Optional extension: run a PHI scrubber on your cluster

You have a working cluster. This optional lab puts a real workload on it: a small service that removes protected health information (PHI) from text before it is stored or sent on. PHI is patient data such as names, dates of birth, and record numbers. A scrubber is a service that finds those patterns and replaces them.

This lab is a starting point, not a finished product. The goal is to show how a workload runs on the cluster you built and to give you something to change.

You run every command in this lab from the jumpbox, the same as the rest of the course.

What you will deploy

• A Deployment that runs a small HTTP service. The service takes text in a request and returns the text with PHI patterns replaced.
• A Service of type ClusterIP so other pods in the cluster can reach the scrubber by name.

Step 1: write the deployment

Create a file named phi-scrubber.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: phi-scrubber
  labels:
    app: phi-scrubber
spec:
  replicas: 2
  selector:
    matchLabels:
      app: phi-scrubber
  template:
    metadata:
      labels:
        app: phi-scrubber
    spec:
      containers:
        - name: phi-scrubber
          image: hashicorp/http-echo:1.0
          args:
            - "-text=replace this image with your own scrubber"
          ports:
            - containerPort: 5678
---
apiVersion: v1
kind: Service
metadata:
  name: phi-scrubber
spec:
  selector:
    app: phi-scrubber
  ports:
    - port: 80
      targetPort: 5678

The image above is a placeholder that echoes a fixed message. It lets you confirm the deployment and service work before you bring your own scrubber. When you have a scrubber image, change the image and args fields and apply the file again.

Step 2: apply it

kubectl apply -f phi-scrubber.yaml

Step 3: confirm it is running

kubectl get pods -l app=phi-scrubber

You should see two pods in the Running state.

kubectl get service phi-scrubber

You should see a ClusterIP service on port 80.

Step 4: reach the service from inside the cluster

Start a temporary pod and call the service by name:

kubectl run curl-test --image=curlimages/curl:8.10.1 --rm -it --restart=Never -- \
  curl -s http://phi-scrubber.default.svc.cluster.local

You should see the placeholder text come back. That confirms one pod can reach the scrubber by its service name.

PHI lens

This service is reachable only from inside the cluster, because it is a ClusterIP service. That is the safe default for anything that touches patient data. You expose a service to the outside only when you have a clear reason and a way to control who reaches it. Lab 12 showed a NodePort service, which opens a port on every node. For a scrubber, you would not do that.

Where to take it next

• Replace the placeholder image with a real scrubber that redacts names, dates, and record numbers.
• Add a readiness check so traffic only reaches pods that are ready.
• Add resource requests and limits so the scrubber gets the CPU and memory it needs.
• Put the scrubber behind another service that sends data through it before storage.

These steps move the cluster from a learning build toward something you could run for real. Take them one at a time.