On-Prem Platform: Databases, TLS and Zabbix

Databases with Helm charts (Bitnami’s OCI charts are a common start):

microk8s helm3 install pg oci://registry-1.docker.io/bitnamicharts/postgresql -n data --create-namespace \
  --set auth.database=shop --set primary.persistence.size=20Gi
microk8s helm3 install redis oci://registry-1.docker.io/bitnamicharts/redis -n data
microk8s helm3 install mongo oci://registry-1.docker.io/bitnamicharts/mongodb -n data
microk8s helm3 install mysql oci://registry-1.docker.io/bitnamicharts/mysql -n data

Store passwords in Kubernetes Secrets, expose databases only inside the cluster, and schedule dumps to storage outside the cluster.

Internal TLS. With no public DNS, create a private CA and a cert-manager issuer:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata: { name: internal-ca }
spec:
  ca: { secretName: internal-ca-keypair }

Reference it from Ingress annotations, and install the CA certificate on client devices.

Monitoring. Zabbix 7.0 LTS (released June 2024) runs on a separate VM with PostgreSQL. Install the Zabbix agent 2 on each node, and use the Kubernetes templates (HTTP agent against the API server) for cluster state. Alert on node ready status, volume usage, database connections and certificate expiry.

AWS emulation. Deploy LocalStack with its Helm chart into cloud-emulation for services that apps expect from AWS.