Skip to content

Commit 493cc84

Browse files
GuopingJiaGuopingJia
committed
Update Blog “deploying-super-mario-game-on-kubernetes-in-hpe-greenlake-for-private-cloud-enterprise”
1 parent 70d2b05 commit 493cc84

File tree

2 files changed

+186
-54
lines changed

2 files changed

+186
-54
lines changed

‎content/blog/deploying-super-mario-game-on-kubernetes-in-hpe-greenlake-for-private-cloud-enterprise.md

Lines changed: 186 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,98 @@ tags:
1414
- Super Mario
1515
- Tetris
1616
- hpe-greenlake-for-private-cloud-enterprise
17+
- TLS termination
1718
---
1819
<style> li { font-size: 27px; line-height: 33px; max-width: none; } </style>
1920

2021
This blog post shows you the detailed process to deploy Super Mario game to the Kubernetes in HPE GreenLake for Private Cloud Enterprise.
2122

23+
![](/img/game-deploy.png)
24+
2225
### Prerequisites
2326

2427
Before starting, make sure you have the following:
2528

2629
* A K8s cluster, being provisioned in HPE GreenLake for Private Cloud Enterprise
27-
* The kubectl CLI tool, together with the kubeconfig file for accessing the K8s cluster
28-
* The optional openssl CLI tool, for validating the generated certificates
30+
* The *kubectl* CLI tool, together with the kubeconfig file for accessing the K8s cluster
31+
* The *helm* CLI tool, version 3.12.0 or later
32+
* A domain and a list of subdomains to generate the SSL certificate and host the applications in the cluster
33+
* The optional *openssl* CLI tool, for validating the generated certificates
34+
35+
### Deploy Super Mario game
36+
37+
*Super Mario*, together with *Tetris*, can be deployed to the cluster using the YAML manifest files from the GitHub repo [k8s-games](https://github.com/GuopingJia/k8s-games):
38+
39+
```shell
40+
$ tree k8s-games/
41+
k8s-games/
42+
├── README.md
43+
├── super-mario
44+
│   ├── deployment.yaml
45+
│   └── service.yaml
46+
└── tetris
47+
├── deployment.yaml
48+
└── service.yaml
49+
```
50+
51+
Type the following commands to deploy the game *Super Mario* and *Tetris* to the namespace *cfe-games*:
52+
53+
54+
```shell
55+
$ kubectl create ns cfe-games
56+
namespace/cfe-games created
57+
58+
$ kubectl apply -f super-mario/ -n cfe-games
59+
deployment.apps/mario-deployment created
60+
service/mario-service created
61+
62+
$ kubectl apply -f tetris/ -n cfe-games
63+
deployment.apps/tetris-deployment created
64+
service/tetris-service created
65+
```
66+
67+
Type the command shown below to check the details of game deployment:
68+
69+
```shell
70+
$ kubectl get all -n cfe-games
71+
NAME READY STATUS RESTARTS AGE
72+
pod/mario-deployment-96f79d8f-dw9hh 1/1 Running 0 19s
73+
pod/mario-deployment-96f79d8f-wsf7s 1/1 Running 0 13s
74+
pod/tetris-deployment-86d744fb47-7kmwl 1/1 Running 0 7s
75+
pod/tetris-deployment-86d744fb47-hqmgd 1/1 Running 0 10s
76+
77+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
78+
service/mario-service ClusterIP 10.104.144.88 <none> 80/TCP 22s
79+
service/tetris-service ClusterIP 10.111.218.14 <none> 80/TCP 10s
80+
81+
NAME READY UP-TO-DATE AVAILABLE AGE
82+
deployment.apps/mario-deployment 2/2 2 2 24s
83+
deployment.apps/tetris-deployment 2/2 2 2 12s
84+
85+
NAME DESIRED CURRENT READY AGE
86+
replicaset.apps/mario-deployment-96f79d8f 2 2 2 24s
87+
replicaset.apps/tetris-deployment-86d744fb47 2 2 2 12s
88+
```
89+
90+
Two games, *mario* and *tetris*, are deployed as the *ClusterIP* type, each running with 2 Pod replicas. They provide internal connectivity and can solely be accessed from within the cluster.
91+
92+
Type the following commend to check that all the game service endpoints have been populated:
93+
94+
```shell
95+
$ kubectl get endpoints -n cfe-games
96+
NAME ENDPOINTS AGE
97+
mario-service 10.192.3.118:80,10.192.4.32:80 60s
98+
tetris-service 10.192.3.119:3000,10.192.4.33:3000 50s
99+
```
100+
### Set up the load balancer with MetalLB
101+
102+
103+
You can install MetalLB and set up the load balancer in the K8s cluster by following up the blog post [Setting up the load balancer with MetalLB](https://developer.hpe.com/blog/set-up-load-balancer-with-metallb-in-hpe-greenlake-for-private-cloud-enterprise/).
104+
105+
Here is the deployed MetalLB to the namespace *metallb-system* in the cluster:
29106

