Curriculum

1. 01Why distributed systems need an orchestratorContainer and distributed systems foundations · foundation · ~18 min
2. 02Linux namespaces and cgroups — the kernel primitives Pods inheritContainer and distributed systems foundations · foundation · ~18 min
3. 03Containers, images and OCI — what the kubelet actually pullsContainer and distributed systems foundations · foundation · ~16 min
4. 04Container runtimes — runc, containerd, CRI and the kubelet boundaryContainer and distributed systems foundations · foundation · ~16 min
5. 05Distributed systems fundamentals every Kubernetes operator must internaliseContainer and distributed systems foundations · foundation · ~16 min
6. 06Desired state and reconciliation — the model that runs the clusterContainer and distributed systems foundations · foundation · ~16 min

1. 01Kubernetes control plane and worker architecture at a glanceKubernetes architecture · intermediate · ~18 min
2. 02The API server — the front door of the clusterKubernetes architecture · intermediate · ~18 min
3. 03etcd — the cluster's source of truthKubernetes architecture · intermediate · ~20 min
4. 04The scheduler — assigning Pods to nodesKubernetes architecture · intermediate · ~18 min
5. 05The controller manager and built-in controllersKubernetes architecture · intermediate · ~18 min
6. 06The worker node — kubelet, runtime, CNI, CSI, and the service dataplaneKubernetes architecture · intermediate · ~18 min

1. 01kubectl as a Kubernetes REST clientKubernetes API · intermediate · ~16 min
2. 02The API server pipeline — authentication, authorisation, admission, validationKubernetes API · intermediate · ~18 min
3. 03Authentication — who is making this request?Kubernetes API · intermediate · ~16 min
4. 04Authorisation — RBAC, the Node authoriser, and webhook delegationKubernetes API · intermediate · ~18 min
5. 05Admission control — mutating, validating, and policy enforcementKubernetes API · intermediate · ~18 min
6. 06etcd persistence — encoding, watch, and the cluster's write pathKubernetes API · intermediate · ~18 min

1. 01The control loop — observe, diff, actDesired state and reconciliation · advanced · ~18 min
2. 02Built-in controllers — what each one doesDesired state and reconciliation · advanced · ~18 min
3. 03Convergence — when does the system stabilise?Desired state and reconciliation · advanced · ~16 min
4. 04Reconciliation pitfalls — what breaks the loop in productionDesired state and reconciliation · advanced · ~18 min
5. 05Watch, informers, and events — how controllers observe the clusterDesired state and reconciliation · advanced · ~16 min
6. 06Level-triggered vs edge-triggered reconciliationDesired state and reconciliation · advanced · ~14 min

1. 01Kubernetes objects — apiVersion, kind, metadataKubernetes objects and metadata · intermediate · ~16 min
2. 02spec and status — the discipline of declared intent vs observed realityKubernetes objects and metadata · intermediate · ~16 min
3. 03Labels and annotations — identifying and describing objectsKubernetes objects and metadata · intermediate · ~16 min
4. 04Selectors — matching objects by labelsKubernetes objects and metadata · intermediate · ~16 min
5. 05Owner references and garbage collectionKubernetes objects and metadata · intermediate · ~14 min
6. 06Finalizers — blocking deletion until cleanup completesKubernetes objects and metadata · intermediate · ~14 min

1. 01kubectl contexts, kubeconfig, and multi-cluster administrationkubectl for administrators · intermediate · ~18 min
2. 02kubectl get, describe, and explain — read-only triagekubectl for administrators · intermediate · ~16 min
3. 03kubectl output formatting — jsonpath, custom-columns, go-templateskubectl for administrators · intermediate · ~18 min
4. 04kubectl logs, exec, cp, and debug — runtime inspectionkubectl for administrators · intermediate · ~18 min
5. 05kubectl edit, label, annotate, set — in-place modificationkubectl for administrators · intermediate · ~16 min
6. 06kubectl plugins (krew) and shell completionkubectl for administrators · intermediate · ~14 min

1. 01kubectl apply — last-applied-configuration and three-way mergeDeclarative resource management · intermediate · ~18 min
2. 02kubectl diff and server-side diff — preview before applyDeclarative resource management · intermediate · ~16 min
3. 03kubectl patch — strategic merge, JSON patch, JSON merge patchDeclarative resource management · intermediate · ~18 min
4. 04kubectl delete — propagation, foreground, background, orphansDeclarative resource management · intermediate · ~18 min
5. 05Server-side apply — field ownership and conflict resolutionDeclarative resource management · intermediate · ~18 min
6. 06Drift detection and remediation — keeping live and manifest in syncDeclarative resource management · intermediate · ~16 min

1. 01Pod anatomy — apiVersion, kind, spec, the atomic unit of schedulingPods · intermediate · ~18 min
2. 02Containers, images, ports, and environment variablesPods · intermediate · ~18 min
3. 03Pod IP and the shared network namespacePods · intermediate · ~16 min
4. 04Shared PID, IPC, and volumes across Pod containersPods · intermediate · ~16 min
5. 05Volumes in Pods — emptyDir, hostPath, projected, and CSIPods · intermediate · ~18 min
6. 06Pod lifecycle, restart policy, and terminationPods · intermediate · ~18 min

1. 01Pod phases — Pending, Running, Succeeded, Failed, UnknownPod lifecycle · intermediate · ~16 min
2. 02Container states — Waiting, Running, TerminatedPod lifecycle · intermediate · ~16 min
3. 03Pod conditions — PodScheduled, Initialized, ContainersReady, ReadyPod lifecycle · intermediate · ~16 min
4. 04Startup probes — slow-starting containers and the InitialDelay trapPod lifecycle · intermediate · ~14 min
5. 05Readiness probes — controlling Service traffic and rolling updatesPod lifecycle · intermediate · ~16 min
6. 06Liveness probes and CrashLoopBackOff — when to restart a containerPod lifecycle · intermediate · ~16 min

1. 01Graceful termination — SIGTERM and the grace periodPod termination and signals · intermediate · ~16 min
2. 02preStop hooks — what to do before SIGTERM arrivesPod termination and signals · intermediate · ~16 min
3. 03terminationGracePeriodSeconds and SIGKILL — when the kubelet gives upPod termination and signals · intermediate · ~14 min
4. 04Force deletion, stuck Pods, and the PodDisruptionBudget connectionPod termination and signals · intermediate · ~16 min
5. 05Node shutdown and Pod termination — graceful vs forcefulPod termination and signals · intermediate · ~14 min
6. 06Troubleshooting termination — diagnosing stuck and slow shutdownsPod termination and signals · intermediate · ~14 min

1. 01Init containers — sequential setup before the main containerInit containers and sidecars · advanced · ~18 min
2. 02Init container ordering and readiness gatesInit containers and sidecars · advanced · ~16 min
3. 03Native sidecar containers (KEP-753, 1.28+)Init containers and sidecars · advanced · ~16 min
4. 04Sidecar lifecycle, restart, and resource semanticsInit containers and sidecars · advanced · ~16 min
5. 05Migrating from annotation-based sidecars to native sidecarsInit containers and sidecars · advanced · ~16 min
6. 06Production sidecar patterns — logging, mesh, init migrationsInit containers and sidecars · advanced · ~18 min

1. 01CPU and memory requests — scheduling and the resource modelResource requests and limits · advanced · ~18 min
2. 02cgroups v2 and Linux CFS quotas — the kernel primitivesResource requests and limits · advanced · ~16 min
3. 03Throttling, OOMKill, and the resource pressure lifecycleResource requests and limits · advanced · ~16 min
4. 04LimitRange defaults and constraints — namespace-level resource policiesResource requests and limits · advanced · ~16 min
5. 05Node allocatable, kubelet reservations, and capacity planningResource requests and limits · advanced · ~16 min
6. 06Troubleshooting resource pressure — a production triage frameworkResource requests and limits · advanced · ~16 min

1. 01QoS classes overview — Guaranteed, Burstable, BestEffortKubernetes QoS classes · advanced · ~16 min
2. 02Guaranteed class — matching requests and limits for predictabilityKubernetes QoS classes · advanced · ~14 min
3. 03Burstable class — requests with bursting headroomKubernetes QoS classes · advanced · ~14 min
4. 04BestEffort class — no reservations, evicted firstKubernetes QoS classes · advanced · ~14 min
5. 05Eviction order and QoS — node pressure and pod survivalKubernetes QoS classes · advanced · ~16 min
6. 06QoS-based production patterns — designing for the right classKubernetes QoS classes · advanced · ~16 min

1. 01Namespaces — logical isolation is not security isolationTenancy and isolation · advanced · ~16 min
2. 02RBAC and Roles per namespace — least privilege as tenancy boundaryTenancy and isolation · advanced · ~16 min
3. 03ResourceQuota per namespace — capping total resource consumptionTenancy and isolation · advanced · ~16 min
4. 04Pod Security Standards per namespace — restricted, baseline, privilegedTenancy and isolation · advanced · ~16 min
5. 05NetworkPolicy per namespace — microsegmentation at the cluster levelTenancy and isolation · advanced · ~16 min
6. 06Multi-tenancy patterns — namespaces as logical clustersTenancy and isolation · advanced · ~16 min

1. 01Deployment anatomy and ReplicaSet — the controller chainDeployments · advanced · ~18 min
2. 02Rollout and revision history — change tracking and rollbackDeployments · advanced · ~16 min
3. 03Rolling updates — maxSurge, maxUnavailable, and rollout phasesDeployments · advanced · ~16 min
4. 04Rollout status, pause, and resume — orchestrating long changesDeployments · advanced · ~14 min
5. 05Rollback — kubectl rollout undo and revision-aware recoveryDeployments · advanced · ~16 min
6. 06Deployment strategies — Recreate, Rolling, Blue-Green, CanaryDeployments · advanced · ~18 min

1. 01Rolling Update — maxSurge, maxUnavailable, and the math of a safe rolloutDeployment strategies · advanced · ~18 min
2. 02Recreate — destructive but simple when downtime is acceptableDeployment strategies · advanced · ~16 min
3. 03Blue/Green — atomic Service swap between two complete environmentsDeployment strategies · advanced · ~18 min
4. 04Canary — small fraction first, metric-driven promotionDeployment strategies · advanced · ~18 min
5. 05Readiness, preStop, and Service traffic — gating rollout safetyDeployment strategies · advanced · ~17 min
6. 06Progressive delivery — controllers that automate canary and blue/greenDeployment strategies · advanced · ~18 min

