16-Part Main Series
All Articles in This Series
The complete distributed systems and Kubernetes pipeline — from theoretical foundations through production-grade platform engineering.
Part 1
Distributed Systems Foundations
What distributed systems are, core challenges of network failures, partial failures, latency, and the fundamental principles of coordination.
Read Article →
Part 2
Consensus Algorithms
How machines agree on shared state — Raft consensus, leader election, log replication, quorum, and split-brain problems.
Read Article →
Part 3
CAP Theorem & Replication
The CAP theorem trade-offs, synchronous vs asynchronous replication, eventual consistency, and conflict resolution strategies.
Read Article →
Part 4
Service Discovery & Communication
How ephemeral services find each other — DNS-based and registry-based discovery, RPC, gRPC, message queues, and resilience patterns.
Read Article →
Part 5
Failure & Resilience
Node failures, network partitions, cascading failures — and the patterns for self-healing, redundancy, and graceful degradation.
Read Article →
Part 6
Kubernetes Architecture
Kubernetes as a declarative reconciliation system — control plane components, worker nodes, and the desired-state mental model.
Read Article →
Part 7
Kubernetes Object Model
Core objects — Pods, ReplicaSets, Deployments, Services, ConfigMaps, Secrets — and declarative YAML manifests.
Read Article →
Part 8
Kubernetes Networking
The flat networking model, CNI plugins (Calico, Cilium, Flannel), pod-to-pod communication, and network fundamentals.
Read Article →
Part 9
Services, Ingress & Service Mesh
ClusterIP, NodePort, LoadBalancer services, Ingress controllers, TLS termination, Istio, Linkerd, and traffic shaping.
Read Article →
Part 10
Kubernetes Storage
Persistent state in distributed systems — PVs, PVCs, StorageClasses, StatefulSets, and the Container Storage Interface.
Read Article →
Part 11
Kubernetes Internals
API machinery, reconciliation loops, scheduler internals (filtering, scoring, binding), and etcd deep dive.
Read Article →
Part 12
CRDs & Operators
Kubernetes as a programmable platform — Custom Resource Definitions, application-specific controllers, and the Operator pattern.
Read Article →
Part 13
Cluster Operations & Reliability
Cluster lifecycle, HPA/VPA, multi-master HA, multi-cluster management, backup and disaster recovery.
Read Article →
Part 14
Kubernetes Security
Threat model, RBAC, pod security contexts, network policies, admission controllers (OPA, Kyverno), and secrets management.
Read Article →
Part 15
Observability & Troubleshooting
Monitoring with Prometheus/Grafana, structured logging, distributed tracing, and diagnosing common Kubernetes failures.
Read Article →
Part 16
Cloud Native Ecosystem
Helm charts, GitOps with ArgoCD/Flux, platform engineering, serverless on Kubernetes (Knative), and the CNCF landscape.
Read Article →
2-Part Minikube
Minikube
Single-node Kubernetes clusters for local development — install, configure drivers, enable addons, and manage multi-node profiles for realistic testing.
Part 1
Minikube: Install & Addons
Install Minikube, configure drivers (Docker/Hyperkit/KVM), enable addons (metrics-server, ingress, dashboard), and run your first cluster.
Read Article →
Part 2
Multi-Node & Profiles
Create multi-node Minikube clusters for realistic testing, manage profiles for project isolation, and configure networking.
Read Article →
2-Part Kind
Kind (Kubernetes IN Docker)
Lightweight multi-node clusters inside Docker containers — ideal for CI pipelines, integration testing, and rapid prototyping without a VM.
Part 1
Kind: Setup & Config
Kubernetes IN Docker — create multi-node clusters for CI testing, configure via YAML, and use local image registries.
Read Article →
Part 2
Multi-Node & CI Usage
Multi-node Kind clusters for testing HA scenarios, GitHub Actions integration, and custom networking configurations.
Read Article →
2-Part Skaffold
Skaffold
Continuous build-deploy-watch inner-loop workflow — hot-reload code changes into Kubernetes, file sync without rebuilds, and profile-based multi-environment pipelines.
Part 1
Skaffold: Workflow & Hot Reload
Skaffold dev mode for continuous build-deploy-watch cycles, file sync for instant reloads, and skaffold.yaml configuration.
Read Article →
Part 2
Pipelines & Profiles
Skaffold build/deploy pipelines, profile-based configuration for dev/staging/prod, and CI/CD integration patterns.
