9-week Kubernetes on AWS bootcamp with DevSecOps and SRE

Week 1: Kubernetes Fundamentals + Local Clusters

Kubernetes Architecture + Core Concepts

• The why behind Kubernetes — what broke before it existed
• Control plane deep dive — API server, etcd, scheduler, controller manager
• Worker node components — kubelet, kube-proxy, container runtime
• Core objects — Pod, ReplicaSet, Deployment, Service
• Setting up Minikube locally, kubectl basics and everyday commands
• YAML manifests in depth — apiVersion, kind, metadata, spec
• ConfigMaps and Secrets — creating, mounting as env vars and volumes
• Namespaces and resource organisation
• Labels, selectors, annotations — how Kubernetes finds things
• Resource requests and limits — why they matter in production
• Kubernetes DNS and service discovery internals
• ImagePullSecrets for private registries
• Lens (Freelens) — Kubernetes IDE for visual cluster management

Project: Deploy a 2-tier e-commerce app (frontend + PostgreSQL) on Minikube — wired together with Services, ConfigMaps, Secrets, private image registry

Resilience Patterns, Autoscaling + Live Debugging

• Liveness, readiness, and startup probes — real failure scenarios
• Rolling upgrades and rollback strategies
• HPA and VPA — pod autoscaling based on CPU/memory/custom metrics
• Init containers and sidecar patterns
• Pod Disruption Budgets for zero-downtime deployments
• Deployment strategies — Recreate vs RollingUpdate vs Blue-Green
• CrashLoopBackOff, OOMKilled — live debugging techniques
• Resource quotas and LimitRanges per namespace
• Reading Kubernetes events to diagnose failures fast
• StatefulSets intro — ordered deployment, stable network identity
• DaemonSets and Jobs — when to use each

Project: Add HPA, probes, and PodDisruptionBudget to the e-commerce app. Simulate CrashLoopBackOff and OOMKilled failures live and debug them. Add a PostgreSQL StatefulSet with persistent local storage

Week 2: CI/CD with OIDC, GitOps + Production EKS Foundation

GitOps with ArgoCD + CI/CD Pipeline on Minikube

• GitOps fundamentals — why GitOps over push-based deployments
• ArgoCD setup on Minikube — apps, sync policies, health checks
• End-to-end CI/CD pipeline — GitHub Actions builds image, ArgoCD deploys
• ArgoCD app-of-apps pattern intro
• Branching strategy for GitOps — app repo vs config repo separation
• Rollback with ArgoCD — one-click vs automated
• Basic Prometheus + Grafana on Minikube — request rate, pod health dashboards
• Debugging failed ArgoCD syncs — common causes and fixes
• Multi-environment GitOps intro — dev vs prod namespaces on same cluster

Project: GitHub Actions pipeline builds and pushes e-commerce image on every commit, ArgoCD auto-deploys to Minikube, basic Grafana dashboard showing pod health and request rate, rollback demonstrated live

Production EKS Setup + Networking + Security Foundations

• EKS cluster setup via eksctl and AWS console
• EKS add-ons — VPC CNI, CoreDNS, EBS CSI Driver, kube-proxy
• IRSA — Kubernetes to AWS IAM with OIDC, no hardcoded credentials
• AWS Load Balancer Controller with Helm — architecture and annotations
• Ingress for internal and external traffic routing
• ExternalDNS for automatic Route53 record management
• Domain, SSL/TLS termination with ACM
• EKS managed node groups vs self-managed nodes — when to use which
• EKS access entry for cluster access

Project: EKS cluster up with eksctl, AWS Load Balancer Controller and ExternalDNS deployed via Helm, RBAC hardened, custom domain with SSL termination working

Week 3: 3-Tier App on EKS + Docker image optimization

Running 3-Tier App on EKS + AWS Integrations

• Running 3-tier app — frontend + backend + RDS PostgreSQL on EKS
• Database migrations using Kubernetes Jobs
• Init containers for DB connection readiness checks
• IRSA in practice — backend pod accessing Secrets Manager without credentials
• AWS Secrets Manager integration — External Secrets Operator pattern
• Ingress rules for routing traffic to frontend vs backend
• Health checks at load balancer level vs pod level
• Blue-Green deployment on EKS with weighted routing
• Namespace strategy for multi-tier apps
• Real troubleshooting — ImagePullBackOff, pending pods, service not reachable

Project: Full 3-tier app on EKS — frontend + Node.js backend + RDS PostgreSQL, IRSA for Secrets Manager, DB migration Job, custom domain, SSL, live troubleshooting of staged failures

