernetes configuration is YAML. Every resource — Pods, Deployments, Services, Ingress — is defined in a YAML manifest. This cheat sheet gives you production-ready templates for every common resource type. Copy, paste, customize.
Pod
The smallest deployable unit. Rarely created directly — use a Deployment instead.
apiVersion: v1
kind: Pod
metadata:
name: debug-pod
labels:
app: debug
spec:
containers:
- name: debug
image: busybox:1.36
command: ["sleep", "3600"]
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 200m
memory: 256Mi
Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
name: api
labels:
app: api
spec:
replicas: 3
selector:
matchLabels:
app: api
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
template:
metadata:
labels:
app: api
spec:
containers:
- name: api
image: myregistry/api:1.2.0
ports:
- containerPort: 8080
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: db-credentials
key: url
- name: LOG_LEVEL
valueFrom:
configMapKeyRef:
name: api-config
key: log-level
resources:
requests:
cpu: 250m
memory: 512Mi
limits:
cpu: 500m
memory: 1Gi
readinessProbe:
httpGet:
path: /health
port: 8080
initialDelaySeconds: 5
periodSeconds: 10
livenessProbe:
httpGet:
path: /health
port: 8080
initialDelaySeconds: 15
periodSeconds: 20
affinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: app
operator: In
values: [api]
topologyKey: kubernetes.io/hostname
Service (ClusterIP)
apiVersion: v1
kind: Service
metadata:
name: api
spec:
selector:
app: api
ports:
- port: 80
targetPort: 8080
protocol: TCP
type: ClusterIP
Service (NodePort)
apiVersion: v1
kind: Service
metadata:
name: api-nodeport
spec:
selector:
app: api
ports:
- port: 80
targetPort: 8080
nodePort: 30080
type: NodePort
Service (LoadBalancer)
apiVersion: v1
kind: Service
metadata:
name: api-lb
annotations:
service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
selector:
app: api
ports:
- port: 443
targetPort: 8080
type: LoadBalancer
Ingress (Nginx)
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: api-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
ingressClassName: nginx
tls:
- hosts:
- api.example.com
secretName: api-tls
rules:
- host: api.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: api
port:
number: 80
ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
name: api-config
data:
log-level: "info"
max-connections: "100"
config.yaml: |
server:
port: 8080
timeout: 30s
cache:
ttl: 300s
Secret
apiVersion: v1
kind: Secret
metadata:
name: db-credentials
type: Opaque
stringData:
url: postgresql://user:password@db:5432/mydb
username: user
password: password
Note: In production, use an external secrets manager (AWS Secrets Manager, HashiCorp Vault) with the External Secrets Operator instead of storing secrets in YAML.
HorizontalPodAutoscaler
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: api-hpa
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: api
minReplicas: 3
maxReplicas: 20
metrics:
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: 70
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: 80
behavior:
scaleDown:
stabilizationWindowSeconds: 300
Job
apiVersion: batch/v1
kind: Job
metadata:
name: db-migration
spec:
backoffLimit: 3
ttlSecondsAfterFinished: 86400
template:
spec:
restartPolicy: OnFailure
containers:
- name: migrate
image: myregistry/migrator:1.0
command: ["./migrate", "--up"]
envFrom:
- secretRef:
name: db-credentials
CronJob
apiVersion: batch/v1
kind: CronJob
metadata:
name: nightly-backup
spec:
schedule: "0 2 * * *"
concurrencyPolicy: Forbid
successfulJobsHistoryLimit: 3
failedJobsHistoryLimit: 3
jobTemplate:
spec:
backoffLimit: 2
template:
spec:
restartPolicy: OnFailure
containers:
- name: backup
image: myregistry/backup:1.0
command: ["./backup.sh"]
volumeMounts:
- name: backup-storage
mountPath: /backups
volumes:
- name: backup-storage
persistentVolumeClaim:
claimName: backup-pvc
PersistentVolumeClaim
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data-pvc
spec:
accessModes:
- ReadWriteOnce
storageClassName: gp3
resources:
requests:
storage: 50Gi
NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: api-netpol
spec:
podSelector:
matchLabels:
app: api
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app: frontend
ports:
- port: 8080
egress:
- to:
- podSelector:
matchLabels:
app: postgres
ports:
- port: 5432
ServiceAccount + RBAC
apiVersion: v1
kind: ServiceAccount
metadata:
name: api-sa
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: api-role
rules:
- apiGroups: [""]
resources: ["configmaps", "secrets"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: api-rolebinding
subjects:
- kind: ServiceAccount
name: api-sa
roleRef:
kind: Role
name: api-role
apiGroup: rbac.authorization.k8s.io
Quick Reference
| Resource | Kind | Common Use |
|---|---|---|
| Pod | Pod | Debugging, one-off tasks |
| Deployment | Deployment | Stateless apps |
| StatefulSet | StatefulSet | Databases, stateful apps |
| DaemonSet | DaemonSet | Node agents, log collectors |
| Job | Job | One-time tasks, migrations |
| CronJob | CronJob | Scheduled tasks |
| Service | Service | Internal/external networking |
| Ingress | Ingress | HTTP routing, TLS termination |
| ConfigMap | ConfigMap | Non-sensitive configuration |
| Secret | Secret | Sensitive data |
| PVC | PersistentVolumeClaim | Storage requests |
| HPA | HorizontalPodAutoscaler | Auto-scaling |
| NetworkPolicy | NetworkPolicy | Pod-to-pod firewall rules |
| ServiceAccount | ServiceAccount | Pod identity, RBAC |
Related posts:
