About this course
Design and build scalable cloud applications by choosing the right compute, storage, networking, and managed-service patterns for each workload.
Course format. Thirteen weeks, four contact hours each: a two-hour lecture (concepts and theory) and a two-hour practice session. The course is project-based; teams carry one running project end to end and present it three times, in weeks 5, 8, and 13.
What you will build
Design and build a cloud-native application with a REST API layer, durable relational storage, object storage, asynchronous worker queues, a caching layer and CDN, and complete Infrastructure-as-Code provisioning using Terraform, Helm, Ansible, and ArgoCD. Load-test the system and document scalability, reliability, and cost evidence with Prometheus and Grafana dashboards tied to defined service-level objectives.
Expected outcomes
- Design multi-region, multi-AZ cloud architectures that align service abstractions (IaaS, PaaS, FaaS, containers) with workload requirements for latency, scale, and operational burden, and correctly assign shared-responsibility boundaries across each service tier.
- Provision cloud infrastructure declaratively with Terraform, package and promote Kubernetes workloads with Helm, implement GitOps continuous delivery with ArgoCD, and automate day-2 configuration management with Ansible.
- Configure cloud and hybrid networking with tiered subnet design, private service endpoints, and transit routing; enforce identity and access control with IAM roles, federated identity (SAML/OIDC), permission boundaries, and dynamically issued secrets with automatic expiry.
- Build stateless, horizontally scalable services with externalized session state, readiness and liveness probes, and target-tracking or predictive auto-scaling policies; optimize cost with mixed on-demand and spot pools, commitment-based discounts, and mandatory resource tagging for cost attribution.
- Deploy Istio to automate mutual-TLS between services, configure traffic weight splitting for canary and blue/green releases, and enforce circuit-breaking with outlier detection to limit failure blast radius.
- Instrument production services with Prometheus and Grafana dashboards tied to SLOs, maintain the internal service catalog with Backstage, and produce load-test evidence and post-incident cost analysis to defend architecture decisions.
Key topics
- Compute options
- Cloud storage choices
- Scalable application design
- Cloud architecture patterns
Theoretical foundations
The concepts and results this course rests on.
- Cloud service models and fault domains: IaaS, PaaS, SaaS, and FaaS spectrum; region and availability-zone blast-radius isolation; geographic latency trade-offs; and multi-AZ redundancy design
- Configuration management and day-2 operations: idempotent automation playbooks, role-based task organization, dynamic inventory discovery from cloud provider APIs, and agentless remote configuration via cloud-native session management
- Service mesh data-plane and control-plane: sidecar proxy injection, xDS dynamic service discovery, automatic mutual-TLS between services, circuit-breaking with outlier detection, and traffic weight splitting for canary and blue/green releases
- Cloud compute abstraction depth: virtual machines, pod-orchestrated containers, serverless functions, and managed runtimes matched to workload latency, scale, and operational burden
- Cloud and hybrid networking: public, private, and isolated subnet tiers; stateful inspection versus stateless ACLs; centralized transit routing across networks and regions; dedicated hybrid circuits; and private service endpoints without public-IP exposure
- Cloud shared responsibility model: provider secures physical infrastructure, hypervisor, and managed services; customer owns data classification, IAM policies, OS patching, encryption key management, and network ACL configuration
- Identity, access management, and secrets: IAM roles, permission boundaries, organization-wide service control policies, federated identity (SAML/OIDC), dynamic credential issuance with automatic expiry, and envelope encryption for secrets co-located with IaC code
- Infrastructure-as-Code and GitOps delivery: declarative state management, idempotent plan-and-apply cycles, reusable module composition, multi-cluster GitOps templating, and analysis-driven canary and blue/green progressive promotion
- Stateless service design and horizontal scaling: session externalization to distributed caches, readiness and liveness probes, auto-scaling policies (target tracking, scheduled, predictive), and mixed on-demand and spot instance pools for cost efficiency
- Cloud FinOps and compute architecture optimization: commitment-based discount mechanics (reserved capacity versus on-demand versus spot), cost attribution via mandatory resource tagging and chargeback dashboards, and heterogeneous-architecture builds for compute cost savings
Prerequisites
This is a Year-3 course. It assumes the mandatory CS core: data structures and algorithms, operating systems, computer networks, databases, software engineering, and the core mathematics (linear algebra, probability and statistics, calculus, discrete mathematics). It additionally requires the specific prior courses listed below.
