Roadmap

Cloud-Native Engineering: Kubernetes & Istio

From containers to production-grade service mesh, master Kubernetes and Istio the way FAANG SREs run them.

18stages133topics~83hours

Curated from the best, MDN · Kubernetes · AWS · OWASP · Google SRE & more

Kubernetes expertise commands $180K–$280K+ at FAANG and cloud-native companies. Istio/service-mesh knowledge is rarer still, engineers who can operate service meshes at scale are in high demand across Netflix, Uber, Airbnb, and every company running microservices.

The complete path, 10 of 133 topics have lessons here; the other 123 are marked learn anywhere. We won't pretend we cover everything.

Ready to build? See capstone projects

Stage 1 / 18 · 8 topics · 1 lessons

Container & Linux Foundations

Kubernetes orchestrates containers; you cannot operate it without deep container and Linux kernel literacy.

Linux NamespacesStart herePID, net, mount, UTS, IPC, user namespaces that isolate processes.

Control Groups (cgroups v1/v2)Kernel mechanism limiting CPU, memory, and IO per process group. Linux man pages

Union Filesystems & LayersOverlayFS and copy-on-write image layering. Docker docs

Container Runtimesrunc, containerd, CRI-O and the OCI runtime spec. Kubernetes docs

OCI Image Spec & RegistriesImage manifests, content addressing, and registry distribution. OCI

Docker & DockerfilesBuilding, tagging, and running images; multi-stage builds. Docker docs

Image Optimization & DistrolessrecMinimal base images, layer caching, and slimming. Docker docs

Linux Networking Primitivesveth pairs, bridges, iptables, routing tables, netfilter. Linux man pages

Stage 2 / 18 · 9 topics · 0 lessons

Kubernetes Architecture

Understand every control-plane and node component before deploying anything.

Control Plane OverviewHow API server, scheduler, controller-manager, and etcd cooperate. Kubernetes docs

kube-apiserverREST front door, auth, admission, and the only writer to etcd. Kubernetes docs

etcdDistributed key-value store holding all cluster state; Raft consensus. etcd docs

kube-schedulerBind pods to nodes via filtering and scoring plugins. Kubernetes docs

kube-controller-managerReconciliation loops driving actual state toward desired state. Kubernetes docs

kubeletNode agent that runs pods and reports status to the API server. Kubernetes docs

kube-proxyService VIP routing via iptables/IPVS/eBPF dataplanes. Kubernetes docs

CRI, CNI, CSI InterfacesPluggable runtime, network, and storage contracts. Kubernetes docs

Declarative Reconciliation ModelLevel-triggered control loops and desired vs observed state. Kubernetes docs

Stage 3 / 18 · 9 topics · 0 lessons

Core Workload Objects

The primitives you deploy applications with every day.

PodsSmallest deployable unit; shared network and storage namespace. Kubernetes docs

ReplicaSetsMaintain a stable set of pod replicas. Kubernetes docs

DeploymentsDeclarative rollouts, rollbacks, and revision history. Kubernetes docs

StatefulSetsStable identities and ordered deployment for stateful apps. Kubernetes docs

DaemonSetsRun one pod per node for agents and log shippers. Kubernetes docs

Jobs & CronJobsRun-to-completion and scheduled batch workloads. Kubernetes docs

Init & Sidecar ContainersOrdered setup containers and native sidecar lifecycle. Kubernetes docs

Pod Lifecycle & ProbesPhases, liveness, readiness, and startup probes. Kubernetes docs

Labels, Selectors & AnnotationsMetadata that drives selection and tooling. Kubernetes docs

Stage 4 / 18 · 6 topics · 1 lessons

Configuration & Secrets

Decouple config from images and manage sensitive data safely.

ConfigMapsInject non-sensitive config as env vars or mounted files. Kubernetes docs

SecretsBase64 objects for credentials; understand they are not encrypted by default. Kubernetes docs

Encryption at Rest & KMSrecEncryptionConfiguration and external KMS providers for etcd. Kubernetes docs

External Secrets & VaultrecExternal Secrets Operator and HashiCorp Vault integration.

