JNCIS-DevOps cheat sheet

DevOps is defined by CALMS: Culture, Automation, Lean, Measurement, Sharing - culture is the prerequisite, not the outcome.

DORA delivery metrics: lead time for changes, deployment frequency, change failure rate, and time to restore service; throughput metrics are the first two, stability metrics the last two.

The Three Ways: (1) flow of work from dev to ops, (2) fast feedback loops, (3) continual experimentation and learning.

Blame-free postmortems are blameless only if they identify contributing system conditions, not just individual error; action items must be owned and dated.

Siloed incentives produce local optimization: dev measured on change volume, ops measured on uptime, yields conflict unless a shared metric (e.g., change failure rate) is used.

WIP limits reduce lead time by Little's Law: average lead time = average WIP / average throughput.

Toil is work that is manual, repetitive, automatable, tactical, and delivers no enduring value; SRE guidance caps operational work near 50% of time.

Error budgets quantify acceptable unreliability: budget = 1 − SLO; exhausting the budget prioritizes reliability work over new features.

Idempotence: applying the same configuration twice yields the same end state with no additional change; it is the defining property of declarative config tools.

Convergence vs. orchestration: configuration management converges a host to a desired state; orchestration sequences actions across hosts.

Push vs. pull: push (e.g., Ansible over SSH) needs no agent and is simpler to bootstrap; pull (e.g., Puppet/Chef agents) scales better and self-heals drift on a schedule.

Resource ordering in Ansible is playbook order; in Puppet it is dependency graph order implied by relationships (require, notify, before, subscribe).

Handlers and notifies fire only when the notifying resource reports changed, giving restart-on-change semantics without unconditional restarts.

Immutable infrastructure replaces servers rather than mutating them; configuration management inside the image is baked at build time, not applied at runtime.

Secrets belong in a vault or encrypted store referenced at deploy time; secrets committed to a repository persist in git history even after deletion.

Configuration drift is any difference between the declared desired state and actual state; periodic enforcement or drift detection jobs surface it.

CI requires every commit to trigger build plus automated tests on a shared trunk; long-lived feature branches delay integration and increase merge risk.

Continuous delivery keeps trunk always deployable with a manual release decision; continuous deployment removes that gate and releases automatically.

A pipeline stage gate should fail fast: cheapest checks (lint, unit) run before expensive ones (integration, end-to-end).

Artifacts must be built once and promoted unchanged through environments; rebuilding per environment invalidates test evidence.

Trunk-based development with short-lived branches and feature flags is the branching model associated with high delivery performance.

Rollback strategy options: redeploy previous artifact, blue/green switch, canary abort; database migrations must be backward compatible to allow it.

Test pyramid: many unit tests, fewer service/contract tests, fewest UI end-to-end tests; inverted pyramids produce slow, flaky pipelines.

A build is reproducible when identical inputs and pinned dependency versions yield an identical artifact; unpinned dependencies break this.

Declarative IaC states the desired end state (Terraform, CloudFormation); imperative IaC states the steps (scripts). Terraform is declarative with a state file.

Terraform state maps declared resources to real objects; remote state with locking prevents concurrent applies from corrupting it.

terraform plan is a dry run diff; terraform apply executes it; terraform refresh reconciles state with real infrastructure.

Configuration drift in IaC is detected by plan showing a non-empty diff; manual console changes are the usual cause.

NETCONF runs over SSH (port 830) and uses YANG-modeled XML; RESTCONF maps YANG to HTTP with JSON or XML.

gNMI/gRPC provides streaming telemetry and model-driven configuration; SNMP polling is slower and less granular by comparison.

Jinja2 and similar templating generate device configs from structured data (YAML/JSON inventory) - the template plus data pattern.

Network CI validates configs before deployment: syntax check, model validation (YANG), and lab/virtual device testing (e.g., containerized routers).

Three pillars: metrics (aggregated numbers), logs (discrete events), traces (request paths across services); observability is the ability to answer new questions from that data.

The four golden signals are latency, traffic, errors, and saturation; USE (utilization, saturation, errors) targets resources, RED (rate, errors, duration) targets services.

SLI is a measured indicator, SLO is a target value for it, SLA is a contractual commitment with consequences; SLO should be stricter than SLA.

Pull vs. push monitoring: Prometheus scrapes exporters over HTTP; push suits short-lived jobs via a pushgateway.

Alerting rule: page only on symptoms that affect users or burn error budget fast; multi-window burn-rate alerts reduce noise versus static thresholds.

Percentile latency (p95, p99) reveals tail behavior that averages hide; averages mask slow outliers.

Distributed tracing uses a trace ID propagated across services with spans per hop; context propagation headers are required for correlation.

Dashboards are for known questions; ad hoc query and exploration are for unknown ones - investing only in dashboards is a common gap.