Kubernetes setup for web application orchestration

Kubernetes Web Application Orchestration Setup

Kubernetes (k8s) is the standard for container orchestration. Automatically restarts failed pods, scales by load, manages configuration and secrets, implements rolling updates and rollbacks.

Minimal manifests set

# namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: myapp

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-web
  namespace: myapp
spec:
  replicas: 3
  selector:
    matchLabels: { app: myapp-web }
  template:
    metadata:
      labels: { app: myapp-web }
    spec:
      containers:
        - name: web
          image: registry.example.com/myapp:v1.0.0
          ports:
            - containerPort: 8080
          envFrom:
            - configMapRef: { name: myapp-config }
            - secretRef: { name: myapp-secrets }
          resources:
            requests:
              cpu: "100m"
              memory: "256Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          readinessProbe:
            httpGet: { path: /health/ready, port: 8080 }
            initialDelaySeconds: 10
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /health/live, port: 8080 }
            initialDelaySeconds: 30
            periodSeconds: 30
      terminationGracePeriodSeconds: 60

# service.yaml
apiVersion: v1
kind: Service
metadata:
  name: myapp-web
  namespace: myapp
spec:
  selector: { app: myapp-web }
  ports:
    - port: 80
      targetPort: 8080

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
  namespace: myapp
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/rate-limit: "100"
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
spec:
  ingressClassName: nginx
  tls:
    - hosts: [example.com]
      secretName: myapp-tls
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp-web
                port: { number: 80 }

ConfigMap and Secrets

# config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: myapp-config
  namespace: myapp
data:
  APP_ENV: production
  APP_URL: https://example.com
  REDIS_HOST: redis-master

---
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
  namespace: myapp
type: Opaque
data:
  # echo -n "value" | base64
  DB_PASSWORD: c2VjcmV0cGFzcw==
  APP_KEY: YmFzZTY0Oi4uLg==

Horizontal Pod Autoscaler

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp-hpa
  namespace: myapp
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp-web
  minReplicas: 2
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

Jobs and CronJobs

apiVersion: batch/v1
kind: CronJob
metadata:
  name: cleanup-old-files
  namespace: myapp
spec:
  schedule: "0 2 * * *"
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: cleanup
              image: registry.example.com/myapp:latest
              command: ["php", "artisan", "files:cleanup"]
              envFrom:
                - secretRef: { name: myapp-secrets }

Deploy via Kustomize

# kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: myapp
images:
  - name: registry.example.com/myapp
    newTag: v1.2.0

resources:
  - namespace.yaml
  - deployment.yaml
  - service.yaml
  - ingress.yaml
  - hpa.yaml

kubectl apply -k ./k8s/production/

# Update image
kustomize edit set image registry.example.com/myapp:v1.3.0
kubectl apply -k .

# Status
kubectl rollout status deployment/myapp-web -n myapp

# Rollback
kubectl rollout undo deployment/myapp-web -n myapp

GitHub Actions deploy

- name: Update k8s image
  run: |
    kubectl set image deployment/myapp-web \
      web=registry.example.com/myapp:${{ github.sha }} \
      -n myapp

    kubectl rollout status deployment/myapp-web -n myapp --timeout=5m

Timeline