120 minutos / 17 tareas                        = 7,0 min por tarea
- 10 minutos de revisión final                 = 6,4 min por tarea
- ~30 s de leer el enunciado y cambiar contexto = 5,9 min por tarea

kubectl config use-context rutas-norte-dev
kubectl config set-context --current --namespace=rutas-norte-dev

apiVersion: v1
kind: Pod
metadata:
  name: api-reservas-con-sidecar
  namespace: rutas-norte-dev
spec:
  initContainers:
  - name: espera-postgres            # initContainer clásico: bloquea hasta terminar
    image: busybox:1.36
    command: ['sh', '-c', 'until nc -z postgres-reservas 5432; do sleep 2; done']
  - name: recolector-logs            # sidecar NATIVO (1.29+): no termina nunca
    image: busybox:1.36
    restartPolicy: Always
    command: ['sh', '-c', 'tail -F /var/log/api/app.log']
    volumeMounts:
    - { name: logs, mountPath: /var/log/api }
  containers:
  - name: api
    image: node:20-alpine
    command: ['sh', '-c', 'while true; do date >> /var/log/api/app.log; sleep 5; done']
    volumeMounts:
    - { name: logs, mountPath: /var/log/api }
  volumes:
  - name: logs
    emptyDir: {}

apiVersion: batch/v1
kind: CronJob
metadata: { name: informes-ocupacion, namespace: rutas-norte-pro }
spec:
  schedule: "0 3 * * *"
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 1800
      template:
        spec:
          restartPolicy: OnFailure        # obligatorio: nunca "Always"
          containers:
          - name: informes
            image: rutas-norte/informes:1.4

    startupProbe:
      httpGet: { path: /healthz, port: 3000 }
      failureThreshold: 30
      periodSeconds: 5          # hasta 150 s de margen para arrancar
    readinessProbe:
      httpGet: { path: /ready, port: 3000 }
      periodSeconds: 10
    livenessProbe:
      httpGet: { path: /healthz, port: 3000 }
      periodSeconds: 15
      failureThreshold: 3

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    fsGroup: 2000
  containers:
  - name: api
    image: rutas-norte/api-reservas:2.3
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
        add: ["NET_BIND_SERVICE"]

    env:
    - name: NIVEL_LOG                      # 1. variable individual
      valueFrom:
        configMapKeyRef: { name: config-api, key: nivel_log }
    - name: DB_PASSWORD                    # 1bis. desde un Secret
      valueFrom:
        secretKeyRef: { name: credenciales-postgres, key: password }
    envFrom:
    - configMapRef: { name: config-api }   # 2. todas las claves
    - secretRef: { name: credenciales-postgres }
    volumeMounts:
    - { name: config, mountPath: /etc/config, readOnly: true }
  volumes:
  - name: config
    configMap:
      name: config-api
      items:                               # 4. solo una clave (sin items → forma 3)
      - { key: app.conf, path: app.conf }

k create configmap config-api --from-literal=nivel_log=info --from-literal=timeout=30
k create configmap config-fichero --from-file=app.conf
k create secret generic credenciales-postgres \
  --from-literal=usuario=reservas --from-literal=password='S3cr3t0!'
k create secret docker-registry regcred --docker-server=registry.rutasnorte.es \
  --docker-username=ci --docker-password=xxx
k create secret tls tienda-web-tls --cert=tls.crt --key=tls.key

k set image deployment/api-reservas api=rutas-norte/api-reservas:2.4
k rollout status deployment/api-reservas
k rollout history deployment/api-reservas
k rollout history deployment/api-reservas --revision=3
k rollout undo deployment/api-reservas                  # a la revisión ANTERIOR
k rollout undo deployment/api-reservas --to-revision=2

# Pausar para agrupar varios cambios en un solo rollout
k rollout pause deployment/api-reservas
k set resources deployment/api-reservas -c=api --limits=memory=512Mi
k rollout resume deployment/api-reservas

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # pods extra permitidos por encima de replicas
      maxUnavailable: 0    # ninguno puede faltar → despliegue sin corte

# Denegar todo en el namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: denegar-todo, namespace: rutas-norte-pro }
spec:
  podSelector: {}          # {} = todos los pods del namespace
  policyTypes: [Ingress, Egress]
---
# Permitir a api-reservas hablar con postgres y resolver DNS
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: api-egress, namespace: rutas-norte-pro }
spec:
  podSelector:
    matchLabels: { app: api-reservas }
  policyTypes: [Egress]
  egress:
  - to:
    - podSelector:
        matchLabels: { app: postgres-reservas }
    ports:
    - { protocol: TCP, port: 5432 }
  - to:                          # DNS: casi siempre hay que permitirlo
    - namespaceSelector:
        matchLabels: { kubernetes.io/metadata.name: kube-system }
    ports:
    - { protocol: UDP, port: 53 }

