Level 5 — Architect · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Cluster API (clusterctl)
clusterctl init --infrastructure <provider> | Turn a cluster into a management cluster |
clusterctl generate cluster <name> --kubernetes-version <v> > cluster.yaml | Generate a workload cluster definition |
kubectl apply -f cluster.yaml | Create it (declaratively) |
clusterctl describe cluster <name> | Tree view of the cluster's machines and conditions |
clusterctl get kubeconfig <name> > <name>.kubeconfig | Get access to the new cluster |
kubectl get clusters,machinedeployments,machines | Fleet objects in the management cluster |
Fleet GitOps
argocd cluster add <context> | Register a cluster with Argo CD |
kubectl get applicationsets -n argocd | Templates that fan out apps to clusters |
Tenant kit (per namespace)
kubectl create namespace team-a | The tenant boundary |
kubectl label ns team-a pod-security.kubernetes.io/enforce=restricted | Enforce the 'restricted' Pod Security Standard |
kubectl create rolebinding team-a-edit --clusterrole=edit --group=team-a -n team-a | The team may manage its own namespace |
kubectl apply -f quota.yaml -f limitrange.yaml -f netpol-default-deny.yaml | Budget, defaults, and network isolation |
Verify isolation
kubectl auth can-i list secrets -n team-b --as-group=team-a --as=someone | Can team A read team B's secrets? (should be no) |
kubectl get networkpolicy -A | Which namespaces are isolated |
Platform building blocks
Golden path | An opinionated, supported way to build and ship a service end to end |
Platform API | A simple, declarative interface (CRD, Terraform module, template) hiding infrastructure detail |
Developer portal | A catalog of services, owners, docs and self-service actions (e.g. Backstage) |
Guard-rails | Policies that prevent unsafe choices automatically, instead of manual approvals |
Measure it
Deployment frequency / lead time | DORA: how fast changes reach production |
Change failure rate / time to restore | DORA: how safely |
Time to first deploy (new service) | How long a golden path takes, end to end |
Developer satisfaction | Survey the platform's users regularly |
Definitions
SLI | A measured ratio of good events: good ÷ total |
SLO | The target for that SLI over a window, e.g. 99.9% over 30 days |
Error budget | What the SLO allows to fail: 0.1% of 30 days ≈ 43 minutes |
Burn rate | How fast the budget is being used (1 = exactly on budget) |
Example PromQL
sum(rate(apiserver_request_total{code=~"5.."}[5m])) / sum(rate(apiserver_request_total[5m])) | API server error ratio |
histogram_quantile(0.99, sum(rate(apiserver_request_duration_seconds_bucket{verb!~"WATCH|CONNECT"}[5m])) by (le)) | p99 API latency (excluding long-lived watches) |
Design document outline
1. Context & requirements | Who, what, scale, constraints, SLOs, RPO/RTO |
2. Cluster topology | How many clusters, where, why (with an ADR) |
3. Tenancy & access | Model, tenant kit, identity, RBAC |
4. Lifecycle | Provisioning, upgrades, waves, add-ons |
5. Resilience & DR | Failure domains, backups, drills, runbooks |
6. Observability & SLOs | SLIs, SLOs, probes, alerting |
7. Cost & risks | Estimate, top risks, open questions |
Questions reviewers always ask
What happens when X fails? | For every component and dependency |
How do you upgrade it? | Without downtime, repeatedly, for years |
How do you know it's working? | SLIs, probes, alerts |
What does it cost, and what could we drop? | Trade-offs made explicit |