Downward APIrecExpose pod metadata into containers. Kubernetes docs

Environment & Config StrategyrecPer-environment overlays and immutable config patterns. Kubernetes docs

Stage 5 / 18 · 9 topics · 2 lessons

Kubernetes Networking

The flat pod network, services, and how traffic actually flows.

Kubernetes Network ModelEvery pod gets a routable IP; no NAT between pods. Kubernetes docs

CNI PluginsCalico, Cilium, Flannel and how they wire pod networking. Kubernetes docs

ServicesClusterIP, NodePort, LoadBalancer, and ExternalName types. Kubernetes docs

Endpoints & EndpointSlicesHow services track healthy backing pods. Kubernetes docs

CoreDNS & Service DiscoveryCluster DNS resolution and search domains. Lab

Ingress & ControllersL7 routing via nginx, Traefik, and ingress controllers.

Gateway APIrecSuccessor to Ingress with richer role-oriented routing. Gateway API docs

Network PoliciesDeclarative L3/L4 firewall rules between pods. Cloudflare Learning

eBPF Dataplane (Cilium)recKernel-level networking, policy, and observability. Cilium docs

Stage 6 / 18 · 6 topics · 0 lessons

Storage & State

Persisting data in an ephemeral, scheduler-driven world.

Volumes & Volume TypesemptyDir, hostPath, projected, and ephemeral volumes. Kubernetes docs

PersistentVolumes & ClaimsDecoupling storage provisioning from consumption. Kubernetes docs

StorageClasses & Dynamic ProvisioningOn-demand volume creation with provisioner parameters. Kubernetes docs

CSI DriversrecPluggable storage backends and snapshot/clone support. Kubernetes CSI docs

Access Modes & Reclaim PoliciesRWO/ROX/RWX semantics and retain vs delete. Kubernetes docs

Stateful Workload PatternsrecRunning databases and queues on Kubernetes safely. Kubernetes docs

Stage 7 / 18 · 8 topics · 0 lessons

Scheduling & Resource Management

Control where pods land and how cluster resources are shared.

Requests & LimitsCPU/memory reservations and throttling/OOM behavior. Kubernetes docs

QoS ClassesGuaranteed, Burstable, BestEffort and eviction order. Kubernetes docs

Affinity & Anti-AffinityNode and pod (anti-)affinity for placement control. Kubernetes docs

Taints & TolerationsRepel pods from nodes unless explicitly tolerated. Kubernetes docs

Topology Spread ConstraintsrecEven distribution across zones and nodes. Kubernetes docs

Priority & PreemptionrecPriorityClasses and evicting lower-priority pods. Kubernetes docs

ResourceQuotas & LimitRangesNamespace-level resource caps and defaults. Kubernetes docs

Scheduler Framework & PluginsoptionalExtension points and custom scheduling logic. Kubernetes docs

Stage 8 / 18 · 6 topics · 0 lessons

Autoscaling & Capacity

Scale workloads and infrastructure to match demand and cost.

Horizontal Pod AutoscalerScale replicas on CPU, memory, or custom metrics. Kubernetes docs

Vertical Pod AutoscalerrecRight-size requests/limits automatically. Kubernetes Autoscaler

Cluster AutoscalerAdd/remove nodes based on pending pods. Kubernetes Autoscaler

Karpenter / Node AutoprovisioningrecJust-in-time, bin-packed node provisioning. Karpenter docs

KEDA Event-Driven ScalingrecScale on queue depth, events, and external triggers. KEDA docs

Metrics Server & Custom Metrics APIResource and custom/external metrics pipelines for scaling. Kubernetes docs

Stage 9 / 18 · 10 topics · 3 lessons

Kubernetes Security

Lock down identity, access, workloads, and the supply chain.

