Private corporate batches, live online cohorts and 1-on-1 mentoring in dynamic reverse proxy and ingress — providers, routers, middleware chains and automatic TLS — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Traefik around its routing model rather than around a sample docker-compose file: entry points, router rule syntax and priority resolution, the ordered middleware chain, and services with their load-balancing, health-check and sticky-session behaviour — with the static and dynamic configuration split made explicit from the first session. Sessions cover every provider a team is likely to use, ACME certificate resolvers across HTTP-01, TLS-ALPN-01 and DNS-01 including wildcards, mutual TLS and TLS options, Kubernetes ingress through both the IngressRoute CRDs and the Gateway API, TCP and UDP routing with SNI, and canary and mirrored traffic. Debugging is taught from access logs, Prometheus metrics and the dashboard against live traffic.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Traefik that means a trainer who has run it in production — dynamic reverse proxy and ingress — providers, routers, middleware chains and automatic TLS — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Traefik batchTraefik is a reverse proxy and load balancer that writes its own configuration. Instead of a static file that an engineer edits and reloads, Traefik watches providers — the Docker socket, Docker Swarm, the Kubernetes API through Ingress, the IngressRoute custom resources or the Gateway API, plus Consul, Nomad, ECS, etcd, Redis and plain files — and rebuilds its routing table live as services appear, scale and disappear. Configuration is split deliberately into static configuration, which defines entry points, providers and cluster-level settings and requires a restart, and dynamic configuration, which defines routing and is reloaded continuously.
The routing model is four objects deep and worth learning precisely, because almost every Traefik problem is a misunderstanding of one of them. An entry point is a listening socket — a port and protocol. A router matches incoming requests with a rule expression built from Host, PathPrefix, Path, Headers, Method, Query and ClientIP matchers combined with logical operators, and a priority that decides which router wins when several match. Between the router and its destination sits an ordered middleware chain, and a service describes the actual back ends, their load-balancing strategy, health checks, sticky sessions and weighting.
Middleware is where most real behaviour lives: stripPrefix for path rewriting, redirectScheme, headers for security and CORS, basicAuth and forwardAuth for delegated authentication, rateLimit, circuitBreaker and retry for resilience, compress and ipAllowList. TLS is first-class: Traefik obtains and renews Let's Encrypt certificates itself through HTTP-01, TLS-ALPN-01 or DNS-01 challenges, and TLS options control minimum version, cipher suites and mutual TLS. Beyond HTTP it routes raw TCP by SNI and UDP by port, and exposes access logs, Prometheus metrics and OpenTelemetry tracing.
The front door became a moving target. When back ends were a fixed list of servers, a hand-maintained NGINX or HAProxy configuration was reasonable. Once services are scheduled by an orchestrator, scale on demand and change addresses several times a day, any configuration a human edits is stale before it is committed — which is why the proxy layer moved from static files to controllers that read the platform's own state.
Traefik sits at that junction in a large number of estates. It is the default ingress controller in K3s, a standard choice in mid-size Kubernetes clusters, and by far the most common edge proxy in Docker and Docker Swarm deployments because a container can declare its own routing through labels. That breadth means the skill transfers: the same router, middleware and service model applies whether the provider is a Docker socket or the Kubernetes API.
The demand, as usual, is for depth rather than a first success. Getting one service reachable over HTTPS takes an afternoon. What organisations hire for is the rest: middleware chains that authenticate and rate-limit correctly, TLS with DNS-01 challenges and wildcard certificates behind a firewall, mutual TLS between tiers, weighted and mirrored routing for progressive delivery, priority rules that resolve overlapping hosts, and the ability to explain from access logs and the dashboard why a request went somewhere unexpected.
The mental model everything else depends on. What a dynamic reverse proxy has to do that a static one does not, then the four objects — entry point, router, middleware, service — and the static versus dynamic configuration split that causes most early confusion. An honest comparison with NGINX, HAProxy and Envoy.
Topics: What a reverse proxy, load balancer and ingress controller each do · Entry points, routers, middlewares and services · Static configuration versus dynamic configuration · Configuration formats: TOML, YAML, labels, annotations and CRDs · How providers feed the dynamic configuration · Traefik compared with NGINX, HAProxy and Envoy · Installing Traefik: binary, container, Helm chart · The dashboard and API as diagnostic tools
How Traefik discovers what to route. The Docker and Docker Swarm providers with their label syntax, constraints and network selection; the file provider for everything the platform cannot express; and key-value providers for configuration held outside the workload. Provider precedence when several are enabled at once.
Topics: The Docker provider: socket access, labels and exposedByDefault · Choosing the right network when a container has several · The Docker Swarm provider and service-level labels · The file provider: single file, directory and hot reload · Consul, Nomad and ECS providers · Key-value providers: etcd, Redis, ZooKeeper · Constraints and provider namespaces · Running multiple providers and resolving conflicts · Securing access to the Docker socket
Getting requests to the right place, deterministically. The full rule syntax and its matchers, how priority is calculated and overridden, entry-point binding, and then services: load-balancing across servers, health checks, sticky sessions, weighted round robin, mirroring and failover.
