Create complete cloud-native-lab repository scaffold for CKAD/CKA preparation

[Copilot]

Implements the full initial repository scaffold for a long-term cloud-native learning and portfolio workspace covering Kubernetes certifications, Go tooling, observability, GitOps, security, and CNCF technologies. 249 files across the complete directory structure.

Description

Bootstrap a production-quality cloud-native lab repository from an empty shell. Covers the full required structure with working labs, executable scripts, GitHub Actions CI, documentation, and security defaults throughout.

Root Configuration

• README.md — Full professional root README: objectives, structure map, current focus checklist, tech table, prerequisites, getting started, learning method
• Makefile — help, check, cluster-create/delete, validate, lint (markdown/yaml/shell), test, clean
• LICENSE — Apache 2.0
• .editorconfig, .gitignore, .markdownlint.json, .shellcheckrc, .yamllint.yml — Full linting/formatting config; yamllint excludes Helm templates
• SECURITY.md — Responsible disclosure, no-secrets policy, Kubernetes Secret limitations, image security, RBAC, supply-chain guidance
• CODE_OF_CONDUCT.md, roadmap.md — 7-phase roadmap from foundation to CKS

GitHub Actions Workflows

All workflows include permissions: contents: read (CodeQL-verified):

• markdown-lint.yml, shellcheck.yml, yaml-lint.yml, kubernetes-validation.yml (kubeconform), go-ci.yml (fmt + vet + test across all modules)

Certifications — 5 Complete CKAD Starter Labs

Each lab ships with namespace.yaml, resources.yaml, validate.sh, cleanup.sh:

Lab	Domain
multi-container-pod	Application Design and Build
rolling-update	Application Deployment
configure-probes	Observability and Maintenance
config-map-and-secret	Environment, Configuration and Security
cluster-ip-service	Services and Networking

Kubernetes Labs — 5 Complete General Labs

• configuration/config-maps/pod-with-config-map — ConfigMap via envFrom
• workloads/deployments/web-deployment — 3-replica nginx with probes, rolling update, rollback
• workloads/cron-jobs/scheduled-task — Job + CronJob with history limits and concurrency policy docs
• storage/persistent-volume-claims/basic-pvc — PVC + Pod, dynamic provisioning notes
• networking/network-policies/default-deny — Default-deny + allow policy, CNI enforcement warning

Cluster, Helm, Kustomize

• kubernetes-labs/clusters/kind/kind-config.yaml — 3-node cluster with ingress port mappings
• kubernetes-labs/helm/charts/sample-web/ — Full chart: Chart.yaml, values.yaml, _helpers.tpl, Deployment + Service templates with probes and security context
• kubernetes-labs/kustomize/ — bases/sample-web + overlays/development (1 replica) + overlays/production (3 replicas, resource patches)

Go Labs

// go-labs/kubernetes-client/list-pods/main.go
// Reads active kubeconfig, accepts --namespace flag, lists Pods with tabwriter output
pods, err := clientset.CoreV1().Pods(namespace).List(context.Background(), metav1.ListOptions{})

go.sum committed; go build ./... verified passing.

Scripts (all set -euo pipefail, executable)

• check-prerequisites.sh — Core (Docker, kubectl, Kind, Git) vs optional (Helm, Kustomize, Go) split
• create-kind-cluster.sh / delete-kind-cluster.sh — Respects CLUSTER_NAME env var, idempotent
• validate-manifests.sh — kubeconform → server dry-run → client dry-run fallback chain
• cleanup.sh — Removes temp files only; cluster deletion requires CLEANUP_CLUSTER=true

Documentation

• docs/templates/lab-readme-template.md — Standard lab structure template
• Cheatsheets: kubectl.md, linux.md, docker.md, go.md
• docs/troubleshooting/kubernetes.md — CrashLoopBackOff, Pending, ImagePullBackOff, Service connectivity
• docs/glossary/cloud-native-glossary.md

Security Defaults Throughout

All Kubernetes manifests enforce:

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: [ALL]
resources:
  requests: { cpu: 50m, memory: 64Mi }
  limits: { cpu: 100m, memory: 128Mi }

container-labs/multi-stage-builds/go-app/ — distroless runtime, non-root user, static binary.

Stub READMEs for All Planned Areas

linux-labs/, container-labs/, networking-labs/, observability-labs/, gitops-labs/, security-labs/, cncf-labs/, automation/, examples/, tests/ — all have README.md with learning roadmaps or topic context; no empty directories.

Type of Change

• New lab or exercise
• Bug fix or correction
• Documentation update
• Script or automation improvement
• Refactoring (no behaviour change)
• Other (describe below)

Lab or Area Affected

Entire repository — initial scaffold covering all root directories, certification labs, Kubernetes general labs, Go example, scripts, docs, and CI workflows.

Checklist

• Directory and file names use lowercase kebab-case
• README.md is complete and follows the lab template
• Kubernetes YAML passes manifest validation (make validate)
• Shell scripts pass ShellCheck (make lint-shell)
• Markdown passes markdownlint (make lint-markdown)
• YAML passes yamllint (make lint-yaml)
• No secrets, credentials or real values committed
• Cleanup script only removes resources created by this lab
• Validation script works correctly
• Links in README files are correct

Testing

# Shell script syntax
bash -n scripts/check-prerequisites.sh  # all 5 scripts — OK

# YAML syntax (excludes Helm templates)
python3 -c "import yaml, glob; [list(yaml.safe_load_all(open(f))) for f in glob.glob('kubernetes-labs/**/*.yaml', recursive=True) if 'templates/' not in f]"

# Go build
cd go-labs/kubernetes-client/list-pods && go mod tidy && go build ./...  # Build succeeded

# CodeQL scan: 0 alerts (actions + go)
# Code Review: no issues

Original prompt

Create a complete GitHub repository named cloud-native-lab.

