Deploy a PHP application on Kubernetes by packaging the application and its dependencies in an immutable image, running that image in a Deployment, and placing a Service in front of the Pods. PHP-FPM executes PHP; NGINX or Apache handles HTTP. Use ConfigMaps for ordinary settings, Secrets for credentials, and an Ingress only when you need external HTTP routing or TLS. Keep databases, Redis, uploads, and other durable state as separately designed services.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This guide shows a production-minded path from Dockerfile to verified rollout, with manifests for PHP-FPM, NGINX, configuration, secrets, Services, and ingress-nginx FastCGI routing.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Understand the Kubernetes shape of a PHP application
Kubernetes does not run a PHP source directory by itself. A typical deployment has several layers:
- Container image: contains a tested PHP runtime, required extensions, Composer dependencies, application code, and the command that starts the selected process.
- Deployment: keeps the desired number of identical Pods running and performs rolling updates when the image or configuration changes.
- PHP runtime: PHP-FPM listens for FastCGI requests, conventionally on TCP port 9000. PHP-FPM is an application runtime, not an HTTP server.
- Web tier: NGINX or Apache serves static files, terminates HTTP concerns where appropriate, and forwards dynamic requests to PHP-FPM.
- Service: gives a changing set of Pods a stable DNS name and virtual IP.
- Ingress or LoadBalancer: optionally publishes HTTP/HTTPS outside the cluster and provides host/path routing.
- Stateful dependencies: databases, Redis, object storage, queues, and persistent uploads are designed and backed up independently of the PHP web Pods.
A Pod is replaceable. Anything written only to its container layer can disappear when that Pod is rescheduled, recreated, or scaled down. Treat the image and manifests as the repeatable application definition, not the running filesystem as a data store.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Two common web layouts
| Layout | How requests flow | Strengths | Trade-offs |
|---|---|---|---|
| PHP-Apache image | HTTP client → Apache with an embedded or attached PHP handler | One web container and a simple Service; convenient for small applications | Less separation between static serving and PHP process management; scaling and tuning are coupled |
| NGINX plus PHP-FPM | HTTP client → NGINX → FastCGI → PHP-FPM | Clear separation, familiar PHP-FPM tuning, efficient static-file serving | Requires a shared-code design and correct FastCGI parameters |
| NGINX sidecar with PHP-FPM | Two containers in one Pod; NGINX reaches PHP-FPM through localhost | Containers scale together and can share an image volume or emptyDir |
Static and dynamic capacity cannot scale independently; both containers must be released together |
| Separate NGINX and PHP Deployments | NGINX Service → PHP-FPM Service over cluster DNS | Independent scaling and resource isolation | Both tiers need the same application files, normally through identical images or deliberate shared storage |
For a first deployment, a single PHP-Apache container is the shortest path. Choose PHP-FPM with NGINX when you need conventional FastCGI behavior, independent resource tuning, or a separate static web tier. Do not split the tiers without deciding how each one receives the same release files.
Prerequisites and release decisions
- A Kubernetes cluster and a
kubectlcontext pointing at the intended namespace. - A container registry reachable by every cluster node. Use a versioned, tested image tag rather than relying on
latest. - The PHP version, extensions, and Composer lock file required by the application.
- A health endpoint that can answer without performing an expensive report, migration, or external operation.
- A database and cache plan, including credentials, migrations, backups, and network policy decisions.
- A DNS name and TLS plan if the application will be public.
Choose the namespace before applying manifests. The examples below use php-demo; replace it consistently rather than mixing namespaces between resources.
Free tools Windows power users keep installed
One-click scans. No signup required.
Build and publish an immutable PHP image
The image should install the runtime and dependencies during the build, then start only the process appropriate for that container. A multi-stage build keeps Composer tooling out of the production layer. The exact extensions depend on the framework and database driver, so treat the example as a starting point rather than a universal list.
