Advanced DevOps and Infrastructure Engineering Course

You can diagnose an unfamiliar Linux host under load and explain what every number in top actually means.

1. Processes, signals and the proc filesystem1.5 hrs
   • process tree
   • signal handling
   • proc inspection
   • file descriptors
   • zombie reaping
2. Filesystems, inodes and disk pressure1.5 hrs
   • mount options
   • inode exhaustion
   • LVM basics
   • disk latency
   • log rotation
3. systemd units and service management1.5 hrs
   • unit files
   • journalctl
   • restart policies
   • dependency ordering
   • timers
4. Users, permissions, sudo and SELinux1.5 hrs
   • POSIX permissions
   • sudoers scoping
   • SELinux contexts
   • audit denials
   • capabilities
5. Bash scripting for operations1.5 hrs
   • set -euo pipefail
   • argument parsing
   • traps and cleanup
   • idempotent scripts
   • shellcheck
6. Performance triage under load1.5 hrs
   • load average
   • iostat
   • CPU steal
   • memory pressure
   • USE method

Hands-on project: Diagnose five broken hosts — disk full, inode exhaustion, runaway process, failed unit, DNS misconfiguration — writing an investigation note for each.

You can trace a connection from a container to an external API and name every hop and every place it can fail.

1. IP, routing and subnetting1.5 hrs
   • CIDR notation
   • routing tables
   • default gateway
   • subnet planning
   • overlapping ranges
2. TCP, UDP and connection states1.5 hrs
   • three-way handshake
   • TIME_WAIT
   • retransmission
   • MTU and fragmentation
   • keepalives
3. DNS in depth1.5 hrs
   • resolution order
   • record types
   • TTL effects
   • split-horizon
   • caching pitfalls
4. TLS and certificate chains1.5 hrs
   • handshake steps
   • chain validation
   • SNI
   • corporate interception
   • expiry monitoring
5. Load balancing and proxies1.5 hrs
   • layer 4 vs 7
   • health checks
   • session affinity
   • reverse proxy
   • upstream timeouts
6. Packet-level diagnosis1.5 hrs
   • tcpdump filters
   • ss and netstat
   • traceroute reading
   • firewall rule inspection
   • evidence packaging

Hands-on project: Diagnose a broken connection crossing NAT, a proxy, a firewall and DNS, and produce a change request the network team will accept.

You can run a branching strategy a team of forty can work in without constant merge pain.

1. Git internals and the commit graph1 hr
   • objects
   • refs
   • the DAG
   • detached HEAD
   • reflog
2. Branching strategies compared1 hr
   • trunk based
   • GitHub flow
   • git flow
   • release branches
   • selection criteria
3. Rebase, merge and history hygiene1 hr
   • rebase vs merge
   • interactive rebase
   • squashing
   • force-with-lease
   • shared branch rules
4. Monorepos versus many repositories1 hr
   • monorepo tooling
   • build scoping
   • ownership boundaries
   • CI cost
   • migration pain
5. Branch protection and review policy1 hr
   • required checks
   • required reviewers
   • CODEOWNERS
   • merge queue
   • bypass auditing
6. Hotfixes, reverts and release tagging1 hr
   • revert strategy
   • cherry-pick
   • semantic tags
   • release notes
   • rollback drill

Hands-on project: Define and document a branching and release strategy for a team of forty, including protection rules, review policy and a hotfix path.

You can build an image that is small, non-root and reproducible, and debug one that will not start.

1. Namespaces, cgroups and what a container is1.5 hrs
   • PID namespace
   • network namespace
   • cgroup limits
   • overlayfs
   • capabilities
2. Images, layers and the build cache1.5 hrs
   • layer stacking
   • cache invalidation
   • build context
   • dockerignore
   • history inspection
3. Writing production Dockerfiles1.5 hrs
   • multi-stage builds
   • non-root user
   • health checks
   • pinned digests
   • entrypoint vs cmd
4. Networking and volumes1.5 hrs
   • bridge networks
   • embedded DNS
   • port publishing
   • named volumes
   • bind mount permissions
5. Compose for local environments1.5 hrs
   • service definitions
   • health-gated ordering
   • profiles
   • override files
   • teardown
6. Image security and the supply chain1.5 hrs
   • Trivy scanning
   • secret leakage
   • SBOM
   • image signing
   • registry policy

Hands-on project: Containerise three services with multi-stage, non-root images under 100 MB each, passing a vulnerability scan with no high findings.