The repository will be a long-term, hands-on learning and portfolio workspace focused on cloud-native engineering, Linux Foundation training, CNCF technologies, Kubernetes certifications, automation, observability, security, containers, networking, GitOps, and Go development.

The repository must be structured so that it can initially support CKAD preparation and later expand to CKA, CKS, Kubernetes Operators, Custom Resources, Go tooling, Linux administration, observability, container security, and other CNCF technologies.

Use English for all files, documentation, examples, comments, scripts, and directory names.

Repository purpose

The repository should demonstrate practical cloud-native knowledge through:

• executable exercises;
• Kubernetes manifests;
• Bash scripts;
• Go examples;
• troubleshooting scenarios;
• certification-oriented labs;
• validation commands;
• cleanup procedures;
• reusable documentation;
• diagrams;
• Helm charts;
• Kustomize examples;
• GitHub Actions workflows;
• security and observability practices.

The repository should be suitable both for personal study and as a public technical portfolio.

General standards

Use the following conventions throughout the repository:

• lowercase kebab-case for directories and files;
• clear and professional English;
• Markdown documentation for every major area;
• small, focused, reproducible exercises;
• declarative Kubernetes YAML where appropriate;
• shell scripts using Bash;
• Go modules for Go examples;
• no real credentials or secrets;
• no generated binaries or compiled artefacts committed;
• no unnecessary dependencies;
• no placeholder files without explanations;
• avoid overengineering;
• prioritise practical examples;
• follow KISS, Clean Code and cloud-native principles;
• use secure defaults;
• make exercises easy to run locally;
• ensure scripts fail safely;
• make validation and cleanup steps explicit.

Use set -euo pipefail in Bash scripts where appropriate.

All Kubernetes examples should use current stable API versions and should avoid deprecated APIs.

Required root structure

Create the following initial structure:

cloud-native-lab/
├── .github/
│   ├── ISSUE_TEMPLATE/
│   │   ├── bug-report.md
│   │   └── lab-proposal.md
│   ├── workflows/
│   │   ├── markdown-lint.yml
│   │   ├── shellcheck.yml
│   │   ├── yaml-lint.yml
│   │   ├── kubernetes-validation.yml
│   │   └── go-ci.yml
│   ├── CONTRIBUTING.md
│   └── pull_request_template.md
├── certifications/
│   ├── README.md
│   ├── ckad/
│   │   ├── README.md
│   │   ├── application-design-and-build/
│   │   ├── application-deployment/
│   │   ├── application-observability-and-maintenance/
│   │   ├── application-environment-configuration-and-security/
│   │   ├── services-and-networking/
│   │   ├── mock-exams/
│   │   ├── timed-exercises/
│   │   └── exam-strategy/
│   ├── cka/
│   │   └── README.md
│   └── cks/
│       └── README.md
├── kubernetes-labs/
│   ├── README.md
│   ├── core-concepts/
│   ├── workloads/
│   │   ├── pods/
│   │   ├── replica-sets/
│   │   ├── deployments/
│   │   ├── daemon-sets/
│   │   ├── stateful-sets/
│   │   ├── jobs/
│   │   └── cron-jobs/
│   ├── configuration/
│   │   ├── config-maps/
│   │   ├── secrets/
│   │   ├── environment-variables/
│   │   ├── resource-requirements/
│   │   └── service-accounts/
│   ├── networking/
│   │   ├── services/
│   │   ├── ingress/
│   │   ├── dns/
│   │   ├── network-policies/
│   │   └── gateway-api/
│   ├── storage/
│   │   ├── volumes/
│   │   ├── persistent-volumes/
│   │   ├── persistent-volume-claims/
│   │   └── storage-classes/
│   ├── security/
│   │   ├── rbac/
│   │   ├── security-contexts/
│   │   ├── pod-security/
│   │   ├── admission-control/
│   │   └── secrets-management/
│   ├── observability/
│   │   ├── probes/
│   │   ├── logging/
│   │   ├── metrics/
│   │   └── debugging/
│   ├── scheduling/
│   │   ├── labels-and-selectors/
│   │   ├── node-selectors/
│   │   ├── affinity/
│   │   ├── taints-and-tolerations/
│   │   └── topology-spread/
│   ├── troubleshooting/
│   ├── custom-resources/
│   │   ├── crds/
│   │   └── examples/
│   ├── controllers/
│   ├── operators/
│   ├── helm/
│   │   ├── charts/
│   │   └── exercises/
│   ├── kustomize/
│   │   ├── bases/
│   │   ├── overlays/
│   │   └── exercises/
│   └── clusters/
│       ├── kind/
│       ├── minikube/
│       └── k3d/
├── linux-labs/
│   ├── README.md
│   ├── shell/
│   ├── files-and-permissions/
│   ├── processes/
│   ├── systemd/
│   ├── networking/
│   ├── storage/
│   ├── users-and-groups/
│   ├── package-management/
│   ├── security/
│   └── troubleshooting/
├── container-labs/
│   ├── README.md
│   ├── docker/
│   ├── containerd/
│   ├── images/
│   ├── registries/
│   ├── namespaces-and-cgroups/
│   ├── buildkit/
│   ├── multi-stage-builds/
│   └── container-security/
├── go-labs/
│   ├── README.md
│   ├── fundamentals/
│  ...

</details>