Break-Fix Drills

# drill-2-oom.yaml — a container that asks for far more memory than its limit
apiVersion: v1
kind: Pod
metadata:
  name: hungry
  namespace: drills
spec:
  containers:
    - name: stress
      image: polinux/stress
      command: ["stress"]
      args: ["--vm", "1", "--vm-bytes", "200M", "--vm-hang", "1"]
      resources:
        requests:
          memory: "32Mi"
        limits:
          memory: "32Mi"        # <-- the sabotage

# drill-4c-pvc.yaml — a claim for a storage class this cluster does not have
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
  namespace: drills
spec:
  storageClassName: fast-ssd        # <-- the sabotage: no such class on kind/minikube
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: v1
kind: Pod
metadata:
  name: needs-disk
  namespace: drills
spec:
  containers:
    - name: app
      image: nginx:1.27-alpine
      volumeMounts:
        - name: data
          mountPath: /data
  volumes:
    - name: data
      persistentVolumeClaim:
        claimName: data

# drill-5-config.yaml — a container that demands a key nobody created
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
  namespace: drills
data:
  GREETING: "hello"                 # note: no APP_MODE key here
---
apiVersion: v1
kind: Pod
metadata:
  name: config-consumer
  namespace: drills
spec:
  containers:
    - name: app
      image: nginx:1.27-alpine
      env:
        - name: APP_MODE
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: APP_MODE         # <-- the sabotage: this key does not exist

# drill-6-probes.yaml — a probe pointed at a path nginx does not serve
apiVersion: v1
kind: Pod
metadata:
  name: probey
  namespace: drills
  labels:
    app: probey
spec:
  containers:
    - name: web
      image: nginx:1.27-alpine
      ports:
        - containerPort: 80
      # ROUND A: only this probe is active as written
      readinessProbe:
        httpGet:
          path: /healthz           # <-- nginx returns 404 here
          port: 80
        periodSeconds: 5
      # ROUND B: delete the pod, comment out readinessProbe above,
      # uncomment the six lines below, and apply again
      # livenessProbe:
      #   httpGet:
      #     path: /healthz
      #     port: 80
      #   periodSeconds: 5
      #   failureThreshold: 3

# drill-9-deny.yaml — a default-deny that also silently kills DNS
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: drills
spec:
  podSelector: {}                  # every pod in the namespace
  policyTypes: ["Ingress", "Egress"]
---
# the repair: additive allow rules, applied WITHOUT removing default-deny
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-and-web
  namespace: drills
spec:
  podSelector: {}
  policyTypes: ["Ingress", "Egress"]
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - podSelector:
            matchLabels:
              app: web
      ports:
        - protocol: TCP
          port: 80
  ingress:
    - from:
        - podSelector: {}          # anything in this namespace
      ports:
        - protocol: TCP
          port: 80

# drill-10-ingress.yaml — a rule for a host you will not send
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop
  namespace: drills
spec:
  ingressClassName: nginx
  rules:
    - host: shop.example.com       # <-- sabotage A: curl a different Host header
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80

# drill-12-policy.yaml — Kyverno rejects :latest at admission
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-latest-tag
  annotations:
    # Kyverno normally AUTO-GENERATES a twin of this rule for Deployments, Jobs and
    # CronJobs, which would reject round (b) at the Deployment itself. Turning autogen
    # off is what pushes that denial down onto the ReplicaSet — the whole point of (b).
    pod-policies.kyverno.io/autogen-controllers: none
spec:
  validationFailureAction: Enforce   # on Kyverno 1.13+ this moves DOWN to the rule as
                                     # validate.failureAction: Enforce — set one or the
                                     # other, never both, and check `kubectl explain
                                     # clusterpolicy.spec` on the version you installed
  background: false
  rules:
    - name: require-explicit-tag
      match:
        any:
          - resources:
              kinds: ["Pod"]
              namespaces: ["drills"]
      validate:
        message: "Images must use an explicit tag, not :latest."
        pattern:
          spec:
            containers:
              - image: "!*:latest"

# drill-14-rollout.yaml — a canary that will stop and wait for a human
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: demo
  namespace: drills
spec:
  replicas: 4
  strategy:
    canary:
      steps:
        - setWeight: 25
        - pause: {}                # <-- indefinite: waits for a manual promote
        - setWeight: 50
        - pause: {duration: 30s}
        - setWeight: 100
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      labels:
        app: demo
    spec:
      containers:
        - name: web
          image: nginx:1.27-alpine
          ports:
            - containerPort: 80

# drill-15-sm.yaml — a real target, plus a ServiceMonitor Prometheus will quietly ignore
apiVersion: apps/v1
kind: Deployment
metadata:
  name: metricsapp
  namespace: drills
  labels:
    app: metricsapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: metricsapp
  template:
    metadata:
      labels:
        app: metricsapp
    spec:
      containers:
        - name: app
          image: quay.io/brancz/prometheus-example-app:v0.5.0   # serves /metrics on 8080
          ports:
            - name: metrics
              containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: metricsapp
  namespace: drills
  labels:
    app: metricsapp           # the ServiceMonitor selector must match THIS, not the pod labels
spec:
  selector:
    app: metricsapp
  ports:
    - name: metrics           # the ServiceMonitor endpoint must use this NAME
      port: 8080
      targetPort: metrics
---
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: metricsapp
  namespace: drills
  labels:
    team: platform            # <-- sabotage 1: missing the "release" label Prometheus selects on
spec:
  selector:
    matchLabels:
      app: web-v2             # <-- sabotage 2: no Service carries this label
  endpoints:
    - port: "8080"            # <-- sabotage 3: must be the Service PORT NAME, not a number
      path: /metrics
      interval: 15s