You can deploy and expose a stateless application on Kubernetes and explain every object you created.

1. Architecture and control loop2 hrs
   • API server
   • etcd
   • scheduler
   • controller manager
   • kubelet
2. Pods, deployments and replicasets2 hrs
   • pod lifecycle
   • deployment strategy
   • replicaset ownership
   • rollout and rollback
   • pod disruption budgets
3. Services, endpoints and DNS2 hrs
   • ClusterIP
   • NodePort
   • LoadBalancer
   • headless services
   • cluster DNS
4. Configmaps, secrets and configuration2 hrs
   • configmap mounting
   • secret types
   • env injection
   • immutable configs
   • external secret stores
5. Probes, resources and scheduling2 hrs
   • liveness and readiness
   • startup probes
   • requests vs limits
   • QoS classes
   • node affinity
6. Ingress and TLS2 hrs
   • ingress controllers
   • path and host routing
   • cert-manager
   • TLS secrets
   • external DNS

Hands-on project: Deploy a three-service application with configmaps, secrets, probes, resource requests and an ingress, from manifests you wrote by hand.

You can operate a cluster other people depend on: upgrades, stateful workloads, autoscaling, RBAC and incident diagnosis.

1. RBAC, service accounts and admission control2 hrs
   • roles and bindings
   • service accounts
   • admission controllers
   • PodSecurity standards
   • policy engines
2. Stateful workloads and storage2 hrs
   • statefulsets
   • persistent volume claims
   • storage classes
   • volume expansion
   • backup and restore
3. Autoscaling: pods, nodes and events2 hrs
   • horizontal pod autoscaler
   • vertical scaling
   • cluster autoscaler
   • KEDA
   • scaling lag
4. Cluster upgrades and node lifecycle2 hrs
   • version skew policy
   • drain and cordon
   • surge upgrades
   • node image patching
   • maintenance windows
5. Helm and release management2 hrs
   • chart structure
   • values layering
   • upgrade hooks
   • release history
   • rollback
6. Diagnosing cluster failures2 hrs
   • pending pods
   • CrashLoopBackOff
   • OOMKilled
   • image pull errors
   • node pressure

Hands-on project: Run a production-shaped cluster through a node upgrade, a stateful database failover and an injected incident without data loss or downtime.

You can build cloud infrastructure that is reproducible, reviewable and safe to change on a Friday.

1. Core workflow and the resource graph2 hrs
   • plan and apply
   • resource graph
   • dependencies
   • lifecycle rules
   • targeting
2. State: remote backends and locking2 hrs
   • S3 backend
   • DynamoDB locking
   • state isolation
   • import
   • state surgery risks
3. Modules and reuse2 hrs
   • module interface
   • versioning
   • registry modules
   • composition
   • anti-patterns
4. Workspaces, environments and promotion2 hrs
   • environment separation
   • variable layering
   • promotion flow
   • tfvars management
   • naming discipline
5. Drift, policy and safe change2 hrs
   • drift detection
   • plan review in CI
   • policy as code
   • prevent_destroy
   • approval gates
6. Secrets and provider credentials2 hrs
   • no secrets in state
   • Vault provider
   • dynamic credentials
   • OIDC to cloud
   • credential rotation

Hands-on project: Provision a multi-environment AWS estate with remote state, locking, reusable modules, drift detection and a tested destroy path.

You can bring a fleet of servers to a known state repeatedly, and prove the run is idempotent.

