Workshop Roadmap

Exercise Map

#	Exercise	Type	Est. Time	Status
01	Bootstrap ArgoCD	Core	30 min	✅ Implemented
02	Deploy podinfo via GitOps	Core	30 min	✅ Implemented
03	MetalLB + Ingress-Nginx (LAN exposure)	Core	45 min	✅ Implemented
03b	Cloudflare Tunnel voor webhooks	Bonus	30–45 min	✅ Implemented
04	Tekton pipeline (image tag bump → GitOps loop)	Core	45 min	✅ Implemented
05	App upgrade via GitOps	Core	15 min	✅ Implemented
06	Monitoring: Prometheus + Grafana	Bonus	60 min	✅ Implemented

Total core: ~2.5–3h. Beginners may stop after Exercise 03 (~1h45m).

Model: solution branches are standalone per exercise (not cumulative).

Branch	State
`solution/01-argocd-bootstrap`	ArgoCD running, root app applied
`solution/02-deploy-podinfo`	podinfo synced via ArgoCD
`solution/03-metallb-ingress`	MetalLB + Ingress-Nginx + podinfo reachable on LAN; CRD `caBundle` drift handling included
`solution/03b-cloudflare-tunnel`	Cloudflared tunnel connector manifests met token placeholders
`solution/04-tekton-pipeline`	Full Tekton GitOps loop working
`solution/05-app-upgrade`	deployment.yaml bumped to 6.7.0
`solution/06-monitoring`	Prometheus + Grafana running

Exercise	Smoke-tested
01	✅ Validated (clean VM + bootstrap + root sync)
02	✅ Validated (podinfo app deploy + healthy)
03	✅ Validated (MetalLB + ingress + podinfo URL reachable)
04	✅ Validated after hardening fixes (PSA patch + pipeline runtime fixes)
05	✅ Validated (upgrade/drift workflow over working 04 stack)
06	✅ Validated (Prometheus/Grafana app healthy + Grafana ingress reachable)

Full end-to-end test: completed on ops-demo-tryout from clean baseline through 01–06.

End-to-end smoke test executed in clean tryout environment (vagrant destroy && vagrant up).
Exercise 04 hardening to make tutorial reproducible:
- Tekton namespace PodSecurity patch (pod-security.kubernetes.io/enforce=privileged)
- pipeline validate step switched to pure client-side kubectl create --dry-run=client
- clone task now ensures workspace writeability for later task images (chmod -R a+rwX .)
- git clone/push switched to HTTP auth header flow (no URL credential embedding)
Exercise 04 docs clarified with explicit PSA semantics and workshop trade-offs.
Assignment clarity improvements across docs/01..06:
- every shell snippet clearly marked as VM or HOST
- removed large per-page top callout blocks; context now lives at snippet level
Exercise 03 docs expanded with practical explanation around MetalLB manifests and key Kubernetes terms.
Exercise 04 docs expanded with:
- explicit mandatory credential step before PipelineRun
- clear distinction between Argo wrapper manifest vs full Tekton pipeline manifest
- Tekton Dashboard + ingress walkthrough
scripts/vm/set-git-credentials.sh now prints a context-correct PipelineRun path (/vagrant/... fallback included).
Earlier branch-level fixes remain in place:
- root recursive discovery
- MetalLB CRD caBundle drift handling
- Tekton empty kustomize drift fix in solution flow