CNT-01 · Cloud-Native and Telco Infrastructure
Networks that hold up in production.
Design a service mesh and a multi-cluster network, then run them through a GitOps workflow built to survive a bad day.
You build: a multi-cluster mesh managed through GitOps.
Promise
Design a service mesh, a multi-cluster network, and a GitOps workflow that holds up in production.
Prerequisites
basic Kubernetes; PDP-03 recommended.
Units
1. Foundations ch 01–03
Kubernetes networking review, microservice communication problems.
2. Service mesh ch 04–10
concepts, Istio architecture, Envoy, install, traffic management, security, observability.
3. Mesh alternatives ch 12–13
Consul Connect, choosing a mesh.
4. Multi-cluster ch 14–19
architecture patterns, federation, cluster lifecycle, Istio multi-cluster, cross-cluster discovery.
5. Multi-cluster traffic and security ch 20–22
gateway traffic distribution, identity, unified observability.
6. Optimization and troubleshooting ch 23–24
.
7. Modern delivery ch 25–27
GitOps, serverless with Knative, eBPF for meshes.
8. Hybrid and cases ch 28–30
.
Labs
Each lab names its environment and a pass check. Labs are not marked complete on "it ran" — the pass check has to hold.
| Lab | What you do | Environment |
|---|---|---|
| CNT-01ach 07–08 | Istio install and a 90/10 traffic splitPass check: Split measured | container90 min |
| CNT-01bch 09 | mTLS and an authorization policyPass check: Denied request shown | container60 min |
| CNT-01cch 19 | Cross-cluster service discoveryPass check: Remote service reached | container120 min |
| CNT-01dch 24 | Find a broken route in the meshPass check: Root cause written up | container60 min |
Capstone project · CAP-04
Multi-Cluster Mesh with Policy · 3 weeks
Two clusters must share three services. Only named flows may cross, all encrypted, all observable.
Build the mesh, the policy, and the SLA dashboard. Show a denied flow and an allowed flow.
Deliverables: Manifests, test suite, dashboard, runbook.
Outcomes
- I can split traffic between two versions of a service and roll back.
- I can enforce mTLS and an authorization policy and show a denied request.
- I can make a service in one cluster reachable from another.
Also in
How it runs
Work through the units in order. Each unit groups the chapters of the study guide with its share of the labs. You can start any time; there is no cohort date and nothing expires.
Labs run in a VM, a container, a simulator or on real hardware, and the card above names which. Where a lab needs hardware — an RDMA NIC, a programmable switch model, an FPGA — there is a simulator fallback so you are never blocked by equipment.
Questions
Do I get a certificate?
You get a completion record for the course. Path badges and project credentials are earned by passing the labs and the project review, not by attendance.
Can my team take this together?
Yes — and if you would rather have it delivered live, with the instructor in the room, this course also exists as a scheduled live cohort. See the live dates.
How long does it take?
≈ 30 h of study including the labs. Most engineers take it part-time over a few weeks.