Skip to main content

Chapter 12.1 - Production Deployment

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand production requirements
  • Implement high availability
  • Configure security in production
  • Manage resources efficiently
  • Set up monitoring and alerts
  • Apply best practices

Introduction​

Deploying to production requires rigorous preparation to ensure availability, security, and performance.

High Availability​

Multi-Node Clusters​

Recommendations:

  • Minimum 3 nodes for the Control Plane
  • Minimum 3 worker nodes
  • Distribution across multiple availability zones

Pod Disruption Budgets​

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: app-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: my-app

Result: Ensures that at least 2 Pods are available during updates.

Security​

RBAC Configuration​

# Limit permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]

Network Policies​

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Encrypted Secrets​

# Enable encryption at rest
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: <base64-encoded-secret>

Scanned Images​

Use image scanning tools (Trivy, Clair) before deployment.

Resource Management​

Requests and Limits​

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    spec:
      containers:
      - name: app
        image: my-app:1.0
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: 500m
            memory: 1Gi

Resource Quotas​

apiVersion: v1
kind: ResourceQuota
metadata:
  name: namespace-quota
  namespace: production
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    persistentvolumeclaims: "10"

Limit Ranges​

apiVersion: v1
kind: LimitRange
metadata:
  name: namespace-limits
  namespace: production
spec:
  limits:
  - default:
      cpu: "500m"
      memory: "1Gi"
    defaultRequest:
      cpu: "250m"
      memory: "512Mi"
    type: Container

Monitoring and Alerts​

Essential Metrics​

  • CPU/Memory usage
  • Request latency
  • Error rate
  • Service availability

Critical Alerts​

  • Pods in CrashLoop
  • CPU usage > 90%
  • Memory usage > 90%
  • Unavailable services

Backup and Disaster Recovery​

etcd Backup​

# Backup
ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/etcd/ca.crt \
  --cert=/etc/etcd/server.crt \
  --key=/etc/etcd/server.key

# Restore
ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-snapshot.db

Volume Backups​

Use volume snapshots (EBS, Azure Disk, etc.).

Best Practices​

1. Multi-Environments​

Separate dev, staging, production with namespaces or clusters.

2. Versioning​

Use specific image tags, not latest.

3. Health Checks​

Configure liveness, readiness, and startup probes.

4. Rolling Updates​

Use zero-downtime deployment strategies.

5. Documentation​

Document deployment and rollback procedures.

Summary​

In this chapter, you learned:

High availability: Multi-nodes, Pod Disruption Budgets
Security: RBAC, Network Policies, encrypted secrets, scanned images
Resources: Requests, limits, quotas, limit ranges
Monitoring: Essential metrics, critical alerts
Backup: etcd, volumes, disaster recovery
Best practices: Multi-environments, versioning, health checks

Next Steps​

Chapter 12.2: CI/CD
Chapter 12.3: Environments
Lab 12.1: Resource Management Configuration

Chapter created on: December 2024