LPI DevOps Tools Engineer cheat sheet

Git three-stage model: working tree → index (staging area) → repository; git add updates the index, git commit records the index as a tree object.

A merge commit has two parents; fast-forward merges move the branch pointer without creating a commit; git merge --no-ff forces a merge commit.

git rebase replays commits onto a new base, producing new commit hashes; never rebase commits already pushed to a shared branch.

CI pipeline stages run in order: build → unit test → package artifact → integration test → deploy; each stage gates the next on exit code 0.

Semantic versioning: MAJOR.MINOR.PATCH; MAJOR increments on incompatible API changes, MINOR on backward-compatible features, PATCH on backward-compatible fixes.

Infrastructure as Code declarative tools (Terraform) compute a diff between desired and actual state; imperative scripts execute steps without state tracking.

git bisect performs binary search over commit history to locate the first bad commit; mark commits good or bad to narrow the range.

Twelve-Factor App: config in environment variables, stateless processes, logs as event streams to stdout, and strict build/release/run separation.

A container shares the host kernel and isolates via Linux namespaces (PID, NET, MNT, UTS, IPC, USER) and cgroups (CPU, memory, I/O limits).

Dockerfile instruction order determines cache reuse: once a layer's instruction or its parent layer changes, that layer and all subsequent layers rebuild.

COPY copies from build context; ADD additionally handles URLs and local tar extraction - prefer COPY for predictability.

Multi-stage builds use multiple FROM lines; only artifacts copied into the final stage ship in the image, reducing size and attack surface.

Container image references: registry/repository:tag; a missing tag defaults to latest, which is mutable and unsuitable for reproducible deploys.

docker run -d -p hostPort:containerPort image publishes a port; -v hostPath:containerPath bind-mounts; --rm deletes the container on exit.

The container's main process is PID 1; it must reap orphaned children or handle SIGTERM for graceful shutdown - use an init process such as tini when needed.

docker build sends the build context (directory) to the daemon; a .dockerignore file excludes paths from that context and from COPY.

Control plane components: kube-apiserver (all requests), etcd (cluster state store), kube-scheduler (pod-to-node assignment), kube-controller-manager (reconciliation loops).

Node components: kubelet manages pod lifecycle on the node; kube-proxy programs Service routing rules; the container runtime runs containers.

Pod is the smallest deployable unit; containers in one Pod share network namespace (same IP, localhost) and can share volumes.

Service types: ClusterIP (internal virtual IP), NodePort (static port on every node), LoadBalancer (external LB), ExternalName (DNS CNAME).

Deployment manages ReplicaSets for stateless workloads; StatefulSet provides stable pod names and per-pod PersistentVolumeClaims; DaemonSet runs one pod per node.

A Pod is scheduled only when requests fit node allocatable resources; limits cap usage, and exceeding a memory limit triggers OOMKill of the container.

Readiness probes gate Service endpoints; liveness probes restart containers; startup probes delay liveness checks for slow-starting apps.

ConfigMap and Secret inject configuration via env vars or volume mounts; Secrets are base64-encoded, not encrypted, unless encryption at rest is configured.

The three pillars of observability are metrics (numeric aggregates over time), logs (discrete timestamped events), and traces (request path across services).

Prometheus pulls metrics from HTTP /metrics endpoints; PromQL rates use rate(counter[5m]), and histograms expose _bucket, _sum, and _count series.

The four golden signals: latency, traffic, errors, saturation - the minimum metric set for monitoring a service.

Kubernetes RBAC: Role/RoleBinding are namespaced; ClusterRole/ClusterBinding are cluster-wide; permissions are additive and default-deny.

Pod Security Standards define privileged, baseline, and restricted profiles; runAsNonRoot, dropped capabilities, and read-only root filesystems harden containers.

Secrets management: avoid baking credentials into images; inject at runtime from a vault or Kubernetes Secret and rotate regularly.

Distributed tracing propagates context via headers (e.g., W3C traceparent); a trace is a tree of spans identified by trace ID and span ID.

Least privilege for service accounts: disable automounting of the default token (automountServiceAccountToken: false) when the pod does not call the API.