setup - Production Cluster Setup
Provides step-by-step commands for setting up production Kubernetes clusters on managed services or self-hosted
/plugin marketplace add pluginagentmarketplace/custom-plugin-kubernetes/plugin install kubernetes-assistant@pluginagentmarketplace-kubernetesComplete guide to setting up production-grade Kubernetes clusters.
# Create cluster using eksctl
eksctl create cluster --name production --region us-east-1 --nodes=3
# Add worker nodes
eksctl create nodegroup --cluster production --name workers
# Get kubeconfig
aws eks update-kubeconfig --region us-east-1 --name production
# Create cluster
gcloud container clusters create production \
--zone us-central1-a \
--num-nodes 3 \
--machine-type n1-standard-2
# Get credentials
gcloud container clusters get-credentials production --zone us-central1-a
# Create resource group
az group create --name myResourceGroup --location eastus
# Create cluster
az aks create --resource-group myResourceGroup \
--name production \
--node-count 3 \
--vm-set-type VirtualMachineScaleSets
# Get credentials
az aks get-credentials --resource-group myResourceGroup --name production
# Prerequisites: 3+ nodes with Ubuntu/CentOS
# On all nodes:
sudo apt-get install -y apt-transport-https ca-certificates curl
sudo curl -fsSLo /usr/share/keyrings/kubernetes-archive-keyring.gpg https://packages.cloud.google.com/apt/doc/apt-key.gpg
echo "deb [signed-by=/usr/share/keyrings/kubernetes-archive-keyring.gpg] https://apt.kubernetes.io/ kubernetes-xenial main" | sudo tee /etc/apt/sources.list.d/kubernetes.list
sudo apt-get update
sudo apt-get install -y kubelet kubeadm kubectl
# On master node:
sudo kubeadm init --pod-network-cidr=10.244.0.0/16
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
# Install networking (Flannel):
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
# On worker nodes:
kubeadm join <master-ip>:6443 --token <token> --discovery-token-ca-cert-hash sha256:<hash>
# Install containerd (recommended)
wget https://github.com/containerd/containerd/releases/download/v1.6.0/containerd-1.6.0-linux-amd64.tar.gz
sudo tar Czxvf containerd-1.6.0-linux-amd64.tar.gz -C /
# Install local storage provisioner
helm install local-path local-path-provisioner/local-path-provisioner \
--namespace local-path-storage --create-namespace
# Install Prometheus stack
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm install prometheus prometheus-community/kube-prometheus-stack \
-n monitoring --create-namespace
# Apply default deny policy
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
EOF
# Create admin user
kubectl create serviceaccount admin-user -n kubernetes-dashboard
kubectl create clusterrolebinding admin-user \
--clusterrole=cluster-admin \
--serviceaccount=kubernetes-dashboard:admin-user
# Enable Pod Security Standards
kubectl label namespace default \
pod-security.kubernetes.io/enforce=restricted
kubectl get nodes
kubectl get pods --all-namespaces
kubectl get svc --all-namespaces
# Multiple clusters
kubectl config set-context prod --cluster=production --user=admin
kubectl config use-context prod
/best-practices - Production best practices/troubleshoot - Troubleshooting guide/quickstart - Quick referenceVerify your cluster setup with: kubectl cluster-info