AuthenticationCerts, OIDC, service account tokens, and webhook auth. Kubernetes docs

RBACRoles, ClusterRoles, and bindings for least privilege. Kubernetes docs

Service Accounts & Token ProjectionWorkload identity and bound, audience-scoped tokens. Kubernetes docs

Admission Controllers & WebhooksValidating/mutating admission and policy enforcement. Kubernetes docs

Pod Security StandardsPrivileged/Baseline/Restricted profiles replacing PSP.

OPA Gatekeeper & KyvernorecPolicy-as-code guardrails for cluster resources. Kyverno docs

Security Contexts & CapabilitiesrunAsNonRoot, seccomp, AppArmor, dropped capabilities. Kubernetes docs

Supply Chain SecurityrecImage signing (cosign), SBOMs, and admission verification.

Runtime SecurityoptionalFalco and threat detection for running workloads. Falco docs

CIS Benchmarks & Hardeningreckube-bench and cluster hardening baselines.

Stage 10 / 18 · 8 topics · 0 lessons

Packaging, Templating & GitOps

Manage manifests at scale and deploy declaratively from Git.

kubectl MasteryImperative and declarative ops, jsonpath, and debugging flags. Kubernetes docs

HelmCharts, values, releases, and templating logic. Helm docs

KustomizeTemplate-free overlays and patches. Kustomize docs

Argo CDPull-based GitOps continuous delivery and sync waves. Argo CD docs

Flux CDrecGitOps toolkit with image automation. Flux docs

CRDs & OperatorsExtend the API and encode operational knowledge in controllers. Kubernetes docs

Operator SDK & KubebuilderrecBuild custom controllers with controller-runtime. Operator SDK docs

Progressive DeliveryrecArgo Rollouts/Flagger for canary and blue-green. Martin Fowler

Stage 11 / 18 · 7 topics · 0 lessons

Observability

Metrics, logs, traces, and events to run clusters with confidence.

PrometheusPull-based metrics, PromQL, and the operator. Prometheus docs

Grafana & DashboardsVisualization and alerting on cluster signals. Grafana docs

Logging PipelinesFluent Bit, Loki, and structured log aggregation. Kubernetes docs

Distributed TracingrecOpenTelemetry, Jaeger, and trace context propagation. OpenTelemetry docs

OpenTelemetryrecUnified collection of metrics, logs, and traces. OpenTelemetry docs

Alerting, SLOs & Error BudgetsAlertmanager, burn-rate alerts, and SRE practice. Google SRE Workbook

Events & Cluster Debuggingkubectl events, describe, and ephemeral debug containers. Kubernetes docs

Stage 12 / 18 · 6 topics · 1 lessons

Service Mesh Fundamentals

Why meshes exist and the architecture they impose before touching Istio.

Why a Service MeshCross-cutting traffic, security, and observability concerns.

Sidecar Proxy PatternPer-pod proxies intercepting all service traffic. Istio docs

Data Plane vs Control PlaneProxies move traffic; control plane configures them. Istio docs

Envoy ProxyThe L7 proxy underpinning Istio; listeners, clusters, filters. Envoy docs

xDS ProtocolrecHow control planes push config (LDS/CDS/EDS/RDS) to Envoy. Envoy docs

Mesh Trade-offsLatency, resource cost, and operational complexity. Istio docs

Stage 13 / 18 · 7 topics · 0 lessons

Istio Architecture & Installation

Istio's components, install profiles, and injection model.

istiod Control PlaneUnified pilot, citadel, and galley responsibilities. Istio docs

Sidecar InjectionAutomatic and manual Envoy injection via webhooks. Istio docs

Ambient Mesh (Sidecarless)recztunnel and waypoint proxies; L4/L7 split. Istio docs

istioctl & IstioOperatorInstall, profiles, and config validation tooling. Istio docs

Installation Profilesdefault, demo, minimal, and production tuning. Istio docs

Istio GatewaysIngress/egress gateways at the mesh edge. Istio docs

Upgrades & RevisionsrecCanary control-plane upgrades via revision labels. Istio docs

Stage 14 / 18 · 8 topics · 1 lessons

Istio Traffic Management

Shape, route, and harden service-to-service traffic.