  # A) UNA entrada con dos selectores (AND): pods app=api EN namespaces entorno=pro
  - namespaceSelector: { matchLabels: { entorno: pro } }
    podSelector: { matchLabels: { app: api } }

  # B) DOS entradas (OR): cualquier pod de namespaces entorno=pro, MÁS
  #    los pods app=api del namespace de la política
  - namespaceSelector: { matchLabels: { entorno: pro } }
  - podSelector: { matchLabels: { app: api } }

alias k=kubectl
export do='--dry-run=client -o yaml'
export now='--force --grace-period=0'
source <(kubectl completion bash)
complete -o default -F __start_kubectl k

# Pods
k run tienda-web --image=nginx:1.27-alpine $do > pod.yaml
k run debug --image=busybox:1.36 $do --command -- sleep 3600 > debug.yaml
k run api --image=node:20 --labels=app=api,tier=backend --port=3000 \
  --env=NIVEL_LOG=debug $do > api.yaml

# Deployments y Services
k create deployment api-reservas --image=rutas-norte/api:2.3 --replicas=3 $do > deploy.yaml
k expose deployment api-reservas --port=80 --target-port=3000 --name=api-svc $do > svc.yaml
k create service clusterip api-svc --tcp=80:3000 $do > svc.yaml
k create service nodeport tienda-svc --tcp=80:80 --node-port=30080 $do > svc.yaml

# Configuración, trabajos, Ingress y RBAC
k create configmap config-api --from-literal=nivel=info $do > cm.yaml
k create secret generic cred --from-literal=pass=xxx $do > sec.yaml
k create job migracion --image=rutas-norte/migra:1.0 $do > job.yaml
k create cronjob informes --image=rutas-norte/informes:1.4 --schedule="0 3 * * *" $do \
  -- /bin/sh -c "informes.sh" > cj.yaml
k create ingress tienda --rule="www.rutasnorte.es/*=tienda-web-svc:80" $do > ing.yaml
k create serviceaccount soporte $do > sa.yaml
k create role lector --verb=get,list --resource=pods $do > role.yaml
k create rolebinding lector-b --role=lector --serviceaccount=ns:soporte $do > rb.yaml
k create quota cuota-qa --hard=cpu=4,memory=8Gi,pods=20 $do > quota.yaml
k create poddisruptionbudget api-pdb --selector=app=api --min-available=2 $do > pdb.yaml

k explain pod.spec.containers.livenessProbe --recursive
k explain pod.spec.securityContext --recursive
k explain cronjob.spec --recursive
k explain networkpolicy | head -3        # recordar el apiVersion correcto
k api-resources | grep -i policy

# Pods de un solo uso, para comprobar conectividad o DNS
k run test --image=busybox:1.36 --rm -it --restart=Never -- wget -qO- api-svc:80
k run dns  --image=busybox:1.36 --rm -it --restart=Never -- nslookup api-svc

# Modificar objetos existentes sin tocar YAML
k scale deployment api-reservas --replicas=5
k autoscale deployment api-reservas --min=2 --max=10 --cpu-percent=70
k set image deployment/api-reservas api=rutas-norte/api:2.4
k set resources deployment/api-reservas -c=api --limits=cpu=500m,memory=512Mi
k set serviceaccount deployment/api-reservas soporte
k set env deployment/api-reservas NIVEL_LOG=debug
k set env deployment/api-reservas --from=configmap/config-api
k label pod tienda-web entorno=pro --overwrite
k annotate deployment api-reservas kubernetes.io/change-cause="subida a 2.4"
k cp rutas-norte-pro/api-reservas-abc:/var/log/app.log ./app.log

k get events -n rutas-norte-pro --sort-by=.lastTimestamp     # el más útil al depurar
k get pods -A --sort-by=.status.containerStatuses[0].restartCount
k get pods -o name
k get pod api-reservas-abc -o jsonpath='{.status.podIP}'
k get pods -o custom-columns=NOMBRE:.metadata.name,NODO:.spec.nodeName,ESTADO:.status.phase
k get pods --field-selector status.phase=Running
k get pods -l 'entorno in (pre,pro)'
k get pods -l '!app'                                  # pods SIN la etiqueta app
k logs -l app=api-reservas --tail=50 --all-containers=true
k logs api-reservas-abc -c sidecar --previous          # el contenedor anterior al crash

cat <<'EOF' > ~/.vimrc
set number
set expandtab
set tabstop=2
set shiftwidth=2
set softtabstop=2
set autoindent
set paste
EOF

