Architecture, Scaling & Cost Labs

# tenants.yaml — apply once, then again with tenant-a → tenant-b
apiVersion: v1
kind: Namespace
metadata:
  name: tenant-a
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-quota
  namespace: tenant-a
spec:
  hard:
    requests.cpu: "1"
    requests.memory: 1Gi
    limits.cpu: "2"
    limits.memory: 2Gi
    pods: "10"
    persistentvolumeclaims: "2"
---
apiVersion: v1
kind: LimitRange
metadata:
  name: tenant-defaults
  namespace: tenant-a
spec:
  limits:
    - type: Container
      defaultRequest: { cpu: 100m, memory: 128Mi }   # injected if you omit requests
      default:        { cpu: 200m, memory: 256Mi }   # injected if you omit limits
      max:            { cpu: "1",  memory: 1Gi }     # a single container may not exceed this

# isolation.yaml — deny everything into tenant-a, then re-allow same-namespace traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: tenant-a
spec:
  podSelector: {}            # every pod in the namespace
  policyTypes: ["Ingress"]   # no ingress rules below = deny all ingress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-same-namespace
  namespace: tenant-a
spec:
  podSelector: {}
  policyTypes: ["Ingress"]
  ingress:
    - from:
        - podSelector: {}    # any pod in THIS namespace

# qos.yaml — the three classes, side by side.
# busybox, not pause: you need a shell and /bin/cat inside to read the OOM score.
apiVersion: v1
kind: Pod
metadata: { name: qos-guaranteed, namespace: default }
spec:
  containers:
    - name: app
      image: busybox:1.36
      command: ["sleep", "3600"]
      resources:
        requests: { cpu: 100m, memory: 128Mi }
        limits:   { cpu: 100m, memory: 128Mi }   # limits == requests, for EVERY resource
---
apiVersion: v1
kind: Pod
metadata: { name: qos-burstable, namespace: default }
spec:
  containers:
    - name: app
      image: busybox:1.36
      command: ["sleep", "3600"]
      resources:
        requests: { cpu: 100m, memory: 128Mi }
        limits:   { cpu: 500m, memory: 512Mi }   # limits > requests
---
apiVersion: v1
kind: Pod
metadata: { name: qos-besteffort, namespace: default }
spec:
  containers:
    - name: app
      image: busybox:1.36
      command: ["sleep", "3600"]                 # no requests, no limits at all

# priority.yaml — two lanes: cheap batch, and never-touch-this
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata: { name: batch-low }
value: 100
globalDefault: false
description: "Best-effort batch work — the first thing preempted when the node fills up."
---
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata: { name: platform-critical }
value: 1000000
globalDefault: false
preemptionPolicy: PreemptLowerPriority
description: "Platform components that must schedule even on a full node."

# kind-arch.yaml — a four-node cluster so scheduling actually has choices
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
  - role: control-plane
  - role: worker
  - role: worker
  - role: worker
# kind create cluster --name arch --config kind-arch.yaml

# placement.yaml — "zones a and b only, spread evenly, keep off the GPU node"
apiVersion: apps/v1
kind: Deployment
metadata: { name: spread, namespace: default }
spec:
  replicas: 4
  selector: { matchLabels: { app: spread } }
  template:
    metadata: { labels: { app: spread } }
    spec:
      containers:
        - name: app
          image: registry.k8s.io/pause:3.9
          resources: { requests: { cpu: 50m, memory: 32Mi } }
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.kubernetes.io/zone
                    operator: In
                    values: ["a", "b"]
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector: { matchLabels: { app: spread } }

# pdb.yaml — start deliberately too strict, then relax it
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata: { name: spread-pdb, namespace: default }
spec:
  minAvailable: 4                       # == replicas, so NO voluntary eviction is allowed
  selector: { matchLabels: { app: spread } }

# metrics-server: the prerequisite for kubectl top, HPA and VPA.
kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

# kind/minikube use self-signed kubelet certs, so metrics-server needs one extra flag:
kubectl -n kube-system patch deploy metrics-server --type=json \
  -p='[{"op":"add","path":"/spec/template/spec/containers/0/args/-","value":"--kubelet-insecure-tls"}]'

kubectl -n kube-system rollout status deploy/metrics-server
kubectl top nodes        # if this prints numbers, HPA has something to read

