Kubernetes 2025 + 開発者生産性ツール総整理：AIワークロード、FinOps、Platform Engineeringの時代

apiVersion: v1
kind: Pod
metadata:
  name: gpu-inference
spec:
  containers:
    - name: inference
      image: my-model:v1
      resources:
        limits:
          nvidia.com/mig-1g.5gb: 1

apiVersion: v1
kind: ConfigMap
metadata:
  name: time-slicing-config
data:
  any: |-
    version: v1
    flags:
      migStrategy: none
    sharing:
      timeSlicing:
        resources:
          - name: nvidia.com/gpu
            replicas: 4

apiVersion: v1
kind: Pod
metadata:
  name: topology-aware-training
spec:
  containers:
    - name: training
      image: pytorch-train:v2
      resources:
        limits:
          nvidia.com/gpu: 4
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: topology.kubernetes.io/zone
      whenUnsatisfied: DoNotSchedule

apiVersion: kubeflow.org/v1
kind: PyTorchJob
metadata:
  name: llm-fine-tuning
spec:
  pytorchReplicaSpecs:
    Master:
      replicas: 1
      template:
        spec:
          containers:
            - name: pytorch
              image: my-training:v1
              resources:
                limits:
                  nvidia.com/gpu: 2
    Worker:
      replicas: 3
      template:
        spec:
          containers:
            - name: pytorch
              image: my-training:v1
              resources:
                limits:
                  nvidia.com/gpu: 2

apiVersion: serving.kserve.io/v1beta1
kind: InferenceService
metadata:
  name: llm-service
spec:
  predictor:
    model:
      modelFormat:
        name: pytorch
      storageUri: s3://models/llm-v2
      resources:
        limits:
          nvidia.com/gpu: 1
        requests:
          memory: 16Gi
  transformer:
    containers:
      - name: preprocessor
        image: my-preprocessor:v1

# OpenCostインストール（Helm）
# helm repo add opencost https://opencost.github.io/opencost-helm-chart
# helm install opencost opencost/opencost

apiVersion: apps/v1
kind: Deployment
metadata:
  name: opencost
  namespace: opencost
spec:
  replicas: 1
  selector:
    matchLabels:
      app: opencost
  template:
    metadata:
      labels:
        app: opencost
    spec:
      containers:
        - name: opencost
          image: ghcr.io/opencost/opencost:latest
          env:
            - name: CLUSTER_ID
              value: 'production-cluster'
            - name: CLOUD_PROVIDER_API_KEY
              valueFrom:
                secretKeyRef:
                  name: cloud-api-key
                  key: api-key

# Kubecostインストール
# helm install kubecost cost-analyzer \
#   --repo https://kubecost.github.io/cost-analyzer/ \
#   --namespace kubecost \
#   --create-namespace

# コストアラート設定例
apiVersion: v1
kind: ConfigMap
metadata:
  name: kubecost-alerts
  namespace: kubecost
data:
  alerts.json: |
    {
      "alerts": [
        {
          "type": "budget",
          "threshold": 1000,
          "window": "7d",
          "aggregation": "namespace",
          "filter": "namespace=production"
        },
        {
          "type": "efficiency",
          "threshold": 0.5,
          "window": "48h",
          "aggregation": "deployment"
        }
      ]
    }

# アンチパターン：リソース設定なし（ノードリソースを無制限に使用可能）
apiVersion: v1
kind: Pod
metadata:
  name: no-limits-bad
spec:
  containers:
    - name: app
      image: my-app:v1
      # resources設定なし - 危険！
---
# ベストプラクティス：適切なリクエストとリミットの設定
apiVersion: v1
kind: Pod
metadata:
  name: properly-sized
spec:
  containers:
    - name: app
      image: my-app:v1
      resources:
        requests:
          cpu: 250m
          memory: 512Mi
        limits:
          cpu: 500m
          memory: 1Gi

apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: my-app-vpa
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  updatePolicy:
    updateMode: 'Off' # まず推奨のみ受け取る
  resourcePolicy:
    containerPolicies:
      - containerName: app
        minAllowed:
          cpu: 100m
          memory: 128Mi
        maxAllowed:
          cpu: 2
          memory: 4Gi

apiVersion: karpenter.sh/v1beta1
kind: NodePool
metadata:
  name: spot-pool
spec:
  template:
    spec:
      requirements:
        - key: karpenter.sh/capacity-type
          operator: In
          values: ['spot', 'on-demand']
        - key: node.kubernetes.io/instance-type
          operator: In
          values:
            - m5.xlarge
            - m5.2xlarge
            - m6i.xlarge
            - m6i.2xlarge
      nodeClassRef:
        name: default
  limits:
    cpu: '100'
    memory: 400Gi
  disruption:
    consolidationPolicy: WhenUnderutilized
    expireAfter: 720h

