New content deployed at $(date)
EOF # Update ConfigMap kubectl create configmap nginx-nodeport-content \ --from-file=index.html=new-index.html \ --dry-run=client -o yaml | kubectl apply -f - # Reload nginx to pick up changes POD_NAME=$(kubectl get pods -l app=nginx-nodeport -o name | head -1) kubectl exec $POD_NAME -- nginx -s reload echo "β Content updated! Access at: http://[$NODE_IPV6]:30091" ``` ### Update nginx configuration ```bash # Create custom nginx config cat > custom-nginx.conf << 'EOF' server { listen 8080; listen [::]:8080 ipv6only=on; server_name my-site.com; # Custom logging access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log; location / { root /usr/share/nginx/html; index index.html; try_files $uri $uri/ =404; } location /health { access_log off; return 200 "healthy\n"; } } EOF # Update ConfigMap kubectl create configmap nginx-nodeport-nginx-config \ --from-file=default.conf=custom-nginx.conf \ --dry-run=client -o yaml | kubectl apply -f - # Reload nginx POD_NAME=$(kubectl get pods -l app=nginx-nodeport -o name | head -1) kubectl exec $POD_NAME -- nginx -s reload ``` ## π Troubleshooting ### Pod won't start ```bash # Check pod status and events kubectl describe pod -l app=nginx-nodeport # Check pod logs kubectl logs -f deployment/nginx-nodeport # Check resource availability kubectl top nodes kubectl describe nodes ``` ### Service not accessible ```bash # Verify service exists and has endpoints kubectl get svc nginx-nodeport-service kubectl get endpoints nginx-nodeport-service # Check if pod is ready kubectl get pods -l app=nginx-nodeport -o wide # Verify NodePort is open netstat -tulpn | grep 30091 ``` ### IPv6 connectivity issues ```bash # Test IPv6 on the node ping6 -c 3 $NODE_IPV6 # Check nginx is listening on IPv6 POD_NAME=$(kubectl get pods -l app=nginx-nodeport -o name | head -1) kubectl exec $POD_NAME -- netstat -tuln | grep 8080 # Verify nginx configuration kubectl exec $POD_NAME -- cat /etc/nginx/conf.d/default.conf ``` ### Performance issues ```bash # Check resource usage kubectl top pods -l app=nginx-nodeport # Check nginx status and connections POD_NAME=$(kubectl get pods -l app=nginx-nodeport -o name | head -1) kubectl exec $POD_NAME -- ps aux | grep nginx kubectl exec $POD_NAME -- netstat -an | grep :8080 | wc -l ``` ## ποΈ Cleanup ```bash # Remove all resources kubectl delete -f nginx-nodeport-deployment.yaml -f nginx-nodeport-service.yaml # Remove ConfigMaps kubectl delete configmap nginx-nodeport-content nginx-nodeport-nginx-config # Verify cleanup kubectl get all -l app=nginx-nodeport # Should return nothing ``` ## π Nginx Deployment Variants Comparison ### Complete Overview: 4 Ways to Deploy Nginx on Mycelium Cloud | Feature | hostNetwork | NodePort | LoadBalancer | Ingress | |---------|-------------|----------|--------------|---------| | **Example** | nginx-mycelium | nginx-nodeport | (Future) | (Future) | | **Pod Network** | β Host | β Isolated | β Isolated | β Isolated | | **Security** | β οΈ Low | β Medium | β Medium | β High | | **Access Pattern** | `[pod-ip]:8080` | `[node-ip]:30091` | `[lb-ip]:80` | `domain.com` | | **Port Range** | Any | 30000-32767 | 80, 443 | 80, 443 | | **Mycelium Access** | Direct pod | Via node | Via LB | Via ingress | | **Use Case** | Demo/POC | Testing/Dev | Production | Web apps | | **Scalability** | β Limited | β Good | β Excellent | β Excellent | | **Load Balancing** | Manual | K8s Service | Cloud LB | Ingress controller | | **SSL/TLS** | Manual | Manual | Possible | Native | | **DNS Support** | No | No | Possible | Yes | | **Production Ready** | β οΈ No | β Yes | β Yes | β Yes | ### Key Differences: hostNetwork vs NodePort | Feature | hostNetwork (nginx-mycelium) | NodePort (nginx-nodeport) | |---------|------------------------------|---------------------------| | **Security** | β οΈ Direct host access | β Isolated pod network | | **Network Isolation** | β Uses host interfaces | β Pod namespace isolation | | **Port Conflicts** | β Limited by host ports | β No port conflicts | | **Debugging** | π Host-level tools | β Standard K8s patterns | | **Monitoring** | π Host monitoring | β Pod-level monitoring | | **Scalability** | β Single instance per node | β Multiple replicas | | **Production Ready** | β οΈ Demo/POC only | β Production patterns | | **Access URL** | `http://[pod-mycelium-ip]:8080` | `http://[node-mycelium-ip]:30091` | | **Port Used** | 8080 (+ NodePort 30090) | NodePort 30091 | ## π Scaling and High Availability ### Scale to multiple replicas ```bash # Scale deployment kubectl scale deployment nginx-nodeport --replicas=3 # Verify scaling kubectl get pods -l app=nginx-nodeport # Check load balancing NODE_IPV6=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}') for i in {1..5}; do curl -6 "http://[$NODE_IPV6]:30091/" | grep -o "nginx-nodeport-[a-z0-9]*-[a-z0-9]*" | head -1 done ``` ### Add resource limits for better performance ```yaml # Update deployment with enhanced resources resources: requests: memory: "128Mi" cpu: "200m" limits: memory: "256Mi" cpu: "500m" ``` ## π― Best Practices 1. **Security First**: Always prefer standard pod networking over hostNetwork 2. **Resource Management**: Set appropriate requests and limits 3. **Health Checks**: Use liveness and readiness probes 4. **Monitoring**: Implement proper logging and metrics collection 5. **Updates**: Use rolling updates for zero-downtime deployments 6. **Configuration**: Store configuration in ConfigMaps for flexibility ## π Complete NodePort Flow Explained ### Understanding the Full Request Path ``` βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β Step 1: User with Mycelium Network β β β’ Has Mycelium client running β β β’ Can reach Mycelium IPv6 addresses globally β β β’ Accesses: http://[worker-node-mycelium-ipv6]:30091 β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β Step 2: Mycelium Network Routes to Worker Node β β β’ Peer-to-peer IPv6 routing β β β’ No traditional DNS needed β β β’ Direct encrypted connection β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β Step 3: Worker Node Receives Request on Port 30091 β β β’ kube-proxy listens on NodePort 30091 β β β’ Forwards to Service cluster IP β β β’ Preserves source IPv6 (externalTrafficPolicy: Local) β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β Step 4: Kubernetes Service Load Balances β β β’ Service receives on port 8080 β β β’ Selects backend pod (app=nginx-nodeport) β β β’ Routes to targetPort 8080 β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β Step 5: nginx Pod Processes Request β β β’ Pod in isolated network namespace β β β’ nginx listens on container port 8080 β β β’ Serves HTML from ConfigMap β β β’ Returns response β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β Step 6: Response Returns to User β β β’ Same path in reverse β β β’ User sees website in browser β β β’ Access logs show original IPv6 (source IP preserved) β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ ``` ### Why NodePort is Better for Production **Security Benefits:** 1. Pods cannot access host network interfaces 2. Network policies can restrict pod-to-pod traffic 3. Resource limits prevent resource exhaustion 4. Health checks ensure reliability **Operational Benefits:** 1. Standard Kubernetes debugging tools work 2. Can scale horizontally (multiple replicas) 3. Service provides automatic load balancing 4. Compatible with monitoring stacks (Prometheus, etc.) 5. Can evolve to LoadBalancer or Ingress later **Mycelium Integration:** - Worker nodes have Mycelium IPv6 addresses - NodePort makes service accessible via these IPs - No need for traditional cloud load balancers - Perfect for decentralized web hosting ## οΏ½ Learning Outcomes After completing this example, you understand: - **NodePort Services** - Kubernetes service exposure patterns - **Network Security** - Pod isolation vs hostNetwork trade-offs - **Production Patterns** - Resource management and health checks - **IPv6 Networking** - Dual-stack nginx configuration - **ConfigMap Management** - Dynamic content and configuration updates - **Service Discovery** - Kubernetes service networking - **Load Balancing** - Service-level load distribution ## π Next Steps - **Multi-Replica Deployment**: Scale to 3+ replicas for high availability - **LoadBalancer Service**: Move to cloud LoadBalancer for production - **Ingress Controller**: Implement advanced routing and SSL termination - **Monitoring**: Add Prometheus metrics and Grafana dashboards - **SSL/TLS**: Implement HTTPS with Let's Encrypt certificates --- **Success Criteria**: You'll know everything is working when: - β `kubectl get pods` shows nginx-nodeport pod in "Running" status - β `kubectl get svc` shows nginx-nodeport-service with NodePort 30091 - β `curl -6 "http://[$NODE_IPV6]:30091"` returns your secure website - β Website displays "NODEPORT SECURE" and "ENHANCED SECURITY" badges - β `kubectl logs deployment/nginx-nodeport` shows nginx access logs **Access URL**: `http://[NODE-IPV6]:30091` (replace NODE-IPV6 with your node's IPv6 address)