Example PHP-FPM Dockerfile
FROM composer:2 AS vendor
WORKDIR /app
COPY composer.json composer.lock ./
RUN composer install --no-dev --prefer-dist --no-interaction --no-progress --optimize-autoloader
FROM php:8.3-fpm-alpine
WORKDIR /var/www/html
RUN docker-php-ext-install pdo pdo_mysql opcache
COPY --from=vendor /app/vendor ./vendor
COPY . .
RUN mkdir -p storage bootstrap/cache
&& chown -R www-data:www-data storage bootstrap/cache
USER www-data
EXPOSE 9000
CMD ["php-fpm", "-F"]Pin a minor version and rebuild when security updates are available. Keep the Composer lock file in the build context so the image contains the exact dependency graph that was tested. If the application needs image processing, PostgreSQL, LDAP, or another extension, install and verify it in the image rather than adding packages interactively to a running Pod.
Build, tag, and push
docker build -t registry.example/php-demo:2026-10-15-1 .
docker push registry.example/php-demo:2026-10-15-1The registry hostname and tag above are examples. The cluster must be able to pull the image, either anonymously or with an image-pull Secret. Deploy a unique tag for each tested release so a rollback points to a known image.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Image and filesystem rules
- Do not put database passwords or API tokens in the image or Dockerfile layers.
- Do not depend on a writable application directory surviving a Pod replacement.
- Write logs to standard output and standard error so the container runtime and cluster logging system can collect them.
- Send user uploads to durable object storage or a PersistentVolume with a backup policy; do not rely on a container writable layer.
- Run as a non-root user when the image and web server configuration permit it.
Store ordinary settings and credentials correctly
Kubernetes defines a ConfigMap as an API object for non-confidential key-value data. Use it for an application mode, cache hostname, feature flag, or public base URL. A Secret is an object containing confidential data such as a password, token, or key. Secrets still require access controls and encryption-at-rest practices; base64 encoding in a manifest is not encryption.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →ConfigMap and Secret manifests
apiVersion: v1
kind: ConfigMap
metadata:
name: php-demo-config
namespace: php-demo
data:
APP_ENV: production
CACHE_HOST: redis.php-demo.svc.cluster.local
LOG_CHANNEL: stderr
---
apiVersion: v1
kind: Secret
metadata:
name: php-demo-secrets
namespace: php-demo
type: Opaque
stringData:
DB_PASSWORD: replace-with-a-secret-value
APP_KEY: replace-with-a-random-keystringData lets Kubernetes accept plain text in the submitted manifest and encode it for storage. Keep this file out of an ordinary source repository, or generate the Secret through your secret-management system. You can expose values as environment variables or mount them as files, depending on what the PHP framework expects.
Environment variables versus mounted files
| Method | Use it when | Important behavior |
|---|---|---|
| Environment variables | The framework reads process environment at startup | Simple and common; changing the referenced ConfigMap or Secret does not automatically restart the process |
| Mounted files | The application or an agent reads a configuration file | Kubernetes can update projected files, but the application must reread them; never assume every framework does so |
| Command arguments | A binary explicitly requires flags | Arguments can be visible in process inspection; avoid putting sensitive values there |
When configuration changes, restart the Deployment deliberately or use a rollout mechanism that changes the Pod template. Never commit a real password merely because a Secret manifest is base64 encoded.
Deploy PHP-FPM with a Kubernetes Deployment
The Deployment below injects configuration, sets resource boundaries, and defines HTTP probes against a health endpoint. A PHP-FPM process does not answer HTTP itself, so the probe assumes the image also provides an HTTP-capable sidecar or that you will change the probe to a TCP check. If NGINX is a separate container, put the HTTP probe on the NGINX container and use a suitable PHP-FPM readiness check.