# Backstageサービスカタログ定義
apiVersion: backstage.io/v1alpha1
kind: Component
metadata:
  name: payment-service
  description: 決済処理マイクロサービス
  tags:
    - java
    - spring-boot
  annotations:
    github.com/project-slug: myorg/payment-service
    backstage.io/techdocs-ref: dir:.
spec:
  type: service
  lifecycle: production
  owner: team-payments
  system: checkout
  providesApis:
    - payment-api
  consumesApis:
    - user-api
    - inventory-api
  dependsOn:
    - resource:payments-db
    - resource:payments-queue

apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
  name: spring-boot-service
  title: Spring Bootマイクロサービス
  description: 標準的なSpring Bootサービスを生成します
spec:
  owner: platform-team
  type: service
  parameters:
    - title: サービス情報
      required:
        - name
        - owner
      properties:
        name:
          title: サービス名
          type: string
          pattern: '^[a-z][a-z0-9-]*$'
        owner:
          title: 所有チーム
          type: string
          ui:field: OwnerPicker
        javaVersion:
          title: Javaバージョン
          type: string
          enum:
            - '17'
            - '21'
          default: '21'
  steps:
    - id: fetch-template
      name: テンプレート取得
      action: fetch:template
      input:
        url: ./skeleton
        values:
          name: 'skeleton-name'
          owner: 'skeleton-owner'
          javaVersion: '21'
    - id: publish
      name: GitHubリポジトリ作成
      action: publish:github
      input:
        repoUrl: github.com?owner=myorg
        description: サービス説明
    - id: register
      name: Backstageに登録
      action: catalog:register
      input:
        repoContentsUrl: 'catalog-info-url'
        catalogInfoPath: /catalog-info.yaml

# AWS RDSインスタンスをK8s CRDで定義
apiVersion: database.aws.crossplane.io/v1beta1
kind: RDSInstance
metadata:
  name: production-db
spec:
  forProvider:
    region: ap-northeast-2
    dbInstanceClass: db.r6g.xlarge
    engine: postgres
    engineVersion: '15'
    masterUsername: admin
    allocatedStorage: 100
    publiclyAccessible: false
    vpcSecurityGroupIds:
      - sg-abc123
  writeConnectionSecretToRef:
    name: production-db-creds
    namespace: default

apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: standard-database
spec:
  compositeTypeRef:
    apiVersion: platform.myorg.io/v1alpha1
    kind: Database
  resources:
    - name: rds-instance
      base:
        apiVersion: database.aws.crossplane.io/v1beta1
        kind: RDSInstance
        spec:
          forProvider:
            dbInstanceClass: db.r6g.large
            engine: postgres
            engineVersion: '15'
    - name: security-group
      base:
        apiVersion: ec2.aws.crossplane.io/v1beta1
        kind: SecurityGroup
        spec:
          forProvider:
            description: Database security group
    - name: subnet-group
      base:
        apiVersion: database.aws.crossplane.io/v1beta1
        kind: DBSubnetGroup

Golden Pathの例：新しいマイクロサービスの作成

1. Backstageテンプレートから「Spring Boot Service」を選択
2. サービス名、チーム、Javaバージョンを入力
3. [自動] GitHubリポジトリ作成
4. [自動] CI/CDパイプライン設定（GitHub Actions）
5. [自動] ArgoCDアプリケーション登録
6. [自動] モニタリングダッシュボード作成（Grafana）
7. [自動] Backstageサービスカタログ登録
8. 開発者はビジネスロジックにのみ集中！

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: payment-service
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/k8s-manifests
    targetRevision: main
    path: apps/payment-service/overlays/production
  destination:
    server: https://kubernetes.default.svc
    namespace: payment
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m

apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: microservices
  namespace: argocd
spec:
  generators:
    - git:
        repoURL: https://github.com/myorg/k8s-manifests
        revision: main
        directories:
          - path: 'apps/*/overlays/production'
  template:
    metadata:
      name: 'app-name-placeholder'
    spec:
      project: default
      source:
        repoURL: https://github.com/myorg/k8s-manifests
        targetRevision: main
        path: 'path-placeholder'
      destination:
        server: https://kubernetes.default.svc

# Flux GitRepositoryソース
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: app-repo
  namespace: flux-system
spec:
  interval: 1m
  url: https://github.com/myorg/k8s-manifests
  ref:
    branch: main
---
# Flux Kustomization
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: payment-service
  namespace: flux-system
spec:
  interval: 5m
  path: ./apps/payment-service/production
  prune: true
  sourceRef:
    kind: GitRepository
    name: app-repo
  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: payment-service
      namespace: payment
  timeout: 3m

