Advanced concepts in DevOps & Cloud, page 6
Managed Kubernetes: Your Cloud's K8s Control Plane
A managed Kubernetes service (EKS, AKS, GKE) runs the complex K8s control plane for you, letting you focus on deploying apps, not managing infrastructure. Use it to run containers without the overhead of maintaining masters.
Horizontal Pod Autoscaler (HPA): Scale on Demand
A Horizontal Pod Autoscaler (HPA) is a thermostat for your app's capacity, adding or removing pods based on load. It's used to handle traffic spikes by watching metrics like CPU, but a common footgun is setting aggressive thresholds that cause flapping.
Pod Priority: Deciding Who Gets Evicted in Kubernetes
Pod Priority is a VIP pass for your critical workloads, telling the scheduler which pods can bump others off a node. This ensures system-critical services run even on a full cluster. The footgun: high-priority pods can cause cascading evictions if not planned.
Kubernetes StatefulSets: Stable Identity for Pods
A StatefulSet gives pods a stable, unique identity and persistent storage, unlike a Deployment's interchangeable replicas. Use it for clustered databases or queues where members need stable network names.
Bulkhead Pattern: Isolate Failures, Protect Your System
The Bulkhead pattern partitions a system like a ship's hull, containing failures to prevent a total outage. By isolating resource pools for each service or consumer, a fault in one component won't cascade and take down the entire application.
Kubernetes CPU Management: Static vs. None Policy
K8s CPU policies control if your pod gets a dedicated CPU core or just a time-slice of a shared one. The default none policy maximizes utilization, while static gives exclusive cores to latency-sensitive apps.
Service Mesh: The Network Layer for Your Microservices
A service mesh acts as a dedicated network layer for microservices, handling complex communication logic outside your application. It enables features like mTLS and canary releases.
Data Sharding: Splitting a Database for Scale
Sharding splits a huge database into smaller, independent databases (shards), each on its own server. It's like giving different volumes of a phone book to different librarians. This is critical for massive datasets, but a bad shard key creates 'hot spots'.
Kubernetes Scheduler Framework: A Plugin System for Pod Placement
The Kubernetes Scheduler Framework is a plugin pipeline for pod placement. Use it to add custom logic—like co-scheduling ML jobs or avoiding specific nodes—without forking Kubernetes. The footgun: a slow plugin can bottleneck your entire cluster's scheduling.
CNI: The Universal Plug for Container Networking
CNI is the standard API that decouples container runtimes from network implementations. In Kubernetes, it lets you swap networking plugins like Calico or Flannel.
Threat Modeling for Reliability: Find Failures Before They Happen
Threat modeling for reliability is like pre-gaming an outage: you systematically ask "how will this break?" before shipping code. Instead of attackers, you model failures like a database failing or a cloud region going down, then design mitigations.
Kubernetes Operators: SREs in a Box
Think of an Operator as an automated site reliability engineer for your app, encoding human knowledge into software. It's used to manage complex stateful applications like databases, automating tasks like backups and upgrades.
Serverless State Machines: The Conductor for Your Functions
A serverless state machine is the conductor for your microservices, telling each function when to run and how to handle errors. It's built for multi-step processes like ETL pipelines or coordinating parallel tasks. The footgun is creating a visual monolith.
The Saga Pattern: Transactions Across Microservices
The Saga pattern manages transactions across services by chaining local operations. If a step fails, compensating actions undo previous work. It's common in booking systems.
CQRS: Separate Models for Reading and Writing Data
CQRS splits your application into two parts: one for changing data (Commands) and one for reading it (Queries), often with separate data models. Use it in complex systems with different read/write patterns.
K8s Authentication: Proving Who You Are to the API Server
The K8s API Server is a vault door; authentication is proving your identity to the guard. It tries a chain of methods—like OIDC for users or tokens for pods—until one succeeds. The footgun: unauthenticated requests become system:anonymous, a major risk.
Kubernetes API Server Authorization Modules
Kubernetes API server authorization is like a chain of security guards. A request must get a "yes" from at least one configured module (like RBAC) to pass. This is fundamental to securing any cluster. The footgun is that the chain stops at the first "allow."
Kubernetes Audit Logging: Your Cluster's Black Box Recorder
Kubernetes audit logging is the security camera for your API server, recording every API call to answer "who did what, and when?". It's essential for security forensics and compliance, but a common footgun is using a weak default or logging everything.
FMEA: Systematically Mapping What Could Go Wrong
FMEA is a structured pre-mortem for system components, cataloging potential failures, their causes, and their effects. It's used in system design to proactively identify risks before they become outages. The footgun is treating it as a one-time task.
Falco: Real-Time Threat Detection for Cloud-Native
Falco is a runtime security camera, watching Linux syscalls to detect threats in real time. It's used in Kubernetes to spot abnormal behavior like privilege escalation or writing to /etc. The key is it only *detects* and *alerts*; it doesn't block threats.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles