Configuring Pod Specifications

1. Setting Container Images

Property	Value	Description
image	`nginx:1.21`	The Docker image to use for the container
imagePullPolicy	`Always`	When to pull the image: `Always`, `IfNotPresent`, or `Never`
imagePullSecrets	`[{name: "my-secret"}]`	Secrets to use for pulling private images

Example: Basic Pod with Container Image

apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
spec:
  containers:
  - name: nginx-container
    image: nginx:1.21

Example: Pod with Private Image

apiVersion: v1
kind: Pod
metadata:
  name: private-image-pod
spec:
  imagePullSecrets:
  - name: my-docker-registry-secret
  containers:
  - name: app-container
    image: my-registry.com/myapp:v1.0

2. Defining Resource Requests

Property	Description	Values	Notes
resources.requests.cpu	CPU request for the container	`100m`, `2`	100m = 100 milli-CPU (0.1 CPU)
resources.requests.memory	Memory request for the container	`128Mi`, `2Gi`	Units: Ki (kibibytes), Mi (mebibytes), Gi (gibibytes)
resources.limits.cpu	Maximum CPU the container can use	`200m`, `1`	Can be higher than request, but not more than node capacity
resources.limits.memory	Maximum memory the container can use	`256Mi`, `4Gi`	Must be equal to or higher than request

Example: Defining CPU and Memory Requests

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  containers:
  - name: app-container
    image: nginx
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"

Note: Resource requests and limits are enforced by the Kubernetes scheduler and kubelet. If a pod's total requested resources exceed node capacity, it will not be scheduled.

3. Defining Resource Limits

Property	Value	Description
resources.limits.cpu	`500m`	Maximum CPU cores a Pod can consume
resources.limits.memory	`512Mi`	Maximum memory a Pod can use
resources.requests.cpu	`250m`	Minimum CPU cores guaranteed to a Pod
resources.requests.memory	`256Mi`	Minimum memory guaranteed to a Pod

Example: Setting Resource Limits in a Pod Spec

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  containers:
  - name: app-container
    image: nginx
    resources:
      limits:
        memory: "512Mi"
        cpu: "500m"
      requests:
        memory: "256Mi"
        cpu: "250m"

Note: Resource limits and requests must be specified in the same unit (e.g., m for CPU, Gi, Mi for memory).

4. Configuring Environment Variables

Variable Type	Definition	Usage	Notes
env	`env:`	Defines environment variables for a container	Each variable is specified as `name: value`
envFrom	`envFrom:`	Loads environment variables from ConfigMaps or Secrets	Can reference all keys in a ConfigMap or Secret

Example: Setting Environment Variables

apiVersion: v1
kind: Pod
metadata:
  name: env-pod
spec:
  containers:
  - name: app
    image: nginx
    env:
    - name: ENV_VAR
      value: "production"

Example: Loading Variables from ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  DATABASE_URL: "postgres://localhost:5432/mydb"
  LOG_LEVEL: "info"

---

apiVersion: v1
kind: Pod
metadata:
  name: env-from-configmap
spec:
  containers:
  - name: app
    image: nginx
    envFrom:
    - configMapRef:
        name: app-config

Example: Loading Variables from Secret

apiVersion: v1
kind: Secret
metadata:
  name: app-secret
type: Opaque
data:
  DB_PASSWORD: "cGFzc3dvcmQxMjM="

---

apiVersion: v1
kind: Pod
metadata:
  name: env-from-secret
spec:
  containers:
  - name: app
    image: nginx
    envFrom:
    - secretRef:
        name: app-secret

5. Setting Container Commands

Property	Description	Values
command	Overrides the default entrypoint of the image	`string[]`
args	Overrides the default arguments of the image	`string[]`

Example: Overriding entrypoint and arguments

apiVersion: v1
kind: Pod
metadata:
  name: example-pod
spec:
  containers:
  - name: example-container
    image: ubuntu:20.04
    command: ["/bin/bash", "-c"]
    args: ["echo Hello World"]

Note: The command and args fields are used to override the default entrypoint and arguments defined in the Docker image. If both command and args are specified, the container's default entrypoint is completely replaced.

