Private corporate batches, live online cohorts and 1-on-1 mentoring in Kubernetes-native CI/CD built entirely from custom resources — Tasks, Pipelines, Triggers and signed supply-chain provenance — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Tekton as Kubernetes first and CI second — Tasks and Pipelines as custom resources you can inspect, secure and quota like any other workload, with params, results and workspaces as the three things that decide whether a Pipeline composes or fights you. Sessions cover rootless image builds with Buildah and Kaniko instead of a mounted Docker socket, ServiceAccount and annotated-secret credential flow for Git and registries, Triggers with interceptors turning webhooks into PipelineRuns, Tekton Chains for signed provenance, and the operational realities: pruning, remote resolvers, affinity assistant behaviour and debugging a PipelineRun stuck in Pending.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Tekton that means a trainer who has run it in production — Kubernetes-native CI/CD built entirely from custom resources — Tasks, Pipelines, Triggers and signed supply-chain provenance — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Tekton batchTekton is a CI/CD framework that runs entirely inside Kubernetes and is defined entirely by Kubernetes custom resources. There is no controller process to install on a VM, no plugin catalogue and no separate configuration database. A Task is a CRD listing ordered Steps, and each Step is a container. A TaskRun is the object that actually executes one, and Kubernetes schedules it as a single Pod with one container per Step. A Pipeline composes Tasks into a graph, and a PipelineRun executes it. If you can operate Kubernetes, you already know how to inspect, secure, quota and audit a Tekton build, because it is all just workloads and RBAC.
The primitives that carry real weight are params, results and workspaces. Params make a Task reusable; results let one Task emit a value that a later Task consumes, which is how a Pipeline becomes a graph rather than a list; and workspaces bind storage — a PVC, an emptyDir, a ConfigMap or a Secret — at run time rather than in the Task definition, so the same Task works whether it needs a shared volume or a mounted credential. Around those sit when expressions for conditional execution, matrix for fan-out, finally for teardown that runs regardless of outcome, retries, timeouts and sidecars.
Tekton is deliberately unopinionated about the layers above. Triggers — EventListener, TriggerBinding, TriggerTemplate and interceptors — turn a Git webhook into a PipelineRun. Pipelines as Code puts pipeline definitions in a .tekton directory in the application repository. Tekton Chains observes completed runs and produces signed, in-toto provenance attestations, which is why Tekton has become the common substrate for SLSA-aligned supply chain work. Tekton Results stores run history beyond the cluster's retention, the Dashboard and the tkn CLI provide the human interface, and Red Hat's OpenShift Pipelines is the most widely deployed commercial distribution.
Every organisation that standardised on Kubernetes eventually asks why its build system is a separate estate with its own servers, its own credentials, its own access model and its own upgrade cycle. Tekton is the answer that removes the second estate: builds become workloads, access becomes RBAC, isolation becomes namespaces and quotas, and the audit trail is the same one the cluster already produces.
The second driver is software supply chain security. Regulators and large customers now ask where an artifact came from, what built it and whether that can be verified. Tekton Chains generates signed provenance for every run without pipeline authors writing anything, which makes SLSA-level claims achievable rather than aspirational. That has pulled Tekton into organisations that had no particular interest in changing CI systems.
The skills gap is specific. Teams can write a Task; far fewer can design workspaces so a Pipeline does not deadlock on a single-writer volume, get git and registry credentials into a run through the right ServiceAccount, build images without a privileged Docker socket, keep TaskRun objects from accumulating until etcd suffers, or debug a PipelineRun that is stuck Pending because of an affinity assistant. That gap is what training is bought to close.
Why Tekton is a set of CRDs rather than an application. The object model — Task, TaskRun, Pipeline, PipelineRun — how a TaskRun becomes a Pod with one container per Step, and an honest comparison against running a conventional CI server alongside a cluster.
Topics: The CRD-based object model · Task, TaskRun, Pipeline, PipelineRun · How Steps become containers in one Pod · Installing Tekton Pipelines and the Operator · OpenShift Pipelines as a distribution · tkn CLI and the Dashboard · Where Tekton is the wrong choice
The unit of work in depth. Ordered steps, images and commands, script blocks, parameters with defaults and types, emitting results for downstream consumption, sidecars, and the entrypoint rewriting that makes step ordering work.
Topics: Steps, images, command, args and script · Params: string, array and object types · Results and how they are emitted · Step and Task resource requests · Sidecars for services a step needs · StepActions and reusable step definitions · Environment, env-from and step templates · Timeouts and step-level failure behaviour
The primitive that causes most Tekton failures. Binding storage at run time rather than definition time, choosing between emptyDir, PVC and volumeClaimTemplate, mounting ConfigMaps and Secrets as workspaces, and the affinity assistant behaviour that decides whether parallel tasks can share a volume.
