Guardrails-First Course Materials
This course teaches production-grade Kubernetes and SRE practice through incidents, guardrails, and repeatable workflows.
The goal is not to memorize tools. The goal is to learn how to keep systems safe when pressure, ambiguity, and AI-assisted speed all show up at the same time.
Who This Is For
- platform engineers moving from “it works” to “it survives mistakes”
- DevOps engineers who want stronger operating discipline, not more tooling hype
- SREs who want concrete labs, guardrails, and incident-shaped lessons
How the Course Works
Each chapter is built around one production failure pattern:
- what broke
- why the shortcut looked reasonable
- how the investigation becomes confusing
- which guardrail restores a safe operating path
From Chapter 02 on, every core chapter includes:
- a written incident walkthrough
- a hands-on lab
- a quiz to confirm the operating rule
- runbooks or scorecards where the topic needs them
Chapter 00 is the lab setup itself, and Chapter 01 sets the rules the rest of the course applies; both end with a quiz.
This course does not only teach how to operate Kubernetes around applications. It also shows what a production-ready Kubernetes application should look like so rollout safety, observability, GitOps reconciliation, and incident response work correctly in the first place.
The course uses the SafeOps reference applications as concrete examples:
- safeops-course/backend, a small production-shaped Go API with health probes, metrics, tracing hooks, chaos endpoints (opt-in, off in production), and OpenAPI/Swagger support
- safeops-course/frontend, a Vue-based frontend with container hardening and runtime config injection
Their Kubernetes manifests live in the platform repository as Kustomize overlays per environment.
Many of the application patterns in those reference apps are inspired by Podinfo by Stefan Prodan. What the SafeOps apps implement:
- readiness and liveness probes
- graceful shutdown on interrupt signals
- config reload from a mounted directory (backend
CONFIG_PATH, shown at/configs); the platform itself passes feature flags from a ConfigMap as environment variables - Prometheus and OpenTelemetry instrumentation
- structured logging
- 12-factor configuration
- fault injection for safe drills
- multi-arch images scanned for CVEs before they are published, then signed, with an SBOM and build provenance attached
Video assets are optional. The written lesson remains the primary source of truth, and the video should make the same lesson easier to absorb, not replace the material.
Recommended Learning Path
- Start with Intro: AI as a Very Well-Read Junior Engineer.
- Set up your lab in Chapter 00 - every later lab runs on it.
- Go through Chapters 01-15 in order.
- Run the lab before moving to the next chapter.
- Use the quiz to confirm the main guardrail rule before continuing.
- Move to the advanced chapters only after the core path feels operationally natural.
Tracks
Core track:
- Chapter 00: your lab environment
- Chapters 01-15 covering platform foundations, GitOps, CI/CD, security, observability, reliability, and on-call discipline
Advanced track:
- Chapter 16: Admission Policy Guardrails
- Chapter 17: Supply Chain Security
- Chapter 18: Rollback and Data Migrations
- Chapter 19: Progressive Delivery (Canary with Traefik + Flagger)
- Chapter 20: Platform Lifecycle
- Chapter 21: Credential & Access Lifecycle
- Chapter 22: Disaster Recovery
- Chapter 23: Capstone - Prove and Hand Over Your Platform
Reference appendices:
- Appendix: Local Development Environment
- Appendix: DNS and TLS Automation
References
- Full structure and outcomes: Curriculum
- Intro mental model: Intro: AI as a Very Well-Read Junior Engineer