StatefulSets, Persistent Storage + Docker Image Optimisation

• StatefulSets deep dive — production patterns and failure recovery
• PersistentVolume, PVC, StorageClass — static vs dynamic provisioning on EKS
• EBS vs EFS — choosing the right storage for the workload
• Headless Services for StatefulSet DNS resolution
• Troubleshooting multi-attach volume errors and common StatefulSet failures
• Volume snapshots and backup strategies on EKS
• Multi-stage Docker builds — drastically smaller production images
• Distroless and minimal base images for attack surface reduction
• Docker image optimisation — layer caching, build context, .dockerignore

Project: Add MinIO as a StatefulSet with persistent EBS storage to the e-commerce app for product image uploads. Rebuild all images with multi-stage builds, integrate Trivy in GitHub Actions, and reduce image sizes by 60%+

Week 4: Microservices on K8s + Terraform EKS + GitOps

Production EKS with Terraform

• Production EKS cluster with Terraform — VPC, subnets, node groups, and add-ons
• Terraform module structure for EKS — separation of concerns
• Managing dev/staging/prod with Terraform workspaces
• Deploying AWS Load Balancer Controller and ExternalDNS via Terraform
• IRSA setup via Terraform — no manual console steps
• Terraform drift detection on EKS infrastructure
• Node group configuration — instance types, spot vs on-demand, taints and tolerations
• EKS upgrade strategy with Terraform — node group rotation

Project: Rebuild the entire EKS cluster from scratch with Terraform — VPC, node groups, add-ons, IRSA, Load Balancer Controller, and ExternalDNS all provisioned via code. Zero manual console steps

Microservices on EKS + Advanced ArgoCD GitOps

• Microservices design principles — bounded context, single responsibility
• Splitting monolith into microservices — frontend, order, inventory, and user service
• Inter-service communication — ClusterIP vs headless vs service mesh
• Network Policies for microservice traffic isolation between namespaces
• Gateway API — advanced ingress routing vs traditional Ingress
• ArgoCD App-of-Apps pattern — managing many services cleanly
• ArgoCD ApplicationSet for environment promotion across dev/staging/prod
• Matrix builds in GitHub Actions for multiple microservices

Project: E-commerce app split into 4 microservices each with own Helm chart and ArgoCD Application, App-of-Apps managing all services, Gateway API routing, matrix CI/CD builds, OpenCost showing per-service spend

Week 5: Full Observability Stack

Metrics, Logs + Dashboards

• How observability works in real production companies
• Prometheus — metrics collection, PromQL, scrape configs
• Prometheus Operator and ServiceMonitor CRDs
• Loki for log storage and querying — LogQL basics
• Fluent Bit on EKS — log aggregation, filtering, routing to Loki
• Grafana dashboards — Kubernetes cluster, app metrics, AWS resource metrics
• AlertManager — routing alerts to Slack and PagerDuty with grouping and silencing
• CloudWatch Container Insights integration alongside Prometheus
• Monitoring differences — Fargate vs managed node groups
• Cost visibility dashboard — RDS, Lambda, EKS node costs in Grafana

Project: Prometheus + Loki + Grafana + Fluent Bit deployed on EKS, Grafana dashboard showing order volume, error rates, DB query latency, AlertManager fires Slack alert when order service error rate crosses 1%, CloudWatch Container Insights alongside

Distributed Tracing, SLOs + Advanced Alerting

• OpenTelemetry for distributed tracing — instrumentation, collectors, exporters
• Tracing a request across frontend → order service → inventory service → DB
• Jaeger or Tempo as tracing backend — setup and querying
• SLO and SLI definitions — what they mean in practice
• Error budget dashboards in Grafana — how teams use them day to day
• Multi-window, multi-burn-rate alerting for SLOs
• AlertManager advanced — inhibition rules, routing trees, deduplication
• Runbook links in alerts — connecting alert to action
• Log-based alerting in Grafana with Loki rules
• Observability for stateful services — what’s different about monitoring databases
• Live debugging 10 real Kubernetes interview scenarios — staged failures on the e-commerce cluster
• Advanced live troubleshooting — node pressure, evictions, DNS failures, RBAC misconfiguration

Project: OpenTelemetry tracing across all e-commerce microservices, Tempo as backend, Grafana trace explorer showing end-to-end request flow, SLO dashboards with error budget burn rate, multi-window AlertManager rules for order service

