DevOps interview prep

• AI-Assisted Engineering Practice — Where AI coding tools genuinely help infrastructure work and where they reliably fail, context engineering as
• AI-Augmented DevOps — Using large language models and ML to accelerate DevOps workflows: AI code review, intelligent incident respon
• Anatomy of a Chart — Every file in a Helm chart and what it does. Chart.yaml metadata, values.yaml defaults, templates/, _helpers.t
• Ansible — SSH-based agentless configuration management from Red Hat. YAML playbooks, idempotent modules, dynamic invento
• Ansible Project Structure — Standard Ansible project layout with 21 explained components: inventory (production/staging), group_vars (all.
• Ansible Roles vs Collections — Roles organize tasks within a project into reusable units (tasks/handlers/templates/vars/defaults/files). Coll
• APM Platforms — Application Performance Monitoring — integrated traces + metrics + logs + RUM + profiling in one product. Data
• App of Apps Pattern — The original recursive Argo CD pattern (a parent Application that creates child Applications) and its modern r
• Argo CD — CNCF Graduated GitOps tool. Used at Intuit, IBM, Tesla, BMW, Adobe. Five microservices: server, application-co
• Argo CD at Scale — Sharding, Performance Tuning, Failure Modes and Mistakes — Scaling one Argo CD instance to hundreds of clusters: controller sharding, repo-server and Redis tuning, and t
• Argo Workflows — CNCF Graduated K8s-native workflow engine. Workflow CRD with DAG/steps templates, artifacts via S3/GCS, parame
• Backstage — Backstage is the CNCF-graduated (2024) open-source developer portal originated at Spotify. Includes software c
• Bare-Metal Provisioning — How a machine with no operating system becomes a cluster node: the network boot chain, out-of-band management,
• Bazel — Google's hermetic build system for monorepos. Incremental, multi-language builds with remote caching and remot
• Bitbucket Pipelines — Atlassian container-per-step CI: bitbucket-pipelines.yml structure, caches versus artifacts, the shared per-st
• Build Performance and Caching for C++ — Where C++ build time actually goes and how to get it back — measurement first, then ccache and sccache, distri
• Building MCP APIs and Servers — The Model Context Protocol as a control-plane API surface: the JSON-RPC foundation, tools versus resources ver
• Buildkite — Hybrid model: SaaS-hosted UI/orchestrator with self-hosted agents on your infrastructure. Designed for mega-mo
• Buildpacks, Jib & ko — Three production-grade ways to ship a container without writing or maintaining a Dockerfile. Cloud Native Buil
• C++ Dependency Management with Conan and vcpkg — Why C++ never got a canonical package manager, and how Conan 2 and vcpkg manifest mode close the gap — package
• C++ Test Automation and Coverage — GoogleTest and GoogleMock, Catch2 and doctest, CTest as the runner, and coverage with gcov/lcov and llvm-cov.
• Chaos Engineering — Deliberately injecting failures into production-like systems to uncover weaknesses before they cause outages.
• Chart Dependencies — Declaring and managing sub-chart dependencies in Chart.yaml, running helm dependency update, aliasing sub-char
• ChatOps and Self-Service Release Bots — Operations in a shared channel, where the transcript is the audit log. The Slack platform mechanics a platform
• CI/CD and GitOps Integration — Driving Helm through GitHub Actions and GitLab CI pipelines, integrating with Argo CD and Flux for GitOps, and
• CircleCI — Performance-first SaaS CI. Per-second billing, fast hosted runners, Orbs registry for reusable config, automat
• Cloud-Native IaC — Cloud-vendor-native IaC tools — AWS CDK on top of CloudFormation, Azure Bicep on top of ARM, Crossplane / ACK
• Cluster API and Declarative Cluster Lifecycle — Managing Kubernetes clusters as Kubernetes objects: the Cluster, Machine, MachineSet, MachineDeployment and Ma
• CMake for Cross-Platform C++ — Modern target-based CMake: usage requirements that propagate correctly, install and export so downstream proje
• CNCF Landscape & Cloud Native Ecosystem — Navigating the CNCF landscape, understanding project maturity levels (sandbox/incubating/graduated), and selec
• Configuration Drift — When the running system diverges from its declared state — manual SSH fixes, time-based decay, partial deploys
• Container Errors — OOMKilled, Exit Codes, Probes and Stale Images — Failures inside the container boundary: OOM kills, exit codes 1, 126, 127, 139, 143 and 255, StartError, readi
• Container Fundamentals — Containers are not lightweight VMs — they are Linux processes scoped by namespaces, capped by cgroups, and con
• Container Image Hardening — The smaller the image, the smaller the attack surface — and the smaller the CVE backlog. Distroless (Google),
• Container Probes — Liveness, Readiness, Startup — Kubernetes has three probe types (liveness, readiness, startup) and three probe mechanisms (httpGet, tcpSocket
• Container Runtime Security — Static image scanning catches known CVEs at build time; runtime security catches the rest. Falco (CNCF Graduat
• containerd and Container Runtimes — containerd is the industry-standard container runtime daemon that manages the complete container lifecycle, fr
• Continuous Delivery vs Deployment — Continuous Delivery is the capability to release any commit; Continuous Deployment automates the act. Same pip
• Continuous Integration — Fowler's CI definition, the ten practices, and why daily mainline commits with a fast self-testing build is th
• Control Plane Errors — API Server, RBAC, Webhooks, Quotas and Finalizers — The failures that stop you before any workload runs: unreachable API servers, Forbidden, broken webhooks, stuc
• Cost-Optimized CI Runner Fleet — Designing CI runner fleets with spot/preemptible instances, warm pools, and cross-region spot arbitrage to min
• Cross-Compilation and Sysroots — Build, host, and target machines; GNU triples; what a sysroot actually contains; CMake toolchain files and the
• Crossplane — Cloud Control Plane — Kubernetes-native cloud infrastructure management — Crossplane turns your Kubernetes cluster into a universal
• Dagger — Dagger is a programmable CI/CD engine that lets you define pipelines as code using Go, Python, or TypeScript S
• Data Observability — Five-pillar data observability (freshness, volume, schema, distribution, lineage), the OpenLineage standard, d
• Database Migrations in CI/CD — Versioned schema migrations under CI/CD. Tools (Flyway, Liquibase, Sqitch, Atlas, Bytebase, Prisma Migrate, Al
• Database Schema Evolution — Schema evolution as a discipline, not a tool. Expand-contract in depth, online DDL theory, multi-region migrat
• Debugging a Broken Alerting Pipeline — Systematic approach to diagnosing why alerts stopped firing during a production incident.
• Deploying Kubernetes on Bare Metal — End to End — The whole build in order, from racked hardware to running workloads: node baseline and containerd, an API-serv
• Deployment Strategies — The deploy mechanics under progressive delivery. K8s Deployment rolling-update internals (maxSurge, maxUnavail
• Dev Containers & Reproducible Dev Environments — Standardizing development environments with Dev Containers spec, Devbox, Nix shells, and cloud IDEs to elimina
• Developer Experience Metrics — Three frameworks for measuring developer experience: DORA (deploy frequency, lead time, MTTR, change failure r
• Developer Productivity — SPACE Framework — The SPACE framework for measuring developer productivity across Satisfaction, Performance, Activity, Communica
• DevSecOps Architecture & Pipeline — Security embedded in every CI/CD stage: Developer → GitHub → [Build & Test → SAST Scan → Dependency Scan → Doc
• Distributed Tracing — Trace requests across service boundaries. Spans, parent/child relationships, baggage, sampling. Tools: Jaeger
• Docker — Production Errors, Mistakes and Recovery — Docker exit codes, OOM kills, stop signals, full disks, registry, network and daemon errors, decoded from the
• Docker BuildKit and Modern Container Builds — BuildKit (default backend in Docker 23+, 2023) replaced the legacy Docker builder with a parallel DAG executor
• Docker Buildx — Docker Buildx extends the Docker CLI with BuildKit — a next-generation builder that executes Dockerfile stages
• Docker CLI — Mastering the Docker CLI means knowing which flags actually control container behavior, how to inspect running
• Docker Compose — Docker Compose defines and runs multi-container applications from a single YAML file. One command — docker com
• Docker Container Lifecycle and Signals — Every container moves through a defined lifecycle: created, running, paused, stopped, removed. Understanding S
• Docker Daemon — The Docker daemon (dockerd) is the long-running process that manages all Docker objects. It delegates containe
• Docker Debugging and Observability — Effective Docker debugging uses docker exec for live inspection, docker logs for output capture, docker inspec
• Docker Image Internals and OCI Spec — Docker images are OCI-compliant stacks of content-addressed layer tarballs plus a JSON config and a manifest.
