Focused, hands-on problems for sharpening your DevOps and server-side skills. Some teach specific concepts while others mirror real-world scenarios. Every challenge includes hints, feedback, and automated solution checks.
The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.
The production Kubernetes cluster lives inside a private VPC, and its API server has no public endpoint. Turn an SSH connection to the bastion host into a SOCKS proxy and teach kubectl to use it, so the cluster becomes manageable from your workstation.
Add a new, separate Service CIDR range for the dev team using the ServiceCIDR API object — without touching or restarting the cluster's default Service CIDR — then create a Service with an explicit ClusterIP inside that new range and verify DNS resolution.
Configure a Kubernetes Service so that requests from the same client IP are always routed to the same backend Pod for a sustained period, using ClientIP-based session affinity.
An inventory service lives inside a private VPC and keeps its debugging port bound to 127.0.0.1. Use SSH local port forwarding with a jump-only bastion to query the debugging port from your workstation.
The application fleet lives inside a private VPC, reachable only through a locked-down bastion that refuses to give you a shell. Find a way to jump through the bastion and place a maintenance lock on two misbehaving servers.
A production search cluster lives inside a private VPC and is reachable only from within it. Use SSH local port forwarding through a public-facing bastion host to query the cluster's API from your dev machine.
A payment webhook receiver runs as a local build on your dev machine, bound to 127.0.0.1 and invisible from the Internet. Use SSH remote port forwarding to publish it on a public-facing gateway VM so a test payment provider can reach it.
A status dashboard runs on an isolated device in your home network, with no inbound route from the Internet. Use SSH remote port forwarding with your workstation as a jump host to publish it on a public-facing gateway VM.
Several self-hosted services run on isolated devices in your home network, with no inbound route from the Internet. Use SSH dynamic remote port forwarding to turn a public-facing gateway VM into a single SOCKS proxy that reaches all of them.