apiVersion: apps/v1
kind: Deployment
metadata:
name: php-demo
namespace: php-demo
labels:
app: php-demo
spec:
replicas: 2
selector:
matchLabels:
app: php-demo
template:
metadata:
labels:
app: php-demo
spec:
containers:
- name: php-fpm
image: registry.example/php-demo:2026-10-15-1
imagePullPolicy: IfNotPresent
ports:
- name: fpm
containerPort: 9000
envFrom:
- configMapRef:
name: php-demo-config
- secretRef:
name: php-demo-secrets
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
readinessProbe:
tcpSocket:
port: fpm
initialDelaySeconds: 5
periodSeconds: 10
livenessProbe:
tcpSocket:
port: fpm
initialDelaySeconds: 20
periodSeconds: 20
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
capabilities:
drop: ["ALL"]Change the resource values after observing real workload behavior; they are starting points, not a benchmark. A TCP probe only proves that PHP-FPM accepts connections. An application-level HTTP health check is more useful when an HTTP container is present, but it should not make the database or every external dependency mandatory for readiness unless that is the behavior you want during an outage.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Give the Pods a stable Service
A Service selector must exactly match the labels on the Pod template. For a separate NGINX or another in-cluster caller, a ClusterIP Service is normally sufficient.
apiVersion: v1
kind: Service
metadata:
name: php-fpm
namespace: php-demo
spec:
type: ClusterIP
selector:
app: php-demo
ports:
- name: fastcgi
port: 9000
targetPort: fpmOther Pods can resolve this endpoint as php-fpm.php-demo.svc.cluster.local, or simply php-fpm from the same namespace. If NGINX is a sidecar in the same Pod, it can connect to 127.0.0.1:9000 and does not need this Service for the local hop.
Expose HTTP traffic
ClusterIP for an internal application
Use only the ClusterIP Service when another internal gateway, job, or platform component is responsible for public traffic. This minimizes the PHP application’s exposure and keeps TLS termination in one place.
LoadBalancer for a direct cloud endpoint
Change the web Service, not the PHP-FPM Service, to type: LoadBalancer when your cluster integration provisions an external load balancer. The exact address, health-check behavior, and billing depend on the cloud provider. A LoadBalancer Service is useful for a straightforward endpoint but does not replace host/path routing or certificate management.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsIngress for host, path, and TLS routing
An Ingress resource requires an installed Ingress controller. The Kubernetes object describes rules; the controller implements them. Use an Ingress when you need a hostname, multiple applications behind one entry point, HTTP-to-HTTPS policy, or controller-managed certificates.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Route directly from ingress-nginx to PHP-FPM with FastCGI
Ingress-NGINX can send requests directly to a FastCGI Service, but this is not the same as proxying HTTP to NGINX. PHP is not HTML: a FastCGI server such as PHP-FPM processes an index.php script and returns the response. The controller therefore needs FastCGI-specific annotations and parameters, and the script path must match the files inside the PHP image.
FastCGI parameter ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
name: php-fastcgi-params
namespace: php-demo
data:
SCRIPT_FILENAME: /var/www/html$fastcgi_script_name
DOCUMENT_ROOT: /var/www/html
SCRIPT_NAME: $fastcgi_script_name
QUERY_STRING: $query_string
REQUEST_METHOD: $request_method
CONTENT_TYPE: $content_type
CONTENT_LENGTH: $content_length
REQUEST_URI: $request_uri
DOCUMENT_URI: $document_uri
SERVER_PROTOCOL: $server_protocol
REQUEST_SCHEME: $scheme
HTTPS: $https if_not_empty
GATEWAY_INTERFACE: CGI/1.1
REMOTE_ADDR: $remote_addr
REMOTE_PORT: $remote_port
SERVER_ADDR: $server_addr
SERVER_PORT: $server_port
SERVER_NAME: $server_nameCreate this ConfigMap before the Ingress and verify that the controller version supports the parameter reference you use. The filename is the most common failure point: it must point to the application path in the PHP-FPM container, not to a path that exists only in an NGINX container.
FastCGI Ingress manifest
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: php-demo
namespace: php-demo
annotations:
nginx.ingress.kubernetes.io/backend-protocol: 'FCGI'
nginx.ingress.kubernetes.io/fastcgi-index: 'index.php'
nginx.ingress.kubernetes.io/fastcgi-params-configmap: 'php-demo/php-fastcgi-params'
spec:
ingressClassName: nginx
rules:
- host: php.example.test
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: php-fpm
port:
name: fastcgiThe critical annotation is nginx.ingress.kubernetes.io/backend-protocol: 'FCGI'. The fastcgi-index value selects index.php when a directory-like request arrives, while the parameter ConfigMap supplies variables expected by the FastCGI configuration. If your controller's documentation uses a different annotation syntax or parameter format, follow that installed version rather than copying an incompatible example.