Topics: Rule matchers: Host, HostRegexp, Path, PathPrefix, PathRegexp, Headers, Method, Query, ClientIP · Combining matchers with logical operators and grouping · Router priority: the default calculation and explicit overrides · Binding routers to specific entry points · Services and server lists · Load-balancing strategies and passHostHeader · Active and passive health checks · Sticky sessions and cookie configuration · Weighted round-robin services for canary traffic · Mirroring services for shadow traffic · Failover services
The ordered chain between a router and its service, which is where most production behaviour actually lives. Path manipulation, redirects, authentication including delegated forwardAuth, resilience with rate limiting, retries and circuit breakers, and the security headers that belong on every public route.
Topics: Middleware ordering and chaining · stripPrefix, stripPrefixRegex, addPrefix and replacePath · redirectScheme and redirectRegex · headers: security headers, CORS and custom request headers · basicAuth, digestAuth and forwardAuth · Integrating an external identity provider through forwardAuth · rateLimit and inFlightReq · retry and circuitBreaker expressions · compress, buffering and errors pages · ipAllowList and ipWhiteList migration · Middleware in Kubernetes: the Middleware CRD and cross-namespace references
Transport security that renews itself. ACME certificate resolvers and the three challenge types, including DNS-01 for wildcard certificates and for services with no inbound path from the internet. Then TLS options, default certificates, SNI behaviour, and mutual TLS for service-to-service authentication.
Topics: ACME certificate resolvers and the acme.json store · HTTP-01, TLS-ALPN-01 and DNS-01 challenges compared · Wildcard certificates and DNS provider integrations · Certificate storage, permissions and persistence across restarts · Multiple resolvers and per-router certificate selection · Bringing your own certificates through the file provider · TLS options: minimum version, cipher suites and curve preferences · Default certificate and SNI strict mode · Mutual TLS with clientAuth and CA bundles · HTTP to HTTPS redirection at entry-point level · Rate limits and staging environments when testing with Let's Encrypt
The provider most teams end up on. Deploying Traefik with the Helm chart and the RBAC it needs, then the three routing surfaces — the standard Ingress resource, Traefik's own IngressRoute CRDs, and the Gateway API — with a clear account of what each can and cannot express, and how to move between them.
Topics: Deploying Traefik with the Helm chart; DaemonSet versus Deployment · IngressClass, RBAC and the service account · The Kubernetes Ingress provider and Traefik annotations · IngressRoute, IngressRouteTCP and IngressRouteUDP CRDs · TraefikService for weighted and mirrored routing · ServersTransport for back-end TLS and connection settings · The Kubernetes Gateway API provider: GatewayClass, Gateway, HTTPRoute · Middleware and TLSOption as namespaced resources · Exposing Traefik: LoadBalancer, NodePort, hostPort and externalTrafficPolicy · Cert-manager alongside or instead of the ACME resolver · Progressive delivery: canary weighting and traffic mirroring in a cluster
Everything beyond HTTP, and everything needed to run Traefik as supported infrastructure. SNI-based TCP routing and UDP routing, then access logs, Prometheus metrics, OpenTelemetry tracing, dashboard and API exposure, high availability, and the migration path from an existing NGINX or HAProxy edge.
Topics: TCP routers and SNI-based rules, including HostSNI(`*`) · TLS passthrough versus termination · UDP routers and their constraints · Access logs: formats, fields, filtering and correlation · Prometheus metrics and the dashboards worth building · OpenTelemetry tracing and propagation to back ends · Securing the dashboard and API in production · Running Traefik highly available and sharing ACME state · Resource limits, connection tuning and graceful shutdown · Upgrading across major versions and the v2 to v3 changes · Migrating an existing NGINX or HAProxy edge onto Traefik
We rebuild the agenda around the tools you actually run.
Request a custom agendaPublish containers through Docker labels alone, scale one to three replicas, and watch the routing table and load balancer update with no configuration edit.
Construct deliberately overlapping router rules across hosts and path prefixes, predict which one matches, then prove it and correct the order with priority.
Build an ordered chain that strips a prefix, delegates authentication through forwardAuth, rate limits per client and adds security headers — then break the order deliberately.
Issue and renew a wildcard certificate with a DNS-01 challenge for services with no inbound internet path, then enforce mutual TLS on an internal route.
Express the same route three ways in a cluster, then add canary weighting and traffic mirroring that only the CRD and Gateway API versions can support.
Deliver a highly available Traefik edge with automated TLS, a middleware library, Prometheus metrics, OpenTelemetry tracing and a secured dashboard — then diagnose an injected misroute from logs alone.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Basics explanation was exemplary from Rajesh where he dealt with complicated topics to be simple. Great learning stuff personally for me.
Very detailed explanation and has lots of patience in attending the questionnaire. Thanks again for your wonderful sessions.
Good discussion, helped us to understand different tools in SRE.
Got good lab sessions which kept the new DevOps tool learnings to the point and it helped a lot in my career.
I took Terraform training with the tutor named Mithilesh. I requested to tailor the course curriculum for my needs. He did an excellent job of showing me how to write the Terraform script per the instructions provided.
My experience with the AIOps training was positive. The course covered important topics in a structured way, and Rajesh Kumar explained the concepts patiently. I found the practical aspects particularly helpful because they made the technical content easier to understand.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.