VirtualServiceRouting rules, matching, weighting, and rewrites. Istio docs

DestinationRuleSubsets, load balancing, and connection pools. Istio docs

ServiceEntry & SidecarExternal services and scoping proxy config. Istio docs

Canary & Traffic SplittingWeighted routing for progressive rollouts.

Timeouts, Retries & Circuit BreakingOutlier detection and failure isolation. Istio docs

Fault InjectionrecInject delays and aborts to test resilience. Istio docs

Traffic MirroringrecShadow live traffic to test versions safely. Istio docs

Locality Load BalancingrecZone-aware routing and failover. Istio docs

Stage 15 / 18 · 7 topics · 0 lessons

Istio Security

Identity, encryption, and authorization across the mesh.

Mutual TLSAutomatic mTLS, PERMISSIVE vs STRICT modes. Cloudflare Learning

SPIFFE Workload IdentityCryptographic identities issued per workload. SPIFFE docs

PeerAuthenticationEnforce mTLS policy at mesh/namespace/workload scope. Istio docs

RequestAuthentication (JWT)Validate end-user JWTs at the proxy. Istio docs

AuthorizationPolicyFine-grained allow/deny rules on identity and attributes. Istio docs

Certificate ManagementrecIstio CA, cert rotation, and integrating external CAs. Istio docs

Egress ControlrecRestrict and monitor outbound traffic from the mesh. Istio docs

Stage 16 / 18 · 5 topics · 0 lessons

Istio Observability

Golden signals, topology, and tracing the mesh gives you for free.

Mesh Metrics & Telemetry APIStandard Envoy metrics and the Telemetry resource. Istio docs

KialiMesh topology visualization and config validation. Kiali docs

Distributed Tracing in the MeshrecHeader propagation requirements and trace sampling. Istio docs

Envoy Access LogsrecPer-request logging and custom log formats. Istio docs

Wasm & EnvoyFilter ExtensionsoptionalCustom telemetry and dataplane logic. Istio docs

Stage 17 / 18 · 5 topics · 0 lessons

Advanced Mesh Topologies

Scale Istio across clusters, networks, and meshes.

Multi-Cluster MeshrecPrimary-remote and multi-primary deployment models. Istio docs

Multi-Network & East-West GatewaysrecCross-network connectivity and endpoint discovery. Istio docs

Mesh FederationoptionalConnecting independent meshes with shared trust. Istio docs

VM & Non-K8s WorkloadsoptionalOnboarding virtual machines into the mesh. Istio docs

Mesh Performance TuningrecSidecar resource limits, concurrency, and scoping. Istio docs

Stage 18 / 18 · 9 topics · 1 lessons

Cluster Operations & SRE

Run, upgrade, recover, and harden clusters in production.

Cluster Provisioningkubeadm, managed (EKS/GKE/AKS), and cluster-api. Kubernetes docs

Cluster & Node UpgradesVersion skew policy and safe rolling upgrades. Kubernetes docs

etcd Backup & RestoreSnapshots and disaster recovery procedures. Kubernetes docs

Node Drain & PodDisruptionBudgetsSafe maintenance without violating availability. Kubernetes docs

Multi-TenancyrecNamespace isolation, hierarchical namespaces, vClusters. Kubernetes docs

Cost OptimizationrecBin packing, spot instances, and rightsizing. OpenCost

DR & Multi-Cluster StrategyrecFailover, federation, and regional redundancy. Kubernetes docs

Chaos EngineeringoptionalFault injection with Chaos Mesh/LitmusChaos.

Production TroubleshootingCrash loops, pending pods, networking, and DNS failures. Kubernetes docs

You're job-ready.

Clear every stage, earn the certificate, and walk into interviews prepared. The complete path, nothing hidden, no gaps.

Destination reached