Containers & Orchestration
Platform Engineering & ArgoCD
Internal Developer Platforms (IDPs), GitOps delivery, and automated admission policies.
Platform Engineering treats infrastructure as a product, providing software teams with golden paths and self-service portals. By combining GitOps delivery engines like ArgoCD with policy enforcement (Kyverno, OPA Gatekeeper), platform teams enable secure, frictionless software shipping.
Virtual Lab Ready
Automated testing sandbox running in your browser.
Launch First Lab ⚡No local installation required
Hands-on Practice
Interactive Terminal Labs
Real environment tasks with automated validation. Write real commands, verify state, and debug errors.
Scaffold a Service Template
Topic: Golden Path Templates
A golden path starts as a template repository: everything a new service needs, pre-wired. Scaffold one — structure, Dockerfile, CI workflow — exactly like a platform team would ship it.
Key Checks:
- Directory ~/templates/service-template exists
- It contains src/, tests/, Dockerfile and .github/workflows/ci.yml
Register a Service in the Catalog
Topic: Service Catalog
Backstage-style catalogs read a catalog-info.yaml from each repository. Write one for the service you templated — ownership, domain and component type.
Key Checks:
- File ~/templates/service-template/catalog-info.yaml exists
- It declares a Component owned by a team
Declare a GitOps Application
Topic: GitOps with ArgoCD
GitOps means the cluster syncs itself from Git. Write the ArgoCD Application manifest that tells the controller to watch a repo and apply everything in it.
Key Checks:
- File ~/gitops/app.yaml exists
- It declares an argoproj.io Application watching a Git repo
Write an Admission Policy
Topic: Policy & Guardrails
Platform teams enforce policy at admission time — the cluster simply rejects workloads that break the rules. Write a Kyverno-style policy banning privileged containers.
Key Checks:
- File ~/policies/no-privileged.yaml exists
- It validates that privileged: false is required
System Design
GitOps Declarative Reconciliation Loop
Understand how this tool operates internally before running production workloads.
Internal Mechanics
ArgoCD continuously monitors a Git repository holding Kubernetes manifests or Helm charts. When changes merge to main, ArgoCD reconciles the cluster to match the Git commit, detecting and correcting manual drift.
Mental Model Rule of Thumb
Never treat Platform Engineering & ArgoCD as a black box. Understanding its boundary with the kernel, filesystem, and network stack prevents 90% of production outages.
Core Architectural Subsystems
Git Source of Truth
Repository storing all desired Kubernetes manifests, Helm values, and Kustomize overlays.
ArgoCD Application Controller
Compares live cluster resources against desired state in Git.
Admission Controller (Kyverno/OPA)
Intercepts API requests to reject non-compliant manifests before scheduling.
Developer Service Catalog
Self-service scaffolding interface (e.g. Backstage) generating boilerplate repos.
Developer Reference
Command Reference & Cheatsheet
Curated commands, flags, and one-liners tested for everyday operational productivity.
argocd app listList all deployed platform applications and their health/sync statuses
argocd app sync <app-name>Trigger manual reconciliation between Git repository and cluster state
argocd app diff <app-name>Display live diff between Git manifests and running cluster resources
kubectl get cpol -AList all cluster-wide Kyverno security and compliance policies
Fundamental Primitives
Key Terminology & Primitives
Core abstractions you must master to communicate and build with confidence.
GitOps Principle
Declarative infrastructure versioned in Git; software agents automatically ensure live state equals target state.
Golden Path
An opinionated, well-supported template providing developers the path of least resistance to production.
Admission Webhook
Kubernetes mutating and validating webhooks that inspect incoming JSON objects.
Self-Healing & Out-of-Sync
When a developer modifies a resource via kubectl, ArgoCD immediately overwrites it with the Git version.
Production War-Stories
Common Pitfalls & Debugging Playbook
The exact errors that take down production systems and how to diagnose and resolve them.
Sync loops / infinite sync fighting
Symptom
ArgoCD repeatedly marks app OutOfSync due to dynamic fields (e.g. status or default mutations).
Resolution
Configure ignoreDifferences in the Application manifest to omit managed fields like replicas or default mutation annotations.
Reliability Standards
Production Readiness Checklist
Review this checklist before deploying workloads to staging or production clusters.
- ✓Store production manifests in a repository separate from application source code.
- ✓Enforce mandatory policies rejecting containers running as root or without resource limits.
- ✓Enable automated rollback on failed health checks.
- ✓Provide developers with clear error messages in self-service scaffolding templates.
Full Curriculum Track
Master Platform Engineering & ArgoCD as part of the DevOps Engineer path
Tools do not exist in isolation. Learn how Platform Engineering & ArgoCD connects with other systems, CI/CD pipelines, and infrastructure patterns.