Kubernetes: Beginner to Advanced

You can explain cluster internals, configure local environments with minikube and kind, and run imperative vs declarative kubectl commands.

1. What is Kubernetes and why it exists90 min
   • container orchestration
   • cluster state reconciliation
   • declarative configuration
2. Kubernetes vs Docker Swarm vs Nomad90 min
   • architectural tradeoffs
   • scheduling algorithms
   • enterprise adoption
3. Control Plane — API Server, Scheduler, Controller Manager, etcd2 hrs
   • kube-apiserver
   • etcd consensus
   • kube-scheduler
4. Worker Nodes — kubelet, kube-proxy, Container Runtime2 hrs
   • kubelet lifecycle
   • iptables vs IPVS
   • containerd interface
5. kubectl CLI deep dive and kubeconfig90 min
   • contexts
   • namespaces
   • output formatting
6. Setting up local cluster — minikube and kind90 min
   • minikube start
   • kind create cluster
   • kubectl cluster-info
7. Declarative vs Imperative approach60 min
   • kubectl run
   • kubectl apply
   • kubectl replace

Hands-on project: Spin up a local multi-node kind cluster, inspect control plane component logs, and deploy a test NGINX pod declaratively using a YAML manifest with resource limits.

You can configure pod lifecycles, manage multi-container design patterns, and execute zero-downtime rolling deployments.

1. Pod lifecycle and anatomy90 min
   • pod phases
   • restart policies
   • pod spec
2. Multi-container Pods — sidecar, ambassador, adapter patterns2 hrs
   • shared volumes
   • localhost communication
   • init containers
3. ReplicaSets — self-healing and desired state90 min
   • selector matchLabels
   • replica count
   • owner references
4. Deployments — rolling updates and rollback strategies2 hrs
   • maxSurge
   • maxUnavailable
   • kubectl rollout undo
5. Resource requests and limits90 min
   • CPU shares
   • memory limits
   • OOMKilled events
6. Liveness, Readiness, and Startup probes2 hrs
   • httpGet
   • exec probe
   • initialDelaySeconds
7. Pod scheduling — nodeSelector, affinity, taints and tolerations2 hrs
   • nodeAffinity
   • podAntiAffinity
   • taint effects

Hands-on project: Deploy an API service with sidecar logging, configure readiness and liveness probes, and perform a rolling update followed by a clean rollback.

You can expose cluster workloads through ClusterIP, NodePort, LoadBalancer services, and secure HTTP routing with Ingress controllers.

1. ClusterIP, NodePort, and LoadBalancer services90 min
   • service types
   • selectors
   • endpoints
2. DNS resolution inside the cluster90 min
   • CoreDNS
   • service discovery
   • FQDN format
3. Ingress controllers — NGINX, Traefik2 hrs
   • ingress-nginx
   • backend services
   • annotations
4. Ingress rules, path routing and TLS termination2 hrs
   • host matching
   • tls secrets
   • path types
5. Network Policies — restricting Pod-to-Pod communication2 hrs
   • ingress rules
   • egress rules
   • namespace selector
6. CoreDNS configuration90 min
   • Corefile
   • forward plugin
   • custom stubs
7. Service Mesh introduction — Istio and Linkerd overview90 min
   • sidecar injection
   • mutual TLS
   • traffic management

Hands-on project: Deploy an NGINX Ingress controller, create path-based routing rules for frontend and backend services, and isolate pod traffic using NetworkPolicies.

You can decouple application settings and sensitive credentials from code using ConfigMaps, Secrets, and external secret operators.

1. ConfigMaps — creating and consuming config90 min
   • kubectl create configmap
   • envFrom
   • configmap generator
2. Secrets — opaque, TLS, docker-registry types90 min
   • base64 encoding
   • secret types
   • imagePullSecrets
3. Environment variable injection60 min
   • valueFrom
   • fieldRef
   • resourceFieldRef
4. Volume mounts for config and secrets90 min
   • subPath
   • defaultMode
   • hot reloading
5. External Secrets Operator overview2 hrs
   • SecretStore
   • ExternalSecret
   • AWS Secrets Manager
6. Sealed Secrets for GitOps workflows2 hrs
   • kubeseal CLI
   • asymmetric encryption
   • git integration

Hands-on project: Inject application database credentials via Kubernetes Secrets and configuration properties via ConfigMaps mounted both as environment variables and files.

You can provision persistent storage dynamically using StorageClasses, PersistentVolumeClaims, and CSI drivers.

