120 minuts / 17 tasques                         = 7,0 min per tasca
- 10 minuts de revisió final                    = 6,4 min per tasca
- ~30 s de llegir l'enunciat i canviar context  = 5,9 min per tasca

kubectl config use-context rutas-norte-dev
kubectl config set-context --current --namespace=rutas-norte-dev

apiVersion: v1
kind: Pod
metadata:
  name: api-reserves-amb-sidecar
  namespace: rutas-norte-dev
spec:
  initContainers:
  - name: espera-postgres            # initContainer clàssic: bloqueja fins a acabar
    image: busybox:1.36
    command: ['sh', '-c', 'until nc -z postgres-reserves 5432; do sleep 2; done']
  - name: recollector-logs           # sidecar NATIU (1.29+): no acaba mai
    image: busybox:1.36
    restartPolicy: Always
    command: ['sh', '-c', 'tail -F /var/log/api/app.log']
    volumeMounts:
    - { name: logs, mountPath: /var/log/api }
  containers:
  - name: api
    image: node:20-alpine
    command: ['sh', '-c', 'while true; do date >> /var/log/api/app.log; sleep 5; done']
    volumeMounts:
    - { name: logs, mountPath: /var/log/api }
  volumes:
  - name: logs
    emptyDir: {}

apiVersion: batch/v1
kind: CronJob
metadata: { name: informes-ocupacio, namespace: rutas-norte-pro }
spec:
  schedule: "0 3 * * *"
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      activeDeadlineSeconds: 1800
      template:
        spec:
          restartPolicy: OnFailure        # obligatori: mai "Always"
          containers:
          - name: informes
            image: rutas-norte/informes:1.4

    startupProbe:
      httpGet: { path: /healthz, port: 3000 }
      failureThreshold: 30
      periodSeconds: 5          # fins a 150 s de marge per arrencar
    readinessProbe:
      httpGet: { path: /ready, port: 3000 }
      periodSeconds: 10
    livenessProbe:
      httpGet: { path: /healthz, port: 3000 }
      periodSeconds: 15
      failureThreshold: 3

spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    fsGroup: 2000
  containers:
  - name: api
    image: rutas-norte/api-reserves:2.3
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
        add: ["NET_BIND_SERVICE"]

    env:
    - name: NIVELL_LOG                     # 1. variable individual
      valueFrom:
        configMapKeyRef: { name: config-api, key: nivell_log }
    - name: DB_PASSWORD                    # 1bis. des d'un Secret
      valueFrom:
        secretKeyRef: { name: credencials-postgres, key: password }
    envFrom:
    - configMapRef: { name: config-api }   # 2. totes les claus
    - secretRef: { name: credencials-postgres }
    volumeMounts:
    - { name: config, mountPath: /etc/config, readOnly: true }
  volumes:
  - name: config
    configMap:
      name: config-api
      items:                               # 4. només una clau (sense items → forma 3)
      - { key: app.conf, path: app.conf }

k create configmap config-api --from-literal=nivell_log=info --from-literal=timeout=30
k create configmap config-fitxer --from-file=app.conf
k create secret generic credencials-postgres \
  --from-literal=usuari=reserves --from-literal=password='S3cr3t0!'
k create secret docker-registry regcred --docker-server=registry.rutasnorte.es \
  --docker-username=ci --docker-password=xxx
k create secret tls botiga-web-tls --cert=tls.crt --key=tls.key

k set image deployment/api-reserves api=rutas-norte/api-reserves:2.4
k rollout status deployment/api-reserves
k rollout history deployment/api-reserves
k rollout history deployment/api-reserves --revision=3
k rollout undo deployment/api-reserves                  # a la revisió ANTERIOR
k rollout undo deployment/api-reserves --to-revision=2