Topics: Declaring and binding workspaces · emptyDir vs PVC vs volumeClaimTemplate · ConfigMap and Secret workspaces · Optional workspaces · The affinity assistant and node placement · Parallel tasks sharing a single-writer volume · subPath and workspace isolation · Diagnosing a PipelineRun stuck Pending on storage
Composing Tasks into delivery. Ordering with runAfter and result dependencies, referencing versus embedding task specs, conditional execution with when expressions, matrix fan-out, finally tasks that always run, and retries and timeouts at pipeline level.
Topics: taskRef vs taskSpec · runAfter and implicit ordering through results · when expressions and conditional tasks · matrix for fan-out · finally tasks and guaranteed teardown · Pipeline-level params, results and workspaces · Retries, timeouts and cancellation · Custom tasks and the Run interface
The part that is genuinely different in Kubernetes-native CI. Building container images without a privileged Docker socket, using Buildah, Kaniko or ko; registry and Git credentials through ServiceAccounts and annotated secrets; and the catalog Tasks worth reusing instead of rewriting.
Topics: Why the Docker socket is the wrong answer · Buildah, Kaniko and ko compared · Rootless builds and required capabilities · ServiceAccounts and annotated secrets for Git and registries · imagePullSecrets and private base images · git-clone, buildah and skopeo-copy catalog Tasks · Tekton Hub and Artifact Hub · Image digests and immutable references
Getting from a Git event to a PipelineRun. EventListener, TriggerBinding and TriggerTemplate; interceptors for GitHub, GitLab, Bitbucket and CEL filtering; securing the webhook sink; and Pipelines as Code, which puts pipeline definitions in the application repository.
Topics: EventListener and the event sink · TriggerBinding and TriggerTemplate · ClusterTriggerBinding and reuse · GitHub, GitLab and Bitbucket interceptors · CEL interceptors for filtering · Webhook secrets and sink exposure · Pipelines as Code and the .tekton directory · Pull request status reporting
Provenance without asking pipeline authors to do anything. How Chains observes completed TaskRuns, what an in-toto attestation contains, signing with Sigstore and cosign including keyless flows, storing and verifying attestations, and what SLSA levels actually require.
Topics: What Tekton Chains observes and emits · in-toto attestations and SLSA provenance · Signing with cosign and Sigstore · Keyless signing and Fulcio/Rekor · Attestation storage backends · Verifying provenance before deployment · Policy enforcement with admission control · SBOM generation in a pipeline
Running it for an organisation rather than a demo. Namespace and RBAC design, resource quotas, pruning run history before etcd suffers, remote resolution so Tasks are not copy-pasted into every namespace, Tekton Results for long-term history, and debugging runs that will not start.
Topics: Namespace, RBAC and ServiceAccount design · ResourceQuota and LimitRange for build workloads · Pruning TaskRuns and PipelineRuns · Remote resolvers: git, hub and bundles · Tekton Bundles as OCI-packaged Tasks · Tekton Results for long-term run history · config-defaults and feature flags · Debugging Pending, unschedulable and stuck runs · Upgrades and CRD version migration
We rebuild the agenda around the tools you actually run.
Request a custom agendaWrite a Task from raw YAML, run it, then trace it down to the Pod, containers and volumes Kubernetes actually created — the fastest way to build a correct mental model.
Reproduce a PipelineRun that hangs on a ReadWriteOnce claim with parallel tasks, then fix it with the right workspace binding and affinity behaviour.
Build and push a container image with Buildah using no privileged container and no Docker socket, with private Git and registry credentials via one ServiceAccount.
Stand up an EventListener with a GitHub interceptor and CEL filtering, secure the sink, and report the result back onto the pull request.
Enable Tekton Chains, inspect the in-toto attestation, verify the signed image at deploy time, and watch an unsigned image get rejected.
Deliver a multi-team Tekton platform with namespace RBAC, quotas, pruning, a git-resolved Task library and a documented upgrade path.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Helped to understand more on overall DevOps concepts.
Got good lab sessions which kept the new DevOps tool learnings to the point and it helped a lot in my career.
Basics explanation was exemplary from Rajesh where he dealt with complicated topics to be simple. Great learning stuff personally for me.
Very detailed explanation and has lots of patience in attending the questionnaire. Thanks again for your wonderful sessions.
Good discussion, helped us to understand different tools in SRE.
I took Terraform training with the tutor named Mithilesh. I requested to tailor the course curriculum for my needs. He did an excellent job of showing me how to write the Terraform script per the instructions provided.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.