Concepts in DevOps & Cloud, page 9
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
Network ACLs: A Stateless Firewall for Subnets
A Network ACL (NACL) is a firewall for an entire cloud subnet, checking traffic as it enters or leaves. It's used for broad, stateless rules, like blocking a malicious IP from all instances.
DAST: Probing a Running App for Security Flaws
DAST acts like an automated pen-tester, attacking your running application from the outside to find flaws without seeing the code. It's used in CI/CD to catch common web vulnerabilities. The footgun: DAST can't see the code, so it misses business logic errors.
Loki: The Log System That Indexes Labels, Not Text
Loki is a log system that indexes only metadata labels, not the full log content. This makes it cheaper and simpler to run than full-text indexing systems, storing compressed logs in object storage.
Kubernetes Pods: The Atomic Unit of Deployment
A Pod is the smallest deployable unit in Kubernetes, a wrapper for one or more containers that run together on one machine. It's used for tightly coupled 'sidecar' helpers, like a log shipper.
VPC Peering: Connect Private Networks Securely
VPC peering connects two virtual networks as if they were one, letting them talk over private IPs. Use it to share files or access resources between VPCs across accounts or regions without going over the public internet.
Test Data Management (TDM): Stop Flaky Tests
Test Data Management (TDM) treats test data like code: versioned, managed, and reliably provisioned to ensure consistent, meaningful tests. This is crucial in CI/CD pipelines where automated tests require repeatable data states.
Inverted Index: The Engine of Fast Log Search
An inverted index makes log search fast by mapping terms to the logs containing them, like a book's index. It powers platforms like Splunk or Elasticsearch, enabling instant searches across terabytes of data. The footgun is indexing high-cardinality fields.
Labels and Selectors: The Glue of Kubernetes
Labels are key-value tags for organizing Kubernetes objects; selectors are queries to find them. This is how a Service finds its Pods. The main footgun is a mismatched selector, which orphans Pods from the Deployment that created them.
Load Balancer Health Checks: Don't Route to Dead Servers
A load balancer uses health checks to ask backend servers "Are you alive?" before sending them traffic. This is essential for any high-availability setup, preventing users from being routed to a crashed or unresponsive instance.
Package Manifest: Your Project's List of Ingredients
A package manifest is your project's recipe, listing all dependencies and build scripts. Package managers use it to install the right libraries. The footgun is forgetting that the manifest (e.g., package.json) and the lockfile work together for consistency.
Query Federation: Combining Prometheus Servers
Query federation lets one Prometheus server scrape metrics from another, creating a meta-monitor. Use it to build a global view from local servers or to combine application and infrastructure metrics for richer alerts.
DNS Routing Policies: Directing Traffic with Intention
DNS routing policies are a control plane for your domain, directing users based on location, latency, or server health. Use them for disaster recovery (failover) or canary releases (weighted). The footgun: confusing geolocation with latency-based routing.
Semantic Versioning: A Three-Part Numbering System
Semantic Versioning (SemVer) is a widely used convention for assigning software versions. It uses a three-part Major.Minor.Patch number to create unique identifiers for software states.
On-Call Rotations: Engineering Reliability Under Pressure
On-call rotations are the human backstop for service reliability, with engineers responding to alerts in minutes. This is critical for high-availability services like search or email.
etcd: Kubernetes's Single Source of Truth
etcd is the distributed key-value store that acts as the brain for a Kubernetes cluster, storing its entire configuration and state. The API server uses it to persist all objects, from Pods to Secrets.
Cloud Direct Connect: A Private Lane to the Cloud
Think of Direct Connect as a private fiber-optic highway from your datacenter to the cloud, bypassing the public internet. It's for stable, high-bandwidth needs like large data transfers where public internet performance is too unpredictable or insecure.
Docker Registry: A Library for Your Images
A Docker Registry is like GitHub, but for Docker images. It's a centralized storage system where you push and pull images, enabling sharing and deployment. The biggest footgun is using the :latest tag, which can lead to unpredictable builds.
Incident Command: Who Does What in a Crisis
The Incident Command System (ICS) is a playbook for major outages, assigning clear roles to avoid chaos. It's like an emergency response crew for your software. Use it when multiple teams must coordinate.
Kubelet: The Node Agent of Kubernetes
The kubelet is the primary agent on each Kubernetes node, ensuring containers described in PodSpecs are running and healthy. It watches the API server for work and reports status back. The footgun is trying to manage it directly; always use the API server.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles