CDOS cheat sheet

DevOps is defined by CALMS (Culture, Automation, Lean, Measurement, Sharing); the culture element precedes tooling in most maturity models.

DORA's four key metrics: deployment frequency, lead time for changes, change failure rate, and time to restore service; throughput metrics are the first two, stability metrics the last two.

Lead time for changes is measured from commit to running in production; cycle time typically spans first commit to first deploy of that change.

Change failure rate = failed deployments divided by total deployments, expressed as a percentage over a defined window.

Mean time to restore (MTTR) measures elapsed time from incident start to service restoration, not time to root-cause analysis.

The Three Ways: flow (left-to-right delivery), feedback (right-to-left amplification), and continual experimentation and learning.

Blameless postmortems separate human error from systemic causes; action items are tracked to closure with owners and due dates.

Toil is manual, repetitive, automatable work with no enduring value; SRE guidance targets keeping toil below roughly 50% of operational time.

Westrum organizational typology ranks culture as pathological (power-oriented), bureaucratic (rule-oriented), or generative (performance-oriented); generative cultures correlate with higher delivery performance.

Git stores content as immutable blobs addressed by SHA-1 (or SHA-256 in newer repos); a commit object references a tree, parent commits, author, and message.

Branches are movable pointers to commits; HEAD points to the current branch, and detached HEAD means HEAD points directly to a commit.

git merge creates a merge commit with two parents when histories diverged; git rebase replays commits onto a new base and rewrites commit hashes.

Fast-forward merge occurs only when the target branch is a strict ancestor of the source; otherwise a three-way merge or rebase is required.

git reset --soft moves HEAD only; --mixed also resets the index; --hard additionally resets the working tree, discarding uncommitted changes.

Trunk-based development keeps short-lived branches (typically under a day or two) and relies on feature flags to hide incomplete work.

Gitflow uses long-lived develop, main, feature, release, and hotfix branches; it suits versioned releases but adds merge overhead versus trunk-based flow.

Signed commits (GPG or SSH) and signed tags let policy servers verify authorship; protected branches block force-push and require passing checks.

Monorepo versus polyrepo is a repository-topology decision: monorepos simplify atomic cross-service changes but need build-graph and ownership tooling.

Continuous integration requires every commit to trigger an automated build and test run on a shared mainline, with failures fixed or reverted promptly.

Continuous delivery keeps every change deployable to production at any time; continuous deployment automatically releases every passing change.

A pipeline stage gate is a policy check (tests, security scan, approval); a deployment gate is a control on promotion between environments.

Build caching (dependency and layer caches keyed by lockfile hash) reduces pipeline duration; cache keys must change when inputs change.

Test pyramid: many fast unit tests, fewer service or contract tests, and few end-to-end UI tests; the inverse (ice-cream cone) slows feedback.

Artifacts should be built once and promoted unchanged through environments; rebuilding per environment breaks provenance and reproducibility.

Pipeline-as-code files (Jenkinsfile, .gitlab-ci.yml, GitHub Actions workflow) are versioned with the application and reviewed like source.

Flaky tests are tests with nondeterministic outcomes; quarantine them, track failure rates, and fix or delete rather than retry indefinitely.

Blue-green and canary are delivery strategies: blue-green swaps whole environments; canary shifts a small traffic percentage and watches metrics before full rollout.

Declarative IaC states the desired end state (Terraform HCL, Kubernetes manifests); imperative IaC states the steps to reach it (shell scripts, some CLI-driven tools).

Terraform state maps declared resources to real infrastructure; remote state with locking (for example, an object store plus a lock table) prevents concurrent-apply corruption.

terraform plan computes a diff against state and remote APIs; terraform apply executes it; drift is any difference between state and actual infrastructure.

Idempotence means applying the same configuration repeatedly yields the same result; it is the core property enabling safe re-runs.

Configuration management tools (Ansible, Puppet, Chef, Salt) converge machines; Ansible is agentless over SSH, Puppet and Chef typically use agents.

Ansible playbooks are YAML task lists; modules are idempotent units, handlers run on change notification, and roles package reusable content.

Immutable infrastructure replaces servers rather than mutating them; mutable approaches patch in place and accumulate configuration drift.

Terraform providers and modules are versioned; pinning provider and module versions prevents surprise changes during apply.

Secrets must not live in IaC repositories; reference a secrets manager or encrypted store and inject at deploy or runtime.

A container shares the host kernel and isolates via namespaces (visibility) and cgroups (resource limits); a VM runs a separate kernel under a hypervisor.

A container image is an ordered set of read-only layers; a Dockerfile instruction that changes creates a new layer, and layer caching reuses unchanged layers.

Multi-stage builds copy artifacts from a build stage into a slim runtime stage, reducing image size and attack surface.

Kubernetes Pod is the smallest deployable unit; it can hold multiple containers sharing network namespace and volumes.

Deployment manages stateless replicated Pods with rolling updates; StatefulSet gives stable identities and ordered rollout; DaemonSet runs one Pod per node.

