# AWS EKS: check available add-on and version information
aws eks describe-addon-versions --region eu-central-1 | jq '.addons[].addonName' | sort -u

# Azure AKS: check available versions per region
az aks get-versions --location westeurope -o table

# GKE: check available versions per region
gcloud container get-server-config --region europe-west3 --format=json | jq '.validMasterVersions[0:5]'

# DigitalOcean Kubernetes: check available options
doctl kubernetes options versions

# Linode/Akamai LKE: check available versions
linode-cli lke versions-list

sudo apt update
sudo apt install -y \
  ca-certificates curl gnupg lsb-release git jq unzip tar gzip \
  openssh-client openssl make bash-completion

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/kubectl
kubectl version --client

curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
helm version

sudo apt update
sudo apt install -y gnupg software-properties-common
wget -O- https://apt.releases.hashicorp.com/gpg | \
  gpg --dearmor | sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg >/dev/null

echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/hashicorp.list

sudo apt update
sudo apt install -y terraform
terraform version

# Check AWS CLI
aws --version
aws sts get-caller-identity

# Check eksctl
eksctl version

# Check Azure CLI
az version
az account show -o table

# Check Google Cloud CLI
gcloud version
gcloud auth list

# Check DigitalOcean CLI
doctl version
doctl account get

# Check Linode CLI
linode-cli --version
linode-cli profile view

# Check Oracle Cloud CLI
oci --version
oci iam region list --all

# Check IBM Cloud CLI
ibmcloud version
ibmcloud account show

export CLOUD_PROVIDER="aws"                 # aws, azure, gcp, digitalocean, linode, oci, ibm, civo, vultr, scaleway, hetzner
export CLUSTER_MODE="managed"               # managed, autopilot, terraform, vm-kubeadm, vm-k3s, vm-rke2, vm-k0s, talos
export CLUSTER_NAME="k8s-workshop-cloud"
export REGION="eu-central-1"
export RESOURCE_GROUP="rg-k8s-workshop"
export PROJECT_ID="my-gcp-project"
export NODE_COUNT="2"
export NODE_SIZE="small"
export K8S_VERSION=""
export OWNER="your.name@example.com"
export TTL="8h"
export ENVIRONMENT="workshop"

# Only show what would happen
bash cloud-kubernetes-provision.sh --provider aws --mode managed --cluster workshop-eks

# Actually create EKS with eksctl
bash cloud-kubernetes-provision.sh \
  --provider aws \
  --mode managed \
  --cluster workshop-eks \
  --region eu-central-1 \
  --nodes 2 \
  --node-size t3.medium \
  --execute

# Actually create AKS
bash cloud-kubernetes-provision.sh \
  --provider azure \
  --mode managed \
  --cluster workshop-aks \
  --region westeurope \
  --resource-group rg-workshop-aks \
  --nodes 2 \
  --node-size Standard_B2s \
  --execute

# Actually create GKE Autopilot
bash cloud-kubernetes-provision.sh \
  --provider gcp \
  --mode autopilot \
  --cluster workshop-gke \
  --region europe-west3 \
  --project my-gcp-project \
  --execute

# Create DigitalOcean Kubernetes
bash cloud-kubernetes-provision.sh \
  --provider digitalocean \
  --mode managed \
  --cluster workshop-doks \
  --region fra1 \
  --nodes 2 \
  --node-size s-2vcpu-4gb \
  --execute

# Validate cluster
bash cloud-kubernetes-provision.sh --provider aws --action validate --cluster workshop-eks --region eu-central-1

# Delete cluster
bash cloud-kubernetes-provision.sh --provider aws --action delete --cluster workshop-eks --region eu-central-1 --execute

#!/usr/bin/env bash
set -Eeuo pipefail

# Cloud Kubernetes provisioning for workshops.
# Default: dry-run. Real execution only with --execute.

ACTION="create"
PROVIDER="${CLOUD_PROVIDER:-aws}"
MODE="${CLUSTER_MODE:-managed}"
CLUSTER_NAME="${CLUSTER_NAME:-k8s-workshop-cloud}"
REGION="${REGION:-eu-central-1}"
RESOURCE_GROUP="${RESOURCE_GROUP:-rg-k8s-workshop}"
PROJECT_ID="${PROJECT_ID:-}"
NODE_COUNT="${NODE_COUNT:-2}"
NODE_SIZE="${NODE_SIZE:-}"
K8S_VERSION="${K8S_VERSION:-}"
OWNER="${OWNER:-unknown}"
TTL="${TTL:-8h}"
ENVIRONMENT="${ENVIRONMENT:-workshop}"
DRY_RUN="true"

log() { printf '[%s] %s\n' "$(date +%H:%M:%S)" "$*"; }
fail() { printf 'ERROR: %s\n' "$*" >&2; exit 1; }
need() { command -v "$1" >/dev/null 2>&1 || fail "Required command is missing: $1"; }

run() {
  if [[ "$DRY_RUN" == "true" ]]; then
    printf '[dry-run] %s\n' "$*"
  else
    log "Executing: $*"
    "$@"
  fi
}

usage() {
  cat <<'USAGE'
Usage:
  cloud-kubernetes-provision.sh [options]

