Advanced concepts in DevOps & Cloud, page 4
Pod QoS Classes: Guaranteed, Burstable, BestEffort
Kubernetes QoS classes are eviction priorities, not performance guarantees. Under node pressure, the kubelet kills BestEffort pods first, then Burstable, then Guaranteed. Omitting limits does not grant infinite headroom; it makes your pod die first.
CSPM: A Single Pane of Glass for Cloud Security
A CSPM is a single pane of glass for your cloud security, continuously scanning all assets for misconfigurations. It unifies security data across multi-cloud environments, replacing disparate tools.
Pod Disruption Budgets: Stop Upgrades From Killing Your App
A Pod Disruption Budget (PDB) is a contract with Kubernetes to maintain minimum availability. It limits how many pods can be voluntarily terminated at once during node drains or cluster upgrades, preventing self-inflicted outages.
Data Sovereignty: Your Data's Legal 'Citizenship'
Data sovereignty means data is subject to the laws of the country it's in; data residency is storing it there to comply. This is critical for apps in regions with strict laws like the EU's GDPR. The footgun is confusing residency with full legal compliance.
Pod Affinity: Grouping or Separating Your Pods
Pod affinity tells Kubernetes to place pods together for performance or apart for high availability. Use it to co-locate a web server and cache for low latency, or spread database replicas across nodes to prevent a single point of failure.
Cloud Compliance Frameworks: Security as a Standard
Think of a cloud compliance framework as a standardized rulebook for security. It translates broad security goals into specific, auditable controls, providing a checklist to prove your cloud environment is secure to regulators and customers.
OODA Loop: Winning the Incident Response Race
The OODA loop (Observe, Orient, Decide, Act) is a model for making fast decisions under pressure. During an incident, the team that cycles fastest wins. It's used for triaging alerts and debugging live outages.
Pipeline Templates: Reusable CI/CD Building Blocks
Think of pipeline templates as versioned, shareable functions for your CI/CD. Instead of copy-pasting YAML, you import a standardized block of logic for tasks like security scanning or deployment.
Dynamic Pipelines: Parent-Child vs. Multi-Project
Break up monolithic CI/CD pipelines into smaller, independent ones. Use parent-child pipelines for dynamic jobs in one project (like a monorepo), or multi-project pipelines to coordinate across repos. The footgun: the parent pipeline doesn't wait by default.
Policy as Code in CI/CD with OPA
Treat pipeline rules as code using Open Policy Agent (OPA) to automate guardrails. Instead of scripts, write declarative policies to check test coverage or validate dependency licenses.
EndpointSlice: Splitting the Monolithic Endpoints List
EndpointSlice shards a service's pod backends into smaller chunks instead of one massive list. This keeps kube-proxy and DNS fast when services scale to thousands of pods. Do not edit them by hand; the controller owns them and will overwrite your changes.
Serverless Databases: Pay for Use, Not for Idle
A serverless database automatically scales compute and storage based on demand, from zero to massive, without you managing any servers. Use it for spiky, unpredictable workloads to avoid paying for idle capacity.
Kubernetes NetworkPolicy: A Firewall for Pods
NetworkPolicy is a firewall for pods, locking down traffic in a cluster where everything can talk to everything by default. Use it to isolate services, like preventing a web frontend from directly accessing a database.
Cloud Data Warehouse: Analytics Without the Hardware
A cloud data warehouse is your company's analytical brain, but without the hardware headache. It separates storage and compute, letting you query massive historical datasets from sales, marketing, and ops.
Auto-Remediation: Automated Fixes for Common Failures
Auto-remediation is a system's immune response, automatically detecting and fixing known problems like a crashed service. It's a core SRE practice for improving availability, but a bad script can create a 'remediation storm' that worsens an outage.
kube-proxy: The Plumber for Kubernetes Services
kube-proxy is the network plumber on each node, making Kubernetes Services work. It translates a Service's virtual IP into routes to real pods using iptables or IPVS. The name is a footgun: it's a Layer 4 packet forwarder, not a Layer 7 application proxy.
Managed Graph Databases: When Relationships Are the Data
A managed graph database models data as nodes and edges, making relationship-heavy queries fast. Use it for social networks, fraud detection, or recommendations.
Automated Canary Analysis: Let the Metrics Decide
Automated canary analysis uses metrics to decide if a new release is safe. It compares a new 'canary' version against the stable 'baseline' in production, scoring its health before a full rollout.
Managed Time Series Databases (TSDB)
A managed time series database is a hosted service optimized for data with a timestamp. It's used for application monitoring, IoT sensor data, and financial analytics. The main footgun is using a general-purpose database, which fails at high-volume writes.
Global Database: One Logical DB, Multiple Regions
A global database is a single logical database that spans multiple geographic regions, providing fast local reads and disaster recovery. It's used for apps with a worldwide user base that must survive regional outages.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles