Why Every Cloud Engineer Should Learn Kubernetes in 2026

# cluster.yaml   Create with: eksctl create cluster -f cluster.yaml
# Note: managed clusters cost money; delete after practice.
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
metadata:
  name: course-cluster
  region: ap-south-1
managedNodeGroups:
  - name: general
    instanceType: t3.medium
    minSize: 1
    desiredCapacity: 2
    maxSize: 3
    privateNetworking: true
    labels: { role: general }

#!/usr/bin/env bash
# Practise Kubernetes concepts for free on a local cluster
set -euo pipefail
kind create cluster --name practice
kubectl get nodes
kubectl create deployment web --image=nginx:1.27 --replicas=2
kubectl expose deployment web --port=80 --type=NodePort
kubectl get pods,svc
# When done:
kind delete cluster --name practice

apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  type: LoadBalancer        # the cloud creates a load balancer
  selector:
    app: web
  ports:
    - port: 80
      targetPort: 8080
---
# Check with: kubectl get svc web -w
# EXTERNAL-IP stays <pending> until the cloud load balancer is ready

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
spec:
  accessModes: ["ReadWriteOnce"]
  storageClassName: gp3      # name depends on your cluster's storage classes
  resources:
    requests:
      storage: 10Gi
---
# Debug a pending claim:
#   kubectl get storageclass
#   kubectl describe pvc data      (read the Events section)

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
# Pods must set resources.requests.cpu for this to work.

# EKS IAM Roles for Service Accounts (IRSA) example
apiVersion: v1
kind: ServiceAccount
metadata:
  name: reports-reader
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/reports-read-only
---
# In the Deployment's pod spec:
#   serviceAccountName: reports-reader
# The pod then gets temporary credentials for that role only.

Project: Web app on a managed Kubernetes cluster

- Practise first on kind (free)
- Managed cluster created with eksctl or Terraform
- Deployment with probes and resource requests
- LoadBalancer Service or Ingress for traffic
- PersistentVolumeClaim for app data
- HPA scaling on CPU; node group min/max set
- Service account with a least-privilege cloud role
- README with diagram, cost note and teardown steps

Week 1  Kubernetes basics on kind: pods, deployments, services
Week 2  Probes, resources, ConfigMaps, Secrets
Week 3  Managed cluster: create, connect, delete
Week 4  LoadBalancer, Ingress, PVCs, troubleshooting
Week 5  HPA, node scaling, workload identity, project write-up

Before ending a practice session:

[ ] kubectl delete svc --all (removes cloud load balancers)
[ ] kubectl delete pvc --all (releases volumes)
[ ] Delete the cluster (eksctl delete cluster -f cluster.yaml)
[ ] Check for leftover load balancers and volumes in the console
[ ] Check the billing page