6. Configuring Working Directory

Field	Description	Values
workingDir	Specifies the working directory inside the container	`/app`

Example: Setting Working Directory

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: app-container
    image: nginx
    workingDir: /app

7. Setting Security Context

Property	Description	Values
securityContext	Defines security settings for the Pod or Container	`Object`
runAsUser	UID to run the container process as	`int64`
runAsGroup	GID to run the container process as	`int64`
fsGroup	Group ID for the filesystem group	`int64`
supplementalGroups	Additional GIDs to be added to the container	`Array[int64]`
readOnlyRootFilesystem	Mounts the root filesystem as read-only	`boolean`
allowPrivilegeEscalation	Allows processes to gain more privileges than their parent	`boolean`
privileged	Runs container in privileged mode	`boolean`
capabilities	Linux capabilities to add or drop	`Object`

Example: Setting Security Context for a Pod

apiVersion: v1
kind: Pod
metadata:
  name: security-context-pod
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  containers:
  - name: security-context-container
    image: nginx
    securityContext:
      runAsUser: 1001
      runAsGroup: 3001
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL

8. Configuring Pod Priority

Property	Description	Values
priorityClassName	Names the priority class for the pod	`string`
priority	Integer value defining pod priority (higher = more important)	`int`

Example: Setting Pod Priority

apiVersion: v1
kind: Pod
metadata:
  name: priority-pod
spec:
  priorityClassName: high-priority
  containers:
  - name: main
    image: nginx

Note: Priority classes must be defined in the cluster before use.

Warning: Pods with higher priority may cause preemption of lower-priority pods.

9. Using Pod Preemption Policy

Field	Description	Values	Notes
preemptionPolicy	Defines the preemption policy for a Pod	`Never`, `PreemptLowerPriority`	Default is `PreemptLowerPriority`

Example: Setting preemptionPolicy to Never

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  preemptionPolicy: Never
  containers:
  - name: app-container
    image: nginx

Note: Setting preemptionPolicy to Never prevents the Pod from being preempted by other Pods with lower priority, even if resources are tight.

10. Setting Pod Restart Policy

Policy	Description	Default Value	Notes
Never	Pod will never be restarted under any circumstances.	`Never`	Useful for one-time jobs or tasks that should only run once.
Always	Pod will always be restarted if it exits, regardless of the exit code.	`Always`	Commonly used for long-running applications or services.
OnFailure	Pod will only restart if it exits with a non-zero status code.	`OnFailure`	Useful for jobs or tasks that should retry on failure but not on success.

Example: Setting Restart Policy in Pod Spec

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: app-container
    image: nginx
  restartPolicy: Always

11. Configuring Pod DNS Policy

Policy	Description	Default Behavior	Notes
ClusterFirst	DNS queries for cluster-internal services are resolved within the cluster.	Yes	External queries are forwarded to upstream nameservers configured in the cluster.
ClusterFirstWithHostNet	Same as ClusterFirst, but also allows host network access.	No	Used when pods use hostNetwork=true.
Default	Uses the cluster's default DNS policy.	Yes	Equivalent to ClusterFirst unless overridden by cluster configuration.
None	No DNS resolution is performed by the kubelet.	No	Pods must rely on custom DNS configuration or external resolution.

Example: Setting DNS Policy in Pod Spec

apiVersion: v1
kind: Pod
metadata:
  name: dns-policy-example
spec:
  dnsPolicy: "None"
  containers:
  - name: example-container
    image: nginx

Note: When dnsPolicy is set to None, the pod's DNS configuration must be handled manually via dnsConfig.

12. Using Service Account

Property	Description	Default Value	Notes
serviceAccountName	Name of the ServiceAccount to use for the Pod	default	Must exist in the same namespace
automountServiceAccountToken	Whether to automatically mount the ServiceAccount token	true	Set to false to disable automatic mounting

Example: Define ServiceAccount in Pod Spec

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: my-service-account
  automountServiceAccountToken: false
  containers:
  - name: app-container
    image: nginx

Note: The ServiceAccount must exist in the same namespace as the Pod.

Warning: Disabling automountServiceAccountToken means the Pod will not have access to the ServiceAccount token by default.