OS2: Production Kubernetes Stack

May 2026 - Jun 2026

OS2 runs a web shop on Kubernetes with HTTPS, auto-scaling, and live attack detection, not a single VM with unread logs. It combines k3s, a FastAPI app, a log classifier (rules + online ML + DDoS windows), and Prometheus/Grafana for a live security dashboard. I extended the course Docker assignment into this full cluster deployment and showed how the app scales and defends itself on real VMs.

Python
FastAPI
Docker
Docker Compose
Kubernetes
k3s
Apache
Helm
cert-manager
Prometheus
Grafana
River ML
Locust
GitHub

Required vs. what I built

Damascus University OS2 final project — the assignment asked for a Docker Compose stack. I delivered that and extended the same services onto Kubernetes, with several components going well beyond the spec.

Area Required What I built
Deployment docker-compose.yml with 2 web app instances + Apache Compose plus Docker Desktop k8s plus a 3-node k3s cluster (Ubuntu ARM64 VMs)
Web app Simple containerized web app, 2 instancefs Shop API (FastAPI) — products, JWT auth, cart, admin routes, Prometheus /metrics, intentional 500 errors for demo
SSL Self-signed certs on web apps and Apache Self-signed in Compose; cert-manager SelfSigned Certificate in k8s
Apache Reverse proxy, SSL termination, load balance HTTPS Same, plus JSON structured logs, /balancer-manager, /server-status, security headers (HSTS, CSP), mod_ratelimit → 429
Monitoring Prometheus + Grafana — request load, response times, container CPU/memory Prometheus + Grafana + Alertmanager + cAdvisor; in k8s: kube-prometheus-stack via Helm, ServiceMonitor / PodMonitor / PrometheusRule, custom OS2 Stack Overview dashboard
AI classifier Separate Python container; rule-based only (no ML training) Rule-based plus River HalfSpaceTrees online ML anomaly detection plus in-memory sliding windows per IP (DDoS, auth brute-force, recon)
Classifier deployment Standalone container sharing Apache logs via Docker volume Standalone in Compose; sidecar in k8s (same pod, shared emptyDir log volume)
Traffic generator Container flooding Apache to trigger 429s Locust with 3 user classes (Shopper, Attacker, DDoSFlooder) and a 90s attack timeline; runnable in Compose or as a k8s Job
Testing Verify HTTPS, load balancing, monitoring dashboards All of the above, plus HPA scale demo, multi-node pod scheduling, classifier unit tests (make test)

What the assignment required

  1. Two containerized web app instances behind Apache with self-signed SSL
  2. docker-compose.yml wiring apps, Apache LB, and network discovery
  3. Prometheus scraping app + Apache metrics; Grafana dashboards for load, latency, and per-container CPU/memory
  4. A rule-based AI log classifier (no training) detecting 500 errors, 401/403 alerts, SQLi/XSS patterns, and 429 DDoS-like traffic — exposed as Prometheus metrics
  5. A traffic generator container to flood Apache and validate 429 detection

What I added beyond the spec

Kubernetes production stack

  • 3-node k3s cluster on a private LAN (192.168.28.0/24) — control plane + 2 workers, ARM64 Ubuntu 24.04 VMs
  • Mac as operator only: docker build, kubectl, helm against the remote cluster
  • StatefulSet webapp with headless Service (stable DNS: webapp-0, webapp-1)
  • HPA scaling 2→6 replicas at 60% CPU
  • cert-manager for TLS; Apache on NodePort 30443 (not Ingress — keeps course-required Apache edge)
  • NetworkPolicy, PodDisruptionBudget, topology spread across nodes

Hybrid classifier (3 layers, not just rules)

  1. Signatures — OWASP CRS-inspired SQLi, XSS, recon path detection
  2. ML — River HalfSpaceTrees online anomaly scoring on log features (status, bytes, URI length, duration)
  3. Stateful windows — per-IP sliding windows flagging DDoS (>20 req/60s), auth brute-force bursts, and recon sweeps

Richer observability & simulation

  • Alertmanager for alert routing
  • cAdvisor for container resource metrics in Compose
  • Custom Grafana dashboard aggregating app, Apache, and classifier metrics
  • Locust simulates a realistic attack progression: normal shopping → credential brute-force + injection probes → DDoS burst

Three runtimes, one codebase

Runtime Command Use
Docker Compose make dev Local dev — HTTPS on localhost, Grafana on :3000
Docker Desktop k8s make k8s Single-node laptop demo
3-node k3s cluster make k8s + remote KUBECONFIG Primary production demo — multi-node scheduling, HPA, real cluster

Demo endpoints (k3s cluster)

https://operating-systems.com:30443/api/v1/products
https://operating-systems.com:30443/balancer-manager

After make flood-k8s, the OS2 Stack Overview Grafana dashboard shows request load, classifier counters (errors, security alerts, flagged IPs, ML anomaly scores), and container CPU/memory.

LinkedIn