# Réplicas
k patch deployment api-reservas -p '{"spec":{"replicas":5}}'

# Imagen de un contenedor concreto (strategic merge)
k patch deployment api-reservas \
  -p '{"spec":{"template":{"spec":{"containers":[{"name":"api","image":"rutas-norte/api:2.4"}]}}}}'

# Tipo de un Service
k patch svc tienda-web-svc -p '{"spec":{"type":"NodePort"}}'

# JSON patch para reemplazar un campo exacto
k patch pv pv-informes --type='json' \
  -p='[{"op":"replace","path":"/spec/persistentVolumeReclaimPolicy","value":"Retain"}]'

# YAML multilinea (cómodo para listas)
k patch deployment worker-notificaciones --type='strategic' -p '
spec:
  template:
    spec:
      tolerations:
      - { key: dedicado, operator: Equal, value: batch, effect: NoSchedule }'

k get job migracion -o yaml > job.yaml   # editar, quitar status y metadatos volátiles
k delete job migracion && k apply -f job.yaml

apiVersion: v1
kind: Pod
metadata: { name: informes-ocupacion, namespace: rutas-norte-dev }
spec:
  containers:
  - name: generador
    image: busybox:1.36
    command: ['sh', '-c', 'while true; do date >> /datos/ocupacion.log; sleep 5; done']
    volumeMounts: [{ name: datos, mountPath: /datos }]
  - name: lector
    image: busybox:1.36
    command: ['sh', '-c', 'tail -F /datos/ocupacion.log']
    volumeMounts: [{ name: datos, mountPath: /datos }]
  volumes:
  - name: datos
    emptyDir: {}

k logs informes-ocupacion -c lector -n rutas-norte-dev

Wed Aug  6 09:14:22 UTC 2026
Wed Aug  6 09:14:27 UTC 2026

k create configmap config-api --from-literal=nivel_log=debug \
  --from-literal=max_conexiones=50 -n rutas-norte-dev
k create secret generic credenciales-postgres --from-literal=usuario=reservas \
  --from-literal=password='Nort3!2026' -n rutas-norte-dev
k run api-reservas --image=nginx:1.27-alpine $do -n rutas-norte-dev > api.yaml

spec:
  containers:
  - name: api-reservas
    image: nginx:1.27-alpine
    envFrom:
    - configMapRef: { name: config-api }
    volumeMounts:
    - { name: secretos, mountPath: /etc/secretos, readOnly: true }
  volumes:
  - name: secretos
    secret: { secretName: credenciales-postgres }

k exec api-reservas -n rutas-norte-dev -- env | grep -E 'nivel_log|max_conexiones'
k exec api-reservas -n rutas-norte-dev -- cat /etc/secretos/usuario

nivel_log=debug
max_conexiones=50
reservas

k create cronjob informes-nocturnos --image=busybox:1.36 --schedule="0 3 * * *" \
  -n rutas-norte-pro $do -- /bin/sh -c "echo informe generado" > cj.yaml

spec:
  schedule: "0 3 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: OnFailure
          containers:
          - name: informes-nocturnos
            image: busybox:1.36
            command: ["/bin/sh", "-c", "echo informe generado"]

k create job prueba --from=cronjob/informes-nocturnos -n rutas-norte-pro
k logs job/prueba -n rutas-norte-pro

informe generado

        startupProbe:
          httpGet: { path: /healthz, port: 3000 }
          periodSeconds: 10
          failureThreshold: 12        # 12 x 10s = 120 s de margen
        readinessProbe:
          httpGet: { path: /ready, port: 3000 }
          periodSeconds: 10
        livenessProbe:
          httpGet: { path: /healthz, port: 3000 }
          periodSeconds: 10
          failureThreshold: 3

k rollout status deployment/api-reservas -n rutas-norte-pre
k describe pod -l app=api-reservas -n rutas-norte-pre | grep -E 'Liveness|Readiness|Startup'

k patch deployment tienda-web -n rutas-norte-pro -p '
spec:
  strategy:
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }'

k set image deployment/tienda-web tienda-web=nginx:1.27.2-alpine -n rutas-norte-pro
k annotate deployment tienda-web -n rutas-norte-pro \
  kubernetes.io/change-cause="actualizacion a nginx 1.27.2" --overwrite
k rollout status deployment/tienda-web -n rutas-norte-pro
k rollout history deployment/tienda-web -n rutas-norte-pro

