Infrastructure as Code, Terraform, Docker and Kubernetes — explained in depth, built from first principles. Runnable labs, 3 a.m. production scenarios, SRE incident playbooks, and a full interview question bank.
From "what is declarative infrastructure?" to draining a node during an incident without dropping a request. Every chapter has an analogy, the tools you already use, runnable code, and a checkpoint quiz.
Part 1 — Fundamentals: the topics below as 8
chapters × 5 levels, analogy to expert view, with lab links
and checkpoint quizzes.
Part 2 — Terraform & IaC at Scale: 16
chapters × 5 levels on modules, remote state & locking,
drift management, policy as code, multi-cloud, testing IaC, secrets,
CI/CD for infra, and cost governance.
Part 3 — Kubernetes Platform Engineering: 16
chapters × 5 levels on CRDs & operators, Helm at scale,
GitOps, service mesh, multi-tenancy, admission control, autoscaling,
storage, and Kubernetes security.
Part 4 — Cloud Networking, Identity & Security:
16 chapters × 5 levels on VPC design, load
balancing, DNS, IAM, zero-trust, Vault, mTLS, compliance, and secure
landing zones.
Part 5 — Observability & Incident Engineering:
16 chapters × 5 levels on Prometheus, Grafana,
OpenTelemetry, SLOs, alerting, chaos engineering, on-call, and
postmortems — each ending in an interview drill.
Why we stopped SSH-ing into servers. Desired state vs imperative steps, what a state file is and why it is dangerous, drift, plan & apply, and the push/pull models.
The plan/apply lifecycle, the state file up close, remote
backends with locking, modules as functions, for_each,
and the migrations that keep teams up at night.
What a container actually is (it is a process), image layers and the build cache, multi-stage builds, distroless, networking, volumes, and Compose for the whole dependency graph.
The control loop that runs the internet. Control plane vs nodes,
the reconciliation pattern, how a kubectl apply
becomes a running Pod, and where it breaks.
Pods, ReplicaSets, Deployments and rollouts; StatefulSets and stable storage; Jobs and CronJobs; Services, endpoints, and Ingress routing. Nine runnable manifests.
Config outside the image, why a Secret is not encryption, PV/PVC/CSI and the storage lifecycle, least-privilege RBAC, default-deny networking, and Pod security.
Requests vs limits and the OOMKill, QoS classes, the three probes and how they cause outages, HPA/VPA/KEDA, affinity and spread, PodDisruptionBudgets, and graceful shutdown.
SLI/SLO/error budgets, the four golden signals, how an SRE runs an incident, rollout strategies, capacity and toil, and blameless postmortems — with worked examples.
Every example is checked in CI: terraform validate,
hadolint, a real docker build,
and kubeconform — plus a zero-dependency
Python structural check that is the source of the green badge.
Hello-state, variables + validation + locals, a local module
called with for_each, and a remote
backend with locking. Provider-light — no cloud account needed.
A Go app compiled in a fat image and shipped on distroless; a hardened single-stage Python image with the full checklist; a Compose stack with health-gated dependencies.
Pod, Deployment + Service, ConfigMap/Secret, Ingress, StatefulSet, HPA, RBAC, NetworkPolicy, PodDisruptionBudget + the full probe set, and a blue/green cutover.
The part interviews and on-call actually test: what you do when it is broken. Symptom → diagnosis → fix → prevention, written the way a runbook should be.
CrashLoopBackOff, ImagePullBackOff, OOMKilled, Pending forever, DNS flakiness, a rollout that 502s, node NotReady, PVC stuck Terminating, throttling that looks like a slow app.
Open scenariosHow an SRE tackles a live incident: triage, comms, mitigation before root cause, error-budget decisions, and the blameless postmortem that follows.
Open playbooksGrouped Q&A: architecture, scheduling, networking, storage, security, autoscaling, and troubleshooting — with the follow-up the interviewer will ask next.
Open Q&ASLIs/SLOs, error budgets, the golden signals, capacity planning, incident command, and the classic "design me a paging strategy" question.
Open Q&AClone, run the validator, then pick a lab. Real tools optional.
git clone https://github.com/satyabhan007/DevOps-Infra.git
cd DevOps-Infrapython lab/validate.pycd terraform/examples/01-hello && terraform init && terraform plan
# or
docker build -t demo docker/examples/multistage
# or
kubectl apply --dry-run=client -f kubernetes/manifests/Every topic gets a beginner guide (analogy + daily-life), a deep dive or scenario file (production war stories + examples), and runnable code.
| Guide | Topic | What you get |
|---|---|---|
| iac/BEGINNER_GUIDE.md | IaC 101 | Cattle-not-pets analogy, declarative vs imperative, drift, the state-file danger |
| iac/DEEP_DIVE.md | IaC internals | Reconciliation, plan/apply, push vs pull, immutable infra, policy-as-code |
| terraform/BEGINNER_GUIDE.md | Terraform | Providers, the state file up close, modules, workspaces, the core loop |
| terraform/SCENARIOS.md | Terraform in prod | State lock stuck, drift, import, moved, secret leaks, blast radius |
| docker/BEGINNER_GUIDE.md | Containers | A container is a process; layers, cache, multi-stage, volumes, networking |
| docker/SCENARIOS.md | Docker in prod | Huge images, cache misses, zombie PID 1, prod-parity, the OOMKill |
| kubernetes/BEGINNER_GUIDE.md | Kubernetes 101 | The control loop, objects, kubectl apply end to end |
| kubernetes/DEEP_DIVE.md | K8s internals | Scheduler, kubelet, CNI/CSI, RBAC, admission, the networking model |
| kubernetes/INTERVIEW.md | K8s interview | Grouped Q&A with the follow-up questions, by topic area |
| kubernetes/PROD_SCENARIOS.md | K8s on-call | 12 symptom→fix→prevention runbooks for the common failures |
| kubernetes/APPLICATIONS.md | K8s applications | Deploying stateless, stateful, autoscaled, and blue/green workloads |
| sre/BEGINNER_GUIDE.md | SRE 101 | SLI/SLO/error budget, golden signals, toil, on-call from scratch |
| sre/PROD_CHALLENGES.md | SRE incidents | How an SRE tackles & resolves prod challenges — worked incidents |
| sre/INTERVIEW_QA.md | SRE interview | Q&A + system-design prompts with model answers |
Five course parts in this repo — Part 1 from first principles, Parts 2–5 operating the standard tools at production depth.
IaC → Terraform → Docker → Kubernetes architecture & workloads → config/storage/security → scaling & self-healing → SRE production ops.
Open Part 1Modules, remote state & locking, drift, policy as code (OPA/Sentinel), multi-cloud, testing IaC, secrets, CI/CD for infra, state surgery, cost governance.
Open Part 2CRDs & operators, Helm at scale, GitOps (Argo CD/Flux), service mesh, multi-tenancy, admission control, autoscaling, storage, Kubernetes security, cost optimization.
Open Part 3VPC design, load balancing, DNS, peering & transit gateways, IAM, zero-trust, Vault/KMS, mTLS, network security, CIS compliance, secure landing zones.
Open Part 4Prometheus, Grafana, OpenTelemetry tracing, log aggregation, SLOs & error budgets, burn-rate alerting, on-call, chaos engineering, postmortems.
Open Part 5AI/ML engineering from scratch through production system design, deployment, observability, and enterprise-scale AI. 202 chapters.
Open AI-ML ↗