Foundations: DevOps & SRE Operations

What you'll learn

• 1. Cloud Infrastructure Design

• Highly Available & Fault-Tolerant Deployments

  Core principles: | Principle | Implementation | |-----------|---------------| | Multi-AZ | Deploy across 2-3 Availability Zones minimum | | Auto Scaling | Scale out on CPU/memory/custom metrics; scale in during off-hours | | Stateless se…

• Secrets Management

  Architecture: Best practices: - Never store secrets in code, env files in repos, or container images - Use IAM roles / Workload Identity for service-to-service auth (no static keys) - Automatic rotation every 30-90 days (secrets manager…

• Disaster Recovery

  | Tier | RTO | RPO | Strategy | Cost | |------|-----|-----|----------|------| | Hot standby | Minutes | Near-zero | Active-active or active-passive with sync replication | $$$$ | | Warm standby | 15-60 min | Minutes | Scaled-down replica…

• Backup & Restore Design

  Minimizing restore downtime: - Blue-green database cutover: restore to new instance, switch traffic atomically - Streaming replication catch-up: restore to PITR, then replay remaining WAL - Application-level routing: feature flag to rout…

• 2. Linux Troubleshooting

• CPU Spike Investigation

  Step-by-step approach: Differentiating rogue process vs external attack: | Indicator | Rogue Process | External Attack (DDoS) | |-----------|---------------|------------------------| | Network traffic | Normal | Massive spike in inbound…

• Memory Leak Investigation

  Approach: Prevention: - Set memory limits (container resources.limits.memory) - Alerting on RSS growth rate (not just absolute value) - Regular load testing with leak detection enabled - OOMKiller threshold: kernel kills highest OOM-scor…

• I/O Performance Optimization

  | Tool | What It Shows | |------|---------------| | iostat -x 1 | Per-disk IOPS, throughput, await, %util | | iotop | Per-process I/O bandwidth | | fio | Benchmark disk with synthetic workloads | | lsblk | Block device topology (check RA…

• Network Troubleshooting

  Application unreachable — systematic diagnosis: Packet loss debugging between data centers: | Step | Command | What It Reveals | |------|---------|-----------------| | Verify loss | ping -c 100 | % packet loss | | Find where | mtr --rep…

• TLS Handshake Performance

  Why TLS handshake is slow: - Full handshake: 2 round trips (TCP + TLS 1.2) = 4× latency - Certificate chain validation (client verifies server cert + intermediates + OCSP) - Key exchange computation (RSA/ECDHE) Optimization without compr…

• 3. Monitoring & Observability

• Dashboard Design Principles

  The USE Method (for infrastructure): - Utilization — % of resource used (CPU, memory, disk, network) - Saturation — queue depth (are requests waiting?) - Errors — error count/rate The RED Method (for services): - Rate — requests/second -…

• Alert Design & Avoiding Alert Fatigue

  | Threshold Type | When to Use | Example | |---------------|-------------|---------| | Static | Known bounds | CPU > 90% for 5 min | | Dynamic/Anomaly | Variable baselines | 3σ deviation from rolling 7-day average | | Rate of change | Ra…

• Log Correlation During Incidents

  Three pillars of observability: Correlation workflow during incident: 1. Metric alert fires → p99 latency spiked on Service A at 14:32 2. Check traces → find slow traces starting at 14:32; see Service A → DB calls taking 5s (normally 20m…

• Synthetic Monitoring

  What it is: Automated scripts that simulate user journeys from external locations, running continuously — detecting issues before real users do. Design considerations: | Aspect | Decision | |--------|----------| | What to test | Critical…

• Application Performance Monitoring (APM)

  APM provides real-time information about application performance and user satisfaction during production incidents. It pinpoints problematic parts of software or infrastructure — often without writing code or reconfiguring infrastructure…

• 4. SLI / SLO / SLA

• Definitions & Relationships

  | Term | What It Is | Who Cares | Example | |------|-----------|-----------|---------| | SLI (Service Level Indicator) | A metric measuring service quality | Engineering | Successful requests / Total requests | | SLO (Service Level Objec…

• Choosing SLIs

  Good SLIs have these properties: - Directly measure user experience (not internal metrics) - Clearly defined numerator and denominator - Stable enough that small code changes don't swing them wildly Common SLI categories: | Category | SL…

• 7. Kubernetes Operations (Troubleshooting)

• Troubleshooting CrashLoopBackOff

  What it means: Container starts, crashes, Kubernetes restarts it, crashes again. Backoff delay increases exponentially (10s, 20s, 40s... up to 5 min). Diagnostic steps: For production-critical pods: - Don't delete the crashing pod if oth…

