https://github.com/andreacv98/k8s-automation-setup
https://github.com/andreacv98/k8s-automation-setup
Last synced: 5 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/andreacv98/k8s-automation-setup
- Owner: andreacv98
- Created: 2024-08-09T17:53:24.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2024-08-18T16:58:19.000Z (almost 2 years ago)
- Last Synced: 2025-10-26T04:02:47.902Z (8 months ago)
- Language: HCL
- Size: 43 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Kubernetes Cluster Deployment
## Objective
Provision a Kubernetes cluster consisting of a manager and
two workers and deploy an application consisting of at least three services and
presenting a graphical user interface accessible via a browser.
## Virtual Machines Setup
The Kubernetes cluster is deployed on three virtual machines, one manager and two workers. The virtual machines are provisioned using Vagrant and VirtualBox.
The choice of Vagrant is motivated by the fact that it is a tool that allows the creation and configuration of lightweight, reproducible, and portable development environments. It is also a tool that is easy to use and that allows the automation of the creation of virtual machines.
## Ansible Playbooks
Along with the Vagrantfile, there are Ansible playbooks that are used to provision the virtual machines. The playbooks are used to install the necessary software packages and to configure the virtual machines.
The specific tasks have been defined following the best practices for the deployment of Kubernetes clusters, in particular the requirements for a RKE cluster. More information can be found [here](https://rke.docs.rancher.com/os#general-linux-requirements)
## Terraform
The Terraform script is used to provide the Kubernetes RKE cluster upon the virtual machines. The script is used to create the cluster and to deploy the required namespaces and benchmarks.
### Rancher Kubernetes Engine (RKE)
The choice of RKE is motivated by the fact that it is a Kubernetes distribution that is easy to use and that provides a good balance between simplicity and flexibility. Moreover the usage upon the virtual machines is straightforward and well-documented for the integration in the Terraform script.
### RKE Provider
The RKE provider is used to create an Rancher Kubernetes Engine (RKE) cluster. The provider allows the creation of a Kubernetes cluster using a YAML configuration file, that can be found in the `cluster.yml` file [here](./terraform/cluster.yaml).
### Security Benchmark
The Terraform script provides the deployment of the `kube-bench` security benchmark. The benchmark is a Go application that checks whether Kubernetes is deployed according to security best practices. The benchmark is deployed in the `default` namespace.
The choice of the `kube-bench` benchmark is motivated by the fact that it is a tool that is easy to use and that provides a good overview of the security of the Kubernetes cluster. It is widely used in the Kubernetes community and is a good starting point for the security of a Kubernetes cluster.
#### Rancher CIS Benchmark
The Terraform script provides the deployment of the `rancher-cis-benchmark` security benchmark.
This benchmark has been chosen since it leverages the `kube-bench` security benchmark, but it focus on checks suitable for Rancher Kubernetes Engine (RKE) clusters. Therefore, this benchmark is more suitable for the Kubernetes cluster that is being deployed.
## Helm Application
### Application Deployment
The application designated for deployment is the Google Online Boutique. The application is a cloud-native microservices demo application that is used to demonstrate the use of Kubernetes. The application is composed of several services, including a frontend service that presents a graphical user interface accessible via a browser.
The application can be deployed through an Helm chart in the local repository. The Helm chart is used to deploy the application in the `default` namespace.
You can deploy the application by running the following command:
```bash
helm install online-boutique ./helm/online-boutique
```
### Application update
The application can be updated by running the following command:
```bash
helm upgrade online-boutique ./helm/online-boutique
```
#### Downtime considerations
All the deployment templates implements the default rolling update strategy of Kubernetes (details [here](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)). This means that the application will be updated without downtime.
Moreover thanks to a combination of readiness and liveness probes, Kubernetes when triggered of an update by Helm, will wait for the new pods to be ready before terminating the old ones. This ensures that the application is always available during the update process.
### Application access
The application can be accessed via a browser, but it first needs to be exposed to the outside world. This can be done by running a kubectl port-forward command:
```bash
kubectl port-forward service/frontend 8084:80
```
The application can then be accessed by opening a browser and navigating to http://localhost:8084.