Course-specific prerequisites:
- Operating systems and computer networks
- Software engineering and a programming language
Weekly schedule 13 weeks · lecture + practice
Foundations
Wk 1
Cloud service models, regions, and fault-domain design
LectureSurvey the IaaS, PaaS, SaaS, and FaaS service-model spectrum; region and availability-zone fault domains; geographic latency trade-offs; multi-AZ redundancy for blast-radius isolation; and the shared-responsibility boundary across each model.
PracticeDocker — build and run a containerized hello-service; compare deploying the same workload as a VM, a managed container service, and a FaaS function and map the operational responsibility of each option.
ProjectProject repository, cloud account, workload scenario, initial architecture diagram, and hello-service running in a container are established.
Wk 2
Cloud compute spectrum: VMs, containers, serverless, and managed runtimes
LectureCompare virtual machines, pod-orchestrated containers, serverless functions, and managed runtimes by startup time, isolation, scaling model, state constraints, cost, and operational burden; match abstraction depth to workload latency, scale, and team capacity.
PracticeDocker and Kubernetes — containerize the API service, push to a registry, deploy to a Kubernetes cluster, and inspect pod scheduling, resource requests, and restart policies.
ProjectCompute decision matrix delivered; core API service runs in a container on a Kubernetes cluster with a clean, layered, reproducible image.
Wk 3
Cloud shared responsibility, IAM, and secrets management
LectureMap the shared-responsibility boundary: provider secures physical infrastructure, hypervisor, and managed services; customer owns IAM policies, OS patching, encryption key management, and network ACL configuration. Cover IAM roles, permission boundaries, org-wide service control policies, federated identity (SAML/OIDC), dynamic credential issuance with automatic expiry, and envelope encryption for secrets co-located with IaC code.
PracticeBackstage — register the project service in the internal developer portal and service catalog; Terraform — write and apply a first infrastructure module that provisions IAM roles, resource groups, and a secrets store with envelope encryption.
ProjectIAM roles and permission boundaries defined; secrets management approach documented and provisioned; project service registered in the Backstage catalog.
Wk 4
Cloud and hybrid networking: subnet tiers, routing, and private endpoints
LectureDesign public, private, and isolated subnet tiers; compare stateful inspection versus stateless ACLs; configure centralized transit routing across networks and regions; plan dedicated hybrid circuits for data-center connectivity; and expose services through private endpoints without public-IP exposure.
PracticeHelm and Kubernetes — package the API deployment as a Helm chart with environment-specific values; configure ingress routing rules aligned with subnet placement; deploy the service into a private subnet with a controlled ingress path.
ProjectNetwork architecture documented; API service deployed into a tiered network with ingress, private storage endpoints, and security group rules.
Architecture Specification
Wk 5
Architecture specification milestonePresentation
LectureReview workload requirements, architecture decision records, security and network boundaries, compute and storage choices, scaling goals, and cost assumptions; discuss common architecture anti-patterns and how to catch them at specification stage.
WorkshopStudent teams present their project architecture specification: service boundaries, network and IAM design, compute and storage choices, scaling goals, reliability targets, and cost budget.
ProjectApproved architecture specification, decision records, network and IAM design, and project implementation plan are delivered.
IaC and Configuration Automation
Wk 6
Infrastructure-as-Code and GitOps delivery pipelines
LectureApply declarative state management, idempotent plan-and-apply cycles, and reusable module composition; design multi-cluster GitOps templating; configure analysis-driven canary and blue/green progressive promotion; and manage configuration drift and rollback.
PracticeTerraform — provision the full project infrastructure (networking, compute, storage) as versioned, modular code; ArgoCD — configure GitOps continuous delivery so every merged commit to the project repository automatically syncs to the Kubernetes cluster.
ProjectAll infrastructure provisioned from versioned Terraform modules; ArgoCD watches the Git repository and keeps the cluster in sync with declared state.
Wk 7
Configuration management and day-2 operations
LectureWrite idempotent automation playbooks with role-based task organization; discover hosts dynamically from cloud provider APIs; configure instances agentlessly via cloud-native session management; detect and remediate configuration drift at scale without agent installation.
PracticeAnsible — write idempotent configuration playbooks for cloud instances; use dynamic inventory to discover provisioned hosts from Terraform outputs; run a drift-check playbook and remediate one intentional configuration change.
ProjectAnsible playbooks automate post-provision instance configuration; dynamic inventory integrates with Terraform state; drift remediation verified with a re-run.
