Advanced concepts in DevOps & Cloud, page 5
AWS DMS: Automating Database Migrations
AWS DMS automates moving data between databases, not just as a simple data pump. Use it for one-time migrations to the cloud or for continuous replication. The footgun is assuming DMS also converts your schema; for different engines, you must use the Schema…
Pulumi: Infrastructure as Code with Real Programming Languages
Pulumi is Infrastructure as Code using real languages like Python or TypeScript, not a special DSL. This lets you use loops, functions, and classes to define resources. The main footgun is writing overly complex, clever code that becomes unmaintainable.
Terragrunt: A Thin Wrapper for DRY Terraform
Terragrunt is a thin wrapper for Terraform/OpenTofu that automates common tasks. Just add an empty terragrunt.hcl file to get features like automatic init.
Open Policy Agent (OPA): Centralized Policy as Code
OPA decouples policy decisions from your app's code. Instead of scattering if statements, you query a central engine: 'Is this allowed?' It enforces rules in Kubernetes, CI/CD, and API gateways. A common footgun is only using it for yes/no decisions.
Cloud-Init: Bootstrapping Cloud Instances
Cloud-init is the script that runs on a generic VM's first boot to turn it into *your* server. It's used by cloud providers to apply your user-data (like SSH keys and startup scripts) at launch. The biggest footgun: it only runs once on first boot.
Continuous Deployment: Shipping Code on Every Commit
Continuous Deployment isn't just automation; it's shipping every merged change to production automatically. It's for teams with high test coverage and robust monitoring to reduce lead time.
Shadow Deployment: Test in Production, Safely
Shadow deployment copies live user traffic to a new "shadow" service for testing without user impact. It's used to validate new code versions with real-world load or to analyze traffic for security threats.
External Secrets Operator: Sync Secrets into Kubernetes
Treat your cloud's secret manager as the source of truth. The External Secrets Operator (ESO) fetches secrets from external APIs like AWS Secrets Manager or Vault and injects them into native Kubernetes Secrets, keeping them in sync.
Sealed Secrets: Safely Commit K8s Secrets to Git
Sealed Secrets lets you commit encrypted Kubernetes secrets to a public Git repo. In a GitOps workflow, this allows all configuration to live in version control. The footgun: a SealedSecret is a one-way street; only the target cluster can decrypt it.
Immutable Deployments: Treat Servers Like Cattle, Not Pets
Treat servers like cattle, not pets. Instead of modifying live servers, you deploy updates by replacing entire server fleets with new, pre-baked images. This eliminates configuration drift and simplifies rollbacks.
.ebextensions: Infrastructure as Code for Elastic Beanstalk
.ebextensions are config files for customizing the AWS resources in your Elastic Beanstalk environment. Use them to install packages, run commands on instances, or provision related AWS resources.
Cloud Native Buildpacks: No More Dockerfiles
Cloud Native Buildpacks turn source code into container images without a Dockerfile. This lets platform teams enforce security and best practices, while app developers just push code. The footgun is assuming they're simple; they're a full build system.
Kubernetes Sealed Secrets: Git-Friendly Secret Management
Sealed Secrets let you safely commit encrypted Kubernetes secrets to a public Git repo. A one-way lockbox: anyone can add a secret, but only the target cluster can unlock it. Essential for GitOps, but remember: a Sealed Secret is tied to its cluster.
Critical Path Analysis for Performance Tuning
Critical path analysis finds the slowest chain of operations in a request, showing where to optimize for impact. Use it in distributed tracing to see which service call is the bottleneck. Optimizing off-path components is wasted effort.
External Secrets Operator: Sync Secrets into Kubernetes
The External Secrets Operator (ESO) acts as a bridge, syncing secrets from an external store like Vault or AWS Secrets Manager into native Kubernetes Secrets. This keeps secrets out of Git and centralizes management.
Queueing Theory: The Math of Waiting Lines
Queueing theory is the math of waiting lines, helping you predict system performance under load. It's used for capacity planning and setting autoscaling rules.
Container Storage Interface (CSI): The Universal Adapter for K8s Storage
CSI is a universal adapter for storage in Kubernetes, letting any storage system speak a common language. This allows providers to create plugins for their systems without touching core Kubernetes code.
Amdahl's Law: The Bottleneck of Parallel Speedup
Amdahl's Law shows a system's speedup is limited by its sequential parts. If 10% of a task must run serially, your maximum speedup is 10x, no matter how many cores you add. This applies to CPUs, databases, and distributed jobs.
Universal Scalability Law: The Physics of Scaling
The Universal Scalability Law (USL) models throughput by quantifying the two costs of parallelism: contention and coherency. Use it to forecast performance and diagnose bottlenecks.
Kubernetes Volume Snapshots: A Save Point for Data
A Volume Snapshot is a point-in-time copy of your persistent data in Kubernetes, like a game save. Use it to back up a database before an upgrade or clone a prod environment. The footgun: it's not a true backup; a storage failure can lose both.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles