Kubernetes for Developers — Deploy Your First App on EKS/GKE in 2026

# Install gcloud CLI: https://cloud.google.com/sdk/docs/install
gcloud auth login
gcloud config set project YOUR_PROJECT_ID

# Create Autopilot cluster in Mumbai region
gcloud container clusters create-auto my-cluster   --region asia-south1

# Get kubectl credentials
gcloud container clusters get-credentials my-cluster   --region asia-south1

# Verify connection
kubectl get nodes

# Install eksctl: https://eksctl.io/installation/
# Install kubectl: https://kubernetes.io/docs/tasks/tools/

eksctl create cluster   --name my-cluster   --region ap-south-1   --nodegroup-name workers   --node-type t3.medium   --nodes 2   --nodes-min 1   --nodes-max 4   --managed

# Updates kubeconfig automatically
kubectl get nodes

# Configure Docker to use gcloud credentials
gcloud auth configure-docker asia-south1-docker.pkg.dev

# Build and tag
docker build -t asia-south1-docker.pkg.dev/YOUR_PROJECT/my-app/api:v1 .

# Push
docker push asia-south1-docker.pkg.dev/YOUR_PROJECT/my-app/api:v1

apiVersion: v1
kind: Namespace
metadata:
  name: my-app
  labels:
    app: my-app

kubectl apply -f k8s/namespace.yaml

# Set as default so you don't have to type -n my-app every time
kubectl config set-context --current --namespace=my-app

apiVersion: v1
kind: ConfigMap
metadata:
  name: my-app-config
  namespace: my-app
data:
  NODE_ENV: "production"
  PORT: "3000"
  AWS_REGION: "ap-south-1"
  LOG_LEVEL: "info"

# Create Secret imperatively (values are base64-encoded automatically)
kubectl create secret generic my-app-secrets   --namespace my-app   --from-literal=DATABASE_URL="postgresql://user:pass@host:5432/db"   --from-literal=JWT_ACCESS_SECRET="$(openssl rand -hex 32)"   --from-literal=JWT_REFRESH_SECRET="$(openssl rand -hex 32)"

# View secrets (values are base64 encoded, not encrypted by default)
kubectl get secret my-app-secrets -o yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: my-app
  labels:
    app: my-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-app
  # Rolling update: bring up new pods before removing old ones
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1        # allow 1 extra pod during update
      maxUnavailable: 0  # never reduce below desired replicas
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: api
          image: asia-south1-docker.pkg.dev/YOUR_PROJECT/my-app/api:v1
          ports:
            - containerPort: 3000
          # Load non-secret config from ConfigMap
          envFrom:
            - configMapRef:
                name: my-app-config
          # Load secrets individually
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: my-app-secrets
                  key: DATABASE_URL
            - name: JWT_ACCESS_SECRET
              valueFrom:
                secretKeyRef:
                  name: my-app-secrets
                  key: JWT_ACCESS_SECRET
            - name: JWT_REFRESH_SECRET
              valueFrom:
                secretKeyRef:
                  name: my-app-secrets
                  key: JWT_REFRESH_SECRET
          # Resource requests and limits
          resources:
            requests:
              cpu: "100m"      # 0.1 CPU core
              memory: "128Mi"
            limits:
              cpu: "500m"      # 0.5 CPU core
              memory: "512Mi"
          # Liveness probe: restart pod if it stops responding
          livenessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 10
            periodSeconds: 30
            failureThreshold: 3
          # Readiness probe: don't send traffic until app is ready
          readinessProbe:
            httpGet:
              path: /health
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 10
            failureThreshold: 3

apiVersion: v1
kind: Service
metadata:
  name: my-app-service
  namespace: my-app
spec:
  # ClusterIP: internal only (use with Ingress)
  # LoadBalancer: creates a cloud load balancer (costs money, use sparingly)
  type: ClusterIP
  selector:
    app: my-app   # routes to pods with this label
  ports:
    - protocol: TCP
      port: 80        # Service port
      targetPort: 3000 # Pod port

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.10.0/deploy/static/provider/cloud/deploy.yaml

# Wait for it to get an external IP
kubectl get service ingress-nginx-controller -n ingress-nginx --watch

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app-ingress
  namespace: my-app
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    # TLS termination — cert-manager will provision the certificate
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.yourdomain.com
      secretName: my-app-tls
  rules:
    - host: api.yourdomain.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-app-service
                port:
                  number: 80

# Apply all manifests
kubectl apply -f k8s/

# Watch pods come up
kubectl get pods --watch

# Check deployment status
kubectl rollout status deployment/my-app

# View logs
kubectl logs -l app=my-app --tail=50

# Describe a pod (useful for debugging CrashLoopBackOff)
kubectl describe pod <pod-name>

# Get external IP of Ingress
kubectl get ingress my-app-ingress

# Build and push new image with new tag
docker build -t asia-south1-docker.pkg.dev/YOUR_PROJECT/my-app/api:v2 .
docker push asia-south1-docker.pkg.dev/YOUR_PROJECT/my-app/api:v2

# Update the deployment with new image
kubectl set image deployment/my-app   api=asia-south1-docker.pkg.dev/YOUR_PROJECT/my-app/api:v2

# Watch the rolling update
kubectl rollout status deployment/my-app

# View rollout history
kubectl rollout history deployment/my-app

# Rollback to previous version (immediate)
kubectl rollout undo deployment/my-app

# Rollback to specific revision
kubectl rollout undo deployment/my-app --to-revision=2

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: my-app-hpa
  namespace: my-app
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70   # scale up when avg CPU > 70%
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

# Apply HPA
kubectl apply -f k8s/hpa.yaml

# Watch scaling decisions
kubectl get hpa my-app-hpa --watch

# View current replica count and targets
kubectl describe hpa my-app-hpa