• Docker Multi-Stage Builds — Multi-stage builds use multiple FROM instructions in one Dockerfile to separate build-time tools from the prod
• Docker Networking — Docker gives every container its own network namespace by default. Containers on the same user-defined bridge
• Docker Overview — Docker is an open platform for building, shipping, and running applications in containers. It uses a client-se
• Docker Registries — A registry stores and distributes container images as content-addressed layer blobs and manifests. Understandi
• Docker Resource Limits — Docker uses Linux cgroups v2 to enforce per-container CPU quotas, memory hard limits, swap access, and PID cou
• Docker Security — Container security is defense-in-depth: minimal base images reduce the CVE surface, dropping Linux capabilitie
• Docker Storage — Container filesystems are assembled from read-only image layers stacked via overlayfs, with a thin writable la
• Docker Swarm — Docker Swarm turns a group of Docker hosts into a single cluster managed through the standard Docker API. It u
• DORA 2024 — 39 Capabilities & AI Impact — DORA 2024 State of DevOps: 39 capabilities across 5 clusters, new AI category, 5 performance levels. How elite
• DORA Four Keys — Deep Dive — DORA Four Keys: Deployment Frequency, Lead Time for Changes, Change Failure Rate, Time to Restore. Elite: depl
• DORA Four Keys — Implementation — Implementing DORA 4 Keys in practice — measuring deployment frequency, lead time, change failure rate, and MTT
• DORA Metrics — The four delivery metrics from DORA research that distinguish elite from low performers. Measurable, actionabl
• DORA Metrics — Definitions, the Math, and How to Measure Them — The five DORA metrics as formulas with worked arithmetic, and how Four Keys and GitLab actually compute them.
• eBPF Observability — Kernel-level observability without code changes. eBPF runs verified programs at kprobes/uprobes/tracepoints/XD
• eBPF Programming — eBPF lets you run sandboxed programs inside the Linux kernel without changing kernel source or loading kernel
• Ephemeral and Preview Environments — Replacing the one shared staging environment with a disposable environment per pull request: isolation models
• etcd and the API Server — The Write Path, Raft, and Why 3 vs 5 Members Matters — How a Kubernetes write travels from kubectl through the API server into etcd and back out as watch events, how
• Event-Driven Architecture — The patterns that make event-driven systems work in practice. Transactional outbox (atomic write + publish), s
• Event-Driven Automation and StackStorm — If-this-then-that for infrastructure. StackStorm sensors, triggers, rules, actions and Orquesta workflows, how
• External Secrets Operator — Sync secrets from AWS Secrets Manager, Vault, GCP Secret Manager, and other stores into Kubernetes Secrets — t
• Feature Flags — Decouple deploy from release. Flag types (release, ops, experiment, permission), evaluation models (server-sid
• FinOps & Cloud Cost Engineering — The practice of bringing financial accountability to the variable spend model of cloud computing through cross
• Firecracker microVMs — Firecracker is an open-source Virtual Machine Monitor written in Rust by AWS that uses Linux KVM to run lightw
• Flux v2 — CNCF Graduated GitOps tool. Originated at Weaveworks (the GitOps coiners). v2 rewrite from monolithic v1 to mo
• GCC Toolchain Internals — What the gcc driver actually runs, what each optimization and debug level enables, and the flags that silently
• GCC Upgrades and ABI Migration — Why moving a fleet from GCC 9 to GCC 14 is a platform migration and not a version bump: the libstdc++ dual ABI
• Git — Git from the three trees to merge queues: every command as a live picture, then branching, integration, histor
• Git Migration to GitHub — Moving repositories to GitHub or between GitHub products: strategy and paths, GitHub Enterprise Importer, live
• GitHub Actions — The dominant CI/CD platform in 2026 (~33% market share, JetBrains DevEcosystem 2024). Workflow architecture, r
• GitLab CI — The integrated DevSecOps platform — SCM + CI + container registry + SAST/DAST + dependency scanning in one pro
• GitOps — Pull-Based Deployment Model — OpenGitOps 4 principles: declarative, versioned+immutable, pulled automatically, continuously reconciled. Argo
• GitOps Drift Detection and Reconciliation — Drift is when cluster state diverges from git — a kubectl edit hotfix, a mutating admission webhook, a partial
• GitOps for Databases — Why databases were excluded from the original GitOps wave and how Atlas Operator, Bytebase, Schemahero, and pg
