🚀 Kubernetes Cluster Setup Guide

1Cluster Creation

The first step was creating a Kubernetes cluster. This cluster serves as the foundation for all subsequent deployments.

2Metrics Server Deployment

The Kubernetes Metrics Server was deployed to collect resource metrics from kubelets and expose them via the Kubernetes API.

Installation Command:

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

Why Metrics Server?

• Enables kubectl top commands to monitor CPU and memory usage
• Required for Horizontal Pod Autoscaling (HPA)
• Provides real-time resource metrics

Verification Commands:

# Check metrics server deployment
kubectl get deployment metrics-server -n kube-system

# View node resource usage
kubectl top nodes

# View pod resource usage across all namespaces
kubectl top pods -A

# View pod resource usage in dev namespace
kubectl top pods -n dev

# View container-level metrics in dev namespace
kubectl top pods -n dev --containers

3ArgoCD Installation & Configuration

ArgoCD is a declarative, GitOps continuous delivery tool for Kubernetes. It automates the deployment of applications by syncing them with Git repositories.

3.1 Installation

helm upgrade --install argocd ./argocd -n argocd --create-namespace

3.2 ArgoCD Components Deployed:

3.3 Access ArgoCD UI

# Port forward to access ArgoCD UI locally
kubectl port-forward svc/argocd-server -n argocd 8081:80

3.4 Retrieve Admin Password

# Get the initial admin password
kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath="{.data.password}" | base64 -d && echo

3.5 ArgoCD CLI Login

# Login to ArgoCD via CLI
argocd login localhost:8081 --insecure --username admin --password $(kubectl get secret \
argocd-initial-admin-secret -n argocd -o jsonpath="{.data.password}" | base64 -d)

3.6 Create ArgoCD Project

A project provides logical grouping of applications with access controls.

# Create a project named 'learning-hub'
argocd proj create learning-hub \
    --dest https://kubernetes.default.svc,dev \
    --dest https://kubernetes.default.svc,prod \
    --src '*'

4Traefik Ingress Controller

Traefik is a modern HTTP reverse proxy and load balancer. It automatically discovers services and routes traffic to them.

Check Traefik Service

kubectl get svc -n kube-system | grep traefik

Next Steps for Traefik:

1. Add Traefik IngressRoute configuration to Helm deployment
2. Configure DNS to point to the AWS Load Balancer
3. Apply HTTPS redirect middleware

HTTPS Redirect Middleware

kubectl apply -f traefik/https-redirect-middleware.yaml

This middleware automatically redirects HTTP traffic to HTTPS.

5Cert-Manager Setup

Cert-Manager automates the management and issuance of TLS certificates from Let's Encrypt and other certificate authorities.

5.1 Install Cert-Manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.2/cert-manager.yaml

5.2 Wait for Cert-Manager to be Ready

kubectl wait --for=condition=ready pod -l app.kubernetes.io/instance=cert-manager -n cert-manager --timeout=300s

5.3 Cert-Manager Components:

5.4 Configure Let's Encrypt Issuers

kubectl apply -f cert-manager/letsencrypt-issuer.yaml

5.5 Current Certificates:

6ECR Access Configuration

Amazon Elastic Container Registry (ECR) access was configured to allow pulling private Docker images.

Create Docker Registry Secret

kubectl create secret docker-registry ecr-secret \
    --docker-server=541770108352.dkr.ecr.us-east-1.amazonaws.com \
    --docker-username=AWS \
    --docker-password=$(aws ecr get-login-password --region us-east-1) \
    -n dev

7Learning Hub Application Deployment

The Learning Hub application is deployed to both dev and prod environments using ArgoCD with GitOps workflow.

7.1 Create Dev Application

argocd app create learning-hub-dev \
    --repo https://github.com/hanov/helm.git \
    --path learning-hub \
    --dest-server https://kubernetes.default.svc \
    --dest-namespace dev \
    --values values-dev.yaml \
    --project learning-hub \
    --sync-policy automated \
    --auto-prune \
    --self-heal

7.2 Create Prod Application

argocd app create learning-hub-prod \
    --repo https://github.com/hanov/helm.git \
    --path learning-hub \
    --dest-server https://kubernetes.default.svc \
    --dest-namespace prod \
    --values values-prod.yaml \
    --project learning-hub \
    --sync-policy automated \
    --auto-prune \
    --self-heal

ArgoCD Configuration Explained:

Application Management Commands:

