SRE Thailand Bootcamp

Week 13: Production Kubernetes — Clusters, Networking, RBAC

Theme: Build and operate production-grade Kubernetes clusters.

Learning Objectives

1. Provision a multi-node Kubernetes cluster with kubeadm or kOps
2. Configure networking policies (Calico, Cilium)
3. Implement RBAC with least-privilege principles
4. Manage node pools, taints/tolerations, affinity rules

Reading Materials

• Kubernetes the Hard Way (Kelsey Hightower)
• kOps Documentation
• Calico Network Policies
• Cilium Documentation
• Kubernetes RBAC
• Kubernetes Production Best Practices (AWS)
• Kubernetes Security Best Practices (Google)

Finger Exercises (choose 2)

1. Write a NetworkPolicy that allows only the Go app to talk to the Python worker on port 8080. Deny all other ingress.
2. Create a ServiceAccount for the Go app. Bind it to a Role with least privilege (only get/list pods, create events).
3. Set up node affinity: schedule the Go app on nodes with label workload=services, Python worker on workload=workers.

Project

• Provision a cluster (on AWS/GCP or locally with kubeadm VMs): 1 control plane + 2 workers
• Configure Cilium as CNI with network policies:
  • Default deny ingress/egress
  • Allow ingress to Go app on port 8080 from Ingress controller
  • Allow Go app egress to Python worker on port 8081
  • Allow all pods egress to DNS (port 53 UDP)
• Set up RBAC:
  • developer role: get/list/watch pods, services, deployments in dev namespace
  • ops role: full access to prod namespace
  • viewer role: read-only across all namespaces
• Configure taints/tolerations: Python worker runs on spot/preemptible instances, Go app runs on on-demand instances
• Write a CLUSTER_SETUP.md documenting the cluster architecture, networking, and access control

Time Budget