30107
```shell
31-
$ k get all -n metallb-system
108+
$ kubectl get all -n metallb-system
32109
NAME READY STATUS RESTARTS AGE
33110
pod/controller-57b4fdc957-dr4h4 1/1 Running 0 18d
34111
pod/speaker-9kx9h 1/1 Running 0 18d
@@ -50,8 +127,70 @@ NAME DESIRED CURRENT READY AGE
50127
replicaset.apps/controller-57b4fdc957 1 1 1 18d
51128
```
52129

130+
### Deploy Nginx Ingress controller
131+
132+
In order for an Ingress to work in the cluster, there must be an Ingress controller being deployed and running. It's the Ingress controller that accesses the certificate and the routing rules defined on the Ingress resource and makes them part of its configuration.
133+
134+
A variety of Ingress controllers are available for deployment in the cluster, including [Traefik](https://doc.traefik.io/traefik/providers/kubernetes-ingress/), [HAProxy](https://github.com/haproxytech/kubernetes-ingress#readme) and [Nginx Ingress controller](https://www.nginx.com/products/nginx-ingress-controller/). Execute the command below to install the Nginx Ingress controller to the cluster using helm:
135+
136+
```shell
137+
$ helm upgrade --install ingress-nginx ingress-nginx \
138+
> --repo https://kubernetes.github.io/ingress-nginx \
139+
> --namespace ingress-nginx --create-namespace
140+
Release "ingress-nginx" does not exist. Installing it now.
141+
NAME: ingress-nginx
142+
LAST DEPLOYED: Wed Mar 6 18:30:55 2024
143+
NAMESPACE: ingress-nginx
144+
STATUS: deployed
145+
REVISION: 1
146+
TEST SUITE: None
147+
NOTES:
148+
The ingress-nginx controller has been installed.
149+
It may take a few minutes for the load balancer IP to be available.
150+
You can watch the status by running 'kubectl get service --namespace ingress-nginx ingress-nginx-controller --output wide --watch'
151+
152+
An example Ingress that makes use of the controller:
153+
apiVersion: networking.k8s.io/v1
154+
kind: Ingress
155+
metadata:
156+
name: example
157+
namespace: foo
158+
spec:
159+
ingressClassName: nginx
160+
rules:
161+
- host: www.example.com
162+
http:
163+
paths:
164+
- pathType: Prefix
165+
backend:
166+
service:
167+
name: exampleService
168+
port:
169+
number: 80
170+
path: /
171+
# This section is only required if TLS is to be enabled for the Ingress
172+
tls:
173+
- hosts:
174+
- www.example.com
175+
secretName: example-tls
176+
177+
If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:
178+
179+
apiVersion: v1
180+
kind: Secret
181+
metadata:
182+
name: example-tls
183+
namespace: foo
184+
data:
185+
tls.crt: <base64 encoded cert>
186+
tls.key: <base64 encoded key>
187+
type: kubernetes.io/tls
188+
```
189+
190+
The Nginx Ingress controller is deployed to the namespace *ingress-nginx* in the cluster. Type the following command to check the deployment details:
191+
53192
```shell
54-
$ k get all -n ingress-nginx
193+
$ kubectl get all -n ingress-nginx
55194
NAME READY STATUS RESTARTS AGE
56195
pod/ingress-nginx-controller-5957546d75-zjwjh 1/1 Running 0 15d
57196

@@ -66,8 +205,15 @@ NAME DESIRED CURRENT READY
66205
replicaset.apps/ingress-nginx-controller-5957546d75 1 1 1 15d
67206
```
68207

