Fix the Deployment
An inventory API never comes up on Kubernetes. Find and fix the bugs in its Deployment, Service and ConfigMap until the rollout finishes and the Service answers.
The situation
The inventory API was moved to Kubernetes on Friday. On Monday it is still not serving: the rollout never finishes, and the few times a pod looked healthy, nothing answered behind the Service. The person who wrote the manifests is on holiday.
The app itself is fine. It reads the store name from STORE_NAME and refuses to start without it, listens on port 8080, answers ok on GET /healthz and JSON with the store's stock on GET /. The manifests in k8s/ are where the bugs are, and there is more than one.
Your task
- The inventory-api Deployment rolls out with 2 of 2 replicas ready.
- The inventory-api Service routes to the pods.
- GET / on port 80 of the Service answers HTTP 200 for the store named in the ConfigMap.
- The pods stay up without restarts.
- Keep the image and its entrypoint, the 2 replicas, both HTTP probes, STORE_NAME from a ConfigMap, and the security settings: the namespace enforces Pod Security restricted.
What the grader checks
| Check | Passes when |
|---|---|
| The manifests apply | The files in k8s/ parse and apply, and only define the inventory-api Deployment and Service plus ConfigMaps. The image, the 2 replicas and both HTTP probes stay in place, STORE_NAME comes from a ConfigMap, and the pods meet Pod Security restricted (no root, no privileged mode, no host namespaces or host paths). Nothing is applied until these checks pass. |
| The rollout finishes | kubectl rollout status for deployment/inventory-api succeeds within 120 seconds, with 2 of 2 replicas ready. |
| The Service has endpoints | The inventory-api Service routes to at least one ready pod. |
| The Service answers | GET / on port 80 of the Service's cluster IP answers HTTP 200 with the store name from the ConfigMap. |
| The pods stay up | 30 seconds after the other checks: the URLs both probes call answer 2xx without a redirect, 2 of 2 replicas are still ready, and no container restarted. |
When a check fails, the grader's comment says what it saw, not how to fix it.
Files you may change
challenges/fix-the-deployment/k8s/*.yamlchallenges/fix-the-deployment/k8s/*.yml
A pull request that changes any other file, including the tests or the workflows, is not graded.
Hints
Start where Kubernetes tells you
kubectl get pods, then kubectl describe pod and read the Events at the bottom. kubectl logs shows what the app printed before it stopped.
A pod that runs but is never ready
Something decides when a pod is ready. Ask the app what it actually serves: port-forward to the Deployment and curl the paths the probes use.
Ready pods, but the Service does not answer
kubectl get endpointslices -l kubernetes.io/service-name=inventory-api shows which pods the Service sends traffic to, and on which port. Compare the Service with the pods it should select.
Test it locally
From the challenge folder, with Docker, kind and kubectl:
kind create cluster --name inventory
docker build -t devops-daily/inventory-api:1.0 app/
kind load docker-image devops-daily/inventory-api:1.0 --name inventory
kubectl create namespace challenge
kubectl label namespace challenge pod-security.kubernetes.io/enforce=restricted
kubectl apply -n challenge -f k8s/
kubectl -n challenge rollout status deployment/inventory-api --timeout=120s
kind delete cluster --name inventorySubmit
- Fork The-DevOps-Daily/challenges and create a branch.
- Commit your changes to the files listed above, and nothing else.
- Open a pull request against main in The-DevOps-Daily/challenges.
- Read the grader's comment. If a check fails, push another commit to the same branch and it grades again.
- When every check passes, the PR gets the passed label and is closed. It is never merged, and your pass is usually counted on this page within a few minutes.
The workflow takes the tests and the grader from the repository's main branch and copies only the files above out of your PR. Your code runs in a container or a throwaway kind cluster, and some inputs are random at grading time. A second workflow checks the result against your PR's real commit before it comments.
Learn the basics first
Exercise
Helm Charts and Kubernetes Package Management
Learn Kubernetes application deployment and management using Helm charts with templates, values, and lifecycle management.
90 minutes
Exercise
Kubernetes Horizontal Pod Autoscaler
Configure and test Horizontal Pod Autoscaler to automatically scale applications based on CPU and memory usage.
90 minutes
Guide
Introduction to Kubernetes
Learn Kubernetes 1.37 hands-on with kind: pods, Deployments, Services, Gateway API, ConfigMaps, Secrets, storage, autoscaling, monitoring and security.
More challenges
Docker · Starter
Shrink the Image
A tiny Flask app ships in a container image of more than 1 GB that runs as root. Rewrite the Dockerfile so the image is under 200 MB, runs as a normal user and still works.
About 30 min
Bash · Starter
Script It: Summarize an Access Log
Finish a half-written Bash script that turns an nginx access log into a short report: requests, status classes, top clients and top paths. ShellCheck has to be clean and the edge cases right.
About 45 min