Options:
  --provider <aws|azure|gcp|digitalocean|linode|oci|ibm|civo|vultr|scaleway|hetzner>
  --mode <managed|autopilot|terraform|vm-kubeadm|vm-k3s|vm-rke2|vm-k0s|talos>
  --action <create|validate|delete|versions|kubeconfig>
  --cluster <name>
  --region <region>
  --resource-group <name>       Azure Resource Group
  --project <id>                Google Cloud Project ID
  --nodes <count>
  --node-size <size>
  --k8s-version <version>
  --owner <name or email>
  --ttl <duration>
  --environment <name>
  --execute                     Disable dry-run
  -h, --help

Examples:
  ./cloud-kubernetes-provision.sh --provider aws --mode managed --cluster demo
  ./cloud-kubernetes-provision.sh --provider azure --mode managed --cluster demo --execute
  ./cloud-kubernetes-provision.sh --provider gcp --mode autopilot --cluster demo --project my-project --execute
USAGE
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --provider) PROVIDER="$2"; shift 2 ;;
    --mode) MODE="$2"; shift 2 ;;
    --action) ACTION="$2"; shift 2 ;;
    --cluster) CLUSTER_NAME="$2"; shift 2 ;;
    --region) REGION="$2"; shift 2 ;;
    --resource-group) RESOURCE_GROUP="$2"; shift 2 ;;
    --project) PROJECT_ID="$2"; shift 2 ;;
    --nodes) NODE_COUNT="$2"; shift 2 ;;
    --node-size) NODE_SIZE="$2"; shift 2 ;;
    --k8s-version) K8S_VERSION="$2"; shift 2 ;;
    --owner) OWNER="$2"; shift 2 ;;
    --ttl) TTL="$2"; shift 2 ;;
    --environment) ENVIRONMENT="$2"; shift 2 ;;
    --execute) DRY_RUN="false"; shift ;;
    -h|--help) usage; exit 0 ;;
    *) fail "Unknown option: $1" ;;
  esac
 done

print_context() {
  cat <<EOF
Context:
  Provider:      $PROVIDER
  Mode:          $MODE
  Action:        $ACTION
  Cluster:       $CLUSTER_NAME
  Region:        $REGION
  ResourceGroup: $RESOURCE_GROUP
  Project:       ${PROJECT_ID:-not set}
  Nodes:         $NODE_COUNT
  Node Size:     ${NODE_SIZE:-provider-default}
  K8s Version:   ${K8S_VERSION:-provider-default}
  Owner:         $OWNER
  TTL:           $TTL
  Environment:   $ENVIRONMENT
  Dry-Run:       $DRY_RUN
EOF
}

common_validate() {
  need kubectl
  run kubectl cluster-info
  run kubectl get nodes -o wide
  run kubectl get namespaces
  run kubectl get pods -A
}

aws_default_node_size() { [[ -n "$NODE_SIZE" ]] && printf '%s' "$NODE_SIZE" || printf 't3.medium'; }
azure_default_node_size() { [[ -n "$NODE_SIZE" ]] && printf '%s' "$NODE_SIZE" || printf 'Standard_B2s'; }
gcp_default_node_size() { [[ -n "$NODE_SIZE" ]] && printf '%s' "$NODE_SIZE" || printf 'e2-standard-2'; }
do_default_node_size() { [[ -n "$NODE_SIZE" ]] && printf '%s' "$NODE_SIZE" || printf 's-2vcpu-4gb'; }
linode_default_node_size() { [[ -n "$NODE_SIZE" ]] && printf '%s' "$NODE_SIZE" || printf 'g6-standard-2'; }

aws_versions() {
  need aws
  run aws eks describe-addon-versions --region "$REGION"
}

aws_kubeconfig() {
  need aws
  run aws eks update-kubeconfig --region "$REGION" --name "$CLUSTER_NAME"
}

aws_create_managed() {
  need eksctl
  local size; size="$(aws_default_node_size)"
  local args=(eksctl create cluster --name "$CLUSTER_NAME" --region "$REGION" --nodes "$NODE_COUNT" --node-type "$size" --managed)
  [[ -n "$K8S_VERSION" ]] && args+=(--version "$K8S_VERSION")
  args+=(--tags "owner=$OWNER,environment=$ENVIRONMENT,ttl=$TTL")
  run "${args[@]}"
  aws_kubeconfig
}

aws_create_autopilot() {
  need aws
  cat <<'INFO'
EKS Auto Mode requires several IAM, networking, and cluster parameters. For production-like usage, a dedicated IaC module is recommended.
This script intentionally does not create a half-complete Auto Mode cluster. Use the AWS chapter in the Markdown file or Terraform.
INFO
}

aws_delete() {
  if command -v eksctl >/dev/null 2>&1; then
    run eksctl delete cluster --name "$CLUSTER_NAME" --region "$REGION"
  else
    need aws
    run aws eks delete-cluster --name "$CLUSTER_NAME" --region "$REGION"
  fi
}

azure_versions() {
  need az
  run az aks get-versions --location "$REGION" -o table
}

azure_kubeconfig() {
  need az
  run az aks get-credentials --resource-group "$RESOURCE_GROUP" --name "$CLUSTER_NAME" --overwrite-existing
}

