GitOps with Kubernetes

Overview

Every change applied to a cluster by hand is knowledge lost at the next rebuild. With GitOps the desired state of the cluster lives in Git and the cluster brings itself there. In this training we deploy applications with ArgoCD, set up promotion between test and production, store secrets safely and roll a release back in minutes. We run our own test and production clusters this way.

Course content

1. Kubernetes architecture

• Control plane and worker nodes
• API server, etcd, scheduler and kubelet
• Namespaces and RBAC basics
• Working with kubectl

2. Workloads

• Pods, ReplicaSets and Deployments
• StatefulSets, DaemonSets, Jobs and CronJobs
• Rolling update and recreate strategies
• Pod disruption budgets

3. Networking

• Service types
• Ingress and the Gateway API
• DNS and service discovery
• TLS certificates with cert-manager

4. Resource management

• Requests and limits; QoS classes
• When the memory estimate is wrong: OOM and node loss
• Liveness, readiness and startup probes
• Anti-affinity and topology spread
• Lab: moving a .NET service onto the cluster

5. Packaging

• Kustomize: bases and overlays
• Helm: charts, values and templates
• When to use which
• Per-environment configuration

6. GitOps principles

• Desired state in Git, the cluster converges
• The cost of manual changes
• Push versus pull deployment
• Repository layout: app code and deployment definitions

7. ArgoCD

• Applications and AppProjects
• Sync, self-heal and prune
• App-of-apps and ApplicationSets
• Sync waves and hooks
• ignoreDifferences pitfalls

8. Release flow

• Image tags and digests
• Automatic image updates with Image Updater
• Branch flow: development, test, main
• Approved production releases and the emergency path
• Lab: automatic to test, approved to production

9. Secret management

• No plain secrets in Git
• Sealed Secrets
• External Secrets and vault integration
• Rotating secrets

10. Security

• Network isolation with NetworkPolicies
• Pod security standards
• An introduction to mTLS between services
• Image provenance and signing

11. Data on the cluster

• Persistent volumes and storage classes
• PostgreSQL with CloudNativePG
• Continuous WAL archiving and base backups
• Restore drills

12. Operations

• Rollback through git revert
• Common mistakes and diagnosis
• Cluster upgrades
• Lab: rolling back a broken release through Git

Schedule

Each module takes about 4 hours, half a day; 48 hours in total.

• Day 1: modules 1 and 2
• Day 2: modules 3 and 4
• Day 3: modules 5 and 6
• Day 4: modules 7 and 8
• Day 5: modules 9 and 10
• Day 6: modules 11 and 12

Prerequisites

• Comfort with Docker and containers
• Basic Linux command line and YAML
• Branches and pull requests in Git
• A laptop with kubectl (we provide the lab cluster)

Training format

• On site or remote: at your office or in live virtual sessions.
• Hands-on: every day ends with lab sessions where you apply that day’s topic to a working example.
• Lab environment: participants get a prepared working environment and a sample code repository.
• Tailored to your team: content and examples are adapted to your stack after a short call before the training.
• Materials: slides, lab guides and reference code stay with you after the training.