Cheatsheet Kubernetes Operations

Fondasi memahami Kubernetes sebagai production runtime untuk backend services enterprise.

Model berpikir operasional Kubernetes: desired state, actual state, reconciliation, status, event, dan condition.

Batas tanggung jawab backend engineer, platform engineer, SRE, DevOps, security, dan cluster admin dalam operasi Kubernetes production.

Praktik aman mengakses cluster Kubernetes production: kubeconfig, context, namespace, RBAC, read-only access, break-glass, audit log, dry-run, diff, impersonation awareness, dan command blast radius.

Workflow kubectl yang aman untuk investigasi workload production: get, describe, logs, exec, top, events, rollout, port-forward, debug, auth can-i, diff, explain, dan wait.

Namespace sebagai boundary environment, team, application, resource quota, LimitRange, NetworkPolicy, RBAC, Secret scope, naming convention, label convention, dan isolation review.

Metadata sebagai fondasi selector, ownership, cost allocation, observability, deployment traceability, compliance, dan operational debugging di Kubernetes.

Cara membuat inventory workload, service, ingress, dependency, owner, runtime, criticality, dan service catalog untuk operasi Kubernetes production.

Operasi lifecycle Pod dari scheduling, image pull, init container, startup/readiness/liveness probe, serving traffic, termination, PreStop hook, SIGTERM, SIGKILL, dan graceful shutdown untuk Java/JAX-RS workloads.

Operasi Kubernetes Deployment, ReplicaSet, replica, revision, rollout, rollback, progress deadline, available condition, updated replicas, ready replicas, unavailable replicas, dan rollout history untuk backend services production.

Debugging ReplicaSet, pod template hash, revision history, rollout stuck, ProgressDeadlineExceeded, maxSurge, maxUnavailable, pod not ready, bad image, bad config, bad probe, dan rollout failure mode untuk backend services production.

Operasi StatefulSet untuk workload dengan stable identity, stable network, stable storage, ordered rollout, partitioned rollout, VolumeClaimTemplate, headless service, pod ordinal, stateful workload risk, managed service vs self-managed, dan dependency operations awareness.

Operasi Job dan CronJob untuk batch, scheduler, migration, reconciliation, backoff, deadline, parallelism, concurrency policy, missed schedule, stuck job, dan idempotent execution di Kubernetes production.

Klasifikasi workload backend di Kubernetes: JAX-RS API service, Kafka consumer, RabbitMQ consumer, Redis-backed service, Camunda worker, batch job, scheduler, file processing job, reconciliation job, dan migration job.

Operasi service Java 17+ / JAX-RS / Jakarta RESTful Web Services di Kubernetes: endpoint, probes, JVM, thread pool, connection pool, timeout, graceful shutdown, observability, dan production debugging.

Operasi Kafka consumer workload di Kubernetes: consumer group, partition assignment, lag, rebalance, replica count, graceful shutdown, offset commit, retry/DLQ, backpressure, autoscaling, dan production runbook.

Operasi RabbitMQ consumer di Kubernetes: queue depth, consumer count, prefetch, ack/nack, unacked messages, redelivery, retry, DLQ, graceful shutdown, dan backpressure.

Operasi Camunda worker di Kubernetes: worker lifecycle, job activation, concurrency, timeout, retry, incident, process correlation, pod restart impact, graceful shutdown, dan observability.

Operasi batch, scheduler, reconciliation, checkpointing, locking, overlapping run prevention, retry, partial completion, dan failure notification di Kubernetes.

Alur request dari client ke DNS, load balancer, ingress controller, NGINX/API gateway, Service, EndpointSlice, Pod, container port, Java/JAX-RS endpoint, dependency call, dan response path.

Operasi Kubernetes Service, ClusterIP, Headless Service, EndpointSlice, selector, named port, targetPort, DNS name, CoreDNS, no endpoint issue, dan wrong selector issue untuk backend engineers.

Operasi Kubernetes Ingress, IngressClass, ingress controller, host/path routing, rewrite, TLS, backend service, backend protocol, serta debugging 404, 502, 503, dan 504.

Operasi NGINX Ingress Controller untuk backend services: controller pod, ConfigMap, annotation, timeout, buffering, body size, WebSocket, SSE, upstream health, reload, logs, metrics, dan runbook debugging.

Awareness operasional terhadap Kubernetes Gateway API, API Gateway, GatewayClass, Gateway, HTTPRoute, edge auth, rate limiting, TLS policy, route ownership, dan migrasi dari Ingress.

Operasi CoreDNS, service DNS, pod DNS, external/private DNS, ndots, search domain, DNS cache, DNS timeout, wrong DNS response, dan private endpoint DNS untuk backend engineer.

Operasi NetworkPolicy untuk ingress policy, egress policy, default deny, namespace selector, pod selector, IPBlock, DNS egress, database egress, broker egress, cloud service egress, dan debugging blocked traffic.

Operasi pod egress melalui NAT gateway, proxy, NO_PROXY, firewall, private endpoint, VPC endpoint, Azure Private Endpoint, egress allowlist, cloud SDK egress, cost, dan troubleshooting outbound connectivity.

Operasi TLS termination, certificate, private key, CA bundle, Java truststore/keystore, cert-manager awareness, Secret-mounted certificate, certificate expiry, SNI, mTLS, dan TLS debugging untuk backend workloads di Kubernetes.

Operasi timeout end-to-end dari client, CDN/front door, load balancer, ingress, NGINX, service, Java/JAX-RS runtime, HTTP client, PostgreSQL, Kafka, RabbitMQ, Redis, Camunda, sampai cloud dependency.