1. 01StatefulSets — when Deployments are not the right controllerStatefulSets · advanced · ~18 min
2. 02Stable identity — ordinals, headless Services, and predictable DNSStatefulSets · advanced · ~17 min
3. 03Persistent storage — volumeClaimTemplates, per-Pod PVCs, and reclaimStatefulSets · advanced · ~17 min
4. 04Ordered deployment and the partition field — controlling rollout sequenceStatefulSets · advanced · ~17 min
5. 05StatefulSet operations — scaling, rolling out, and the deletion sequenceStatefulSets · advanced · ~18 min
6. 06StatefulSet anti-patterns — when not to reach for the database controllerStatefulSets · advanced · ~17 min

1. 01DaemonSets — one Pod per node for node-local agentsDaemonSets · advanced · ~17 min
2. 02DaemonSet update strategies — RollingUpdate vs OnDeleteDaemonSets · advanced · ~16 min
3. 03DaemonSet scheduling — nodeSelector, taints, and tolerationsDaemonSets · advanced · ~16 min
4. 04DaemonSet use cases — log collectors, CNI agents, monitoring, and moreDaemonSets · advanced · ~17 min
5. 05Drain and cordon interplay — what happens to DaemonSet Pods during node maintenanceDaemonSets · advanced · ~17 min
6. 06Host networking, hostPath, and mount propagation — node-level access patternsDaemonSets · advanced · ~17 min

1. 01Jobs — running Pods to completionJobs and CronJobs · advanced · ~17 min
2. 02completionMode — Indexed and NonIndexed, work-queue vs partitioned batchesJobs and CronJobs · advanced · ~17 min
3. 03Restart policy, backoffLimit, and podFailurePolicy — Job resilienceJobs and CronJobs · advanced · ~17 min
4. 04CronJobs — schedules, concurrency policy, and missed-run handlingJobs and CronJobs · advanced · ~17 min
5. 05Job patterns — work queues, parallel shards, and indexed batchesJobs and CronJobs · advanced · ~17 min
6. 06Job troubleshooting — failed runs, TTL cleanup, and debuggingJobs and CronJobs · advanced · ~17 min

1. 01ConfigMaps — key-value configuration decoupled from container imagesConfiguration · advanced · ~17 min
2. 02Environment variables — ConfigMap keys as Pod env varsConfiguration · advanced · ~17 min
3. 03Mounted volumes — ConfigMap as files inside the containerConfiguration · advanced · ~17 min
4. 04Update behaviour — env vars are frozen, files are eventually consistentConfiguration · advanced · ~17 min
5. 05Immutable ConfigMaps and Secrets — preventing runtime driftConfiguration · advanced · ~16 min
6. 06Configuration anti-patterns — what not to put in a ConfigMapConfiguration · advanced · ~17 min

1. 01Secrets — base64 is not encryptionSecrets · advanced · ~17 min
2. 02Consuming Secrets — env vars, mounted files, image pull credentialsSecrets · advanced · ~17 min
3. 03etcd storage — where Secrets live and who can read themSecrets · advanced · ~16 min
4. 04Encryption at rest — EncryptionConfiguration, AES-GCM, and key rotationSecrets · advanced · ~18 min
5. 05RBAC for Secrets — least-privilege access to credentialsSecrets · advanced · ~17 min
6. 06External secret managers — Vault, External Secrets Operator, and patternsSecrets · advanced · ~18 min

1. 01The scheduler pipeline — observe, filter, score, bindScheduling fundamentals · advanced · ~17 min
2. 02Filter phase — predicates that eliminate impossible nodesScheduling fundamentals · advanced · ~17 min
3. 03Score phase — how the scheduler ranks feasible nodesScheduling fundamentals · advanced · ~17 min
4. 04Binding — how the scheduler reserves a node and commits the choiceScheduling fundamentals · advanced · ~17 min
5. 05Pending Pods — diagnosing a Pod that will not scheduleScheduling fundamentals · advanced · ~17 min
6. 06Multiple schedulers and profiles — custom and workload-specific schedulingScheduling fundamentals · advanced · ~17 min

1. 01nodeSelector — the simplest node-placement mechanismNode affinity · advanced · ~16 min
2. 02requiredDuringSchedulingIgnoredDuringExecution — hard node affinityNode affinity · advanced · ~17 min
3. 03preferredDuringSchedulingIgnoredDuringExecution — soft node affinityNode affinity · advanced · ~16 min
4. 04Well-known node labels — kubernetes.io and topology.kubernetes.ioNode affinity · advanced · ~16 min
5. 05Taints and tolerations preview — the counterpart to Node AffinityNode affinity · advanced · ~16 min
6. 06Node Affinity patterns — GPU, dedicated pools, latency zonesNode affinity · advanced · ~17 min

1. 01Pod affinity and anti-affinity — co-locate or separate PodsPod affinity · advanced · ~17 min
2. 02requiredDuringSchedulingRequiredDuringExecution — hard inter-pod affinityPod affinity · advanced · ~16 min
3. 03requiredDuringSchedulingIgnoredDuringExecution — hard inter-pod anti-affinityPod affinity · advanced · ~17 min
4. 04preferredDuringSchedulingIgnoredDuringExecution — soft inter-pod affinityPod affinity · advanced · ~16 min
5. 05HA patterns — spreading replicas for availabilityPod affinity · advanced · ~17 min
6. 06Performance cost — large topology domains and broad selectorsPod affinity · advanced · ~17 min

1. 01Topology spread constraints — balanced distribution across domainsTopology spread · advanced · ~17 min
2. 02maxSkew — the imbalance budgetTopology spread · advanced · ~16 min
3. 03Topology keys — kubernetes.io/hostname, topology.kubernetes.io/zone, and beyondTopology spread · advanced · ~16 min
4. 04labelSelector and matchLabelKeys — dynamic groupingTopology spread · advanced · ~16 min
5. 05Topology spread vs anti-affinity — choosing the right toolTopology spread · advanced · ~17 min
6. 06Topology spread HA patterns — balanced distribution in productionTopology spread · advanced · ~17 min

1. 01Taints and tolerations — the node-repulsion modelScheduling and node lifecycle · advanced · ~16 min
2. 02Effect types — NoSchedule, PreferNoSchedule, NoExecuteScheduling and node lifecycle · advanced · ~17 min
3. 03Dedicated nodes — infra, GPU, and workload isolationScheduling and node lifecycle · advanced · ~18 min
4. 04tolerationSeconds and graceful eviction windowsScheduling and node lifecycle · advanced · ~15 min
5. 05Taints for node problems — NotReady, unreachable, pressureScheduling and node lifecycle · advanced · ~17 min
6. 06Taints and tolerations in production — anti-patterns and disciplineScheduling and node lifecycle · advanced · ~16 min

1. 01The Pending Pod — diagsosing scheduling failuresScheduling and node lifecycle · advanced · ~18 min
2. 02Resource-driven failures — insufficient CPU, memory, and storageScheduling and node lifecycle · advanced · ~17 min
3. 03Affinity, taint, and topology failuresScheduling and node lifecycle · advanced · ~16 min
4. 04PVC and storage-driven scheduling failuresScheduling and node lifecycle · advanced · ~17 min
5. 05Preemption and priority — when a Pod evicts anotherScheduling and node lifecycle · advanced · ~18 min
6. 06Scheduling gates, profiles, and the extended schedulerScheduling and node lifecycle · advanced · ~17 min

1. 01The Node object — cluster view of a worker hostNode architecture · advanced · ~17 min
2. 02The components on a node — kubelet, runtime, CNI, kube-proxyNode architecture · advanced · ~18 min
3. 03Node filesystem layout — /var/lib/kubelet, /var/log, /var/lib/containerdNode architecture · advanced · ~16 min
4. 04Node registration — how a node joins the clusterNode architecture · advanced · ~16 min
5. 05Node addresses and topology — labels the cluster readsNode architecture · advanced · ~17 min
6. 06Node observers and the node controller — who decides statusNode architecture · advanced · ~17 min

1. 01The kubelet — gRPC client, Pod sync loop, status reporterNode architecture · advanced · ~18 min
2. 02Pod lifecycle from the kubelet's view — admit, sync, run, terminateNode architecture · advanced · ~18 min
3. 03Probes — liveness, readiness, and startupNode architecture · advanced · ~17 min
4. 04Static Pods and the mirror Pod — bootstrap without an API serverNode architecture · advanced · ~16 min
5. 05kubelet garbage collection — images, containers, volumesNode architecture · advanced · ~15 min
6. 06kubelet credentials and rotation — TLS, tokens, and certificatesNode architecture · advanced · ~17 min

1. 01The Container Runtime Interface — kubelet-to-runtime contractContainer runtime · advanced · ~17 min
2. 02containerd — the production CRI implementationContainer runtime · advanced · ~18 min
3. 03Image pulls — registry, layers, and the kubelet's roleContainer runtime · advanced · ~17 min
4. 04RuntimeClass and runtime alternatives — runc, kata, gVisorContainer runtime · advanced · ~17 min
5. 05Runtime failure modes — ErrImagePull, CrashLoopBackOff, OOMKilledContainer runtime · advanced · ~17 min
6. 06Runtime migration history — Docker, dockershim, and the path to containerdContainer runtime · advanced · ~16 min

1. 01Node conditions — Ready, MemoryPressure, DiskPressure, PIDPressureNode lifecycle · advanced · ~17 min
2. 02Node heartbeats — the lease mechanism and the controller's grace periodNode lifecycle · advanced · ~16 min
3. 03The node controller — cluster-level node lifecycle managementNode lifecycle · advanced · ~17 min
4. 04Pressure-driven conditions — memory, disk, PID when the kubelet detects themNode lifecycle · advanced · ~17 min
5. 05Unknown and NotReady nodes — partial observabilityNode lifecycle · advanced · ~16 min
6. 06Adding and removing nodes — node lifecycle operationsNode lifecycle · advanced · ~16 min

1. 01Eviction fundamentals — soft, hard, and the kubelet's loopNode pressure and eviction · advanced · ~17 min
2. 02Memory pressure eviction — the kubelet's reclaim logicNode pressure and eviction · advanced · ~17 min
3. 03Disk pressure eviction — imagefs, logs, and the node filesystemNode pressure and eviction · advanced · ~17 min
4. 04PID pressure eviction — when the kernel runs out of PIDsNode pressure and eviction · advanced · ~16 min
5. 05Eviction monitoring — metrics, alerts, and the kubelet's exposesNode pressure and eviction · advanced · ~16 min
6. 06Eviction flow — from pressure to eviction to controller replacementNode pressure and eviction · advanced · ~17 min