1. Volumes vs PersistentVolumes90 min
   • emptyDir
   • hostPath
   • PV lifecycle
2. PersistentVolumeClaims and binding90 min
   • claim requests
   • volumeMode
   • binding states
3. StorageClasses and dynamic provisioning2 hrs
   • provisioner
   • reclaimPolicy
   • volumeBindingMode
4. Access modes — ReadWriteOnce, ReadOnlyMany, ReadWriteMany60 min
   • RWO
   • ROX
   • RWX compatibility
5. CSI drivers and cloud storage integration2 hrs
   • Container Storage Interface
   • EBS CSI driver
   • node plugin
6. Volume snapshots and backup strategies90 min
   • VolumeSnapshot
   • Velero
   • snapshot controller

Hands-on project: Provision dynamic storage for a database deployment using local StorageClasses and verify data persistence across pod restarts and rescheduling.

You can orchestrate stateful databases, node-level log collectors, and batch processing jobs.

1. StatefulSets — stable identity and ordered deployment2 hrs
   • pod ordinal index
   • persistent volume claim template
   • ordered scaling
2. Headless services for StatefulSets90 min
   • clusterIP None
   • SRV records
   • direct pod DNS
3. DaemonSets — node-level workloads90 min
   • nodeAffinity rule
   • tolerations
   • fluentbit agent
4. Jobs — run-to-completion workloads90 min
   • completions
   • parallelism
   • backoffLimit
5. CronJobs — scheduled batch tasks90 min
   • cron syntax
   • concurrencyPolicy
   • startingDeadlineSeconds
6. Real use case — deploying MySQL with StatefulSet2 hrs
   • primary-replica replication
   • headless discovery
   • init script mount

Hands-on project: Deploy a replicated MySQL cluster using StatefulSets backed by a headless service and schedule daily database backups using CronJobs.

You can enforce cluster security using RBAC roles, ServiceAccounts, Pod Security Standards, and admission controllers.

1. Authentication vs Authorization in Kubernetes90 min
   • X509 certs
   • token review
   • RBAC webhook
2. Roles, ClusterRoles, RoleBindings, ClusterRoleBindings2 hrs
   • verbs
   • apiGroups
   • scope binding
3. ServiceAccounts and token management90 min
   • automountServiceAccountToken
   • token request API
   • secret tokens
4. Pod Security Standards — Privileged, Baseline, Restricted2 hrs
   • enforce mode
   • audit mode
   • restricted context
5. Network Policies for cluster hardening90 min
   • default deny
   • namespace isolation
   • port filtering
6. Audit logging and security scanning with Trivy2 hrs
   • image vulnerability scan
   • k8s manifest scan
   • audit policy file
7. OPA Gatekeeper and admission controllers2 hrs
   • validating webhook
   • Rego language
   • ConstraintTemplate

Hands-on project: Create a restricted developer ServiceAccount with read-only namespace access via Role and RoleBinding, and audit container vulnerabilities using Trivy.

You can package, version, and distribute applications using custom Helm charts and manage multi-chart deployments with Helmfile.

1. What is Helm and why it solves YAML sprawl60 min
   • template engine
   • release management
   • chart repository
2. Charts, Releases, and Repositories90 min
   • helm install
   • helm upgrade
   • helm repo add
3. Writing your own Helm chart from scratch2 hrs
   • helm create
   • Chart.yaml
   • templates directory
4. Values, templates, and overrides2 hrs
   • values.yaml
   • tpl function
   • dot notation
5. Helm hooks and lifecycle management90 min
   • pre-install hook
   • post-upgrade hook
   • weight ordering
6. Artifact Hub — finding and using community charts60 min
   • artifacthub.io
   • dependency management
   • Chart.lock
7. Helmfile for multi-chart deployments2 hrs
   • helmfile.yaml
   • environments
   • secrets integration

Hands-on project: Build a reusable Helm chart for a microservice application from scratch, parameterize environment variables via values.yaml, and deploy via Helmfile.

You can configure Horizontal Pod Autoscalers, Cluster Autoscalers, and resource quotas to optimize cloud spend and performance.

1. Horizontal Pod Autoscaler (HPA)90 min
   • metrics-server
   • targetCPUUtilizationPercentage
   • behavior scaling rules
2. Vertical Pod Autoscaler (VPA)90 min
   • recommender
   • updater
   • updateMode
3. Cluster Autoscaler90 min
   • node groups
   • scale-down delay
   • cluster-autoscaler flags
4. KEDA — event-driven autoscaling2 hrs
   • ScaledObject
   • trigger source
   • RabbitMQ scaler
5. Resource quotas and LimitRanges per namespace90 min
   • ResourceQuota
   • LimitRange
   • default limits
6. Quality of Service classes — Guaranteed, Burstable, BestEffort60 min
   • QoS calculation
   • eviction priority
   • node pressure

Hands-on project: Set up an HPA driven by custom CPU metrics, define Namespace resource quotas, and configure KEDA for queue-based event scaling.

