Skip to content
CampusPrep
IT-704 · Cloud Computing Lab/Quick Revision Short Notes

Cloud Computing Lab (IT-704) - Unit 3 Short Notes

UNIT 3: CLOUD APPLICATION DEPLOYMENT & ORCHESTRATION (Lab-Focused Notes)

3.0 Introduction to Unit 3 & Prerequisites Review

  • Recap of Service Models:

    • IaaS: Raw compute/network/storage (e.g., AWS EC2, Azure VMs). User manages OS & apps.

    • PaaS: Platform for app deployment (e.g., AWS Elastic Beanstalk, Azure App Service). Provider manages runtime, OS, infrastructure.

    • SaaS: Complete software application (e.g., Gmail, Salesforce). Provider manages everything.

  • Lab Environment Setup:

    • Cloud Provider Access: AWS/Azure/GCP console, CLI (aws, az, gcloud).

    • Local Tools: Terminal, Docker Desktop, kubectl, Terraform.

    • Security Credentials: IAM Users/Roles (AWS), Service Principals (Azure), Service Accounts (GCP). Never commit keys to Git.

  • [!TIP] Exam Focus: Be able to distinguish which management layer (User vs. Provider) corresponds to each service model (IaaS/PaaS/SaaS).

3.1 Containerization Fundamentals (Docker)

  • Core Concepts:

    • Image: Read-only template with app code & dependencies (like a recipe).

    • Container: Runnable instance of an image (like a cooked meal). Ephemeral by default.

    • Dockerfile: Text file with instructions to build an image (FROM, RUN, COPY, CMD).

    • Registry: Repository for images (Docker Hub, AWS ECR, Google Container Registry).

  • Essential Lab Commands:

    
docker pull <image>          # Download image from registry

docker run -p 8080:80 nginx  # Run container, map host:container port

docker ps                    # List running containers

docker stop <container_id>

docker rm <container_id>

docker build -t myapp:v1 .   # Build image from Dockerfile in current dir

docker images                # List local images

  • Storage & Networking:

    • Volumes: Persistent storage managed by Docker (docker volume create).

    • Bind Mounts: Map host directory to container (-v /host/path:/container/path).

    • Networking: Default bridge network. Use --network to connect containers. Port mapping (-p) exposes container ports to host.

  • [!TIP] Common Pitfall: Forgetting to expose ports (-p) in docker run makes the app inaccessible from outside the host.

3.2 Container Orchestration with Kubernetes (K8s)

  • Core Architecture & Concepts:

    | K8s Object | Purpose | Analogy | | :--- | :--- | :--- | | Pod | Smallest deployable unit; 1+ containers sharing network/storage. | A single host/machine. | | Deployment | Declarative management of Pods (replicas, updates, rollbacks). | A blueprint for a fleet of identical hosts. | | Service | Stable network endpoint to access a set of Pods (load balancing). | A load balancer or DNS name for the fleet. | | Namespace | Virtual cluster partition for resource isolation. | Different departments in a company. | | ConfigMap | Store non-sensitive configuration data as key-value pairs. | App config file (e.g., app.properties). | | Secret | Store sensitive data (passwords, tokens) in base64-encoded form. | Secure vault for credentials. |

  • Cluster Setup (Lab):

    • Local: minikube start, kind create cluster, Docker Desktop K8s.

    • Managed (Console Walkthrough): AWS EKS, Azure AKS, GCP GKE.

  • kubectl Command Mastery:

    
kubectl get pods,svc,deploy,ns          # List resources

kubectl describe pod <pod-name>         # Detailed info & events

kubectl apply -f <manifest.yaml>       # Create/Update resource (declarative)

kubectl create -f <manifest.yaml>      # Create resource (imperative)

kubectl delete -f <manifest.yaml>

kubectl logs <pod-name>                # View container logs

kubectl exec -it <pod-name> -- /bin/bash # Enter container shell

kubectl scale deploy <name> --replicas=3

  • YAML Manifest Structure (Example - Deployment):

    
apiVersion: apps/v1

kind: Deployment

metadata:

  name: nginx-deploy

spec:

  replicas: 3

  selector:

    matchLabels:

      app: nginx

  template:

    metadata:

      labels:

        app: nginx

    spec:

      containers:

      - name: nginx

        image: nginx:1.25

        ports:

        - containerPort: 80

  • Exposing Apps:

    • NodePort: Exposes service on a static port on each cluster node (type: NodePort). For local testing.

    • LoadBalancer: Provisions cloud provider's load balancer (type: LoadBalancer). For production cloud clusters.

  • [!TIP] Exam Focus: Know the difference between kubectl apply (idempotent, desired state) and kubectl create. Always use apply for production manifests.

3.3 Cloud-Native Application Patterns & Deployment Strategies

  • Microservices Communication:

    • Service Discovery: K8s Services provide internal DNS (<service-name>.<namespace>.svc.cluster.local).

    • API Gateway (Conceptual): Single entry point (e.g., Nginx Ingress, AWS ALB Ingress Controller) for routing, SSL termination, auth.

