Deploying Spring Boot to Kubernetes: Step-by-Step

Intermediate·3 min read·

Fast recall

Quick revision

Core answer

Build a Docker image tagged with the commit SHA, push to a registry, then apply four manifests: Deployment (with resource requests/limits, probes, rolling strategy), Service (ClusterIP with label selector), ConfigMap/Secret (configuration injected as env), and Ingress (external routing). Use Helm or Kustomize for per-environment overrides. Never use the latest tag, never skip probes, never ship without resource limits.

Interview Answer3 min

Deploying a Spring Boot application to Kubernetes involves five components working together: a containerized image, a Deployment, a Service, a ConfigMap or Secret, and an Ingress. Each element has one job, and the deploy process builds them in dependency order.

Build and push the image

Tag with the registry path and a specific version like the commit SHA: docker build -t my-registry.io/payment-service:a1b2c3d . then docker push — never use latest in Kubernetes manifests because kubectl rollout undo becomes non-deterministic.
Authenticate to the registry from Kubernetes using an imagePullSecret; missing this is the most common cause of ErrImagePull.

Deployment and ConfigMap

Write a Deployment YAML declaring image, replicas, resource requests and limits, liveness/readiness/startup probes, rolling-update strategy, and envFrom references to ConfigMaps and Secrets — never hardcode configuration values in the Deployment spec.
Apply the ConfigMap first, then the Deployment — a Deployment referencing a missing ConfigMap fails with CreateContainerConfigError.
For the JVM, set -XX:MaxRAMPercentage=75.0 so the heap stays within the container limit with room for non-heap allocations.
Verify rollout: kubectl rollout status deployment/payment-service blocks until all replicas are running the new version.

Service and Ingress

Create a ClusterIP Service with a label selector matching the Deployment's pod template labels — immediately verify with kubectl get endpoints payment-service; an empty endpoint list means the selector does not match any pods.
Create the Ingress pointing to the Service by name and test the full external path: curl -H "Host: payments.example.com" http:///api/payments before marking the deployment complete.

Production hardening

Tag with commit SHA for deterministic rollback; keep revisionHistoryLimit: 10 so kubectl rollout undo works instantly without a rebuild.
Add a PodDisruptionBudget with minAvailable: 2 so node drains during cluster upgrades do not take the service to zero replicas.
Use Kustomize or Helm for per-environment values — one base parameterized for dev, staging, and prod prevents the slow drift that happens when teams copy-paste manifests.

Interview-ready guide

Interview answer

Build and push the image

Tag with the registry path and a specific version like the commit SHA: docker build -t my-registry.io/payment-service:a1b2c3d . then docker push — never use latest in Kubernetes manifests because kubectl rollout undo becomes non-deterministic.
Authenticate to the registry from Kubernetes using an imagePullSecret; missing this is the most common cause of ErrImagePull.

Deployment and ConfigMap

Write a Deployment YAML declaring image, replicas, resource requests and limits, liveness/readiness/startup probes, rolling-update strategy, and envFrom references to ConfigMaps and Secrets — never hardcode configuration values in the Deployment spec.
Apply the ConfigMap first, then the Deployment — a Deployment referencing a missing ConfigMap fails with CreateContainerConfigError.
For the JVM, set -XX:MaxRAMPercentage=75.0 so the heap stays within the container limit with room for non-heap allocations.
Verify rollout: kubectl rollout status deployment/payment-service blocks until all replicas are running the new version.

Service and Ingress

Create a ClusterIP Service with a label selector matching the Deployment's pod template labels — immediately verify with kubectl get endpoints payment-service; an empty endpoint list means the selector does not match any pods.
Create the Ingress pointing to the Service by name and test the full external path: curl -H "Host: payments.example.com" http:///api/payments before marking the deployment complete.

Production hardening

Tag with commit SHA for deterministic rollback; keep revisionHistoryLimit: 10 so kubectl rollout undo works instantly without a rebuild.
Add a PodDisruptionBudget with minAvailable: 2 so node drains during cluster upgrades do not take the service to zero replicas.
Use Kustomize or Helm for per-environment values — one base parameterized for dev, staging, and prod prevents the slow drift that happens when teams copy-paste manifests.

03 · Deep dive