Kubernetes for app developers

The 20% of Kubernetes that application developers actually need to understand — pods, services, secrets, HPA.

If you write code that will be deployed to Kubernetes but you don't run the cluster, you don't need to know everything. You need to know these six primitives.

1. Pod

The smallest deployable unit — one or more containers sharing the same network namespace. You almost never create bare pods; you let a Deployment manage them.

2. Deployment

apiVersion: apps/v1
kind: Deployment
metadata: { name: web }
spec:
  replicas: 3
  selector: { matchLabels: { app: web } }
  template:
    metadata: { labels: { app: web } }
    spec:
      containers:
        - name: web
          image: ghcr.io/acme/web:1.7.2
          ports: [{ containerPort: 8080 }]
          resources:
            requests: { cpu: 100m, memory: 128Mi }
            limits:   { cpu: 500m, memory: 256Mi }

Requests = what the scheduler reserves. Limits = the hard ceiling. Getting these right is the #1 lever on cost and stability.

3. Service

A stable DNS name and virtual IP in front of your pods. web.default.svc.cluster.local resolves inside the cluster and load-balances across the pods.

4. ConfigMap and Secret

Externalized configuration. Mount as env vars or files:

envFrom:
  - configMapRef: { name: web-config }
  - secretRef:    { name: web-secrets }

Secrets are base64-encoded, not encrypted at rest by default. Turn on envelope encryption on the API server or use an external secret store (External Secrets Operator + AWS/GCP secret manager).

5. Ingress

How outside traffic reaches your service. In 2026 the successor is the Gateway API, but Ingress is still what most clusters run:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  tls: [{ hosts: [app.acme.io], secretName: web-tls }]
  rules:
    - host: app.acme.io
      http:
        paths:
          - path: /
            pathType: Prefix
            backend: { service: { name: web, port: { number: 80 } } }

6. HPA (Horizontal Pod Autoscaler)

Scales replicas based on CPU / memory / custom metrics. Simple version:

kubectl autoscale deploy/web --cpu-percent=70 --min=2 --max=20

Debug the four commands you need

kubectl get pods -o wide
kubectl describe pod web-xxxxx
kubectl logs web-xxxxx --previous
kubectl exec -it web-xxxxx -- sh

You don't need to know how the scheduler works. You need to know what a Deployment does when you push a new image. Master that, ship features.