Private corporate batches, live online cohorts and 1-on-1 mentoring in the GitOps Toolkit controllers — sources, Kustomizations, HelmReleases and image automation — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Flux as a set of controllers rather than a single tool — source-controller artifacts and their revision semantics, kustomize-controller's inventory-based pruning and server-side apply behaviour, helm-controller drift detection and remediation, and the reflector/policy/automation chain that writes image tags back to Git. Sessions cover the design decisions that determine whether an estate stays maintainable: repository topology, dependsOn ordering and health gates, tenant isolation through serviceAccountName impersonation, and secret handling with SOPS or External Secrets.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Flux that means a trainer who has run it in production — the GitOps Toolkit controllers — sources, Kustomizations, HelmReleases and image automation — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Flux batchFlux is a GitOps delivery system for Kubernetes, built as a set of small, single-purpose controllers rather than one application. That composition is its defining characteristic. source-controller fetches from Git, OCI registries, Helm repositories and S3-compatible buckets, verifies them, and publishes an immutable local artifact. kustomize-controller takes that artifact, builds it, and applies it with server-side apply — tracking what it created in an inventory so that removing a file from Git prunes the object from the cluster. helm-controller drives the Helm SDK directly from a HelmRelease resource, with drift detection and remediation on failure. notification-controller handles both directions: inbound webhook Receivers that trigger immediate reconciliation, and outbound Alerts to Slack, Teams, Git commit status or any webhook.
The two image controllers are the part with no direct equivalent elsewhere. image-reflector-controller scans a registry and records available tags; ImagePolicy selects one by semver, numerical or alphabetical ordering; image-automation-controller then writes that tag back into the Git repository as a commit. The registry becomes an input to Git rather than something a pipeline pushes past Git.
Flux bootstraps by committing its own manifests into the repository it will watch, so the installation is itself under GitOps from the first minute. Multi-tenancy is expressed in Kubernetes terms — namespaced resources, serviceAccountName impersonation on every Kustomization and HelmRelease, and cross-namespace reference restrictions — rather than through a separate permission system.
The reason GitOps displaced push-based deployment is credential blast radius and drift. A CI job holding cluster-admin has to be trusted absolutely, and it has no way to notice that someone edited a live resource an hour after the deploy. A controller reconciling from Git closes both gaps at once.
Flux occupies a particular position within that model. It is the implementation teams choose when they want GitOps composed from Kubernetes primitives rather than layered on top of them — every unit of work is a namespaced custom resource, every permission decision is Kubernetes RBAC, and every reconciliation runs under an impersonated service account. That makes it a natural fit for platform teams building a substrate other teams consume, and for organisations where the security review focuses on who can write to which namespace.
The skill gap is not installation. It is designing repository structure and dependency ordering, deciding whether artifacts arrive as Git or as OCI, running image automation without a commit loop, and diagnosing a HelmRelease that keeps rolling back. Those are the questions a production Flux estate turns on.
The model first. Why a controller pulling from Git changes the security and drift story, what continuous reconciliation guarantees and what it does not, and how Flux's composed-controller design differs from a single-application approach.
Topics: Push pipelines vs pull reconciliation · The four GitOps principles · Flux's toolkit design vs monolithic controllers · Flux compared with Argo CD on real criteria · Repository topology: mono-repo, per-team, per-environment · What GitOps does not solve
The six controllers and the resources each owns. What a source artifact actually is, how revisions and checksums drive reconciliation, and how the controllers chain together through object references rather than through a pipeline.
Topics: source-controller and artifacts · kustomize-controller · helm-controller · notification-controller · image-reflector and image-automation controllers · The CRD map and object references · Reconciliation intervals, retries and suspend
Installing Flux by committing Flux. What flux bootstrap writes into the repository, how the installation then manages its own upgrades, and how to recover the whole thing when the cluster is gone.
Topics: flux bootstrap for GitHub, GitLab and generic Git · What lands in clusters/<name>/flux-system · Deploy keys, tokens and repository access · Upgrading Flux through Git · Customising the installation with kustomize patches · Uninstall and re-bootstrap · Bootstrap into an existing repository
Where truth comes from. GitRepository with branch, tag and semver references; OCIRepository for artifacts published by CI; HelmRepository in both HTTP and OCI form; Bucket for S3-compatible storage — plus verification and credentials for each.
