INFINITY-PIPELINE

1. Introduction

Infinity-Pipeline is a Kubernetes laboratory project I developed between March and May 2026 to acquire deep expertise in DevOps and Cloud-Native infrastructure. The project demonstrates the practical implementation of modern system administration: automating a complete cluster from scratch, ensuring scalability, and deploying it into a production-ready state.

Project Scope

A local Kubernetes system comprising one master and three worker nodes, fully automated with Ansible, orchestrated by Kubernetes, and running a Python Flask application (SwissTask) backed by PostgreSQL.

Development Environment

• Hardware: Intel Core i5-9500, 32GB RAM, NVIDIA RTX 3060 12GB
• Infrastructure: Four Ubuntu 22.04 LTS VMs, managed via Vagrant and VirtualBox
• Development: 31 Git commits over a two-month period

Transparency Note: AI-Assisted Development

Modern software engineering demands maximum efficiency. In this project, generative AI was leveraged as a "pair-programming" partner. While AI assisted with troubleshooting, generating boilerplate code, and syntax optimization, the architectural decisions, Infrastructure as Code (IaC) design, DevSecOps concepts, and final code responsibility remained entirely mine. This reflects my real-world workflow: utilizing modern tools efficiently without relinquishing architectural control.

2. Technical Architecture

2.1 Cluster Topology

The project consists of four virtual machines, all based on Ubuntu 22.04 LTS:

2.2 Application Stack & DevSecOps

The SwissTask application integrates industry-standard DevOps and security practices:

2.3 Infrastructure as Code

All system components are automated via Ansible. The playbooks execute in a deterministic sequence:

• 01_base_setup.yml – Kernel modules tuning, disable swap
• 01_2_hostname_fix.yml – Set node hostnames
• 01_5_network_fix.yml – Enable IPv4 Forwarding
• 01_8_containerd_fix.yml – Configure Containerd
• 02_install_k8s.yml – Install kubelet, kubeadm, kubectl
• 03_master_init.yml – Initialize master node, deploy Flannel CNI
• 04_workers_join.yml – Auto-join worker nodes to the cluster
• 05_deploy_swisstask.yml – Deploy SwissTask API + PostgreSQL manifests
• 06_deploy_monitoring.yml – Deploy Prometheus and Grafana via Helm

3. Deployment & Automation

3.1 DevSecOps CI/CD Pipeline

A push to the main branch triggers the GitHub Actions pipeline, which incorporates built-in security gates:

Key Feature: Images are not tagged with :latest, but rather with the unique Git Commit-SHA. This effectively prevents image caching issues and ensures deployments are 100% reproducible.

3.2 Rolling Updates

New versions are deployed via Kubernetes Rolling Updates to ensure high availability:

• New pods are initialized with the updated image.
• Health Checks (Liveness & Readiness Probes) verify readiness.
• Old pods are gracefully terminated only after the new pods are fully operational.
• Result: Zero-Downtime Deployments.

3.3 Self-Healing Mechanisms

Kubernetes autonomously monitors and maintains cluster health:

• Pod Failures: If a pod crashes, the Kubelet automatically restarts it.
• Node Failures: If a node becomes unresponsive, its pods are evicted and rescheduled on healthy nodes.

4. Engineering Challenges & Solutions

4.1 Kubelet Health-Check Collision (CrashLoopBackOff)

Root Cause: The rate limiter failed to distinguish internal cluster health-check traffic from external, potentially malicious requests.

Solution: Analyzed the internal traffic routing and implemented targeted @limiter.exempt decorators explicitly for the internal probes:

@app.route('/health', methods=['GET'])
@limiter.exempt
def health_check():
    """Kubernetes liveness probe bypasses rate limits"""
    # ...

Result: Internal K8s monitoring functions seamlessly (0 Restarts), while all external API endpoints remain strictly protected against DDoS abuse.

4.2 Kubernetes Swap Issue

Root Cause: Kubernetes does not operate stably when Linux Swap is enabled, as the Kubelet service terminates itself to preserve memory allocation accuracy.

Solution: Permanently disabled swap across all nodes via Ansible automation:

- name: Disable swap
  shell: swapoff -a
- name: Remove from fstab
  lineinfile:
    path: /etc/fstab
    regexp: "^.* swap"
    state: absent

Result: The cluster operates stably, and pods are scheduled reliably.

4.3 Docker Image Caching

Solution: Transitioned to an "Immutable Tags" strategy. Images are now strictly tagged with the unique Git Commit-SHA:

docker push myrepo/app:${{ github.sha }}

Result: Every deployment guarantees the extraction of the exact, updated code. Rollbacks are now deterministic and secure.

5. Conclusion & DevOps Competencies

5.1 Acquired Competencies

This project serves as a practical demonstration of my deep understanding of modern Cloud-Native architectures:

• DevSecOps: Code validation, SAST, Vulnerability Scans, and Rate-Limiting mechanisms.
• Orchestration: Kubernetes Deployments, Services, StatefulSets, Secrets, and RBAC.
• CI/CD: GitHub Actions workflows, automated testing, and Zero-Downtime deployments.
• Infrastructure as Code: Ansible Playbooks and idempotent automation principles.

5.2 Deployment Readiness

Infinity-Pipeline is production-ready for demonstration purposes. To deploy the system onto physical cloud servers, only the IP addresses in the ansible/inventory.ini file need to be updated prior to executing the Ansible playbooks.