Intermediate concepts in DevOps & Cloud, page 5
Web Application Firewall (WAF): Your App's HTTP Bodyguard
A Web Application Firewall (WAF) is a specialized bodyguard for your web app, inspecting all HTTP traffic for malicious requests. It blocks common attacks like SQL injection and XSS by matching traffic against known patterns.
Kubernetes Probes: Liveness, Readiness, and Startup
Kubernetes probes ask your app about its health. Liveness asks 'are you alive?' (restart if not), readiness asks 'can you take work?' (pause traffic if not), and startup protects slow-starting apps. This is key for self-healing and zero-downtime deployments.
Single Sign-On (SSO): One Login, Many Apps
Single Sign-On (SSO) lets you log in once to access multiple apps. Instead of juggling passwords for Slack and Jira, you authenticate with one central service. This simplifies corporate IT access management.
Cloud Audit Trail: The 'Who Did What' Record
Think of a cloud audit trail as security camera footage for your infrastructure, recording who did what, where, and when. It's essential for investigating security incidents, proving compliance, and debugging operational issues.
Init Containers: Setup Tasks Before Your Main App Runs
Init containers are setup tasks that run to completion before your main application starts. Use them to wait for dependencies, fetch configs, or run database migrations.
Identity Federation: One Login for Many Services
Identity federation lets one trusted system vouch for a user's identity to many apps, like using a driver's license at multiple venues. This powers "Sign in with Google" and corporate SSO, but don't confuse it with simple user directory syncing.
DDoS Mitigation: Surviving Traffic Floods
DDoS mitigation acts like a smart bouncer, learning your app's normal traffic to block malicious floods. It's used for any public internet endpoint, filtering attacks at the network and transport layers (L3/L4).
CI/CD Pipelines: How Stages and Jobs Orchestrate Work
Think of a CI/CD pipeline as an assembly line. Stages are sequential stations (Build, Test, Deploy), while jobs are the parallel tasks at each station. This model automates software delivery. The footgun: a single failed job halts the entire line by default.
Kubernetes CronJob: Scheduled Tasks in Your Cluster
A Kubernetes CronJob is like a recurring alarm for your cluster. It automatically runs tasks like backups or reports on a schedule, creating a new Job for each run. The main footgun is concurrency: by default, jobs can overlap if one runs too long.
Conditional Pipeline Execution: Run Jobs Only When Needed
Think of conditional execution as if statements for your CI/CD pipeline, letting you run or skip jobs based on specific triggers. Use it to run tests on merge requests or deploy only from main.
Public Status Page: Your System's Voice During an Outage
A public status page is a dedicated site for communicating your service's health, turning "is it down?" support tickets into a single source of truth. It's used to report outages, degradation, and scheduled maintenance for public-facing services.
Secrets Management in CI/CD Pipelines
Treat secrets like temporary keys, not permanent passwords. Your CI/CD pipeline should fetch them just-in-time from a central vault, never storing them in code. The biggest footgun is storing secrets as long-lived environment variables in the CI tool itself.
5 Whys: Find the Root Cause, Not Just the Symptom
The 5 Whys technique digs past symptoms to find a problem's true root cause. It's used in postmortems to understand system failures by repeatedly asking "Why?". The footgun is stopping too early or blaming people instead of broken processes.
Jenkins Shared Libraries: Don't Repeat Your Pipeline Code
Jenkins Shared Libraries let you centralize and reuse Pipeline code, just like a common function library. Use them to define standard build or deployment stages across many projects.
GitHub Composite Actions: Script Your CI Steps
A composite action is a reusable script for your CI workflow, bundling multiple steps into one. It's perfect for DRYing up common sequences like setup and testing, but remember you cannot nest composite actions within each other.
Self-Hosted Runners: Bring Your Own CI/CD Hardware
A self-hosted runner is your own machine executing CI/CD jobs, giving you full control over its environment and network. Use it for private network access or custom hardware. The footgun: you are now responsible for all security, updates, and maintenance.
Beyond 'Root Cause': Proximate vs. Contributing Factors
A proximate cause is an incident's final trigger, while contributing factors are the conditions that made it possible. This helps post-mortems move beyond blame to find systemic risks.
Swiss Cheese Model: Layered Defenses Against Failure
Think of system defenses as slices of Swiss cheese. An accident happens only when the holes—weaknesses in each layer—align. It's used in post-mortems to see how small failures combine into a major outage.
Kubernetes Ingress: The Cluster's Smart Receptionist
Ingress acts as a smart receptionist for your cluster, routing external HTTP/S traffic to internal services based on host or path. This lets you expose many apps with one load balancer.
Hindsight Bias: The 'Knew-It-All-Along' Postmortem Trap
Hindsight bias makes past failures seem obvious. In postmortems, this leads to blaming engineers for not seeing what's now clear, instead of fixing the system. The footgun is judging past decisions with present knowledge, which hides real systemic flaws.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles