More in DevOps & Cloud — page 14
Centralized logging across microservices
WHAT IT TESTS: aggregating and correlating logs. OUTLINE: ship structured logs from every service into a central searchable store, then propagate a correlation ID through all hops to trace one request. RED FLAG: grepping per-host files with no shared ID.
Automate patching across a VM fleet
WHAT IT TESTS: fleet configuration management. OUTLINE: use a patch or config tool to target by tag, roll out in canaried waves with health checks, and prefer immutable golden images long term. RED FLAG: SSHing into each of 100 boxes by hand.
What is Infrastructure as Code?
WHAT IT TESTS: the case for declarative infrastructure. OUTLINE: IaC defines infra in version-controlled files, giving repeatability, peer review, and drift-free consistency, unlike error-prone console clicks. RED FLAG: calling it mere scripting.
High-throughput serverless stream processing
WHAT IT TESTS: stream design at scale. OUTLINE: partition by key for per-user ordering, use a sharded log with batched consumers for backpressure, and tune batch size and shards for cost. RED FLAG: a global FIFO queue or per-event invocation at 100k/sec.
Serverless functions with a relational database
WHAT IT TESTS: the connection-storm problem. OUTLINE: concurrent function instances each open connections and exhaust the database's bounded pool; fix with a connection proxy or pooler, init-phase reuse, or capped concurrency. RED FLAG: a connection per call.
Distributed tracing for serverless apps
WHAT IT TESTS: end-to-end observability. OUTLINE: propagate a trace context through every hop, instrument with OpenTelemetry or X-Ray, capture spans including the database, and correlate traces with structured logs. RED FLAG: per-service logs, no correlation.
Idempotency in event-driven systems
WHAT IT TESTS: handling at-least-once delivery. OUTLINE: idempotency means repeated processing yields the same end state; it matters because messages get redelivered; achieve it with idempotency keys and conditional writes. RED FLAG: assuming exactly-once.
State machines versus long-running functions
WHAT IT TESTS: orchestration for long workflows. OUTLINE: state machines externalize state, pause for human input without running compute, give built-in retries and audit history, and bill per transition. RED FLAG: a function blocking for days on input.
Purpose and setup of a Dead-Letter Queue
WHAT IT TESTS: handling unprocessable messages. OUTLINE: a DLQ captures messages that repeatedly fail so they neither block the queue nor get lost; configure a redrive policy with a max receive count and alarm on it. RED FLAG: silently dropping failures.
Serverless cold starts and how to mitigate them
WHAT IT TESTS: the serverless execution model. OUTLINE: a cold start is the latency to provision and initialize a fresh environment; mitigate with provisioned concurrency, smaller packages, and lighter runtimes. RED FLAG: calling every slow call cold.
Debug intermittent pod-to-pod connectivity
WHAT IT TESTS: systematic network debugging. OUTLINE: scope the failure by path, rule out DNS, inspect kube-proxy iptables and conntrack, check the CNI, then verify cloud security groups and MTU. RED FLAG: restarting pods with no hypothesis.
Isolate tenants in a shared Kubernetes cluster
WHAT IT TESTS: layered multi-tenancy. OUTLINE: namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace. RED FLAG: treating a namespace alone as a hard security boundary.
Grant an EKS pod IAM access to S3
WHAT IT TESTS: secure workload identity. OUTLINE: IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials. RED FLAG: hardcoding keys or sharing the node profile.
Running stateful apps with StatefulSets
WHAT IT TESTS: stateful workloads in Kubernetes. OUTLINE: stateful apps need stable identity and storage; a StatefulSet gives stable names, ordered rollout, and per-Pod volumes. RED FLAG: claiming a Deployment plus PVC solves it.
Exposing Kubernetes services to the internet
WHAT IT TESTS: Kubernetes networking layers. OUTLINE: a Service gives stable access and LoadBalancer exposes one service, while Ingress adds L7 host and path routing with TLS for many services. RED FLAG: conflating the two, or one LB per service.
Multi-stage Docker builds
WHAT IT TESTS: separating build tooling from runtime. OUTLINE: a build stage compiles with the toolchain, the final stage uses a minimal base and copies only the artifact, cutting size and attack surface. RED FLAG: shipping compilers and source.
Kubernetes Deployment versus Pod
WHAT IT TESTS: Kubernetes controllers and self-healing. OUTLINE: a Pod is the smallest disposable unit, a Deployment maintains a desired replica count, self-heals, and rolls out updates. RED FLAG: bare Pods expected to be recreated after a crash.
Writing a Dockerfile for a web app
WHAT IT TESTS: core Dockerfile instructions and layering. OUTLINE: FROM a base, set WORKDIR, install dependencies before app code for cache reuse, EXPOSE the port, CMD the start command. RED FLAG: copying everything before installing deps, or root.
Migrating a stateful monolith to PaaS
WHAT IT TESTS: cloud-native refactoring strategy. OUTLINE: externalize state to backing services, make processes stateless and disposable, read config from the environment per Twelve-Factor. RED FLAG: a lift-and-shift that keeps local-disk state.
Cold starts in serverless environments
WHAT IT TESTS: serverless latency internals. OUTLINE: a cold start is the delay to provision a fresh instance and initialize the runtime; mitigate with provisioned concurrency and by shrinking init work. RED FLAG: blaming network or steady-state latency.