A Tutorial on Quickly Deploying Kubernetes, Harbor, and a Web Service

This tutorial provides an in-depth quick-start guide to deploying a local Kubernetes cluster with Minikube, generating and managing private certificates with Ansible, deploying the Harbor container registry with Helm, and deploying a secure demo web service. It is aimed at engineers with a basic understanding of Kubernetes, Helm, and Ansible and shows how these tools work together to build a secure development environment.

Prerequisites

Before you begin, make sure your system meets the following requirements:

• Minikube: For running a local Kubernetes cluster (Minikube installation).
• Docker: For building and pushing container images (Docker installation).
• kubectl: The Kubernetes command-line tool (kubectl installation).
• Helm: For deploying Harbor (Helm installation).
• Ansible: For automating certificate management (Ansible installation).
• A basic understanding of Kubernetes, Helm, and Ansible.
• Optional: The Kubernetes client for Python (pip install kubernetes) for use with Ansible's k8s module.

Part 1: Setting Up Kubernetes with Minikube

Minikube is a lightweight tool that runs a single-node Kubernetes cluster locally, making it ideal for development and testing.

1. Start Minikube:

   BASHCopy

   minikube start
   

   This starts a single-node Kubernetes cluster.

2. Enable the Ingress add-on: Minikube's Ingress add-on provides an NGINX Ingress controller to handle external HTTP/HTTPS traffic.

   BASHCopy

   minikube addons enable ingress
   

   Verify that the Ingress controller is running:

   BASHCopy

   kubectl get pods -n ingress-nginx
   

3. Configure DNS: Get Minikube's IP address:

   BASHCopy

   minikube ip
   

   Edit the /etc/hosts file (administrator privileges required) and add the following entry, replacing <minikube ip> with the actual IP address:

   Copy

   <minikube ip> harbor.example.com demo.example.com
   

   This lets you access the services through harbor.example.com and demo.example.com.

Part 2: Generating Private Certificates with Ansible

We'll use Ansible to automate the generation of self-signed certificates and store them as Kubernetes Secrets for Harbor and the web service to use. Self-signed certificates are suitable for development environments, but use certificates from a trusted CA in production.

1. Install the Ansible collections: Install the community.crypto and kubernetes.core collections:

   BASHCopy

   ansible-galaxy collection install community.crypto
   ansible-galaxy collection install kubernetes.core
   

2. Create the certificates directory:

   BASHCopy

   mkdir certs
   

3. Create the Ansible playbook: Create a file named generate_certs.yaml with the following contents:

4. Run the playbook:

   BASHCopy

   ansible-playbook generate_certs.yaml
   

   This generates self-signed certificates for harbor.example.com and demo.example.com and creates Kubernetes Secrets named harbor-tls and demo-tls.

Part 3: Deploying Harbor

Harbor is an open-source container registry that provides role-based access control, image vulnerability scanning, and image signing. We'll deploy Harbor with Helm and configure TLS to ensure secure communication.

1. Add the Harbor Helm repository:

   BASHCopy

   helm repo add harbor https://helm.goharbor.io
   helm repo update
   

2. Create the Helm configuration file: Create a file named values.yaml with the following contents:

This configuration enables Ingress, uses the harbor-tls Secret to provide TLS, and sets the Harbor administrator password.

3. Install Harbor:

   BASHCopy

   helm install harbor harbor/harbor -f values.yaml
   

4. Verify the deployment: Check that the Harbor components are running:

   BASHCopy

   kubectl get pods
   

   Go to https://harbor.example.com (you may need to accept the self-signed certificate warning) and sign in with the username admin and password mysecretpassword.

Part 4: Deploying the Demo Web Service

We'll create a simple Node.js web app, build a Docker image, push it to Harbor, and deploy it to Kubernetes, exposing it over HTTPS through Ingress.

1. Create the web app: Create a directory named demo-app and add the following files:

   • app.js:

• package.json:

• Dockerfile:

FROM node:14
WORKDIR /app
COPY package*.json ./
RUN npm install
COPY . .
EXPOSE 3000
CMD ["node", "app.js"]

2. Build and push the Docker image:

   • Log in to Harbor:

     BASHCopy

     docker login harbor.example.com -u admin -p mysecretpassword
     

   • Build the image:

     BASHCopy

     docker build -t harbor.example.com/library/demo-app:latest .
     

   • Push the image:

     BASHCopy

     docker push harbor.example.com/library/demo-app:latest
     

3. Create the Kubernetes resources:

   • Create deployment.yaml:

• Create service.yaml:

apiVersion: v1 
kind: Service
metadata:
  name: demo-service
spec:
  selector:
    app: demo-app
  ports:
    - protocol: TCP
      port: 80
      targetPort: 3000

• Create ingress.yaml:

4. Apply the Kubernetes resources:

   BASHCopy

   kubectl apply -f deployment.yaml
   kubectl apply -f service.yaml
   kubectl apply -f ingress.yaml
   

5. Access the web service: Open your browser and go to https://demo.example.com. Because the site uses a self-signed certificate, you may need to accept the security warning. You should see the message: “Hello from demo app!”