Service provides a stable virtual IP and DNS name to a set of Pods selected by labels; Ingress exposes HTTP routes from outside the cluster.

Requests and limits: requests drive scheduling, limits cap usage; exceeding a memory limit triggers OOMKill, while CPU over limit is throttled.

Liveness probes restart unhealthy containers; readiness probes remove Pods from Service endpoints; startup probes protect slow-starting apps from liveness restarts.

ConfigMap holds non-sensitive configuration; Secret holds sensitive data, base64-encoded by default and requiring encryption-at-rest or external stores for real protection.

Shared responsibility model: the provider secures the cloud (physical, hypervisor, managed service internals); the customer secures what they put in it (identity, data, configuration).

AWS IAM policy evaluation: explicit deny overrides any allow; otherwise an allow is required; absence of an allow is an implicit deny.

IAM roles with temporary credentials (STS) are preferred over long-lived access keys; instance or workload identity removes embedded secrets.

Availability zones are isolated datacenters within a region; multi-AZ designs survive single-AZ failure, while multi-region designs address regional outages.

Infrastructure provisioning order follows dependencies: network and subnets, then compute and data stores, then load balancers and DNS records.

Managed services shift operational burden to the provider but retain customer responsibility for configuration, access control, and data classification.

Autoscaling groups or managed node pools scale on metrics such as CPU or queue depth; scale-in protection and cooldowns prevent flapping.

Cost controls: tagging for allocation, budgets and alerts, and reserved or savings-plan commitments for steady-state workloads.

Cloud-native IaC often uses provider-specific tools (CloudFormation, Bicep, Deployment Manager) or cross-cloud tools such as Terraform and Pulumi.

The three pillars are metrics (aggregated numbers over time), logs (discrete timestamped events), and traces (causal spans across services).

The four golden signals are latency, traffic, errors, and saturation; the RED method uses rate, errors, duration for request-driven services.

USE method (utilization, saturation, errors) applies to resources such as CPU, memory, disk, and network interfaces.

Prometheus pulls metrics over HTTP; counters only increase, gauges go up and down, histograms and summaries capture distributions, and histograms are aggregatable across instances.

SLI is a measured indicator; SLO is a target range for the SLI; SLA is a contractual commitment with consequences; error budget = 1 minus SLO.

Alert on symptoms (user-visible error rate, latency) rather than causes (high CPU) to reduce noise; every page should be actionable and urgent.

A trace is a tree of spans identified by trace ID; span context propagation (for example, W3C traceparent) links services across boundaries.

Structured logging emits key-value fields (often JSON) so logs are queryable; correlation IDs tie logs, metrics, and traces for one request.

Cardinality explosions from high-dimension labels (user ID, request ID) in metrics degrade storage and query performance; keep those in logs or traces.

Shift-left security places checks (SAST, dependency scanning, IaC scanning, secret detection) in the pipeline before merge or deploy.

SAST analyzes source code statically; DAST probes a running application; SCA identifies vulnerable or license-flagged third-party dependencies.

Secret scanning detects committed credentials; on detection, rotate the secret first, then purge history, because history rewriting alone does not revoke exposure.

Least privilege: grant the minimum permissions needed, scope IAM policies to specific resources, and prefer short-lived credentials over static keys.

Supply chain controls: sign artifacts and images (Sigstore/cosign), generate SBOMs (SPDX, CycloneDX), and verify signatures at admission.

Container image hardening: minimal base images, non-root user, read-only root filesystem, no privileged mode, pinned image digests.

Compliance frameworks (SOC 2, ISO 27001, PCI DSS, HIPAA) map to controls; evidence should be generated automatically from pipeline and cloud configuration data.

Policy as code (OPA/Rego, admission controllers) enforces rules such as required labels, disallowed registries, or blocked privileged Pods at admission time.

Threat modeling (for example, STRIDE) identifies design-level risks early; vulnerability triage prioritizes by exploitability and reachability, not raw CVSS alone.

Release is the decision to make a version available; deployment is the technical act of installing it; they can be decoupled via feature flags.

Rolling deployment replaces instances incrementally; blue-green switches traffic between two full environments; canary sends a small traffic slice first.

Rollback strategies: redeploy the previous immutable artifact, flip traffic back in blue-green, or disable a feature flag; database migrations must be backward compatible.

Expand-and-contract migration pattern: add new schema alongside old, dual-write or backfill, switch reads, then remove old columns in a later release.

Incident severity levels drive response: sev1 pages immediately with an incident commander; lower severities follow normal on-call or ticket flow.

Incident roles include incident commander (coordination), communications lead (stakeholders), and subject-matter experts (diagnosis and fix).

Runbooks and playbooks codify response steps; chaos engineering and game days rehearse failure handling before real incidents.

Postmortem outputs: timeline, contributing factors, detection and response gaps, and tracked corrective actions with owners and dates.

Change management in high performers is lightweight and automated: peer review, automated tests, and progressive rollout replace heavy approval boards.