Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
$ als gewone gebruiker# als root (of met sudo)
Build the reference platform
One small app ("shop"), from commit to production, with security at every step.
| Layer | Choice | Services |
|---|---|---|
| Code and review | GitHub, protected main, signed commits | git, gh |
| CI | GitHub Actions | semgrep, gitleaks, trivy, docker, syft, cosign |
| Infra | Azure or a home lab | terraform, packer, ansible, cloud-init, az |
| Cluster | k3s (lab) or AKS (cloud) | kubectl, helm, kustomize, etcdctl |
| Delivery | GitOps | argocd or flux, sops |
| Edge | Ingress + TLS | nginx (ingress-nginx) or traefik, cert-manager |
| Data | DB + cache | psql, redis-cli |
| Identity and secrets | SSO + secret store | kcadm (or Entra ID), vault (or Key Vault) |
| Observe | Metrics, logs, traces, alerts | promtool, amtool, grafana-cli, logcli, fluent-bit, otelcol |
| Protect | Runtime and benchmarks | falco, kube-bench, Pod Security, NetworkPolicies |
| Test | From outside | zap, nmap |
Follow one change through the platform
What happens when you change one line of code.
- You push a branch and open a PR with
gh pr create. - CI runs
semgrep,gitleaks,trivy fsand unit tests; the PR shows the results. - After review and merge, CI builds the image with
docker, scans it withtrivy, makes an SBOM withsyft, signs it withcosignand pushes it. - CI changes the image tag in the GitOps repo (
kustomize edit set image). argocdsees the new commit and syncs the cluster; Kyverno checks the signature first.- Prometheus and Loki show the new version; an alert fires if the 5xx rate rises;
argocd app rollbackorgit revertbrings the old version back. - Every night:
zapbaseline on staging,grypeon all SBOMs,kube-benchandfalcoreports,etcdctland database backups.
Start small in the home lab
The order to build it, one weekend per step.
- 3 VMs with RHEL (or Rocky/Alma), hardened with Ansible; BIND for
lab.local; WireGuard for access. - k3s with 1 server + 2 agents; Traefik or ingress-nginx; cert-manager with a lab CA.
- Argo CD from a GitOps repo; SOPS with age for secrets.
- kube-prometheus-stack + Loki + Fluent Bit; 3 alerts and 1 dashboard.
- The CI pipeline with scans, SBOM and signing; Kyverno to enforce signatures.
- Falco, kube-bench and a weekly
nmapof the lab network. - Backups: etcd snapshots,
pg_dump,mc mirrorto MinIO; one restore test.
Op het werk
Write a short README with a diagram and "what I learned" for each step. Link it from your CV and LinkedIn — see the portfolio chapter.
Map the services to the exams
Where the services of this guide appear in the certificates of the path.
| Exam | Services you must know |
|---|---|
| RHCSA (EX200) | firewall-cmd, auditctl basics, podman, SELinux, nginx/httpd basics |
| AZ-104 | az, VNets, NSGs, Key Vault, Azure Monitor |
| Terraform Associate | terraform (all commands, state, modules) |
| CKA | kubectl, helm, kustomize, crictl, etcdctl |
| CKS | falco, kube-bench, trivy, cosign ideas, auditctl-style audit policies, NetworkPolicies |
Onthoud
Tools change; the ideas stay: least privilege, everything as code, scan early, sign what you ship, watch what runs, and test your restores.