๐Ÿซ School Platform โ€” learn Kubernetes step-by-step

One real project โ€” a school management system with two services โ€” used to teach every DevOps tool with a job to do. Complex ideas, explained like you're five, with school analogies, diagrams and hands-on labs.

๐Ÿณ Dockerโ˜ธ๏ธ Kubernetes ๐Ÿ—๏ธ Terraformโ˜๏ธ AWS ๐Ÿ”„ CircleCI๐Ÿค– ArgoCD / GitOps
1Check your foundations Terminal, git, YAML & 4 more โ€” with an interactive tick-off checklist.
Open the checklist โ†’ ยท Study plan โ†’
2Take the 14 lessons One git branch = one idea. Each lesson: ELI5 story, analogy, diagram, What/Why/How, and commands to try.
3Go deeper 4K architecture diagrams, the production design doc, and a narrated video tour โ€” all below.

๐Ÿ—บ๏ธ The big picture โ€” one diagram, the whole school

All 26 lessons on one canvas. Click for the 4K version.

The big picture: the core Kubernetes school (lessons 1-13) and shipping plus running it for real (lessons 14-26)

๐ŸŽ“ The 26 lessons

๐Ÿ“… Not sure how to pace it? Follow the 9-week study plan โ€” sequence, time estimates, weekly milestones and a capstone, with progress saved in your browser.

Lessons live on branches โ€” branch 05 contains lessons 01โ€“05, so you can stop and resume anywhere. Click a card to read the lesson right on GitHub (diagrams render there), or check the branch out locally. Prefer pictures? All 14 lessons are also drawn as numbered box-and-arrow diagrams on one page.

1

๐Ÿฑ Containers & images

A packed lunchbox โ€” everything the app needs, inside the box.lesson-01-containersRead lesson โ†’See the diagram โ†—
2

๐Ÿช‘ Pods

One school desk โ€” the smallest unit; replaceable, never repaired.lesson-02-podsRead lesson โ†’See the diagram โ†—
3

๐Ÿง‘โ€๐Ÿซ Deployments

A strict class monitor โ€” "there shall ALWAYS be 2" (self-healing).lesson-03-deploymentsRead lesson โ†’See the diagram โ†—
4

โ˜Ž๏ธ Services

The reception desk โ€” one number that never changes, kids move around.lesson-04-servicesRead lesson โ†’See the diagram โ†—
5

๐Ÿšช Namespaces

Separate classrooms โ€” two kids named Aarav, no confusion.lesson-05-namespacesRead lesson โ†’See the diagram โ†—
6

๐Ÿ”‘ ConfigMaps & Secrets

Notice board vs locker key โ€” settings outside the lunchbox.lesson-06-configmaps-secretsRead lesson โ†’See the diagram โ†—
7

๐Ÿ™‹ Health probes

"Are you awake? Are you ready?" โ€” two questions, two consequences.lesson-07-health-probesRead lesson โ†’See the diagram โ†—
8

๐Ÿ› Requests & limits

Lunch portions โ€” a promised plate, and a cap on seconds.lesson-08-resourcesRead lesson โ†’See the diagram โ†—
9

๐ŸšŒ Autoscaling

Extra buses on rainy days โ€” pods multiply under load.lesson-09-autoscalingRead lesson โ†’See the diagram โ†—
10

๐Ÿซ Ingress

The main gate + signboard โ€” one entrance, routed by path.lesson-10-ingressRead lesson โ†’See the diagram โ†—
11

โšฝ Rollouts & rollbacks

Substituting players mid-game โ€” the crowd never notices.lesson-11-rolloutsRead lesson โ†’See the diagram โ†—
12

๐Ÿ“š Storage & state

Backpack vs library shelf โ€” what survives when a pod dies.lesson-12-storageRead lesson โ†’See the diagram โ†—
13

๐Ÿข Under the hood

The school office โ€” API server, etcd, scheduler, kubelet.lesson-13-under-the-hoodRead lesson โ†’See the diagram โ†—
14

๐Ÿค– Bonus: CI/CD & ArgoCD

The caretaker robot with the master plan book โ€” GitOps.lesson-14-deploy-gitopsRead lesson โ†’See the diagram โ†—
15

๐Ÿซ๐Ÿซ Bonus: Multi-AZ & scaling

Many buildings + the exam-day ladder โ€” fires and rushes, survived.lesson-15-multi-az-scalingRead lesson โ†’See the diagram โ†—

๐Ÿงฐ Part 3 โ€” running it for real (lessons 16โ€“26)

The cluster stands โ€” now learn to operate it: debug it, secure it, schedule it, upgrade it, extend it, and watch it breathe. Same format, same school.

