Stage 5 · Platform
Kubernetes & Cloud Native
K8s internals, operators, service mesh, and building resilient cloud-native platforms.
12 modules72 lessons8.7h of reading72/72 live today
Prerequisite
Docker + codified infrastructure.
What this course leaves you with
- Operate and troubleshoot real clusters
- Debug pod, networking, and scheduling failures
- Autoscale and secure workloads
KubernetesAKSHelmCloud Native
Why this stage matters — Platform is running — now specialize in the cloud running it.
Progress
0 of 72 lessons complete. Progress is stored locally in your browser so you can pick the path back up later.
0%
course completion
01
6 lessons
Kubernetes Architecture Deep Dive
Control plane, node components, and the API machinery.
- 01Control Plane ComponentsAPI server, controller manager, scheduler, etcd — roles and HA.8 min
- 02Node Componentskubelet, kube-proxy, CRI, CNI, CSI — the node agent stack.7 min
- 03API MachineryREST, watch, informers, caches, and the resource version.7 min
- 04etcd Deep DiveRaft, leases, compaction, defragmentation, and disaster recovery.7 min
- 05Authentication & AuthorizationUsers, service accounts, RBAC, ABAC, and admission control.7 min
- 06API ExtensionsCRDs, API aggregation, and webhook conversion.6 min
02
6 lessons
Workloads & Scheduling
Pods, controllers, and placing workloads optimally.
- 01Pod LifecyclePhases, conditions, probes, init containers, and ephemeral containers.7 min
- 02Built-in ControllersDeployment, StatefulSet, DaemonSet, Job, CronJob — internals.8 min
- 03Scheduling Deep DivePredicates, priorities, node affinity, taints/tolerations, and topology spread.8 min
- 04Custom Schedulers & ExtendersScheduler framework, plugins, and writing a scheduler plugin.7 min
- 05Resource ManagementQoS classes, limit ranges, resource quotas, and vertical pod autoscaler.7 min
- 06Horizontal & Cluster AutoscalingHPA, VPA, CA, KEDA, and custom metrics.7 min
03
6 lessons
Networking, Storage & Service Mesh
Connecting and persisting — the data plane of Kubernetes.
- 01Services & IngressClusterIP, NodePort, LoadBalancer, ExternalName, and Ingress controllers.7 min
- 02CNI & Network PoliciesCalico, Cilium, Weave, and Kubernetes NetworkPolicy.7 min
- 03Service MeshIstio, Linkerd, Cilium Service Mesh — mTLS, traffic management.8 min
- 04CSI & Persistent StorageVolume lifecycle, snapshots, expansion, and topologies.7 min
- 05Storage Classes & Dynamic ProvisioningProvisioners, volume binding modes, and reclaim policies.6 min
- 06CoreDNS & Service DiscoveryCluster DNS, stub domains, and custom DNS policies.6 min
04
6 lessons
Platform Engineering & Multi-Tenancy
Building developer platforms on Kubernetes.
- 01Helm Charts & PackagingTemplates, values, dependencies, Chart Releaser, and OCI registries.7 min
- 02Kustomize & GitOpsBases, overlays, patches, and ArgoCD/Flux integration.7 min
- 03Multi-TenancyNamespaces, hierarchy, virtual clusters (vcluster), and cost allocation.8 min
- 04Policy & GovernanceKyverno, Gatekeeper, OPA, and admission control at scale.7 min
- 05Cluster SecurityPod Security Standards, runtime security (Falco), and supply chain (SLSA, cosign).8 min
- 06Day 2 OperationsUpgrades, backup (Velero), disaster recovery, and cluster lifecycle.7 min
05
6 lessons
Networking & Service Mesh
Advanced Kubernetes traffic paths, isolation policy, and mesh operations in production.
- 01CNI DataplanesCalico iptables, Cilium eBPF, overlay routing, and kube-proxy replacement tradeoffs.8 min
- 02Service Traffic FlowClusterIP, EndpointSlice, kube-proxy IPVS, session affinity, and topology-aware routing.7 min
- 03Ingress & Gateway APINGINX, Envoy Gateway, HTTPRoute, TLS termination, and multi-tenant routing.8 min
- 04NetworkPolicy DesignDefault deny, namespace selectors, egress controls, and testing with netshoot.7 min
- 05Mesh mTLS & IdentityIstio, Linkerd, SPIFFE IDs, certificate rotation, and zero-trust service identity.8 min
- 06Traffic ShapingRetries, timeouts, circuit breakers, fault injection, and weighted canary routes.7 min
06
6 lessons
Observability & Autoscaling
Measuring cluster health and scaling workloads from metrics, traces, and demand signals.
- 01Prometheus OperatorServiceMonitor, PodMonitor, recording rules, alert rules, and remote write.8 min
- 02Grafana SLO DashboardsGolden signals, RED/USE panels, burn-rate views, and error budget reporting.7 min
- 03OpenTelemetry TracingCollectors, auto-instrumentation, tail sampling, and trace correlation in Kubernetes.8 min
- 04HPA, VPA & KEDAResource metrics, custom metrics, event-driven scaling, and conflicting scaler behavior.8 min
- 05Cluster AutoscalerNode group discovery, scale-down delays, bin packing, and overprovisioning pods.7 min
- 06Autoscaling SLO FeedbackConnecting latency SLOs, queue depth, saturation, and cost signals to scaling policy.7 min
07
6 lessons
Configuration & Secrets Management
ConfigMaps, Secrets, projected volumes, and external secret synchronization for production workloads.
