loom-kubernetes

# Kubernetes ## Overview Production Kubernetes resource design, security hardening, Helm, and operations. The annotated examples below and the **Expert Practices** section carry the load-bearing knowledge — most production failures here are silent (no API error, no event), surfacing only under load, node maintenance, or a hardened cluster. ## Workload & Identity Cheatsheet | Kind | Identity guarantee | Use for | | --------------- | ------------------------------------------------------------------------------- | ------------------------------------------- | | **Deployment** | Fungible pods, random names, no ordering | Stateless services | | **StatefulSet** | Stable ordinal identity + DNS + per-pod PVC; ordered rollout (`OrderedReady`) | Databases, quorum systems, sharded stores | | **DaemonSet** | One pod per (matching) node | Node agents: logging, CNI, node-exporter | | **Job/CronJob** | Run-to-completion / scheduled | Batch, migrations, backups | Rollout knobs: `strategy.rollingUpdate.maxSurge`/`maxUnavailable` (Deployment); `maxUnavailable` + `partition` (StatefulSet). `imagePullPolicy`: `IfNotPresent` for immutable tags/digests; `Always` only for mutable tags (adds a regi...