16

๐Ÿฉบ Debugging playbook

The nurse's triage chart โ€” describe, events, logs, exec, in order.lesson-16-debuggingRead lesson โ†’See the diagram โ†—
17

๐Ÿชช RBAC & ServiceAccounts

Hall passes โ€” kids, teachers and robots open different doors.lesson-17-rbacRead lesson โ†’See the diagram โ†—
18

โฐ Jobs & CronJobs

Homework vs the morning bell โ€” includes the REAL backup CronJob.lesson-18-jobs-cronjobsRead lesson โ†’See the diagram โ†—
19

๐Ÿšซ๐Ÿ“ NetworkPolicies

Passing-notes rules โ€” by default every pod whispers to every pod.lesson-19-network-policiesRead lesson โ†’See the diagram โ†—
20

๐ŸŽซ Taints & affinity

Assigned seating โ€” signs on desks, chits and wishes on kids.lesson-20-taints-affinityRead lesson โ†’See the diagram โ†—
21

๐Ÿงฏ DaemonSets

One fire extinguisher on EVERY floor โ€” no exceptions.lesson-21-daemonsetsRead lesson โ†’See the diagram โ†—
22

๐Ÿท๏ธ StatefulSets

Desks with name plates โ€” postgres-0 keeps its own drawer.lesson-22-statefulsetsRead lesson โ†’See the diagram โ†—
23

๐Ÿฝ๏ธ QoS & evictions

Who leaves when lunch runs short โ€” the pecking order you're in.lesson-23-qos-evictionsRead lesson โ†’See the diagram โ†—
24

๐Ÿ—๏ธ Cluster upgrades

Renovating while school stays open โ€” cordon, drain, PDBs on stage.lesson-24-cluster-upgradesRead lesson โ†’See the diagram โ†—
25

๐Ÿค– CRDs & operators

Teaching the office new words โ€” how ArgoCD's Application works.lesson-25-crds-operatorsRead lesson โ†’See the diagram โ†—
26

๐Ÿ“ˆ Observability

Report cards, diaries, alarm bells โ€” eyes on everything.lesson-26-observabilityRead lesson โ†’See the diagram โ†—
# take the course locally:
git clone https://github.com/BaluRaut/learn-kubernetes-school.git
cd learn-kubernetes-school
git checkout lesson-01-containers   # then open lessons/01-containers/README.md
๐ŸŽ’ Completely new to all of this? Do the Before-You-Start checklist first โ€” 7 foundations (terminal, git, HTTP, YAMLโ€ฆ), each with a self-check and free resources. Your ticks are saved in the browser.

โ˜ธ๏ธ The real k8s manifests

The actual YAML files the lessons teach โ€” every one heavily commented, in k8s/. Read them in this order (it's also the apply order):

a

๐Ÿšช namespace.yaml

The classroom everything else lives in โ€” apply this first.lesson 05Open file โ†’
b

๐Ÿ“Œ configmap.yaml

Non-secret settings on the notice board: PORT, APP_VERSION.lesson 06Open file โ†’
c

๐Ÿ”‘ secret.example.yaml

Locker-key template โ€” copy to git-ignored secret.yaml, fill in the DB password.lesson 06Open file โ†’
d

๐Ÿง‘โ€๐Ÿซ deployment.yaml

The heart: 2 replicas, rolling updates, probes, resources โ€” 4 lessons in one file.lessons 03 ยท 07 ยท 08 ยท 11Open file โ†’
e

โ˜Ž๏ธ service.yaml

The reception desk: stable name + IP in front of the Node API pods.lesson 04Open file โ†’
f

๐Ÿ analytics-deployment.yaml

Second service, same patterns โ€” calls the Node API by Service name.lessons 03 ยท 04Open file โ†’
g

โ˜Ž๏ธ analytics-service.yaml

Reception desk #2, for the Python analytics pods.lesson 04Open file โ†’
h

๐ŸšŒ hpa.yaml

The transport manager: 2โ€“5 pods, more buses at 70% CPU.lesson 09Open file โ†’
i

