StorageClass 

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast-sc
provisioner: kubernetes.io/no-provisioner
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer
reclaimPolicy: Delete

LimitRange 

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: dev
spec:
  limits:
  - type: Container
    default:
      cpu: 500m
      memory: 256Mi
    defaultRequest:
      cpu: 100m
      memory: 128Mi
    max:
      cpu: "2"
      memory: 1Gi

ResourceQuota 

apiVersion: v1
kind: ResourceQuota
metadata:
  name: my-quota
  namespace: myns
spec:
  hard:
    pods: "10"
    resourcequotas: "1"
    services: "5"
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"

Custom Resource (CRD instance) 

# apiVersion = <group>/<version> from kubectl api-resources
# kind = Kind from kubectl api-resources
apiVersion: example.com/v1
kind: Widget
metadata:
  name: my-widget
spec:
  size: large
  color: blue

EndpointSlice (manual external endpoint) 

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: my-svc           # match Service name
  labels:
    kubernetes.io/service-name: my-svc
addressType: IPv4
ports:
  - protocol: TCP
    port: 9999
endpoints:
  - addresses:
      - 192.168.1.100

Multi-container Pod 

apiVersion: v1
kind: Pod
metadata:
  name: multi-pod
spec:
  containers:
  - name: first
    image: busybox:1.28
    command: ["sh", "-c", "sleep 3600"]
    env:
    - name: ORDER
      value: FIRST
  - name: second
    image: nginx:1.17
    ports:
    - containerPort: 8080
  - name: third
    image: busybox:1.31.1
    command: ["sh", "-c", "sleep 3600"]
    env:
    - name: ORDER
      value: THIRD

QoS classes quick reference 

# Guaranteed: requests == limits for ALL resources on ALL containers
resources:
  requests: {cpu: 200m, memory: 200Mi}
  limits:   {cpu: 200m, memory: 200Mi}

# Burstable: any container has requests OR limits (not equal, or only one set)
resources:
  limits: {memory: 200Mi}    # requests unset = 0 =/= 200Mi -> Burstable

# BestEffort: NO resources block on any container

kubectl get pods -n <ns> \
  --output=custom-columns="NAME:.metadata.name,QOS:.status.qosClass"

Namespace: Pod Security labels 

apiVersion: v1
kind: Namespace
metadata:
  name: secure-ns
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

Role + RoleBinding 

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: dev
rules:
- apiGroups: [""]
  resources: [pods]
  verbs: [get, list, watch]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: dev
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-reader
subjects:
- kind: ServiceAccount
  name: my-sa
  namespace: dev

Exam gotchas

  • Forbidden: exceeded quota → admission, not RBAC: check ResourceQuota USED vs HARD
  • Namespace with ResourceQuota needs LimitRange defaults or explicit requests/limits on every container
  • Job/CronJob restartPolicy is Never or OnFailure
  • StatefulSet needs a matching headless Service