Curated
The documentation actually worth bookmarking, the repositories worth reading, and a path through them that does not assume you already know the answer.
Four stages, in order. The durations assume a few focused hours a week alongside a job — treat them as a sanity check, not a deadline.
You’ll be able to: explain what a container is at the kernel level, write a cache-efficient multi-stage Dockerfile, and publish a multi-architecture image.
You’ll be able to: deploy and expose an application, read a failing pod’s events and logs to a root cause, and choose the right controller for a workload.
You’ll be able to: package an application as a chart that works across environments, and ship it through a pipeline that builds, scans, signs, and deploys.
You’ll be able to: run workloads safely: least-privilege RBAC, hardened pods, meaningful SLOs, and an on-call runbook you would trust at 3am.
Primary sources only. When a blog post and the official docs disagree, the docs are usually right and always more current.
Start with Concepts, not the Tasks section — the mental model saves far more time.
The specifications are shorter and more readable than most people expect.
Two competing philosophies — templating versus overlays. Learn both, pick per project.
For working out what a project actually does before you adopt it.
Reading production code is the fastest way past the tutorial plateau. Each entry includes a concrete place to start rather than “browse the repo”.
The project itself. Enormous, but the controller implementations are surprisingly readable and are the definitive answer to “what does this actually do?”.
Start with: pkg/controller/deployment — the rollout logic described in every tutorial, in code.
The framework and book for building your own controllers. Writing one operator teaches more about how Kubernetes works than months of using it.
Start with: The Kubebuilder Book’s CronJob tutorial, start to finish.
The reference OCI runtime. Small enough to read end to end, and it is where containers are literally created.
Start with: libcontainer/ — the namespace and cgroup setup, and nsexec.c for the clone dance.
A CNCF graduated runtime with a genuinely clean plugin architecture. A good model for how to structure a large Go daemon.
Start with: docs/ then the CRI plugin under internal/cri.
Shows how rendering, release storage, and the three-way merge upgrade strategy actually work — which explains most surprising Helm behaviour.
Start with: pkg/action/upgrade.go
An exemplary Go codebase. The TSDB implementation is a genuinely good storage-engine tutorial in its own right.
Start with: tsdb/docs/format/ — the on-disk format, documented properly.
Networking, observability, and security implemented with eBPF instead of iptables. The best entry point into kernel-level networking.
Start with: Documentation/ then bpf/ for the datapath programs.
Not code, but the easiest place to make a first meaningful open source contribution — and reviewers are patient with newcomers.
Start with: The “good first issue” label on the issue tracker.