Read Article →
2-Part Kustomize
Kustomize
Template-free environment-specific configuration — bases and overlays for dev/staging/prod, strategic merge patches, ConfigMapGenerator, and SecretGenerator.
Part 1
Kustomize: Bases & Overlays
Kustomize bases and overlays for environment-specific configuration without templates or Helm charts.
Read Article →
Part 2
Patches & SecretGenerator
Strategic merge patches, JSON patches, ConfigMapGenerator, SecretGenerator, and variable substitution in Kustomize.
Read Article →
4-Part Helm
Helm
The Kubernetes package manager — chart repositories, Go templates, values hierarchy, lifecycle hooks, OCI registries, and production patterns with Helmfile.
Part 1
Helm: Install & First Deploy
Install Helm, add repositories, inspect charts, deploy the grade-api with
Read Article →
helm install, and manage release lifecycle with upgrade and rollback.
Part 2
Chart Structure & Templates
Chart anatomy, Go template syntax, built-in objects, values hierarchy, named templates, and chart linting. Build a grade-api chart from scratch.
Read Article →
Part 3
Advanced Templating & Hooks
Sprig functions, conditional blocks, loops, subcharts, library charts, lifecycle hooks for migrations and smoke tests, and unit testing with helm-unittest.
Read Article →
Part 4
Production Patterns
OCI chart registries, Helm Secrets for encrypted values, RBAC and multi-environment promotion, Helmfile for declarative fleet management, and CI/CD integration.
Read Article →
5-Part Argo CD
Argo CD
Declarative GitOps continuous delivery — install, Applications, sync policies, App-of-Apps pattern, ApplicationSets, RBAC/Projects, notifications, and multi-cluster fleet management.
Part 1
Argo CD: Concepts & Install
GitOps principles, Argo CD architecture, HA install on a real cluster, CLI and UI tour, repository connections, and a first Application deployment.
Read Article →
Part 2
Applications & Sync Policy
Application manifest deep dive, declarative vs imperative sync, auto-sync and self-heal, health checks, resource hooks, and diff strategies.
Read Article →
Part 3
App-of-Apps & Sync Waves
App-of-apps pattern, ApplicationSets for fleet management, sync waves and phases for ordered rollouts, and multi-tenant cluster bootstrapping.
Read Article →
Part 4
RBAC & Projects
AppProjects as security boundaries, RBAC policy configuration, SSO with Dex and OIDC, team onboarding patterns, and multi-tenant isolation.
Read Article →
Part 5
Notifications, Image Updater & Multi-Cluster
Argo CD Notifications for Slack/email/PagerDuty alerts, Image Updater for automated tag promotion, and multi-cluster fleet management patterns.
Read Article →
4-Part Flux
Flux
Pull-based GitOps with the CNCF Flux project — bootstrap, source controllers, Kustomization reconciliation, HelmRelease, OCI sources, and image automation.
Part 1
Flux: Bootstrap & Sources
Bootstrap Flux into your cluster, configure GitRepository and HelmRepository sources, and understand the reconciliation loop.
Read Article →
Part 2
Kustomization & Reconciliation
Flux Kustomization controller for multi-app deployments, dependency ordering, health checks, and pruning strategies.
Read Article →
Part 3
HelmRelease & OCI Sources
Deploy Helm charts via Flux HelmRelease CRD, use OCI registries as sources, and manage Helm values with ConfigMaps.
Read Article →
Part 4
Image Automation & Alerts
Automate container image updates with ImageRepository, ImagePolicy, and ImageUpdateAutomation. Configure alerts for Slack/Teams.
Read Article →
4-Part Vault
HashiCorp Vault
Dynamic secrets management for Kubernetes — install Vault via Helm, Kubernetes auth, sidecar/VSO secret injection, dynamic database credentials, and PKI certificate automation.
Part 1
Vault: Concepts & Install
HashiCorp Vault concepts — secrets engines, auth methods, policies, and Helm installation on Kubernetes.
Read Article →
Part 2
Kubernetes Auth Method
Configure Vault's Kubernetes auth method so pods authenticate using ServiceAccount tokens.
Read Article →
Part 3
Secret Injection: Agent & VSO
Inject secrets into pods via the Vault Agent Sidecar Injector and the Vault Secrets Operator (VSO).
Read Article →
Part 4
Dynamic Secrets & PKI
Dynamic database credentials with automatic rotation, PKI secrets engine for auto-issued TLS certificates.
Read Article →
3-Part OPA / Gatekeeper
OPA / Gatekeeper
Policy-as-code with Rego — write admission control policies, deploy them via Gatekeeper ConstraintTemplates, audit existing resources, and test policies in CI with conftest.