Scalable Design Patterns
Wk 8
Scalable design patterns milestonePresentation
LectureCover stateless service composition, asynchronous worker patterns, cache-aside, materialized views, outbox pattern, saga, bulkhead, retry with exponential back-off, timeout, circuit breaker, and graceful degradation under partial failure.
WorkshopStudent teams demonstrate the working system: API layer, worker queues, storage integration, GitOps delivery, and at least one resilience pattern exercised under simulated failure.
ProjectWorking cloud-native application demonstrated with architecture diagrams, IaC pipeline live, async worker path, and measured resilience behavior under a realistic failure scenario.
Service Mesh and Autoscaling
Wk 9
Service mesh and workload communication
LectureInject sidecar proxies and understand the xDS control-plane protocol for dynamic service discovery; enforce automatic mutual-TLS between every service pair; configure circuit-breaking with outlier detection to isolate failing instances; split traffic by weight for canary and blue/green releases.
PracticeIstio and Helm — inject Istio sidecars into the project namespace, enable cluster-wide mTLS, deploy a canary version of the API service, and configure a 90/10 traffic weight split; use Helm values overrides to manage per-environment mesh settings.
ProjectService mesh deployed; mutual-TLS enforced between all service pairs; canary traffic split active; circuit-breaker policy configured for the worker-to-database path.
Wk 10
Stateless service design and horizontal autoscaling
LectureExternalize session state to distributed caches; define readiness and liveness probes for safe rolling updates; configure target-tracking, scheduled, and predictive auto-scaling policies; design mixed on-demand and spot instance pools to balance cost and availability.
PracticeKubernetes and ArgoCD — configure Horizontal Pod Autoscaler with CPU and custom-metric target tracking; add readiness and liveness probes to the API and worker deployments; use ArgoCD analysis templates to gate progressive promotion on error-rate thresholds.
ProjectAuto-scaling configured for API and worker services; readiness probes prevent traffic routing to unready pods; ArgoCD progressive delivery gates promotion on measured error rate.
Cost and Observability
Wk 11
Cloud FinOps and compute architecture optimization
LectureUnderstand commitment-based discount mechanics: reserved capacity versus on-demand versus spot; attribute cost via mandatory resource tagging and chargeback dashboards; evaluate heterogeneous-architecture builds (ARM versus x86) for compute cost savings; model trade-offs between cost efficiency and availability guarantees.
PracticePrometheus and Grafana — instrument resource utilization metrics (CPU, memory, request rate) and build a cost attribution dashboard that breaks down spend by service tag; identify and document two compute optimization actions from the data.
ProjectMandatory resource tagging applied to all infrastructure; cost attribution dashboard showing per-service spend; initial FinOps optimization recommendations documented with evidence.
Wk 12
Observability, SLOs, and production readiness
LectureDefine service-level objectives and error budgets; configure alert routing and on-call runbooks; apply distributed tracing and structured logging for incident diagnosis; conduct post-incident capacity analysis; complete a production-readiness review checklist.
PracticePrometheus and Grafana — define SLO recording rules, configure alerting rules with error-budget burn thresholds, and build latency and availability dashboards; Backstage — update the service catalog entry with SLO links and runbook references; run a load test and interpret tail-latency results.
ProjectSLO dashboards and alerting rules in place; load-test results documented against latency and throughput targets; production-readiness checklist completed and linked from the Backstage catalog.
Capstone
Wk 13
Final Demo and DefensePresentation
LectureSynthesize cloud architecture decisions across the full stack: compute and storage selection, networking and identity, IaC and GitOps delivery, service mesh, autoscaling, FinOps, and observability; connect each decision back to requirements, reliability targets, and cost constraints.
WorkshopStudent teams present the final demo with an oral defense covering architecture decisions, IaC provisioning, GitOps pipeline, service mesh configuration, auto-scaling evidence, load-test results, SLO dashboards, and cost analysis.
ProjectFinal cloud-native application delivered with architecture documentation, complete IaC provisioning, load-test evidence, SLO dashboards, and oral defense of all design decisions.
AI tools in this course.
Students use AI assistants to compare cloud architecture options, draft architecture decision records, scaffold Terraform modules, generate Helm chart values, write Ansible playbooks, and sketch IAM role and network boundary designs. They use chat-based and editor-integrated tools to query ArgoCD sync status, inspect Kubernetes events, and propose configuration fixes via kubectl and cloud MCP servers. AI helps interpret Prometheus and Grafana output, summarizing latency percentiles, error-budget burn rates, and cost attribution data into concrete autoscaling and FinOps actions. Teams configure Istio traffic-split policies and circuit-breaker thresholds with AI assistance and use it to generate realistic load patterns for testing SLO compliance. Every generated manifest, Terraform plan, and Ansible task must be reviewed critically before apply, since a plausible but wrong IAM policy or subnet configuration can expose the system or prevent it from scaling.
