CDOS flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

CALMS framework

A model for assessing DevOps adoption across Culture, Automation, Lean, Measurement, and Sharing. Culture is treated as the foundation because tooling alone rarely changes delivery outcomes.

Change failure rate

The percentage of deployments that cause degraded service and require remediation such as a rollback, hotfix, or patch. It is one of DORA's two stability metrics.

Blameless postmortem

A structured review after an incident that focuses on systemic and process causes rather than individual fault. Its goal is producing tracked corrective actions that reduce recurrence.

Toil

Manual, repetitive, automatable operational work that produces no enduring value and scales linearly with service growth. SRE practice aims to keep it a minority of operational time.

Detached HEAD

A Git state where HEAD points directly to a commit rather than a branch. Commits made in this state are not on any branch and can be lost unless a branch is created.

Git rebase

Replaying commits onto a new base commit, producing new commits with new hashes. It creates linear history but rewrites shared history, so avoid rebasing commits others already pulled.

Fast-forward merge

A merge that only advances the branch pointer because the target branch is a direct ancestor of the source. No merge commit is created and history stays linear.

Trunk-based development

A branching model where developers commit to a single mainline with very short-lived branches. Incomplete features are hidden behind feature flags rather than long-running branches.

Build once, promote artifact

A pipeline rule that a single immutable artifact is built once and promoted unchanged through environments. Rebuilding per environment breaks provenance and can introduce untested differences.

Test pyramid

A test portfolio shape with many fast unit tests, fewer integration or contract tests, and few end-to-end tests. It optimizes feedback speed and reduces brittle UI test maintenance.

Deployment gate

A policy or approval control that must be satisfied before a change is promoted to the next environment. Examples include security scan results, change approval, or error-budget checks.

Canary release

A deployment strategy that routes a small percentage of traffic to a new version while monitoring error rates and latency. Traffic increases only if metrics stay within thresholds.

Idempotence

The property that applying the same configuration repeatedly produces the same end state without side effects. It makes re-running provisioning and configuration tools safe after partial failure.

Terraform state

A file mapping declared resources to real infrastructure identifiers. Remote state with locking prevents concurrent applies from corrupting or duplicating resources.

Configuration drift

Any divergence between declared or expected configuration and the actual state of running infrastructure. It is detected by plan or compliance scans and corrected by reapply or replacement.

Immutable infrastructure

A model where servers or containers are replaced rather than modified in place. It eliminates configuration drift and makes rollback a matter of redeploying a prior artifact.

Container namespaces

Linux kernel features that isolate what a process can see, including process IDs, network interfaces, mounts, and hostnames. They provide container isolation without a separate kernel.

Kubernetes readiness probe

A check that determines whether a Pod should receive traffic through a Service. Failing readiness removes the Pod from endpoints without restarting the container.

Resource requests and limits

Requests are the guaranteed resources used for scheduling decisions; limits are hard caps. Exceeding memory limits causes OOMKill, while exceeding CPU limits causes throttling.

Multi-stage build

A Dockerfile pattern using multiple FROM stages where artifacts are copied from a build stage into a slim runtime stage. It reduces final image size and vulnerability surface.

Shared responsibility model

A cloud security division: the provider secures physical infrastructure and managed service internals, while the customer secures identity, data, configuration, and access policies.

IAM explicit deny

In AWS-style policy evaluation, an explicit deny statement overrides any allow. Without an allow, access is implicitly denied by default.

Availability zone

An isolated datacenter group within a cloud region with independent power and networking. Multi-AZ designs tolerate single-zone failure but not full regional outages.

Instance profile

A mechanism that delivers temporary credentials to cloud workloads, such as EC2 instances or Kubernetes service accounts, removing the need to embed long-lived access keys.

Four golden signals

Latency, traffic, errors, and saturation, used to monitor request-driven services. They prioritize signals that reflect user experience and capacity pressure.

Prometheus counter

A monotonic metric that only increases or resets on restart, such as total requests. Rates are computed with functions such as rate or increase over a time window.

Error budget

The allowed amount of unreliability derived as one minus the SLO target. Exhausting it typically freezes risky releases until reliability improves.

Distributed trace

A tree of timed spans sharing a trace identifier that follows one request across services. Span context propagation links work performed by each service.

SAST versus DAST

SAST analyzes source or bytecode without running the application; DAST probes a running application from outside. They find different classes of vulnerabilities and complement each other.

Software bill of materials

A machine-readable inventory of components and dependencies in an artifact, commonly in SPDX or CycloneDX format. It supports vulnerability response and license compliance.

Policy as code

Expressing security and compliance rules as versioned, testable code enforced automatically at admission or in pipelines. OPA with Rego is a common implementation.

Expand-and-contract migration

A backward-compatible schema change pattern: add new structures, backfill and dual-write, switch reads, then drop old structures in a later release. It keeps rollbacks safe.

Incident commander

The role that coordinates response, assigns tasks, and owns decisions during an incident. This person typically does not perform hands-on debugging themselves.