Cheat notes · Module 08 · Share the cluster

Capstone: a third team, on your own

A five-minute review for when you have done this module and want it back in your head. Open the full module for the steps and the lab, or the full text to print.

The idea

Onboarding a team is the same kit every time, in an order that lets you test each layer: namespace, quota and defaults, RBAC, the app, network policies last. An internal service has no Ingress and one named caller, and the caller's egress must allow the call too.

Remember

Order: namespace, quota and LimitRange, RBAC, app, network policies, with a check after each.
Internal only: a ClusterIP Service, no Ingress, ingress allowed only from the caller's pods.
One list item, both selectors: namespaceSelector for checkout-dev and podSelector for app.kubernetes.io/name: checkout.
Both ends: checkout's restrict-egress needs a rule to payments on 9898.
Quota for 3 replicas at 100m: room for 4 pods during a rollout, so 400m to 600m.
A budget that allows a drain: maxUnavailable: 1, never minAvailable equal to the replica count.
docs/onboarding.md: each item with a command and the answer you expect, including some no.

Pitfalls

Writing payments' ingress rule and forgetting checkout's egress: the call times out.
Two dashes instead of one in from:: either selector would match, which lets in all of checkout-dev or every checkout pod anywhere.
Applying the tenant folder before the namespace: limits.yaml comes first alphabetically and fails.

Commands

`kubectl apply -f tenants/TEAM/namespace.yaml`	The namespace before its folder
`kubectl label --dry-run=server --overwrite namespace NS pod-security.kubernetes.io/enforce=restricted`	Ready for enforce?
`kubectl -n NS exec deployment/NAME -- ls /var/run/secrets/kubernetes.io/serviceaccount`	No token mounted?
`diff -r REF/tenants/payments tenants/payments`	Compare with the reference

tenants/payments/networkpolicy.yaml (allow-from-checkout)

ingress:
  - from:
      - namespaceSelector:
          matchLabels:
            kubernetes.io/metadata.name: checkout-dev
        podSelector:
          matchLabels:
            app.kubernetes.io/name: checkout
    ports:
      - protocol: TCP
        port: 9898

Test yourself

Answer in your head first, then open the answer.

payments allows checkout in, but the call from checkout times out. First check?

checkout's egress rules.

Which budget lets a node drain with 3 replicas?

maxUnavailable: 1.

In what order do you build a tenant?

Namespace, quota and defaults, RBAC, app, network policies, testing after each.

Where module 08 leaves you: A third tenant, payments-dev, runs payments with 3 replicas, its own quota, RBAC, policies and Pod Security. checkout can call it; catalog and the ingress controller cannot. Your repo has docs/onboarding.md. The cluster is deleted; your repo keeps everything.