  • Configuration & Secrets:

    • ConfigMap/Secret as Volume: Mount as files in pod (volumes).

    • ConfigMap/Secret as Env Vars: Inject as environment variables (envFrom).

    • Cloud Provider Secret Managers: AWS Secrets Manager, Azure Key Vault. More secure; integrate via K8s CSI driver or external tools.

  • Deployment Strategies in K8s:

    • Rolling Update (Default): Gradually replace old pods with new ones (strategy.type: RollingUpdate).

    • Blue-Green: Deploy new version (green) alongside old (blue), switch service selector. Zero downtime, requires double resources.

    • Canary: Route a small percentage of traffic to new version (using Ingress annotations or service mesh like Istio). Gradual rollout, easy rollback.

  • Stateful Applications:

    • StatefulSet: For stateful apps (DBs). Provides stable network ID, persistent storage per pod.

    • PersistentVolumeClaim (PVC): Request for storage. PersistentVolume (PV) is the actual storage (cloud disk, NFS). PVC binds to a PV.

    
apiVersion: v1

kind: PersistentVolumeClaim

metadata:

  name: mysql-pvc

spec:

  accessModes:

    - ReadWriteOnce

  resources:

    requests:

      storage: 10Gi

  • [!TIP] Common Pitfall: Using a Deployment for a stateful database (like MySQL) without a StatefulSet and PVC leads to data loss on pod restart.

3.4 Infrastructure as Code (IaC) for Cloud Resources

  • Tool Focus: Terraform (HCL Language)

  • Core Concepts:

    • Provider: Plugin for cloud platform (AWS, Azure, GCP). provider "aws" { region = "us-east-1" }

    • Resource: Infrastructure object (VM, VPC, K8s cluster). resource "aws_instance" "web" { ... }

    • State File (terraform.tfstate): JSON file mapping real resources to config. Must be stored securely (remote backend like S3).

    • Workflow: terraform init → terraform plan → terraform apply → terraform destroy.

  • Lab Exercise Snippet (Provision AWS EC2):

    
resource "aws_instance" "web_server" {

  ami           = "ami-0c55b159cbfafe1f0"

  instance_type = "t2.micro"

  tags = {

    Name = "WebServer"

  }

}

output "public_ip" {

  value = aws_instance.web_server.public_ip

}

  • Integrating with K8s: Use terraform to provision the cluster (EKS/AKS/GKE) and then use kubectl/Helm to deploy apps. Or use the kubernetes provider in Terraform to manage K8s resources directly.

  • [!TIP] Exam Focus: terraform plan shows what will change. terraform apply executes the change. State file is the source of truth for Terraform.

3.5 Continuous Integration/Continuous Deployment (CI/CD) Pipelines

  • Pipeline Stages: Source → Build → Test → Deploy → Monitor.

  • Toolchain Example (GitHub Actions):

    • Source: GitHub repo push/PR.

    • Build: docker build & docker push to registry.

    • Deploy: kubectl set image or helm upgrade using new image tag.

  • Sample GitHub Actions Workflow (.github/workflows/deploy.yml):

    
name: Deploy to K8s

on:

  push:

    branches: [ main ]

jobs:

  deploy:

    runs-on: ubuntu-latest

    steps:

    - uses: actions/checkout@v3

    - name: Build & Push Docker Image

      run: |

        docker build -t myapp:${{ github.sha }} .

        docker push myapp:${{ github.sha }}

    - name: Deploy to K8s

      run: |

        kubectl set image deployment/myapp-deploy myapp-container=myapp:${{ github.sha }}

      env:

        KUBECONFIG: ${{ secrets.KUBECONFIG }}

  • Key Concepts:

    • Pipeline as Code: CI/CD config stored in repo (e.g., .gitlab-ci.yml, Jenkinsfile).

    • Triggers: On commit, on schedule, manually.

    • Secrets in CI/CD: Store as encrypted secrets in CI tool (GitHub Secrets, Jenkins Credentials), not in code.

  • [!TIP] Common Pitfall: Hardcoding image tags (latest) in deployment manifests. Use immutable tags (commit SHA, version number) for reliable rollbacks.

3.6 Monitoring, Logging, and Troubleshooting in the Cloud

  • Cloud-Native Monitoring (Provider Tools):

    • AWS: CloudWatch (Metrics, Logs, Alarms).

    • Azure: Azure Monitor (Metrics, Logs, Application Insights).

    • GCP: Cloud Operations (formerly Stackdriver).

  • K8s Monitoring & Logging:

    • Metrics:

      • kubectl top pod/node – Basic CPU/Memory usage.

      • Prometheus: Pull-based metrics collection. Scrapes K8s endpoints.

      • Grafana: Dashboard visualization for Prometheus data.

    • Logging:

      • kubectl logs <pod-name> – View single container logs.

      • Cluster-Level Logging: Sidecar pattern (Fluentd/Fluent Bit) or node-level agent (Fluentd) → Backend (Elasticsearch) → UI (Kibana). EFK Stack.

