Course Introduction

​

What you’ll learn (at a glance)

• GitOps fundamentals: continuous and declarative concepts, desired state, state drift, reconciliation, and feedback loops.
• GitOps principles: why Git as the single source of truth matters and the core principles that define GitOps.
• Reconciliation engines: hands-on with Argo CD and Argo Rollouts.
• Manifests and packaging: Kustomize, Helm charts, and OCI-based Git/registry workflows.
• Secrets management: working with Bitnami Sealed Secrets and kubeseal.
• Observability: integrating Prometheus, Grafana, and Alertmanager for metrics and alerts.
• CI integration: building pipelines that publish artifacts and update Git for pull-based delivery.
• Release patterns: rolling updates, recreate, blue/green, and canary releases.
• Metrics & best practices: DORA metrics, operational guardrails, and security-first practices.
• Mock exams and practice questions to validate readiness for certification.

​

Course modules overview

​

Hands-on labs and learning approach

​

GitOps patterns — storing secrets safely with Bitnami Sealed Secrets

1. Create a Kubernetes Secret manifest locally (without applying it to the cluster).
2. Encrypt that secret with kubeseal to produce a SealedSecret.
3. Commit the SealedSecret to Git; your GitOps controller (for example, Argo CD) will apply it and the Sealed Secrets controller will decrypt it inside the cluster.

# Create a Kubernetes Secret manifest (not applied to the cluster)
kubectl create secret generic mysql-password \
  --from-literal=password='s1Ddh@rttF' \
  --dry-run=client -o yaml > mysql-password_k8s-secret.yaml

# Use kubeseal (installed separately) to encrypt the secret into a SealedSecret
# Apply the sealed secret to the cluster (Sealed Secrets controller will decrypt it)
# kubectl apply -f sealed-secret.yaml

apiVersion: v1
kind: Secret
metadata:
  name: mysql-password
type: Opaque
data:
  # Base64-encoded password (example)
  password: czFEZGhAcnQj

argocd app create sealed-secrets \
  --repo https://bitnami-labs.github.io/sealed-secrets \
  --helm-chart sealed-secrets \
  --revision 2.2.0 \
  --dest-namespace kube-system \
  --dest-server https://1.2.3.4

• Bitnami Sealed Secrets: https://github.com/bitnami-labs/sealed-secrets
• kubeseal docs: https://github.com/bitnami-labs/sealed-secrets#kubeseal

​

Tooling and repository layouts

# Example repository navigation
cd cgoa-demos/manifests/helm/
ls
# Output:
# highway-chart
cd highway-chart/

• infrastructure/ for cluster-level manifests (ingress, storage)
• applications/ for per-app Helm charts or Kustomize overlays
• ci/ for pipeline definitions that update Git

​

CI pipelines that update Git (example pattern)

pipeline {
  agent any
  environment {
    REPO_URL = "http://localhost:5000/kk-org/cgoa-demos"
    BRANCH = "feature-gitea"
    REMOTE_AUTH = "http://587fcc78b44a416b7497ad5065dad577d722708@localhost:5000/kk-org/cgoa-demos"
  }
  stages {
    stage('Checkout') {
      steps {
        script {
          if (fileExists('cgoa-demos')) {
            echo 'Cloned repo already exists - Pulling latest changes'
            dir('cgoa-demos') {
              sh 'git pull'
            }
          } else {
            echo 'Repo does not exist - Cloning the repo'
            sh "git clone -b ${BRANCH} ${REPO_URL}"
          }
        }
      }
    }

    stage('Update Manifest') {
      steps {
        dir('cgoa-demos/jenkins-demo') {
          // Replace placeholder image with the new image tag in deployment.yaml
          sh 'sed -i "s|${IMAGE_REPO}/${NAME}:${VERSION}|${NEW_IMAGE}|g" deployment.yaml'
          sh 'cat deployment.yaml'
        }
      }
    }

    stage('Commit & Push') {
      steps {
        dir('cgoa-demos/jenkins-demo') {
          sh '''
            git config --global user.email "jenkins@ci.com"
            git remote set-url origin ${REMOTE_AUTH}
            git checkout ${BRANCH}
            git add -A || true
            git commit -m "Update manifest: set image to ${NEW_IMAGE}" || true
            git push origin ${BRANCH} || true
          '''
        }
      }
    }
  }
}

• CI: build/publish artifacts and update Git (push change).
• GitOps controller: continuously reconcile the cluster to match Git.

​

Infrastructure as Code (IaC) vs Configuration as Code (CaC)

​

Other topics covered

• Moving from DevOps to DevSecOps: integrating security into GitOps workflows.
• CI/CD best practices and how CI pipelines feed pull-based delivery.
• Observability: Prometheus metrics, Grafana dashboards, and Alertmanager for alerts and incident detection.
• DORA metrics: measuring lead time, deployment frequency, MTTR, and change failure rate.
• Labs, exercises, and mock exams to validate your knowledge and certification readiness.

​

Quick links & references

• Argo CD: https://argo-cd.readthedocs.io/
• Bitnami Sealed Secrets: https://github.com/bitnami-labs/sealed-secrets
• Kubernetes docs: https://kubernetes.io/docs/
• Helm: https://helm.sh/
• Kustomize: https://kustomize.io/
• Prometheus: https://prometheus.io/
• Grafana: https://grafana.com/
• Jenkins: https://www.jenkins.io/
• DORA metrics primer: https://cloud.google.com/blog/products/devops-sre/dora-research-accelerate