Configuring Pod Specifications
1. Setting Container Images
| Field | Description |
|---|
| image | registry/repo:tag@sha256:digest |
| imagePullPolicy | Always, IfNotPresent (default), Never |
| imagePullSecrets | List of Secret names for private registries |
Note: Pin by digest (@sha256:...) for immutable, reproducible deployments. Avoid :latest.
2. Defining Resource Requests
| Unit | Meaning |
|---|
| CPU | 1 = 1 core; 500m = 0.5 core; 100m = 0.1 core |
| Memory | Ki, Mi, Gi (binary) or K, M, G (decimal) |
| requests.cpu | Guaranteed CPU; influences scheduling |
| requests.memory | Guaranteed memory |
resources:
requests: { cpu: 250m, memory: 256Mi }
3. Defining Resource Limits
| Limit | Behavior on Exceed |
|---|
| limits.cpu | Throttled (CFS quotas) |
| limits.memory | OOMKilled by kernel |
| limits.ephemeral-storage | Pod evicted |
Warning: Without memory limit a runaway pod can starve the node. Always set limits in production.
4. Configuring Environment Variables
| Source | Example |
|---|
| Literal | env: [{name: LOG_LEVEL, value: "info"}] |
| ConfigMap key | valueFrom: { configMapKeyRef: {name, key} } |
| Secret key | valueFrom: { secretKeyRef: {name, key} } |
| Downward API | valueFrom: { fieldRef: {fieldPath: status.podIP} } |
| envFrom | Import all keys from ConfigMap/Secret |
Example: Combining env sources
env:
- name: NODE_NAME
valueFrom: { fieldRef: { fieldPath: spec.nodeName } }
- name: DB_PASS
valueFrom: { secretKeyRef: { name: db, key: password } }
envFrom:
- configMapRef: { name: app-config }
- secretRef: { name: app-secrets }
5. Setting Container Commands
| Field | Maps to Docker |
|---|
| command | ENTRYPOINT (overrides) |
| args | CMD (overrides) |
command: ["sh", "-c"]
args: ["echo hello && sleep 3600"]
6. Configuring Working Directory
| Field | Effect |
|---|
| workingDir | Override image WORKDIR |
7. Setting Security Context
| Field | Scope |
|---|
| runAsUser / runAsGroup | UID/GID |
| runAsNonRoot | Refuse to start as UID 0 |
| readOnlyRootFilesystem | Container only |
| allowPrivilegeEscalation | Container only |
| capabilities | add/drop Linux capabilities |
| fsGroup | Volume ownership GID (Pod) |
| seccompProfile | RuntimeDefault, Localhost, Unconfined |
Example: Hardened security context
securityContext:
runAsNonRoot: true
runAsUser: 10001
fsGroup: 10001
seccompProfile: { type: RuntimeDefault }
containers:
- name: app
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities: { drop: ["ALL"] }
8. Configuring Pod Priority
| Object | Field |
|---|
| PriorityClass | value: 1000000, globalDefault, preemptionPolicy |
| Pod | spec.priorityClassName: high |
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata: { name: high }
value: 1000000
preemptionPolicy: PreemptLowerPriority
9. Using Pod Preemption Policy
| preemptionPolicy | Effect |
|---|
| PreemptLowerPriority | Default; evicts lower-priority pods to fit |
| Never | Pod waits in Pending instead of preempting |
10. Setting Pod Restart Policy
| restartPolicy | Use |
|---|
| Always | Default for Deployments; restart on any exit |
| OnFailure | Restart only on non-zero exit (Jobs) |
| Never | Never restart (Jobs, one-shot) |
11. Configuring Pod DNS Policy
| dnsPolicy | Behavior |
|---|
| ClusterFirst | Default; uses CoreDNS for cluster domains |
| ClusterFirstWithHostNet | For hostNetwork pods |
| Default | Inherit node resolver |
| None | Use dnsConfig only |
dnsPolicy: None
dnsConfig:
nameservers: ["1.1.1.1"]
searches: ["svc.cluster.local"]
options: [{ name: ndots, value: "2" }]
12. Using Service Account
| Field | Effect |
|---|
| serviceAccountName | SA whose token is mounted |
| automountServiceAccountToken | Set false to skip token mount |
spec:
serviceAccountName: app-sa
automountServiceAccountToken: false