๐Ÿซ ingress.yaml

The main gate: one ALB, /analytics โ†’ Python, everything else โ†’ Node.lesson 10Open file โ†’

โ˜๏ธ The AWS components under the cluster โ€” purpose, required or optional

"Is EC2 connected to Kubernetes?" โ€” completely: Kubernetes doesn't replace EC2, it sits on top of it. Every node you see in kubectl get nodes IS an EC2 instance (a rented desk ๐Ÿ–ฅ๏ธ); an EKS node group is an Auto Scaling Group of those desks; the HPA adds pods and, when they no longer fit, the cluster autoscaler asks the ASG for more desks. A NotReady node is usually an EC2 story underneath (spot reclaimed, instance died). The map below shows every AWS piece this repo's terraform/ touches โ€” what each is for, and whether it's REQUIRED or OPTIONAL. Click for the 4K version.

Map of AWS components under the Kubernetes cluster: VPC, subnets, gateways, EKS control plane, EC2 node group, IAM, ECR required; ALB, RDS, EBS, CloudWatch, Route 53 optional

Deep-dive on the two foundations (IAM & EC2) in the AWS foundations course โ€” its lesson 12 is exactly this reveal.

๐Ÿ—บ๏ธ The architecture diagrams

The big numbered diagrams from the README, one after another โ€” readable right here; click any to open the 4K version. Every one is also explained step-by-step in the README.

Big picture architecture
1 ยท The big picture โ€” how all the tools fit together
Docker
2 ยท Docker โ€” image build & local compose
Kubernetes
3 ยท Kubernetes โ€” pods, services, HPA in the cluster
Terraform and AWS
4 ยท Terraform โ†’ AWS โ€” VPC, EKS, ECR, RDS from code
CI/CD pipeline
5 ยท CI/CD โ€” test โ†’ build โ†’ approve โ†’ deploy
Multi-tenancy
6 ยท Multi-tenancy โ€” 100 schools, zero mix-ups
docker run internals
7 ยท Under the hood โ€” what docker run really does
kubectl apply internals
8 ยท Under the hood โ€” how kubectl apply becomes a pod
Life of a request
9 ยท Under the hood โ€” the life of one HTTP request
Before you start foundations
10 ยท Before you start โ€” the 7 foundations

๐Ÿ“š Go deeper

๐Ÿ“ The lesson diagrams โ€” follow the numbers

Every lesson as one numbered box-and-arrow diagram, one after another โ€” readable right here. Also on a standalone page with jump navigation.

1 ๐Ÿฑ Containers & images โ€” recipe โ†’ lunchbox โ†’ lunch

One recipe (Dockerfile) bakes one frozen lunchbox (image); every opened box (container) is identical.

๐Ÿ“ Dockerfile the recipe card ๐ŸงŠ Image school-api:v1 โ€” frozen box ๐Ÿ—„๏ธ Registry (ECR) the shelf where images wait ๐Ÿƒ Running containers box 1 box 2 box 3 1 docker build 2 docker push 3 docker run ร—3 โ€” identical

Read full lesson 01 โ†’

2 ๐Ÿช‘ Pods โ€” one desk, one address, replace don't repair

Kubernetes never runs a bare container โ€” it always sits at a desk (Pod) with its own IP and shared shelf.

๐ŸŒ Cluster network callers ๐Ÿช‘ Pod โ€” IP 10.0.4.7 ๐Ÿ“ฆ school-api main container ๐Ÿ“ฆ sidecar optional helper ๐Ÿ—„๏ธ shared volume 1 talks to the Pod's IP 2 ๐Ÿช‘ NEW Pod new name, new IP 10.0.9.9 3 ๐Ÿ’ฅ desks are replaced, never repaired

Read full lesson 02 โ†’

3 ๐Ÿง‘โ€๐Ÿซ Deployments โ€” declare a wish, the monitor enforces it forever

You say "always 2"; the ReplicaSet counts non-stop and replaces anything that dies.

๐Ÿง‘โ€๐Ÿซ You declare replicas: 2 ยท image: v5 Deployment school-api ReplicaSet the monitor ยท count = 2 ๐Ÿช‘ pod โ€ฆabc12 ๐Ÿ’ฅ crashes! ๐Ÿช‘ pod โ€ฆdef34 healthy ๐Ÿช‘ pod โ€ฆxyz99 auto-created replacement 1 2 3 claims pods by label app: school-api 4 sees 1 missing โ†’ makes a new one

Read full lesson 03 โ†’

4 โ˜Ž๏ธ Services โ€” one number that never changes

Pods get new IPs all the time; callers dial the Service name and it forwards to whoever is present.