1. 01Cordon and uncordon — the soft scheduling gateCordon, drain, uncordon · advanced · ~16 min
2. 02kubectl drain — the eviction-based maintenance toolCordon, drain, uncordon · advanced · ~17 min
3. 03Drain with DaemonSets — what runs through the drainCordon, drain, uncordon · advanced · ~16 min
4. 04Drain with PodDisruptionBudgets — the interruption limitCordon, drain, uncordon · advanced · ~17 min
5. 05Drain with local data — emptyDir, hostPath, and the data-loss riskCordon, drain, uncordon · advanced · ~16 min
6. 06Drain automation — Cordoning, draining, and replacing nodes at scaleCordon, drain, uncordon · advanced · ~17 min

1. 01PodDisruptionBudgets — the voluntary disruption limitPodDisruptionBudgets · advanced · ~17 min
2. 02minAvailable — the floor on running PodsPodDisruptionBudgets · advanced · ~16 min
3. 03maxUnavailable — the ceiling on unavailable PodsPodDisruptionBudgets · advanced · ~16 min
4. 04PDB and eviction — what the eviction API actually checksPodDisruptionBudgets · advanced · ~17 min
5. 05PDB failure modes — when the protection backfiresPodDisruptionBudgets · advanced · ~17 min
6. 06PDB best practices — production discipline for protected workloadsPodDisruptionBudgets · advanced · ~17 min

1. 01The Kubernetes networking model — four rules and a contractKubernetes networking · advanced · ~17 min
2. 02Pod-to-Pod across nodes — the cross-node routing problemKubernetes networking · advanced · ~17 min
3. 03Pod-to-Service — the Service abstraction and the kube-proxy dataplaneKubernetes networking · advanced · ~18 min
4. 04External-to-Service — NodePort, LoadBalancer, and IngressKubernetes networking · advanced · ~17 min
5. 05DNS and service discovery — CoreDNS, the resolv.conf, and the FQDNKubernetes networking · advanced · ~17 min
6. 06Network troubleshooting — the diagnostic workflowKubernetes networking · advanced · ~17 min

1. 01CNI specification — the contract between kubelet and the network pluginContainer Network Interface · advanced · ~17 min
2. 02CNI lifecycle — ADD, DEL, CHECK, and the kubelet as the runtimeContainer Network Interface · advanced · ~17 min
3. 03IPAM — how the CNI assigns Pod IPs deterministicallyContainer Network Interface · advanced · ~18 min
4. 04CNI chaining — delegating to multiple plugins in orderContainer Network Interface · advanced · ~17 min
5. 05Comparing CNI plugins — Calico, Cilium, Flannel, Weave, and the choice matrixContainer Network Interface · advanced · ~18 min
6. 06CNI installation and upgrade — the operational disciplineContainer Network Interface · advanced · ~18 min

1. 01The Pod network namespace and veth pair — what the kubelet actually createsPod networking · advanced · ~18 min
2. 02Pod-to-Pod communication — same node, different nodePod networking · advanced · ~18 min
3. 03Host network and Pod network — the trade-off and the consequencesPod networking · advanced · ~16 min
4. 04Pod CIDR allocation — how the cluster splits the IP space across nodesPod networking · advanced · ~17 min
5. 05MTU and fragmentation — the silent failurePod networking · advanced · ~17 min
6. 06Dual-stack networking — IPv4 and IPv6 side by sidePod networking · advanced · ~17 min

1. 01Services and ClusterIP — the stable virtual IP for a set of PodsServices · advanced · ~18 min
2. 02Service types — choosing the right exposure for the trafficServices · advanced · ~17 min
3. 03NodePort — exposing a Service on every nodeServices · advanced · ~16 min
4. 04LoadBalancer — the cloud-managed external endpointServices · advanced · ~17 min
5. 05ExternalName — the CNAME alias to an external serviceServices · advanced · ~14 min
6. 06Headless services and Service topology — direct Pod addressingServices · advanced · ~16 min

1. 01Service discovery fundamentals — the four patterns and the trade-offsService discovery · advanced · ~17 min
2. 02DNS for Services — the cluster DNS, the records, and the search pathService discovery · advanced · ~18 min
3. 03EndpointSlices — the scalable service-to-Pod mappingService discovery · advanced · ~17 min
4. 04Labels, selectors, and the publishNotReadyAddresses optionService discovery · advanced · ~16 min
5. 05SRV records and port discovery — finding the port without an A recordService discovery · advanced · ~14 min
6. 06Service discovery anti-patterns — the most common mistakesService discovery · advanced · ~16 min

1. 01kube-proxy fundamentals — the Service dataplanekube-proxy · advanced · ~18 min
2. 02iptables mode — the legacy default and the rule explosionkube-proxy · advanced · ~18 min
3. 03IPVS mode — high-performance Service load balancingkube-proxy · advanced · ~17 min
4. 04eBPF mode — Cilium kube-proxy replacement and the kernel-bypass dataplanekube-proxy · advanced · ~17 min
5. 05kube-proxy mode comparison — the 1.34 default and the choice matrixkube-proxy · advanced · ~17 min
6. 06kube-proxy troubleshooting — iptables, IPVS, and eBPF diagnosticskube-proxy · advanced · ~17 min

1. 01CoreDNS fundamentals — the cluster DNS architectureCoreDNS · advanced · ~17 min
2. 02The Corefile — CoreDNS configuration and the plugin chainCoreDNS · advanced · ~17 min
3. 03The Kubernetes plugin — how CoreDNS serves cluster recordsCoreDNS · advanced · ~17 min
4. 04Stub domains and upstream resolvers — extending CoreDNS for custom domainsCoreDNS · advanced · ~15 min
5. 05CoreDNS autoscaling and tuning — performance for the clusterCoreDNS · advanced · ~16 min
6. 06CoreDNS troubleshooting — diagnosing the cluster DNSCoreDNS · advanced · ~17 min

1. 01Ingress fundamentals — the cluster HTTP gatewayIngress · advanced · ~17 min
2. 02Ingress controllers — choosing the right one for the workloadIngress · advanced · ~17 min
3. 03IngressClass and defaults — managing multiple controllersIngress · advanced · ~15 min
4. 04Ingress TLS termination — the cluster HTTPS gatewayIngress · advanced · ~16 min
5. 05Ingress path and host routing — the cluster URL spaceIngress · advanced · ~16 min
6. 06Ingress troubleshooting — diagnosing the cluster HTTP gatewayIngress · advanced · ~17 min

1. 01Gateway API introduction — the next-generation IngressGateway API · advanced · ~17 min
2. 02GatewayClass — the infrastructure provider resourceGateway API · advanced · ~15 min
3. 03Gateway — the cluster operator resourceGateway API · advanced · ~17 min
4. 04HTTPRoute — the application developer resourceGateway API · advanced · ~17 min
5. 05Other route types — TCPRoute, UDPRoute, TLSRoute, GRPCRouteGateway API · advanced · ~15 min
6. 06Gateway API adoption and migration — from Ingress to Gateway APIGateway API · advanced · ~17 min

1. 01NetworkPolicy fundamentals — the cluster firewall and the CNI dependencyNetworkPolicy · advanced · ~18 min
2. 02NetworkPolicy ingress rules — controlling inbound trafficNetworkPolicy · advanced · ~16 min
3. 03NetworkPolicy egress rules — controlling outbound trafficNetworkPolicy · advanced · ~16 min
4. 04NetworkPolicy selectors — pods, namespaces, and IP blocksNetworkPolicy · advanced · ~15 min
5. 05Default-deny policies — the zero-trust patternNetworkPolicy · advanced · ~16 min
6. 06CNI-specific NetworkPolicy extensions — Calico and CiliumNetworkPolicy · advanced · ~16 min

1. 01Systematic network troubleshooting — the methodologyNetwork troubleshooting · advanced · ~18 min
2. 02Pod-to-Pod troubleshooting — diagnosing the Pod networkNetwork troubleshooting · advanced · ~17 min
3. 03Service troubleshooting — diagnosing the Service dataplaneNetwork troubleshooting · advanced · ~17 min
4. 04DNS troubleshooting — diagnosing the cluster DNSNetwork troubleshooting · advanced · ~17 min
5. 05NetworkPolicy troubleshooting — diagnosing the cluster firewallNetwork troubleshooting · advanced · ~17 min
6. 06Packet capture and network performance — diagnosing the networkNetwork troubleshooting · advanced · ~17 min

1. 01Packet capture in Kubernetes — what you actually need and whyPacket capture · advanced · ~17 min
2. 02tcpdump in Kubernetes — the flags that matterPacket capture · advanced · ~16 min
3. 03Capturing inside a container — Pod-level network namespacesPacket capture · advanced · ~16 min
4. 04Service mesh capture — Istio, Linkerd, Cilium, and the mTLS rewritesPacket capture · advanced · ~17 min
5. 05CNI-aware capture — Calico, Cilium, and the tools that know the clusterPacket capture · advanced · ~16 min
6. 06Capture performance, retention, and the cost of seeing every bytePacket capture · advanced · ~17 min

1. 01MTU fundamentals — what MTU is, what it does, and why it breaks in KubernetesMTU problems · advanced · ~17 min
2. 02Overlay MTU — VXLAN, IPIP, Geneve, and the encapsulation overheadMTU problems · advanced · ~16 min
3. 03MTU and the CNI — how Calico, Cilium, Flannel set the Pod MTUMTU problems · advanced · ~16 min
4. 04MTU troubleshooting — finding the bottleneck, validating the fixMTU problems · advanced · ~17 min
5. 05Cloud-provider MTU — AWS, GCP, Azure, and the underlay constraintsMTU problems · advanced · ~16 min
6. 06MTU operations — incident response, runbook, and validationMTU problems · advanced · ~16 min

1. 01Storage fundamentals — what storage is in Kubernetes and what it is notStorage fundamentals · advanced · ~16 min
2. 02Block vs file vs object storage — and what Kubernetes usesStorage fundamentals · advanced · ~16 min
3. 03The kubelet volume manager — how volumes become Pod mountsStorage fundamentals · advanced · ~16 min
4. 04The I/O path — from application syscall to storage backendStorage fundamentals · advanced · ~17 min
5. 05Storage concepts — access modes, capacity, and the API surfaceStorage fundamentals · advanced · ~16 min
6. 06Storage architecture — designing storage for production clustersStorage fundamentals · advanced · ~17 min

1. 01Ephemeral vs persistent volumes — the fundamental distinctionVolumes · advanced · ~16 min
2. 02emptyDir — the ephemeral directory, its variants, and its trapsVolumes · advanced · ~16 min
3. 03hostPath — mounting the node filesystem into a PodVolumes · advanced · ~16 min
4. 04Persistent volumes introduction — PVs, PVCs, and the binding contractVolumes · advanced · ~16 min
5. 05Volume mounts — how Pods consume volumes, subPaths, and projectionsVolumes · advanced · ~16 min
6. 06Volume lifecycle — from PVC creation to PV deletion and reclamationVolumes · advanced · ~17 min

1. 01PV-PVC binding — how Kubernetes matches storage requests to volumesPersistentVolumes and Claims · advanced · ~16 min
2. 02PV lifecycle — the states and transitions of a PersistentVolumePersistentVolumes and Claims · advanced · ~16 min
3. 03PVC lifecycle — the states and transitions of a PersistentVolumeClaimPersistentVolumes and Claims · advanced · ~16 min
4. 04Access modes in depth — RWO, ROX, RWX, RWOP, and what each enablesPersistentVolumes and Claims · advanced · ~16 min
5. 05Reclaim policies in depth — Retain, Delete, Recycle, and the backup strategyPersistentVolumes and Claims · advanced · ~16 min
6. 06PV-PVC anti-patterns — common storage mistakes and how to avoid themPersistentVolumes and Claims · advanced · ~17 min

1. 01StorageClass basics — provisioning templates, parameters, and binding modesStorageClasses · advanced · ~16 min
2. 02The default StorageClass — implicit bindings and the production riskStorageClasses · advanced · ~16 min
3. 03Provisioners and CSI drivers — what calls the storage backendStorageClasses · advanced · ~16 min
4. 04Volume binding modes — Immediate vs WaitForFirstConsumer in depthStorageClasses · advanced · ~16 min
5. 05Volume expansion — growing PVCs online and the capacity disciplineStorageClasses · advanced · ~16 min
6. 06StorageClass anti-patterns — misconfigurations that cause incidentsStorageClasses · advanced · ~17 min

1. 01CSI overview — the Container Storage Interface standard and its lifecycleCSI · advanced · ~17 min
2. 02The CSI controller plugin — Create, Delete, Attach, Snapshot, ExpandCSI · advanced · ~17 min
3. 03The CSI node plugin — Stage, Publish, Format, MountCSI · advanced · ~17 min
4. 04The CSI gRPC protocol — the wire format, errors, and idempotencyCSI · advanced · ~16 min
5. 05Attach vs mount vs format — the three CSI operations and their separationCSI · advanced · ~16 min
6. 06Deploying and operating CSI drivers in productionCSI · advanced · ~17 min

1. 01PVC Pending — the diagnostic ladder for a stuck volume claimStorage failure modes · advanced · ~16 min
2. 02Attach failures — multipath, device limits, and the kernel-level diagnosticsStorage failure modes · advanced · ~16 min
3. 03Mount failures — wrong fsType, missing secrets, and the kubelet-level diagnosticStorage failure modes · advanced · ~16 min
4. 04Topology affinity — the binding constraints between zones, regions, and nodesStorage failure modes · advanced · ~16 min
5. 05Volume expansion failures — when growing a PVC does not workStorage failure modes · advanced · ~16 min
6. 06Storage incident runbook — the complete diagnostic and recoveryStorage failure modes · advanced · ~17 min

1. 01Application-consistency vs crash-consistency — what backups actually meanStateful workloads · advanced · ~16 min
2. 02StatefulSet alone is not enough — why stateful workloads need an OperatorStateful workloads · advanced · ~16 min
3. 03The Operator pattern — custom resources, controllers, and the reconciliation loopStateful workloads · advanced · ~16 min
4. 04Quiesce, freeze, and application hooks — the techniques for consistent backupsStateful workloads · advanced · ~16 min
5. 05Backup and restore patterns for stateful workloadsStateful workloads · advanced · ~16 min
6. 06Stateful workload anti-patterns — the storage mistakes that cause data lossStateful workloads · advanced · ~17 min

1. 01Snapshots are not backups — what CSI snapshots actually give youStorage snapshots · advanced · ~16 min
2. 02The VolumeSnapshot CRD — schema, lifecycle, and the restore procedureStorage snapshots · advanced · ~16 min
3. 03Snapshot lifecycle — creation, status, deletion, and the retention policyStorage snapshots · advanced · ~16 min
4. 04Restore from snapshot — the dataSource procedure and the validation stepsStorage snapshots · advanced · ~16 min
5. 05Application-consistent snapshots — quiesce, freeze, and the application-level hooksStorage snapshots · advanced · ~17 min
6. 06Snapshot operations — schedulers, Velero, and the production disciplineStorage snapshots · advanced · ~17 min

1. 01Threat modeling Kubernetes — who, what, where, whySecurity foundations · advanced · ~16 min
2. 02Defense in depth — layered controls for the clusterSecurity foundations · advanced · ~15 min
3. 03Attack surface mapping — what is exposed to whomSecurity foundations · advanced · ~15 min
4. 04CVE landscape and known issues — staying currentSecurity foundations · advanced · ~14 min
5. 05Security posture assessment — measuring the clusterSecurity foundations · advanced · ~15 min
6. 06Zero trust in Kubernetes — never trust, always verifySecurity foundations · advanced · ~16 min

1. 01X.509 client certificates — the legacy defaultAuthentication · advanced · ~16 min
2. 02Bearer tokens — long-lived, file-based, deprecatedAuthentication · advanced · ~14 min
3. 03Projected ServiceAccount tokens — TokenRequest and audienceAuthentication · advanced · ~16 min
4. 04OIDC — corporate identity for human usersAuthentication · advanced · ~17 min
5. 05Anonymous access — the request that has no identityAuthentication · advanced · ~13 min
6. 06Webhook authentication — TokenReview and external identityAuthentication · advanced · ~14 min

1. 01Role and ClusterRole — the verbs the cluster allowsRBAC · advanced · ~16 min
2. 02RoleBinding and ClusterRoleBinding — granting the roleRBAC · advanced · ~15 min
3. 03Verbs and resources — the RBAC decision matrixRBAC · advanced · ~16 min
4. 04kubectl auth can-i — testing RBAC decisionsRBAC · advanced · ~14 min
5. 05Over-permissioned ServiceAccounts — the most common RBAC failureRBAC · advanced · ~15 min
6. 06RBAC anti-patterns — what to avoid and whyRBAC · advanced · ~15 min

1. 01kubectl auth can-i — verifying RBAC decisions in practicekubectl auth · advanced · ~14 min
2. 02kubectl auth reconcile — generating bindings from fileskubectl auth · advanced · ~12 min
3. 03kubectl auth impersonate — acting as another identitykubectl auth · advanced · ~13 min
4. 04kubectl whoami — knowing what the cluster seeskubectl auth · advanced · ~11 min
5. 05kubectl create token — issuing and caching tokenskubectl auth · advanced · ~13 min
6. 06Troubleshooting authentication — the diagnostic workflowkubectl auth · advanced · ~14 min

1. 01ServiceAccount anatomy — the workload identityServiceAccounts · advanced · ~14 min
2. 02Token volume projection — the SA token in the PodServiceAccounts · advanced · ~13 min
3. 03TokenRequest API — programmatic token issuanceServiceAccounts · advanced · ~13 min
4. 04Default bindings and automountServiceAccountTokenServiceAccounts · advanced · ~13 min
5. 05SA tokens in pod spec — explicit projection and audiencesServiceAccounts · advanced · ~13 min
6. 06External token issuers — IRSA, Workload Identity, SPIFFEServiceAccounts · advanced · ~14 min

1. 01Admission pipeline — the gatekeeper between authn and persistenceAdmission control · advanced · ~15 min
2. 02ValidatingAdmissionPolicy — declarative policy in CELAdmission control · advanced · ~14 min
3. 03MutatingAdmissionWebhook — modifying objects at admissionAdmission control · advanced · ~13 min
4. 04ValidatingAdmissionWebhook — external policy at admissionAdmission control · advanced · ~14 min
5. 05ImagePolicyWebhook — deprecated, the predecessor to CosignAdmission control · advanced · ~11 min
6. 06Admission best practices — the operational disciplineAdmission control · advanced · ~14 min

1. 01Pod Security Standards — overview of the three profilesPod Security Standards · advanced · ~14 min
2. 02Privileged profile — when and how to allow full accessPod Security Standards · advanced · ~12 min
3. 03Baseline profile — preventing known privilege escalationsPod Security Standards · advanced · ~12 min
4. 04Restricted profile — minimum-allow for productionPod Security Standards · advanced · ~13 min
5. 05PSA labels and modes — enforcing PSS at admissionPod Security Standards · advanced · ~12 min
6. 06PSS migration — moving workloads to restrictedPod Security Standards · advanced · ~14 min

1. 01Linux capabilities — the kernel privilege boundaryLinux security controls · advanced · ~14 min
2. 02Seccomp RuntimeDefault — the runtime's safe baselineLinux security controls · advanced · ~12 min
3. 03Custom seccomp profiles — Localhost and workload-specific rulesLinux security controls · advanced · ~14 min
4. 04AppArmor profiles — kernel-enforced workload confinementLinux security controls · advanced · ~12 min
5. 05SELinux — kernel-enforced confinement on RHEL-based nodesLinux security controls · advanced · ~12 min
6. 06Security Context — runAsUser, runAsNonRoot, readOnlyRootFilesystemLinux security controls · advanced · ~13 min

1. 01Image tags vs digests — pinning for supply chain integritySupply chain security · advanced · ~13 min
2. 02SBOM — Software Bill of Materials for supply chainSupply chain security · advanced · ~13 min
3. 03Vulnerability scanning — detecting known CVEs in imagesSupply chain security · advanced · ~14 min
4. 04Cosign — image signing and verificationSupply chain security · advanced · ~14 min
5. 05Notary v2 — supply chain attestations beyond signaturesSupply chain security · advanced · ~12 min
6. 06SLSA provenance — attesting the build processSupply chain security · advanced · ~13 min