• GitOps Principles — Weaveworks coined the term in 2017; OpenGitOps (CNCF, 2021) formalized it. Four principles: declarative, versi
• GNU Make and gmake — The dependency-graph and timestamp model that still underlies almost every C and C++ build, plus the rules, au
• Go for Control-Plane Development — The subset of Go that matters when you are writing controllers, admission webhooks, and platform APIs — contex
• Go Templating — The Go template engine that powers Helm charts: pipelines, built-in objects, control structures (if/with/range
• Golden Paths — Golden paths are the well-trodden, supported, opinionated default for the 80% of use cases. Spotify-coined ter
• gRPC & Protocol Buffers — High-performance RPC framework using Protocol Buffers — unary and streaming RPCs, HTTP/2 multiplexing, schema
• Hardware-in-the-Loop CI — How to wire real GPUs and boards into CI as hardware-in-the-loop test benches: self-hosted runners, exclusive
• HashiCorp Vault — Vault as a system: seal and unseal, Raft storage and HA, the secret engines and auth methods that matter on Ku
• Helm 4 Migration — What changed in Helm 4 (November 2025): server-side apply, improved Secrets-based release storage, namespace i
• Helm vs Kustomize — The two dominant K8s manifest tools, with opposite philosophies. Helm packages charts (Go-templated YAML + val
• HelmRelease and helm-controller — The HelmRelease CRD turns Helm into a controller-driven, continuously reconciled resource with automated remed
• High Availability System Design — HA eliminates single points of failure: Load Balancer → Multiple App Servers in different AZs → Primary DB + R
• How User Requests Travel in Kubernetes — End-to-end flow: User browser → DNS → Load Balancer → Ingress Controller → Kubernetes Service → kube-proxy/IPV
• HTTP 4xx and 5xx in Kubernetes — Which Hop Sent It and How to Fix It — How to tell which hop wrote a 4xx or 5xx (CDN, cloud load balancer, Ingress, mesh sidecar, app or API server)
• IaC Governance — Policy enforcement at PR time — OPA Rego, HashiCorp Sentinel, Checkov, tfsec, Terrascan, Infracost cost gates,
• IaC State Management — State is the bottleneck of declarative IaC. S3 + DynamoDB locking, Terraform Cloud / Spacelift / env0 / Atlant
• Identity, Secrets and Config Errors — Workload Identity, Stale ConfigMaps and Secret Stores — Pods that run fine but cannot reach a cloud API, read yesterday's config, or never start because the secret st
• Image Update Automation — How Flux closes the loop from container registry back to Git: image-reflector-controller scans tags, image-aut
• Immutable Infrastructure — The discipline of never modifying running servers or containers — replace them instead. Image baking with Pack
• Infrastructure as Code — The discipline of expressing infrastructure as version-controlled, reviewable, idempotent code. Declarative st
• Ingress & Gateway API — How external traffic reaches Pods. Ingress (legacy, controller-specific via annotations) vs Gateway API (CNCF-
• Ingress and Load Balancer Errors — 502, 503, 504, 404, 413 and TLS — The errors users see at the edge of a Kubernetes cluster: what each status code proves about where the request
• Install and CLI Fundamentals — Getting Helm installed and mastering the core lifecycle commands: install, upgrade, rollback, uninstall, list,
• Installation and Bootstrap — How flux bootstrap differs from flux install, why committing Flux own manifests to Git makes it self-managing,
• Internal Developer Platforms — IDPs are self-service abstraction layers over multi-cluster, multi-cloud infrastructure. Components: service c
• Internal Developer Platforms (IDPs) & Backstage — IDPs abstract infrastructure complexity from developers via golden paths. Backstage (CNCF) is the leading open
• Jenkins — The CI/CD incumbent for ~20 years. Master/agent architecture, Declarative vs Scripted Pipeline, Configuration-
• Jenkins Controller vs Agent Architecture — Jenkins Controller manages the CI/CD system (job scheduling, pipeline orchestration, credentials, plugins, use
• Jenkinsfile — Pipeline as Code — Jenkinsfile defines CI/CD pipeline as code (pipeline { agent any; stages { stage("Build") { steps {...} } } po
• JFrog Artifactory — Production Administration, Errors and Mistakes — How Artifactory stores binaries, why disks fill and garbage collection does not free them, how to build dev-to
• JFrog Xray — Policies, Watches, Impact Analysis, Errors and Mistakes — How Xray turns vulnerabilities into violations through watches and policies, and finds every stored artifact t
• Karpenter — Node Autoscaling — Just-in-time node provisioning for Kubernetes — Karpenter watches unschedulable pods and provisions the optima
• kubectl CLI Command Reference — kubectl is the primary interface to a Kubernetes cluster. Beyond get and apply, interviews test knowledge of t
• Kubernetes — Stuck Rollouts, Version Upgrades and Mistakes — Working a stuck rollout and a CrashLoopBackOff to an undo-or-fix decision, planning a two-minor-version upgrad
• Kubernetes Admission Control — Admission controllers are the last line of defense in the Kubernetes API request pipeline. They run after auth
• Kubernetes AI and GPU Scheduling — Device Plugin Framework, NVIDIA device plugin, MIG vs. time-slicing vs. MPS, GPU Operator, training vs. infere
• Kubernetes API Aggregation — Extending the Kubernetes API beyond CRDs: APIService, proxy architecture, authentication flow, metrics-server
• Kubernetes API Errors — 4xx and 5xx Explained — What the API server actually returns and why: 401 versus 403, when 403 is really an admission webhook, 409 on
• Kubernetes Architecture — How a cluster is wired: a control plane (kube-apiserver, etcd, scheduler, controller-manager, cloud-controller
• Kubernetes Autoscaling: HPA, VPA, KEDA, and Cluster Autoscaler — Kubernetes provides a layered autoscaling stack that addresses horizontal replica scaling, vertical resource r
• Kubernetes Cluster Upgrades and Version Management — Version skew policy, kubeadm upgrade procedures, worker node drain and replace patterns, and managed K8s upgra
• Kubernetes Core Resources — The everyday API surface: Pod (smallest schedulable unit), workload controllers (Deployment, StatefulSet, Daem
• Kubernetes Custom Schedulers — Scheduling framework extension points, writing plugins in Go, scheduler profiles, extenders vs. plugins, gang
• Kubernetes Deployment Strategies — Six deployment strategies for zero-downtime releases: Canary (gradual %), Blue-Green (instant switch), A/B Tes
• Kubernetes Descheduler — Post-scheduling rebalancing: RemoveDuplicates, LowNodeUtilization, topology spread repair, eviction limits, PD
• Kubernetes Error Triage — Symptoms, Exit Codes and Cloud Equivalents — The hub of the Kubernetes production errors guide: the outside-in method, the first five minutes of commands,
• Kubernetes Evictions and Node Pressure — Node-pressure eviction, QoS classes, soft vs. hard thresholds, PodDisruptionBudgets, API-initiated vs. kubelet
• Kubernetes Gateway API v1 — Gateway API v1 (GA Oct 2023): GatewayClass/Gateway/HTTPRoute hierarchy. Role-oriented design, traffic splittin
• Kubernetes Multi-cloud and Hybrid Cluster Patterns — Multi-cloud Kubernetes drivers and challenges, fleet management with Cluster API and Rancher, service mesh for
• Kubernetes Multi-tenancy Patterns — Namespace-based soft tenancy, OPA/Gatekeeper and Kyverno policy enforcement, hard tenancy with vCluster and Ca
• Kubernetes Native Sidecar Containers — Native sidecar containers (stable in Kubernetes 1.29) solve a long-standing lifecycle problem: regular sidecar
• Kubernetes Network Policies — NetworkPolicy resources control which Pods can communicate. Ingress rules restrict incoming traffic; Egress ru
• Kubernetes Networking Deep Dive — Kubernetes networking rests on a single foundational contract: every Pod gets a unique, routable IP, and any P
• Kubernetes Observability: Metrics, Logs, and Traces — Kubernetes observability is built on three pillars — metrics, logs, and distributed traces — but the platform
• Kubernetes Operators & CRDs — How Kubernetes turns into a platform for everything: define a CustomResourceDefinition, write a controller tha
• Kubernetes Pod Networking & CNI — How every Pod gets a unique routable IP via CNI plugins. Pod-to-Pod communication on the same node (via Linux
• Kubernetes Pod Scheduling — Kubernetes pod scheduling determines how the control plane assigns pods to nodes using a multi-phase pipeline
• Kubernetes RBAC — Kubernetes RBAC (Role-Based Access Control) is the primary authorization mechanism in every production cluster
• Kubernetes Runtime Classes — RuntimeClass lets you select the container runtime for individual pods. Different workloads have different sec
• Kubernetes Secrets Management — Kubernetes Secrets are widely misunderstood. The built-in Secret resource stores values as base64 — encoding,
• Kubernetes Security: Pod Security and Runtime Hardening — Kubernetes security is a layered discipline spanning admission control, container-level isolation, supply chai
• Kubernetes Services — Pods are ephemeral — they restart with new IPs. Services provide a stable virtual endpoint (ClusterIP) backed