๐Ÿ analytics pod calls http://school-api โ˜Ž๏ธ Service school-api stable IP + DNS ยท port 80 โ†’ 3000 ๐Ÿช‘ pod 10.0.4.7 ready ๐Ÿช‘ pod 10.0.9.2 ready ๐Ÿ’€ old pod gone โ€” auto-removed 1 DNS finds the Service 2 picks a READY pod by label 3

Read full lesson 04 โ†’

5 ๐Ÿšช Namespaces โ€” classrooms inside one building

One shared cluster, partitioned into rooms โ€” names only need to be unique inside a room.

๐Ÿซ One Kubernetes cluster โ€” the building ๐Ÿšช namespace: school Deployments: school-api, analytics Services ร—2 ยท ConfigMap ยท Secret HPA ยท Ingress 1 our room โ€” everything in this repo ๐Ÿšช kube-system the school office: CoreDNS ยท metrics-server 2 Kubernetes' own machinery ๐Ÿšช default experiments land here if you forget -n ๐Ÿ˜… 3 Same name in two rooms is fine โ€” "Aarav from 3A" vs "Aarav from 3B" ยท delete a room = clean sweep of only that room

Read full lesson 05 โ†’

6 ๐Ÿ”‘ ConfigMaps & Secrets โ€” settings live outside the lunchbox

Same image everywhere; the notice board (config) and locker key (secret) are injected at start-up.

๐Ÿ“Œ ConfigMap PORT: 3000 ยท APP_VERSION ๐Ÿ”‘ Secret DATABASE_URL (password!) ๐Ÿช‘ Pod at start-up env: PORT, DATABASE_URLโ€ฆ app reads process.env ๐Ÿฑ Image identical in dev & prod 1 envFrom: configMapRef 2 secretKeyRef (never in git) 3 change settings โ†’ restart pods โ†’ same image, new behaviour

Read full lesson 06 โ†’

7 ๐Ÿ™‹ Health probes โ€” two questions, two very different consequences

Liveness failure restarts the container; readiness failure only pauses its traffic.

๐Ÿง‘โ€๐Ÿซ kubelet asks every few seconds GET /healthz โ€” alive? liveness probe GET /readyz โ€” ready? readiness probe ๐Ÿ”„ fails ร—3 โ†’ RESTART same pod, fresh container โธ๏ธ fails โ†’ NO traffic out of the Service list, no restart 1 2 3 4 mixing the two up is one of the most common Kubernetes mistakes!

Read full lesson 07 โ†’

8 ๐Ÿ› Requests & limits โ€” promised plates and capped seconds

Requests are reservations the scheduler counts; limits are hard caps with different penalties for CPU vs memory.

๐Ÿ“‹ Scheduler the cook counting plates ๐Ÿ–ฅ๏ธ Node โ€” 2 CPU ยท 4 Gi ๐Ÿช‘ school-api โ€” req 100m / 128Mi limit 500m / 256Mi ๐Ÿช‘ analytics โ€” req 100m / 128Mi limit 500m / 256Mi ๐ŸŸฉ unreserved โ€” room for more pods ๐Ÿฒ CPU over limit โ†’ throttled (slower) ๐Ÿซƒ RAM over limit โ†’ OOMKilled ๐Ÿ’€ 1 places pods only where requests fit 2 3

Read full lesson 08 โ†’

9 ๐ŸšŒ Autoscaling โ€” the transport manager watches the buses

Above 70% average CPU it adds pods (max 5); when quiet it parks them (never below 2).

๐Ÿ“Š metrics-server measures pod CPU ๐Ÿง‘โ€๐Ÿ’ผ HPA target 70% ยท min 2 ยท max 5 Deployment replicas: โ† edited ๐ŸšŒ 1 ๐ŸšŒ 2 ๐ŸšŒ 3 ๐ŸšŒ 4 1 2 85% โ†’ scale up! 3 scale-up is fast ยท scale-down is slow on purpose (don't park the bus the second the rain stops)

Read full lesson 09 โ†’

10 ๐Ÿซ Ingress โ€” one gate, routed by the signboard

One load balancer for everything; the URL path decides which Service the visitor reaches.

