Labs
Do the thing. Every lab has success criteria you verify yourself, and a challenge that removes the instructions.
Three tiers: guided, then the same goal without the steps, then an incident where nothing is explained.
Your Cloud DevOps platform
Build the production platform, from an empty laptop to a running system
Where this lands
Build it yourself
Build It Yourself — Cloud DevOps Capstone
Eight guided modules that build the same platform from an empty workspace. You write every line; the finished repository is the answer key, not the starting point.
Start the guided buildThe reference
Cloud DevOps Capstone
The platform you have been building, assembled and working: three microservices taken from source to a monitored, GitOps-managed deployment on AWS EKS. Terraform provisions the AWS infrastructure, Ansible configures the build host, Jenkins builds and scans, Argo CD reconciles, Prometheus watches.
Read the finished platformLab library
Every guided lab, filterable by level and technology. Use this when you need one specific thing. Each has a challenge that removes the instructions; the path above adds the incidents and the capstone on top of these.
- terraformAWS VPC, Subnets, Gateways & Route TablesRebuild the network you made by hand as Terraform modules, and see the plan account for every subnet and route.47mIntermediateChallenge
- terraformIAM Roles, IRSA Policies & Security GroupsGive the cluster, the nodes and the build server exactly the permissions each needs and nothing more.23mIntermediateChallenge
- terraformAmazon ECR Container Registry & S3 Storage BucketsStand up the registry your images live in and the buckets your application writes to, both private by default.23mIntermediateChallenge
- terraformAmazon RDS PostgreSQL & AWS Secrets Manager IntegrationRun a Multi-AZ database that survives losing an availability zone, with a password no human ever types.31mIntermediateChallenge
- terraformAmazon EKS Cluster & Managed Node Group ProvisioningProvision the cluster everything else runs on, with worker nodes in private subnets and no public endpoint.31mIntermediateChallenge
- terraformTerraform FundamentalsProvider, resource, variable, output, state — the five pieces, on infrastructure small enough to read in one screen.45mBeginnerChallenge
- terraformJenkins EC2 Instance, S3 Backend & AWS Backup VaultMove Terraform state off your laptop into locked remote storage, and put the build server under a backup plan.23mIntermediateChallenge
- terraformTerraform ModulesTurn a working configuration into a network module and a compute module, called twice with different inputs.50mIntermediateChallenge
- ansibleAnsible Architecture, Configuration & Automated InventoryHave Ansible discover your EC2 instances by tag instead of maintaining a host list nobody remembers to update.39mIntermediateChallenge
- terraformTerraform Remote State & LockingMove state off your laptop into an encrypted, versioned, locked backend — and prove the lock works by breaking it deliberately.45mIntermediateChallenge
- ansibleAutomated Jenkins Server & Toolchain ProvisioningStructure 8 modular Ansible roles under roles/.31mIntermediateChallenge
- dockerProduction-Grade Multi-Stage Dockerfile for Django & GunicornTurn a Django application into an image that starts fast, runs as a non-root user, and carries no build tooling.31mBeginnerChallenge
- awsAWS IAM & Least PrivilegeWrite a policy that grants exactly one action, prove what it blocks, and swap a long-lived key for a role.50mBeginnerChallenge
- dockerNginx Reverse Proxy & Multi-Container Docker Compose StackPut the whole stack behind one entry point, with Nginx serving static files and Gunicorn handling the rest.39mBeginnerChallenge
- awsAWS VPC Networking by HandBuild the network by hand so the Terraform version stops being magic — and find out what actually makes a subnet public.55mBeginnerChallenge
- kubernetesCore Kubernetes Workloads, ConfigMaps & SecretsGet the application running on Kubernetes with its configuration and secrets outside the image.31mIntermediateChallenge
- awsEC2 Operations: SSM, CloudWatch Logs & MetricsOperate an instance without SSH: run commands, ship logs, and alarm on something that matters.50mIntermediateChallenge
- dockerDocker Networking, Volumes & Health ChecksMake four containers find each other, keep data across a restart, and start in an order that actually works.50mBeginnerChallenge
- kubernetesApplication Routing with K8s Ingress & AWS Load Balancer ControllerLet a Kubernetes manifest provision a real AWS load balancer, and make the application reachable from the internet.23mIntermediateChallenge
- awsRDS PostgreSQL: Backups, Restore and FailoverTake a snapshot, destroy data on purpose, and restore it — then measure how long that actually took.55mIntermediateChallenge
- kubernetesKubernetes Security Hardening (NetworkPolicies) & HPADeny traffic between Pods by default, then allow only what the application needs — and scale it under load.47mIntermediateChallenge
- awsProduction DNS & TLS with Route 53 and ACMTake a site from an IP address to a real domain over HTTPS, with a certificate that renews itself.50mIntermediateChallenge
- helmCreating a Custom Helm Chart for Django MicroservicesTurn a directory of manifests into a versioned chart you can install into any environment with different values.47mIntermediateChallenge
- terraformTerraform Validation, Linting & CIBuild the gate that runs before every apply: format, validate, lint, scan, and a plan a human approves.50mIntermediateChallenge