azure_create_managed() {
  need az
  local size; size="$(azure_default_node_size)"
  run az group create --name "$RESOURCE_GROUP" --location "$REGION" --tags owner="$OWNER" environment="$ENVIRONMENT" ttl="$TTL"
  local args=(az aks create --resource-group "$RESOURCE_GROUP" --name "$CLUSTER_NAME" --location "$REGION" --node-count "$NODE_COUNT" --node-vm-size "$size" --generate-ssh-keys --enable-managed-identity --tags owner="$OWNER" environment="$ENVIRONMENT" ttl="$TTL")
  [[ -n "$K8S_VERSION" ]] && args+=(--kubernetes-version "$K8S_VERSION")
  run "${args[@]}"
  azure_kubeconfig
}

azure_create_autopilot() {
  need az
  cat <<'INFO'
AKS Automatic has its own requirements and options, which may change quickly.
Use the AKS Automatic chapter as a baseline and check the current Azure CLI help before execution: az aks create --help
INFO
}

azure_delete() {
  need az
  run az aks delete --resource-group "$RESOURCE_GROUP" --name "$CLUSTER_NAME" --yes --no-wait
}

gcp_versions() {
  need gcloud
  [[ -n "$PROJECT_ID" ]] && run gcloud config set project "$PROJECT_ID"
  run gcloud container get-server-config --region "$REGION" --format=json
}

gcp_kubeconfig() {
  need gcloud
  [[ -n "$PROJECT_ID" ]] && run gcloud config set project "$PROJECT_ID"
  run gcloud container clusters get-credentials "$CLUSTER_NAME" --region "$REGION"
}

gcp_create_managed() {
  need gcloud
  [[ -n "$PROJECT_ID" ]] && run gcloud config set project "$PROJECT_ID"
  local size; size="$(gcp_default_node_size)"
  local args=(gcloud container clusters create "$CLUSTER_NAME" --region "$REGION" --num-nodes "$NODE_COUNT" --machine-type "$size" --labels "owner=$OWNER,environment=$ENVIRONMENT,ttl=$TTL")
  [[ -n "$K8S_VERSION" ]] && args+=(--cluster-version "$K8S_VERSION")
  run "${args[@]}"
  gcp_kubeconfig
}

gcp_create_autopilot() {
  need gcloud
  [[ -n "$PROJECT_ID" ]] && run gcloud config set project "$PROJECT_ID"
  local args=(gcloud container clusters create-auto "$CLUSTER_NAME" --region "$REGION" --labels "owner=$OWNER,environment=$ENVIRONMENT,ttl=$TTL")
  [[ -n "$K8S_VERSION" ]] && args+=(--cluster-version "$K8S_VERSION")
  run "${args[@]}"
  gcp_kubeconfig
}

gcp_delete() {
  need gcloud
  [[ -n "$PROJECT_ID" ]] && run gcloud config set project "$PROJECT_ID"
  run gcloud container clusters delete "$CLUSTER_NAME" --region "$REGION" --quiet
}

do_versions() {
  need doctl
  run doctl kubernetes options versions
}

do_kubeconfig() {
  need doctl
  run doctl kubernetes cluster kubeconfig save "$CLUSTER_NAME"
}

do_create_managed() {
  need doctl
  local size; size="$(do_default_node_size)"
  local args=(doctl kubernetes cluster create "$CLUSTER_NAME" --region "$REGION" --size "$size" --count "$NODE_COUNT" --tag "owner:$OWNER" --tag "environment:$ENVIRONMENT" --tag "ttl:$TTL")
  [[ -n "$K8S_VERSION" ]] && args+=(--version "$K8S_VERSION")
  run "${args[@]}"
  do_kubeconfig
}

do_delete() {
  need doctl
  run doctl kubernetes cluster delete "$CLUSTER_NAME" --dangerous --force
}

linode_versions() {
  need linode-cli
  run linode-cli lke versions-list
}

linode_create_managed() {
  need linode-cli
  local size; size="$(linode_default_node_size)"
  [[ -z "$K8S_VERSION" ]] && fail "For LKE you must set --k8s-version. Available versions: linode-cli lke versions-list"
  run linode-cli lke cluster-create --label "$CLUSTER_NAME" --region "$REGION" --k8s_version "$K8S_VERSION" --node_pools.type "$size" --node_pools.count "$NODE_COUNT" --tags "$ENVIRONMENT" --tags "$OWNER"
  cat <<'INFO'
Note: Afterwards, determine the cluster ID with:
  linode-cli lke clusters-list
and save the kubeconfig with:
  linode-cli lke kubeconfig-view <cluster-id> --text | base64 -d > ./kubeconfig-lke.yaml
  export KUBECONFIG="$PWD/kubeconfig-lke.yaml"
INFO
}

linode_delete() {
  need linode-cli
  cat <<'INFO'
LKE deletion requires the cluster ID, not only the label:
  linode-cli lke clusters-list
  linode-cli lke cluster-delete <cluster-id>
INFO
}

oci_create_hint() {
  need oci
  cat <<'INFO'
OKE requires compartment, VCN, and subnet OCIDs. Set these values deliberately before creating clusters.
Example:
  oci ce cluster create \
    --compartment-id "$OCI_COMPARTMENT_ID" \
    --name "$CLUSTER_NAME" \
    --kubernetes-version "$K8S_VERSION" \
    --vcn-id "$OCI_VCN_ID" \
    --endpoint-subnet-id "$OCI_ENDPOINT_SUBNET_ID" \
    --service-lb-subnet-ids '["ocid1.subnet..."]'
INFO
}

ibm_create_hint() {
  need ibmcloud
  cat <<'INFO'
IBM Cloud Kubernetes Service uses the ks plugin. Install and check it first:
  ibmcloud plugin install container-service
  ibmcloud ks cluster versions
  ibmcloud ks cluster create --help
INFO
}

terraform_hint() {
  need terraform
  mkdir -p "generated/$PROVIDER-$CLUSTER_NAME"
  cat > "generated/$PROVIDER-$CLUSTER_NAME/README.md" <<EOF
# Terraform starting point for $PROVIDER / $CLUSTER_NAME

This directory was generated as a placeholder. Add provider, networking, and cluster resources based on the provider chapter.

