PlatformEngr® Kubernetes course

Kubernetes for platform engineers: printable course notes

Run a shared Kubernetes cluster as a platform team: Deployments, Services and Ingress, ConfigMaps and Secrets, requests, limits and quotas, probes and disruption budgets, namespaces and RBAC, NetworkPolicy and Pod Security, five debugging labs, and a capstone.

These pages are the same content as the interactive course, on one page per module, for reading and printing.

Four pieces

PieceWhat it is
See the end resultNot the first step: a 30-minute preview with few explanations. Build the cluster, run checkout, fence it, and watch one failure. Useful to know where you are heading.
Full course9 modules from an empty laptop to a cluster shared by three teams: workloads, config, sizing, probes, RBAC, network walls, Pod Security, five debugging labs and a capstone.
Reference repoThe finished implementation: the cluster, three tenants, three apps, the lab pods and the docs. You copy from it.
Your repok8s-platform: what should exist in your cluster, one folder per owner. You create it in module 00.

Your setup

Commands in these notes use these values (shared with the interactive course, stored only in this browser).

Outline

ModulePartTimeYou areYou will
00 Orientation: what a platform team owns in KubernetesOrientation30 minPlatform and productCreate a three-node cluster and your repo of manifests, and declare team-checkout's namespace from Git.
01 One app, three objects: Deployment, Service, IngressRun a workload45 minPlatform and productRun checkout as a Deployment with 2 replicas, reachable by name inside the cluster and by hostname from your laptop.
02 Configuration and secrets, and where the line isRun a workload40 minPlatform and productGive checkout its settings from a versioned ConfigMap and its password from a Secret that is not in Git.
03 Sizing: requests, limits, and a quota per teamKeep it healthy45 minPlatform and productSize checkout's pods and cap what team-checkout's namespace can take from the cluster.
04 Probes and disruption budgets: staying up while things changeKeep it healthy45 minPlatform and productMake checkout safe to restart, roll out and drain, and prove it by draining a node under load.
05 Two teams, one cluster: namespaces and RBACShare the cluster50 minPlatform teamGive two teams a namespace each, with permissions that stop at the namespace, and prove it with kubectl auth can-i.
06 Walls: NetworkPolicy and Pod SecurityShare the cluster50 minPlatform teamIsolate each team's network and enforce the restricted Pod Security level on both namespaces, without breaking either app.
07 Debugging labs: five ways a pod does not runShare the cluster60 minPlatform and productDiagnose five common pod failures from their signals, fix each one through Git, and write one runbook entry.
08 Capstone: a third team, on your ownShare the cluster60 minPlatform and productOnboard team-payments end to end without step-by-step commands: an internal service that only checkout may call.

Between you and production