Avoid common Kubernetes mistakes — resource limits, probe configuration, selector mismatches, and RBAC pitfalls.
requests = guaranteed minimum — scheduler uses this for placementlimits = maximum allowed — exceeding memory = OOMKilled, CPU = throttledrequests without limits = burstable — can use more if availablereadinessProbe controls traffic — fails = removed from Service endpointslivenessProbe restarts container — fails = container killed and restartedstartupProbe for slow starts — disables liveness/readiness until successinitialDelaySeconds too short — pod killed before app startstimeoutSeconds too short — slow response = restart loopscheme: HTTPSapp, version, environmentmatchExpressions for complex selection — In, NotIn, ExistsenvFrom imports all keys — env.valueFrom for specific keyssubPath for single file without replacing directoryClusterIP internal only — default, only accessible within clusterNodePort exposes on node IP — 30000-32767 range, not for productionLoadBalancer provisions cloud LB — works only in supported environmentsstorageClassName must match — or use "" for no dynamic provisioningReadWriteOnce = single node — ReadWriteMany needed for multi-podpersistentVolumeReclaimPolicy controls PV fatekubectl apply vs create — apply for declarative (can update), create for imperative (fails if exists)-n namespace or set context defaultlatest in production — no version pinning, unpredictable updatesimagePullPolicy — Always for latest tag, IfNotPresent for versionedkubectl describe pod for events — shows scheduling failures, probe failureskubectl logs -f pod for logs — -p for previous container (after crash)kubectl exec -it pod -- sh for shell — debug inside containerkubectl get events --sort-by=.lastTimestamp — cluster-wide events timelineServiceAccount per workload — not default, for least privilegeRole is namespaced — ClusterRole is cluster-wideRoleBinding binds Role to user/SA — ClusterRoleBinding for cluster-widekubectl auth can-i verb resource --as=system:serviceaccount:ns:sa