Paket 2 · Praktik LanjutanModul J — Container Orchestration

Kubernetes Production Concepts

Menyiapkan Kubernetes produksi: resource requests/limits, probes, HPA, PDB, storage, RBAC, network policy, observability, dan backup.

Cluster yang berjalan belum tentu siap produksi. Diperlukan kontrol resource, keamanan, ketersediaan, observability, dan prosedur pemulihan.

Resource requests dan limits

resources:
  requests:
    cpu: 250m
    memory: 256Mi
  limits:
    cpu: "1"
    memory: 512Mi
FieldFungsi
requestsResource yang dijamin untuk scheduling
limitsBatas maksimum

Jika limit memory terlampaui, container di-OOMKill. Jika CPU limit terlampaui, container di-throttle.

Tanpa requests, scheduling tidak akurat

Pod tanpa requests bisa ditempatkan ke node yang sudah penuh, lalu saling berebut resource. Tetapkan requests berdasarkan pengukuran.

Probes

livenessProbe:
  httpGet:
    path: /health
    port: 3000
  initialDelaySeconds: 10
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /ready
    port: 3000
  initialDelaySeconds: 5
  periodSeconds: 5

startupProbe:
  httpGet:
    path: /health
    port: 3000
  failureThreshold: 30
  periodSeconds: 5
ProbeFungsi
LivenessRestart jika hang
ReadinessTerima trafik hanya jika siap
StartupBeri waktu aplikasi mulai

Horizontal Pod Autoscaler

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: app
  namespace: production
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: app
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

HPA membutuhkan metrics-server. Scaling berdasarkan CPU saja bisa terlambat; pertimbangkan custom metrics (RPS, queue depth).

PodDisruptionBudget

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: app
  namespace: production
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: web

PDB mencegah drain node mematikan terlalu banyak Pod sekaligus.

Rolling update

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 0

Dengan maxUnavailable: 0, Pod baru harus siap sebelum Pod lama dimatikan.

Storage

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: postgres-data
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 20Gi
  storageClassName: local-path

Gunakan StatefulSet untuk database:

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: postgres
spec:
  serviceName: postgres
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:16
          env:
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-secret
                  key: password
          volumeMounts:
            - name: data
              mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
    - metadata:
        name: data
      spec:
        accessModes: [ReadWriteOnce]
        resources:
          requests:
            storage: 20Gi

Database produksi di Kubernetes membutuhkan perencanaan backup, IOPS, dan operator khusus.

RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: app-reader
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-reader
  namespace: production
subjects:
  - kind: ServiceAccount
    name: app-reader
    namespace: production
roleRef:
  kind: Role
  name: app-reader
  apiGroup: rbac.authorization.k8s.io

Terapkan least privilege. Jangan memberi cluster-admin untuk rutinitas.

Network Policy

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-allow-ingress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes: [Ingress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - protocol: TCP
          port: 3000

Network policy membutuhkan CNI yang mendukungnya.

Observability

  • Metrics: Prometheus + kube-state-metrics + node-exporter.
  • Logs: Loki/ELK, kumpulkan stdout.
  • Traces: OpenTelemetry + Tempo/Jaeger.
  • Alert: Alertmanager.
  • Dashboard: Grafana.

Backup

  • Backup manifest/konfigurasi di Git.
  • Backup PV/database dengan tool khusus.
  • Velero untuk backup resource dan volume.
  • Uji restore ke cluster terpisah.

Upgrade cluster

  1. Baca release notes.
  2. Backup etcd dan workload.
  3. Upgrade control plane satu per satu.
  4. Drain node dengan PDB.
  5. Upgrade kubelet/node.
  6. Verifikasi workload.
  7. Siapkan rollback.

Checklist produksi

  • Requests/limits terukur.
  • Liveness/readiness/startup probe.
  • Minimal 2 replika.
  • PDB dan rolling update.
  • HPA sesuai beban.
  • Storage dan backup.
  • RBAC least privilege.
  • Network policy.
  • Secret terenkripsi.
  • Monitoring, log, alert.
  • Prosedur upgrade dan disaster recovery.

Ringkasan

  • Produksi membutuhkan resource, probe, dan availability control.
  • HPA dan PDB menjaga skalabilitas serta ketersediaan.
  • Storage, RBAC, dan network policy melindungi data dan akses.
  • Observability dan backup adalah bagian wajib.

Selesai — Paket 2

Anda telah menuntaskan kurikulum DevOps: Git & CI/CD, deployment produksi, HA, performa, database, observability, DevSecOps, otomasi infrastruktur, dan Kubernetes. Praktikkan setiap modul di lab Proxmox Anda dan dokumentasikan hasilnya.

Kubernetes Fundamentals

Memahami arsitektur Kubernetes, objek inti, kubectl, Deployment, Service, Ingress, dan alur deploy aplikasi.

On this page

Resource requests dan limitsProbesHorizontal Pod AutoscalerPodDisruptionBudgetRolling updateStorageRBACNetwork PolicyObservabilityBackupUpgrade clusterChecklist produksiRingkasan