Recommended workflow:

\`\`\`bash
terraform init
terraform fmt -recursive
terraform validate
terraform plan
terraform apply
\`\`\`
EOF
  log "Terraform starting point: generated/$PROVIDER-$CLUSTER_NAME"
}

vm_hint() {
  cat <<EOF
Mode $MODE requires cloud VMs, SSH access, firewall rules, and internal IP addresses first.
After that, use the chapter on VM-based cloud clusters:
  - kubeadm: full Kubernetes bootstrap
  - k3s/RKE2/k0s: lighter distributions
  - Talos: declarative OS and cluster operation
EOF
}

create() {
  case "$MODE" in
    terraform) terraform_hint ;;
    vm-kubeadm|vm-k3s|vm-rke2|vm-k0s|talos) vm_hint ;;
    managed)
      case "$PROVIDER" in
        aws) aws_create_managed ;;
        azure) azure_create_managed ;;
        gcp) gcp_create_managed ;;
        digitalocean) do_create_managed ;;
        linode) linode_create_managed ;;
        oci) oci_create_hint ;;
        ibm) ibm_create_hint ;;
        *) fail "Managed mode for provider '$PROVIDER' is not directly implemented in this script. Use the provider chapter or Terraform." ;;
      esac ;;
    autopilot)
      case "$PROVIDER" in
        aws) aws_create_autopilot ;;
        azure) azure_create_autopilot ;;
        gcp) gcp_create_autopilot ;;
        *) fail "Autopilot/Automatic mode is not defined for '$PROVIDER'." ;;
      esac ;;
    *) fail "Unknown mode: $MODE" ;;
  esac
}

versions() {
  case "$PROVIDER" in
    aws) aws_versions ;;
    azure) azure_versions ;;
    gcp) gcp_versions ;;
    digitalocean) do_versions ;;
    linode) linode_versions ;;
    *) log "No version query is implemented for provider '$PROVIDER'. Use the provider CLI help." ;;
  esac
}

kubeconfig() {
  case "$PROVIDER" in
    aws) aws_kubeconfig ;;
    azure) azure_kubeconfig ;;
    gcp) gcp_kubeconfig ;;
    digitalocean) do_kubeconfig ;;
    linode) linode_create_managed ;;
    *) fail "kubeconfig action is not implemented for '$PROVIDER'." ;;
  esac
}

delete() {
  case "$PROVIDER" in
    aws) aws_delete ;;
    azure) azure_delete ;;
    gcp) gcp_delete ;;
    digitalocean) do_delete ;;
    linode) linode_delete ;;
    *) fail "Delete action is not implemented for '$PROVIDER'. Use the provider chapter and manually check remaining resources." ;;
  esac
}

print_context

case "$ACTION" in
  create) create ;;
  validate) common_validate ;;
  delete) delete ;;
  versions) versions ;;
  kubeconfig) kubeconfig ;;
  *) fail "Unknown action: $ACTION" ;;
esac

export AWS_REGION="eu-central-1"
export CLUSTER_NAME="workshop-eks"

aws sts get-caller-identity

eksctl create cluster \
  --name "$CLUSTER_NAME" \
  --region "$AWS_REGION" \
  --nodes 2 \
  --node-type t3.medium \
  --managed \
  --tags owner="$USER",environment=workshop,ttl=8h

aws eks update-kubeconfig \
  --region "$AWS_REGION" \
  --name "$CLUSTER_NAME"

kubectl get nodes -o wide

eksctl delete cluster \
  --name "$CLUSTER_NAME" \
  --region "$AWS_REGION"

aws elbv2 describe-load-balancers --region "$AWS_REGION" | jq '.LoadBalancers[].LoadBalancerName'
aws ec2 describe-volumes --region "$AWS_REGION" --filters Name=status,Values=available | jq '.Volumes[].VolumeId'
aws ec2 describe-addresses --region "$AWS_REGION" | jq '.Addresses[].PublicIp'

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: workshop-eks
  region: eu-central-1
  tags:
    owner: workshop
    environment: lab
    ttl: "8h"

managedNodeGroups:
  - name: system
    instanceType: t3.medium
    desiredCapacity: 2
    minSize: 1
    maxSize: 3
    volumeSize: 40
    privateNetworking: true

eksctl create cluster -f eksctl-workshop.yaml

# 1. Create an IAM role for the EKS control plane.
# 2. Provision VPC, subnets, security groups, and routing.
# 3. Create the EKS cluster.
# 4. Create a node group or Fargate profile.
# 5. Write kubeconfig.
# 6. Check add-ons.