1. 01Secret types — the Kubernetes Secret primitivesSecrets security · advanced · ~13 min
2. 02Etcd encryption — Secrets at restSecrets security · advanced · ~13 min
3. 03Secret mounting risks — how Secrets leakSecrets security · advanced · ~13 min
4. 04Secrets RBAC — controlling who can read SecretsSecrets security · advanced · ~13 min
5. 05External Secrets Operator — Secrets outside KubernetesSecrets security · advanced · ~13 min
6. 06Secret best practices — the operational disciplineSecrets security · advanced · ~13 min

1. 01etcd as the Kubernetes database — what it stores, who writes, who readsetcd fundamentals · advanced · ~19 min
2. 02Raft consensus — leader election, terms, log replicationetcd fundamentals · advanced · ~19 min
3. 03Write-ahead log, bbolt, and the on-disk formatetcd fundamentals · advanced · ~18 min
4. 04Snapshots, compaction, defragmentation — 8 GB warning, 2 GB recommendedetcd fundamentals · advanced · ~18 min
5. 05Performance limits — disk fsync, write rate, latency budgetsetcd fundamentals · advanced · ~18 min
6. 06etcd flags, environment, and tuning the operator controlsetcd fundamentals · advanced · ~18 min

1. 01Quorum math — floor(N/2)+1, odd members, fault toleranceetcd quorum · advanced · ~17 min
2. 02Three vs five members — design choices, write latency, fault toleranceetcd quorum · advanced · ~16 min
3. 03Split-brain prevention — how Raft refuses to fabricate leadershipetcd quorum · advanced · ~17 min
4. 04Member lifecycle — add, remove, replace, retireetcd quorum · advanced · ~18 min
5. 05Failure domain placement — AZs, racks, hosts, and cost of spreadetcd quorum · advanced · ~16 min
6. 06Quorum loss recovery — when a cluster is stuck, snapshot restore is the pathetcd quorum · advanced · ~18 min

1. 01Why back up etcd — the failure modes only snapshots coveretcd backup · advanced · ~16 min
2. 02etcdctl snapshot save — flags, options, and integrationetcd backup · advanced · ~18 min
3. 03Backup storage strategy — local, off-cluster, object storageetcd backup · advanced · ~17 min
4. 04Encryption at rest for snapshots — what to encrypt and howetcd backup · advanced · ~17 min
5. 05Snapshot validation — verify before you trustetcd backup · advanced · ~17 min
6. 06Backup cadence and retention — schedule, RPO, RTO, complianceetcd backup · advanced · ~16 min

1. 01When to restore — the decision treeetcd restore · advanced · ~16 min
2. 02Pre-flight checks — what to verify before running the restoreetcd restore · advanced · ~17 min
3. 03Stopping the control plane — API server, controller manager, scheduleretcd restore · advanced · ~17 min
4. 04etcdutl snapshot restore — the per-host commandsetcd restore · advanced · ~18 min
5. 05Restarting the cluster — bringing etcd back up safelyetcd restore · advanced · ~18 min
6. 06Validating the restored cluster — production readiness checksetcd restore · advanced · ~18 min

1. 01API server role — the cluster gateway and only writer to etcdAPI server · advanced · ~17 min
2. 02Request lifecycle — authentication, authorisation, admissionAPI server · advanced · ~17 min
3. 03Watch semantics — list-watch, resourceVersion, informerAPI server · advanced · ~17 min
4. 04Aggregated API servers — kube-aggregator, extension pointsAPI server · advanced · ~16 min
5. 05API server flags and configuration — secure-port, audit, encryptionAPI server · advanced · ~17 min
6. 06API server HA — multiple instances, load balancing, failoverAPI server · advanced · ~17 min

1. 01Scheduler architecture — informer, queue, scheduling cycleScheduler · advanced · ~17 min
2. 02Filtering — feasibility across nodesScheduler · advanced · ~17 min
3. 03Scoring — least allocated, balanced, topology, customScheduler · advanced · ~16 min
4. 04Reserve, permit, bind — the cycle's latter phasesScheduler · advanced · ~17 min
5. 05Scheduling framework — plugins, profiles, extensibilityScheduler · advanced · ~17 min
6. 06Multiple schedulers and profiles — coexistence and opt-inScheduler · advanced · ~16 min

1. 01Controller manager overview — the cluster's automation engineController manager · advanced · ~17 min
2. 02Node controller — heartbeats, NotReady, evictionController manager · advanced · ~17 min
3. 03Deployment, ReplicaSet, and other workload controllersController manager · advanced · ~17 min
4. 04EndpointSlice controller — Service-to-Pod traffic surfaceController manager · advanced · ~16 min
5. 05ServiceAccount and Token controllers — identity for PodsController manager · advanced · ~17 min
6. 06Custom controllers — extending the cluster with codeController manager · advanced · ~17 min

1. 01HA topology — stacked vs external etcd, design choicesControl plane HA · advanced · ~17 min
2. 02Load balancer — HAProxy, keepalived, MetalLB, cloud LBControl plane HA · advanced · ~17 min
3. 03DNS and kubeconfig — distributing the API server endpointControl plane HA · advanced · ~17 min
4. 04Failure domain design — AZ placement and topologyControl plane HA · advanced · ~16 min
5. 05Backup before change — the snapshot as a change gateControl plane HA · advanced · ~16 min
6. 06HA validation — chaos testing, drills, observabilityControl plane HA · advanced · ~17 min

1. 01kubeadm init — phases, output, and post-init sanitykubeadm · advanced · ~18 min
2. 02kubeadm join — control-plane and worker node bootstrappingkubeadm · advanced · ~17 min
3. 03Certificate management — kubeadm PKI, rotation, validationkubeadm · advanced · ~18 min
4. 04kubeadm-config ConfigMap — ClusterConfiguration, KubeletConfigurationkubeadm · advanced · ~17 min
5. 05Upgrade plan — prepare, control-plane, workers in orderkubeadm · advanced · ~18 min
6. 06kubeadm upgrade apply — phases, validation, post-upgrade checkskubeadm · advanced · ~18 min

1. 01Capacity sizing — control plane and worker node sizingBuilding a production cluster · advanced · ~17 min
2. 02OS and kernel tuning — sysctl, transparent huge pages, disk schedulersBuilding a production cluster · advanced · ~17 min
3. 03Container runtime — containerd, runc, and runtime choiceBuilding a production cluster · advanced · ~17 min
4. 04CNI selection — Cilium, Calico, Flannel, and choosingBuilding a production cluster · advanced · ~17 min
5. 05Load balancer for the cluster — keepalived, HAProxy, cloud LBBuilding a production cluster · advanced · ~17 min
6. 06Time sync, DNS, certificates — foundations and observability stackBuilding a production cluster · advanced · ~17 min

1. 01Cluster certificates — the PKI that holds the cluster togetherCluster certificates · advanced · ~16 min
2. 02Default 1-year expiry — the clock that is always runningCluster certificates · advanced · ~14 min
3. 03check-expiration — inventorying the cluster certsCluster certificates · advanced · ~13 min
4. 04Certificate renewal — kubeadm certs renew and the rotation sequenceCluster certificates · advanced · ~15 min
5. 05Cert rotation in /etc/kubernetes/pki — the file-by-file walkCluster certificates · advanced · ~14 min
6. 06Cert expiry monitoring — alerting before the outageCluster certificates · advanced · ~14 min

1. 01Upgrade sequence — read release notes, backup, control plane, then workers in wavesKubernetes upgrades · advanced · ~17 min
2. 02kubeadm upgrade apply — the leader's upgradeKubernetes upgrades · advanced · ~15 min
3. 03Pre-upgrade backup — the snapshot that catches the rollbackKubernetes upgrades · advanced · ~13 min
4. 04Worker drain and upgrade — the in-place upgrade patternKubernetes upgrades · advanced · ~14 min
5. 05CNI and add-on upgrades — the post-control-plane migrationsKubernetes upgrades · advanced · ~14 min
6. 06Post-upgrade validation — confirming the cluster is healthyKubernetes upgrades · advanced · ~13 min

1. 01Version skew policy — the compatibility matrixVersion skew · advanced · ~14 min
2. 02kube-apiserver vs kubelet — the asymmetric skewVersion skew · advanced · ~13 min
3. 03Controller-manager and scheduler — the symmetric skewVersion skew · advanced · ~12 min
4. 04kubectl compatibility — the operator clientVersion skew · advanced · ~11 min
5. 05etcd compatibility — the K8s minor and the etcd minorVersion skew · advanced · ~12 min
6. 06Skew validation tooling — verifying the cluster is in policyVersion skew · advanced · ~12 min

1. 01kubectl deprecations — inspecting manifest compatibilityAPI deprecation · advanced · ~13 min
2. 02pluto — finding deprecated APIs in Helm chartsAPI deprecation · advanced · ~13 min
3. 03kube-no-trouble — the cluster-wide deprecation auditAPI deprecation · advanced · ~12 min
4. 04--dry-run=server for manifest review — server-side validationAPI deprecation · advanced · ~12 min
5. 05API removal planning — the 9-month calendarAPI deprecation · advanced · ~12 min
6. 06CI/CD gating for deprecated APIs — the pipeline enforcementAPI deprecation · advanced · ~13 min

1. 01Worker upgrade patterns — in-place vs surgeWorker upgrades · advanced · ~14 min
2. 02Drain before upgrade — the rule of patienceWorker upgrades · advanced · ~13 min
3. 03Surge and replace — the cloud-native worker upgradeWorker upgrades · advanced · ~14 min
4. 04kubelet-only upgrade — the patch-level maintenanceWorker upgrades · advanced · ~12 min
5. 05Workers in waves — the PDB-driven schedulingWorker upgrades · advanced · ~13 min
6. 06Worker validation after upgrade — confirming the cluster is healthyWorker upgrades · advanced · ~12 min

1. 01Cluster Autoscaler — the cluster-level scalerCluster autoscaling · advanced · ~14 min
2. 02Node group configuration — the scaling targetsCluster autoscaling · advanced · ~14 min
3. 03Scale-up triggers — when the cluster growsCluster autoscaling · advanced · ~13 min
4. 04Scale-down triggers — when the cluster shrinksCluster autoscaling · advanced · ~13 min
5. 05Cooldown and balance — the multi-node-group strategyCluster autoscaling · advanced · ~13 min
6. 06Cluster Autoscaler integration with cloud providers — the contractCluster autoscaling · advanced · ~13 min

