From e4cbcf6c404ea8c282622db6d06afea3f8b4dfbb Mon Sep 17 00:00:00 2001 From: ced4568 Date: Tue, 25 Aug 2026 23:28:55 -0500 Subject: [PATCH] docs(curriculum): inventory existing RootNode learning assets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Full inventory of scenarios/data/ (98 scenarios), scenarios/bundles/, rootnode-path.json's stage structure, assessment_definitions, and the programs/achievements model — gathered by inspection before any Phase 6A design work, nothing modified to produce this. Only 3 scenarios are RootNode-authored; the other 95 (including all 44 wired into rootnode-path.json) are generic upstream Kubernetes/CKS content. 54 scenarios exist with no rootnode-path.json stage at all — a real, working content bank for future ROOT 07/08/09/10 modules, inventoried and grouped by category rather than left undiscovered. Co-Authored-By: Claude Sonnet 5 --- docs/ROOT_CURRICULUM_INVENTORY.md | 209 ++++++++++++++++++++++++++++++ 1 file changed, 209 insertions(+) create mode 100644 docs/ROOT_CURRICULUM_INVENTORY.md diff --git a/docs/ROOT_CURRICULUM_INVENTORY.md b/docs/ROOT_CURRICULUM_INVENTORY.md new file mode 100644 index 0000000..2306564 --- /dev/null +++ b/docs/ROOT_CURRICULUM_INVENTORY.md @@ -0,0 +1,209 @@ +# ROOT_ Curriculum Inventory + +Phase 6A §1 — a factual inventory of what already exists in this repository, gathered by +inspecting `scenarios/data/`, `scenarios/bundles/`, `scenarios/rootnode-path.json`, +`assessment_definitions` (013_assessments.sql), `programs` (019_programs.sql), `achievements`, +and the curriculum/progress APIs — before any Phase 6A design work happened. Nothing here was +modified to produce this document. + +## 1. The current program model + +One program exists: `root-kubernetes-foundations` (`programs` table, family `root`, +`delivery_mode = self_paced`, `curriculum_path = rootnode-path`, +`completion_assessment_id = rootnode-capstone`). `init`/`compile` families are supported by the +schema's CHECK constraint but have zero seeded programs — no init_/compile_ curriculum exists +anywhere in this repository. + +## 2. `scenarios/rootnode-path.json` — the existing stage structure + +The one curriculum path that exists, "RootNode Learning Path," version 1, with 7 stages: + +| Stage | Scenario count | Completion rule | +|---|---|---| +| `foundation` | 20 | all_required | +| `workloads` | 8 | all_required | +| `networking` | 2 | all_required | +| `configuration` | 5 | all_required | +| `troubleshooting` | 5 | all_required | +| `real-ops` (bundle `rootnode-real-ops`) | 4 | all_required | +| `capstone` (type `capstone`) | 0 (references `rootnode-capstone`) | unlocks when all 6 content stages above are complete | + +44 of the repository's 98 total scenarios are wired into this path. The remaining 54 exist as +real, working scenario content but are not referenced by `rootnode-path.json` at all — see §4. + +## 3. `scenarios/bundles/` — exam-prep bundle groupings + +Five bundles exist (`1-k8s-basics`, `2-k8s-appdev`, `3-k8s-admin`, `4-k8s-security`, +`rootnode-real-ops`), each a flat list of scenario ids used for CKS-style exam-prep grouping in +the existing Practice area — overlapping by design (a scenario can appear in more than one +bundle). These are unrelated to `rootnode-path.json`'s stages and untouched by Phase 6A. + +## 4. Full scenario inventory + +For every scenario in `scenarios/data/` (98 total): id, title, category, difficulty, task vs. +MCQ, which bundle(s) it's in, which `rootnode-path.json` stage (if any) it's wired into, whether +it appears in the `rootnode-capstone` or `rootnode-quick-assessment` `assessment_definitions` +pool_spec, and whether it's