• Kubernetes Storage — Kubernetes Storage covers the full lifecycle of persistent volumes, storage classes, and CSI drivers that allo
• Kubernetes the Hard Way — Kubernetes the Hard Way is a manual bootstrapping approach that teaches every component of a Kubernetes cluste
• Kubescape and Kubernetes Runtime Security — Kubescape and Kubernetes runtime security tools provide continuous posture assessment and real-time threat det
• Kustomization and Reconciliation — The Kustomization CRD is the apply engine of Flux: it builds manifests from a Source, substitutes variables, d
• Lease and Reservation Control Planes — Arbitrating scarce, non-fungible resources — a GPU zone, a hardware bench, a test cluster — with time-bounded
• libstdc++, libc++, glibc and Symbol Versioning — The three C++ standard libraries, how glibc symbol versioning sets the minimum host your binary can run on, an
• Lifecycle Hooks and Tests — Running ordered actions at specific lifecycle phases with hook annotations, controlling execution order with w
• Linking Deep Dive — Symbol resolution semantics and link failure diagnosis: why archive order matters, what SONAME and RUNPATH act
• Linux Cron & Task Scheduling — Cron syntax, user vs system crontabs, /etc/cron.d vs /etc/crontab, environment pitfalls, systemd timers as the
• Local Kubernetes Cluster Setup (minikube / kind / k3d) — Local Kubernetes tools let you run a real cluster on your laptop for development and testing. minikube is best
• Log Aggregation — Centralized logs across services. Three storage models: full-text indexed (Elasticsearch / OpenSearch), label-
• Microservices Design — Service boundaries via DDD bounded contexts, sync (REST/gRPC) vs async (events) communication, the distributed
• Migration and Production Patterns — Moving to Flux v2 from Flux v1, the Helm Operator, or an imperative CI pipeline — then the operational pattern
• Monitoring and Troubleshooting — The Flux observability stack — Prometheus metrics, Kubernetes events, and controller logs — plus a systematic
• Monorepo Build Systems — Hermetic builds, dependency graphs, remote caching, incremental rebuilds. How Google, Meta, Microsoft, Vercel
• MSVC Toolchain and Windows Native Build — The Windows native build stack end to end: cl.exe and link.exe, the developer environment, MSBuild versus CMak
• Multi-Cluster GitOps — Topologies for managing fleets of Kubernetes clusters from git: hub-and-spoke (one Argo CD or Flux instance ma
• Native Artifact Signing and Release — Signing application binaries for Windows, macOS, and Linux: Authenticode and timestamping, hardware-backed key
• Native Debugging — gdb, Core Dumps and Symbols — Getting an actionable backtrace out of a crash you did not witness — gdb on optimized builds, core dump captur
• Node and Scaling Errors — NotReady, Scale-Up, Drain, Terminating and HPA — How to diagnose the failures above any one pod: nodes going NotReady, autoscalers that will not add or remove
• Notifications, Alerts and Webhooks — notification-controller runs in both directions: outbound Providers and Alerts push reconciliation events to S
• OpenFeature & Feature Flag Governance — The OpenFeature standard for feature flagging, flag lifecycle management, technical debt from long-lived flags
• OpenTelemetry — CNCF Incubating project; second-most-active CNCF project after Kubernetes. Vendor-neutral spec for traces, met
• OpenTelemetry Collector — Pipelines & Deployment — OTel Collector: receivers, processors, exporters. Tail-based vs head-based sampling. Agent/Gateway topology. K
• Overlay vs Underlay Networking — Underlay = real physical/cloud network that carries actual packets (routers, switches, data center, cloud VPC)
• PCI-DSS and SOC 2 for Kubernetes — What PCI-DSS and SOC 2 actually demand of a platform team, why scoping and segmentation is the highest-leverag
• Perl and PowerShell for Build Automation — The two languages mature build systems actually run on. Reading and maintaining legacy Perl without rewriting
• Pipeline-as-Code — Pipeline definitions versioned in the repo. GitHub Actions, GitLab CI, Jenkinsfile — and how to keep them DRY
• Platform Engineering — Platform engineering treats internal developer tooling as a product with internal customers — paved roads, gol
• Platform Engineering & IDP Design — Designing Internal Developer Platforms — golden paths, thinnest viable platform, Backstage, cognitive load red
• Platform Engineering Maturity Model — CNCF Platform Engineering Maturity Model: four levels across five aspects — investment, adoption, interfaces,