# vpa-recommend.yaml — advice only. updateMode "Off" never touches a running pod.
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata: { name: php-apache, namespace: default }
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: php-apache
  updatePolicy:
    updateMode: "Off"          # "Auto" would evict and recreate pods to resize them
  resourcePolicy:
    containerPolicies:
      - containerName: "*"
        controlledResources: ["cpu", "memory"]

# scaledobject.yaml — scale a worker on queue depth, all the way down to zero
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata: { name: worker, namespace: default }
spec:
  scaleTargetRef:
    name: worker
  minReplicaCount: 0          # the headline: no work, no pods, no cost
  maxReplicaCount: 10
  pollingInterval: 5          # seconds between metric checks
  cooldownPeriod: 30          # seconds of idle before scaling back to zero
  triggers:
    - type: redis
      metadata:
        address: redis.default.svc.cluster.local:6379
        listName: jobs
        listLength: "5"       # aim for ~5 queued items per replica
        enableTLS: "false"

# stateful.yaml — a standalone PVC that will sit Pending, plus a StatefulSet that binds
apiVersion: v1
kind: Service                           # headless: gives db-0 and db-1 stable DNS names
metadata: { name: db, namespace: default }
spec:
  clusterIP: None
  selector: { app: db }
  ports:
    - { name: db, port: 5432 }
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata: { name: lonely, namespace: default }
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: standard            # kind's default: rancher.io/local-path
  resources: { requests: { storage: 1Gi } }
---
apiVersion: apps/v1
kind: StatefulSet
metadata: { name: db, namespace: default }
spec:
  serviceName: db
  replicas: 2
  selector: { matchLabels: { app: db } }
  template:
    metadata: { labels: { app: db } }
    spec:
      containers:
        - name: app
          image: busybox:1.36
          command: ["/bin/sh","-c","echo hello-from-$HOSTNAME >> /data/log; sleep 3600"]
          volumeMounts:
            - { name: data, mountPath: /data }
  volumeClaimTemplates:                 # one PVC per ordinal, named data-db-0, data-db-1
    - metadata: { name: data }
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: standard
        resources: { requests: { storage: 1Gi } }

# A Prometheus for OpenCost to read from, then OpenCost itself.
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo add opencost https://opencost.github.io/opencost-helm-chart
helm repo update

helm install prometheus prometheus-community/prometheus \
  -n prometheus --create-namespace \
  --set alertmanager.enabled=false --set prometheus-pushgateway.enabled=false

helm install opencost opencost/opencost -n opencost --create-namespace \
  --set opencost.prometheus.internal.serviceName=prometheus-server \
  --set opencost.prometheus.internal.namespaceName=prometheus \
  --set opencost.prometheus.internal.port=80

kubectl -n opencost rollout status deploy/opencost
kubectl -n opencost port-forward svc/opencost 9003:9003

# 1 — PVCs that no running pod mounts: pure, silent, recurring cost.
kubectl get pvc -A -o json \
  | jq -r '.items[] | "\(.metadata.namespace)/\(.metadata.name)"' | sort > /tmp/all-pvc
kubectl get pods -A -o json \
  | jq -r '.items[] as $p | $p.spec.volumes[]? | select(.persistentVolumeClaim)
           | "\($p.metadata.namespace)/\(.persistentVolumeClaim.claimName)"' | sort -u > /tmp/used-pvc
comm -23 /tmp/all-pvc /tmp/used-pvc          # <- orphans

# 2 — Requested vs actually used (needs metrics-server from Lab 7).
kubectl top pods -A --containers --no-headers | sort -k4 -h | head -20
kubectl get pods -A -o custom-columns='NS:.metadata.namespace,POD:.metadata.name,CPU_REQ:.spec.containers[*].resources.requests.cpu,MEM_REQ:.spec.containers[*].resources.requests.memory'

# 3 — Objects that exist but do nothing.
kubectl get pods -A --field-selector status.phase=Succeeded
kubectl get deploy -A -o json | jq -r '.items[] | select(.spec.replicas==0) | "\(.metadata.namespace)/\(.metadata.name)"'