DevOps Engineering flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Error budget

The allowed amount of unreliability, computed as 1 minus the SLO over the compliance window. It converts reliability into a spendable quantity that balances release velocity against stability work.

Burn rate alerting

An alerting method that fires when the error budget is consumed faster than the SLO permits. Multi-window burn rates page quickly for severe outages while suppressing transient noise.

Four golden signals

Latency, traffic, errors, and saturation. These four metrics characterize a user-facing service well enough to detect most degradation without instrumenting every internal component.

Liveness versus readiness probe

A liveness probe failing restarts the container; a readiness probe failing removes the pod from service endpoints without restarting it. Confusing them causes restart loops during dependency outages.

Resource requests and limits

Requests reserve capacity used by the scheduler for placement; limits cap consumption. Exceeding a CPU limit throttles, exceeding a memory limit triggers an OOM kill.

Multi-stage build

A Dockerfile pattern using several FROM stages where build toolchains compile artifacts and a minimal final stage copies only runtime outputs, reducing image size and attack surface.

Build once, promote many

A CI/CD rule that a single immutable artifact, identified by digest, is promoted through environments unchanged. Rebuilding per environment breaks provenance and reproducibility guarantees.

Blue-green deployment

Two identical environments where traffic switches atomically from the live one to the newly deployed one. Rollback is a router change back to the previous environment.

Canary release

A progressive rollout sending a small percentage of traffic to the new version, then increasing it only if automated metric gates confirm health. Limits blast radius of defects.

DORA four keys

Deployment frequency, lead time for changes, change failure rate, and time to restore service. These four metrics describe software delivery performance and are derived from pipeline and incident data.

Terraform state locking

A mechanism preventing concurrent applies by recording a lock in shared remote state storage. Without it, simultaneous runs can corrupt state or create duplicate resources.

Idempotent configuration

A property where applying the same configuration repeatedly yields the same end state with no changes after the first run. It is the foundation of safe configuration management reruns.

Configuration drift

Divergence between declared infrastructure or configuration and the actual running state, usually caused by manual changes. Scheduled drift detection surfaces it before it causes incidents.

Immutable infrastructure

A practice of replacing servers or instances rather than modifying them in place. It eliminates configuration drift and makes deployments reproducible and rollback predictable.

Shared responsibility model

The division of security duties between cloud provider and customer. The provider secures the underlying cloud; the customer secures identity, data, configuration, and network policy.

Availability zone

An isolated datacenter or group of datacenters within a cloud region, with independent power and networking. Spanning at least two zones removes single-datacenter failure as an outage cause.

Workload identity federation

A mechanism letting workloads obtain short-lived cloud credentials by presenting a verifiable token, replacing long-lived static access keys and reducing credential leakage risk.

Least privilege

Granting only the permissions required for a task, for the shortest practical duration. It bounds the blast radius of compromised credentials and misconfigured automation.

SAST versus DAST

SAST analyzes source code statically without running it; DAST probes a running application externally. SAST finds code-level flaws early; DAST catches runtime and configuration issues.

Software bill of materials

A machine-readable inventory of components and versions in an artifact, typically SPDX or CycloneDX format. It enables fast impact analysis when a new dependency vulnerability is disclosed.

Policy as code

Expressing security and compliance rules as executable policies evaluated automatically in pipelines or admission controllers, replacing manual review that cannot scale with deployment frequency.

Secret scanning

Automated detection of credentials committed to repositories, with alerting and revocation workflow. Detection alone is insufficient; leaked secrets must be rotated, not just deleted.

Trunk-based development

A branching model where developers merge small changes to a shared mainline at least daily, using feature flags to hide incomplete work. It minimizes merge conflict cost.

Semantic versioning

A versioning scheme where MAJOR signals incompatible changes, MINOR backward-compatible features, and PATCH backward-compatible fixes. Pre-release identifiers sort before the final release.

Feature flag

A runtime toggle decoupling deployment from release. Flags let incomplete code ship dark, but each needs an owner and removal date to prevent untested combinations from accumulating.

Immutable release tag

A version tag that is never moved or force-updated after publication. Moving tags breaks reproducibility and provenance for every consumer that pinned to them.

Bash strict mode

The combination set -euo pipefail, which exits on command failure, unset variables, and pipeline errors. It turns silent partial failures into visible exits in automation scripts.

Exit code convention

Zero indicates success and any nonzero value indicates failure, with specific codes often carrying meaning. Automation must branch on exit status rather than parsing human-readable output.

Dry run

An execution mode that reports intended actions without performing them. Destructive automation should default to dry run and require an explicit confirmation flag for real execution.

Blameless postmortem

A retrospective assuming people acted reasonably given available information, focusing on systemic contributing factors. It produces tracked remediation actions rather than individual blame.

Conway's Law

The observation that system architecture tends to mirror the communication structure of the organization that builds it, which is why team topologies are designed deliberately.

Westrum organizational typology

A culture classification into pathological, bureaucratic, and generative types based on how information flows. Generative, performance-oriented cultures correlate with higher software delivery performance.