A self-generated k8s course

In the age of GenAI and quick coding, the value in software development starts to shift from writing code, to understading software architecture and security.

How the course was formed

This page is a Work in Progress.

The course code will be published, after I anonimized by own setup and generalized specifics for my use case.

• The course is ended to my home set-up, allowing me to host a cluster (with 1 node) in my LAN.
• The inspiratoin is the Volt Europa Tech stack. It is hyper modern, and is built in a way to require as little maintainance as needed. For Volt, this is important since we’re relying on volunteers. For me, it’s important because who likes to do maintainance for a homelab?

The chapters of this course:

1. What we are building

                 Your laptop                         Raspberry Pi (K3s node)
        ┌────────────────────────────┐        ┌───────────────────────────────┐
        │  kubectl / flux / helm     │        │  K3s cluster (single node)    │
        │  k3d practice clusters     │        │  ├── Traefik ingress          │
        │  git (pushes to Gitea)     │        │  ├── cert-manager (TLS)       │
        └─────────────┬──────────────┘        │  ├── Flux (GitOps controller) │
                      │ git push = deploy     │  └── your apps                │
                      ▼                       └───────────────┬───────────────┘
        ┌────────────────────────────┐                        │ NFS volumes
        │  Local NAS                 │◄───────────────────────┘
        │  ├── Gitea (Git server)    │   IaC repo: clusters/, apps/, infrastructure/
        │  ├── NFS export (storage)  │
        │  └── Hyper Backup          │
        └────────────────────────────┘

The core idea of GitOps: the Git repository is the single source of truth. Every app, config, and secret (encrypted) is declared in files. Flux watches the repo and makes the cluster match it. git push = deploy. git revert = rollback.

2. Learning goals

By the end you will be able to:

1. Explain and use the core Kubernetes objects: Pod, Deployment, Service, Ingress, ConfigMap, Secret, PersistentVolume/Claim, Namespace
2. Create and destroy throwaway clusters locally (k3d) and run a real one (K3s on the Pi)
3. Store cluster state in Git and deploy exclusively through GitOps (Flux)
4. Give the cluster persistent storage backed by your NAS (NFS)
5. Handle secrets safely in Git (SOPS + age encryption)
6. Do the operator basics: verify health, read events/logs, roll back, back up
7. Know what to do next for monitoring, updates, and secure remote access

3. How we work through a lesson

1. You read the lesson file (before or at the start of a session).
2. The agent teaches the concepts (ask anything, anytime).
3. Together you execute the action steps — the agent explains each command, you run the interactive/sensitive ones yourself (passwords are never shared).
4. You run the verify steps to prove it worked.
5. The agent ticks the checkboxes in the lesson files once you verified you understood the lesson concepts, so the next session knows exactly where we are.

Rules of thumb: practice on the laptop before touching the NAS/Pi; never let the agent handle passwords; NAS changes always need your explicit approval.

4. Lesson index

Phase	File	Lessons
1 — Access, tooling & decisions	01-access-tooling-and-decisions.md	1.1 SSH key → NAS · 1.2 toolchain · 1.3 container concepts · 1.4 ADRs / MADR 4.0
2 — K8s playground	02-kubernetes-playground.md	2.1 cluster + kubectl · 2.2 workloads · 2.3 ingress · 2.4 storage · 2.5 Helm/Kustomize · 2.6 break & fix
3 — NAS prep	03-nas-preparation.md	3.1 Gitea · 3.2 NFS export · 3.3 backups
4 — Pi + GitOps	04-pi-cluster-and-gitops.md	4.1 Pi OS · 4.2 K3s · 4.3 NFS storage · 4.4 TLS · 4.5 Flux · 4.6 SOPS · 4.7 first apps
5 — Operations	05-operations-and-remote-access.md	5.1 RBAC/NetworkPolicy · 5.2 monitoring · 5.3 backups · 5.4 updates · 5.5 remote access

5. Progress tracker

The agent keeps this table in sync. Date = completed.

Lesson	Status	Date
1.1 SSH key to NAS	☐ not started
1.2 Toolchain (docker, kubectl, k3d, flux, helm)	☐ not started
1.3 Container concepts	☐ not started
1.4 Decision records (ADR / MADR 4.0)	☐ not started
2.1 k3d cluster + kubectl basics	☐ not started
2.2 Workloads: Deploy/Service/ConfigMap/Secret	☐ not started
2.3 Ingress + Traefik + local DNS	☐ not started
2.4 Storage: PV/PVC/StorageClass	☐ not started
2.5 Helm + Kustomize	☐ not started
2.6 Break things & fix them	☐ not started
3.1 Gitea on NAS	☐ not started
3.2 NFS export on NAS	☐ not started
3.3 NAS backups for Gitea/NFS	☐ not started
4.1 Raspberry Pi OS reinstall	☐ not started
4.2 K3s install + kubeconfig	☐ not started
4.3 NFS storage provisioner	☐ not started
4.4 cert-manager + TLS	☐ not started
4.5 Flux bootstrap (GitOps handoff)	☐ not started
4.6 SOPS + age secrets	☐ not started
4.7 First apps via git push	☐ not started
5.1 RBAC + NetworkPolicies	☐ not started
5.2 Monitoring	☐ not started
5.3 Backup strategy	☐ not started
5.4 Update automation	☐ not started
5.5 Remote access (VPN/tunnel)	☐ not started