Ship your first app (ko)

This builds a small Go web server with ko (no Dockerfile), pushes it to your registry, and serves it over HTTPS.

It assumes:

• You can reach your cluster with kubectl (see the kubectl quickstart).
• You’ve set up GHCR credentials: a local push login and the ghcr pull secret in the demo namespace (see Set up GHCR credentials).
• The optional ingress bundle is installed, for HTTPS (see Expose a service with Ingress).
• You have Go and ko installed locally.

Write the app

mkdir hello && cd hello
go mod init example.com/hello

cat <<'EOF' > main.go
package main

import (
  "fmt"
  "log"
  "net/http"
)

func main() {
  http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
    fmt.Fprintln(w, "hello from skube - ko")
  })
  log.Fatal(http.ListenAndServe(":8080", nil))
}
EOF

Point ko at your registry

You’re already logged in to ghcr.io from the credentials guide, so ko just needs to know which repo to push to:

export KO_DOCKER_REPO=ghcr.io/<github-username>

Write the manifest

Caution

Replace hello.example.com with your own hostname and create its DNS A record first (see Expose a service with Ingress).

The ko:// image reference tells ko to build main.go and substitute the pushed image:

cat <<'EOF' > deploy.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello
  namespace: demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello
  template:
    metadata:
      labels:
        app: hello
    spec:
      containers:
        - name: hello
          image: ko://example.com/hello
          ports:
            - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: hello
  namespace: demo
spec:
  selector:
    app: hello
  ports:
    - port: 80
      targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: hello
  namespace: demo
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: traefik
  tls:
    - hosts:
        - hello.example.com
      secretName: hello-tls
  rules:
    - host: hello.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: hello
                port:
                  number: 80
EOF

Build, push, deploy

ko apply -f deploy.yaml

ko compiles the app, pushes the image to ghcr.io/<you>/hello, rewrites the ko:// reference, and applies the manifest. The pushed package is private by default, which is why the cluster needs the ghcr pull secret from the previous guide.

Verify

kubectl get certificate hello-tls -n demo -w

Once READY is True:

curl https://hello.example.com

You should get back hello from skube - ko.

Clean up

kubectl delete namespace demo