Skip to content

Room 35

1173— password: “affinity” title_prefix: “🗺️ ” summary: “Use topology spread constraints to distribute pods evenly.”

TOPOLOGY SPREAD

The Balance Chamber

  • Topology spread constraints ensure pods are distributed evenly across failure domains.
  • Balance pods across nodes to reveal the password.

📜 Mission Briefing

  1. Deploy spread-deploy.yaml with topologySpreadConstraints.
  2. Verify pods are distributed across nodes (max skew of 1).
  3. Check the deployment annotation for the password: topology.
Key Commands
Command Purpose
kubectl get pods -o wide Pod-to-node mapping
kubectl describe pod NAME Topology spread info
Topology Spread Constraints
apiVersion: apps/v1
kind: Deployment
metadata:
  name: balanced-app
  annotations:
    escape-password: "topology"
spec:
  replicas: 6
  selector:
    matchLabels:
      app: balanced
  template:
    metadata:
      labels:
        app: balanced
    spec:
      topologySpreadConstraints:
        - maxSkew: 1 # Max imbalance allowed
          topologyKey: kubernetes.io/hostname # Spread across nodes
          whenUnsatisfiable: DoNotSchedule # or ScheduleAnyway
          labelSelector:
            matchLabels:
              app: balanced
      containers:
        - name: app
          image: nginx:alpine

# topologyKey options:
# kubernetes.io/hostname:         Spread across nodes
# topology.kubernetes.io/zone:    Spread across zones
# topology.kubernetes.io/region:  Spread across regions

# whenUnsatisfiable:
# DoNotSchedule:   Hard constraint (pod stays pending)
# ScheduleAnyway:  Soft constraint (schedule anyway, minimize skew)

# maxSkew: N means the difference between the most-loaded and
# least-loaded topology domain can't exceed N

# Example: 3 nodes, 6 pods, maxSkew=1
# Node A: 2 pods, Node B: 2 pods, Node C: 2 pods ✅
# Node A: 3 pods, Node B: 2 pods, Node C: 1 pods ❌ (skew=2)
Hints

Hint 1

kubectl apply -f spread-deploy.yaml
kubectl get pods -o wide -l app=balanced

Hint 2

Check the distribution: 

kubectl get pods -o wide -l app=balanced --no-headers | awk '{print $7}' | sort | uniq -c

Hint 3

The password is topology.

🔓 Unlock Room 36

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_36/README -out ../room_36/README.txt -pass pass:PASSWORD
cat ../room_36/README.txt