Kubernetes Training in Pune with Placement

Kubernetes explained as a set of cooperating control loops rather than a list of commands, because almost every troubleshooting question later resolves to knowing which component owns a behaviour. API server, etcd, scheduler and controller manager on the control plane; kubelet, kube-proxy and containerd on each node.

The declarative model — desired state, reconciliation, and why `kubectl apply` is not `kubectl run` — is established this week. Every student ends with a local cluster on kind or Minikube, a working kubeconfig with multiple contexts, and a first Deployment, Service and Ingress serving traffic.

The Pod as the unit of scheduling, and everything that happens inside one. Single and multi-container Pods, init containers for ordered setup, sidecar containers (now a stable, first-class feature) and ephemeral containers for debugging a running Pod without restarting it.

Probes get an extended treatment because misconfigured probes cause more self-inflicted outages than almost anything else: readiness versus liveness versus startup, timing parameters, and the failure modes each one produces when set wrongly. Resource requests, limits and QoS classes close the module.

The workload controllers and what each one guarantees. Deployments and ReplicaSets with rolling-update parameters, revision history, rollback, and pause and resume for staged releases; the ownership chain that explains why deleting a ReplicaSet does not do what people expect.

StatefulSets cover stable network identity, ordered deployment and scaling, and per-replica storage. DaemonSets handle node-level agents, and Jobs and CronJobs cover batch work including parallelism, completions, backoff limits and the concurrency policy.

How traffic finds a Pod. The four Service types and what each actually creates, EndpointSlices and how they track healthy backends, and the kube-proxy modes (iptables and IPVS) that implement the routing underneath.

CoreDNS and the cluster DNS naming scheme come next, including headless Services for direct Pod addressing and the resolution behaviour StatefulSets depend on. The module is deliberately heavy on debugging: `kubectl describe`, endpoint inspection, DNS lookups from inside a Pod, and port-forward.

External access done properly. The Ingress resource and the NGINX Ingress Controller — path and host routing, annotations, rewrite rules, and TLS termination with cert-manager issuing certificates from Let's Encrypt automatically.

Gateway API is taught as the successor rather than an alternative: Gateway, HTTPRoute, GRPCRoute, the role separation between infrastructure and application teams that motivated it, and a migration path from Ingress. Header-based routing and traffic splitting close the module.

Separating configuration from images. ConfigMaps as environment variables, arguments and mounted files; immutable ConfigMaps and Secrets for performance and safety; and the reload problem — what actually happens to a running Pod when a mounted ConfigMap changes.

Secrets are covered honestly: base64 is encoding, not encryption, so the module moves to encryption at rest, then to the External Secrets Operator backed by AWS Secrets Manager, Azure Key Vault or Vault, and Sealed Secrets for storing encrypted secrets safely in a GitOps repository.

Running stateful software on Kubernetes, and the judgement of when not to. PersistentVolumes and claims, access modes, storage classes and dynamic provisioning, reclaim policies, and the CSI driver model with cloud implementations — EBS, Azure Disk, Persistent Disk — plus Longhorn for on-premises.

Volume snapshots, restore and expansion follow. The module ends with real StatefulSet patterns for PostgreSQL, Redis and Kafka, and a frank discussion of when a managed database is the better engineering decision.

Packaging and templating manifests. Helm 3 charts end to end — structure, values files and precedence, the template language and its common traps, named templates, hooks, chart dependencies, and release lifecycle including upgrade, rollback and history. OCI registries as the modern chart distribution path.

Kustomize follows with bases, overlays, patches and generators — a genuinely different philosophy, not a competitor with the same shape. The module ends with a clear-eyed comparison and guidance on choosing per team rather than per preference.

How Kubernetes extends itself, which is what separates an operator of clusters from an engineer who can shape one. Custom Resource Definitions, schema validation with OpenAPI, versioning and conversion, and how a CRD plus a controller reproduces the same reconciliation model the built-in resources use.

The operator pattern is then read in practice — examining a real operator's reconcile loop, its status conditions and finalisers — with an overview of the Operator SDK and Kubebuilder for teams that need to write their own.

The authorisation and admission layer. Roles and ClusterRoles, RoleBindings and ClusterRoleBindings, the aggregation model, and auditing what a given principal can actually do with `kubectl auth can-i`. Service accounts, projected and bound tokens, and cloud workload identity for keyless access to external resources.

Admission control closes the module: the mutating and validating webhook flow, and ValidatingAdmissionPolicy with CEL expressions — the in-tree, webhook-free path that is now the default recommendation for straightforward policy.

Hardening the cluster's runtime. Network Policies for ingress and egress control, the default-allow behaviour that surprises people, and building a default-deny baseline that does not break DNS. Calico versus Cilium as CNI choices, and eBPF-based networking and observability with Cilium and Hubble.

Pod Security Standards and Pod Security Admission replace the removed PodSecurityPolicy, and the module ends on image security — Trivy scanning, Cosign signatures and admission-time verification.

Seeing inside a running cluster. Prometheus architecture and the pull model, exporters, and the Prometheus Operator's ServiceMonitor and PodMonitor resources. PromQL taught as a language — selectors, rate versus increase, histograms and quantiles, recording rules and query cost.

Alertmanager covers routing, grouping, inhibition and silences; Grafana dashboards are built to the USE, RED and Four Golden Signals methods. Loki with LogQL, Tempo for traces and OpenTelemetry instrumentation complete the stack, ending in an on-call simulation against a deliberately broken cluster.

Deciding where Pods run and how a cluster grows. The scheduler's filter and score phases, node selectors and affinity, pod affinity and anti-affinity for spreading replicas, taints and tolerations, topology spread constraints, and pod priority with preemption.

Autoscaling covers all three axes — Horizontal Pod Autoscaler including custom metrics, Vertical Pod Autoscaler, and node-level scaling with Cluster Autoscaler and Karpenter. Cluster operations closes the module: Pod Disruption Budgets, draining, upgrade strategy and etcd backup and restore.

The delivery model most Kubernetes-first teams have settled on. Argo CD architecture, Application CRDs, sync policies with self-healing and pruning, sync waves and health assessment, and ApplicationSets for generating applications across clusters and environments. Repository structure and promotion from dev to staging to production are built as code rather than as a runbook.

Service mesh is covered comparatively — Istio versus Linkerd, the sidecar and ambient models, mTLS, traffic shifting and observability — with honest guidance on when a mesh is not yet worth its operational cost.

Full-time capstone work plus structured Certified Kubernetes Administrator preparation. The capstone is a complete platform — Helm-packaged workloads, Argo CD delivery, the full observability stack, network policy and RBAC baselines, and documented runbooks.

CKA preparation is hands-on rather than multiple choice, because the exam is: timed troubleshooting drills, `kubectl` shortcuts and aliases that buy back minutes, and two full-length mock exams. Interview preparation covers a cluster-troubleshooting round and an architecture round, plus resume, LinkedIn and portfolio polish.