REVISION  CHANGE-CAUSE
1         <none>
2         actualizacion a nginx 1.27.2

k rollout undo deployment/tienda-web -n rutas-norte-pro
k get deployment tienda-web -n rutas-norte-pro \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

nginx:1.27-alpine

apiVersion: v1
kind: Pod
metadata: { name: worker-notificaciones, namespace: rutas-norte-pro }
spec:
  securityContext:
    runAsUser: 10001
    runAsGroup: 3000
    runAsNonRoot: true
  containers:
  - name: worker
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities: { drop: ["ALL"] }

k exec worker-notificaciones -n rutas-norte-pro -- id
k exec worker-notificaciones -n rutas-norte-pro -- touch /prueba

uid=10001 gid=3000
touch: /prueba: Read-only file system

k expose deployment tienda-web --name=tienda-web-svc --port=80 --target-port=80 \
  -n rutas-norte-pro
k create ingress tienda-ingress -n rutas-norte-pro --class=nginx \
  --rule="www.rutasnorte.es/*=tienda-web-svc:80"

k describe ingress tienda-ingress -n rutas-norte-pro | grep -A4 Rules
k get endpoints tienda-web-svc -n rutas-norte-pro

Rules:
  Host                Path  Backends
  ----                ----  --------
  www.rutasnorte.es   /     tienda-web-svc:80 (10.244.1.9:80,10.244.2.4:80)

k get pods -n rutas-norte-dev

NAME          READY   STATUS                       RESTARTS   AGE
redis-cache   0/1     CreateContainerConfigError   0          4m

k describe pod redis-cache -n rutas-norte-dev | tail -6

Events:
  Warning  Failed  2m (x12 over 4m)  kubelet
    Error: configmap "config-redis" not found

k create configmap config-redis --from-literal=maxmemory=256mb -n rutas-norte-dev
k get pods -n rutas-norte-dev
echo "El pod referenciaba el ConfigMap config-redis, inexistente en el namespace" \
  > /opt/diagnostico.txt

# 1 (≈90 s)
k create deployment tienda-web --image=nginx:1.27-alpine --replicas=4
k create service nodeport tienda-web --tcp=80:80 --node-port=30080

# 2 (≈60 s)
k create configmap config-web --from-literal=entorno=dev --from-literal=cache=on
k set env deployment/tienda-web --from=configmap/config-web

# 3 (≈150 s): generar y añadir completions/parallelism
k create job migracion-bd --image=busybox:1.36 $do -- /bin/sh -c "echo migrado" > job.yaml

spec:
  completions: 3
  parallelism: 2
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: migracion-bd
        image: busybox:1.36
        command: ["/bin/sh", "-c", "echo migrado"]

k apply -f job.yaml
# 4 (≈30 s)
k autoscale deployment tienda-web --min=2 --max=8 --cpu-percent=70
# 5 (≈30 s)
k get pods --sort-by=.metadata.name -o name > /opt/pods.txt

apiVersion: v1
kind: Pod
metadata: { name: api-reservas-full, namespace: rutas-norte-pre }
spec:
  securityContext: { runAsNonRoot: true, runAsUser: 10001 }
  initContainers:
  - name: espera-db
    image: busybox:1.36
    command: ['sh', '-c', 'until nc -z postgres-reservas 5432; do sleep 2; done']
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  - name: logs
    image: busybox:1.36
    restartPolicy: Always            # sidecar nativo (1.29+)
    command: ['sh', '-c', 'tail -F /var/log/nginx/access.log']
    volumeMounts: [{ name: logs-nginx, mountPath: /var/log/nginx }]
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  containers:
  - name: api
    image: nginx:1.27-alpine
    ports: [{ containerPort: 80 }]
    resources:
      requests: { cpu: 100m, memory: 128Mi }
      limits:   { cpu: 200m, memory: 256Mi }
    readinessProbe:
      httpGet: { path: /, port: 80 }
      initialDelaySeconds: 5
    livenessProbe:
      httpGet: { path: /, port: 80 }
      periodSeconds: 15
      failureThreshold: 3
    volumeMounts: [{ name: logs-nginx, mountPath: /var/log/nginx }]
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  volumes:
  - name: logs-nginx
    emptyDir: {}

k get pods -n rutas-norte-dev -o wide                    # 1. qué no está Running
k describe pod <nombre> -n rutas-norte-dev | tail -20    # 2. los eventos: 80 % de los casos
k logs <nombre> -n rutas-norte-dev --previous            # 3. si arranca y muere
k get endpoints -n rutas-norte-dev                       # 4. si el problema es de Service
k get pods --show-labels -n rutas-norte-dev              #    ¿casan con el selector?
k get events -n rutas-norte-dev --sort-by=.lastTimestamp | tail -20

cat <<'EOF' > /opt/diagnostico.txt
1. tienda-web: ErrImagePull por tag nginx:9.9 inexistente -> corregido a 1.27-alpine
2. api-reservas: CreateContainerConfigError, faltaba el Secret credenciales-postgres -> creado
3. redis-cache-svc: sin endpoints, selector app=redis frente a etiqueta app=redis-cache -> corregido
EOF