Workload Management in HCL
DevOps IaC Part 2 — Day 10
Orchestrate K8s Deployments, Services, ConfigMaps, and Pod health checks natively using the HashiCorp Kubernetes provider
While raw YAML is traditional in Kubernetes, managing workloads via HashiCorp's official Kubernetes Provider in Terraform provides compile-time schema checking, dynamic variable injection, state tracking, and unified lifecycle management across cloud infrastructure and containers. Today you will orchestrate a complete microservice tier: Namespace, ConfigMap, Deployment with liveness/readiness probes, and Service, all cleanly expressed in declarative HCL.
An interactive 20 min video walkthrough for Day 10 is currently in production. Follow the step-by-step interactive playbook below!
The official reference codebase for Day 10 is hosted in the repository. Clone the repository and navigate to day-10-k8s-workloads to run the working solution.
git clone https://github.com/777abhi/devops-terraform-roadmap.git
cd devops-terraform-roadmap/day-10-k8s-workloadsWhy HCL for Kubernetes Workloads?
Compare Terraform HCL workloads against raw YAML templates and Helm charts.
Evaluate the architectural advantages of expressing cluster objects in Terraform.
Feature Raw YAML Manifests Terraform HCL ────────────────────────────────────────────────────────────────── Schema Validation Runtime (kubectl apply) Plan-time (terraform plan) Dynamic Variables External (sed/envsubst) Native (var.environment) Resource Dependencies Implicit / Manual wait Automatic DAG Graph Drift Detection Manual diff terraform plan -detailed-exitcode Unified State Separate etcd state Synchronized in S3/DynamoDB
HCL Workload Definition: Deployment & Service
Write declarative HCL to provision a resilient 3-replica web workload with health checks.
Point the provider to the local Kind kubeconfig context.
# versions.tf
terraform {
required_version = ">= 1.5.0"
required_providers {
kubernetes = {
source = "hashicorp/kubernetes"
version = "~> 2.30.0"
}
}
}
provider "kubernetes" {
config_path = "~/.kube/config"
config_context = "kind-devops-lab-cluster"
}Author the complete application workload with resource limits and health probes.
# main.tf
resource "kubernetes_namespace" "lab" {
metadata {
name = "devops-lab"
labels = {
environment = "sandbox"
}
}
}
resource "kubernetes_config_map" "app_config" {
metadata {
name = "webapp-config"
namespace = kubernetes_namespace.lab.metadata[0].name
}
data = {
APP_NAME = "OrderService"
ENV_TIER = "Development"
}
}
resource "kubernetes_deployment" "webapp" {
metadata {
name = "webapp-deployment"
namespace = kubernetes_namespace.lab.metadata[0].name
labels = {
app = "webapp"
}
}
spec {
replicas = 3
selector {
match_labels = {
app = "webapp"
}
}
template {
metadata {
labels = {
app = "webapp"
}
}
spec {
container {
name = "nginx"
image = "nginx:1.25-alpine"
resources {
limits = {
cpu = "250m"
memory = "128Mi"
}
requests = {
cpu = "100m"
memory = "64Mi"
}
}
port {
container_port = 80
}
liveness_probe {
http_get {
path = "/"
port = 80
}
initial_delay_seconds = 5
period_seconds = 10
}
readiness_probe {
http_get {
path = "/"
port = 80
}
initial_delay_seconds = 3
period_seconds = 5
}
}
}
}
}
}
resource "kubernetes_service" "webapp_svc" {
metadata {
name = "webapp-service"
namespace = kubernetes_namespace.lab.metadata[0].name
}
spec {
selector = {
app = kubernetes_deployment.webapp.metadata[0].labels.app
}
port {
port = 80
target_port = 80
node_port = 30080
}
type = "NodePort"
}
}Execution, Scaling & Health Probe Auditing
Apply the workload and audit pod readiness and endpoints with kubectl.
Initialize the Kubernetes provider and provision all resources.
cd /Users/abhinavsharma/Downloads/devops-terraform-roadmap/day-10-k8s-workloads
terraform init
terraform apply -auto-approveConfirm that all 3 replicas are Running and probes are healthy.
kubectl get pods -n devops-lab -o wide
kubectl get svc -n devops-lab webapp-service
curl -I http://localhost:8080Production Best Practices & Zero-Downtime Rollouts
Learn zero-downtime rolling update configurations and pod disruption budgets.
In production deployments, prevent service drops during deployment rollouts by configuring strategy:
strategy {
type = "RollingUpdate"
rolling_update {
max_surge = "25%"
max_unavailable = "0" # Guarantees no capacity drops during rollout
}
}- Understood the benefits of Terraform HCL for Kubernetes workloads over raw unvalidated YAML.
- Configured the official HashiCorp Kubernetes provider with local Kind cluster context.
- Declared Namespace, ConfigMap, Deployment with 3 replicas, and NodePort Service.
- Instrumented liveness and readiness HTTP health probes directly in HCL.
- Verified pod distribution and tested zero-downtime rolling update strategies.