  • Troubleshooting Lab Scenarios:

    1. Crashing Pod: kubectl logs <pod-name> --previous (if crashed), kubectl describe pod <pod-name> (check Events, state, conditions).

    2. Service Not Reachable: kubectl get svc, kubectl describe svc <name> (check ports, selector), kubectl get endpoints <svc-name> (verify endpoints exist).

    3. High Resource Usage: kubectl top pod, check resources.requests/limits in manifest. Increase limits or add more replicas.

  • [!TIP] Exam Focus: kubectl describe is the most powerful troubleshooting command – shows events, config, state, and conditions.

3.7 Security Best Practices for Deployed Workloads

  • K8s Security:

    • Namespaces: Isolate environments (dev, staging, prod). Apply RBAC per namespace.

    • RBAC: Role/ClusterRole (permissions) + RoleBinding/ClusterRoleBinding (assignment). Principle of least privilege.

    • Pod Security Standards / OPA Gatekeeper: Enforce policies (e.g., run as non-root, disallow privileged containers).

  • Image Security:

    • Scanning: Use trivy image <image-name> or docker scan. Integrate into CI pipeline.

    • Base Images: Use minimal, trusted images (e.g., alpine, distroless).

  • Network Policies: Control pod-to-pod communication (like a firewall).

    
apiVersion: networking.k8s.io/v1

kind: NetworkPolicy

metadata:

  name: deny-all-ingress

spec:

  podSelector: {} # Applies to all pods in namespace

  policyTypes:

  - Ingress

  - Egress

  • Cloud Security Integration:

    • IAM Roles for Service Accounts (IRSA - AWS) / Workload Identity (GCP): Grant K8s pods AWS/GCP permissions without long-term keys.

  • [!TIP] Common Pitfall: Running containers as root user inside the pod. Always specify runAsNonRoot: true and runAsUser in Pod/Deployment securityContext.

3.8 Cost Management & Optimization for Deployed Resources

  • Cloud Cost Tools:

    • AWS: Cost Explorer, Cost & Usage Reports.

    • Azure: Cost Management + Billing.

    • GCP: Billing Reports, Cost Table.

  • Optimization Techniques:

    • Right-Sizing (K8s): Set accurate requests and limits in pod specs. Prevents over-provisioning.

      
resources:

  requests:

    memory: "256Mi"

    cpu: "250m"

  limits:

    memory: "512Mi"

    cpu: "500m"

    • Spot/Preemptible Instances: Use for non-critical, fault-tolerant workloads (batch jobs, dev envs). Configure via IaC.

      • Terraform (AWS): instance_interruption_behavior = "terminate", spot_price = "0.05".

    • Scheduling: Use kubectl scale or cronjob to start/stop non-production clusters/pods outside business hours.

    • Identify Waste: Look for unattached EBS volumes, idle load balancers, over-provisioned disks. Use cloud provider's cost tools and kubectl top to find idle pods.

  • [!TIP] Exam Focus: requests = guaranteed resources (scheduling). limits = maximum allowed (prevents a single pod from starving others). Setting both correctly is key for cost and stability.

3.9 Capstone Lab: Full-Stack Cloud-Native Application Deployment

  • Integrated Exercise Flow:

    1. IaC Provisioning (Terraform):

      • Define VPC, subnets, security groups.

      • Provision a managed K8s cluster (EKS/AKS/GKE).

      • Output cluster endpoint and credentials.

    2. Containerization (Docker):

      • Write Dockerfile for frontend (React/Node.js) and backend (Python/Java).

      • Build images, tag with commit SHA, push to private registry (ECR/ACR/GCR).

    3. K8s Deployment:

      • Create Namespace (e.g., prod).

      • Define Deployment for frontend & backend (with image pull secrets).

      • Define Service (ClusterIP) for internal communication.

      • Define Ingress (or LoadBalancer Service) for external access.

      • Define ConfigMap & Secret for app config (DB connection string).

      • Define PVC & StatefulSet for database (PostgreSQL/MySQL).

    4. CI/CD Pipeline (GitHub Actions/GitLab CI):

      • On push to main: build & push new image.

      • Update K8s Deployment with new image tag (kubectl set image or helm upgrade).

    5. Security & Monitoring:

      • Apply NetworkPolicy to restrict DB access only to backend pods.

      • Deploy Prometheus & Grafana (or use cloud monitoring) to monitor app metrics.

      • Run trivy scan on built images in CI pipeline.

    6. Cost Analysis:

      • Use cloud provider's cost tools to generate a report of resources used (cluster nodes, load balancer, disks, data transfer).

  • Final Deliverables: IaC code, Dockerfiles, K8s manifests, CI/CD config, monitoring dashboard screenshots, cost report.

  • [!TIP] Exam-Winning Approach: In the capstone, modularize your manifests (separate files for deploy, service, ingress) and use kubectl apply -k ./k8s/ (kustomize) or Helm charts for cleaner management.

Go to where you left off?

Quick Add to Notes

Save questions, your own notes and screenshots into notes filed by unit. It takes a free account.

Create free account

Have an account? Log in