1. Inventory, groups and variables1.5 hrs
   • static inventory
   • dynamic inventory
   • group vars
   • host vars
   • variable precedence
2. Playbooks, tasks and idempotency1.5 hrs
   • task modules
   • changed_when
   • check mode
   • handlers
   • idempotency proof
3. Roles and reusable structure1.5 hrs
   • role layout
   • defaults vs vars
   • dependencies
   • Galaxy roles
   • testing with Molecule
4. Templating with Jinja21.5 hrs
   • template module
   • conditionals
   • loops
   • filters
   • validation before write
5. Secrets with Ansible Vault1.5 hrs
   • vault encryption
   • vault ids
   • CI integration
   • rotation
   • what not to encrypt
6. Ansible at scale and its limits1.5 hrs
   • forks and strategy
   • delegation
   • rolling updates
   • when IaC is better
   • drift reality

Hands-on project: Write a role set that configures a fleet from bare OS to running service, proving a second run changes nothing.

You can build a pipeline fast and trustworthy enough that engineers stop routing around it.

1. Pipeline design and stage ordering2 hrs
   • fail fast
   • stage dependencies
   • parallelism
   • caching
   • runtime budget
2. GitHub Actions in depth2 hrs
   • workflow syntax
   • reusable workflows
   • matrix builds
   • OIDC to cloud
   • runner choice
3. Jenkins pipelines2 hrs
   • declarative pipeline
   • shared libraries
   • agents
   • credentials binding
   • upgrade pain
4. Artefacts, registries and versioning2 hrs
   • artefact immutability
   • semantic versioning
   • registry promotion
   • retention
   • provenance
5. Security gates in the pipeline2 hrs
   • SAST
   • dependency scanning
   • image scanning
   • secret scanning
   • blocking thresholds
6. Deployment strategies and rollback2 hrs
   • rolling
   • blue-green
   • canary
   • feature flags
   • automated rollback

Hands-on project: Build a pipeline from commit to production with security gates, environment promotion, artefact signing and an automated rollback trigger.

You can design an AWS environment with deliberate network, identity and cost decisions rather than console defaults.

1. Accounts, organisations and landing zones2 hrs
   • account strategy
   • organisations
   • SCPs
   • landing zone patterns
   • account vending
2. VPC design and connectivity2 hrs
   • subnet tiers
   • NAT cost
   • transit gateway
   • VPC endpoints
   • peering limits
3. IAM and least privilege2 hrs
   • policy evaluation
   • roles vs users
   • permission boundaries
   • OIDC federation
   • access analyzer
4. Compute and container services2 hrs
   • EC2 sizing
   • auto scaling groups
   • ECS vs EKS
   • Fargate
   • spot strategy
5. Data services and durability2 hrs
   • S3 classes
   • RDS multi-AZ
   • backup policy
   • cross-region replication
   • restore testing
6. Cost engineering on AWS2 hrs
   • cost explorer
   • savings plans
   • rightsizing
   • idle resource cleanup
   • tagging for showback

Hands-on project: Design and build a multi-account AWS landing zone with VPC segmentation, least-privilege IAM, private connectivity and a cost model.

You can answer why a system is slow from telemetry, and build dashboards an on-call engineer can act on at 3am.

1. Metrics with Prometheus1.5 hrs
   • exposition format
   • scrape config
   • cardinality control
   • recording rules
   • federation
2. Dashboards with Grafana1.5 hrs
   • golden signals
   • dashboard hierarchy
   • variables
   • annotations
   • avoiding wall art
3. Log aggregation and structure1.5 hrs
   • structured logging
   • Loki or ELK
   • retention and cost
   • PII redaction
   • query patterns
4. Distributed tracing1.5 hrs
   • OpenTelemetry
   • context propagation
   • sampling
   • span attributes
   • trace analysis
5. Alerting that people trust1.5 hrs
   • symptom-based alerts
   • thresholds vs anomaly
   • alert fatigue
   • routing
   • runbook links
6. Debugging a production incident from signals1.5 hrs
   • RED and USE
   • correlation
   • bisecting deploys
   • hypothesis order
   • proving the fix

Hands-on project: Instrument a distributed application with the three signals and diagnose an injected latency regression using telemetry alone.

You can keep credentials out of your pipelines and code, and produce the evidence an auditor asks for.

