Kubernetes: Production-Grade Container Orchestration

Zero Downtime Deployments, Ingress, Observability, and Secrets

8 modules, 44 lessons: The Cluster And Your First Diagnosis; Running And Repairing Workloads; Services And External Traffic; Configuration And Persistent Data; Scheduling And Resource Pressure; Identity And Pod Security; Cluster Operations And Recovery; Packaging, GitOps And Operators.

Advanced · 2 hours · 44 lessons · 95 labs

Related guides

Who it is for

Advanced level.

For engineers who already run containers and now need to deploy, repair and operate services on Kubernetes in production.

What you don't need yet:

What helps:

Before you start:

Take first:

Take next:

Learning paths:

Nobody needs to know everything before they start. Each course builds on the one before, so a learning path takes you there step by step.

Labs

95 labs: you write the code, it runs, and graded labs check the result. The outline lists each lesson's labs.

What is free

Start free: First module free with an account. Pro: Every course, lab, handbook, practice exam and certificate.

Course outline

The Cluster And Your First Diagnosis

  1. From Docker To Desired State (6 labs): You can explain what a cluster adds to a container runtime, write and apply your first Pod manifest, and show that a Deployment replaces a pod you delete while a bare Pod stays dead.
  2. Control Plane: etcd, API Server, Scheduler, Controllers (5 labs): You can name the four control plane components, say what breaks when each one stops, find them running as static pods, see your own objects as keys in etcd, and read the events that prove which component made which decision.
  3. Worker Nodes: kubelet, Runtime, CNI And kube-proxy (3 labs): You can describe what the kubelet, the container runtime, the network plugin and kube-proxy each do on a node, tell the CNI plugin apart from kube-proxy, and inspect all four on a running cluster.
  4. Bootstrap A Local Cluster And Check Your Context (4 labs): You can create a throwaway local cluster with kind or minikube, read a kubeconfig as three separate lists, prove which cluster and namespace a command will hit before you run it, and keep the course cluster in a kubeconfig of its own.
  5. Namespaces, Labels And Declarative Manifests (2 labs): You can separate work with namespaces, select objects with labels, and apply a declarative manifest repeatedly without changing its meaning.
  6. Troubleshooting: describe, Events And A First Smoke Test (2 labs): You can collect object state and events, use a focused smoke test, and preserve evidence before changing a workload.

Running And Repairing Workloads

  1. Pods, Init Containers And Sidecars (2 labs): You can choose a pod shape, order startup work with an init container, and explain when a sidecar shares a pod lifecycle.
  2. Deployments, ReplicaSets, Rollouts And Rollback (2 labs): You can create a Deployment, watch a rolling update, pause and resume it, and roll back a bad revision.
  3. DaemonSets And Node Services (2 labs): You can use a DaemonSet for one pod per eligible node, constrain it with selectors, and update its node service safely.
  4. Jobs And CronJobs (3 labs): You can run finite work with a Job, schedule repeated work with a CronJob, and choose completion and concurrency policies.
  5. Troubleshooting: Probes, Logs, exec And CrashLoopBackOff (2 labs): You can separate liveness from readiness, collect logs, inspect a live container, and diagnose a CrashLoopBackOff systematically.
  6. Troubleshooting: ImagePullBackOff And Failed Rollouts (2 labs): You can distinguish image pull failures from application crashes, use rollout evidence to find a bad revision, and recover without guessing.

Services And External Traffic

  1. ClusterIP, Selectors, EndpointSlices And DNS (2 labs): You can expose pods with a ClusterIP Service, verify its EndpointSlices, and resolve its stable DNS name.
  2. NodePort, LoadBalancer And ExternalName (2 labs): You can choose among ClusterIP, NodePort, LoadBalancer, and ExternalName according to the traffic boundary you need.
  3. Ingress: Controllers, Hosts, Paths And TLS (2 labs): You can route HTTP traffic with Ingress rules, identify the controller prerequisite, and make TLS termination explicit.
  4. Gateway API: GatewayClass, Gateway And HTTPRoute (2 labs): You can read the Gateway API relationship between a class, a Gateway, and an HTTPRoute and explain its successor role.
  5. NetworkPolicy And The Consul Service Mesh Boundary (2 labs): You can use NetworkPolicy to state pod traffic rules and explain what a service mesh adds beyond the network boundary.
  6. Troubleshooting: DNS, Empty Endpoints And Broken Routes (2 labs): You can trace a failed request from DNS through Service selectors and endpoints to Ingress or Gateway status.

Configuration And Persistent Data

  1. ConfigMaps, Secrets And Configuration Updates (2 labs): You can separate configuration from an image, mount ConfigMaps and Secrets, and choose an update strategy that reaches every pod.
  2. Volumes, PersistentVolumes And PersistentVolumeClaims (2 labs): You can distinguish ephemeral volumes from persistent storage and bind a claim to a volume with a clear access contract.
  3. StorageClasses, CSI And Dynamic Provisioning (2 labs): You can read a StorageClass, explain CSI provisioning, and choose a storage policy that matches workload durability and performance.
  4. StatefulSets, Stable Identity And Data Recovery (2 labs): You can match a StatefulSet to stable identities and claims, update it carefully, and describe a tested recovery path.
  5. Troubleshooting: Pending Claims And Failed Mounts (2 labs): You can separate pending provisioning from attachment and mount failures and collect the events needed to repair each one.

Scheduling And Resource Pressure

  1. Requests, Limits, Quotas And Horizontal Autoscaling (2 labs): You can set resource requests and limits, explain namespace quotas, and read the signals that drive a horizontal autoscaler.
  2. Node Affinity, Pod Affinity And Topology Spread (2 labs): You can express hard and soft placement preferences and spread replicas across topology domains without relying on node names.
  3. Taints, Tolerations And Disruption Budgets (2 labs): You can reserve nodes with taints, permit matching workloads with tolerations, and protect availability during voluntary disruption.
  4. Troubleshooting: Pending Pod Triage (2 labs): You can triage a Pending pod by separating admission, scheduling, storage, and image causes and reading the decisive events.
  5. Troubleshooting: OOMKilled, Throttling And Evictions (2 labs): You can distinguish OOMKilled from CPU throttling and node eviction and choose evidence based on the owner of each event.

Identity And Pod Security

  1. Authentication, ServiceAccounts And Short Lived Tokens (2 labs): You can explain Kubernetes request identity, use a ServiceAccount, and inspect a short lived token without treating it as a permanent credential.
  2. RBAC: Roles, Bindings And Least Privilege (2 labs): You can write a namespaced Role and RoleBinding, test an identity with can-i, and reduce permissions to the smallest useful set.
  3. securityContext: Nonroot, Capabilities And Seccomp (2 labs): You can set a pod and container securityContext that runs as nonroot, drops capabilities, and uses a seccomp profile.
  4. Pod Security Admission And Pod Security Standards (2 labs): You can label a namespace for privileged, baseline, or restricted enforcement and explain warn, audit, and enforce modes.
  5. Troubleshooting: Forbidden Requests And Admission Rejections (2 labs): You can tell an RBAC denial from a Pod Security Admission rejection and repair the right identity, binding, or manifest.

Cluster Operations And Recovery

  1. kubeadm, High Availability And Cluster Lifecycle (1 lab): You can describe kubeadm phases, identify the highly available control plane dependencies, and plan lifecycle changes safely.
  2. Drain, Upgrade, Version Skew And Certificate Maintenance (1 lab): You can plan a node drain and upgrade around disruption budgets, supported version skew, and certificate expiry.
  3. etcd Snapshots And A Tested Restore (2 labs): You can describe an etcd snapshot, protect its metadata, and verify a restore procedure on an isolated control plane.
  4. Troubleshooting: NotReady Nodes And kubelet Logs (1 lab): You can diagnose a NotReady node by separating heartbeat, runtime, network, and resource evidence and reading kubelet logs.
  5. Troubleshooting: API Server And Control Plane Failures (1 lab): You can separate API reachability, authentication, etcd, scheduler, and controller failures using direct health evidence.
  6. Troubleshooting: A Timed Service Recovery Drill (2 labs): You can run a bounded recovery drill from symptom to evidence, repair, smoke test, and written handoff.

Packaging, GitOps And Operators

  1. Package The Service As A Helm Chart (2 labs): You can structure a Helm chart, render values into manifests, and use release history for a reversible application change.
  2. Kustomize Base And Dev And Prod Overlays (2 labs): You can build a reusable Kustomize base, apply dev and prod overlays, and inspect the final manifests before deployment.
  3. Argo CD Applications And Flux Reconciliation (2 labs): You can compare Argo CD and Flux reconciliation, define an application source and destination, and read drift status.
  4. A Tiny CRD, Controller And The Operator Pattern (2 labs): You can read a small CRD, create a custom resource, and explain how a controller reconciles its desired and observed state.
  5. Troubleshooting: GitOps Drift And Controller Failures (2 labs): You can separate repository, controller, admission, and workload failures when a GitOps application is out of sync.

Certification courses