Topics: GitRepository: ref by branch, tag, semver and commit · Ignore rules and sparse checkout · OCIRepository and artifact-based delivery · HelmRepository, HTTP and OCI · Bucket sources · Secrets for SSH, HTTPS and registry auth · Signature verification with cosign · Artifact revision and readiness conditions
The workhorse resource. Server-side apply and field ownership, inventory-based pruning, health checks that make readiness meaningful, dependsOn for ordering, and post-build variable substitution for the differences between environments.
Topics: Kustomization spec: path, prune, interval, timeout · Server-side apply and field managers · Inventory and how pruning decides what to delete · healthChecks and wait · dependsOn ordering across Kustomizations · postBuild substitution and substituteFrom · targetNamespace and common metadata · Force and drift correction
Helm without helm install. HelmRelease driving the Helm SDK, chart sources from repository or Git, values assembled from ConfigMaps and Secrets, and the install/upgrade/rollback remediation policy that decides what happens when a release fails.
Topics: HelmRelease spec and chart sources · HelmChart resource and chart reconciliation · values, valuesFrom and value merging order · install, upgrade and rollback remediation · driftDetection and correction · dependsOn between HelmReleases · Post-renderers and kustomize patches · Diagnosing a release stuck in retries
Closing the loop from registry back to Git. Scanning tags with ImageRepository, selecting one with an ImagePolicy, and committing the result with ImageUpdateAutomation — including the marker syntax, commit identity and the loop-avoidance rules that keep CI and Flux from fighting.
Topics: ImageRepository and registry credentials · ImagePolicy: semver, numerical and alphabetical ordering · Tag filtering with filterTags patterns · ImageUpdateAutomation and update markers · Commit identity, message templates and signing · push.branch and pull request workflows · Avoiding CI/Flux commit loops · When image automation is the wrong answer
Making reconciliation visible. Providers and Alerts for outbound messages, Receivers for inbound webhooks that skip the polling interval, Git commit status updates, and the Prometheus metrics that tell you an estate is healthy.
Topics: Provider and Alert resources · Event severity and object filtering · Slack, Teams, generic webhook and Git commit status providers · Receiver resources and webhook tokens · Suspending noisy alerts · Controller metrics and readiness · Grafana dashboards for reconciliation health · flux events and flux logs
Running Flux for an organisation. Tenant isolation through namespaces and impersonation, cross-namespace reference restrictions, secret management with SOPS or External Secrets, sharding and scale, and the troubleshooting workflow that resolves most incidents.
Topics: Tenant namespaces and serviceAccountName impersonation · Disabling cross-namespace references · Remote cluster reconciliation with kubeConfig · SOPS with age and cloud KMS · External Secrets and Sealed Secrets compared · Vertical and horizontal scaling of controllers · flux trace, flux diff and reconcile on demand · Upgrade path and CRD migration
We rebuild the agenda around the tools you actually run.
Request a custom agendaBootstrap a cluster from an empty repository, then upgrade the Flux version by committing a change and nothing else.
Deliver the same workload from a GitRepository and from an OCIRepository published by CI, then compare revision semantics and verification.
Build CRD, infrastructure and application layers with health checks and dependsOn so a cold start converges in a guaranteed order.
Run a chart through helm-controller with drift detection, then edit the live release by hand and watch correction and remediation behave.
Chain ImageRepository, ImagePolicy and ImageUpdateAutomation to promote a semver tag into dev automatically and into production by pull request.
Deliver a multi-tenant Flux estate with impersonated service accounts, SOPS-encrypted secrets, alerting, and an onboarding runbook for a third team.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Helped to understand more on overall DevOps concepts.
Got good lab sessions which kept the new DevOps tool learnings to the point and it helped a lot in my career.
Great learning experience from a very knowledgeable instructor with well-prepared course notes. The lab exercises on AWS instance work well to learn the hands-on side of the course.
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
The trainer (Rajesh) provided very good sessions on SRE profession. Not only hands-on learning on the tools but also SRE mindset.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.