aws eks create-cluster \
  --region eu-central-1 \
  --name workshop-eks \
  --role-arn arn:aws:iam::<account-id>:role/EKSClusterRole \
  --resources-vpc-config subnetIds=subnet-a,subnet-b,securityGroupIds=sg-a,endpointPublicAccess=true,endpointPrivateAccess=true

aws eks wait cluster-active \
  --region eu-central-1 \
  --name workshop-eks

aws eks update-kubeconfig \
  --region eu-central-1 \
  --name workshop-eks

aws eks create-nodegroup \
  --region eu-central-1 \
  --cluster-name workshop-eks \
  --nodegroup-name system \
  --node-role arn:aws:iam::<account-id>:role/EKSNodeRole \
  --subnets subnet-a subnet-b \
  --scaling-config minSize=1,maxSize=3,desiredSize=2 \
  --instance-types t3.medium \
  --disk-size 40

eksctl create fargateprofile \
  --cluster workshop-eks \
  --region eu-central-1 \
  --name fp-demo \
  --namespace demo

infra/aws-eks/
├── versions.tf
├── providers.tf
├── variables.tf
├── network.tf
├── eks.tf
├── outputs.tf
└── terraform.tfvars.example

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 21.0"

  name               = var.cluster_name
  kubernetes_version = var.kubernetes_version

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  eks_managed_node_groups = {
    system = {
      instance_types = ["t3.medium"]
      min_size       = 1
      max_size       = 3
      desired_size   = 2
    }
  }

  tags = var.tags
}

terraform init
terraform fmt -recursive
terraform validate
terraform plan -out tfplan
terraform apply tfplan
aws eks update-kubeconfig --region eu-central-1 --name workshop-eks
kubectl get nodes -o wide

export KOPS_STATE_STORE=s3://my-kops-state-store
export NAME=workshop.example.com

kops create cluster \
  --name "$NAME" \
  --zones eu-central-1a,eu-central-1b,eu-central-1c \
  --node-count 2 \
  --node-size t3.medium \
  --control-plane-size t3.medium \
  --dns-zone example.com

kops update cluster --name "$NAME" --yes --admin
kops validate cluster --wait 10m

kops delete cluster --name "$NAME" --yes

sudo kubeadm init \
  --control-plane-endpoint "api.workshop.internal:6443" \
  --pod-network-cidr "10.244.0.0/16" \
  --upload-certs

mkdir -p "$HOME/.kube"
sudo cp /etc/kubernetes/admin.conf "$HOME/.kube/config"
sudo chown "$(id -u):$(id -g)" "$HOME/.kube/config"

kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

rosa login
rosa verify quota
rosa create account-roles --mode auto --hosted-cp
rosa create cluster --hosted-cp --cluster-name workshop-rosa --region eu-central-1
rosa describe cluster --cluster workshop-rosa

export LOCATION="westeurope"
export RESOURCE_GROUP="rg-workshop-aks"
export CLUSTER_NAME="workshop-aks"

az login
az account show -o table

az group create \
  --name "$RESOURCE_GROUP" \
  --location "$LOCATION" \
  --tags owner="$USER" environment=workshop ttl=8h

az aks create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$CLUSTER_NAME" \
  --location "$LOCATION" \
  --node-count 2 \
  --node-vm-size Standard_B2s \
  --generate-ssh-keys \
  --enable-managed-identity \
  --tags owner="$USER" environment=workshop ttl=8h

az aks get-credentials \
  --resource-group "$RESOURCE_GROUP" \
  --name "$CLUSTER_NAME" \
  --overwrite-existing

kubectl get nodes -o wide

export ACR_NAME="acrworkshop$RANDOM"

az acr create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$ACR_NAME" \
  --sku Basic

az aks update \
  --resource-group "$RESOURCE_GROUP" \
  --name "$CLUSTER_NAME" \
  --attach-acr "$ACR_NAME"

az aks nodepool add \
  --resource-group "$RESOURCE_GROUP" \
  --cluster-name "$CLUSTER_NAME" \
  --name apps \
  --node-count 2 \
  --node-vm-size Standard_D2s_v5 \
  --labels workload=apps \
  --tags owner="$USER" environment=workshop

kubectl get nodes --show-labels

resource "azurerm_resource_group" "this" {
  name     = var.resource_group_name
  location = var.location
  tags     = var.tags
}

resource "azurerm_kubernetes_cluster" "this" {
  name                = var.cluster_name
  location            = azurerm_resource_group.this.location
  resource_group_name = azurerm_resource_group.this.name
  dns_prefix          = var.cluster_name
  kubernetes_version  = var.kubernetes_version

  default_node_pool {
    name       = "system"
    node_count = 2
    vm_size    = "Standard_B2s"
  }

  identity {
    type = "SystemAssigned"
  }

  tags = var.tags
}

terraform init
terraform validate
terraform plan -out tfplan
terraform apply tfplan
az aks get-credentials --resource-group rg-workshop-aks --name workshop-aks --overwrite-existing
kubectl get nodes -o wide

az network vnet create \
  --resource-group "$RESOURCE_GROUP" \
  --name vnet-k8s \
  --address-prefixes 10.50.0.0/16 \
  --subnet-name subnet-k8s \
  --subnet-prefixes 10.50.1.0/24

az vm create \
  --resource-group "$RESOURCE_GROUP" \
  --name cp-1 \
  --image Ubuntu2404 \
  --size Standard_B2s \
  --vnet-name vnet-k8s \
  --subnet subnet-k8s \
  --admin-username azureuser \
  --generate-ssh-keys

az aks delete \
  --resource-group "$RESOURCE_GROUP" \
  --name "$CLUSTER_NAME" \
  --yes --no-wait