๐ŸŒ Internet parent's browser ๐Ÿซ Main gate โ€” ALB built by the controller ๐Ÿชง path? the signboard โ˜Ž๏ธ analytics svc /analytics/* โ˜Ž๏ธ school-api svc /* everything else 1 2 3 4 specific paths first (/analytics before /) ยท health-checks reuse lesson 07's /healthz ยท one gate = one bill + one TLS setup

Read full lesson 10 โ†’

11 โšฝ Rollouts โ€” substitute one player at a time, keep the bench

A full team is always on the field; the old version stays benched for instant rollback.

โฑ๏ธ during rollout ๐Ÿช‘ v1 pod โ€” playing โœ… ๐Ÿช‘ v1 pod โ€” playing โœ… ๐Ÿƒ v2 pod โ€” warming up 1 maxSurge: 1 extra allowed ๐Ÿ™‹ readiness gate v2 gets traffic ONLY after /readyz says yes 2 โœ… done โ€” all v2 old pods left one by one, never below full team 3 ๐Ÿช‘ old ReplicaSet v1 โ€” scaled to 0, kept on the bench kubectl rollout undo = "come back on!" โ€” a 10-second rollback 4

Read full lesson 11 โ†’

12 ๐Ÿ“š Storage โ€” backpacks vanish, library shelves survive

A PVC gives disposable pods a durable shelf; this repo goes one further and rents the library (RDS).

๐Ÿช‘ postgres pod v1 ๐Ÿ’ฅ dies (backpack gone) ๐Ÿช‘ postgres pod v2 new desk, same books ๐Ÿ“ PVC "I claim 10 Gi of shelf" ๐Ÿ“š PV = EBS disk outlives every pod 1 2 same claim โ†’ same data 3 ๐Ÿ›๏ธ RDS โ€” the rented library what THIS repo uses (terraform/rds.tf) 4 rule of thumb: stateless pods in the cluster, state in managed services outside

Read full lesson 12 โ†’

13 ๐Ÿข Under the hood โ€” what kubectl apply really does

Five office roles, one register, one endless loop: wish โ†’ record โ†’ reconcile โ†’ run โ†’ report.

๐Ÿง‘ kubectl "I wish: 2 pods" ๐Ÿง‘โ€๐Ÿ’ผ API server the ONLY door ๐Ÿ“– etcd the sacred register ๐Ÿ” controllers wish โ‰  reality? fix it ๐Ÿ—“๏ธ scheduler picks the best node ๐Ÿง‘โ€๐Ÿซ kubelet runs it on the node 1 2 wish written down 3 sees Deployment โ†’ creates Pods (unassigned) 4 assigns each pod a node 5 6 5: kubelet pulls the image ๐Ÿฑ, starts the container, runs the probes ๐Ÿ™‹ ยท 6: "running & ready" reported back โ†’ kubectl get pods shows 2/2 ๐ŸŽ‰

Read full lesson 13 โ†’

14 ๐Ÿค– Bonus: CI/CD & GitOps โ€” the homework robot and the caretaker robot

CI tests & builds on every push; ArgoCD lives inside the cluster and keeps it matching the plan book (git).

๐Ÿง‘โ€๐Ÿ’ป dev git push ๐Ÿ“ฎ Robot 1 โ€” CI pipeline โœ… test โ†’ ๐Ÿฑ build โ†’ ๐Ÿ—„๏ธ push to ECR โ†’ โœ๏ธ manual approval ๐Ÿ“– git repo โ€” the master plan k8s/ manifests = single source of truth ๐Ÿซ Kubernetes cluster ๐Ÿค– Robot 2 โ€” ArgoCD lives INSIDE, no outside key ๐Ÿช‘ school pods 1 2 CI commits the new image tag 3 pulls & compares every ~3 min 4 4: sync + self-heal โ€” hand-edits get reverted, deploys = git commits, rollback = git revert ยท the book always wins ๐Ÿ“–

Read full lesson 14 โ†’

15 ๐Ÿซ๐Ÿซ Bonus: Multi-AZ & the scaling ladder

Never seat the whole class in one building โ€” and climb the cheapest rung first on exam day.