Part 1
Rego Language Basics
OPA Rego language fundamentals — rules, functions, comprehensions, and Kubernetes admission context.
Read Article →
Part 2
Gatekeeper & ConstraintTemplates
Install OPA Gatekeeper, create ConstraintTemplates with embedded Rego, and enforce policies on resources.
Read Article →
Part 3
Audit, Mutation & Testing
Gatekeeper audit mode, mutation policies with Assign/AssignMetadata, and conftest for CI testing.
Read Article →
3-Part Kyverno
Kyverno
Kubernetes-native policy engine using pure YAML — validate, mutate, and generate resources without learning Rego. Image verification with cosign for supply chain security.
Part 1
Kyverno: Install & Validate
Install Kyverno and write YAML-native validate policies — no Rego required. ClusterPolicy and Policy resources.
Read Article →
Part 2
Generate, Mutate & Clone
Kyverno mutate rules for auto-injection, generate rules for auto-creating resources on events.
Read Article →
Part 3
Image Verification & Policy Reports
Kyverno verifyImages rules for cosign signatures, attestation verification, and supply chain security.
Read Article →
2-Part Trivy
Trivy
Container image vulnerability scanning and SBOM generation for CI pipelines, plus the Trivy Operator for continuous in-cluster security reports.
Part 1
Image Scanning & SBOM
Trivy CLI for container image vulnerability scanning, SBOM generation, and CI pipeline integration.
Read Article →
Part 2
Cluster Scan & CI Integration
Trivy Operator for continuous in-cluster scanning with VulnerabilityReport and ConfigAuditReport CRDs.
Read Article →
2-Part External Secrets
External Secrets Operator
Sync secrets from external providers (Vault, AWS Secrets Manager, GCP Secret Manager) into Kubernetes Secrets automatically with SecretStore, ExternalSecret, and PushSecret.
Part 1
SecretStore & ExternalSecret
External Secrets Operator — SecretStore configuration for Vault/AWS/GCP and ExternalSecret for sync.
Read Article →
Part 2
Multi-Backend & PushSecret
PushSecret to write K8s secrets to external providers, generators for dynamic values, ClusterExternalSecret.
Read Article →
3-Part Istio
Istio Service Mesh
Full-featured service mesh with Envoy sidecars — traffic management, canary deployments, mutual TLS, AuthorizationPolicy, and observability with Kiali and Prometheus.
Part 1
Istio: Install & Sidecar
Install Istio service mesh, understand Envoy sidecar injection, and basic traffic management concepts.
Read Article →
Part 2
Traffic Management & Canary
VirtualService for canary deployments, traffic splitting, fault injection, retries, and DestinationRule circuit breaking.
Read Article →
Part 3
mTLS Security & Observability
Mutual TLS for zero-trust communication, PeerAuthentication, AuthorizationPolicy, and RequestAuthentication.
Read Article →
3-Part Cilium
Cilium
eBPF-powered Kubernetes networking — identity-based network policies, kube-proxy replacement, Hubble observability, Cluster Mesh for multi-cluster connectivity, and BGP control plane.
Part 1
Cilium: eBPF Concepts & Install
Cilium eBPF-based CNI — install, CiliumNetworkPolicy for identity-based L3/L4 filtering, kube-proxy replacement.
Read Article →
Part 2
NetworkPolicy & Hubble
Hubble for network flow observability, L7 HTTP/gRPC/DNS visibility, and Prometheus metrics from eBPF.
Read Article →
Part 3
Cluster Mesh & BGP
Multi-cluster pod-to-pod connectivity with Cluster Mesh, BGP control plane for LoadBalancer IP advertisement, and L2 announcements for bare-metal.
Read Article →
3-Part Crossplane
Crossplane
Manage cloud infrastructure from Kubernetes APIs — Providers for AWS/GCP/Azure, Managed Resources, Compositions for reusable blueprints, and Claims for self-service infrastructure.
Part 1
Crossplane: Concepts & Providers
Install Crossplane, configure cloud Providers, and create Managed Resources for real cloud infrastructure.
Read Article →
Part 2
Compositions & XRDs
Compositions for reusable infrastructure blueprints, XRDs for simplified platform APIs, and patch transforms.
Read Article →
Part 3
Claims & GitOps Integration
Claims for namespace-scoped self-service infrastructure, GitOps with Flux/ArgoCD for infrastructure provisioning.
Read Article →