Alternative: put NGINX in front of PHP-FPM
Many teams find a conventional NGINX container easier to reason about than direct FastCGI handling in the ingress controller. In that design, the Ingress speaks HTTP to an NGINX Service. NGINX serves the same release files and uses either 127.0.0.1:9000 for a sidecar or php-fpm.php-demo.svc.cluster.local:9000 for a separate Deployment. This keeps controller annotations focused on HTTP and leaves PHP routing in an ordinary, testable NGINX configuration.
Keep databases, Redis, and uploads separate
A PHP Deployment is normally stateless. Connect it to a database or Redis through a Service, and choose whether those systems are managed outside the cluster or operated as stateful workloads inside it.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Dependency | Managed service | In-cluster stateful workload |
|---|---|---|
| Database | Provider handles much of the patching, replication, backups, and failover; you still configure access and verify recovery | You control versions and topology, but must operate storage, backups, upgrades, failover, and capacity |
| Redis | Useful when cache availability and maintenance should be delegated | Acceptable for an intentionally disposable cache; durable sessions require persistence and a recovery plan |
| User uploads | Object storage avoids tying files to a Pod or node | A PersistentVolume can work, but requires access-mode, backup, and restore decisions |
Kubernetes' PHP Guestbook example demonstrates a PHP front end using Redis as a separate component. The same separation applies to production applications: a web rollout should not silently recreate a database, and a database restart should not require rebuilding the PHP image.
Database migrations
Run migrations as a controlled release step or a one-off Kubernetes Job, not blindly in every replica's startup command. Concurrent startup migrations can race, hold locks, or make a rollback unsafe. Verify that the new schema is compatible with both the old and new application versions during a rolling update.
Apply and verify the rollout
- Create the namespace:
kubectl create namespace php-demo. - Apply the ConfigMap and Secret through your approved secret workflow:
kubectl apply -f config.yaml -f secret.yaml. - Apply the Deployment and Service:
kubectl apply -f deployment.yaml -f service.yaml. - Watch the rollout:
kubectl rollout status deployment/php-demo -n php-demo. - Inspect Pods and recent events:
kubectl get pods -n php-demoandkubectl get events -n php-demo --sort-by=.lastTimestamp. - Confirm the Service has endpoints:
kubectl get endpointslice -n php-demo -l kubernetes.io/service-name=php-fpm. - Read application output:
kubectl logs deployment/php-demo -n php-demo. - Test the FastCGI port from a temporary diagnostic Pod if needed:
kubectl run netcheck -n php-demo --rm -it --image=busybox:1.36 --restart=Never -- sh, then use a network check from inside that shell. - Apply the FastCGI ConfigMap and Ingress, then inspect controller events and the assigned address:
kubectl describe ingress php-demo -n php-demoandkubectl get ingress php-demo -n php-demo. - Request the health endpoint through the configured hostname and verify the TLS certificate, application response, logs, and database connectivity.
A green Deployment rollout proves that Pods became ready according to their probes; it does not prove that DNS, TLS, application routing, migrations, or every dependency is correct. Test the path a real user takes.
Scale and update safely
Replica count and capacity
Set at least two replicas when the application and dependency design support it. A second replica improves availability during a node or Pod failure, but it does not make a single database highly available. Resource requests influence scheduling; limits constrain consumption. Measure CPU, memory, request latency, PHP-FPM worker saturation, and database connection use before choosing final values.
kubectl scale deployment/php-demo --replicas=3 -n php-demoHorizontal Pod Autoscaling can adjust replicas from observed resource or custom metrics, but it cannot fix an undersized database, a lock-heavy session store, or a single-threaded bottleneck. Set an appropriate PodDisruptionBudget and spread replicas across failure domains when your cluster supports those policies.