Operasi ConfigMap untuk runtime configuration, environment variable, volume mount, immutable ConfigMap, config reload, config drift, missing config, wrong environment config, restart requirement, safe default, Helm/Kustomize/GitOps, dan production debugging.

Operasi Kubernetes Secret untuk backend workloads: secret volume, env var, rotation, reload, stale secret, missing secret, leakage, access control, RBAC, GitOps, Java/JAX-RS impact, dependency credentials, dan production-safe debugging.

Operasi External Secrets dan cloud secret integration untuk backend workloads: External Secrets Operator, Secrets Store CSI Driver, AWS Secrets Manager, SSM Parameter Store, Azure Key Vault, sync interval, rotation, access denied, secret versioning, workload identity, and production failure modes.

Operasi ServiceAccount dan RBAC untuk backend workloads: ServiceAccount, Role, ClusterRole, RoleBinding, least privilege, token projection, automountServiceAccountToken, kubectl auth can-i, permission debugging, and production-safe access review.

Operasi workload identity untuk Kubernetes backend workloads di EKS dan AKS: AWS IRSA, EKS OIDC provider, STS AssumeRoleWithWebIdentity, AWS SDK credential chain, Azure Workload Identity, federated credential, managed identity, Azure SDK credential chain, token expiry, and access denied debugging.

Operasi Kubernetes resource requests and limits untuk backend workloads: CPU request, CPU limit, memory request, memory limit, ephemeral storage, QoS class, overprovisioning, underprovisioning, capacity, scheduling, reliability, and cost trade-off.

JVM resource tuning for Java 17+ backend services in Kubernetes: heap sizing, MaxRAMPercentage, InitialRAMPercentage, direct memory, metaspace, thread stack, native memory, GC, CPU throttling, container memory limits, OOMKilled, and production-safe diagnostics.

Operational guide for detecting, reasoning about, and mitigating CPU throttling in Kubernetes workloads, especially Java 17+ / JAX-RS backend services where CFS quota, CPU limits, GC, thread pools, and latency interact.

Production runbook and operational model for OOMKilled, exit code 137, JVM heap and native memory, direct buffers, thread stacks, node memory pressure, eviction, heap dump safety, and memory-related incident debugging in Kubernetes.

Production operational model for Kubernetes ephemeral storage, EmptyDir, writable layers, logs, temporary files, uploads, batch processing, disk pressure, eviction, storage limits, cleanup, and backend failure debugging.

Production operational model for database, HTTP, Kafka, RabbitMQ, and Redis connection pools in Kubernetes, including per-pod pool multiplication, rolling deployment spikes, pool exhaustion, connection leaks, dependency capacity, autoscaling, and incident debugging.

Production operational model for Horizontal Pod Autoscaler, including CPU, memory, custom metrics, external metrics, scaling policy, stabilization windows, min/max replicas, metric lag, scaling thrash, and safe debugging for Java/JAX-RS backend workloads.

Production operational model for autoscaling Kafka, RabbitMQ, Redis Stream, and event-driven worker workloads in Kubernetes, including KEDA awareness, backlog semantics, consumer concurrency, partition/prefetch limits, scaling delay, over-scaling risk, and incident runbooks.

Production operational model for Cluster Autoscaler, Karpenter awareness, AKS node pool autoscaling, pending pod triggers, node provisioning delay, instance types, node pools, zone capacity, spot/preemptible nodes, bin packing, and safe debugging for backend engineers.

Production operational model for PodDisruptionBudget, minAvailable, maxUnavailable, voluntary disruption, node drain, rolling update, cluster upgrade, single replica risk, quorum workload risk, PDB blocking issues, and backend availability review.

Production operational model for node selector, node affinity, pod affinity, pod anti-affinity, topology spread constraints, taints, tolerations, PriorityClass, preemption, zone spreading, and safe scheduling debugging for backend engineers.

Production operational model for node readiness, node pressure, node drain, cordon, taints, node pools, node groups, runtime issue awareness, pod eviction, workload rescheduling, and safe node issue escalation for backend engineers.

Production operational model for PersistentVolume, PersistentVolumeClaim, StorageClass, CSI drivers, access modes, reclaim policy, volume expansion, PVC Pending, mount failures, disk full incidents, and safe storage escalation for backend engineers.

Production awareness for PostgreSQL, Kafka, RabbitMQ, Redis, Camunda, operators, StatefulSets, backup, restore, quorum, and managed-service decisions from a backend service owner perspective.

Operasi image tag, digest, ImagePullBackOff, registry auth, ImagePullSecret, ECR, ACR, vulnerability scan, image promotion, dan registry outage untuk backend service di Kubernetes.

Operasi rolling update, rollout status, history, rollback, revision, bad deployment, bad config, bad secret, bad migration, smoke test, dan post-deployment verification untuk workload backend di Kubernetes.

Operasi canary, traffic split, header-based routing, weight-based routing, Argo Rollouts awareness, Flagger awareness, metric-based promotion, auto rollback, manual pause, dan blast radius untuk backend services di Kubernetes.

Operasi blue-green deployment, blue environment, green environment, traffic switch, database compatibility, cache compatibility, event compatibility, rollback, cost, dan validation untuk workload backend di Kubernetes.

Koordinasi database migration untuk workload Kubernetes: migration job, expand-contract, backward compatibility, rollout order, readiness dependency, rollback limitation, long-running migration, migration lock, observability, dan production-safe release sequencing.