Capstone | Kubernetes | Data For Dummies

Picture it this way

You built one boat, gave it a phone number, a sticky note, and a health check. The capstone is that boat, plus a written list of the harbour rules you would add before real passengers arrive.

What you will apply

One Deployment with three replicas, requests, a readiness probe, and a ConfigMap for a plain setting. One ClusterIP Service. No LoadBalancer, because the local cluster may not give you one.

The image is a public nginx tag. Pin the tag you actually pulled. If the tag moves, your lab moves with it.

What this lab does not prove

It does not prove NetworkPolicy enforcement, encryption of Secrets at rest, a Gateway controller, or a cloud upgrade. The checklist below is the honest list. Tick an item only after you have seen it work on a cluster that can enforce it.

Before production	Done when
Restricted Pod Security on the namespace	A too-wide Pod is rejected or warned
NetworkPolicy on a CNI that enforces it	A denied path fails
Requests, limits, and a disruption budget	A drain does not take every Pod
An Ingress or Gateway with a real controller	A host answers without port-forward
A one-minor upgrade rehearsed off production	The app stayed ready

Lab versus production

Deployment
Service
ConfigMap

Step 1 of 3These three are enough for the local lab.

Lab: apply the app, then write the gap list

Apply the manifest. Port-forward. Then write five lines: what you would add for a managed cluster, and which lesson in this course covers it.

kubectl apply -f - <<'EOF'
apiVersion: v1
kind: ConfigMap
metadata:
  name: hello-config
data:
  MESSAGE: hello from the capstone
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
spec:
  replicas: 3
  selector:
    matchLabels: {app: hello}
  template:
    metadata:
      labels: {app: hello}
    spec:
      containers:
      - name: web
        image: nginx:1.27
        ports: [{containerPort: 80}]
        resources:
          requests: {cpu: 50m, memory: 64Mi}
          limits: {cpu: 200m, memory: 128Mi}
        readinessProbe:
          httpGet: {path: /, port: 80}
        env:
        - name: MESSAGE
          valueFrom:
            configMapKeyRef: {name: hello-config, key: MESSAGE}
---
apiVersion: v1
kind: Service
metadata:
  name: hello
spec:
  selector: {app: hello}
  ports: [{port: 80, targetPort: 80}]
EOF
kubectl rollout status deploy/hello
kubectl port-forward svc/hello 8080:80

Concept summary

The capstone app is a Deployment, a Service, and a ConfigMap.
Port-forward is the local door. It is not an Ingress.
The production list is unfinished until a cluster that can enforce it says so.

Knowledge check

Why is the capstone Service a ClusterIP?

Which item is not proved by a green rollout on kind?

What belongs in the written gap list?

Official sources

Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.