Cloud & DevSecOps training at Simplon.co
Trained in Toulouse, specialising in Azure. This organization gathers every project built along the way: four capstone projects and thirty-two hands-on labs, grouped below by the skill they demonstrate rather than by the tool they happen to use.
End-to-end work, specified and delivered alone, closing each phase of the programme.
| Project | Stack | What it demonstrates |
|---|---|---|
| capstone-aks-gitops-platform | A full Azure platform: Entra ID identity access, AKS with remote Velero backups, and zero credentials stored in Git or Kubernetes. | |
| capstone-quiz-frontend | Angular 22 app for revising Azure certifications, by module or mock exam, on Static Web Apps. | |
| capstone-quiz-backend | Spring Boot 3.5 REST API on Java 21, with a Redis cache and result export to Blob Storage. | |
| capstone-quiz-infrastructure | Private network, PostgreSQL, Redis, Key Vault and App Service, applied by pipeline through OIDC. |
Describing infrastructure in version-controlled code rather than clicking through a portal.
| Project | Stack | What it demonstrates |
|---|---|---|
| azure-compute-comparison | Choosing between three Azure compute platforms for a company's future API, with the trade-offs written down. | |
| azure-compute-bicep | Linux VM, autoscaling scale set behind a load balancer, App Service with a staging slot, deployed as deployment stacks. | |
| azure-terraform-migration | Rebuilding a hand-made az CLI infrastructure as Terraform code, for versioned and repeatable management. | |
| azure-network-hardening | Designing and securing an isolated network architecture, segment by segment. | |
| azure-files-smb-secure | An SMB file share restricted to a single IP and protected by Azure Backup, operated through a Makefile. | |
| azure-blob-storage-cli | Private and public containers, SAS URLs and redundancy options, driven entirely from the az CLI. | |
| terraform-gitlab-managed-state | Importing an existing resource into state, migrating the backend, and proving that locking works. | |
| openstack-devstack-on-azure | A self-hosted cloud: Terraform builds the host, Ansible installs DevStack, one command demos it end to end. |
Getting code from a commit to a running environment without a human holding a secret.
| Project | Stack | What it demonstrates |
|---|---|---|
| git-pull-request-workflow | Branching, pull requests and review workflow as a team would run them. | |
| github-actions-basics | First pipelines: triggers, jobs and collaboration workflows on GitHub. | |
| azure-container-apps-oidc-cd | Continuous deployment of a Flask app to Container Apps, authenticated with OIDC and no stored secret. | |
| aks-gitlab-ci-microservices | Three Go services built into one distroless image, pushed to Azure Container Registry, one tag per commit. | |
| aks-helm-gitlab-cd |  |
The deployment half: a Helm chart shipped to AKS by pipeline, load balancer restricted to a single CIDR. |
| azure-logging-api-gitlab-ci | A containerised logging API delivered fully as code, infrastructure and application in the same pipeline. | |
| github-runner-on-azure | A self-hosted GitHub Actions runner on an Azure VM, provisioned with Terraform, configured with Ansible and benchmarked against GitHub-hosted runners. | |
| gitlab-runner-on-azure |  |
An AKS cluster hosting GitLab CI runners, watched end to end: VictoriaMetrics, VictoriaLogs, alerts, Velero backups and SLOs, all deployed by ArgoCD. |
Surviving a node loss, a zone loss, or a bad afternoon.
| Project | Stack | What it demonstrates |
|---|---|---|
| k8s-ha-multi-zone | Nine nodes across three zones, strict anti-affinity and rolling updates, stress-tested with Siege during simulated zone failures. | |
| k8s-resource-limits-quotas | Per-container requests and limits, plus a LimitRange and a ResourceQuota to cap namespace consumption. | |
| k8s-velero-minio-backup |  |
Backup and restore with Velero, storing the backups in MinIO deployed inside the cluster. |
| aks-velero-azure-backup | The same discipline on managed AKS: backups in Blob Storage, Velero authenticated through Workload Identity. |
Knowing what the system is doing before a user tells you.
| Project | Stack | What it demonstrates |
|---|---|---|
| azure-observability-terraform | Log Analytics, Application Insights, alerts, availability tests and workbooks, all shipped as Terraform modules. | |
| azure-prometheus-grafana | App Insights traces and managed Prometheus metrics unified in one Grafana dashboard, with email alerting. | |
| prometheus-node-exporter-grafana | Host metrics scraped in pull mode from node_exporter, with hardened containers and nothing exposed beyond loopback. | |
| aks-prometheuse-grafana | The same stack on AKS from raw manifests, no Helm chart, no operator, kept in sync by ArgoCD instead of kubectl. | |
| datadog-observability-certifications |  |
Course completion certificates from the Datadog Learning Center, kept as proof of the observability training followed. |
Packaging an application, then running it across a cluster.
| Project | Stack | What it demonstrates |
|---|---|---|
| docker-go-multistage | A multi-stage Dockerfile and a /healthz endpoint wired to the container healthcheck. | |
| docker-go-api-haproxy | A Gin REST API on MongoDB, scaled across replicas behind an HAProxy load balancer. | |
| k8s-kind-getting-started | A first local cluster: three nginx replicas exposed to the host through a Service. | |
| k8s-go-microservices | Gateway, books and movies services from a single image, only the gateway exposed. | |
| aks-mongodb-azure-files | Stateful workloads on AKS, backed by Azure Files NFS persistent storage. | |
| aks-cluster-access-hardening | Entra ID groups mapped to cluster roles, an API server locked to one IP range, and namespace quotas on a cluster that started out wide open. | |
| aks-operators-prometheus-certmanager | Extending Kubernetes with operators: Prometheus Operator and cert-manager on AKS, driven through custom resources. |