RootNode-authored or generic upstream content. + +Only 3 scenarios are RootNode-specific (`rootnode-runaway-monitor`, +`rootnode-probe-port-mismatch`, `rootnode-enforce-limits`) — every other scenario, including all +44 wired into `rootnode-path.json`, is generic upstream Kubernetes/CKS content. This matters for +Phase 6A's course design: the "gold-standard module" spec explicitly asked for a RootNode- +authored incident as the lab, which narrows the real choice to those 3 (plus `broken-deployment`, +generic but already framed as an incident in the `real-ops` stage). + + + +| Scenario ID | Title | Category | Difficulty | Type | Bundles | Path Stage | In Assessment | Origin | +|---|---|---|---|---|---|---|---|---| +| annotate-resource-basics | Annotating Kubernetes Resources | Core Concepts | Easy | task | 1-k8s-basics | foundation | — | generic upstream | +| broken-deployment | Debug a Failing Deployment | Troubleshooting | Medium | task | 3-k8s-admin, rootnode-real-ops | real-ops | capstone, quick-assessment | generic upstream | +| cks-apparmor-profile | AppArmor Profiles | Workload Security | Hard | task | 4-k8s-security | — | — | generic upstream | +| cks-audit-policy | Write a Kubernetes Audit Policy | Cluster Setup | Hard | task | 4-k8s-security | — | — | generic upstream | +| cks-automount-token | Disable ServiceAccount Token | Workload Security | Easy | task | 4-k8s-security | — | — | generic upstream | +| cks-drop-capabilities | Drop Linux Capabilities | Workload Security | Medium | task | 4-k8s-security | — | — | generic upstream | +| cks-egress-namespace | Restrict Egress to Namespace | Network Security | Hard | task | 4-k8s-security | — | — | generic upstream | +| cks-image-pull-secret | Private Registry Image Pull Secret | Supply Chain Security | Easy | task | 4-k8s-security | — | — | generic upstream | +| cks-immutable-secret | Immutable Secrets | Cluster Security | Easy | task | 4-k8s-security | — | — | generic upstream | +| cks-mcq-api-server | API Server Authentication | Cluster Setup | Easy | mcq | 4-k8s-security | — | — | generic upstream | +| cks-mcq-audit-policy | Kubernetes Audit Logging Levels | Cluster Setup | Medium | mcq | 4-k8s-security | — | — | generic upstream | +| cks-mcq-image-footprint | Minimizing Image Footprint | Supply Chain Security | Easy | mcq | 4-k8s-security | — | — | generic upstream | +| cks-mcq-kubelet-auth | Securing the Kubelet | Cluster Setup | Medium | mcq | 4-k8s-security | — | — | generic upstream | +| cks-mcq-psp-replacement | Pod Security Evolution | Cluster Security | Easy | mcq | 4-k8s-security | — | — | generic upstream | +| cks-mcq-runtime-security | Runtime Security Tools | System Hardening | Medium | mcq | 4-k8s-security | — | — | generic upstream | +| cks-mcq-sandboxing | Container Runtime Sandboxing | System Hardening | Hard | mcq | 4-k8s-security | — | — | generic upstream | +| cks-network-policy | Default Deny Network Policy | Network Security | Medium | task | 4-k8s-security | — | — | generic upstream | +| cks-network-policy-metadata | Block Cloud Metadata | Network Security | Hard | task | 4-k8s-security | — | — | generic upstream | +| cks-non-root-enforce | Enforce Non-Root Container | Workload Security | Medium | task | 4-k8s-security | — | — | generic upstream | +| cks-pod-security-context | Pod Security Context | Workload Security | Medium | task | 4-k8s-security | — | — | generic upstream | +| cks-psa-namespace | Pod Security Admission | Cluster Security | Easy | task | 4-k8s-security | — | — | generic upstream | +| cks-rbac-clusterrole | Cluster-Level RBAC | Cluster Security | Medium | task | 4-k8s-security | — | — | generic upstream | +| cks-rbac-least-privilege | RBAC Least Privilege | Cluster Security | Medium | task | 4-k8s-security | — | — | generic upstream | +| cks-readonly-filesystem | Read-Only Root Filesystem | Workload Security | Easy | task | 4-k8s-security | — | — | generic upstream | +| cks-runtime-class | RuntimeClass for Sandboxed Workloads | System Hardening | Medium | task | 4-k8s-security | — | — | generic upstream | +| cks-seccomp-profile | Seccomp Profiles | Workload Security | Hard | task | 4-k8s-security | — | — | generic upstream | +| cks-tls-ingress | Secure Ingress with TLS | Network Security | Hard | task | 4-k8s-security | — | — | generic upstream | +| cluster-upgrade-mcq | Cluster Upgrade Order | Cluster Administration | Hard | mcq | 3-k8s-admin | — | — | generic upstream | +| configmap-volume | Mount ConfigMap as Volume | Configuration | Medium | task | 1-k8s-basics, 2-k8s-appdev | configuration | — | generic upstream | +| container-logging-mcq | Container Logging and Monitoring | Troubleshooting | Easy | mcq | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| crashloop-fix | Fix a CrashLoopBackOff Pod | Troubleshooting | Medium | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| cronjob-task | Create a CronJob | Workloads & Scheduling | Easy | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| daemonset-mcq | Understanding DaemonSets | Workloads | Easy | mcq | 1-k8s-basics | workloads | quick-assessment | generic upstream | +| delete-by-label-basics | Bulk Deletion by Label | Core Concepts | Easy | task | 1-k8s-basics | foundation | — | generic upstream | +| deploy-nginx | Deploy and Expose Nginx | Workloads | Easy | task | 1-k8s-basics, 2-k8s-appdev | workloads | capstone, quick-assessment | generic upstream | +| deployment-rollback | Rolling Back a Deployment | Workloads & Scheduling | Easy | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| deployment-strategy-mcq | Deployment Update Strategies | Workloads | Medium | mcq | 1-k8s-basics | workloads | — | generic upstream | +| dns-resolution-mcq | Kubernetes DNS Resolution | Services & Networking | Easy | mcq | 3-k8s-admin | — | — | generic upstream | +| dry-run-manifest-basics | Generating YAML Manifests | Core Concepts | Easy | task | 1-k8s-basics | foundation | — | generic upstream | +| edit-deployment-basics | Updating Deployments | Workloads | Easy | task | 1-k8s-basics | workloads | capstone | generic upstream | +| emptydir-pod | Shared emptyDir Volume Between Containers | Storage | Easy | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| endpoint-fix-task | Fix a Broken Service Selector | Troubleshooting | Medium | task | 3-k8s-admin | — | — | generic upstream | +| env-vars-configmap | Environment Variables from ConfigMap | Configuration | Easy | task | 1-k8s-basics, 2-k8s-appdev | configuration | capstone | generic upstream | +| etcd-backup-mcq | etcd Backup and Restore | Cluster Administration | Hard | mcq | 3-k8s-admin | — | — | generic upstream | +| exec-command-basics | Execute Commands in Pods | Troubleshooting | Easy | task | 1-k8s-basics | troubleshooting | capstone, quick-assessment | generic upstream | +| expose-service-basics | Exposing an Application | Services & Networking | Easy | task | 1-k8s-basics | networking | quick-assessment | generic upstream | +| extract-logs-basics | Extract Container Logs | Troubleshooting | Easy | task | 1-k8s-basics | troubleshooting | capstone, quick-assessment | generic upstream | +| field-selector-basics | Filtering Resources with Field Selectors | Core Concepts | Easy | task | 1-k8s-basics | foundation | — | generic upstream | +| ingress-task | Create an Ingress Resource | Services & Networking | Medium | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| init-container-task-basics | Pod with Init Container | Core Concepts | Medium | task | 1-k8s-basics | foundation | — | generic upstream | +| init-containers-mcq | Init Containers Behaviour | Core Concepts | Easy | mcq | 1-k8s-basics | foundation | — | generic upstream | +| job-task | Create a One-Shot Job | Workloads & Scheduling | Easy | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| jobs-cronjobs-mcq | Jobs vs CronJobs | Workloads | Easy | mcq | 1-k8s-basics | workloads | — | generic upstream | +| jsonpath-basics | JSONPath Data Extraction | Core Concepts | Medium | task | 1-k8s-basics | foundation | — | generic upstream | +| kubectl-cp-basics | Copy Files to Containers | Troubleshooting | Medium | task | 1-k8s-basics | troubleshooting | capstone, quick-assessment | generic upstream | +| kubectl-diff-basics | Previewing Changes with kubectl diff | Core Concepts | Medium | task | 1-k8s-basics | foundation | — | generic upstream | +| kubectl-essentials-mcq | Essential kubectl Commands | Core Concepts | Easy | mcq | 1-k8s-basics, 2-k8s-appdev | foundation | — | generic upstream | +| kubectl-explain-basics | Exploring the API with kubectl explain | Core Concepts | Easy | task | 1-k8s-basics | foundation | — | generic upstream | +| kubectl-output-format-mcq | kubectl Output Formats | Core Concepts | Easy | mcq | 1-k8s-basics | foundation | — | generic upstream | +| kubectl-patch-basics | Patching Resources with kubectl patch | Core Concepts | Medium | task | 1-k8s-basics | foundation | — | generic upstream | +| labels-selectors-mcq | Labels and Selectors | Core Concepts | Easy | mcq | 1-k8s-basics, 2-k8s-appdev | foundation | — | generic upstream | +| limitrange-task | LimitRange for Default Container Limits | Workloads & Scheduling | Medium | task | 3-k8s-admin | — | — | generic upstream | +| liveness-probe-task | Configure a Liveness Probe | Workloads | Medium | task | 1-k8s-basics, 2-k8s-appdev | workloads | capstone, quick-assessment | generic upstream | +| multi-container-pod-basics | Create a Multi-Container Pod | Core Concepts | Easy | task | 1-k8s-basics | foundation | — | generic upstream | +| namespaces-basics | Working with Namespaces | Core Concepts | Easy | task | 1-k8s-basics, 2-k8s-appdev | foundation | — | generic upstream | +| network-policy | Isolate Traffic with NetworkPolicy | Networking | Hard | task | 3-k8s-admin | — | — | generic upstream | +| networkpolicy-egress | Egress NetworkPolicy | Security | Hard | task | 3-k8s-admin | — | — | generic upstream | +| node-cordon-basics | Cordoning and Uncordoning a Node | Cluster Management | Easy | task | 1-k8s-basics | troubleshooting | capstone, quick-assessment | generic upstream | +| node-label-selector | Node Labels and nodeSelector | Cluster Administration | Easy | task | 3-k8s-admin | — | — | generic upstream | +| node-taint-toleration | Taints and Tolerations | Cluster Administration | Medium | task | 3-k8s-admin | — | — | generic upstream | +| nodeport-task | Expose a Deployment via NodePort | Services & Networking | Easy | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| pod-affinity-mcq | Pod Affinity vs Anti-Affinity | Workloads & Scheduling | Medium | mcq | 3-k8s-admin | — | — | generic upstream | +| pod-basics-mcq | Pod Lifecycle States | Core Concepts | Easy | mcq | 1-k8s-basics, 2-k8s-appdev | foundation | — | generic upstream | +| pod-disruption-budget-task | Configure a PodDisruptionBudget | Cluster Administration | Medium | task | 3-k8s-admin | — | — | generic upstream | +| pod-env-vars-inline | Pod with Inline Environment Variables | Configuration | Easy | task | 