# For dedicated workshop Resource Groups, deleting the entire group is often cleaner:
az group delete \
  --name "$RESOURCE_GROUP" \
  --yes --no-wait

az resource list --resource-group "$RESOURCE_GROUP" -o table

export PROJECT_ID="my-gcp-project"
export REGION="europe-west3"
export CLUSTER_NAME="workshop-gke"

gcloud auth login
gcloud config set project "$PROJECT_ID"
gcloud services enable container.googleapis.com compute.googleapis.com iam.googleapis.com

gcloud container clusters create-auto "$CLUSTER_NAME" \
  --region "$REGION" \
  --labels owner="$USER",environment=workshop,ttl=8h

gcloud container clusters get-credentials "$CLUSTER_NAME" \
  --region "$REGION"

kubectl get nodes -o wide

gcloud container clusters create "$CLUSTER_NAME" \
  --region "$REGION" \
  --num-nodes 1 \
  --machine-type e2-standard-2 \
  --enable-ip-alias \
  --labels owner="$USER",environment=workshop,ttl=8h

gcloud container clusters get-credentials "$CLUSTER_NAME" \
  --region "$REGION"

kubectl get nodes -o wide
gcloud container node-pools list --cluster "$CLUSTER_NAME" --region "$REGION"

gcloud container node-pools create apps \
  --cluster "$CLUSTER_NAME" \
  --region "$REGION" \
  --machine-type e2-standard-2 \
  --num-nodes 1 \
  --node-labels workload=apps

resource "google_container_cluster" "this" {
  name     = var.cluster_name
  location = var.region

  remove_default_node_pool = true
  initial_node_count       = 1

  release_channel {
    channel = "REGULAR"
  }

  ip_allocation_policy {}
}

resource "google_container_node_pool" "system" {
  name       = "system"
  location   = var.region
  cluster    = google_container_cluster.this.name
  node_count = 2

  node_config {
    machine_type = "e2-standard-2"
    labels = {
      workload = "system"
    }
  }
}

gcloud compute networks create k8s-workshop --subnet-mode custom

gcloud compute networks subnets create k8s-workshop-eu \
  --network k8s-workshop \
  --region "$REGION" \
  --range 10.60.1.0/24

gcloud compute firewall-rules create k8s-workshop-ssh \
  --network k8s-workshop \
  --allow tcp:22

gcloud compute instances create cp-1 \
  --zone europe-west3-a \
  --machine-type e2-standard-2 \
  --image-family ubuntu-2404-lts-amd64 \
  --image-project ubuntu-os-cloud \
  --subnet k8s-workshop-eu

gcloud container clusters delete "$CLUSTER_NAME" \
  --region "$REGION" \
  --quiet

# Check remaining resources
gcloud compute forwarding-rules list
gcloud compute disks list
gcloud compute addresses list

export CLUSTER_NAME="workshop-doks"
export REGION="fra1"

doctl auth init
doctl kubernetes options regions
doctl kubernetes options sizes
doctl kubernetes options versions

doctl kubernetes cluster create "$CLUSTER_NAME" \
  --region "$REGION" \
  --size s-2vcpu-4gb \
  --count 2 \
  --tag environment:workshop \
  --tag ttl:8h

doctl kubernetes cluster kubeconfig save "$CLUSTER_NAME"
kubectl get nodes -o wide

doctl kubernetes cluster delete "$CLUSTER_NAME" --dangerous --force

export CLUSTER_NAME="workshop-lke"
export REGION="eu-central"
export K8S_VERSION="<version-from-linode-cli-lke-versions-list>"

linode-cli lke versions-list
linode-cli regions list

linode-cli lke cluster-create \
  --label "$CLUSTER_NAME" \
  --region "$REGION" \
  --k8s_version "$K8S_VERSION" \
  --node_pools.type g6-standard-2 \
  --node_pools.count 2 \
  --tags workshop

linode-cli lke clusters-list

# Then insert the cluster ID:
linode-cli lke kubeconfig-view <cluster-id> --text | base64 -d > kubeconfig-lke.yaml
export KUBECONFIG="$PWD/kubeconfig-lke.yaml"
kubectl get nodes -o wide

linode-cli lke cluster-delete <cluster-id>

export OCI_COMPARTMENT_ID="ocid1.compartment..."
export OCI_VCN_ID="ocid1.vcn..."
export OCI_ENDPOINT_SUBNET_ID="ocid1.subnet..."
export OCI_LB_SUBNET_ID="ocid1.subnet..."
export CLUSTER_NAME="workshop-oke"
export K8S_VERSION="<supported-version>"

oci ce cluster create \
  --compartment-id "$OCI_COMPARTMENT_ID" \
  --name "$CLUSTER_NAME" \
  --kubernetes-version "$K8S_VERSION" \
  --vcn-id "$OCI_VCN_ID" \
  --endpoint-subnet-id "$OCI_ENDPOINT_SUBNET_ID" \
  --service-lb-subnet-ids "[\"$OCI_LB_SUBNET_ID\"]"

ibmcloud login --sso
ibmcloud plugin install container-service
ibmcloud ks cluster versions
ibmcloud ks locations
ibmcloud ks flavors

