StatefulSets, DaemonSets and Jobs

apiVersion: apps/v1
kind: StatefulSet
metadata: { name: db }
spec:
  serviceName: db-headless          # REQUIRED, and must be a headless Service
  replicas: 3
  selector:
    matchLabels: { app: db }
  template:
    metadata:
      labels: { app: db }
    spec:
      terminationGracePeriodSeconds: 30
      containers:
        - name: postgres
          image: postgres:17
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:             # creates ONE PVC PER POD
    - metadata: { name: data }
      spec:
        accessModes: [ReadWriteOnce]
        storageClassName: gp3
        resources: { requests: { storage: 100Gi } }
---
apiVersion: v1
kind: Service
metadata: { name: db-headless }
spec:
  clusterIP: None                   # headless → per-pod DNS records
  selector: { app: db }
  ports: [{ port: 5432 }]

apiVersion: apps/v1
kind: DaemonSet
metadata: { name: log-agent }
spec:
  selector:
    matchLabels: { app: log-agent }
  template:
    metadata:
      labels: { app: log-agent }
    spec:
      # Run on control-plane nodes too, which are usually tainted
      tolerations:
        - operator: Exists
      containers:
        - name: agent
          image: fluent-bit:3.1
          resources:
            limits: { memory: 200Mi }     # it runs EVERYWHERE — cap it
          volumeMounts:
            - name: varlog
              mountPath: /var/log
              readOnly: true
      volumes:
        - name: varlog
          hostPath: { path: /var/log }

apiVersion: batch/v1
kind: Job
metadata: { name: migrate }
spec:
  backoffLimit: 3           # retries before marking Failed
  completions: 1            # how many successful pods are needed
  parallelism: 1            # how many may run at once
  activeDeadlineSeconds: 600
  ttlSecondsAfterFinished: 3600   # auto-delete, or Jobs accumulate forever
  template:
    spec:
      restartPolicy: OnFailure    # Never or OnFailure. NOT Always
      containers:
        - name: migrate
          image: myapp:1.4.2
          command: ["./migrate.sh"]

apiVersion: batch/v1
kind: CronJob
metadata: { name: backup }
spec:
  schedule: "0 2 * * *"           # 02:00 — in the CONTROLLER's timezone
  timeZone: "Africa/Cairo"        # 1.27+. Set it explicitly
  concurrencyPolicy: Forbid       # do not start if the last one still runs
  startingDeadlineSeconds: 300
  successfulJobsHistoryLimit: 3
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: backup
              image: backup:1.0