๐ŸŒ ALB โ€” stands outside all buildings sends visitors wherever is healthy ๐Ÿซ building A โ€” AZ a ๐Ÿ–ฅ๏ธ desk ๐Ÿช‘ api-1 ๐Ÿช‘ analytics-1 ๐Ÿ–ฅ๏ธ new desk added by the autoscaler 2 ๐Ÿซ building B โ€” AZ b ๐Ÿ–ฅ๏ธ desk ๐Ÿช‘ api-2 ยท ๐Ÿช‘ analytics-2 3 topology spread: copies across buildings โ€” one fire โ‰  down 1 ๐Ÿชœ the ladder 1 HPA: more pods โ€” seconds 2 autoscaler: more desks โ€” minutes 3 spread: across buildings 4 PDB: never all away at once Pending pods = kids standing โ€” the autoscaler's signal 4

Read full lesson 15 โ†’

16 ๐Ÿฉบ Debugging โ€” the nurse's triage chart

Whatever walks in: describe first, Events always, logs --previous for crash loops.

๐Ÿค’ sick podsomething is wrong๐Ÿฉบ the nurse asks:1 describe โ†’ EVENTS2 logs --previous ยท 3 exec1Pending ๐Ÿช‘ โ€” no desk fits: requests? taints?cluster full? (L08 ยท L15 ยท L20)ImagePullBackOff ๐Ÿฑ โ€” wrong label, missingtag, or no registry permission (AWS L05)CrashLoopBackOff ๐Ÿ’ฅ โ€” starts, dies, repeats:logs --previous first, then config (L06)OOMKilled ๐Ÿซƒ / Service silent โ˜Ž๏ธ โ€” limit hit,or selector โ‰  labels: get endpointslices (L04)2match the symptomthe drill never changes:describe โ†’ logs โ†’ events โ†’ exec3

Read full lesson 16 โ†’

17 ๐Ÿชช RBAC โ€” hall passes

Roles are passes, bindings hand them over, ServiceAccounts are the robots' cards.

๐Ÿ‘ฅ whoperson ยท group ยท๐Ÿค– ServiceAccount (pod card)๐Ÿ”— RoleBindinghands the pass over๐Ÿชช Role โ€” one roomget/list pods in school๐Ÿซ ClusterRole โ€” whole buildingview ยท edit ยท admin ยท cluster-admin ๐Ÿ—๏ธ12the API server checks the pass on EVERY request โ€” no pass, no entry ยท test: kubectl auth can-i --as=โ€ฆ3

Read full lesson 17 โ†’

18 โฐ Jobs & CronJobs โ€” homework and the bell

The bell creates homework; homework creates a kid; the kid finishes and that's the point.

๐Ÿ”” CronJobschedule: 0 2 * * *suspend: true = off-switch๐Ÿ“ Jobtonight's homeworkbackoffLimit: 2 retries๐Ÿช‘ podpg_dump โ†’ uploadthen EXITS 01on schedule2โœ… Completed โ€” kept for autopsy, tidied by history limits ๐Ÿงน ยท fire one now: kubectl create job --from=cronjob/school-db-backup3

Read full lesson 18 โ†’

19 ๐Ÿšซ๐Ÿ“ NetworkPolicies โ€” passing-notes rules

Default-deny first, then exactly the conversations the app needs.

๐Ÿ˜ณ defaultevery pod whispers toevery pod โ€” even the DB1 default-denyno notes at all (selects every pod)2 allow exactly what's neededanalytics โ†’ api :3000 ยท gate โ†’ apps1๐Ÿšซ anything elsenote intercepted โ€”dropped silently2โš ๏ธ needs a CNI that enforces policies (Calico / VPC CNI switch) โ€” no enforcer = rules silently ignored: always TEST3

Read full lesson 19 โ†’

20 ๐ŸŽซ Taints & affinity โ€” assigned seating

Signs on desks push away; chits permit; wishes attract; anti-affinity separates twins.

๐Ÿ’Ž GPU desktaint: gpu=true:NoSchedulethe sign that repels๐Ÿ–ฅ๏ธ normal desksno signs โ€” anyone sits๐Ÿค– ML podtoleration ๐ŸŽซ + nodeAffinity:allowed AND attracted๐Ÿช‘ ordinary podno chit โ†’ repelled โŒ12๐Ÿ‘ฏ anti-affinity:never both twinson one desk โ€”HA at desk level3

Read full lesson 20 โ†’

21 ๐Ÿงฏ DaemonSets โ€” one on every floor

No replica count: the node list IS the count. New desk, new extinguisher, automatically.