1. 01HPA — Horizontal Pod Autoscaler conceptsHorizontal Pod Autoscaler · advanced · ~14 min
2. 02metrics.k8s.io and the Metrics Server — the default metrics sourceHorizontal Pod Autoscaler · advanced · ~14 min
3. 03Custom metrics API — application-specific scalingHorizontal Pod Autoscaler · advanced · ~14 min
4. 04Behavior block — stabilization and scaling policiesHorizontal Pod Autoscaler · advanced · ~13 min
5. 05Scaling policies — controlling the rate of changeHorizontal Pod Autoscaler · advanced · ~12 min
6. 06HPA anti-patterns — the pitfalls to avoidHorizontal Pod Autoscaler · advanced · ~13 min

1. 01VPA — Vertical Pod Autoscaling conceptsVertical Pod Autoscaler · advanced · ~13 min
2. 02VPA recommender — the recommendation engineVertical Pod Autoscaler · advanced · ~13 min
3. 03VPA updater — evicting pods with new requestsVertical Pod Autoscaler · advanced · ~13 min
4. 04VPA admission controller — the mutating webhookVertical Pod Autoscaler · advanced · ~12 min
5. 05VPA vs HPA — when to use whichVertical Pod Autoscaler · advanced · ~13 min
6. 06VPA limitations — the boundaries of vertical scalingVertical Pod Autoscaler · advanced · ~12 min

1. 01Capacity planning — the discipline of resource budgetingCapacity planning · advanced · ~13 min
2. 02Resource requests and limits — the resource budgeting primitivesCapacity planning · advanced · ~13 min
3. 03Cluster utilization analysis — the metrics of capacityCapacity planning · advanced · ~13 min
4. 04Bin packing — fitting workloads on nodesCapacity planning · advanced · ~13 min
5. 05Right-sizing — the discipline of resource optimizationCapacity planning · advanced · ~12 min
6. 06Capacity forecasting — the planning horizonCapacity planning · advanced · ~12 min

1. 01Cluster observability — the four pillarsCluster observability · advanced · ~13 min
2. 02Signals — metrics, logs, traces, events in depthCluster observability · advanced · ~13 min
3. 03Cluster-level vs workload-level observabilityCluster observability · advanced · ~12 min
4. 04Observability stack components — the toolboxCluster observability · advanced · ~13 min
5. 05SLO/SLI/SLA — the observability-driven targetsCluster observability · advanced · ~13 min
6. 06Observability maturity — the progression of the disciplineCluster observability · advanced · ~12 min

1. 01kube-state-metrics — the cluster's object metricskube-state-metrics · advanced · ~13 min
2. 02KSM metrics taxonomy — the cluster's object statekube-state-metrics · advanced · ~13 min
3. 03KSM deployment — installing the metrics collectorkube-state-metrics · advanced · ~13 min
4. 04KSM vs cAdvisor — different scopes of metricskube-state-metrics · advanced · ~12 min
5. 05KSM Prometheus integration — the metrics flowkube-state-metrics · advanced · ~13 min
6. 06KSM labels and annotations — the metadata for querieskube-state-metrics · advanced · ~12 min

1. 01Metrics Server — the resource metrics APIMetrics Server · advanced · ~13 min
2. 02Resource metrics API — the metrics.k8s.io surfaceMetrics Server · advanced · ~12 min
3. 03Metrics Server deployment — installing the resource metricsMetrics Server · advanced · ~13 min
4. 04kubectl top internals — the interactive metrics queryMetrics Server · advanced · ~11 min
5. 05HPA integration with Metrics Server — the scaling loopMetrics Server · advanced · ~12 min
6. 06Metrics Server scaling — large clusters and high availabilityMetrics Server · advanced · ~12 min

1. 01Prometheus — the cluster metrics foundationPrometheus · advanced · ~14 min
2. 02Prometheus Operator vs kube-prometheus-stack — the deployment choicePrometheus · advanced · ~13 min
3. 03Service discovery — the Kubernetes integrationPrometheus · advanced · ~13 min
4. 04Recording rules — pre-computing the metricsPrometheus · advanced · ~13 min
5. 05Alerting rules — the Prometheus to Alertmanager flowPrometheus · advanced · ~13 min
6. 06Long-term storage — Thanos for PrometheusPrometheus · advanced · ~14 min

1. 01Container stdout to logs — the logging pipelineLogging · advanced · ~13 min
2. 02Node log paths — the files on the hostLogging · advanced · ~12 min
3. 03Loki and Promtail — the log collection and storageLogging · advanced · ~13 min
4. 04Fluentd and Fluent Bit — the alternative log collectorLogging · advanced · ~13 min
5. 05Log aggregation — the cluster-wide pipelineLogging · advanced · ~13 min
6. 06Log-based alerting — the queries and the alertsLogging · advanced · ~12 min

1. 01Distributed tracing — the request journeyTracing · advanced · ~13 min
2. 02OpenTelemetry — the SDK and the CollectorTracing · advanced · ~13 min
3. 03Trace context propagation — the W3C standardTracing · advanced · ~13 min
4. 04Jaeger and Tempo — the trace backendsTracing · advanced · ~13 min
5. 05Trace instrumentation — manual and auto-instrumentationTracing · advanced · ~13 min
6. 06Tracing + metrics + logs — the three signals integratedTracing · advanced · ~13 min

1. 01Kubernetes events — the 1-hour TTL and the event-recorderEvents · advanced · ~13 min
2. 02Event types — Normal, Warning, and the involved objectsEvents · advanced · ~12 min
3. 03Event recorder — emitting events from controllersEvents · advanced · ~13 min
4. 04Event exporter — the long-term storage for eventsEvents · advanced · ~13 min
5. 05Event rate limiting — the throttle on the event floodEvents · advanced · ~13 min
6. 06Event retention — the long-term storage for eventsEvents · advanced · ~12 min

1. 01Alertmanager — the alert routing engineAlerting · advanced · ~13 min
2. 02Alert rules — Prometheus alerting rules for productionAlerting · advanced · ~13 min
3. 03Inhibition and silences — the alert noise reductionAlerting · advanced · ~12 min
4. 04Alert routing — the routing trees and the receiversAlerting · advanced · ~13 min
5. 05Alert receivers — Slack, PagerDuty, and webhookAlerting · advanced · ~12 min
6. 06Runbook links — the alert to the documentationAlerting · advanced · ~12 min

1. 01Observability resilience — monitoring the monitoringObservability resilience · advanced · ~13 min
2. 02Self-monitoring — Prometheus monitors itselfObservability resilience · advanced · ~12 min
3. 03Metric reliability — the metric qualityObservability resilience · advanced · ~13 min
4. 04Cardinality control — the high-cardinality explosion preventionObservability resilience · advanced · ~13 min
5. 05Alert on observability — the self-monitoring alertsObservability resilience · advanced · ~13 min
6. 06Observability HA — the high availability of the observability stackObservability resilience · advanced · ~13 min

1. 01Audit policy stages — RequestReceived, ResponseStarted, ResponseComplete, PanicAudit logs · advanced · ~14 min
2. 02Audit log backends — log file and webhookAudit logs · advanced · ~13 min
3. 03Audit log volume management — the rotation and archivalAudit logs · advanced · ~13 min
4. 04Audit policy in production — the security and compliance patternsAudit logs · advanced · ~13 min
5. 05Audit log in production — the security investigation and complianceAudit logs · advanced · ~13 min
6. 06Audit log debugging — the troubleshooting patternsAudit logs · advanced · ~12 min

1. 01Backup strategy — what to protectBackup strategy · advanced · ~14 min
2. 02etcd backup — the cluster state protectionBackup strategy · advanced · ~13 min
3. 03Persistent data backup — the volumesBackup strategy · advanced · ~13 min
4. 04Manifest backup — Git as the source of truthBackup strategy · advanced · ~13 min
5. 05Secret backup — the encrypted credentialsBackup strategy · advanced · ~13 min
6. 06Disaster recovery plan — the cluster reconstitutionBackup strategy · advanced · ~14 min

1. 01Workload backup principles — etcd is not a backupWorkload backup · advanced · ~18 min
2. 02Application-consistent backups — database quiescence and orderingWorkload backup · advanced · ~17 min
3. 03CSI volume snapshots — the API and lifecycleWorkload backup · advanced · ~17 min
4. 04The snapshot data flow — controllers, sidecars, and the CSI RPC chainWorkload backup · advanced · ~16 min
5. 05PVC, PV, and snapshot relationships — what to back up and in what orderWorkload backup · advanced · ~17 min
6. 06Object storage for backups — S3, MinIO, and the durability rulesWorkload backup · advanced · ~16 min

1. 01Velero architecture — controllers, plugins, and the data pathKubernetes backup tools · advanced · ~17 min
2. 02Installing and configuring Velero — install paths, credentials, and namespace selectionKubernetes backup tools · advanced · ~16 min
3. 03Velero Restic vs Kopia vs native CSI snapshots — the consistency trade-offKubernetes backup tools · advanced · ~17 min
4. 04Velero backup lifecycle — schedules, hooks, and resource selectionKubernetes backup tools · advanced · ~17 min
5. 05Velero restore — selector logic, namespace mapping, and the ordering trapsKubernetes backup tools · advanced · ~17 min
6. 06Verify the backup is actually restorable — the principles-first disciplineKubernetes backup tools · advanced · ~16 min

1. 01DR principles — RPO, RTO, and the cost of recoveryDisaster recovery · advanced · ~17 min
2. 02Recovery architecture for control-plane loss — the design choicesDisaster recovery · advanced · ~17 min
3. 03Etcd recovery scenarios — snapshot, restore, and the quorum trapDisaster recovery · advanced · ~16 min
4. 04Replica rebuild from manifests — when Git is the backupDisaster recovery · advanced · ~16 min
5. 05Cross-cluster restore — restoring a backup into a different clusterDisaster recovery · advanced · ~16 min
6. 06DR testing and game days — the validation cadenceDisaster recovery · advanced · ~16 min

1. 01Cluster loss — the end-to-end recovery sequenceComplete cluster loss · advanced · ~18 min
2. 02New infrastructure — provisioning nodes from scratchComplete cluster loss · advanced · ~17 min
3. 03Control plane rebuild — kubeadm init, HA topology, and the join sequenceComplete cluster loss · advanced · ~17 min
4. 04Networking restoration — CNI, CoreDNS, and cluster DNS verificationComplete cluster loss · advanced · ~16 min
5. 05Storage restoration — CSI drivers, StorageClasses, and snapshot recoveryComplete cluster loss · advanced · ~16 min
6. 06Cluster state, workers, workloads, persistent data, and validation — phases 5-9Complete cluster loss · advanced · ~17 min