# Pausar per agrupar diversos canvis en un sol rollout
k rollout pause deployment/api-reserves
k set resources deployment/api-reserves -c=api --limits=memory=512Mi
k rollout resume deployment/api-reserves

spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # pods extra permesos per damunt de replicas
      maxUnavailable: 0    # cap no pot faltar → desplegament sense tall

# Denegar tot al namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: denegar-tot, namespace: rutas-norte-pro }
spec:
  podSelector: {}          # {} = tots els pods del namespace
  policyTypes: [Ingress, Egress]
---
# Permetre a api-reserves parlar amb postgres i resoldre DNS
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: api-egress, namespace: rutas-norte-pro }
spec:
  podSelector:
    matchLabels: { app: api-reserves }
  policyTypes: [Egress]
  egress:
  - to:
    - podSelector:
        matchLabels: { app: postgres-reserves }
    ports:
    - { protocol: TCP, port: 5432 }
  - to:                          # DNS: gairebé sempre cal permetre'l
    - namespaceSelector:
        matchLabels: { kubernetes.io/metadata.name: kube-system }
    ports:
    - { protocol: UDP, port: 53 }

  # A) UNA entrada amb dos selectors (AND): pods app=api EN namespaces entorn=pro
  - namespaceSelector: { matchLabels: { entorn: pro } }
    podSelector: { matchLabels: { app: api } }

  # B) DUES entrades (OR): qualsevol pod de namespaces entorn=pro, MÉS
  #    els pods app=api del namespace de la política
  - namespaceSelector: { matchLabels: { entorn: pro } }
  - podSelector: { matchLabels: { app: api } }

alias k=kubectl
export do='--dry-run=client -o yaml'
export now='--force --grace-period=0'
source <(kubectl completion bash)
complete -o default -F __start_kubectl k

# Pods
k run botiga-web --image=nginx:1.27-alpine $do > pod.yaml
k run debug --image=busybox:1.36 $do --command -- sleep 3600 > debug.yaml
k run api --image=node:20 --labels=app=api,tier=backend --port=3000 \
  --env=NIVELL_LOG=debug $do > api.yaml

# Deployments i Services
k create deployment api-reserves --image=rutas-norte/api:2.3 --replicas=3 $do > deploy.yaml
k expose deployment api-reserves --port=80 --target-port=3000 --name=api-svc $do > svc.yaml
k create service clusterip api-svc --tcp=80:3000 $do > svc.yaml
k create service nodeport botiga-svc --tcp=80:80 --node-port=30080 $do > svc.yaml

# Configuració, treballs, Ingress i RBAC
k create configmap config-api --from-literal=nivell=info $do > cm.yaml
k create secret generic cred --from-literal=pass=xxx $do > sec.yaml
k create job migracio --image=rutas-norte/migra:1.0 $do > job.yaml
k create cronjob informes --image=rutas-norte/informes:1.4 --schedule="0 3 * * *" $do \
  -- /bin/sh -c "informes.sh" > cj.yaml
k create ingress botiga --rule="www.rutasnorte.es/*=botiga-web-svc:80" $do > ing.yaml
k create serviceaccount suport $do > sa.yaml
k create role lector --verb=get,list --resource=pods $do > role.yaml
k create rolebinding lector-b --role=lector --serviceaccount=ns:suport $do > rb.yaml
k create quota quota-qa --hard=cpu=4,memory=8Gi,pods=20 $do > quota.yaml
k create poddisruptionbudget api-pdb --selector=app=api --min-available=2 $do > pdb.yaml

k explain pod.spec.containers.livenessProbe --recursive
k explain pod.spec.securityContext --recursive
k explain cronjob.spec --recursive
k explain networkpolicy | head -3        # recordar l'apiVersion correcte
k api-resources | grep -i policy

# Pods d'un sol ús, per comprovar connectivitat o DNS
k run test --image=busybox:1.36 --rm -it --restart=Never -- wget -qO- api-svc:80
k run dns  --image=busybox:1.36 --rm -it --restart=Never -- nslookup api-svc

