Kubernetes in Production on AWS

Cheat sheet

Kubernetes objects at a glance

What each object is for, in one line.

Worked examples

Real manifests and a real pipeline

The files behind the animated sessions. Placeholders such as are replaced with your own values.

Example 1 – CI pipeline: test, scan and push to Amazon ECR (GitHub Actions)

# .github/workflows/build-and-deploy.yml
name: build-and-deploy
on:
  push:
    branches: [main]
permissions:
  id-token: write   # OIDC login to AWS - no stored access keys
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
      - run: mvn -B verify          # compile + unit tests
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::<account-id>:role/github-deploy
          aws-region: us-east-1
      - uses: aws-actions/amazon-ecr-login@v2
        id: ecr
      - name: Build, scan and push the image
        env:
          IMAGE: ${{ steps.ecr.outputs.registry }}/campus-jobs-api:${{ github.sha }}
        run: |
          docker build -t "$IMAGE" .
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            aquasec/trivy image --exit-code 1 --severity CRITICAL "$IMAGE"
          docker push "$IMAGE"

Example 2 – Deployment and Service

apiVersion: apps/v1
kind: Deployment
metadata:
  name: campus-jobs-api
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels: { app: campus-jobs-api }
  strategy:
    rollingUpdate: { maxUnavailable: 0, maxSurge: 1 }   # zero-downtime releases
  template:
    metadata:
      labels: { app: campus-jobs-api }
    spec:
      serviceAccountName: campus-jobs-api               # IRSA: AWS permissions for this pod
      containers:
        - name: api
          image: <account-id>.dkr.ecr.us-east-1.amazonaws.com/campus-jobs-api:1.4.0
          ports: [{ containerPort: 8080 }]
          envFrom:
            - configMapRef: { name: campus-jobs-config }
            - secretRef: { name: campus-jobs-secrets }
          resources:
            requests: { cpu: 250m, memory: 256Mi }
            limits: { memory: 512Mi }
          readinessProbe:
            httpGet: { path: /health/ready, port: 8080 }
            periodSeconds: 5
          livenessProbe:
            httpGet: { path: /health/live, port: 8080 }
            initialDelaySeconds: 20
---
apiVersion: v1
kind: Service
metadata:
  name: campus-jobs-api
  namespace: production
spec:
  selector: { app: campus-jobs-api }
  ports: [{ port: 80, targetPort: 8080 }]

Example 3 – Ingress (AWS Load Balancer Controller) and Horizontal Pod Autoscaler

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: campus-jobs
  namespace: production
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:<account-id>:certificate/<certificate-id>
spec:
  ingressClassName: alb
  rules:
    - host: jobs.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: campus-jobs-api
                port: { number: 80 }
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: campus-jobs-api
  namespace: production
spec:
  scaleTargetRef: { apiVersion: apps/v1, kind: Deployment, name: campus-jobs-api }
  minReplicas: 3
  maxReplicas: 20
  metrics:
    - type: Resource
      resource:
        name: cpu
        target: { type: Utilization, averageUtilization: 60 }

Example 4 – Everyday kubectl commands for operating the app

kubectl get pods -n production -l app=campus-jobs-api        # are all pods running?
kubectl rollout status deployment/campus-jobs-api -n production
kubectl describe hpa campus-jobs-api -n production           # why did it scale?
kubectl logs deploy/campus-jobs-api -n production --tail=50  # recent logs
kubectl rollout undo deployment/campus-jobs-api -n production # instant rollback

Further learning

Free official documentation & open-source references

Primary sources and free hands-on resources to go deeper.

• Kubernetes documentation – Overview – official concepts from the Kubernetes project
• Kubernetes Basics tutorial – free interactive introduction
• Amazon EKS User Guide – official AWS documentation for EKS
• Amazon EKS Best Practices Guide – security, reliability, scaling and cost guidance
• AWS Load Balancer Controller – open-source controller behind the Ingress example
• kind – Kubernetes in Docker – free local clusters for the lab
• Kubernetes The Hard Way (GitHub) – build a cluster from scratch to understand every part
• Killercoda Kubernetes playgrounds – free browser-based clusters
• GitHub Actions documentation – official CI/CD documentation
• Helm documentation – the package manager for Kubernetes
• Argo CD documentation – open-source GitOps continuous delivery
• Karpenter – open-source node autoscaler for Kubernetes
• Prometheus – Overview – open-source metrics and alerting
• Fluent Bit documentation – open-source log processor and forwarder
• Trivy (GitHub) – open-source vulnerability scanner used in the pipeline