58 lines
7.2 KiB
HTML
58 lines
7.2 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<meta name="description" content="Case study: Jay Phillips' enterprise-style Kubernetes home-lab platform.">
|
|
<meta name="robots" content="index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1">
|
|
<!-- PUBLIC-METADATA-START -->
|
|
<meta name="author" content="Jay Phillips">
|
|
<meta name="theme-color" content="#07111f">
|
|
<link rel="canonical" href="https://portfolio.phillips-home.net/kubernetes.html">
|
|
<meta property="og:locale" content="en_US">
|
|
<meta property="og:type" content="website">
|
|
<meta property="og:site_name" content="Jay Phillips Infrastructure Portfolio">
|
|
<meta property="og:title" content="Kubernetes and GitOps Platform | Jay Phillips">
|
|
<meta property="og:description" content="Case study of Jay Phillips' four-node Kubernetes platform using Argo CD GitOps, Calico, Longhorn, cert-manager, Sealed Secrets, ingress-nginx, and observability tooling.">
|
|
<meta property="og:url" content="https://portfolio.phillips-home.net/kubernetes.html">
|
|
<meta property="og:image" content="https://portfolio.phillips-home.net/social-card.png">
|
|
<meta property="og:image:type" content="image/png">
|
|
<meta property="og:image:width" content="1200">
|
|
<meta property="og:image:height" content="630">
|
|
<meta property="og:image:alt" content="Jay Phillips - Senior Systems Administrator and Infrastructure Engineer">
|
|
<meta name="twitter:card" content="summary_large_image">
|
|
<meta name="twitter:title" content="Kubernetes and GitOps Platform | Jay Phillips">
|
|
<meta name="twitter:description" content="Case study of Jay Phillips' four-node Kubernetes platform using Argo CD GitOps, Calico, Longhorn, cert-manager, Sealed Secrets, ingress-nginx, and observability tooling.">
|
|
<meta name="twitter:image" content="https://portfolio.phillips-home.net/social-card.png">
|
|
<!-- PUBLIC-METADATA-END --><link rel="icon" href="/favicon.svg" type="image/svg+xml"><link rel="stylesheet" href="/styles.css">
|
|
<title>Kubernetes Platform Case Study | Jay Phillips</title>
|
|
</head>
|
|
<body>
|
|
<a class="skip-link" href="#main">Skip to content</a>
|
|
<header class="site-header"><nav class="nav shell" aria-label="Primary navigation"><a class="brand" href="/"><span class="brand-mark" aria-hidden="true">JP</span><span>Jay Phillips</span></a><div class="nav-links"><a href="/">Home</a><a href="/#projects" aria-current="page">Projects</a><a href="/resume.html">Résumé</a><a href="mailto:Phillips-Jay@outlook.com">Contact</a></div></nav></header>
|
|
<main id="main" class="shell">
|
|
<div class="page-hero">
|
|
<div class="breadcrumb"><a href="/">Home</a> / <a href="/#projects">Projects</a> / Kubernetes</div>
|
|
<div class="eyebrow">Case study 01 · Platform engineering</div>
|
|
<h1>Enterprise-style <span>Kubernetes platform.</span></h1>
|
|
<p class="lead">A four-node home-lab cluster designed to practice production-minded orchestration, GitOps, persistent storage, security policy, observability, backup, and application operations.</p>
|
|
</div>
|
|
|
|
<div class="case-layout">
|
|
<div class="case-content">
|
|
<section class="case-section"><h2>Objective</h2><p>Build a realistic platform that could host useful services while providing hands-on experience with the operational concerns that exist beyond a basic Kubernetes installation: networking, storage, certificates, identity, policy, upgrades, monitoring, logging, backups, and declarative delivery.</p></section>
|
|
<section class="case-section"><h2>Architecture</h2><ul><li>One Ubuntu control-plane node and three Ubuntu worker nodes running Kubernetes 1.36.2 with containerd.</li><li>Calico for pod networking and enforceable NetworkPolicies.</li><li>MetalLB for LoadBalancer services and ingress-nginx as the application entry point.</li><li>cert-manager for automated certificate lifecycle management.</li><li>Longhorn distributed block storage with NFS backup targets.</li><li>Argo CD app-of-apps pattern for GitOps reconciliation.</li><li>Sealed Secrets for encrypted secret material stored in Git.</li></ul></section>
|
|
<section class="case-section"><h2>Delivery and operations</h2><p>Applications are defined in Git and reconciled by Argo CD. Kustomize and Helm are used where appropriate, and automated image workflows can update digest-pinned deployments. Current workloads include documentation, password management, monitoring, uptime checks, logging, DNS automation, tooling, and portfolio services.</p><h3>Operational practices</h3><ul><li>Namespace-based separation for applications and platform components.</li><li>Resource requests and limits, health probes, disruption budgets, and topology spreading.</li><li>Persistent-volume backups and recovery planning.</li><li>Prometheus metrics, Grafana dashboards, Loki logs, and Alertmanager email delivery.</li><li>Git history as the change record and Argo CD as the drift detector.</li></ul></section>
|
|
<section class="case-section"><h2>Security controls demonstrated by this portfolio</h2><ul><li>Restricted Pod Security enforcement pinned to the cluster version.</li><li>Non-root execution, read-only root filesystem, RuntimeDefault seccomp, no privilege escalation, and all Linux capabilities dropped.</li><li>Dedicated ServiceAccount with token automount disabled.</li><li>Default-deny ingress and egress with only ingress-controller traffic allowed.</li><li>Restricted Argo CD AppProject limited to one repository and one namespace.</li><li>ResourceQuota and LimitRange to constrain blast radius.</li></ul></section>
|
|
<section class="case-section"><h2>Engineering lessons</h2><p>The project reinforced that a useful Kubernetes platform is an integration of multiple control planes. Storage, certificates, DNS, ingress, monitoring, and GitOps must all agree on naming, identity, networking, and lifecycle behavior. Troubleshooting therefore requires moving methodically across layers instead of treating every symptom as an application problem.</p></section>
|
|
</div>
|
|
<aside class="case-sidebar">
|
|
<section class="panel"><h3>Platform facts</h3><dl class="fact-list"><div><dt>Cluster</dt><dd>4 nodes</dd></div><div><dt>Kubernetes</dt><dd>v1.36.2</dd></div><div><dt>Runtime</dt><dd>containerd</dd></div><div><dt>Networking</dt><dd>Calico + MetalLB</dd></div><div><dt>Storage</dt><dd>Longhorn</dd></div><div><dt>Delivery</dt><dd>Argo CD GitOps</dd></div></dl></section>
|
|
<section class="panel"><h3>Technologies</h3><div class="tags"><span class="tag">Kubernetes</span><span class="tag">Argo CD</span><span class="tag">Kustomize</span><span class="tag">Helm</span><span class="tag">Calico</span><span class="tag">Longhorn</span><span class="tag">cert-manager</span><span class="tag">Sealed Secrets</span></div></section>
|
|
</aside>
|
|
</div>
|
|
<section><div class="callout"><div><h2>See another case study.</h2><p>Continue with Microsoft infrastructure engineering or observability.</p></div><div class="actions"><a class="button primary" href="/microsoft.html">Microsoft platform</a><a class="button" href="/observability.html">Observability</a></div></div></section>
|
|
</main>
|
|
<footer class="site-footer shell"><span>© 2026 Jay Phillips</span><span>Case study: Kubernetes and GitOps platform.</span></footer>
|
|
</body>
|
|
</html>
|