208+
### Generate a self-signed certificate using cert-manager
209+
210+
211+
You can deploy cert-manager to the K8s cluster and generate a self-signed certificate by following up the blog post [Generating self-signed certificates using cert-manager](https://developer.hpe.com/blog/generating-self-signed-certificates-using-cert-manager-for-kubernetes-in-hpe-greenlake-for-private-cloud-entreprise/).
212+
213+
Here is the deployed cert-manager to the namespace *cert-manager* in the cluster:
214+
69215
```shell
70-
$ k get all -n cert-manager
216+
$ kubectl get all -n cert-manager
71217
NAME READY STATUS RESTARTS AGE
72218
pod/cert-manager-6bcdd5f7c-f7lfw 1/1 Running 0 18d
73219
pod/cert-manager-cainjector-5d4577b4d9-jmpsp 1/1 Running 0 18d
@@ -97,10 +243,14 @@ metadata:
97243
spec:
98244
selfSigned: {}
99245

100-
$ k apply -f issuer-selfsigned.yaml -n cfe-games
246+
$ kubectl apply -f issuer-selfsigned.yaml -n cfe-games
101247
issuer.cert-manager.io/cfe-selfsigned-issuer created
248+
```
102249

103-
$ k get issuer -n cfe-games
250+
Below is the deployed self-signed custom resource definition (CRD) *Issuer* in the namespace *nginx-apps* in which you want to generate certificate:
251+
252+
```shell
253+
$ kubectl get issuer -n cfe-games
104254
NAME READY AGE
105255
cfe-selfsigned-issuer True 10s
106256
```
@@ -127,18 +277,32 @@ spec:
127277
- tetris.example.com
128278
- example.com
129279

130-
$ k apply -f certificate-game.yaml -n cfe-games
280+
$ kubectl apply -f certificate-game.yaml -n cfe-games
131281
certificate.cert-manager.io/cfe-selfsigned-tls created
132282

133-
$ k get certificate -n cfe-games
283+
Here is the generated self-signed certificate in the namespace *cfe-games*:
284+
285+
286+
287+
```shell
288+
$ kubectl get certificate -n cfe-games
134289
NAME READY SECRET AGE
135290
cfe-selfsigned-tls True cfe-tls-key-pair 8s
291+
```
292+
293+
The K8s Secret *cfe-tls-key-pair* is created automatically in the same namespace as part of certificate deployment:
136294

137-
$ k get secrets -n cfe-games cfe-tls-key-pair
295+
296+
297+
```shell
298+
$ kubectl get secrets -n cfe-games cfe-tls-key-pair
138299
NAME TYPE DATA AGE
139300
cfe-tls-key-pair kubernetes.io/tls 3 35s
140301
```
141302

303+
Type the following openssl command to check the generated certificate:
304+
305+
142306
```shell
143307
$ openssl x509 -in <(kubectl get secret -n cfe-games cfe-tls-key-pair -o jsonpath='{.data.tls\.crt}' | base64 -d) -text -noout
144308
Certificate:
@@ -201,48 +365,11 @@ Certificate:
201365
f3:c7:85:8a:46:ba:69:13:c7:a8:14:42:4b:ee:f9:2a:b4:3b:
202366
d9:8f:9c:50
203367
```
368+
The line X509v3 Subject Alternative Name contains the *dnsNames*, *'super-mario.example.com'* & *'tetris.example.com'*, which host two games, *Super Mario* & *Tetris*, respectively in the cluster.
204369