1. 01Multi-cluster concepts — when one cluster is not enoughMulti-cluster · advanced · ~17 min
2. 02Cluster API — declarative Kubernetes cluster lifecycleMulti-cluster · advanced · ~17 min
3. 03Rancher — fleet management with downstream clustersMulti-cluster · advanced · ~17 min
4. 04Tanzu — VMware fleet management with the Tanzu Kubernetes PlatformMulti-cluster · advanced · ~17 min
5. 05Multi-cluster service mesh and federation — connectivity across clustersMulti-cluster · advanced · ~17 min
6. 06Multi-cluster anti-patterns — the most common mistakesMulti-cluster · advanced · ~16 min

1. 01Cluster boundaries — why separate clustersCluster boundaries · advanced · ~16 min
2. 02Environment isolation — dev, staging, prod, and the promotion pipelineCluster boundaries · advanced · ~16 min
3. 03Geography and compliance — region, residency, and the regulatory boundariesCluster boundaries · advanced · ~16 min
4. 04Failure domain and blast radius — partitioning risk across clustersCluster boundaries · advanced · ~16 min
5. 05Cluster-per-team vs cluster-per-app vs hybrid — choosing the right granularityCluster boundaries · advanced · ~16 min
6. 06Federation vs independent clusters — when to federateCluster boundaries · advanced · ~16 min

1. 01Managed vs self-managed Kubernetes — the fundamental trade-offManaged vs self-managed · advanced · ~17 min
2. 02kubeadm vs EKS — the operational comparisonManaged vs self-managed · advanced · ~17 min
3. 03AKS, GKE, OKE — the other managed Kubernetes providersManaged vs self-managed · advanced · ~17 min
4. 04Control plane HA — responsibility and architectureManaged vs self-managed · advanced · ~16 min
5. 05Upgrade responsibilities — who upgrades what and whenManaged vs self-managed · advanced · ~16 min
6. 06Cost and operational trade-offs — total cost of ownershipManaged vs self-managed · advanced · ~16 min

1. 01GitOps principles — Git as the source of truthGitOps · advanced · ~16 min
2. 02Desired state in Git — the manifest repository structureGitOps · advanced · ~16 min
3. 03Reconciliation controllers — Argo CD and Flux in depthGitOps · advanced · ~17 min
4. 04GitOps vs imperative — the operational comparisonGitOps · advanced · ~16 min
5. 05Drift detection — finding and correcting out-of-band changesGitOps · advanced · ~16 min
6. 06GitOps anti-patterns — the most common mistakesGitOps · advanced · ~16 min

1. 01Helm chart structure — Chart.yaml, values.yaml, templates, and helpersHelm · advanced · ~17 min
2. 02Helm values and templating — Go template patterns in productionHelm · advanced · ~17 min
3. 03Helm releases and revisions — the lifecycle of an installed chartHelm · advanced · ~17 min
4. 04Helm install, upgrade, rollback — the operational lifecycleHelm · advanced · ~17 min
5. 05Helm repositories and OCI registries — the chart distribution modelHelm · advanced · ~17 min
6. 06Helm production discipline — safety, review, and the discipline of pinningHelm · advanced · ~16 min

1. 01Kustomize overview — declarative customisation without templatesKustomize · advanced · ~16 min
2. 02Base + overlay — the canonical Kustomize patternKustomize · advanced · ~16 min
3. 03kustomization.yaml in depth — fields, transformers, and generatorsKustomize · advanced · ~17 min
4. 04Kustomize patches — strategic merge vs JSON 6902 vs images transformerKustomize · advanced · ~17 min
5. 05Kustomize vs Helm — when to use whichKustomize · advanced · ~17 min
6. 06Kustomize production discipline — render before apply, review, pin, signKustomize · advanced · ~16 min

1. 01Package management anti-patterns — the most common mistakesPackage management anti-patterns · advanced · ~16 min
2. 02Giant values files — splitting for reviewabilityPackage management anti-patterns · advanced · ~16 min
3. 03Unpinned charts — the floating tag trapPackage management anti-patterns · advanced · ~16 min
4. 04Blindly installing public charts — the supply chain riskPackage management anti-patterns · advanced · ~16 min
5. 05Configuration drift — detecting and correcting divergencePackage management anti-patterns · advanced · ~16 min
6. 06Helm + Kustomize together — combining the tools safelyPackage management anti-patterns · advanced · ~16 min

1. 01Multi-tenancy models — soft vs hard, namespaces vs clustersMulti-tenancy · advanced · ~17 min
2. 02Namespace as tenancy boundary — what it isolates and what it does notMulti-tenancy · advanced · ~17 min
3. 03Soft multi-tenancy with RBAC, NetworkPolicy, and Quotas — the production stackMulti-tenancy · advanced · ~17 min
4. 04vCluster and Kyverno — hard multi-tenancy and per-tenant policyMulti-tenancy · advanced · ~17 min
5. 05Tenant onboarding and isolation testing — the operational disciplineMulti-tenancy · advanced · ~16 min
6. 06Multi-tenancy limits and pitfalls — what namespaces cannot doMulti-tenancy · advanced · ~16 min

1. 01ResourceQuota — the namespace resource budgetResourceQuota · advanced · ~16 min
2. 02Compute quotas — CPU and memory budgets per namespaceResourceQuota · advanced · ~16 min
3. 03Storage and object count quotas — bounding PVCs, secrets, and cluster objectsResourceQuota · advanced · ~16 min
4. 04Quota scoping — PriorityClass and StorageClass-based quotasResourceQuota · advanced · ~16 min
5. 05Quota enforcement lifecycle — admission, observation, and the failure modesResourceQuota · advanced · ~16 min
6. 06Quota operations and anti-patterns — the operational disciplineResourceQuota · advanced · ~16 min

1. 01LimitRange overview — defaults and constraints per container and PodLimitRange · advanced · ~16 min
2. 02Container defaults — the foundation of resource accountingLimitRange · advanced · ~16 min
3. 03Min and max constraints — bounding what containers can requestLimitRange · advanced · ~16 min
4. 04Pod-level limits — bounding the sum across containersLimitRange · advanced · ~16 min
5. 05PVC constraints — bounding storage requestsLimitRange · advanced · ~16 min
6. 06LimitRange anti-patterns — the operational disciplineLimitRange · advanced · ~16 min

1. 01PriorityClass — workload priority in KubernetesPriority and preemption · advanced · ~17 min
2. 02System critical priority classes — protecting kube-systemPriority and preemption · advanced · ~16 min
3. 03Preemption mechanics — how the scheduler evicts lower-priority PodsPriority and preemption · advanced · ~17 min
4. 04Scheduler integration — how priority affects scheduling decisionsPriority and preemption · advanced · ~16 min
5. 05PDB interaction with preemption — budgets that block preemptionPriority and preemption · advanced · ~16 min
6. 06Priority anti-patterns — the most common mistakesPriority and preemption · advanced · ~17 min

1. 01eBPF dataplanes and Cilium — modern Kubernetes networkingAdvanced networking · advanced · ~17 min
2. 02Gateway API — the modern Ingress replacementAdvanced networking · advanced · ~16 min
3. 03BGP service advertisement — LoadBalancer IPs and BGP peersAdvanced networking · advanced · ~17 min
4. 04Advanced policy — L7, FQDN, and DNS-based controlsAdvanced networking · advanced · ~16 min
5. 05Dual-stack and IPv6 — modern IP addressing in KubernetesAdvanced networking · advanced · ~16 min
6. 06Network anti-patterns — the most common mistakesAdvanced networking · advanced · ~16 min

1. 01Bare metal LB problem — why cloud-provider LBs do not exist on-premLoad balancing on bare metal · advanced · ~16 min
2. 02MetalLB L2 mode — ARP/NDP-based load balancingLoad balancing on bare metal · advanced · ~16 min
3. 03MetalLB BGP mode — multi-node load balancing with ECMPLoad balancing on bare metal · advanced · ~17 min
4. 04Integration with VyOS and BIRD — router-side BGP configurationLoad balancing on bare metal · advanced · ~17 min
5. 05BGP peer configuration — IP pools, peers, and communitiesLoad balancing on bare metal · advanced · ~17 min
6. 06Bare metal LB anti-patterns — the most common mistakesLoad balancing on bare metal · advanced · ~16 min

1. 01CoreDNS advanced configuration — Corefile, plugins, and tuningDNS advanced troubleshooting · advanced · ~17 min
2. 02ndots and search paths — the DNS resolution chainDNS advanced troubleshooting · advanced · ~16 min
3. 03DNS latency and nodelocaldns — caching at the node levelDNS advanced troubleshooting · advanced · ~16 min
4. 04Stub domains and upstream resolvers — overriding DNS for specific zonesDNS advanced troubleshooting · advanced · ~16 min
5. 05DNS security — DoH, response policy zones, and DNSSECDNS advanced troubleshooting · advanced · ~16 min
6. 06DNS troubleshooting flow — the diagnostic methodologyDNS advanced troubleshooting · advanced · ~16 min

1. 01cert-manager — Kubernetes-native certificate managementCertificate and TLS operations · advanced · ~17 min
2. 02ACME issuers — Let's Encrypt and the ACME protocolCertificate and TLS operations · advanced · ~17 min
3. 03Internal CA — the cert-manager CA injector and self-signed CAsCertificate and TLS operations · advanced · ~16 min
4. 04Vault PKI — HashiCorp Vault as the certificate authorityCertificate and TLS operations · advanced · ~17 min
5. 05Application TLS secrets — using TLS material in PodsCertificate and TLS operations · advanced · ~16 min
6. 06Certificate rotation and renewal — the operational disciplineCertificate and TLS operations · advanced · ~16 min

1. 01Image registry overview — pull, push, cache, and securityImage registry operations · advanced · ~17 min
2. 02Private registries — Harbor, Quay, and on-prem controlImage registry operations · advanced · ~17 min
3. 03imagePullSecrets and credential rotation — authentication to registriesImage registry operations · advanced · ~17 min
4. 04Unavailable registries — graceful degradation and pull-through cacheImage registry operations · advanced · ~17 min
5. 05Tag vs digest strategy — immutability and reproducibilityImage registry operations · advanced · ~17 min
6. 06Registry cache — pull-through proxy and local kubelet cacheImage registry operations · advanced · ~17 min