Rolling releases and rollback
Change the image tag in the Deployment, apply the manifest, and monitor the rollout. Kubernetes replaces Pods according to the Deployment strategy while keeping the selector stable.
Recommended Free Tools
kubectl set image deployment/php-demo php-fpm=registry.example/php-demo:2026-10-15-2 -n php-demo
kubectl rollout status deployment/php-demo -n php-demo
kubectl rollout history deployment/php-demo -n php-demoIf the new version fails its probes or serves errors, stop further promotion and inspect logs and events. Roll back to the previous revision only after checking schema compatibility and dependency changes:
kubectl rollout undo deployment/php-demo -n php-demo
kubectl rollout status deployment/php-demo -n php-demoTroubleshoot the failures that matter most
| Symptom | Likely cause | What to check or change |
|---|---|---|
ImagePullBackOff |
Wrong tag, registry access, or missing pull credentials | Inspect Pod events, verify the exact image name, and configure an image-pull Secret if the registry is private. |
| Pods run but Service has no endpoints | Selector and Pod labels do not match, or readiness is failing | Compare kubectl get pods --show-labels with the Service selector and inspect readiness-probe failures. |
| 502 or 504 from ingress-nginx | Wrong Service port, unreachable PHP-FPM, or malformed FastCGI parameters | Confirm the Service target port, EndpointSlices, controller events, and the FastCGI backend-protocol annotation. |
| File-not-found FastCGI errors | SCRIPT_FILENAME points to a path absent from the PHP container |
Match the parameter ConfigMap to the image's WORKDIR and copied application path. |
| Static files return 404 | Only PHP-FPM is exposed and no HTTP container serves assets | Add NGINX or Apache, or configure the web tier to serve the same release files. |
| Environment changes have no effect | Existing processes retain their startup environment | Update the Pod template or restart the Deployment after changing the ConfigMap or Secret. |
| Uploads disappear after a rollout | Files were written to a container layer or ephemeral volume | Move uploads to object storage or a deliberately managed PersistentVolume and test restore. |
| Repeated restarts despite healthy PHP | Probe checks the wrong port or demands a dependency that is temporarily unavailable | Use a probe that represents process health, and keep readiness criteria distinct from liveness criteria. |
| Ingress hostname works intermittently | DNS, external load balancer, TLS secret, or multiple controller classes are misconfigured | Check Ingress status, controller logs, DNS records, certificate Secret, and ingressClassName. |
Production checklist
- Pin a tested PHP base image and application image tag.
- Scan the image and Composer dependencies, and rebuild for security updates.
- Use a non-root runtime and drop unnecessary Linux capabilities.
- Define resource requests and limits from observed usage.
- Use readiness and liveness probes that reflect the actual container architecture.
- Keep non-confidential settings in ConfigMaps and credentials in Secrets or an external secret manager.
- Restrict who can read Secrets with Kubernetes RBAC and protect the cluster's control plane and storage.
- Terminate TLS at a controlled gateway or Ingress and redirect HTTP if that matches your security policy.
- Separate database and cache lifecycle from web-Pod lifecycle.
- Document migrations, backups, restore tests, and rollback compatibility.
- Send logs and metrics to your operational systems; alert on failed rollouts, unavailable endpoints, latency, and dependency errors.
- Test a complete deployment in a non-production namespace before changing the production image.
Choose the simplest architecture that meets the requirement
Use PHP-Apache when a single container and straightforward HTTP exposure are enough. Use NGINX with PHP-FPM when static-file handling, FastCGI tuning, or independent web/runtime responsibilities matter. Keep NGINX and PHP-FPM in one Pod when they must scale together and can share release files cleanly; use separate Deployments when independent scaling and isolation outweigh the added file-distribution work. Start with a ClusterIP Service for internal traffic, add a LoadBalancer for a simple external endpoint, and choose an Ingress for host/path routing and TLS. In every case, make the image immutable, make configuration explicit, and keep durable state outside replaceable web Pods.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