• Cross-Namespace Networking Issues

  Debugging between Service A (namespace X) and Service B (namespace Y): Common causes: - NetworkPolicy blocking cross-namespace traffic - Service has no endpoints (pods not ready / selector mismatch) - DNS resolution failing (CoreDNS issu…

• Docker Image Security

  Pre-deployment security pipeline: | Stage | Tool Examples | What It Catches | |-------|---------------|-----------------| | Base image | Use minimal base (distroless, alpine) | Reduces attack surface by 90% | | Dependency scan | Trivy, S…

• Kubernetes Rollback

  Minimizing downtime during rollback: - Use RollingUpdate strategy with maxUnavailable: 0 (always have full capacity) - PodDisruptionBudget ensures minimum replicas during the rollout - Readiness probes gate traffic: old pods serve while…

• 8. CI/CD Pipeline Design

• Pipeline Architecture for Microservices

  Avoiding pipeline bottlenecks at scale: - Only build/test what changed (affected service detection via file paths) - Parallel execution: independent services build simultaneously - Cache: Docker layer cache, dependency cache (Maven/npm),…

• Secrets in CI/CD Pipelines

  | Approach | Security Level | Example | |----------|---------------|---------| | Environment variables (encrypted) | Medium | GitLab CI masked variables, GitHub Encrypted Secrets | | Vault integration | High | Pipeline requests short-liv…

• Deployment Strategies

  | Strategy | How It Works | Risk | Rollback Speed | |----------|-------------|------|----------------| | Rolling update | Replace pods N at a time | Medium (gradual exposure) | Slow (undo rolls N at a time) | | Blue-Green | Two full envi…

• Pipeline Optimization (Reducing Build Time)

  | Technique | Typical Savings | Implementation | |-----------|----------------|----------------| | Docker layer caching | 30-60% | Order Dockerfile: deps first, code last | | Dependency caching | 20-40% | Cache nodemodules / .m2 / pip be…

• 9. Nginx Configuration & Architecture

• Nginx vs Apache — Architecture Difference

  | Aspect | Nginx | Apache | |--------|-------|--------| | Architecture | Event-driven, async, non-blocking | Process-based (pre-fork model) | | Connection handling | Single thread handles thousands via epoll/kqueue | One process or threa…

• nginx.conf Structure (Contexts & Directives)

  Nginx config follows a hierarchical context structure: Context hierarchy: Main → Events / HTTP → Upstream / Server → Location Key directives: | Directive | Context | Purpose | |-----------|---------|---------| | workerprocesses | Main |…

• Location Block Types & Priority

  Location blocks determine which config handles a given URL. Priority (highest to lowest): | Priority | Modifier | Meaning | Example | |----------|----------|---------|---------| | 1 (highest) | = | Exact match only | location = /api/heal…

• Variables, Rewrites & tryfiles

  Built-in variables: | Variable | Contains | |----------|----------| | $uri | Current URI (changes with rewrites) | | $requesturi | Original request URI (never changes) | | $host | Hostname from request | | $remoteaddr | Client IP address…

• Reverse Proxy Configuration

  Why X-Forwarded-For? Without it, the backend sees Nginx's IP as the client. This header preserves the original client IP through the proxy chain.

• Logging

  ---

• 10. Configuration Management

• Idempotency & Drift Prevention

  Idempotency: Running the same automation (Ansible playbook, Terraform plan) twice produces the same end state. No duplicate packages installed, no extra config lines added. How Ansible ensures idempotency: - Modules check current state b…

• 11. Scripting Patterns (Interview Scenarios)

• Pattern: Cross-Region Backup Verification

  Approach: Key considerations: - Use s3 sync (not cp) — only transfers changed objects on re-run - For cross-region: enable transfer acceleration or use multi-part upload - Verify with aws s3api list-objects-v2 --summarize on both buckets…

• Pattern: Certificate Expiry Monitoring

  Approach: Key command: echo | openssl sclient -connect domain:443 2>/dev/null | openssl x509 -noout -enddate

• Pattern: Auto Scaling Based on Metrics

  Approach: Critical safeguards: - Minimum capacity floor (never scale to 0) - Cooldown period prevents thrashing - Rate limit: max 2 scale-out actions per 10 minutes - Alert on repeated scaling (may indicate underlying issue) ---

• 12. Monitoring Kubernetes

• Kubernetes-Specific Metrics

  | Layer | Key Metrics | Tools | |-------|-------------|-------| | Cluster | Node count, node CPU/memory, pod scheduling latency | Prometheus + node-exporter | | Node | CPU, memory, disk pressure, network I/O, pod count | kube-state-metri…

• Key Interview Talking Points

  | Question Type | Framework | |--------------|-----------| | "How do you troubleshoot X?" | Systematic top-down: scope → identify → analyze → fix → prevent | | "How do you design for HA?" | Multi-AZ, redundancy, health checks, auto-scali…