1. 01Maintenance windows — the contract between uptime and changeOperations and maintenance · advanced · ~16 min
2. 02Snowflakes and phoenixes — the topology of replaceable infrastructureOperations and maintenance · advanced · ~15 min
3. 03Pre-change gates — what must be true before a window opensOperations and maintenance · advanced · ~15 min
4. 04Cordon and drain orchestration — the eviction choreographyOperations and maintenance · advanced · ~16 min
5. 05Notify, freeze, and rollout windows — the social contract of changeOperations and maintenance · advanced · ~14 min
6. 06Post-change validation and rollback gates — closing the window with evidenceOperations and maintenance · advanced · ~15 min

1. 01Change management as risk governance — the goal of a changeChange management · advanced · ~15 min
2. 02CAB, peer review, and four-eyes — the social contract of governanceChange management · advanced · ~14 min
3. 03Risk classification and CHG documents — the cost of a changeChange management · advanced · ~14 min
4. 04Pre-prod gates and canary fleets — paying down risk before productionChange management · advanced · ~15 min
5. 05Communication and customer notifications — the social contract of changeChange management · advanced · ~13 min
6. 06Post-change verification and PIR — the artefact that pays down the lessonChange management · advanced · ~14 min

1. 01The 11-step methodology — the canonical troubleshooting workflowTroubleshooting methodology · advanced · ~18 min
2. 02Symptom definition and impact — the first two stepsTroubleshooting methodology · advanced · ~14 min
3. 03Inspect object → events → logs — the evidence-gathering arcTroubleshooting methodology · advanced · ~16 min
4. 04Dependencies and component identification — the network of causeTroubleshooting methodology · advanced · ~15 min
5. 05Hypothesis, test, restore, validate — the closing arcTroubleshooting methodology · advanced · ~16 min
6. 06The sysadmin troubleshooting posture — habits, tools, and ergonomicsTroubleshooting methodology · advanced · ~14 min

1. 01Pending pods — the scheduling diagnostic gridPod troubleshooting · advanced · ~16 min
2. 02CrashLoopBackOff and ImagePullBackOff — the image and startup failuresPod troubleshooting · advanced · ~17 min
3. 03CreateContainerConfigError and OOMKilled — the misconfiguration and memory failuresPod troubleshooting · advanced · ~16 min
4. 04Probe failures — readiness, liveness, and startupPod troubleshooting · advanced · ~16 min
5. 05Stuck Terminating — the eviction and shutdown diagnosticPod troubleshooting · advanced · ~15 min
6. 06Pod field reference — the canonical `kubectl describe pod` excerptsPod troubleshooting · advanced · ~16 min

1. 01Rollout stuck — the progression blockDeployment troubleshooting · advanced · ~16 min
2. 02Unavailable replicas and maxUnavailable — the rolling update guardDeployment troubleshooting · advanced · ~15 min
3. 03Broken selectors and orphan services — the routing failureDeployment troubleshooting · advanced · ~15 min
4. 04Readiness failures cascading — the probe and the rolloutDeployment troubleshooting · advanced · ~15 min
5. 05Bad images and rollout deadlock — the recovery pathDeployment troubleshooting · advanced · ~14 min
6. 06Rollback, undo, and history — the recovery toolkitDeployment troubleshooting · advanced · ~14 min

1. 01DNS → Service → EndpointSlice → Pod IP → application port — the canonical flowService troubleshooting · advanced · ~18 min
2. 02Service has no endpoints — the empty EndpointSliceService troubleshooting · advanced · ~15 min
3. 03ClusterIP unreachable — the kube-proxy and routing failureService troubleshooting · advanced · ~16 min
4. 04NodePort and LoadBalancer — the external reachability pathService troubleshooting · advanced · ~15 min
5. 05Headless and ExternalName — the DNS-only ServicesService troubleshooting · advanced · ~14 min
6. 06kube-proxy and iptables/IPVS — the routing engineService troubleshooting · advanced · ~14 min

1. 01CoreDNS architecture and role — the cluster's DNS resolverDNS troubleshooting · advanced · ~16 min
2. 02NXDOMAIN, no endpoints, and stub-domain — the DNS resolution failuresDNS troubleshooting · advanced · ~15 min
3. 03Search path and ndots — the DNS client configurationDNS troubleshooting · advanced · ~14 min
4. 04CoreDNS scale and tuning — the resolver at scaleDNS troubleshooting · advanced · ~14 min
5. 05DNS outage and mitigations — the cluster wide failureDNS troubleshooting · advanced · ~14 min
6. 06External DNS and split-horizon — the cluster to enterprise DNSDNS troubleshooting · advanced · ~14 min

1. 01Default-allow vs default-deny — the cluster network's postureNetworkPolicy troubleshooting · advanced · ~15 min
2. 02Selector mismatch diagnosis — the policy that misses the PodNetworkPolicy troubleshooting · advanced · ~14 min
3. 03Egress and DNS rules — the outbound traffic pathNetworkPolicy troubleshooting · advanced · ~14 min
4. 04Cross-namespace policy — the multi-tenant networkNetworkPolicy troubleshooting · advanced · ~14 min
5. 05CNI enforcement validity — the policy engine checkNetworkPolicy troubleshooting · advanced · ~14 min
6. 06Policy testing and CI gates — the prevention strategyNetworkPolicy troubleshooting · advanced · ~14 min

1. 01NotReady and unknown nodes — the heart of the workerNode troubleshooting · advanced · ~16 min
2. 02DiskPressure and PIDPressure — the resource exhaustionNode troubleshooting · advanced · ~15 min
3. 03kubelet logs and auth — the node's voiceNode troubleshooting · advanced · ~14 min
4. 04containerd and runtime recovery — the container engineNode troubleshooting · advanced · ~14 min
5. 05Node-level kernel and network — the host underneathNode troubleshooting · advanced · ~14 min
6. 06Node replacement and rollback — the recovery pathNode troubleshooting · advanced · ~14 min

1. 01API server health and 503s — the cluster's front doorControl plane troubleshooting · advanced · ~16 min
2. 02controller-manager loops — the cluster's reconciliationControl plane troubleshooting · advanced · ~15 min
3. 03Scheduler backlogs — the cluster's placement engineControl plane troubleshooting · advanced · ~14 min
4. 04kube-apiserver HA and load balancers — the cluster's front door at scaleControl plane troubleshooting · advanced · ~14 min
5. 05cert rotation and clock skew — the cryptographic driftControl plane troubleshooting · advanced · ~14 min
6. 06Control plane failure recovery — the cluster's worst dayControl plane troubleshooting · advanced · ~14 min

1. 01etcd alarm and no-space — the cluster's disk exhaustionetcd incident response · advanced · ~15 min
2. 02Quorum loss triage — the cluster's brain failureetcd incident response · advanced · ~16 min
3. 03etcd snapshot restore — the cluster's ultimate recoveryetcd incident response · advanced · ~16 min
4. 04Replace failed member — the cluster's recoveryetcd incident response · advanced · ~14 min
5. 05Performance incident on etcd — the cluster's slownessetcd incident response · advanced · ~14 min
6. 06Post-mortem and runbook exercises — the artefact that pays down the lessonetcd incident response · advanced · ~14 min

1. 01PVC pending and dynamic-provision — the storage runtimeStorage troubleshooting · advanced · ~15 min
2. 02CSI driver crash and force-detach — the storage runtime failuresStorage troubleshooting · advanced · ~14 min
3. 03Filesystem remount and read-only — the storage integrityStorage troubleshooting · advanced · ~14 min
4. 04Volume expansion and quota — the storage growthStorage troubleshooting · advanced · ~14 min
5. 05Snapshot and restore at CSI — the storage recoveryStorage troubleshooting · advanced · ~14 min
6. 06Performance IOPS and throttling — the storage bottleneckStorage troubleshooting · advanced · ~14 min

1. 01Latency and saturation — the application performanceApplication performance troubleshooting · advanced · ~16 min
2. 02CPU throttling and limits — the compute bottleneckApplication performance troubleshooting · advanced · ~14 min
3. 03Memory limits and OOM semantics — the memory bottleneckApplication performance troubleshooting · advanced · ~14 min
4. 04Network saturation and retries — the network bottleneckApplication performance troubleshooting · advanced · ~14 min
5. 05Storage IOPS and tail latency — the storage performanceApplication performance troubleshooting · advanced · ~14 min
6. 06Continuous profiling and tracing — the performance insightApplication performance troubleshooting · advanced · ~14 min

1. 01Detection and triage — the security incident's first hourSecurity incident response · advanced · ~15 min
2. 02Containment and isolation — the security incident's first hourSecurity incident response · advanced · ~14 min
3. 03Container forensics — the security incident's investigationSecurity incident response · advanced · ~14 min
4. 04Cluster-wide credential rotation — the security incident's recoverySecurity incident response · advanced · ~14 min
5. 05Disclosure and notification — the security incident's social contractSecurity incident response · advanced · ~14 min
6. 06Recovery and post-mortem — the security incident's closureSecurity incident response · advanced · ~14 min

1. 01Top 20 production anti-patterns — the cluster's hidden failuresProduction anti-patterns · advanced · ~20 min
2. 02Image and compute anti-patterns — the workload's foundationProduction anti-patterns · advanced · ~14 min
3. 03Availability anti-patterns — the workload's resilienceProduction anti-patterns · advanced · ~14 min
4. 04Security anti-patterns — the cluster's protectionProduction anti-patterns · advanced · ~14 min
5. 05Operational anti-patterns — the cluster's runbookProduction anti-patterns · advanced · ~14 min
6. 06CI gates and Polaris — the prevention strategyProduction anti-patterns · advanced · ~14 min

1. 01Production reference architecture — the canonical clusterProduction reference architecture · advanced · ~25 min
2. 02HA control plane topology — the cluster's brain at scaleProduction reference architecture · advanced · ~14 min
3. 03Multi-worker pools and topology spread — the cluster's computeProduction reference architecture · advanced · ~14 min
4. 04Production networking and ingress — the cluster's connectivityProduction reference architecture · advanced · ~14 min
5. 05Stateful workload — the cluster's data layerProduction reference architecture · advanced · ~14 min
6. 06The reference architecture in one diagram — the cluster's complete storyProduction reference architecture · advanced · ~16 min
7. 07Mission-critical Kubernetes capstone — the complete production estateProduction reference architecture · advanced · ~240 minLab

No lessons published in this part yet. The full curriculum is planned in docs/courses/kubernetes/curriculum.md on GitHub.

No lessons published in this part yet. The full curriculum is planned in docs/courses/kubernetes/curriculum.md on GitHub.

No lessons published in this part yet. The full curriculum is planned in docs/courses/kubernetes/curriculum.md on GitHub.