# Example structure; adjust exact options to account, region, VPC, and cluster type:
ibmcloud ks cluster create vpc-gen2 \
  --name workshop-iks \
  --zone eu-de-1 \
  --flavor bx2.4x16 \
  --workers 2

ibmcloud ks cluster config --cluster workshop-iks
kubectl get nodes -o wide

ibmcloud ks cluster rm --cluster workshop-iks

civo apikey add workshop <api-key>
civo apikey current workshop
civo region ls
civo kubernetes versions

civo kubernetes create workshop-civo \
  --region FRA1 \
  --nodes 2 \
  --size g4s.kube.medium \
  --save \
  --switch

kubectl get nodes -o wide

civo kubernetes delete workshop-civo --yes

vultr-cli account info
vultr-cli kubernetes versions
vultr-cli regions list

vultr-cli kubernetes create \
  --region fra \
  --label workshop-vke \
  --version <version> \
  --node-pools '[{"node_quantity":2,"label":"system","node_plan":"vc2-2c-4gb"}]'

vultr-cli kubernetes list
vultr-cli kubernetes config <cluster-id> > kubeconfig-vke.yaml
export KUBECONFIG="$PWD/kubeconfig-vke.yaml"
kubectl get nodes -o wide

vultr-cli kubernetes delete <cluster-id>

scw init
scw k8s version list
scw k8s cluster create \
  name=workshop-kapsule \
  region=fr-par \
  version=<version> \
  cni=cilium

scw k8s pool create \
  cluster-id=<cluster-id> \
  name=system \
  node-type=DEV1-M \
  size=2

scw k8s kubeconfig get <cluster-id> > kubeconfig-scaleway.yaml
export KUBECONFIG="$PWD/kubeconfig-scaleway.yaml"
kubectl get nodes -o wide

scw k8s cluster delete <cluster-id> with-additional-resources=true

# Typical IaC path:
terraform init
terraform plan
terraform apply

# Then write kubeconfig from output or provider resource and validate:
kubectl get nodes -o wide

aliyun configure
aliyun cs GET /api/v1/clusters

# Cluster creation requires VPC, subnets, worker configuration, and RAM roles depending on the mode.
# For reproducible environments, prefer Terraform or the official ACK CLI examples.

tccli configure

tccli tke DescribeClusters

# For reproducible environments, prefer Terraform or an approved organizational module.

export HCLOUD_TOKEN="<token>"
hcloud server-type list
hcloud image list

hcloud server create \
  --name cp-1 \
  --type cx22 \
  --image ubuntu-24.04 \
  --location fsn1 \
  --ssh-key <ssh-key-name> \
  --label environment=workshop \
  --label ttl=8h

hcloud server list

hcloud server delete cp-1 worker-1 worker-2
hcloud load-balancer list
hcloud volume list

sudo swapoff -a
sudo sed -i.bak '/ swap / s/^/#/' /etc/fstab

cat <<EOF | sudo tee /etc/modules-load.d/k8s.conf
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

cat <<EOF | sudo tee /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF

sudo sysctl --system

sudo apt update
sudo apt install -y containerd
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml >/dev/null
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
sudo systemctl restart containerd
sudo systemctl enable containerd

sudo apt update
sudo apt install -y apt-transport-https ca-certificates curl gpg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key | \
  sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.36/deb/ /' | \
  sudo tee /etc/apt/sources.list.d/kubernetes.list

sudo apt update
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

sudo kubeadm init \
  --control-plane-endpoint "api.k8s.internal:6443" \
  --pod-network-cidr "10.244.0.0/16" \
  --upload-certs

mkdir -p "$HOME/.kube"
sudo cp /etc/kubernetes/admin.conf "$HOME/.kube/config"
sudo chown "$(id -u):$(id -g)" "$HOME/.kube/config"

kubectl apply -f https://raw.githubusercontent.com/flannel-io/flannel/master/Documentation/kube-flannel.yml

helm repo add cilium https://helm.cilium.io/
helm repo update
helm install cilium cilium/cilium \
  --namespace kube-system \
  --set kubeProxyReplacement=false

sudo kubeadm join api.k8s.internal:6443 \
  --token <token> \
  --discovery-token-ca-cert-hash sha256:<hash>

curl -sfL https://get.k3s.io | sh -
sudo k3s kubectl get nodes
sudo cat /etc/rancher/k3s/k3s.yaml

export K3S_TOKEN="$(openssl rand -hex 24)"
curl -sfL https://get.k3s.io | \
  K3S_TOKEN="$K3S_TOKEN" \
  sh -s - server --cluster-init

curl -sfL https://get.k3s.io | \
  K3S_URL="https://<server-ip>:6443" \
  K3S_TOKEN="<token>" \
  sh -

curl -sfL https://get.rke2.io | sudo sh -
sudo systemctl enable rke2-server.service
sudo systemctl start rke2-server.service
sudo journalctl -u rke2-server -f

sudo cp /etc/rancher/rke2/rke2.yaml ./rke2.yaml
sudo chown "$USER:$USER" ./rke2.yaml
export KUBECONFIG="$PWD/rke2.yaml"
kubectl get nodes

