Path 09 · learning path
Assembling an internal platform for a Kubernetes-hosted service from parts already built on this site: the contract between the platform team and the teams that ship on it, environments generated from Git with Argo CD ApplicationSets, a versioned GitLab CI template as the golden delivery path, Kyverno guardrails delivered through GitOps, and a Prometheus, Grafana and Loki stack to see what runs.
Each part names what it needs. Nothing has to be installed before part 1.
The path
Each part states what it assumes from the previous one, so you can also jump in where your setup already is.
The operating model behind the CI templates, ApplicationSets, Kyverno guardrails and observability stack on this site: what a team hands over, what the platform returns, where the golden path ends and enforcement begins.
Replace hand-copied Argo CD Applications with an ApplicationSet driven by per-environment config files: the Git file generator, templatePatch for automated versus manual sync, AppProject boundaries and deletion policy.
One platform-owned GitLab CI template instead of a pipeline per repository: spec:inputs with validation, a consumer that includes it by project and tag, extension points, versioning, and what a consumer can override.
Kyverno as a platform guardrail system: baseline and production policy layers keyed on namespace labels, delivered by Argo CD from one repository, rolled out audit-first, with scoped expiring exceptions.
kube-prometheus-stack, Loki in single-binary mode and Alloy on a kind cluster; the PromQL and LogQL that answer operational questions; low-cardinality log labels; a real OOM restart loop diagnosed end to end.
Practise
On a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.
Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.
Toolchain
Container orchestration platform and the deployment target for most of the toolchain.
Declarative GitOps continuous delivery controller for Kubernetes.
Source control, merge requests and CI/CD in one platform, with built-in security scanning templates.
Kubernetes-native policy engine: validate, mutate, generate and verify images with YAML.
Pull-based metrics collection, storage and alerting with PromQL.
Dashboards and alerting across metrics, logs and traces.
Log aggregation that indexes labels, not content, for cost-efficient storage.