Week 6: Service Mesh, Karpenter + Security

Service Mesh + Network Policies + Zero Trust

• Service mesh fundamentals — why it exists, what problems it actually solves
• Istio installation and architecture — control plane, data plane, sidecars
• mTLS between all microservices — automatic, no code changes
• Traffic management — VirtualService, DestinationRule, Gateway
• Canary deployments with Istio traffic splitting — 10% to new version
• Visualising service mesh traffic with Kiali
• Network Policies for zero-trust pod-to-pod communication
• Egress controls and namespace isolation
• Pod topology spread constraints for multi-AZ resilience
• Istio observability — built-in metrics, tracing integration with Jaeger

Project: Istio deployed on e-commerce EKS cluster, mTLS enforced between all microservices, canary deployment for order service routing 10% traffic to v2, Kiali showing live traffic topology, network policies blocking all non-essential pod communication

Karpenter, EKS Auto Mode + Cost Optimisation

• Karpenter architecture — how it differs from Cluster Autoscaler
• NodePool and EC2NodeClass configuration
• Cost optimisation with Spot + On-Demand mixed node fleets
• Karpenter bin packing and consolidation policies — removing underutilised nodes
• Taints, tolerations, and node selectors with Karpenter
• EKS Auto Mode — what it is, when to use it over Karpenter
• Pod topology spread constraints across AZs with Karpenter
• Kyverno policy enforcement — blocking deployments without resource limits
• Pod security admission — restricted, baseline, privileged modes
• Security contexts and pod security standards in practice

Project: Karpenter deployed on EKS, replacing managed node group for inventory service, Spot instances with on-demand fallback, Kyverno policies enforced, blocking any deployment without resource limits and liveness probes, pod security standards applied cluster-wide

Module 5: (3-week) DevSecOps and SRE

Week 7: Shift Left Security + Pipeline Hardening

• DevSecOps on Kubernetes — the shift left mindset, where security fits in the SDLC, and why bolt-on security after deployment is a losing strategy
• Security integrated into the pipeline — SAST with Semgrep for code-level vulnerabilities, DAST with OWASP ZAP against staging, SCA and dependency auditing with Trivy and Grype
• Pre-commit secret scanning and GitHub secret scanning — catching credentials before they hit the repository, not after
• Container supply chain security — Trivy blocking critical CVEs before image push, image signing with Cosign, SBOM generation with Syft so you know exactly what is in every image
• IaC security scanning — Checkov linting Terraform and Kubernetes manifests before apply, failing the pipeline on misconfigurations not just vulnerabilities
• Secrets management in the pipeline — no hardcoded credentials anywhere, OIDC for AWS auth, External Secrets Operator pulling from Secrets Manager into pods at runtime

Week 8: Runtime Security + Policy as Code + Zero Trust on EKS

• Falco for runtime threat detection on EKS — custom rules for suspicious process execution, unexpected file access, and anomalous network activity, alerting to Slack in real time
• Kyverno policy engine — blocking unsigned images, requiring resource limits, enforcing labels and security contexts, validating ingress rules cluster-wide
• Pod Security Admission — restricted, baseline, and privileged modes, applying the right profile per namespace and understanding what each one actually prevents
• CIS Kubernetes Benchmark scanning with kube-bench — running the benchmark against the EKS cluster, understanding each failed check, systematic remediation
• Network policies for zero-trust between namespaces — default deny all, explicit allow only, verifying isolation holds under live traffic

Project — Complete DevSecOps Pipeline

GitHub Actions enforces the full chain before anything reaches EKS: Semgrep scans application code, Checkov lints manifests, Trivy blocks images with critical CVEs, Cosign signs every image that passes. On the cluster side: Kyverno rejects any unsigned image or manifest missing resource limits, Falco monitors runtime behaviour and fires Slack alerts on suspicious activity, network policies enforce zero-trust between namespaces, kube-bench runs on a schedule and posts a remediation report. Every stage has a hard fail — nothing progresses if the gate does not pass.

Week 9: SRE + everything that comes with it

• SLI, SLO, SLA — precise definitions, writing measurable objectives that mean something, and how error budgets make deployment decisions instead of gut feel
• DORA metrics — deployment frequency, lead time for changes, MTTR, and change failure rate as a team health signal, and how to actually measure them across the bootcamp stack
• On-call culture and runbook discipline — what a good runbook looks like, escalation path design, handoff practice, and why most runbooks fail at 2 am
• Postmortem culture — blameless analysis, timeline reconstruction, contributing factors, and writing RCAs that prevent recurrence rather than assign blame
• Error budget policy — what happens when the budget is burned, how to freeze deployments, negotiate reliability work vs feature work
• Kubernetes interview scenarios — the 10 most common live debugging questions asked at the senior level, and how to think through them systematically under pressure
• Three live war room simulations drawn from across the bootcamp stack, followed by a written RCA