# Modificar objectes existents sense tocar YAML
k scale deployment api-reserves --replicas=5
k autoscale deployment api-reserves --min=2 --max=10 --cpu-percent=70
k set image deployment/api-reserves api=rutas-norte/api:2.4
k set resources deployment/api-reserves -c=api --limits=cpu=500m,memory=512Mi
k set serviceaccount deployment/api-reserves suport
k set env deployment/api-reserves NIVELL_LOG=debug
k set env deployment/api-reserves --from=configmap/config-api
k label pod botiga-web entorn=pro --overwrite
k annotate deployment api-reserves kubernetes.io/change-cause="pujada a 2.4"
k cp rutas-norte-pro/api-reserves-abc:/var/log/app.log ./app.log

k get events -n rutas-norte-pro --sort-by=.lastTimestamp     # el més útil en depurar
k get pods -A --sort-by=.status.containerStatuses[0].restartCount
k get pods -o name
k get pod api-reserves-abc -o jsonpath='{.status.podIP}'
k get pods -o custom-columns=NOM:.metadata.name,NODE:.spec.nodeName,ESTAT:.status.phase
k get pods --field-selector status.phase=Running
k get pods -l 'entorn in (pre,pro)'
k get pods -l '!app'                                  # pods SENSE l'etiqueta app
k logs -l app=api-reserves --tail=50 --all-containers=true
k logs api-reserves-abc -c sidecar --previous          # el contenidor anterior al crash

cat <<'EOF' > ~/.vimrc
set number
set expandtab
set tabstop=2
set shiftwidth=2
set softtabstop=2
set autoindent
set paste
EOF

# Rèpliques
k patch deployment api-reserves -p '{"spec":{"replicas":5}}'

# Imatge d'un contenidor concret (strategic merge)
k patch deployment api-reserves \
  -p '{"spec":{"template":{"spec":{"containers":[{"name":"api","image":"rutas-norte/api:2.4"}]}}}}'

# Tipus d'un Service
k patch svc botiga-web-svc -p '{"spec":{"type":"NodePort"}}'

# JSON patch per reemplaçar un camp exacte
k patch pv pv-informes --type='json' \
  -p='[{"op":"replace","path":"/spec/persistentVolumeReclaimPolicy","value":"Retain"}]'

# YAML multilínia (còmode per a llistes)
k patch deployment worker-notificacions --type='strategic' -p '
spec:
  template:
    spec:
      tolerations:
      - { key: dedicat, operator: Equal, value: batch, effect: NoSchedule }'

k get job migracio -o yaml > job.yaml   # editar, treure status i metadades volàtils
k delete job migracio && k apply -f job.yaml

apiVersion: v1
kind: Pod
metadata: { name: informes-ocupacio, namespace: rutas-norte-dev }
spec:
  containers:
  - name: generador
    image: busybox:1.36
    command: ['sh', '-c', 'while true; do date >> /dades/ocupacio.log; sleep 5; done']
    volumeMounts: [{ name: dades, mountPath: /dades }]
  - name: lector
    image: busybox:1.36
    command: ['sh', '-c', 'tail -F /dades/ocupacio.log']
    volumeMounts: [{ name: dades, mountPath: /dades }]
  volumes:
  - name: dades
    emptyDir: {}

k logs informes-ocupacio -c lector -n rutas-norte-dev

Wed Aug  6 09:14:22 UTC 2026
Wed Aug  6 09:14:27 UTC 2026

k create configmap config-api --from-literal=nivell_log=debug \
  --from-literal=max_connexions=50 -n rutas-norte-dev
k create secret generic credencials-postgres --from-literal=usuari=reserves \
  --from-literal=password='Nort3!2026' -n rutas-norte-dev
k run api-reserves --image=nginx:1.27-alpine $do -n rutas-norte-dev > api.yaml

