Tutorials

Step-by-step engineering guides

Practical tutorials written by engineers who've done it in production. Follow along, run the commands, and end up with something real.

19 tutorials

Intermediate45 min12 min read

Setting Up Kubernetes RBAC from Scratch

A step-by-step guide to configuring Role-Based Access Control in Kubernetes. You'll create users, define roles with least-privilege permissions, bind them, and verify access — all with real kubectl commands.

Intermediate30 min11 min read

Setting Up Horizontal Pod Autoscaler with Custom Metrics

Scale your Kubernetes workloads on business metrics — RPS, queue depth, or latency — instead of just CPU. This tutorial wires up KEDA and Prometheus Adapter to drive HPA from real application signals.

Beginner25 min8 min read

Zero-Downtime Deployments with Rolling Updates and Readiness Probes

Most Kubernetes deployments drop traffic during updates because readiness probes are misconfigured or missing. This tutorial shows you the exact configuration that eliminates downtime — and how to verify it.

Beginner20 min9 min read

Debugging CrashLoopBackOff from Scratch

CrashLoopBackOff means your container keeps crashing and Kubernetes keeps restarting it. This tutorial gives you a systematic approach to find the root cause every time — no guessing.

Intermediate45 min10 min read

Building a Multi-Namespace Helm Chart with Environment Overlays

Structure a Helm chart that deploys cleanly to dev, staging, and production with different values per environment — without duplicating templates or maintaining separate charts per namespace.

Intermediate35 min10 min read

Configuring NetworkPolicies to Isolate Namespaces

By default, every pod in a Kubernetes cluster can talk to every other pod. NetworkPolicies let you enforce zero-trust networking — allowing only the traffic you explicitly permit. This tutorial shows you how.

Intermediate40 min12 min read

Setting Up Cluster Autoscaler on EKS

Configure Kubernetes Cluster Autoscaler on EKS so nodes scale automatically with your workloads. Covers IAM setup, autoscaling group tagging, deployment, and tuning scale-down behavior.

Beginner40 min11 min read

Building a GitHub Actions Pipeline That Deploys to Kubernetes

Build a CI/CD pipeline from scratch: test on every pull request, build and push a Docker image on merge to main, then deploy to Kubernetes automatically. No third-party deployment tools required.

Intermediate50 min12 min read

Setting Up ArgoCD with Automated Sync and Rollback

Install ArgoCD on Kubernetes, connect your Git repository, and configure automated sync so every push to main deploys automatically — with one-command rollback when something goes wrong.

Intermediate35 min9 min read

Securing CI Pipelines with OIDC: No Long-Lived Secrets

Replace static AWS/GCP credentials in CI with short-lived tokens via OpenID Connect. Your pipeline gets temporary credentials that expire automatically — no more rotating secrets, no more leaked tokens.

Beginner45 min11 min read

Monitoring Kubernetes with Prometheus and Grafana

Deploy the kube-prometheus-stack with Helm, understand what it collects out of the box, build a dashboard for your application, and set up your first alert rule — all in under an hour.

Intermediate30 min10 min read

Defining SLOs and Writing Burn Rate Alerts in Prometheus

Turn a reliability goal into an alerting rule. This tutorial shows you how to express an SLO as a Prometheus query, calculate burn rates, and write multiwindow alerts that page you before users notice.

Intermediate50 min12 min read

Distributed Request Tracing with OpenTelemetry

Instrument a Node.js service with OpenTelemetry, send traces to Jaeger or Tempo, and see exactly which service caused a latency spike. No vendor lock-in, portable signals.

Beginner20 min8 min read

Scanning Container Images for CVEs with Trivy in CI

Add Trivy to your CI pipeline to catch known vulnerabilities before images reach production. Covers severity thresholds, ignoring false positives, scanning Helm charts, and breaking the build on critical CVEs.

Advanced60 min14 min read

HashiCorp Vault: Kubernetes Auth and Dynamic Secrets

Configure Vault's Kubernetes auth method so pods authenticate using their ServiceAccount token, then generate short-lived database credentials on demand instead of storing static passwords in Kubernetes Secrets.

Advanced45 min11 min read

Hardening Pods with Seccomp and AppArmor Profiles

Restrict what system calls a container can make using seccomp, and what filesystem paths it can access using AppArmor. Two complementary Linux security mechanisms that drastically limit the blast radius of a compromised pod.

Intermediate60 min14 min read

Provisioning an EKS Cluster with Terraform from Scratch

Build a production-ready EKS cluster with Terraform: VPC with private subnets, managed node groups, IRSA for pod IAM, and OIDC provider — all in reproducible, reviewable infrastructure code.

Intermediate35 min9 min read

Setting Up IAM Roles for Service Accounts (IRSA) on EKS

Give individual Kubernetes pods scoped AWS permissions without node-level IAM roles. IRSA uses the EKS OIDC provider to issue short-lived credentials per ServiceAccount — no static keys, no overly permissive nodes.

Beginner25 min9 min read

Rightsizing AWS Costs: Finding and Fixing Overprovisioned Resources

Most AWS bills have 20–40% waste from overprovisioned EC2 instances, underused RDS, and forgotten resources. This tutorial shows you how to find it systematically and reduce it without impacting reliability.

Need help applying this to your stack?

Our engineers have implemented these patterns across hundreds of production environments. Book a free call.

Book Free Consultation