Twelve weeks of hands-on Kubernetes. Solo lab work from my M.S. MLOps coursework: first cluster → scheduling and autoscaling → config, probes, and rollouts → Helm and CI → GitOps with Argo CD and image scanning with Trivy → RBAC, default-deny networking, Pod Security Standards, and a deliberately triggered production incident.
Final lab: deploy a memory bomb on purpose, watch the cluster feel it in Grafana, and respond like it's production.
165 manifests, shell transcripts, and written notes, all my own work, extracted from my deliverables in the course repository (KubernetesEngineering-AI7993/k8s-enterprise-capstone-team2), where the commit history is preserved under my account. Lab prompts were set by the course; every artifact here is mine. Course lab instructions are the instructor's material and are deliberately not republished.
Each lab folder is self-contained: the manifests, a .sh transcript of the commands run, the raw kubectl output captured as evidence, and a plain-English *_notes.md explaining what was done and why. The notes are the fastest read.
| Section | Focus | Selected artifacts |
|---|---|---|
| 01 · Cluster fundamentals | Contexts, namespaces as environment boundaries, first Deployments and Services | namespaces.yaml, deployment + service pair, verification transcripts |
| 02 · Scheduling & resources | Requests/limits, taints and tolerations, HPA autoscaling, debugging failing workloads | side-by-side deployments with and without limits plus kubectl top evidence, HPA manifests, kind cluster config |
| 03 · Workloads & config | Deployments and Services in depth, ConfigMaps and Secrets, liveness/readiness probes, rolling updates and rollbacks | probe manifests, rollout and rollback transcripts |
| 04 · Helm & delivery | Authoring a Helm chart, multi-container pods, CI pipeline wiring, deployment strategies | sample-app chart with templates and values, CI snippets |
| 05 · GitOps & supply chain | Argo CD application delivery, secrets management, Trivy image scanning, deployment validation | argocd-app.yaml, Trivy scans comparing :latest vs a pinned tag, good/bad deployment pair with validation scripts in both bash and PowerShell |
| 06 · Security & observability | RBAC and ServiceAccounts, default-deny NetworkPolicies, Pod Security Standards, Prometheus/Grafana and incident simulation | read-only Role/RoleBinding, default-deny.yaml plus targeted allow policies, restricted namespace and pod, memory-bomb.yaml with the Grafana capture above |
Everything runs on a local kind cluster with kubectl and Helm. The kind config used is in section 02. To replay a lab: create the cluster, kubectl apply -f the manifests in that lab's folder, and compare against the captured transcripts.
- Secret manifests use obvious dummy values (
password123) by design. The labs practice the mechanics of Secrets, and the capstone's public GitOps repo uses encrypted SealedSecrets for the real thing. - The Helm chart began from
helm createscaffolding, then was modified per the lab, stated so nobody mistakes boilerplate for authorship. - Command outputs are unedited transcripts from my clusters, warts included.
The team capstone this course built toward (a Kubernetes computer-vision inference platform with Argo CD GitOps, sealed secrets, Trivy-gated CI, and Prometheus/Grafana) lives on the mlops branch of the course repo. Five-person team; more on my profile.
Drew Patrick, M.S. Artificial Intelligence, Kennesaw State University.
MIT (my deliverables only), see LICENSE.