- helmManaging EKS Cluster Add-ons with Helm & IRSAInstall the controllers a cluster needs to be useful, each with its own AWS identity instead of node credentials.39mIntermediateChallenge
- jenkinsEnterprise Multibranch CI/CD Pipeline with SonarQube & TrivyMake a commit build, get scanned for code and image vulnerabilities, and deploy itself — with gates that block.31mAdvancedChallenge
- prometheusDeploying Kube-Prometheus-Stack on AWS EKSGet metrics out of the cluster and into Grafana, so 'is it healthy' has an answer that is not a guess.31mAdvancedChallenge
- ansibleAnsible Roles, Variables & IdempotencyWrite a role that configures a server, then prove the second run changes nothing.50mIntermediateChallenge
- gitopsGitOps Delivery with Argo CD: Sync, Drift & Self-HealDeploy by changing Git, then break the cluster by hand and watch Argo CD put it back.45mIntermediateChallenge
- prometheusCustom Prometheus Alert Rules & Grafana DashboardsWrite alerts that fire on conditions worth waking someone for, and a dashboard that shows why they fired.23mAdvancedChallenge
- kubernetesKubernetes Workloads: Pod, ReplicaSet, DeploymentWatch a Deployment create a ReplicaSet create Pods, then delete each in turn and see which come back.45mBeginnerChallenge
- linuxLinux Server AdministrationCreate users and groups, set permissions that actually hold, and manage services and packages on a server you did not build.45mBeginnerChallenge
- kubernetesKubernetes Services & Service DiscoveryGive disposable Pods a stable address, then break the selector and watch the endpoints empty.45mBeginnerChallenge
- networkingLinux Networking & TroubleshootingWork a connection failure from the outside in: DNS, route, port, firewall, application — and know which layer you are on.50mBeginnerChallenge
- kubernetesKubernetes Storage: PVC, PV and StorageClassProve a container's filesystem is disposable, then attach storage that survives, and meet the access mode that blocks a rollout.50mIntermediateChallenge
- linuxBash Automation: A Script You Can TrustWrite a backup script that fails loudly instead of silently, and schedule it so a missed run does not go unnoticed.40mBeginnerChallenge
- gitGit Branching & CollaborationWork a change through a branch, a rebase and a conflict, and recover from the three mistakes everyone makes.45mBeginnerChallenge
- linuxLinux Processes, Services & LogsFind the process, read what it actually said, and restore a service that will not start.45mBeginnerChallenge
- awsStatic Site on S3 + CloudFrontServe a site from a private bucket through a CDN with HTTPS, correct cache headers, and a cleanup you actually run.55mBeginnerChallenge
- linuxLinux Security & SSH HardeningLock down SSH without locking yourself out, and know how to recover when you inevitably do.45mBeginnerChallenge
- networkingHTTP & TLS TroubleshootingTake a failing HTTPS request apart layer by layer: DNS, TCP, TLS, HTTP — and know which one broke.50mIntermediateChallenge
- networkingReverse Proxy & Load Balancing with NginxPut a proxy in front of two backends, then break one and watch what the health check does about it.50mIntermediateChallenge
- gitGit Recovery & History SurgeryDestroy work four different ways and get it back, then remove a secret from history and understand why that is not the fix.45mIntermediateChallenge
- gitProfessional Collaboration on GitHubProtect a branch, require review, and make the pipeline the thing that decides whether code can merge.45mIntermediateChallenge
- kubernetesKubernetes RBAC & Service AccountsGrant a namespace read-only access, give a workload its own identity, and verify with the cluster rather than by hoping.50mIntermediateChallenge
- kubernetesFrom Ingress to Gateway APIExpress the same routing twice — as an Ingress and as a Gateway — and see what the newer model actually fixes.50mIntermediateChallenge
- helmHelm Upgrades, Rollbacks & Release StrategyShip a release, break the next one on purpose, and get back to a working state in seconds.45mIntermediateChallenge
- jenkinsJenkins Fundamentals & Role-Based AccessRun Jenkins in a container, build a job from a webhook, and stop every authenticated user being an administrator.50mBeginnerChallenge
- jenkinsJenkins Pipeline: Build, Scan and Push an ImageTake a commit to a scanned, tagged image in a registry, with a gate that blocks rather than reports.55mIntermediateChallenge
- sreBackup & Disaster Recovery DrillLose the database on purpose, restore it, and write down the RTO and RPO you actually achieved.55mAdvancedChallenge
- sreChaos: Failure Injection & RecoveryKill things deliberately, measure how long recovery takes, and find the assumption that was wrong.50mAdvancedChallenge
- github-actionsGitHub Actions: Build, Scan and Deploy to EKSThe same pipeline as the Jenkins lab, with no server to maintain and no stored AWS credentials.55mIntermediateChallenge
- loggingCentralised Logging with Loki and GrafanaShip every Pod's logs somewhere they survive the Pod, then answer a real question with them.50mIntermediateChallenge
- terraformTerraform Drift & State RecoverySomeone changed AWS by hand and someone else deleted the state. Recover from both without rebuilding anything.55mAdvancedChallenge
- kubernetesNode Drain, Upgrade & RecoveryTake a node out of service without taking the application with it, and find out which workloads were never ready for it.55mAdvancedChallenge