spec:
  containers:
  - name: api-reserves
    image: nginx:1.27-alpine
    envFrom:
    - configMapRef: { name: config-api }
    volumeMounts:
    - { name: secrets, mountPath: /etc/secrets, readOnly: true }
  volumes:
  - name: secrets
    secret: { secretName: credencials-postgres }

k exec api-reserves -n rutas-norte-dev -- env | grep -E 'nivell_log|max_connexions'
k exec api-reserves -n rutas-norte-dev -- cat /etc/secrets/usuari

nivell_log=debug
max_connexions=50
reserves

k create cronjob informes-nocturns --image=busybox:1.36 --schedule="0 3 * * *" \
  -n rutas-norte-pro $do -- /bin/sh -c "echo informe generat" > cj.yaml

spec:
  schedule: "0 3 * * *"
  concurrencyPolicy: Forbid
  successfulJobsHistoryLimit: 3
  jobTemplate:
    spec:
      backoffLimit: 2
      template:
        spec:
          restartPolicy: OnFailure
          containers:
          - name: informes-nocturns
            image: busybox:1.36
            command: ["/bin/sh", "-c", "echo informe generat"]

k create job prova --from=cronjob/informes-nocturns -n rutas-norte-pro
k logs job/prova -n rutas-norte-pro

informe generat

        startupProbe:
          httpGet: { path: /healthz, port: 3000 }
          periodSeconds: 10
          failureThreshold: 12        # 12 x 10s = 120 s de marge
        readinessProbe:
          httpGet: { path: /ready, port: 3000 }
          periodSeconds: 10
        livenessProbe:
          httpGet: { path: /healthz, port: 3000 }
          periodSeconds: 10
          failureThreshold: 3

k rollout status deployment/api-reserves -n rutas-norte-pre
k describe pod -l app=api-reserves -n rutas-norte-pre | grep -E 'Liveness|Readiness|Startup'

k patch deployment botiga-web -n rutas-norte-pro -p '
spec:
  strategy:
    rollingUpdate: { maxSurge: 1, maxUnavailable: 0 }'

k set image deployment/botiga-web botiga-web=nginx:1.27.2-alpine -n rutas-norte-pro
k annotate deployment botiga-web -n rutas-norte-pro \
  kubernetes.io/change-cause="actualitzacio a nginx 1.27.2" --overwrite
k rollout status deployment/botiga-web -n rutas-norte-pro
k rollout history deployment/botiga-web -n rutas-norte-pro

REVISION  CHANGE-CAUSE
1         <none>
2         actualitzacio a nginx 1.27.2

k rollout undo deployment/botiga-web -n rutas-norte-pro
k get deployment botiga-web -n rutas-norte-pro \
  -o jsonpath='{.spec.template.spec.containers[0].image}'

nginx:1.27-alpine

apiVersion: v1
kind: Pod
metadata: { name: worker-notificacions, namespace: rutas-norte-pro }
spec:
  securityContext:
    runAsUser: 10001
    runAsGroup: 3000
    runAsNonRoot: true
  containers:
  - name: worker
    image: busybox:1.36
    command: ["sleep", "3600"]
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities: { drop: ["ALL"] }

k exec worker-notificacions -n rutas-norte-pro -- id
k exec worker-notificacions -n rutas-norte-pro -- touch /prova

uid=10001 gid=3000
touch: /prova: Read-only file system

k expose deployment botiga-web --name=botiga-web-svc --port=80 --target-port=80 \
  -n rutas-norte-pro
k create ingress botiga-ingress -n rutas-norte-pro --class=nginx \
  --rule="www.rutasnorte.es/*=botiga-web-svc:80"

k describe ingress botiga-ingress -n rutas-norte-pro | grep -A4 Rules
k get endpoints botiga-web-svc -n rutas-norte-pro