You can implement end-to-end cluster observability with Prometheus, Grafana, central logging, and distributed tracing.

1. Metrics Server setup60 min
   • metrics-server yaml
   • kubectl top pod
   • aggregator layer
2. Prometheus and Grafana stack on Kubernetes2 hrs
   • kube-prometheus-stack
   • ServiceMonitor
   • PromQL queries
3. kube-state-metrics and node-exporter90 min
   • object state metrics
   • hardware metrics
   • scraping targets
4. Centralized logging with EFK stack2 hrs
   • Fluentd daemonset
   • Elasticsearch cluster
   • Kibana discovery
5. Distributed tracing with Jaeger90 min
   • OpenTelemetry collector
   • trace propagation
   • jaeger-query UI
6. Alerting rules and PagerDuty integration90 min
   • PrometheusRule
   • Alertmanager config
   • receiver webhooks

Hands-on project: Deploy the Prometheus Operator stack, build a custom Grafana dashboard for pod memory and CPU metrics, and configure Alertmanager notifications.

You can build automated deployment pipelines and implement pull-based GitOps workflows using ArgoCD and GitHub Actions.

1. CI/CD pipeline overview for containerized apps60 min
   • build vs deploy
   • image tagging strategy
   • registry security
2. GitHub Actions deploying to Kubernetes2 hrs
   • kubectl action
   • kubeconfig secret
   • workflow triggers
3. ArgoCD — GitOps continuous delivery2 hrs
   • Application CRD
   • sync policy
   • argo-cd ui
4. FluxCD — pull-based GitOps workflow2 hrs
   • GitRepository
   • Kustomization CRD
   • flux bootstrap
5. Image update automation90 min
   • ImageRepository
   • ImagePolicy
   • automated PR generation
6. Progressive delivery — canary and blue-green with Argo Rollouts2 hrs
   • Rollout CRD
   • canary analysis
   • traffic shifting

Hands-on project: Set up ArgoCD to synchronize cluster manifests automatically from a Git repository and configure GitHub Actions to build and push container images.

You can upgrade a live cluster and restore it after losing the control plane.

1. What must be backed up90 min
   • etcd snapshots
   • Velero resource and volume backup
   • GitOps as the source of truth
2. Upgrading without downtime90 min
   • Version skew policy
   • Control plane then nodes
   • Surge and drain
3. Keeping workloads up during drain90 min
   • PodDisruptionBudgets
   • Graceful termination
   • Anti-affinity spread
4. Rehearsing the restore90 min
   • Namespace restore
   • Stateful workload recovery
   • Measuring actual RTO

Hands-on project: Back up etcd and namespace state with Velero, perform a control-plane and node-pool upgrade respecting version skew with workloads staying available, then restore one namespace into a fresh cluster and verify the application runs.

You can administer multi-node production clusters, perform etcd backups, manage upgrades, and deploy an end-to-end cloud-native capstone system.

1. Multi-node cluster setup with kubeadm2 hrs
   • kubeadm init
   • kubeadm join
   • CNI plugin installation
2. Managed Kubernetes — EKS, GKE, AKS comparison2 hrs
   • control plane pricing
   • node groups
   • cloud integrations
3. Cluster upgrades — zero downtime strategy2 hrs
   • kubeadm upgrade
   • drain and cordon
   • control plane rotation
4. etcd backup and disaster recovery2 hrs
   • etcdctl snapshot save
   • snapshot restore
   • cert management
5. Node maintenance — drain, cordon, uncordon90 min
   • kubectl cordon
   • kubectl drain --ignore-daemonsets
   • pod disruption budgets
6. Cost optimization on cloud Kubernetes clusters90 min
   • spot instances
   • right-sizing resources
   • Kubecost analysis
7. CKA and CKAD exam strategy and mock tests2 hrs
   • terminal shortcuts
   • imperative command generation
   • time management
8. Capstone Integration, Deployment & Defense3 hrs
   • end-to-end architecture review
   • gitops synchronization test
   • failure injection simulation

Hands-on project: Deploy a complete multi-tier microservices application onto a production-grade Kubernetes cluster using Helm charts, manage secrets via External Secrets, monitor via Prometheus/Grafana, automate delivery via ArgoCD, and execute an etcd disaster recovery drill.