PlatformEngr® Fleet GitOps course

Fleet GitOps: printable course notes

Run a fleet of Kubernetes clusters the way platform teams do: clusters from Terraform, a hub running Argo CD, add-ons and guardrails on every cluster, products onboarded with one file, and every change, production included, through issues, pull requests and approvals.

These pages are the same content as the interactive course, on one page per module, for reading and printing.

Four pieces, one fleet

PieceWhat it is
See the end resultNot the first step: create the finished fleet from the template, run terraform apply, watch a product deploy. About 30 minutes, few explanations. Useful to know where you are heading, or as a demo.
Full courseBuild the same fleet piece by piece, in the order a platform team would, with the reasoning, the workflow and failure drills.
Reference repoThe completed implementation. You copy folders from it, one pull request per module, and compare against it at the end.
Your repoThe repo you operate and Argo CD watches. Starts empty in the course; created from the template in the end-result preview.

Your setup

Commands in these notes use these values (shared with the interactive course, stored only in this browser).

Outline

ModulePartTimeYou areYou will
00 Orientation: the platform you will runOrientation20 minPlatform and productKnow the scenario, who owns what, how a change travels, and the four pieces of this course. Tell the course who you are so every command is yours.
01 Your fleet repo and the change workflowPlatform foundation45 minPlatform teamCreate your fleet repo with CI, issue forms and review rules in place before anything else, then make your first change through the whole journey: an issue, a pull request, validation, a merge.
02 Clusters as code with TerraformPlatform foundation45 minPlatform teamProvision the hub and the workload clusters declaratively, install Argo CD and register the clusters with labels from the inventory, all from one reviewed Terraform change.
03 Hand the fleet over to GitPlatform foundation40 minPlatform teamAdd the root Application so Argo CD manages the fleet from your repo, generate the first Applications per cluster, and watch Argo CD undo a manual change.
04 Platform add-ons on every clusterPlatform foundation40 minPlatform teamInstall the same pinned set of add-ons (ingress, certificates, secrets, metrics, policy engine, rollouts) on every cluster with one matrix ApplicationSet, and see a new cluster get them for free.
05 Guardrails and the namespace baselinePlatform foundation45 minPlatform teamShip the policies that protect the platform and the chart that gives every product the same namespace baseline: quota, limits, network policy, RBAC, Pod Security, ownership and cost labels.
06 Onboard a product, declarativelyProduct self-service60 minProduct teamAs team-checkout, request a product, propose one product.yaml and your deployment config, and get an AppProject, a namespace baseline and an Application per environment without touching a cluster.
07 Ship, promote and roll backProduct self-service50 minProduct teamShip a change to dev with no approval, promote a version to prod through the production gate, trace both to the clusters, and roll back with a revert.
08 Operate the fleet: failure drillsOperate and grow60 minPlatform and productRun five realistic failures and, for each, answer: what failed, how it was detected, who responds, how it is corrected, and how the platform prevents it next time.
09 Observability and change visibilityOperate and grow40 minPlatform and productShip logs from every cluster to Loki and Grafana on the hub, declaratively, and connect what is running to the change that put it there.
10 Secrets and identityOperate and grow45 minPlatform and productGive products secrets without putting secrets in Git, and replace shared passwords with identities: External Secrets per namespace, SSO and per-team access in Argo CD.
11 Going to cloud, and splitting the repoOperate and grow60 minPlatform teamKnow how the same fleet runs on AKS, EKS, GKE or existing clusters, and when and how to split the single repo into infrastructure, platform and product repositories.
12 Reference architecture and the road to productionOperate and grow30 minPlatform and productConnect every exercise into one architecture, compare your repo with the reference, and leave with a prioritised production checklist.

The change journey

  1. Requested: GitHub issue from a form
  2. Proposed: Pull request, Closes #issue
  3. Validated: validate check
  4. Previewed: plan comment: Applications added/removed
  5. Approved: Code owners; prod: environment approval
  6. Merged: Commit on main, deployment record
  7. Reconciled: Argo CD syncs the commit
  8. Healthy: Synced and Healthy on every cluster

Where clusters run

kind on your laptop is the default for every module. On AKS, EKS or GKE only module 02 differs (scripts in infrastructure/cloud/ instead of Terraform); module 11 covers the Terraform route for clouds.

Between you and real production