Kubernetes Cluster on macOS

Helm in 30 seconds

# Install Helm
brew install helm

# Add a chart repository
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update

# Install PostgreSQL in one command (no YAML writing!)
helm install my-db bitnami/postgresql \
  --set auth.postgresPassword=secret123 \
  --set primary.persistence.size=10Gi

# List what you've installed
helm list

# Upgrade with new values
helm upgrade my-db bitnami/postgresql --set primary.persistence.size=20Gi

# Rollback instantly if something breaks
helm rollback my-db 1

# Uninstall everything cleanly
helm uninstall my-db

Install the full stack in your kind cluster

The kube-prometheus-stack Helm chart gives you Prometheus, Grafana, Alertmanager, node-exporter, and a ton of pre-built dashboards in one command.

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

# Install everything in a monitoring namespace
helm install kps prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace

# Port-forward Grafana (default: admin / prom-operator)
kubectl port-forward -n monitoring svc/kps-grafana 3000:80

# Port-forward Prometheus
kubectl port-forward -n monitoring svc/kps-kube-prometheus-stack-prometheus 9090:9090

# Add Loki for logs
helm install loki grafana/loki-stack --namespace monitoring

🚀 Install Rancher in your kind cluster

You can run Rancher locally to try it out. Here's the fastest path using Helm:

# Add the Rancher Helm repo
helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
helm repo update

# cert-manager is required (Rancher uses it for TLS)
helm repo add jetstack https://charts.jetstack.io
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager --create-namespace \
  --set installCRDs=true

# Create the namespace for Rancher
kubectl create namespace cattle-system

# Install Rancher (self-signed cert for local use)
helm install rancher rancher-latest/rancher \
  --namespace cattle-system \
  --set hostname=rancher.localhost \
  --set replicas=1 \
  --set bootstrapPassword=admin

# Wait for it to come up
kubectl -n cattle-system rollout status deploy/rancher

# Port-forward and open in browser
kubectl port-forward -n cattle-system svc/rancher 8443:443
# Then visit: https://rancher.localhost:8443

Alternative: single-container Docker install (fastest for a quick look):

docker run -d --restart=unless-stopped \
  -p 80:80 -p 443:443 \
  --privileged \
  rancher/rancher:latest

# Then browse to https://localhost and grab the bootstrap password:
docker logs <container-id> 2>&1 | grep "Bootstrap Password:"

Rancher vs. Alternatives

🐙 GitHub Actions: Full Build → Push → GitOps Update

.github/workflows/deploy.yml

name: Build and Deploy

on:
  push:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm test

  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract version
        id: meta
        run: echo "version=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Security scan with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

      - uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

  update-gitops:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Checkout GitOps repo
        uses: actions/checkout@v4
        with:
          repository: myorg/gitops-manifests
          token: ${{ secrets.GITOPS_TOKEN }}

      - name: Update image tag in Helm values
        run: |
          sed -i "s|tag: .*|tag: ${{ needs.build-and-push.outputs.version }}|" \
            apps/myapp/values-prod.yaml

      - name: Commit and push
        run: |
          git config user.name "ci-bot"
          git config user.email "[email protected]"
          git add .
          git commit -m "chore: bump myapp to ${{ needs.build-and-push.outputs.version }}"
          git push
          # Argo CD will now sync this change to the cluster automatically

🎯 Tekton: K8s-Native Pipeline

Tekton runs inside your K8s cluster — each Task is a pod.

apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: build-and-deploy
spec:
  params:
    - name: repo-url
    - name: image-name
  workspaces:
    - name: shared-data
  tasks:
    - name: fetch-source
      taskRef:
        name: git-clone
      workspaces:
        - name: output
          workspace: shared-data
      params:
        - name: url
          value: $(params.repo-url)

    - name: run-tests
      runAfter: [fetch-source]
      taskRef:
        name: npm-test
      workspaces:
        - name: source
          workspace: shared-data

    - name: build-image
      runAfter: [run-tests]
      taskRef:
        name: kaniko           # builds images without Docker daemon
      params:
        - name: IMAGE
          value: $(params.image-name)
      workspaces:
        - name: source
          workspace: shared-data

    - name: deploy
      runAfter: [build-image]
      taskRef:
        name: kubernetes-actions
      params:
        - name: script
          value: |
            kubectl set image deployment/myapp \
              myapp=$(params.image-name)
---
# Trigger it with:
# tkn pipeline start build-and-deploy \
#   -p repo-url=https://github.com/me/app \
#   -p image-name=ghcr.io/me/app:v1 \
#   -w name=shared-data,claimName=ws-pvc

🤵 Jenkins X: Preview Environments per PR

Jenkins X auto-generates a preview environment for every pull request. jenkins-x.yml:

buildPack: none
pipelineConfig:
  pipelines:
    pullRequest:
      pipeline:
        stages:
          - name: ci
            steps:
              - name: build
                image: golang:1.21
                command: go build ./...
              - name: test
                command: go test ./...
              - name: build-image
                command: /kaniko/executor --dockerfile=Dockerfile
    release:
      pipeline:
        stages:
          - name: release
            steps:
              - name: promote
                # Jenkins X auto-promotes to staging
                # then waits for manual approval to prod
                command: jx promote --version $VERSION --env staging

Every PR gets its own namespace with a live URL to click and test — SREs call it "PR-driven development."

🦊 GitLab CI: Multi-stage with K8s Deploy

stages:
  - test
  - build
  - scan
  - deploy

variables:
  IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

test:
  stage: test
  image: node:20
  script:
    - npm ci
    - npm test

build:
  stage: build
  image: docker:24
  services: [docker:24-dind]
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $IMAGE .
    - docker push $IMAGE

scan:
  stage: scan
  image: aquasec/trivy
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE

deploy-prod:
  stage: deploy
  image: bitnami/kubectl
  only: [main]
  environment:
    name: production
    url: https://myapp.example.com
  script:
    - kubectl config use-context myorg/gitops:prod
    - kubectl set image deployment/myapp myapp=$IMAGE
    - kubectl rollout status deployment/myapp