๐Ÿงฏ DaemonSetone per desk, always โ€”no replica count: nodes ARE it๐Ÿ–ฅ๏ธ desk 1๐Ÿช‘ apps + ๐Ÿงฏ๐Ÿ–ฅ๏ธ desk 2๐Ÿช‘ apps + ๐Ÿงฏ๐Ÿ–ฅ๏ธ NEW desk(autoscaler, L15)๐Ÿงฏ appears by itself12you already run them: kube-proxy (L04's routing!) and the CNI live in kube-system as DaemonSets ยท log collectors next (L26)3

Read full lesson 21 โ†’

22 ๐Ÿท๏ธ StatefulSets โ€” desks with name plates

Sticky name, sticky drawer, ordered arrival โ€” the whole difference from a Deployment.

๐Ÿท๏ธ StatefulSetnamed, ordered kids:postgres-0, then -1, then -2๐Ÿช‘ postgres-0dies โ†’ replacement hasthe SAME name๐Ÿ—„๏ธ PVC data-postgres-0ITS OWN drawer โ€” survivesthe pod, always reattaches12โ˜Ž๏ธ headless Service: reach postgres-0 BY NAME, no load-balancing ยท HA needs an operator (L25) โ€”production stance unchanged: rent the library (RDS, L12)3

Read full lesson 22 โ†’

23 ๐Ÿฝ๏ธ QoS & evictions โ€” who leaves first

BestEffort, then over-promise Burstable, then Guaranteed โ€” your requests ARE your ranking.

๐Ÿ–ฅ๏ธ desk under pressurememory running out โ€”kubelet must free space๐Ÿฅ‰ BestEffort โ€” no requests at allEVICTED FIRST๐Ÿฅˆ Burstable โ€” requests < limitsnext (our pods live here)๐Ÿฅ‡ Guaranteed โ€” requests == limitsevicted LAST12๐Ÿ‘ฎ PriorityClass:system staff basicallynever leaves3

Read full lesson 23 โ†’

24 ๐Ÿ—๏ธ Cluster upgrades โ€” renovating while open

Office first, then desk by desk: cordon, drain (PDBs on guard), replace, uncordon.

๐Ÿข 1 office firstEKS control plane โ€”one Terraform change๐Ÿšง cordonno new kids๐Ÿšš drainPDB guards ๐Ÿฝ๏ธ๐Ÿ–ฅ๏ธ replace deskfresh EC2 + kubelet1โœ… uncordonnext classroom2๐Ÿ“ถ skew rule:desks may trailthe office,never lead ยทone minor at a time3

Read full lesson 24 โ†’

25 ๐Ÿค– CRDs & operators โ€” new words for the office

A word in the register plus a robot who makes it true โ€” ArgoCD demystified.

๐Ÿ“– CRDteach the office a new word:kind: BackupPlan + grammar๐Ÿข office / etcdstores your wishes โ€”kubectl & RBAC just work๐Ÿค– controllerwatches the word, reconcilesforever โ€” L03's loop, your noun12CRD + controller + expertise = an OPERATOR ยท you've used them all along: ArgoCD's Application,cert-manager's Certificate, CloudNativePG's Cluster โ€” words plus robots ๐Ÿคฏ3

Read full lesson 25 โ†’

26 ๐Ÿ“ˆ Observability โ€” eyes on everything

Report cards (metrics), diaries (logs), alarm bells (alerts) โ€” and one screen for all of it.

๐Ÿช‘ pods expose /metricsnumbers on every door๐Ÿงฏ log collectorDaemonSet (L21) ships diaries๐Ÿ“Š Prometheusscrapes + keeps history๐Ÿ“œ log storediaries outlive desks๐Ÿ“บ Grafanaone screen: metrics + logs๐Ÿ”” Alertmanagerrules ring the on-call phone12start with: is it up ยท is it erroring ยท is it slow ยท is the cluster healthy โ€” four questions, one dashboard3

Read full lesson 26 โ†’

Start Lesson 01 โ†’ ๐Ÿ—“๏ธ Study plan (9 weeks) ๐Ÿ“ All 26 lesson diagrams ๐Ÿงช Quiz โฎ๏ธ Before & trade-offs Check my foundations first ๐Ÿฑ Course 1: Docker & ECR ๐Ÿค– Course 3: ArgoCD