curl -sSLf https://get.k0s.sh | sudo sh
sudo k0s install controller --single
sudo k0s start
sudo k0s status
sudo k0s kubeconfig admin > kubeconfig-k0s.yaml
export KUBECONFIG="$PWD/kubeconfig-k0s.yaml"
kubectl get nodes

talosctl gen config workshop-talos https://<api-endpoint>:6443

talosctl apply-config \
  --insecure \
  --nodes <control-plane-ip> \
  --file controlplane.yaml

talosctl bootstrap --nodes <control-plane-ip>
talosctl kubeconfig --nodes <control-plane-ip>
kubectl get nodes

infra/cloud-kubernetes/
├── README.md
├── versions.tf
├── providers.tf
├── variables.tf
├── locals.tf
├── network.tf
├── cluster.tf
├── nodepools.tf
├── addons.tf
├── outputs.tf
├── terraform.tfvars.example
└── environments/
    ├── aws-dev.tfvars
    ├── azure-dev.tfvars
    └── gcp-dev.tfvars

variable "cluster_name" {
  type        = string
  description = "Name of the Kubernetes cluster."
}

variable "region" {
  type        = string
  description = "Cloud region."
}

variable "kubernetes_version" {
  type        = string
  description = "Desired Kubernetes version."
  default     = null
}

variable "node_count" {
  type        = number
  description = "Desired number of nodes for simple labs."
  default     = 2
}

variable "tags" {
  type        = map(string)
  description = "Required tags for governance and cost control."
  default = {
    environment = "workshop"
    ttl         = "8h"
  }
}

terraform fmt -recursive
terraform init
terraform validate
terraform plan -out tfplan
terraform apply tfplan
terraform output

terraform plan -destroy -out destroy.tfplan
terraform apply destroy.tfplan

pulumi/cloud-kubernetes/
├── Pulumi.yaml
├── Pulumi.dev.yaml
├── index.ts
└── package.json

pulumi login
pulumi stack init dev
pulumi config set cloud:region eu-central-1
pulumi preview
pulumi up
pulumi stack output kubeconfig --show-secrets > kubeconfig.yaml
export KUBECONFIG="$PWD/kubeconfig.yaml"
kubectl get nodes

clusterctl init --infrastructure aws
clusterctl generate cluster workshop-capi \
  --kubernetes-version v1.36.0 \
  --control-plane-machine-count=1 \
  --worker-machine-count=2 \
  > workshop-capi.yaml

kubectl apply -f workshop-capi.yaml
kubectl get clusters
kubectl get machines

kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml
kubectl -n argocd rollout status deployment/argocd-server

flux check --pre
flux bootstrap github \
  --owner=<github-user-or-org> \
  --repository=<repo> \
  --branch=main \
  --path=clusters/workshop

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx \
  --create-namespace

kubectl -n ingress-nginx get svc

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: public
  namespace: ingress
spec:
  gatewayClassName: nginx
  listeners:
    - name: http
      protocol: HTTP
      port: 80

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: demo
  namespace: demo
spec:
  parentRefs:
    - name: public
      namespace: ingress
  rules:
    - backendRefs:
        - name: demo
          port: 80

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm upgrade --install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set crds.enabled=true

kubectl -n cert-manager rollout status deployment/cert-manager

kubectl get storageclass
kubectl describe storageclass

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
  namespace: demo
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 5Gi

kubectl create namespace demo
kubectl apply -f pvc.yaml
kubectl -n demo get pvc
kubectl -n demo describe pvc data

kubectl get nodes -o wide
kubectl top nodes
kubectl top pods -A
kubectl get events -A --sort-by=.lastTimestamp | tail -50

kubectl get deployment metrics-server -n kube-system
kubectl top nodes

kubectl apply -f https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update
helm upgrade --install monitoring prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace

kubectl auth can-i get pods -A
kubectl auth can-i '*' '*' --as system:serviceaccount:demo:app
kubectl get clusterrolebinding

kubectl label namespace demo \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/audit=restricted \
  pod-security.kubernetes.io/warn=restricted

apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo
  namespace: demo
spec:
  replicas: 2
  selector:
    matchLabels:
      app: demo
  template:
    metadata:
      labels:
        app: demo
    spec:
      serviceAccountName: demo
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          image: nginx:1.27-alpine
          ports:
            - containerPort: 8080
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              memory: 256Mi

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: demo
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: demo
spec:
  podSelector: {}
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53

kubectl version
kubectl cluster-info
kubectl get nodes -o wide
kubectl get namespaces
kubectl get pods -A
kubectl get events -A --sort-by=.lastTimestamp | tail -50

kubectl create namespace demo
kubectl create deployment web -n demo --image=nginx:1.27-alpine --replicas=2
kubectl expose deployment web -n demo --port=80 --target-port=80 --type=ClusterIP
kubectl rollout status deployment/web -n demo
kubectl get pods,svc -n demo -o wide

kubectl run curl -n demo --rm -it --image=curlimages/curl:8.10.1 --restart=Never -- \
  curl -sS http://web.demo.svc.cluster.local

kubectl patch svc web -n demo -p '{"spec":{"type":"LoadBalancer"}}'
kubectl get svc web -n demo -w

kubectl get storageclass
kubectl apply -f pvc.yaml
kubectl -n demo get pvc

kubectl auth can-i get pods -n demo
kubectl auth can-i create deployments -n demo
kubectl auth can-i '*' '*' --all-namespaces