Week 12 - Kubernetes¶

Complete

1. Create both pre-configuration files (contents in the SOP reference below), then install K3s:

   curl -sfL https://get.k3s.io | sh -
   

2. Verify the k3s service is running and the node is ready:

   systemctl status k3s
   kubectl get nodes
   

3. Open port 6443/tcp in both firewalld and your cloud security group — this is the only new port that needs external access. All application traffic still flows through Apache on port 80.
4. Add K3s's internal networks to the trusted firewall zone so Traefik can reach application pods:

   firewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16
   firewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16
   firewall-cmd --reload
   

Complete

1. Create the storage directory on the NFS share:

   mkdir -p /data/nfs/inventory
   

2. Save the following to inventory-api.yaml and fill in every _____:

   ---
   apiVersion: v1
   kind: Namespace # (1)!
   metadata:
     name: _____
   ---
   apiVersion: v1
   kind: PersistentVolume # (2)!
   metadata:
     name: inventory-api-pv
   spec:
     capacity:
       storage: 100Mi
     accessModes:
       - ReadWriteMany # (3)!
     persistentVolumeReclaimPolicy: Retain
     storageClassName: "" # (4)!
     nfs:
       path: /data/nfs/inventory
       server: localhost # (5)!
       readOnly: false
   ---
   apiVersion: v1
   kind: PersistentVolumeClaim # (6)!
   metadata:
     name: inventory-api-pvc
     namespace: _____
   spec:
     accessModes:
       - ReadWriteMany
     storageClassName: ""
     volumeName: inventory-api-pv
     resources:
       requests:
         storage: 100Mi
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: inventory-api
     namespace: _____
   spec:
     replicas: _____ # (7)!
     selector:
       matchLabels:
         app: inventory-api
     template:
       metadata:
         labels:
           app: inventory-api
       spec:
         containers:
         - name: inventory-api
           image: registry.hpc.ut.ee/public/sysadm-inventory-api:latest
           imagePullPolicy: Always
           command: ["python", "app.py", "--storage", "/data/inventory/storage.db"] # (8)!
           ports:
           - containerPort: 5000
           volumeMounts:
           - name: inventory-storage
             mountPath: /data/inventory # (9)!
         volumes:
         - name: inventory-storage
           persistentVolumeClaim:
             claimName: inventory-api-pvc
   ---
   apiVersion: v1
   kind: Service
   metadata:
     name: inventory-api
     namespace: _____
   spec:
     selector:
       app: inventory-api # (10)!
     ports:
     - port: 5000
       targetPort: 5000
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: inventory-api
     namespace: _____
   spec:
     ingressClassName: traefik # (11)!
     rules:
     - host: "_____" # (12)!
       http:
         paths:
         - path: /
           pathType: Prefix
           backend:
             service:
               name: inventory-api
               port:
                 number: 5000
   

   1. Isolates all lab12 resources into their own virtual cluster. Resources in different namespaces cannot accidentally interfere with each other.
   2. Represents the actual storage — an NFS directory on this VM. PersistentVolumes are cluster-scoped (no namespace) and provisioned by an administrator.
   3. Both replicas need to mount this volume simultaneously. ReadWriteMany permits concurrent mounts from multiple pods. ReadWriteOnce would only allow one pod at a time.
   4. An empty string disables dynamic provisioning and tells Kubernetes to use the statically created PV above. Without this, Kubernetes would try to provision storage automatically.
   5. The NFS server is on this same VM. K3s uses the internal cluster network to reach it.
   6. A user's claim on storage. The PVC binds to the PV above and gives the Deployment a stable reference to the storage regardless of what's underneath.
   7. Fill in 2. Kubernetes will always keep exactly this many pods running — if one crashes, a replacement starts automatically.
   8. Overrides the container image's default startup command to enable the persistent storage backend. Without this flag, inventory data would be in-memory and lost on restart.
   9. The path inside the container where the NFS volume appears. The application writes storage.db here.
   10. Kubernetes uses this label to find the pods this Service should route traffic to. It must match the labels in the Deployment template.
   11. Routes HTTP requests through K3s's built-in Traefik reverse proxy. The Traefik pod sees the request hostname and forwards it to this Service.
   12. Fill in inventory.<vm_name>.sysadm.ee. Traefik matches the incoming Host header against this value.

3. Apply the manifest and wait for both pods to reach Running:

   kubectl apply -f inventory-api.yaml
   kubectl get pods -n lab12 -w
   

4. Test at each level of the stack to confirm each layer works before the next:

   # Pod level — direct to a pod IP, no auth (bearer auth is Apache's job, not the pod's)
   kubectl get pods -n lab12 -l app=inventory-api -o wide
   curl http://<pod-ip>:5000/api/v1/inventory
   
   # Service level — via the ClusterIP
   kubectl get svc inventory-api -n lab12
   curl http://<cluster-ip>:5000/api/v1/inventory
   
   # Traefik Ingress level — via hostname routing on port 8080
   curl --resolve inventory.<vm_name>.sysadm.ee:8080:<vm_ip> \
     http://inventory.<vm_name>.sysadm.ee:8080/api/v1/inventory
   

5. Update the Apache VirtualHost for inventory.<vm_name>.sysadm.ee to proxy to port 8080 instead of 5000. You have configured reverse proxies before — update the ProxyPass and ProxyPassReverse lines accordingly, then reload Apache.

6. Verify the full chain. The response should include an X-Served-By header with the Kubernetes pod name:

   curl -sI \
     --resolve inventory.<vm_name>.sysadm.ee:80:<vm_ip> \
     -H "Authorization: Bearer 845e6732f32b81dd778972703474ccbb" \
     http://inventory.<vm_name>.sysadm.ee/api/v1/inventory \
     | grep -i x-served-by
   

Complete

1. Create website.yaml for the lab12 namespace containing:

   • A Deployment named website with replicas: 10, the image and env var shown above.
   • A Service named website exposing container port 80.
   • An Ingress routing <vm_name>.sysadm.ee to the Service on port 80.

2. Apply and verify all 10 pods reach Running:

   kubectl apply -f website.yaml
   kubectl get pods -n lab12 -w
   

3. Test at each level before going through Apache:

   # Pod level
   kubectl get pods -n lab12 -l app=website -o wide
   curl http://<pod-ip>:80/ | grep -E "Kubernetes deployment|Served by pod"
   
   # Service level
   kubectl get svc website -n lab12
   curl http://<cluster-ip>:80/ | grep -E "Kubernetes deployment|Served by pod"
   
   # Traefik Ingress — run 10 times to see different pod names each time
   for i in $(seq 1 10); do
     curl -s --resolve <vm_name>.sysadm.ee:8080:<vm_ip> \
       http://<vm_name>.sysadm.ee:8080/ | grep "Served by pod"
   done
   

4. Update the Apache VirtualHost for <vm_name>.sysadm.ee to proxy to Kubernetes instead of serving files directly. You have done this before — replace the DocumentRoot block with a reverse proxy to localhost:8080, then reload Apache.

5. Confirm port 80 now serves the Kubernetes-backed site:

   curl --resolve <vm_name>.sysadm.ee:80:<vm_ip> \
     http://<vm_name>.sysadm.ee/ | grep "Kubernetes deployment on"