DevOps Engineering: Core Practices

Master production-grade DevOps through hands-on labs. You take a single web service and, week by week, containerize it, wire CI/CD, provision its infrastructure, make it observable, orchestrate it on Kubernetes, and ship it through GitOps and progressive delivery — ending with a multi-service, self-healing, fully-observable system and a portfolio that proves you can run software in production.

"You build it, you run it." — Werner Vogels

Course Roadmap

The arc is build → integrate → provision → observe → orchestrate → deliver → operate at scale. Each lab builds on the last; your service grows from one container to a three-service cluster.

| Week | Lab | Module | Key Topics & Tooling (May 2026) | |:---:|:---:|--------|---------------------------------| | 1 | 1 | Web Application Development | Python 3.13, Flask/FastAPI, health endpoints | | 2 | 2 | Containerization | Docker 29, multi-stage, distroless, Trivy scan, GHCR | | 3 | 3 | Continuous Integration | GitHub Actions, testing pyramid, supply-chain safety | | 4 | 4 | Infrastructure as Code | Terraform 1.15 + Pulumi 3.243, state, OpenTofu | | 5 | 5 | Configuration Management | ansible-core 2.21, roles, idempotency, Vault | | 6 | 6 | Continuous Deployment | Advanced Ansible, Compose v2, CI/CD with OIDC | | 7 | 7 | Logging | Loki 3.7, Grafana Alloy 1.16 (Promtail EOL), LogQL | | 8 | 8 | Monitoring | Prometheus 3.x, PromQL, RED/USE, Grafana 13 | | 9 | 9 | Kubernetes | K8s 1.36 "Haru", Deployments, Services — 2nd service joins | | 10 | 10 | Helm | Helm 4.1, charts, templating, hooks, OCI registries | | 11 | 11 | Secrets Management | K8s Secrets, OpenBao 2.5, External Secrets Operator | | 12 | 12 | Configuration & Storage | ConfigMaps, PV/PVC, StorageClass, hot-reload | | 13 | 13 | GitOps | ArgoCD 3.4, ApplicationSet — 3rd service joins | | 14 | 14 | Progressive Delivery | Argo Rollouts 1.8, canary, blue-green, AnalysisTemplate | | 15 | 15 | StatefulSets | Headless services, volumeClaimTemplates, operators | | 16 | 16 | Cluster Monitoring | kube-prometheus, ServiceMonitor, init containers | | — | Bonus Labs | | | | — | 17 | Edge Deployment | Cloudflare Workers, V8 isolates, global edge | | — | 18 | Reproducible Builds | Nix flakes, deterministic builds |

📅 16-week schedule. If your semester runs shorter, lectures pair up (two per week) so the lab cadence stays one-per-week. Lectures 1-16 map 1:1 to Labs 1-16; bonus labs 17-18 are covered by Lecture 16.

The Project: a service that grows into a system

You start with one Python service (Lab 1) and never throw it away — every lab adds a production capability to the same project. Two course-provided plumbing services join later to make orchestration concepts real:

graph LR
    U[User] -->|HTTP| WEB[web :8080<br/>your Python service]
    WEB -->|Lab 9+| ECHO[echo :8081<br/>plumbing]
    WEB -.->|Lab 13+| HEALTH[health :8082<br/>plumbing]
style WEB fill:#2196F3,color:#fff     style ECHO fill:#FF9800,color:#fff     style HEALTH fill:#607D8B,color:#fff

| Service | Role | Owner | When it appears | |---------|------|-------|-----------------| | web | Your Python web service — the project spine | You build it | Lab 1 | | echo | Go companion — makes Service + kube-DNS meaningful | Course plumbing (plumbing/echo/) | Lab 9 | | health | Go companion — gives ArgoCD ApplicationSet a 3rd target | Course plumbing (plumbing/health/) | Lab 13 |

You never write the plumbing services — you deploy and wire them. They expose Prometheus metrics so your Lab 7-8-16 observability stack picks them up automatically.

What Ships vs. What You Produce

| In this repo (course-provided) | In YOUR fork (you produce) | |--------------------------------|----------------------------| | lectures/ — 16 lectures | app_python/ — your service | | labs/ — 18 lab specs | k8s/ — your manifests (Lab 9+) | | plumbing/ — echo + health services | ansible/, terraform/ — your IaC (Labs 4-6) | | README.md — this file | .github/workflows/ — your CI (Lab 3+) | | | monitoring/ — your Prometheus/Loki config (Labs 7-8) |

Student-produced directories are gitignored in this repo so the upstream stays clean. You commit them to your fork.

Lab Structure

Each main lab (1-16) is worth 10 points of main tasks + up to 2 bonus points:

• Main tasks sum to 10 pts. Split varies by lab (e.g. 6+4, or 2+3+3+2) — Task 1 is always standalone so later labs never depend on a task you skipped.
• Bonus tasks sum to 2 pts, flat. Genuinely challenging extensions, not busywork.
• Bonus labs (17, 18) follow the same 10 + 2 shape and are the exam-alternative track.

Grading

Five components. Maximum contributions sum to 139%, capped at 100% — so there are multiple paths to an A and no single component is mandatory.

| Component | Raw | Weight | Rewards | |-----------|----:|-------:|---------| | Main labs 1-16 (main tasks) | 160 | 70% | Diligent weekly project work — the floor | | Bonus tasks (2 pts × 16 labs, flat) | 32 | 14% | Going beyond on weekly topics | | Quiz leaderboards (5 rolling windows, top-10 share a pool) | — | 5% | Engagement + lecture mastery | | Bonus labs 17 + 18 (10 pts each) | 20 | 20% | Edge + reproducible-build mastery; the exam alternative | | Final exam | — | 30% | Optional — written, comprehensive | | Sum (capped at 100%) | | 139% | |

Paths to an A (≥90%)

• Practice path: all main labs (70%) + bonuses (14%) + both bonus labs (20%) → 104% → capped A, no exam.
• Exam path: all main labs (70%) + bonuses (14%) + a solid exam (30%) → A, no bonus labs.
• Mixed: main labs + some bonuses + one bonus lab + a decent exam.

Quiz Leaderboards

Each lecture has a 15-question post-quiz. Quizzes feed 5 rolling leaderboard windows across the semester:

| Window | Lectures | Weeks | |:---:|----------|:---:| | 1 | lec 1-3 | 1-3 | | 2 | lec 4-6 | 4-6 | | 3 | lec 7-9 | 7-9 | | 4 | lec 10-12 | 10-12 | | 5 | lec 13-16 | 13-16 |

The top-10 students in each window split that window's small point pool (≈1% each, ~5% total). Late-joining students can still win later windows.

Technology Stack (pinned May 2026)

| Layer | Tool | Version | |-------|------|---------| | Runtime | Python | 3.13 | | Container | Docker Engine | 29.5 | | Registry | GHCR | — | | Scanning | Trivy | v0.69.3+ (post-CVE-2026-33634 safe) | | CI/CD | GitHub Actions | ubuntu-24.04 runners | | IaC | Terraform / OpenTofu / Pulumi | 1.15 / 1.12 / 3.243 | | Config mgmt | ansible-core | 2.21 | | Logs | Loki + Grafana Alloy | 3.7 / 1.16 | | Metrics | Prometheus + Grafana | 3.x / 13 | | Orchestration | Kubernetes | 1.36 "Haru" | | Local cluster | k3d (k3s-in-Docker) | 5.7 | | Packaging | Helm | 4.1 | | Secrets | OpenBao | 2.5 | | GitOps | ArgoCD | 3.4 | | Progressive delivery | Argo Rollouts | 1.8 |

Submission Workflow

graph LR
    A["Fork repo"] --> B["Branch lab<N>"]
    B --> C["Complete tasks"]
    C --> D["Push & open PR"]
    D --> E["Submit PR URL via Moodle"]
    E --> F["Receive feedback"]
    style A fill:#4CAF50,color:#fff
    style D fill:#F44336,color:#fff
    style E fill:#00BCD4,color:#fff

git checkout -b lab1
... complete the lab ...
git add app_python/
git commit -m "Complete lab1"
git push -u origin lab1
Open a PR from your-fork:lab1 → your-fork:main, submit the PR URL on Moodle

Key Books & Resources

DevOps foundations

• The Phoenix Project — Gene Kim et al. (2013)
• The DevOps Handbook (2e) — Kim, Humble, Debois, Willis (2021)
• Accelerate — Forsgren, Humble, Kim (2018)

• Docker Deep Dive — Nigel Poulton
• Terraform: Up & Running (4e) — Yevgeniy Brikman
• Ansible for DevOps — Jeff Geerling
• Kubernetes Up & Running (3e) — Burns, Beda, Hightower
• Learning Helm (2e) — Butcher, Farina, Dolitsky

• Observability Engineering — Majors, Fong-Jones, Miranda
• Site Reliability Engineering — Beyer et al. (free at sre.google/books) — pairs with the SRE-Intro elective

• DORA State of DevOps
• CNCF Cloud Native Landscape
• 12 Factor App

Ready? Start with Lab 1. Questions → course Moodle or office hours.