Course Hub

Course Hub

Interactive, hand-built figures for learning infrastructure, reliability and AI systems. Each lesson is a small machine you can poke at until the idea clicks.

0 of 27 live lessons complete

New: an EKS deep dive → architecture, VPC CNI, IAM and Pod Identity, EBS and EFS, upgrades, load balancers: each with a live terminal

Kubernetes

From containers to production: the 50 core concepts for beginners, then the real stack around them. CDN and load balancers, DNS and TLS automation, GitOps with blue-green and canary releases, observability, platform internals, and an Amazon EKS deep dive.

0 of 27 done · 0 planned

  1. Lesson 01 Containers & images Explain what a container is, where images come from, and why running many of them by hand calls for an orchestrator. Containers vs VMsImages & registriesWhy orchestrationDeclarative vs imperative Live3D8 min
  2. Lesson 02 The cluster at a glance See the whole system work at once: the control plane keeps replicas running, the scheduler places pods, and traffic reaches them through a Service and an Ingress. Cluster, nodes, control planeSchedulerReconcile loopkubeletPodsReplicaSetsDeployments (replicas)Self-healingServicesEndpoints & kube-proxyIngress Live3D10 min
  3. Lesson 03 Inside the control plane Follow a kubectl apply from YAML to running pod through the API server, etcd and the controllers. API serveretcdController managerContainer runtimekubectl & manifests Live3D10 min
  4. Lesson 04 Pods, labels & namespaces Read a pod's lifecycle and use labels, selectors and namespaces to find and group things. Pods (multi-container)Pod lifecycle & CrashLoopBackOffLabels & selectorsNamespaces Live3D8 min
  5. Lesson 05 Deployments & rollouts Predict what maxSurge and maxUnavailable do during a rolling update, and roll back a bad release. ReplicaSetsDeploymentsRolling updatesRollbacks Live3D10 min
  6. Lesson 06 Pod networking & Services Explain how pods reach each other, why Services exist, and how a name like my-svc resolves. Pod networkingServicesService typesEndpoints & kube-proxyCluster DNS Live3D10 min
  7. Lesson 07 Ingress & NetworkPolicy Route outside traffic by host and path, terminate TLS, and wall pods off from each other. Ingress & controllersTLS at the edgeNetworkPolicy Live3D8 min
  8. Lesson 08 ConfigMaps & Secrets Feed configuration to a pod as env vars or files, and know what a Secret does and doesn't protect. ConfigMapsSecretsEnv vars vs mounted files Live3D8 min
  9. Lesson 09 Health probes Tell liveness, readiness and startup probes apart and see why a new pod waits before getting traffic. Liveness probesReadiness probesStartup probesSelf-healing Live3D8 min
  10. Lesson 10 Requests, limits & QoS Predict where a pod is scheduled, when it is throttled or OOM-killed, and which pods are evicted first. Resource requestsResource limitsQoS classes & eviction Live3D10 min
  11. Lesson 11 Volumes, PVs & PVCs Keep data past a container restart, and bind a claim to a volume through a StorageClass. Volumes & emptyDirPersistentVolumesPersistentVolumeClaimsStorageClasses Live3D8 min
  12. Lesson 12 StatefulSets, DaemonSets & Jobs Pick the right workload type for a database, a per-node agent and a batch task. StatefulSetsDaemonSetsJobsCronJobs Live3D10 min
  13. Lesson 13 Autoscaling & placement Predict how replicas and nodes change with load, and steer pods onto or away from nodes. Horizontal Pod AutoscalerCluster AutoscalerNode selectors & affinityTaints & tolerations Live3D10 min
  14. Lesson 14 ServiceAccounts & RBAC Give a pod an identity and grant people and pods only the access they need. ServiceAccountsRBAC roles & bindingsPod security basics Live3D8 min
  15. Lesson 15 Debugging & Helm Find out why a pod isn't working, and install an app packaged with Helm. describe, logs, exec, eventsHelmObservability basics Live3D10 min
  16. Lesson 16 Beyond: Istio ingress Trace a request through an Istio Gateway, VirtualService, DestinationRule and the Envoy sidecar. Service meshGatewayVirtualServiceDestinationRulemTLS & outlier detection Live3D12 min
  17. Lesson 17 Production: CDN to pod Follow one request from DNS through a CDN edge (CloudFront or Akamai), its WAF and cache, an ALB across three zones, to a pod, and watch each layer absorb a failure. DNS & CNAMEsCDN edge cachingCache invalidationWAFTLS at the edge & to the originALB listeners & target groupsAWS Load Balancer ControllerVPC CNI pod IPsMulti-AZ & topology spreadHealth checks & failover Live3D15 min
  18. Lesson 18 Edge: DNS, TLS & Gateway API See how external-dns, cert-manager and a Gateway controller turn YAML into DNS records, a trusted certificate and a load balancer, and how Gateway API splits traffic. external-dnscert-manager & ACMEDNS-01 challengesCertificate renewalGateway API (GatewayClass, Gateway, HTTPRoute)Traffic splitting & header matchingIngress vs Gateway API Live3D12 min
  19. Lesson 19 Delivery: GitOps, blue-green & canary Follow a change from commit to production through CI, Git, Kustomize and Argo CD, and release it safely with blue-green or canary. CI/CD & image promotionGitOps with Argo CDKustomize overlaysDrift & self-healBlue-green deploymentsCanary releasesAutomated analysis & rollback Live3D14 min
  20. Lesson 20 Observability & reliability Use metrics, logs and traces to find what's wrong, and keep an app up through node upgrades with PodDisruptionBudgets and topology spread. Metrics & PrometheusPromQL & SLO alertsLogs with Fluent Bit & LokiDistributed tracing (OpenTelemetry, Tempo)Grafana dashboardsPodDisruptionBudgetsTopology spread across zonesNode upgrades & drains Live3D14 min
  21. Lesson 21 Platform: CRDs, operators, quotas & Karpenter Extend Kubernetes with a CRD and an operator, share a cluster fairly with quotas and limit ranges, and let Karpenter fit nodes to pods. CustomResourceDefinitionsOperatorsResourceQuotasLimitRangesMulti-tenancyKarpenter provisioningConsolidation Live3D14 min
  22. Lesson 22 EKS architecture Know what AWS runs and what you run in EKS, how the control plane reaches your VPC, and how endpoint access, node groups and Fargate fit together. EKS managed control planeCross-account ENIsPublic & private endpointsManaged node groupsFargate profilesManaged add-onsMulti-AZ control plane & etcd quorum Live3D12 min
  23. Lesson 23 VPC CNI & pod IPs See how the VPC CNI gives pods VPC addresses through ENIs and warm pools, why max pods depends on the instance type, and how to avoid running out of IPs. Amazon VPC CNIENIs & secondary IPsWarm pool (WARM_ENI_TARGET, WARM_IP_TARGET)Max pods per instance typePrefix delegationSubnet IP exhaustionCustom networking & secondary CIDRs Live3D12 min
  24. Lesson 24 IAM on EKS: access entries, IRSA & Pod Identity Follow how IAM identities get into an EKS cluster through access entries, and how pods get IAM roles through IRSA or EKS Pod Identity instead of the node's role. aws eks get-token & the authenticatorAccess entries & access policiesaws-auth ConfigMap (legacy)IMDS & the node roleIRSA (OIDC, AssumeRoleWithWebIdentity)EKS Pod IdentityLeast-privilege pod roles Live3D14 min
  25. Lesson 25 Storage on EKS: EBS, EFS & AZs Use EBS and EFS through their CSI drivers, understand why EBS volumes pin pods to one AZ, and move data between AZs with snapshots. EBS CSI drivergp3 StorageClassVolume binding modesAZ-bound volumes & node affinityEFS & ReadWriteManyVolumeSnapshots & restoreVolume expansion Live3D12 min
  26. Lesson 26 Upgrading EKS Upgrade an EKS cluster safely: find removed APIs with upgrade insights, then upgrade the control plane, add-ons and nodes in order, one minor version at a time. EKS upgrade insightsDeprecated & removed APIsControl plane upgradesAdd-on compatibilityNode group rolling updatesVersion skew policyStandard vs extended support Live3D12 min
  27. Lesson 27 Load balancing on EKS: ALB, NLB & target types See how the AWS Load Balancer Controller builds ALBs and NLBs in tagged subnets, why ip targets skip the kube-proxy hop that instance targets take, and how readiness gates keep rollouts from dropping requests. AWS Load Balancer ControllerALB from Ingress, NLB from ServiceTarget type instance vs ipNodePort & the kube-proxy hopSubnet discovery tagsPod readiness gatesTarget registration & deregistration Live3D12 min