Rules:
  Host                Path  Backends
  ----                ----  --------
  www.rutasnorte.es   /     botiga-web-svc:80 (10.244.1.9:80,10.244.2.4:80)

k get pods -n rutas-norte-dev

NAME          READY   STATUS                       RESTARTS   AGE
redis-cache   0/1     CreateContainerConfigError   0          4m

k describe pod redis-cache -n rutas-norte-dev | tail -6

Events:
  Warning  Failed  2m (x12 over 4m)  kubelet
    Error: configmap "config-redis" not found

k create configmap config-redis --from-literal=maxmemory=256mb -n rutas-norte-dev
k get pods -n rutas-norte-dev
echo "El pod referenciava el ConfigMap config-redis, inexistent al namespace" \
  > /opt/diagnostic.txt

# 1 (≈90 s)
k create deployment botiga-web --image=nginx:1.27-alpine --replicas=4
k create service nodeport botiga-web --tcp=80:80 --node-port=30080

# 2 (≈60 s)
k create configmap config-web --from-literal=entorn=dev --from-literal=cache=on
k set env deployment/botiga-web --from=configmap/config-web

# 3 (≈150 s): generar i afegir completions/parallelism
k create job migracio-bd --image=busybox:1.36 $do -- /bin/sh -c "echo migrat" > job.yaml

spec:
  completions: 3
  parallelism: 2
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: migracio-bd
        image: busybox:1.36
        command: ["/bin/sh", "-c", "echo migrat"]

k apply -f job.yaml
# 4 (≈30 s)
k autoscale deployment botiga-web --min=2 --max=8 --cpu-percent=70
# 5 (≈30 s)
k get pods --sort-by=.metadata.name -o name > /opt/pods.txt

apiVersion: v1
kind: Pod
metadata: { name: api-reserves-full, namespace: rutas-norte-pre }
spec:
  securityContext: { runAsNonRoot: true, runAsUser: 10001 }
  initContainers:
  - name: espera-db
    image: busybox:1.36
    command: ['sh', '-c', 'until nc -z postgres-reserves 5432; do sleep 2; done']
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  - name: logs
    image: busybox:1.36
    restartPolicy: Always            # sidecar natiu (1.29+)
    command: ['sh', '-c', 'tail -F /var/log/nginx/access.log']
    volumeMounts: [{ name: logs-nginx, mountPath: /var/log/nginx }]
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  containers:
  - name: api
    image: nginx:1.27-alpine
    ports: [{ containerPort: 80 }]
    resources:
      requests: { cpu: 100m, memory: 128Mi }
      limits:   { cpu: 200m, memory: 256Mi }
    readinessProbe:
      httpGet: { path: /, port: 80 }
      initialDelaySeconds: 5
    livenessProbe:
      httpGet: { path: /, port: 80 }
      periodSeconds: 15
      failureThreshold: 3
    volumeMounts: [{ name: logs-nginx, mountPath: /var/log/nginx }]
    securityContext:
      allowPrivilegeEscalation: false
      capabilities: { drop: ["ALL"] }
  volumes:
  - name: logs-nginx
    emptyDir: {}

k get pods -n rutas-norte-dev -o wide                    # 1. què no està Running
k describe pod <nom> -n rutas-norte-dev | tail -20       # 2. els esdeveniments: 80 % dels casos
k logs <nom> -n rutas-norte-dev --previous               # 3. si arrenca i mor
k get endpoints -n rutas-norte-dev                       # 4. si el problema és de Service
k get pods --show-labels -n rutas-norte-dev              #    casen amb el selector?
k get events -n rutas-norte-dev --sort-by=.lastTimestamp | tail -20

cat <<'EOF' > /opt/diagnostic.txt
1. botiga-web: ErrImagePull per tag nginx:9.9 inexistent -> corregit a 1.27-alpine
2. api-reserves: CreateContainerConfigError, faltava el Secret credencials-postgres -> creat
3. redis-cache-svc: sense endpoints, selector app=redis davant de l'etiqueta app=redis-cache -> corregit
EOF