Skip to Content
Quickstart

Quickstart

One Ubuntu machine, one command, a complete platform. Then an application on top of it, on real HTTPS, without owning a domain.

You need a single Ubuntu 24.04 host with 2 vCPU, 4 GB RAM, 40 GB disk, a public IP, SSH access and passwordless sudo. Any cloud’s cheapest usable box. Full detail is in Prerequisites.

Install the CLI

terminal
curl -fsSL https://get.kubenest.io | sh
kubenest login

Install the platform

terminal
kubenest platform install \
  --bundle 1.0 \
  --name demo \
  --server 203.0.113.10 \
  --ssh-user ubuntu
output
preflight        ubuntu 24.04, 4 vCPU, 7.6 GiB, 74.8 GiB free    ok
k3s              v1.35.7+k3s1, embedded etcd                     ok   38s
gateway-api      v1.6.1                                          ok    4s
traefik          41.2.0                                          ok   22s
cert-manager     v1.21.1                                         ok   31s
storage          openebs-lvm-localpv 1.10.0, vg kubenest-vg      ok   19s
velero           12.1.0  (no target configured)                  ok   26s
patching         system-upgrade-controller, kured                ok   11s
agent            kubenest-agent 2.3.5                            ok   14s
register         cluster demo → connected                        ok    3s
verify           5 checks                                        ok   21s
 
cluster demo ready · Platform 1.0 · single-server · 4m14s
apps deploy to *.demo.203-0-113-10.sslip.io

Thirteen stages, each named as it runs. On a clean host this takes about four minutes and ends with five acceptance checks: every node Ready, every core component Running, a real volume provisioned, the cluster reporting in, and the running cluster matching the manifest it was built from.

If a stage fails it names the stage, the component and what to do. Fix it and re-run the identical command — completed stages are skipped from the journal, so a re-run takes seconds.

Describe your app

terminal
kubenest init

That writes a kubenest.yaml you can edit. For a first deploy, this is the whole file:

kubenest.yaml
name: hello
 
components:
  web:
    image: nginx:1.25-alpine
    port: 80
    expose: true

Deploy it

terminal
kubenest deploy
output
project hello on cluster demo
 
web   workload   nginx:1.25-alpine   deploying → running   ok   19s
 
web   https://web.hello.203-0-113-10.sslip.io
 
deployed in 19s · deploy 1 · `kubenest rollback` to undo
terminal
kubenest open web

Where the URL came from

You did not configure DNS, and you did not configure a certificate.

expose: true asked the platform for a public URL. With no domain configured, it assigns one derived from the node’s own IP — 203.0.113.10 becomes 203-0-113-10.sslip.io, which resolves through a public wildcard resolver that needs nothing from you or from us. cert-manager then issues a real Let’s Encrypt certificate against that name over HTTP-01.

It is a working URL with valid TLS, and it is not a name you would put on a business card. When you have a domain, point it at the cluster and say so once:

terminal
kubenest cluster set-domain --cluster demo acme.com

Every exposed component moves to <component>.<app>.acme.com, certificates reissue, and the sslip.io names keep working so nothing breaks while DNS propagates.

This was the easy day

You now have a Kubernetes distribution, an ingress controller, a certificate manager, a storage provisioner and a backup system — installed as one tested set, at one version — with an application on it. That took about fifteen minutes and it is the part everyone can do.

The reason to run KubeNest is the next two years. The upgrade nobody wants to own, the backup nobody has restored, the certificate that expires on a holiday, the kernel CVE that sits unpatched because rebooting nodes is frightening. That is day 2, and it is the actual product.

Next

  • Day 2 — what the platform does after the install, and what it stops you having to do
  • Deploying apps — the full kubenest.yaml, addons, wiring, rollback
  • Prerequisites — the three things to sort before real traffic
  • Why these components — k3s, Traefik, ArgoCD, and what we deliberately did not build
Last updated on
PrerequisitesUpgrades