- 01ConfigMap DesignImmutable ConfigMaps, rollout triggers, binary data, and application reload patterns.6 min
- 02Secret TypesOpaque, TLS, dockerconfigjson, service account tokens, and encryption at rest with KMS.7 min
- 03Environment & Volume InjectionenvFrom, valueFrom, projected volumes, subPath mounts, and update propagation behavior.7 min
- 04External SecretsExternal Secrets Operator, Secret Store CSI Driver, Azure Key Vault, and rotation workflows.8 min
- 05Configuration RolloutsChecksum annotations, Stakater Reloader, canary config changes, and rollback validation.6 min
- 06Secret Leak Preventionkubeseal, SOPS, Sealed Secrets, RBAC scoping, and audit log safeguards.7 min
08
6 lessons
Stateful Storage Operations
PersistentVolumes, StatefulSet storage, CSI drivers, and data protection for stateful services.
- 01PV & PVC LifecycleBinding, reclaim policies, access modes, volume expansion, and finalizer behavior.7 min
- 02StorageClass TopologyProvisioners, volumeBindingMode, allowedTopologies, reclaimPolicy, and multi-zone placement.7 min
- 03StatefulSet VolumesvolumeClaimTemplates, stable identities, ordered rollouts, and persistent replica data.8 min
- 04CSI Snapshots & ClonesVolumeSnapshotClass, snapshot controllers, PVC cloning, and restore validation.7 min
- 05Storage PerformanceIOPS limits, filesystem choices, fio testing, and latency dashboards for persistent disks.7 min
- 06Backup & Restore DrillsVelero, application quiescing, restore namespaces, and recovery point verification.8 min
09
6 lessons
Security, Identity & Admission
ServiceAccounts, RBAC, Pod Security admission, runtime profiles, and image governance.
- 01ServiceAccount IdentityBound tokens, audience claims, projected tokens, and workload identity federation.7 min
- 02RBAC DesignRoles, ClusterRoles, aggregation labels, impersonation checks, and least-privilege reviews.8 min
- 03Pod Security AdmissionPrivileged, baseline, restricted profiles, namespace labels, and dry-run enforcement.7 min
- 04Runtime Hardeningseccomp, AppArmor, read-only filesystems, Linux capabilities, and non-root containers.8 min
- 05Image PolicyAdmission webhooks, digest pinning, cosign verification, SBOM checks, and registry allowlists.7 min
- 06Audit & ComplianceAudit policies, kube-apiserver logs, Kubernetes events, and compliance evidence collection.6 min
10
6 lessons
Release Packaging with Helm & Kustomize
Helm charts, release state, Kustomize overlays, and promotion workflows for Kubernetes apps.
- 01Chart StructureChart.yaml, templates, helpers, dependencies, library charts, and OCI registries.7 min
- 02Values Managementvalues.yaml, schema validation, environment files, secrets references, and override precedence.7 min
- 03Helm Release Operationsinstall, upgrade, rollback, history, atomic releases, and failed hook cleanup.7 min
- 04Kustomize OverlaysBases, overlays, strategic merge patches, JSON patches, and image transformers.7 min
- 05Promotion PipelinesGitOps repositories, Argo CD sync waves, Flux reconciliation, and environment promotion gates.8 min
- 06Package Testinghelm lint, chart-testing, kubeconform, conftest, and server-side dry runs.7 min
11
6 lessons
Operators, CRDs & Controllers
CustomResourceDefinitions, reconciliation loops, and operator lifecycle patterns for platform APIs.
- 01CRD Schema DesignOpenAPI schemas, validation rules, defaulting, pruning, and additional printer columns.8 min
- 02Controller PatternInformers, work queues, idempotent reconciliation, finalizers, and status subresources.8 min
- 03Operator SDKKubebuilder, controller-runtime, envtest, RBAC markers, and generated manifests.8 min
- 04CRD VersioningServed versions, storage versions, conversion webhooks, and safe API migration.7 min
- 05Operator LifecycleOLM bundles, channels, upgrade edges, leader election, and high-availability controllers.7 min
- 06Controller ObservabilityReconcile metrics, structured logs, Kubernetes events, pprof, and stuck finalizer alerts.7 min
12
6 lessons
Production Troubleshooting & Operations
kubectl diagnostics, crashloop analysis, resource pressure, and node recovery in live clusters.
- 01kubectl Debug Toolkitkubectl describe, events, logs, exec, debug containers, and netshoot troubleshooting pods.7 min
- 02CrashLoopBackOff AnalysisExit codes, termination messages, probes, OOMKilled events, and restart backoff timing.7 min
- 03Resource PressureCPU throttling, memory pressure, ephemeral storage eviction, PSI metrics, and QoS classes.8 min
- 04Node NotReady Recoverykubelet logs, CNI failures, disk pressure, taints, leases, and cordon-drain workflows.8 min
- 05DNS & Service DebuggingCoreDNS logs, EndpointSlices, kube-proxy rules, conntrack, and tcpdump packet captures.8 min
- 06Change-Safe OperationsPDBs, drain budgets, maintenance windows, preflight checks, and rollback runbooks.7 min