Containerization

Kubernetes Production Deployment Guide

Master Kubernetes production deployment from cluster setup to advanced orchestration with multi-environment configurations, service mesh, monitoring, auto-scaling, and enterprise security on Ubuntu 24.04 LTS.

What you'll learn

Set up a production-grade Kubernetes cluster
Deploy applications with Deployments, Services, and Ingress
Configure horizontal pod auto-scaling
Implement network policies and RBAC
Monitor with Prometheus and Grafana
Manage packages with Helm charts
Configure persistent storage with StatefulSets

Cluster Setup

Bash

1# Install kubeadm, kubelet, kubectl
2sudo apt update && sudo apt install -y apt-transport-https ca-certificates curl
3curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.28/deb/Release.key | \
4  sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
5echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] \
6  https://pkgs.k8s.io/core:/stable:/v1.28/deb/ /' | \
7  sudo tee /etc/apt/sources.list.d/kubernetes.list
8sudo apt update
9sudo apt install -y kubelet kubeadm kubectl
10sudo apt-mark hold kubelet kubeadm kubectl
11
12# Initialize control plane
13sudo kubeadm init --pod-network-cidr=10.244.0.0/16
14
15# Configure kubectl
16mkdir -p $HOME/.kube
17sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config
18sudo chown $(id -u):$(id -g) $HOME/.kube/config
19
20# Install Flannel CNI
21kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

Deploying Workloads

YAML

1# deployment.yaml
2apiVersion: apps/v1
3kind: Deployment
4metadata:
5  name: api
6  namespace: production
7spec:
8  replicas: 3
9  selector:
10    matchLabels:
11      app: api
12  template:
13    metadata:
14      labels:
15        app: api
16    spec:
17      containers:
18        - name: api
19          image: ghcr.io/org/api:v1.0.0
20          ports:
21            - containerPort: 3000
22          resources:
23            requests:
24              cpu: "100m"
25              memory: "128Mi"
26            limits:
27              cpu: "500m"
28              memory: "512Mi"
29          readinessProbe:
30            httpGet:
31              path: /health
32              port: 3000
33            initialDelaySeconds: 10
34            periodSeconds: 5

Networking & Ingress

YAML

1# Install Ingress NGINX
2helm upgrade --install ingress-nginx ingress-nginx \
3  --repo https://kubernetes.github.io/ingress-nginx \
4  --namespace ingress-nginx --create-namespace
5
6# ingress.yaml
7apiVersion: networking.k8s.io/v1
8kind: Ingress
9metadata:
10  name: api-ingress
11  annotations:
12    nginx.ingress.kubernetes.io/ssl-redirect: "true"
13spec:
14  ingressClassName: nginx
15  tls:
16    - hosts: [api.example.com]
17      secretName: api-tls
18  rules:
19    - host: api.example.com
20      http:
21        paths:
22          - path: /
23            pathType: Prefix
24            backend:
25              service:
26                name: api
27                port:
28                  number: 3000

Auto-Scaling

YAML

1# Horizontal Pod Autoscaler
2kubectl autoscale deployment api \
3  --cpu-percent=70 --min=3 --max=20
4
5# Or as YAML
6apiVersion: autoscaling/v2
7kind: HorizontalPodAutoscaler
8metadata:
9  name: api-hpa
10spec:
11  scaleTargetRef:
12    apiVersion: apps/v1
13    kind: Deployment
14    name: api
15  minReplicas: 3
16  maxReplicas: 20
17  metrics:
18    - type: Resource
19      resource:
20        name: cpu
21        target:
22          type: Utilization
23          averageUtilization: 70

RBAC & Security

Apply least-privilege RBAC roles for every service account
Use NetworkPolicies to restrict pod-to-pod traffic
Enable PodSecurityAdmission with the restricted profile
Scan images in CI before pushing to the registry
Store secrets in Kubernetes Secrets (or use External Secrets Operator with a vault)

Monitoring

Bash

1# Install kube-prometheus-stack via Helm
2helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
3helm repo update
4helm install monitoring prometheus-community/kube-prometheus-stack \
5  --namespace monitoring --create-namespace \
6  --set grafana.adminPassword=securepassword

Helm Package Management

Bash

1# Create a Helm chart
2helm create my-app
3
4# Deploy with environment-specific values
5helm upgrade --install my-app ./my-app \
6  -f values.production.yaml \
7  --namespace production --create-namespace
8
9# List releases
10helm list -A
11
12# Rollback
13helm rollback my-app 1