Services, Ingress, ConfigMaps, Secrets, storage and RBAC

Service lab

A Service provides a stable abstraction over selected Pods. Labels/selectors must match; an empty endpoint list often indicates a mismatch or no ready Pods.

apiVersion: v1
kind: Service
metadata:
  name: academy-web
  namespace: academy
spec:
  selector: {app: academy-web}
  ports:
    - port: 80
      targetPort: 80
  type: ClusterIP

kubectl apply -f service.yaml
kubectl -n academy get endpointslices
kubectl -n academy port-forward service/academy-web 8080:80

Visit localhost:8080 while the forwarding session runs. ClusterIP is internal; NodePort and LoadBalancer provide different exposure methods. A cloud LoadBalancer may create billable resources.

Ingress and Gateway API

Ingress defines HTTP routing but needs a compatible controller. Creating an Ingress object alone does not install a proxy/load balancer. Gateway API provides newer, more expressive routing resources with implementation-specific support. Choose a maintained implementation and read its current compatibility/security guidance.

Configuration and secrets

ConfigMaps hold nonsensitive configuration. Kubernetes Secret data is commonly base64-encoded, which is not encryption. Enforce RBAC, encryption at rest where supported and suitable external-secret integration. Environment-variable changes typically require Pod replacement to affect running processes; mounted data update behaviour differs.

Persistent storage

A PersistentVolumeClaim requests storage through a StorageClass/PV. Access modes and topology affect scheduling. A StatefulSet supplies stable workload identity and storage patterns; it does not automatically configure database replication or backups. Understand reclaim policy before deleting a PVC.

RBAC and network boundaries

Roles bind API permissions within a namespace; ClusterRoles can have broader scope. RoleBindings assign permissions to subjects. ServiceAccounts identify workloads for Kubernetes APIs and may integrate with cloud identity. NetworkPolicy requires a supporting network implementation; a YAML policy without enforcement support gives false confidence.

Verification

Test a service selector typo, repair it and observe endpoints. Use kubectl auth can-i to test an intended API permission. Keep the default admin context separate from the limited identity being tested. Delete only the lab namespace after reviewing any external/persistent resources it created.

Official references

Kubernetes Services Kubernetes RBAC

Interview and revision check

Does creating an Ingress install its controller?

No. A compatible controller or gateway implementation must exist to realize the routing configuration.