SRE & DevOps

Running systems reliably: budgets, pipelines, signals and failure.

Coming soon · 6 planned

  1. Lesson 01 SLOs & error budgets Turn an SLO into an error budget and decide when to stop shipping. Planned
  2. Lesson 02 CI/CD pipelines Follow a commit through build, test and deploy stages, and see where gates belong. Planned
  3. Lesson 03 Canary & blue-green Compare rollout strategies by blast radius and rollback speed. Planned
  4. Lesson 04 Metrics, logs & traces Pick the right signal to answer a question about a running system. Planned
  5. Lesson 05 Retries, timeouts & circuit breakers See how retries amplify load and how breakers and budgets stop it. Planned
  6. Lesson 06 Incident response Run an incident: roles, mitigation first, then the review. Planned

Platform Engineering

Building the paved road other teams ship on.

Coming soon · 4 planned

  1. Lesson 01 Internal developer platforms Map what a platform team provides and what a golden path is. Planned
  2. Lesson 02 GitOps Watch a controller reconcile a cluster to what is in Git. Planned
  3. Lesson 03 Infrastructure as code Read a plan, understand state and drift, and apply safely. Planned
  4. Lesson 04 Policy as code Block a bad deploy at admission time with a policy. Planned

AI Systems

How modern AI models work and how they are served and used.

Coming soon · 5 planned

  1. Lesson 01 Tokens & embeddings See how text becomes tokens and tokens become vectors. Planned
  2. Lesson 02 Attention Follow how each token weighs the others to build context. Planned
  3. Lesson 03 Retrieval-augmented generation Trace a question through chunking, vector search and the prompt. Planned
  4. Lesson 04 Serving an LLM See how batching and the KV cache trade latency for throughput. Planned
  5. Lesson 05 Agents & tool use Follow a model's loop of thinking, calling tools and reading results. Planned