1-k8s-basics | configuration | — | generic upstream | +| pod-labeling-basics | Labelling Resources | Core Concepts | Easy | task | 1-k8s-basics | foundation | — | generic upstream | +| pod-node-assignment-mcq | Assigning Pods to Nodes | Scheduling | Medium | mcq | 1-k8s-basics | troubleshooting | — | generic upstream | +| pod-security-context | Pod Security Context | Security | Medium | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| priority-class-task | Pod Priority and PriorityClass | Workloads & Scheduling | Medium | task | 3-k8s-admin | — | — | generic upstream | +| pv-pvc-mount | Persistent Storage with PV and PVC | Storage | Medium | task | 3-k8s-admin | — | — | generic upstream | +| pvc-dynamic-task | Dynamic PVC Provisioning | Storage | Medium | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| rbac-clusterrole | ClusterRole and ClusterRoleBinding | Cluster Administration | Medium | task | 3-k8s-admin | — | — | generic upstream | +| rbac-role | RBAC: Create Role and RoleBinding | Security | Hard | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| readiness-probe-task | Configure a Readiness Probe | Workloads & Scheduling | Medium | task | 2-k8s-appdev, 3-k8s-admin | — | — | generic upstream | +| resource-limits-task | Resource Requests and Limits | Configuration | Easy | task | 1-k8s-basics, 2-k8s-appdev | configuration | capstone | generic upstream | +| resource-quota-ns | ResourceQuota for a Namespace | Cluster Administration | Medium | task | 3-k8s-admin | — | — | generic upstream | +| restart-policy-mcq | Pod Restart Policies | Core Concepts | Easy | mcq | 1-k8s-basics | foundation | — | generic upstream | +| rolling-update-task | Perform a Rolling Update | Workloads | Easy | task | 1-k8s-basics, 2-k8s-appdev | workloads | capstone, quick-assessment | generic upstream | +| rootnode-enforce-limits | Stop the Next Outage: Enforce Resource Defaults | Observability & Ops | Hard | task | rootnode-real-ops | real-ops | capstone, quick-assessment | RootNode-specific | +| rootnode-probe-port-mismatch | Stuck Not-Ready: The Probe Port Mismatch | Observability & Ops | Medium | task | rootnode-real-ops | real-ops | capstone, quick-assessment | RootNode-specific | +| rootnode-runaway-monitor | Recover the Monitoring Stack | Observability & Ops | Medium | task | rootnode-real-ops | real-ops | capstone, quick-assessment | RootNode-specific | +| scale-deployment | Scaling a Deployment | Workloads | Easy | task | 1-k8s-basics, 2-k8s-appdev | workloads | capstone, quick-assessment | generic upstream | +| secrets-basics | Creating and Using Secrets | Configuration | Easy | task | 1-k8s-basics, 2-k8s-appdev | configuration | capstone | generic upstream | +| serviceaccount-pod | ServiceAccount for Pod API Access | Cluster Administration | Medium | task | 3-k8s-admin | — | — | generic upstream | +| services-mcq | Kubernetes Service Types | Networking | Easy | mcq | 1-k8s-basics, 2-k8s-appdev | networking | quick-assessment | generic upstream | +| sort-by-basics | Sorting kubectl Output | Core Concepts | Easy | task | 1-k8s-basics | foundation | — | generic upstream | +| static-pods-mcq | Static Pods in Kubernetes | Core Concepts | Medium | mcq | 1-k8s-basics | foundation | — | generic upstream | +| storageclass-mcq | StorageClass Reclaim Policies | Storage | Easy | mcq | 3-k8s-admin | — | — | generic upstream | + +## 5. Unused content bank, grouped for future ROOT_ modules + +The 54 scenarios with no Path Stage above, grouped by category — a real, working content bank +ROOT 07/08/09/10 can draw on in Phase 6B, not content that needs to be invented: + +- **Workload Security (7):** cks-apparmor-profile, cks-automount-token, cks-drop-capabilities, cks-non-root-enforce, cks-pod-security-context, cks-readonly-filesystem, cks-seccomp-profile +- **Cluster Setup (4):** cks-audit-policy, cks-mcq-api-server, cks-mcq-audit-policy, cks-mcq-kubelet-auth +- **Network Security (4):** cks-egress-namespace, cks-network-policy-metadata, cks-network-policy, cks-tls-ingress +- **Supply Chain Security (2):** cks-image-pull-secret, cks-mcq-image-footprint +- **Cluster Security (5):** cks-immutable-secret, cks-mcq-psp-replacement, cks-psa-namespace, cks-rbac-clusterrole, cks-rbac-least-privilege +- **System Hardening (3):** cks-mcq-runtime-security, cks-mcq-sandboxing, cks-runtime-class +- **Cluster Administration (8):** cluster-upgrade-mcq, etcd-backup-mcq, node-label-selector, node-taint-toleration, pod-disruption-budget-task, rbac-clusterrole, resource-quota-ns, serviceaccount-pod +- **Troubleshooting (3):** container-logging-mcq, crashloop-fix, endpoint-fix-task +- **Workloads & Scheduling (7):** cronjob-task, deployment-rollback, job-task, limitrange-task, pod-affinity-mcq, priority-class-task, readiness-probe-task +- **Services & Networking (3):** dns-resolution-mcq, ingress-task, nodeport-task +- **Storage (4):** emptydir-pod, pv-pvc-mount, pvc-dynamic-task, storageclass-mcq +- **Networking (1):** network-policy +- **Security (3):** networkpolicy-egress, pod-security-context, rbac-role + +## 6. Other existing systems inspected + +- **Assessment definitions** (`assessment_definitions`): `rootnode-capstone` (90 min, hint_policy + `flagged`, required = the 4 real-ops scenarios, random draw across workloads/config/ + troubleshooting) and `rootnode-quick-assessment` (60 min exam, fully random draw). Both real, + both working, neither touched by Phase 6A — the new capstone course activity references + `rootnode-capstone` by id only. +- **Achievements** (`achievements`): 4 types already implemented — `stage_completed`, + `curriculum_completed`, `assessment_completed`, `capstone_completed`. Phase 6A's + `auto_assessment` completion behavior reads `assessment_completed`/`capstone_completed` rows + by `metadata->>'assessment_definition_id'` — no new achievement type needed. + - **Progress/attempt model** (`progress`, `scenario_attempts`): unchanged. `progress` is what + `curriculum-rules.js` and the new `auto_scenario` completion behavior both read. +- **Curriculum APIs**: `curriculum.js` loads scenarios/bundles/path from disk into an in-process + cache; `curriculum-rules.js` computes stage lock/completion/percent purely from that path + + a progress map. Phase 6A's `course-progress.js` follows the identical shape one level higher + (course/module/activity instead of stage/scenario). +- **Self-paced dashboard** (`ProgramsTab.jsx`) and **classroom dashboard** (`ClassroomTab.jsx`, + admin `ClassroomView.jsx`): both currently show curriculum STATE (percent, next scenario) with + no notion of lessons/modules — Phase 6A's `CourseView.jsx`/`CurriculumView.jsx` add that layer + alongside, not instead of, these. +- **Admin curriculum/program tooling** (`admin-learning-routes.js`, `admin-programs-routes.js`): + read-only scenario/stage views and program/enrollment CRUD; no course/module concept existed + before this phase. + +## 7. What this inventory rules out + +- No init_/compile_ curriculum content exists anywhere — confirmed by a full scan of + `scenarios/data/`, not an assumption. +- No DevOps/CI/CD/IaC/GitOps scenario content exists (ROOT 11 is necessarily 100% PLANNED). +- No Linux-fundamentals, Git, or Docker-specific scenario content exists (ROOT 01-04 are + necessarily 100% PLANNED) — everything in `scenarios/data/` is Kubernetes/CKS content.