Your DOKS cluster is provisioned, kubectl is connected, and you understand DNS and Load Balancers. Now comes the moment you've been building toward: deploying your complete Task API stack to production infrastructure.
This isn't a single kubectl apply command. A production deployment involves multiple components that depend on each other. Dapr must exist before your application can use its sidecars. The Ingress controller must have an external IP before cert-manager can validate domain ownership. Certificates must be issued before HTTPS works.
The order matters. Get it wrong, and you'll spend hours debugging why pods are stuck in CrashLoopBackOff or why certificates show "pending" forever.
Think of deploying to production like building a house. You can't install windows before framing the walls, and you can't run electricity before the walls are up. Cloud Kubernetes deployments follow the same logic:
Why this order?
Dapr provides service invocation, state management, and pub/sub for your Task API. On a cloud cluster, initialization is nearly identical to local—but the resources run on cloud nodes.
Output:
Output:
Output:
All five Dapr components are running. The sidecar-injector will automatically add Dapr sidecars to pods with the correct annotations.
Traefik will receive all incoming traffic and route it to your services. On DOKS, installing Traefik creates a DigitalOcean Load Balancer automatically.
Output:
Output:
The Load Balancer takes 2-3 minutes to provision. Wait for it:
Output (after ~2 minutes):
When EXTERNAL-IP shows an IP address (not <pending>), your Load Balancer is ready. Note this IP—you'll need it for DNS.
Point your domain to the Load Balancer IP:
If you don't have a domain, use nip.io for testing: tasks.143.198.123.45.nip.io automatically resolves to that IP.
cert-manager automates TLS certificate issuance from Let's Encrypt. Once installed, it watches for Certificate resources and automatically obtains and renews certificates.
Output:
Output:
Create a file letsencrypt-prod.yaml:
Apply it:
Output:
Output:
Ready: True means cert-manager can communicate with Let's Encrypt.
Now deploy your Task API using the Helm chart from an earlier Chapter. Create a production values file that includes your domain and TLS configuration.
Create values-doks.yaml:
Output:
Output:
Notice 2/2 READY—that's your application container plus the Dapr sidecar.
Output:
READY: True means Let's Encrypt issued your certificate successfully.
If READY shows False, check the Certificate resource:
Look for events explaining why issuance failed (usually DNS not propagated or HTTP challenge failed).
Output:
Output:
Your Task API is running on production infrastructure with:
Run these to confirm everything is operational:
Expected successful output pattern:
Your production stack now includes:
This is the same architecture pattern used by production AI services. The components are loosely coupled—you can upgrade Traefik without touching your application, or switch cert-manager issuers without redeploying.
Symptom:
Diagnosis:
Common causes:
Symptom: Task API pods show 1/2 instead of 2/2
Diagnosis:
Common causes:
Symptom: kubectl get svc -n traefik shows <pending> for EXTERNAL-IP
Diagnosis:
Challenge: Deploy your Task API to DOKS with the full production stack.
Open Claude Code in your project directory and ask:
Record the deployment sequence AI suggests. Does it match the order in this lesson? Note any differences.
AI will suggest default configurations. Evaluate them:
Tell AI your specific requirements:
Watch how AI adapts the configuration to your constraints.
Execute the deployment commands AI provides. Watch for:
If any step fails, share the error with AI:
If your certificate isn't issued after deployment:
Work through the diagnosis together. What did AI suggest checking? What did you discover about your configuration?
Test your production endpoint:
Ask yourself:
Safety Note: Never share API tokens, passwords, or other secrets in prompts. Configure secrets through Kubernetes Secrets, not environment variables in values files.
Test your multi-cloud-deployer skill against what you learned:
Does your skill:
If gaps exist:
By the end of this chapter, your skill handles complete production deployments—not just cluster provisioning.