# Delete applications (if needed)
argocd app delete learning-hub-dev
argocd app delete learning-hub-prod

# List all ArgoCD applications
argocd app list

# View application details
argocd app get learning-hub-dev
argocd app get learning-hub-prod

# Sync application manually
argocd app sync learning-hub-dev

8Current Cluster State Overview

Namespaces (8 total):

• default - Age: ~4 hours
• kube-system - System components (Traefik, Metrics Server)
• argocd - ArgoCD installation (Age: ~2.5 hours)
• cert-manager - Certificate management (Age: ~40 minutes)
• dev - Development environment (Age: ~2 hours)
• prod - Production environment (Age: ~1 hour)
• kube-public - Public resources
• kube-node-lease - Node heartbeats

Key Services:

Application Deployments:

TLS Certificates:

• Dev: learning-hub-tls (Ready)
• Prod: learning-hub-tls (Ready)
• Issuers: letsencrypt-staging, letsencrypt-prod (Both Ready)

External Access:

📊 Architecture Overview

┌─────────────────────────────────────────────────────────────┐
│                         Internet                             │
└────────────────────────┬────────────────────────────────────┘
                         │
                         ▼
              ┌──────────────────────┐
              │   AWS Load Balancer   │
              │  (Traefik External)   │
              └──────────┬───────────┘
                         │
          ┌──────────────┴──────────────┐
          │                             │
          ▼                             ▼
    ┌─────────┐                   ┌─────────┐
    │  HTTP   │──[redirect]──────▶│  HTTPS  │
    │  :80    │                   │  :443   │
    └─────────┘                   └────┬────┘
                                       │
                            ┌──────────┴──────────┐
                            │   Traefik Ingress   │
                            │   (kube-system)     │
                            └──────────┬──────────┘
                                       │
                 ┌─────────────────────┼─────────────────────┐
                 │                     │                     │
                 ▼                     ▼                     ▼
          ┌─────────────┐      ┌─────────────┐      ┌─────────────┐
          │   Dev Env   │      │  Prod Env   │      │   ArgoCD    │
          │             │      │             │      │     UI      │
          │ learning-hub│      │ learning-hub│      │             │
          │   (1 pod)   │      │   (3 pods)  │      │ :8081 (fwd) │
          └─────────────┘      └─────────────┘      └─────────────┘
                 │                     │
                 └──────────┬──────────┘
                            │
                 ┌──────────┴──────────┐
                 │   Cert-Manager      │
                 │  (TLS Certificates) │
                 │                     │
                 │ • letsencrypt-prod  │
                 │ • letsencrypt-stage │
                 └─────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│                    Support Services                          │
├─────────────────────────────────────────────────────────────┤
│  • Metrics Server (resource monitoring)                     │
│  • ArgoCD (GitOps CD)                                       │
│  • ECR Secret (container registry access)                  │
└─────────────────────────────────────────────────────────────┘
    

🛠️ Useful Commands Reference

Cluster Monitoring:

# View all namespaces
kubectl get namespaces

# View all pods across namespaces
kubectl get pods -A

# Check resource usage
kubectl top nodes
kubectl top pods -A

ArgoCD Management:

# Port forward to access UI
kubectl port-forward svc/argocd-server -n argocd 8081:80

# Get admin password
kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath="{.data.password}" | base64 -d && echo

# List applications
argocd app list

# Sync application
argocd app sync learning-hub-dev

Certificate Management:

# Check certificates
kubectl get certificate -A

# Check certificate issuers
kubectl get clusterissuer

# Describe certificate (for troubleshooting)
kubectl describe certificate learning-hub-tls -n dev

Deployment Monitoring:

# Watch deployments in dev
kubectl get deployments -n dev -w

# View deployment details
kubectl describe deployment learning-hub -n dev

# Check pod logs
kubectl logs -n dev -l app=learning-hub

# Get pod details
kubectl get pods -n dev -o wide

Traefik:

# Check Traefik service
kubectl get svc traefik -n kube-system

# View Traefik logs
kubectl logs -n kube-system -l app.kubernetes.io/name=traefik

# Check IngressRoutes
kubectl get ingressroute -A

✅ Summary

The Kubernetes cluster is fully operational with the following capabilities:

• GitOps CD: ArgoCD managing application deployments from Git
• Ingress: Traefik routing external traffic with AWS Load Balancer
• SSL/TLS: Cert-Manager with Let's Encrypt for automatic certificate management
• Monitoring: Metrics Server for resource tracking
• Multi-Environment: Separate dev and prod namespaces
• Container Registry: ECR integration for private images
• Auto-Sync: Applications automatically update on Git changes
• Self-Healing: ArgoCD reverts unauthorized cluster changes