205-
```shell
206-
$ tree k8s-games/
207-
k8s-games/
208-
├── README.md
209-
├── super-mario
210-
│   ├── deployment.yaml
211-
│   └── service.yaml
212-
└── tetris
213-
├── deployment.yaml
214-
└── service.yaml
215-
```
216-
217-
```shell
218-
$ k apply -f super-mario/ -n cfe-games
219-
deployment.apps/mario-deployment created
220-
service/mario-service created
221-
222-
$ k apply -f tetris/ -n cfe-games
223-
deployment.apps/tetris-deployment created
224-
service/tetris-service created
225-
226-
227-
$ k get all -n cfe-games
228-
NAME READY STATUS RESTARTS AGE
229-
pod/mario-deployment-96f79d8f-dw9hh 1/1 Running 0 19s
230-
pod/mario-deployment-96f79d8f-wsf7s 1/1 Running 0 13s
231-
pod/tetris-deployment-86d744fb47-7kmwl 1/1 Running 0 7s
232-
pod/tetris-deployment-86d744fb47-hqmgd 1/1 Running 0 10s
233-
234-
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
235-
service/mario-service ClusterIP 10.104.144.88 <none> 80/TCP 22s
236-
service/tetris-service ClusterIP 10.111.218.14 <none> 80/TCP 10s
237-
238-
NAME READY UP-TO-DATE AVAILABLE AGE
239-
deployment.apps/mario-deployment 2/2 2 2 24s
240-
deployment.apps/tetris-deployment 2/2 2 2 12s
241-
242-
NAME DESIRED CURRENT READY AGE
243-
replicaset.apps/mario-deployment-96f79d8f 2 2 2 24s
244-
replicaset.apps/tetris-deployment-86d744fb47 2 2 2 12s
245-
```
370+
### Set up Ingress TLS
371+
372+
The Ingress resource with TLS has to be created. Here is the sample Ingress TLS resource *ingress-host-based-selfsigned.yaml*, available from the GitHub repo [ingress-demo](https://github.com/GuopingJia/ingress-demo):
246373

247374
```shell
248375
$ cat ingress-host-based-selfsigned-games.yaml
@@ -252,8 +379,7 @@ metadata:
252379
name: ingress-host-based-selfsigned
253380
annotations:
254381
ingress.kubernetes.io/ssl-redirect: "true"
255-
#kubernetes.io/ingress.class: "nginx"
256-
cert-manager.io/issuer: "cfe-selfsinged-issuer"
382+
cert-manager.io/issuer: "cfe-selfsigned-issuer"
257383
spec:
258384
ingressClassName: nginx
259385
tls:
@@ -283,8 +409,14 @@ spec:
283409
number: 80
284410
```
285411

412+
In the above sample YAML manifest file, there is the *'tls'* block that contains the hostname *'nginx.example.com'* and the secret *cfe-tls-key-pair* created in the certification step. There is also the *'rules'* block in which a list of routing rules is defined per host, e.g., host *nginx.example.com* will be routed to the application service *nginx-main* in the backend.
413+
414+
415+
416+
Type the following command to deploy the Ingress resource to the namespace *nginx-apps*:
417+
286418
```shell
287-
$ k describe ingress ingress-host-based-selfsigned -n cfe-games
419+
$ kubectl describe ingress ingress-host-based-selfsigned -n cfe-games
288420
Name: ingress-host-based-selfsigned
289421
Labels: <none>
290422
Namespace: cfe-games

‎static/img/game-deploy.png

355 KB
Loading

0 commit comments

Comments
 (0)