ca-fdops cheat sheet

The Three Ways of DevOps: (1) flow of work from Dev to Ops, (2) fast feedback loops, (3) continual experimentation and learning.

CALMS framework: Culture, Automation, Lean, Measurement, Sharing - used to assess DevOps adoption maturity.

DORA delivery metrics: deployment frequency, lead time for changes, change failure rate, and time to restore service.

Lead time for changes is measured from commit to production; time to restore is measured from incident start to service recovery.

Elite performers deploy on demand (multiple times per day), have lead times under one hour, change failure rates of 0–15%, and restore in under one hour.

Blameless postmortems focus on systemic causes; the goal is identifying contributing factors and corrective actions, not assigning individual fault.

Conway's Law: system architecture tends to mirror an organization's communication structure; team topology design can deliberately shape architecture.

A value stream map identifies the ratio of value-adding time to total lead time; the largest delays typically occur at handoffs and approval queues.

Git stores content as immutable blobs addressed by SHA-1 hashes; a commit references a tree, parent commit(s), author, and message.

A branch in Git is a movable pointer to a commit; HEAD points to the current branch or a detached commit.

git merge creates a merge commit with two parents; git rebase rewrites commits onto a new base and produces a linear history.

Fast-forward merge occurs when the target branch has no new commits; no merge commit is created.

Trunk-based development: short-lived branches merged into trunk at least daily; feature flags hide incomplete work instead of long-lived branches.

GitHub Flow: create a branch, open a pull request, review, run CI checks, merge, and deploy from the mainline.

A protected branch rule prevents direct pushes and requires status checks and approvals before merge.

git revert creates a new commit that undoes a prior commit; it is safe on shared branches, unlike git reset --hard which rewrites history.

CI requires every commit to trigger an automated build and test run on a clean environment; a failing build blocks integration.

Build pipelines should fail fast: run linting and unit tests before slower integration and end-to-end tests.

Hermetic builds use pinned dependency versions and isolated environments so results are reproducible across runs.

Build artifacts should be immutable, versioned, and stored in an artifact repository; the same artifact is promoted across environments.

A build cache keyed on lockfile hash reduces build time; cache invalidation occurs when dependency files change.

Parallel test sharding splits a test suite across runners to reduce wall-clock pipeline duration.

Flaky tests are non-deterministic failures; quarantine them and fix or remove them to preserve pipeline trust.

CI pipeline stages typically include checkout, dependency install, compile, unit test, static analysis, package, and publish artifact.

Continuous delivery keeps the mainline always deployable; continuous deployment automatically releases every change that passes the pipeline.

Deployment is installing a version into an environment; release is exposing that version to users - feature flags separate the two.

Blue-green deployment runs two identical environments and switches traffic atomically; rollback is switching traffic back.

Canary release routes a small percentage of traffic to the new version, monitors error and latency metrics, then ramps up or rolls back.

Rolling deployment replaces instances incrementally; it requires backward-compatible changes between old and new versions.

A release gate is an automated or manual checkpoint (approval, quality metric threshold) that must pass before promotion.

Semantic versioning: MAJOR for incompatible changes, MINOR for backward-compatible features, PATCH for backward-compatible fixes.

Database changes should be backward compatible (expand-contract pattern) so old and new application versions can run concurrently during rollout.

Declarative IaC describes the desired end state; imperative IaC describes the steps to reach it.

Idempotency means applying the same configuration repeatedly yields the same result without unintended changes.

Terraform state maps declared resources to real infrastructure; remote state with locking prevents concurrent modification.

terraform plan previews changes; terraform apply executes them; drift is detected when real infrastructure diverges from state.

Configuration management tools (Ansible, Chef, Puppet) converge a host to a desired configuration; Ansible uses agentless SSH.

Immutable infrastructure replaces servers instead of modifying them, reducing configuration drift.

IaC modules should be versioned and reusable; pin module and provider versions to avoid unexpected upgrades.

Secrets must not be committed to IaC repositories; use a secret manager or encrypted variables injected at deploy time.

A container packages an application and its dependencies; it shares the host kernel and isolates processes via namespaces and cgroups.

A container image is built from layered instructions; each Dockerfile instruction creates a layer, and unchanged layers are cached.

A Kubernetes Pod is the smallest deployable unit; it contains one or more containers sharing network and storage.

A Deployment manages ReplicaSets and provides declarative rolling updates and rollback for stateless workloads.

A Service provides stable virtual IP and DNS for a set of Pods selected by labels.

ConfigMaps hold non-sensitive configuration; Secrets hold sensitive data, base64-encoded by default and requiring encryption at rest.

Liveness probes restart unhealthy containers; readiness probes remove Pods from Service endpoints until they are ready.

Resource requests determine scheduling; limits cap CPU and memory usage and can trigger OOMKill when exceeded.

The shared responsibility model: the cloud provider secures the cloud (physical, hypervisor); the customer secures what runs in the cloud (data, identity, configuration).

Infrastructure as a service provides virtual machines and networks; platform as a service manages the runtime; serverless abstracts servers entirely.

Availability zones are isolated data centers within a region; multi-AZ deployment increases resilience to zone failure.

Auto-scaling adjusts capacity based on metrics such as CPU utilization or request count, within configured minimum and maximum bounds.

Object storage (e.g., S3) offers high durability and is commonly used for artifacts, backups, and static assets.

Identity and access management uses least-privilege roles and policies; temporary credentials via roles are preferred over long-lived access keys.

A landing zone defines account structure, networking, logging, and guardrails for an organization's cloud environment.

The three pillars of observability are metrics, logs, and traces; metrics are aggregated numbers, logs are discrete events, traces follow a request across services.

The four golden signals are latency, traffic, errors, and saturation.

SLI is a measured indicator; SLO is a target value for an SLI; SLA is a contractual commitment with consequences.

An error budget is 1 minus the SLO; it quantifies acceptable unreliability and can gate release velocity.

Alerting should be symptom-based (user-visible impact) rather than cause-based (CPU high) to reduce noise.

Incident severity levels determine response escalation; a runbook documents diagnostic and remediation steps for known alerts.

Mean time to detect (MTTD) and mean time to recover (MTTR) are key incident metrics; reducing MTTD improves recovery.

Distributed tracing uses trace IDs and span IDs to reconstruct request paths across microservices.

Shift left means integrating security checks early in the development lifecycle, such as SAST in the IDE and CI pipeline.

SAST analyzes source code statically; DAST tests a running application; SCA scans third-party dependencies for known vulnerabilities.

The CIA triad: confidentiality, integrity, and availability are the core goals of information security.

Least privilege grants only the permissions required for a task; role-based access control assigns permissions via roles.

Secrets management stores credentials in a dedicated vault; secrets should be rotated and never hard-coded in source or images.

Container image scanning identifies vulnerable OS packages and libraries before deployment.

A software bill of materials (SBOM) lists components and dependencies, enabling rapid response to supply chain vulnerabilities.

Infrastructure as code scanning detects misconfigurations such as public storage buckets or overly permissive security groups before deployment.