Networking & Config

Services, ingress, configmaps, secrets, and switching between clusters/namespaces via kubeconfig contexts.

Exposing a deployment as a service#

Copy
kubectl expose deployment my-deployment --port=80 --target-port=8080
kubectl expose pod my-pod --port=443 --name=my-frontend
kubectl get services
kubectl get svc my-service -o wide

--port is what the Service listens on; --target-port is the container port traffic gets forwarded to — they're allowed to differ (e.g. exposing 443 externally while the container listens on 8443).

Ingress#

Copy
kubectl create ingress simple --rule="app.example.com/*=my-service:80"
kubectl create ingress simple --class=nginx --rule="app.example.com/*=my-service:80,tls=my-tls-secret"
kubectl get ingress
kubectl describe ingress simple

--class selects which ingress controller handles the resource (e.g. nginx, alb) — a cluster with no matching IngressClass installed will accept the resource but never actually route traffic for it.

ConfigMaps#

Copy
kubectl create configmap my-config --from-literal=LOG_LEVEL=info --from-literal=ENV=production
kubectl create configmap my-config --from-file=path/to/config.yaml
kubectl get configmap my-config -o yaml

Secrets#

Copy
kubectl create secret generic my-secret --from-literal=DB_PASSWORD=hunter2
kubectl create secret generic my-secret --from-file=ssh-privatekey=path/to/id_rsa
kubectl get secret my-secret -o jsonpath='{.data.DB_PASSWORD}' | base64 -d   # decode a value for inspection

Secret values in get -o yaml/json are base64-encoded, not encrypted — base64 is an encoding, not security. Anyone with get secrets RBAC access can decode it in one command; rely on RBAC and (if needed) an external secrets manager, not the encoding, for actual protection.

Kubeconfig contexts — switching clusters and namespaces#

Copy
kubectl config get-contexts                     # list all contexts
kubectl config current-context                  # which one is active
kubectl config use-context my-cluster            # switch active context
kubectl config set-context --current --namespace=my-namespace   # default namespace for the current context

Switching context switches which cluster and credentials kubectl talks to — a common incident-response mistake is running a delete against the wrong cluster because the active context wasn't checked first. kubectl config current-context before anything destructive is cheap insurance.

Port-forwarding to a pod or service#

Copy
kubectl port-forward pod/my-pod 8080:80
kubectl port-forward deployment/my-deployment 8080:80
kubectl port-forward service/my-service 8443:https   # target a service's named port