1. Secrets management with Vault1.5 hrs
   • dynamic secrets
   • transit encryption
   • auth methods
   • lease renewal
   • seal management
2. Short-lived credentials and OIDC federation1.5 hrs
   • OIDC trust
   • role assumption
   • scope restriction
   • no static keys
   • rotation elimination
3. Supply chain security1.5 hrs
   • dependency pinning
   • SBOM generation
   • artefact signing
   • provenance attestation
   • verification policy
4. Policy as code1.5 hrs
   • OPA basics
   • admission policy
   • Terraform policy
   • exception workflow
   • policy testing
5. Compliance evidence and audit1.5 hrs
   • control mapping
   • audit logs
   • change records
   • access reviews
   • evidence index
6. Incident readiness for security events1.5 hrs
   • credential compromise
   • blast radius
   • revocation drill
   • forensics basics
   • disclosure

Hands-on project: Remove every long-lived credential from a pipeline, replace them with short-lived federated access, and produce an audit evidence pack.

You can define what reliable means for a service in numbers, and run the incident when it is not.

1. SLIs, SLOs and error budgets1.5 hrs
   • indicator selection
   • target setting
   • error budget maths
   • burn rate alerts
   • budget policy
2. Capacity planning and load testing1.5 hrs
   • demand modelling
   • load test design
   • saturation points
   • headroom policy
   • scaling triggers
3. Incident command and response1.5 hrs
   • severity levels
   • incident roles
   • comms cadence
   • mitigation first
   • escalation
4. Blameless post-mortems1.5 hrs
   • timeline
   • contributing factors
   • counterfactual avoidance
   • action items
   • follow-through
5. Chaos engineering and game days1.5 hrs
   • hypothesis design
   • fault injection
   • blast radius control
   • game day format
   • findings backlog
6. On-call that does not burn people out1.5 hrs
   • rotation design
   • alert quality
   • handover
   • toil measurement
   • escalation support

Hands-on project: Define SLOs and error budgets for two services, instrument them, and run a simulated incident ending in a written post-mortem.

You can reduce cloud spend without reducing reliability, and run a platform other teams actually want to use.

1. Finding where the money goes1 hr
   • cost allocation tags
   • untagged spend
   • per-service breakdown
   • anomaly detection
   • showback reporting
2. The levers that matter most1 hr
   • rightsizing
   • commitment discounts
   • spot usage
   • storage tiering
   • idle cleanup
3. Platform as a product1 hr
   • golden paths
   • self-service
   • internal documentation
   • developer feedback
   • adoption metrics
4. Toil reduction and automation1 hr
   • toil inventory
   • automation candidates
   • runbook to code
   • measuring time saved
   • diminishing returns
5. Environment lifecycle and ephemerality1 hr
   • preview environments
   • TTL enforcement
   • teardown automation
   • data seeding
   • cost per environment
6. Reporting to engineering leadership1 hr
   • reliability metrics
   • cost trend
   • delivery metrics
   • risk register
   • roadmap trade-offs

Hands-on project: Produce a costed reduction plan for a cloud estate, implement the top three measures, and report the measured saving.

You can build and operate a complete production platform, then prove it survives failure, scale and an audit.

1. Architecture, requirements and cost ceiling2 hrs
   • requirement capture
   • architecture diagram
   • SLO definition
   • cost ceiling
   • risk register
2. Infrastructure and cluster build3 hrs
   • Terraform modules
   • network segmentation
   • cluster provisioning
   • RBAC
   • node strategy
3. Application delivery and pipeline3 hrs
   • container builds
   • Helm releases
   • pipeline stages
   • security gates
   • promotion flow
4. Observability, SLOs and alerting2 hrs
   • metrics and traces
   • dashboards
   • SLO instrumentation
   • alert routing
   • runbooks
5. Security, secrets and audit evidence2 hrs
   • OIDC federation
   • policy as code
   • SBOM and signing
   • access review
   • evidence pack
6. Injected incident and panel defence2 hrs
   • incident response
   • rollback execution
   • post-mortem
   • cost review
   • architecture defence

Hands-on project: Build a full platform: multi-environment AWS infrastructure in Terraform, Ansible-configured hosts, a Kubernetes cluster with RBAC and autoscaling, containerised services, a CI/CD pipeline with security gates and automated rollback, full observability with SLOs and alerting, secrets via OIDC federation, a cost model and an audit evidence pack — then survive an injected incident and defend it all in review.