• Pod Startup and Scheduling Errors — ImagePullBackOff, CrashLoopBackOff, Pending, Evicted — The failures between an accepted manifest and a running process: image pulls, crash loops, missing config, uns
• Policy as Code — Express security and compliance rules in version-controlled, testable code. OPA/Rego, Kyverno YAML, AWS Cedar,
• Production Patterns — Structuring Helm for real multi-service estates: Helmfile for multi-chart orchestration, umbrella charts, libr
• Progressive Delivery — Beyond rolling updates: gradual exposure of new versions to users with metric gates and automatic rollback. St
• Prometheus & Grafana — CNCF Graduated metrics stack. Prometheus pulls metrics on intervals, stores TSDB locally. Grafana queries via
• Pulumi — Pulumi expresses infrastructure in TypeScript, Python, Go, .NET, Java, or YAML — same providers as Terraform u
• Puppet, Chef & Salt — The pre-Ansible / pre-Kubernetes generation of config management. Puppet (Ruby DSL, master/agent), Chef (Ruby
• Python for Build Automation — Python as the language you write build tooling in, not web apps. Replacing untestable YAML and shell with a pa
• Qt Deployment and Packaging — Everything a Qt application needs at runtime beyond the executable: plugins, qt.conf, the deploy tools, platfo
• Qt for Build Engineers — Qt from the build side: module structure, the moc/uic/rcc/qmlcachegen code generators and what they do to the
• Release Engineering — The discipline of producing, signing, and shipping releases. Versioning (semver, calver), branch strategies (t
• Release Manifests & Last-Known-Good — A release manifest pins every GPU-stack component to an exact hash so a validated Last-Known-Good build is rep
• Repositories and OCI Distribution — Classic HTTP chart repositories vs modern OCI registries (ECR, GHCR, ACR, GAR, Harbor). Pushing, pulling, and
• Repository Structure and Multi-Tenancy — The four documented Flux repository layouts and their tradeoffs, plus the tenant isolation model built on serv
• Running AI/ML Workloads on Kubernetes — GPU workload taxonomy, distributed training patterns with NCCL and gang scheduling, inference serving with vLL
• Runtime Security — The right edge of the security pipeline: detecting and blocking malicious behavior in running workloads. Falco
• Sanitizers and Memory Debugging — AddressSanitizer, UBSan, ThreadSanitizer and MemorySanitizer — what each instruments, what it costs, and where
• SAST, DAST, SCA & IAST — The four pillars of application security testing — static, dynamic, software composition, and interactive. Wha
• Secrets Management in GitOps — Secrets in GitOps: SOPS+age, Sealed Secrets, External Secrets Operator (ESO). Vault integration patterns. When
• Securing Repositories and CI/CD — GitHub, GitHub Enterprise Server, GitLab and Azure DevOps — Merge controls, pipeline tokens and OIDC, fork and injection risks, deployment gates and build runners on GitH
• Security and Supply Chain — Hardening charts and their distribution path: chart signing and provenance, RBAC scoping, secrets management w
• Security, Secrets and Supply Chain — How to put secrets in Git without putting secrets in Git — SOPS, Sealed Secrets, External Secrets — plus signe
• Self-Hosted CI Runners at Scale — Provision, autoscale, and secure self-hosted GitHub Actions runners for GPU/firmware CI using ephemeral JIT ru
• Serverless Patterns — FaaS (AWS Lambda, GCF, Azure Functions) vs request-driven containers (Cloud Run, Knative, Fly.io Machines). Co
• Service Mesh — East-west traffic plane: mTLS, retries, timeouts, circuit breakers, traffic shifting, zero-trust networking. T
• Service Networking Errors — DNS, Timeouts, Port Mismatch and Mesh Sidecars — Healthy pods that cannot talk: dropped versus refused packets, DNS failures and five-second delays, port misma
• Shift-Left Security — Move security earlier in the SDLC: pre-commit hooks, IDE plugins, PR-time scans, security champions, and desig
• Sigstore & Software Supply Chain Security — Signing, verifying, and attesting software artifacts using Sigstore (Cosign, Fulcio, Rekor), SBOM, and SLSA to
• SLO / SLI / Error Budgets — Service Level Indicators (what you measure), Service Level Objectives (target you commit to), and Error Budget
• SLSA — Software Supply Chain Security — SLSA defines 3 levels of supply chain integrity. Level 1: provenance. Level 2: hosted build + signed provenanc
• Software Supply Chain Security — SLSA levels, SBOM generation, provenance attestation, and dependency pinning to secure the software supply cha
• SonarQube — Quality Gates, Web API, Administration, Errors and Mistakes — How SonarQube Server computes quality gates, how to read them through the Web API, and how to run the server.