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: payment-service
spec:
  replicas: 10
  strategy:
    canary:
      steps:
        - setWeight: 5
        - pause:
            duration: 5m
        - setWeight: 20
        - pause:
            duration: 10m
        - setWeight: 50
        - pause:
            duration: 15m
        - setWeight: 80
        - pause:
            duration: 10m
      canaryMetadata:
        labels:
          role: canary
      stableMetadata:
        labels:
          role: stable
      analysis:
        templates:
          - templateName: success-rate
        startingStep: 2
        args:
          - name: service-name
            value: payment-service

apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
spec:
  args:
    - name: service-name
  metrics:
    - name: success-rate
      interval: 2m
      successCondition: result[0] >= 0.95
      provider:
        prometheus:
          address: http://prometheus:9090
          query: |
            sum(rate(http_requests_total{
              service="payment-service-arg",
              status=~"2.."
            }[5m])) /
            sum(rate(http_requests_total{
              service="payment-service-arg"
            }[5m]))

# ネームスペースにセキュリティ標準を適用
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  hostUsers: false # User Namespace有効化
  containers:
    - name: app
      image: my-app:v1
      securityContext:
        runAsNonRoot: true
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
        seccompProfile:
          type: RuntimeDefault

# Kyvernoポリシーで署名済みイメージのみ許可
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  background: false
  rules:
    - name: verify-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - 'myregistry.io/*'
          attestors:
            - entries:
                - keyless:
                    subject: '*.myorg.io'
                    issuer: 'https://accounts.google.com'

# Istio PeerAuthentication - mTLS強制
apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

GitHub Copilotの効果測定（GitHub内部調査）：

- コード記述速度：55%向上
- タスク完了率：Copilotユーザーが78%高い
- 開発者満足度：ユーザーの75%が業務満足度向上
- 繰り返しコード削減：ボイラープレートコード70%自動生成

Cursorのティップ：
- .cursorrulesでプロジェクトコンベンションを定義
- Composerエージェントでリファクタリングを自動化
- Tab補完＋コンテキスト学習でプロジェクト特化の提案

# Claude Code使用例
claude "このプロジェクトのテストカバレッジを分析して不足しているテストを追加して"

# フック設定例（.claude/hooks.json）
# PreCommitフックでコミット前に自動リント
# PostEditフックでファイル修正後に自動型チェック

# n8nをK8sにデプロイ
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n8n
  namespace: automation
spec:
  replicas: 1
  selector:
    matchLabels:
      app: n8n
  template:
    metadata:
      labels:
        app: n8n
    spec:
      containers:
        - name: n8n
          image: n8nio/n8n:latest
          ports:
            - containerPort: 5678
          env:
            - name: N8N_BASIC_AUTH_ACTIVE
              value: 'true'
            - name: WEBHOOK_URL
              value: 'https://n8n.mycompany.com/'
          volumeMounts:
            - name: n8n-data
              mountPath: /home/node/.n8n
      volumes:
        - name: n8n-data
          persistentVolumeClaim:
            claimName: n8n-data

# CrewAIでコードレビューを自動化（例）
from crewai import Agent, Task, Crew

reviewer = Agent(
    role="Senior Code Reviewer",
    goal="Review code for bugs, security issues, and best practices",
    backstory="Expert developer with 15 years of experience"
)

security_analyst = Agent(
    role="Security Analyst",
    goal="Identify security vulnerabilities in code changes",
    backstory="Specialized in application security and OWASP"
)

review_task = Task(
    description="Review the latest PR for code quality",
    agent=reviewer
)

security_task = Task(
    description="Analyze PR for security vulnerabilities",
    agent=security_analyst
)

crew = Crew(
    agents=[reviewer, security_analyst],
    tasks=[review_task, security_task],
    verbose=True
)

Greptileの設定フロー：
1. GitHub Appをインストール
2. リポジトリを接続（インデックス作成に数分）
3. PR作成時に自動でレビューコメント追加
4. レビュールールのカスタマイズが可能

# mintlify.yaml設定例
name: My API Documentation
navigation:
  - group: Getting Started
    pages:
      - introduction
      - quickstart
      - authentication
  - group: API Reference
    pages:
      - api-reference/users
      - api-reference/payments
      - api-reference/webhooks
colors:
  primary: '#0D47A1'
  light: '#42A5F5'
  dark: '#0D47A1'
api:
  baseUrl: https://api.myservice.com
  auth:
    method: bearer

Warp活用ティップ：
- Cmd+Pで AIにコマンドを質問
- 出力ブロックをクリックしてチームに共有
- Warp Driveによく使うK8sコマンドを保存
  例：kubectl get pods --sort-by=.status.startTime
  例：kubectl top nodes --sort-by=cpu

Phase 1（1-2週間）：基盤
  - AIコーディングツールを選定しチーム全体に導入
  - ArgoCDでGitOps開始
  - OpenCostをインストールしコストを把握

Phase 2（1-2ヶ月）：自動化
  - CI/CDパイプラインの標準化
  - n8nで繰り返し作業を自動化
  - AIコードレビューツールの導入

Phase 3（3-6ヶ月）：プラットフォーム
  - BackstageのMVP構築
  - Golden Pathを1-2個定義
  - Progressive Delivery開始

Phase 4（6ヶ月以上）：最適化
  - Crossplaneでインフラ抽象化
  - Service Mesh導入
  - FinOpsフレームワーク確立
  - IDP高度化