K8s Manifest Generator

Kubernetes Manifests — payments-api (K8s 1.29, nginx ingress)

Target cluster: prod-us-east · Namespace: payments · Service tier: 1

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: payments-api
  namespace: payments
  labels:
    app.kubernetes.io/name: payments-api
    app.kubernetes.io/component: api
    app.kubernetes.io/part-of: payments
spec:
  replicas: 3
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0      # zero-downtime rollouts
  selector:
    matchLabels:
      app.kubernetes.io/name: payments-api
  template:
    metadata:
      labels:
        app.kubernetes.io/name: payments-api
      annotations:
        # Force re-roll when ConfigMap changes
        checksum/config: "{{ .Values.configChecksum }}"
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 10001
        fsGroup: 10001
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: api
          # Digest pin — never use a moving tag in production
          image: ghcr.io/example-org/payments-api@sha256:7c2d4e0b5a1c8f3b9e2a6d8c1f4b7e9a2d5c8f1e4b7a9c2d5e8f1b4c7a9d2e5
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP
          env:
            - name: PORT
              value: "8080"
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: payments-api-secrets
                  key: database-url
            - name: STRIPE_SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: payments-api-secrets
                  key: stripe-secret-key
          resources:
            requests:
              cpu: 250m
              memory: 384Mi
            limits:
              cpu: 1000m
              memory: 768Mi      # 2× request — caps OOM blast radius
          readinessProbe:
            httpGet:
              path: /ready          # checks DB + Stripe reachability
              port: http
            initialDelaySeconds: 5
            periodSeconds: 5
            timeoutSeconds: 3
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz        # process-only check; does NOT touch DB
              port: http
            initialDelaySeconds: 30
            periodSeconds: 15
            timeoutSeconds: 3
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: cache
              mountPath: /app/cache
      volumes:
        - name: tmp
          emptyDir: {}
        - name: cache
          emptyDir: {}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: payments-api

service.yaml and ingress.yaml

apiVersion: v1
kind: Service
metadata:
  name: payments-api
  namespace: payments
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: payments-api
  ports:
    - name: http
      port: 80
      targetPort: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: payments-api
  namespace: payments
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/hsts: "true"
    nginx.ingress.kubernetes.io/hsts-max-age: "31536000"
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    - hosts: [payments.example.com]
      secretName: payments-api-tls
  rules:
    - host: payments.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: payments-api
                port:
                  name: http

hpa.yaml, pdb.yaml, networkpolicy.yaml

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: payments-api
  namespace: payments
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: payments-api
  minReplicas: 3
  maxReplicas: 12
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300   # 5-min cool-down — avoid thrash
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: payments-api
  namespace: payments
spec:
  minAvailable: 2          # paired with 3 replicas; prevents drain to 0
  selector:
    matchLabels:
      app.kubernetes.io/name: payments-api
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: payments-api
  namespace: payments
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: payments-api
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: ingress-nginx
      ports:
        - port: 8080
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: payments
      ports: [{ port: 5432 }]      # Postgres
    - to: []                       # DNS + outbound HTTPS to Stripe
      ports:
        - port: 53
          protocol: UDP
        - port: 443

Resource Decisions

Apply Order

kubectl apply -f networkpolicy.yaml -n payments
kubectl apply -f service.yaml -n payments
kubectl apply -f deployment.yaml -n payments
kubectl apply -f hpa.yaml -n payments
kubectl apply -f pdb.yaml -n payments
kubectl apply -f ingress.yaml -n payments

kubectl rollout status deployment/payments-api -n payments --timeout=2m

Generated by the ClearPoint Nexus K8s Manifest Generator skill. Verify resource sizing against production traffic before scaling beyond staging.

This sample illustrates the skill's output format. Names, metrics, and operational details are illustrative unless the artifact explicitly analyzes public information.