• Sources — Git, OCI, Helm, Bucket — How source-controller fetches, verifies, and republishes external content as an in-cluster artifact, and how G
• Static Analysis for C/C++ in CI — Compiler warnings, clang-tidy, the clang static analyzer, cppcheck and the commercial tools — what each finds,
• Storage Errors — FailedMount, Pending PVCs, Multi-Attach and Full Volumes — Volumes that will not provision, attach, mount, fit or grow: Pending claims, attach and mount failures, Multi-
• Strangler Fig — Martin Fowler's pattern for replacing a legacy system: route some traffic to the new implementation, gradually
• Team Topologies — Skelton & Pais (2019) framework for organizing teams to maximize fast flow. Four team types + three interactio
• Tekton — CI/CD as Kubernetes Custom Resources. Task, Pipeline, PipelineRun, TaskRun. Tekton Catalog for reusable Tasks.
• Terraform — Production Errors, Mistakes and Recovery — The Terraform errors you meet in production (locks, drift, unknown values, cycles, forced replacement, provide
• Terraform & OpenTofu — How Terraform and OpenTofu actually work — HCL parsing, provider plugin gRPC protocol, the state file as sourc
• Terraform count vs for_each — count creates indexed copies (aws_instance.web[0], [1], [2]). for_each creates named resources by key (aws_ins
• Terraform Essentials — Plan and Apply, Variables, Outputs, Data Sources, and Sharing State at Scale — Plan and apply, saved and stale plans, variables, outputs and data sources as the Terraform docs define them.
• Terraform in CI/CD Pipelines — Production-level Terraform CI/CD: Code Commit → Validate → Format Check → Terraform Init → Plan → Policy Check
• Terraform Remote State — S3 + DynamoDB — Terraform state file (terraform.tfstate) records real infrastructure. Remote state in AWS S3 prevents local ma
• Test Pyramid — Mike Cohn's pyramid: many fast unit tests at the base, fewer integration, very few E2E. Avoid the ice-cream-co
• The C/C++ Compilation Model — How a translation unit becomes an object file and why the include graph, not the source line count, determines
• The flux CLI — The command families that actually get used in production: reconcile, suspend, resume, trace, diff, build, che
• The Three Ways — The Phoenix Project / DevOps Handbook foundational philosophy. Three principles that organize every DevOps pra
• Toil Reduction & Automation Strategy — Identifying, measuring, and eliminating toil — manual, repetitive, automatable operations work — to reclaim en
• Trunk-Based Development — Paul Hammant's definition: everyone integrates to trunk daily, branches live hours not weeks, feature flags hi
• Trunk-Based Development with Continuous Deployment — Organizational, technical, and cultural changes required to adopt TBD with CD, and how to sequence them.
• Twelve-Factor App — The 2011 Heroku-authored manifesto for cloud-portable apps. Each factor reread for K8s + serverless + microser
• Value Stream Mapping — Visualize the entire flow from idea to value-delivered. Identify waste (handoffs, queues, rework). The First W
• Values and Overrides — Layering values files and --set overrides, managing per-environment configuration cleanly, and validating inpu
• WebAssembly (Wasm) in Cloud Native — Running WebAssembly workloads on Kubernetes and serverless platforms for near-native performance, instant cold
• Westrum Typology & CALMS — Two frameworks that operationalize "culture eats strategy for breakfast." Westrum predicts performance; CALMS
• Why Flux — Why push-based CI deployment breaks down at scale, the four OpenGitOps principles Flux implements, and where F
• Why Helm — The kubectl-sprawl problem and the package management gap Helm fills. Positions Helm against raw manifests, Ku
• Windows and Linux System Libraries — Where Win32 and POSIX genuinely diverge — process creation, threading, dynamic loading, paths, file semantics,
• Writing Kubernetes Operators in Go — Authoring an operator with kubebuilder and controller-runtime: the Manager/Cache/Client architecture, idempote

Start free on Cariara · Coding problems · System design studio