Student project
Teams design and build a cloud-native application with a REST API layer, durable relational storage, object storage, asynchronous worker queues, a caching layer and CDN, and complete Infrastructure-as-Code provisioning using Terraform, Helm, Ansible, and ArgoCD. The system is load-tested and teams document scalability, reliability, and cost evidence through Prometheus dashboards and SLO metrics, defending every architecture decision across three milestone presentations.
Requirements
- Build a working system, not a set of disconnected exercises: the REST API, worker queues, relational storage, object storage, caching layer, and CDN must all integrate into one running application.
- Be original: a new system that solves a real problem, not a re-implementation of a tutorial or course demo.
- Provision all infrastructure from IaC code (Terraform modules, Helm charts, Ansible playbooks, ArgoCD applications) with no manual click-ops steps that cannot be reproduced from the repository.
- Show real depth: real data, realistic load, and engineering trade-offs that are measured rather than assumed; load-test results and cost attribution evidence are required deliverables.
- Carry one running project from architecture specification through a deployed, defensible result across the whole term.
- Work in a team of three or four and defend the design at each of the three presentations (weeks 5, 8, and 13).
Example projects
Image-sharing platformURL shortener with analyticsReal-time chat backendEvent ticketing serviceIoT telemetry ingestionMultiplayer leaderboard APIDocument collaboration serviceFood delivery dispatch system
Assessment & grading
Grading is project-based, with no written exam. Teams of three or four present one running project three times.
| Component | What it covers | Weight |
|---|---|---|
| Project · Specification | Presentation 1 (week 5): problem, objectives, and architecture | 20% |
| Project · Interim | Presentation 2 (week 8): the working system demonstrated live | 30% |
| Project · Final | Presentation 3 (week 13): end-to-end demo with oral defense | 50% |
Tools & platforms
- Docker: build and run application containers with layered, reproducible images
- Kubernetes: orchestrate containerized workloads and configure autoscaling, probes, and rolling updates
- Backstage: maintain the internal developer portal and service catalog with SLO and runbook links
- Terraform: provision cloud infrastructure as code with declarative, modular, idempotent state management
- Helm: package and template Kubernetes manifests for environment-specific deployment and upgrade
- Ansible: automate day-2 configuration management with idempotent playbooks and dynamic cloud inventory
- ArgoCD: implement GitOps continuous delivery from Git to Kubernetes clusters with progressive promotion
- Istio: configure service mesh with automatic mutual-TLS, circuit-breaking, and canary traffic splitting
- Prometheus: collect cluster and application metrics for SLO monitoring and cost attribution
- Grafana: visualize metrics, build cost and SLO dashboards, and configure error-budget burn-rate alerts
Free online courses
Existing free, video-based courses this course can build on, for self-study or as a teaching basis.
- YouTubeDocker Containers and Kubernetes Fundamentals (Full Hands-On Course)
- YouTubeDocker and Kubernetes - Full Course for Beginners
In Hebrew · בעברית
Primary literature
Seminal works for advanced study.
References
Books and resources link to an online or publisher page.
- TextbookDesigning Distributed Systems, 2nd Edition: Patterns and Paradigms for Scalable, Reliable Services
- TextbookKubernetes: Up and Running, 3rd Edition
- TextbookBuilding Microservices, 2nd Edition: Designing Fine-Grained Systems
- TextbookTerraform: Up and Running, 3rd Edition: Writing Infrastructure as Code
- TextbookCloud Native Patterns: Designing Change-Tolerant Software
- TextbookDesigning Data-Intensive Applications
- DocumentationAWS Well-Architected Framework
- DocumentationAzure Architecture Center
- DocumentationGoogle Cloud Architecture Framework
- DocumentationKubernetes Documentation
- DocumentationDocker Documentation
Role in each concentration
| Concentration | Role |
|---|---|
| Intelligent Software Systems | Core · Semester 1 |
| Networking & Cyber Security | Core · Semester 1 |
| AI & Robotics | Elective |
| AI and Quantum Computing for Finance | Core · Semester 1 |
| Immersive Systems & Game Development | Core · Semester 2 |
| Defense Technologies & Autonomous Systems | Elective |