Concepts in DevOps & Cloud, page 21
Traffic Shaping for Safer Deployments
In deployments, traffic shaping isn't about network speed, but controlling user exposure. You route a precise percentage of users to a new code version, slowly 'opening the valve' from 1% to 100% to de-risk the release. This is the engine of a canary deploy.
K8s Authentication: Proving Who You Are to the API Server
The K8s API Server is a vault door; authentication is proving your identity to the guard. It tries a chain of methods—like OIDC for users or tokens for pods—until one succeeds. The footgun: unauthenticated requests become system:anonymous, a major risk.
Centralized Logging: A Universal Inbox for Your Systems
Centralized logging is a universal inbox for all your system events. Instead of SSHing into each server, agents forward logs to one searchable location, making it possible to debug issues that span multiple services. The footgun is inconsistent log formats.
Dark Launch: Test New Code Invisibly in Production
A dark launch tests new backend code on real production traffic without any user ever seeing it. Use it to measure the performance impact of a new recommendation engine or data service before the UI is built.
Chaos Mesh: Orchestrated Failure for Resilient Systems
Chaos Mesh is a disaster-as-a-service for Kubernetes. It lets you inject failures like network latency or pod kills to test system resilience. Use it to find weaknesses before they impact users, but be warned: its job is to break things, so scope experiments…
Kubernetes API Server Authorization Modules
Kubernetes API server authorization is like a chain of security guards. A request must get a "yes" from at least one configured module (like RBAC) to pass. This is fundamental to securing any cluster. The footgun is that the chain stops at the first "allow."
SLIs & SLOs: Measuring What Matters for Service Reliability
SLIs are what you measure (e.g., latency); SLOs are the target you aim for (e.g., 99% success). They replace vague feelings about service health with concrete numbers. This is how SREs define and manage reliability.
Shadow Deployment: Rehearsing a Release with Live Traffic
Shadow deployment is like a stunt double for your service: it receives a copy of live production traffic to test a new version without impacting users. Use it to validate performance and find bugs under real load.
AWS Fault Injection Simulator
AWS Fault Injection Simulator is a controlled chaos button: it breaks resources on purpose to prove your failover works before real disasters. Run it before peak traffic to validate auto-healing.
Kubernetes Audit Logging: Your Cluster's Black Box Recorder
Kubernetes audit logging is the security camera for your API server, recording every API call to answer "who did what, and when?". It's essential for security forensics and compliance, but a common footgun is using a weak default or logging everything.
Cloud Cost Management: Taming Your Bill
Treat cloud spend like a utility bill you can actively control, not a fixed cost. It's essential when your AWS, GCP, or Azure bill is growing unpredictably. The biggest footgun is treating cost management as a one-time cleanup instead of a continuous process.
Deployment Rings: De-risking Rollouts with Progressive Exposure
Deployment rings are like blast shields for software updates, containing a bad release's impact to a small group. They're used in CI/CD to roll out changes progressively, from internal teams to all users.
FMEA: Systematically Mapping What Could Go Wrong
FMEA is a structured pre-mortem for system components, cataloging potential failures, their causes, and their effects. It's used in system design to proactively identify risks before they become outages. The footgun is treating it as a one-time task.
Falco: Real-Time Threat Detection for Cloud-Native
Falco is a runtime security camera, watching Linux syscalls to detect threats in real time. It's used in Kubernetes to spot abnormal behavior like privilege escalation or writing to /etc. The key is it only *detects* and *alerts*; it doesn't block threats.
IaC State: The Map Between Your Code and the Cloud
IaC state is the source of truth mapping your code to real-world resources, acting as your tool's memory. Terraform uses a state file to plan updates, while other tools use a service backend. The footgun: never commit state files to Git; they lack locking and.
Progressive Delivery: Ship Faster by Reducing Blast Radius
Progressive Delivery reduces release risk by shipping to small user groups before a full rollout, like a soft-opening for new code. It uses canary releases and feature flags to catch issues before they impact everyone.
Resilience Engineering: Studying Success, Not Just Failure
Resilience Engineering studies how systems succeed despite surprises, not just why they fail. It applies to incident analysis and chaos engineering, focusing on building adaptive capacity for unknown events rather than just preventing known failure modes.
The Three Pillars of Observability
Observability isn't one tool; it's a three-legged stool of metrics, logs, and traces. Metrics give the 'what' (CPU is high), logs the 'why' (an error loop), and traces the 'where' (which service is slow). The footgun is treating them as separate silos.
Policy as Code: Rules as Versioned, Testable Code
Policy as Code (PaC) treats rules like code: versioned, tested, and automated. Instead of manual UI clicks, you define guardrails in a declarative language. Use it in CI/CD to block bad deploys or in Kubernetes to enforce runtime rules.
Release Orchestration: Air Traffic Control for Deployments
Release Orchestration is the air traffic control for software delivery, coordinating multiple pipelines and teams. It's used for complex launches with interdependent services, ensuring everything deploys in the correct sequence.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles