TopicsDevOps
DevOps
Kubernetes workloads, CI/CD pipelines, artifact digests, supply-chain controls, Git rebase, merge, and recovery, and Terraform state, modules, and safe change you can defend in interviews.
Common tags: kubernetes, deployments, probes, rollouts, cicd, supply-chain, git, terraform, iac
- DevOps
Monorepo vs Polyrepo - Workspaces, Package Boundaries, Versioning & CI Fan-out
Cluster · Build Systems & Monorepos
Monorepo vs polyrepo trade-offs; workspaces as the base layer and task runners vs build systems on top; boundaries (tags, visibility, exports, CODEOWNERS) with a runnable boundary + CI fan-out + owners demo; fixed vs independent versioning with changesets (runnable); CI fan-out by scale from Turborepo-size repos to Google-scale.
Open study →- devops
- build-systems
- monorepo
- turborepo
- nx
- bazel
- buck2
- nix
- caching
- remote-cache
- remote-execution
- hermetic-builds
- reproducible-builds
- lockfiles
- dependency-resolution
- devcontainers
- interview
- DevOps
Kubernetes Internals - Declarative Reconciliation from kubectl apply to Running Pod
Cluster · Kubernetes Internals
Hub: Kubernetes as a database of intentions plus independent watch-driven loops; imperative vs declarative reconciliation; the full kubectl apply -> running pod path (authn/authz, admission, etcd, Deployment/ReplicaSet controllers, scheduler, kubelet, CRI/CNI/CSI); component contracts, bottlenecks and a layer-picking decision chart. Goes one layer below the existing Workloads series.
Open study →- devops
- kubernetes
- control-plane
- api-server
- etcd
- informers
- crds
- operators
- scheduler
- kubelet
- reconciliation
- storage
- pv
- pvc
- csi
- statefulsets
- helm
- kustomize
- gitops
- cluster-autoscaler
- karpenter
- pdb
- interview
- DevOps
Kubernetes Storage - Volumes, PV, PVC, StorageClass, CSI, StatefulSets & Failure Modes
Cluster · Kubernetes Internals
Storage: volume types, PV/PVC/StorageClass, static vs dynamic provisioning, Immediate vs WaitForFirstConsumer, provision -> bind -> attach -> mount via CSI, access modes (RWO/RWOP/RWX), reclaim policies, StatefulSets with volumeClaimTemplates, expansion and snapshots, zone pinning, Multi-Attach and node-loss failure timelines.
Open study →- devops
- kubernetes
- control-plane
- api-server
- etcd
- informers
- crds
- operators
- scheduler
- kubelet
- reconciliation
- storage
- pv
- pvc
- csi
- statefulsets
- helm
- kustomize
- gitops
- cluster-autoscaler
- karpenter
- pdb
- interview
- DevOps
Scheduler, Controllers & the Kubelet - Filter and Score, Taints, Preemption, Reconcile Loops, Garbage Collection & Pod Sync
Cluster · Kubernetes Internals
Scheduler, controllers and kubelet: scheduling framework (PreFilter, Filter, Score, Reserve, Permit, Bind), taints/tolerations, affinity and topology spread, priority and preemption; level-triggered reconcile loops, owner references, finalizers and garbage collection; kubelet pod sync, node-pressure eviction and a Pending/ContainerCreating triage chart.
Open study →- devops
- kubernetes
- control-plane
- api-server
- etcd
- informers
- crds
- operators
- scheduler
- kubelet
- reconciliation
- storage
- pv
- pvc
- csi
- statefulsets
- helm
- kustomize
- gitops
- cluster-autoscaler
- karpenter
- pdb
- interview
- DevOps
Node-Level Scaling - Node Groups, Cluster Autoscaler vs Karpenter, Over-Provisioning, PDBs & Drains
Cluster · Kubernetes Internals
Node scaling: node groups/ASGs/managed node pools, Cluster Autoscaler simulation and expanders, Karpenter NodePools, consolidation and disruption budgets, CA vs Karpenter, scale-up latency budget, over-provisioning with pause pods and CapacityBuffer, PDBs and drains, cost levers. HPA/VPA linked, not re-taught.
Open study →- devops
- kubernetes
- control-plane
- api-server
- etcd
- informers
- crds
- operators
- scheduler
- kubelet
- reconciliation
- storage
- pv
- pvc
- csi
- statefulsets
- helm
- kustomize
- gitops
- cluster-autoscaler
- karpenter
- pdb
- interview
- DevOps
Kubernetes Control Plane - API Server Request Path, etcd, Watches, Informers, Optimistic Concurrency & CRDs
Cluster · Kubernetes Internals
Control plane: API server request pipeline (authn, API Priority and Fairness, RBAC, mutating/validating admission, schema validation), etcd limits and compaction, resourceVersion, watches, 410 Gone and relist, 409 optimistic concurrency, shared informers and workqueues, CRDs and operators vs aggregated APIs.
Open study →- devops
- kubernetes
- control-plane
- api-server
- etcd
- informers
- crds
- operators
- scheduler
- kubelet
- reconciliation
- storage
- pv
- pvc
- csi
- statefulsets
- helm
- kustomize
- gitops
- cluster-autoscaler
- karpenter
- pdb
- interview
- DevOps
Hermeticity & Reproducible Builds - Sandboxes, Pinned Toolchains, the Nix Store & Bit-for-Bit Output
Cluster · Build Systems & Monorepos
Pinned vs hermetic vs deterministic vs reproducible; sources of non-reproducibility; SOURCE_DATE_EPOCH archive demo (runnable); the Nix model (derivations, store paths, closures, substituters, input- vs content-addressed) with a store-path demo (runnable); lockfiles vs Docker vs Bazel sandboxes vs Nix/Guix; SBOMs and provenance.
Open study →- devops
- build-systems
- monorepo
- turborepo
- nx
- bazel
- buck2
- nix
- caching
- remote-cache
- remote-execution
- hermetic-builds
- reproducible-builds
- lockfiles
- dependency-resolution
- devcontainers
- interview
- DevOps
Helm & Kubernetes Packaging - Charts, Values, Releases, Rollback, Hooks vs Kustomize, Operators & GitOps
Cluster · Kubernetes Internals
Packaging: Helm charts, values precedence, rendering, releases stored as Secrets, upgrade/rollback, 3-way merge vs server-side apply (Helm 4), hooks, dependencies, library charts, CRD handling; compared with Kustomize, raw manifests, operators and GitOps (Argo CD, Flux) with a decision chart.
Open study →- devops
- kubernetes
- control-plane
- api-server
- etcd
- informers
- crds
- operators
- scheduler
- kubelet
- reconciliation
- storage
- pv
- pvc
- csi
- statefulsets
- helm
- kustomize
- gitops
- cluster-autoscaler
- karpenter
- pdb
- interview
- DevOps
Dependency Resolution & Dev Environments - SemVer, SAT vs MVS, Lockfiles, Nix Shells & Devcontainers
Cluster · Build Systems & Monorepos
SemVer and range styles per ecosystem; search (PubGrub/SAT) vs MVS vs nested copies with a runnable diamond demo; lockfiles across ecosystems and integrity hashes (runnable); hoisting and phantom deps; Nix shells vs devcontainers vs mise/asdf vs Docker; works-on-my-machine diagnosis; interview Q&A.
Open study →- devops
- build-systems
- monorepo
- turborepo
- nx
- bazel
- buck2
- nix
- caching
- remote-cache
- remote-execution
- hermetic-builds
- reproducible-builds
- lockfiles
- dependency-resolution
- devcontainers
- interview
- DevOps
Dependency Graphs & Incremental Builds - Task DAGs, Topological Scheduling, Content Hashing & Affected Detection
Cluster · Build Systems & Monorepos
Package vs task vs action graphs; topological waves and the critical path; mtime vs content hash vs verifying and constructive traces; early cutoff; runnable Python mini build engine (topo sort, three rebuilders, cycle error) and TS monorepo task engine with affected detection; static vs dynamic dependencies and the Build Systems a la Carte grid.
Open study →- devops
- build-systems
- monorepo
- turborepo
- nx
- bazel
- buck2
- nix
- caching
- remote-cache
- remote-execution
- hermetic-builds
- reproducible-builds
- lockfiles
- dependency-resolution
- devcontainers
- interview
- DevOps
Content-Addressed Caching - Cache Keys, Remote Cache, Remote Execution & Poisoning
Cluster · Build Systems & Monorepos
What goes into a cache key; undeclared env var wrong-cache-hit demo and the strict-env fix (runnable); local vs remote cache vs remote execution (REAPI CAS + action cache); constructive vs deep traces; cache economics and the critical-path floor (runnable); poisoning table incl. untrusted writers; caching decision chart.
Open study →- devops
- build-systems
- monorepo
- turborepo
- nx
- bazel
- buck2
- nix
- caching
- remote-cache
- remote-execution
- hermetic-builds
- reproducible-builds
- lockfiles
- dependency-resolution
- devcontainers
- interview
- DevOps
Build Systems & Monorepos - Graphs, Caching, Hermeticity & Reproducible Environments
Cluster · Build Systems & Monorepos
Concept hub: a build is a function over a dependency graph; the four properties (correctness, incrementality, caching, hermeticity) and how they stack; task runner vs build system vs package/environment manager; what Turborepo, Nx, Bazel and Nix share and where they differ; runnable mini build function and graph-granularity demo; decision chart.
Open study →- devops
- build-systems
- monorepo
- turborepo
- nx
- bazel
- buck2
- nix
- caching
- remote-cache
- remote-execution
- hermetic-builds
- reproducible-builds
- lockfiles
- dependency-resolution
- devcontainers
- interview
- DevOps
Flag Types & Evaluation — Boolean, Multivariate, Percentage & Sticky Buckets
Cluster · Feature Flags — Targeting, Experimentation & Kill Switches
Flag types and evaluation mechanics decide whether your rollout is trustworthy. Booleans gate on or off. Multivariate flags return named variants. Percentage rollouts need a sticky hash so the same subject stays in the same bucket. This lesson implements those sketches, contrasts hash choices, and shows why a fresh random draw breaks experiments and UX.
Open study →- devops
- feature-flags
- progressive-delivery
- experimentation
- openfeature
- interview
- DevOps
Targeting & Context — Attributes, Segments, Rules & Precedence
Cluster · Feature Flags — Targeting, Experimentation & Kill Switches
Targeting answers who gets a variant: attributes on the evaluation context, reusable segments, and ordered rules with a clear precedence. Bad targeting causes support chaos and biased experiments. This lesson shows a minimal rules engine, how segments are composed, and how exposure differs from authorization.
Open study →- devops
- feature-flags
- progressive-delivery
- experimentation
- openfeature
- interview
- DevOps
Feature Flags — Targeting, Experimentation & Kill Switches
Cluster · Feature Flags — Targeting, Experimentation & Kill Switches
Feature flags (feature toggles) decouple deploy from release: you ship dark code safely, then turn behavior on for segments, percentages, or experiments, and turn it off instantly when metrics or incidents demand it. This hub teaches release, experiment, ops, and permission toggles, sticky bucketing, targeting, A/B guardrails, progressive delivery, kill switches, and hygiene so flags do not become permanent debt.
Open study →- devops
- feature-flags
- progressive-delivery
- experimentation
- openfeature
- interview
- DevOps
Progressive Delivery & Kill Switches — Canary, Ramp, Instant Rollback
Cluster · Feature Flags — Targeting, Experimentation & Kill Switches
Progressive delivery ramps a feature to a larger audience only while metrics stay healthy. A kill switch forces the safe path the moment they do not. This lesson contrasts flag ramps with Kubernetes traffic canaries, designs soak times and abort gates, and defines who may flip a kill switch and how wide the blast radius is.
Open study →- devops
- feature-flags
- progressive-delivery
- experimentation
- openfeature
- interview
- DevOps
Experimentation & A/B — Exposure, Metrics, Guardrails & Peeking
Cluster · Feature Flags — Targeting, Experimentation & Kill Switches
An experiment is a sticky multivariate flag plus exposure logging, a success metric, and guardrail metrics, run with statistical discipline. This lesson covers assignment versus exposure, sample ratio mismatch, peeking, a one-sentence view of CUPED, and when a dedicated experiment platform earns its place next to the flag.
Open study →- devops
- feature-flags
- progressive-delivery
- experimentation
- openfeature
- interview
- DevOps
Flag Architecture & Hygiene — SDK Placement, Consistency, Stale Flags & Debt
Cluster · Feature Flags — Targeting, Experimentation & Kill Switches
Flags fail quietly when the architecture is wrong, and loudly when hygiene is ignored. This lesson places SDKs so services do not split-brain a decision, adopts an OpenFeature-style seam, and sets a lifecycle from create to ramp to delete so stale flags do not become a permanent settings database.
Open study →- devops
- feature-flags
- progressive-delivery
- experimentation
- openfeature
- interview
- DevOps
State, Backends, Locking & Workspaces
Cluster · Infrastructure as Code — Terraform State, Modules & Safe Change
Terraform state maps configuration addresses to real resource IDs. This page covers remote backends, locking, encryption, and why prod usually gets its own root instead of a workspace.
Open study →- devops
- terraform
- iac
- state
- modules
- plan-apply
- policy-as-code
- interview
- DevOps
Resources, Providers & the Dependency Graph
Cluster · Infrastructure as Code — Terraform State, Modules & Safe Change
Providers turn HCL into API calls, and resources are the nodes in the graph. This page covers aliases, implicit edges, lifecycle, and why for_each beats count when a set changes shape.
Open study →- devops
- terraform
- iac
- state
- modules
- plan-apply
- policy-as-code
- interview
- DevOps
Plan, Apply, Drift Detection & Import
Cluster · Infrastructure as Code — Terraform State, Modules & Safe Change
Safe Terraform change is a pipeline: a saved plan, a review of replaces, an apply of that file, then drift detection and a deliberate import or recreate.
Open study →- devops
- terraform
- iac
- state
- modules
- plan-apply
- policy-as-code
- interview
- DevOps
Modules, Composition & Versioning
Cluster · Infrastructure as Code — Terraform State, Modules & Safe Change
A Terraform module is a versioned interface, not a dump of the whole account. This page covers composition, pins, registries, and when a root should stay flat.
Open study →- devops
- terraform
- iac
- state
- modules
- plan-apply
- policy-as-code
- interview
- DevOps
Blast Radius — Policy-as-Code, Secrets & CI Applies
Cluster · Infrastructure as Code — Terraform State, Modules & Safe Change
Terraform outages are usually applies that were allowed to do too much. This page covers policy on plan JSON, secret hygiene, least-privilege CI roles, and gates sized to blast radius.
Open study →- devops
- terraform
- iac
- state
- modules
- plan-apply
- policy-as-code
- interview
- DevOps
Infrastructure as Code — Terraform State, Modules & Safe Change
Cluster · Infrastructure as Code — Terraform State, Modules & Safe Change
Infrastructure as code turns console clicks into reviewable change with a known blast radius. This hub is the Terraform decision map for remote state, modules, saved plans, drift, and policy, with a light contrast to Pulumi, CloudFormation, and Crossplane.
Open study →- devops
- terraform
- iac
- state
- modules
- plan-apply
- policy-as-code
- interview
- DevOps
Rebase vs Merge vs Squash — When, Why & Tradeoffs
Cluster · Git
Merge records parallel work with a join commit. Rebase replays commits onto a new base and mints new ids. Squash collapses a branch into one commit. The wrong choice on a shared branch hurts the team. The wrong choice on a private branch mostly wastes review time.
Open study →- devops
- git
- rebase
- merge
- interview
- DevOps
Git Objects, Refs, Index & Working Tree — Mental Model
Cluster · Git
Everything in Git is an immutable content-addressed object or a mutable ref. The index is the staging area between the working tree and the next commit. Rebase, reset, and reflog stop feeling like magic once those three trees are obvious.
Open study →- devops
- git
- rebase
- merge
- interview
- DevOps
History Surgery — Amend, Interactive Rebase, Fixup & Autosquash
Cluster · Git
History surgery cleans private commits before review. Amend fixes the tip. Interactive rebase reorders, squashes, rewords, or edits. Fixup and autosquash fold review follow-ups into the commit they belong to. Every one of these tools mints new commit ids.
Open study →- devops
- git
- rebase
- merge
- interview
- DevOps
Git — Everyday Commands, Rebase vs Merge & Safe History
Cluster · Git
Git is a content-addressed DAG of commits plus movable refs and a staging index. This hub is the decision matrix for rebase, merge, and squash, and the map to objects, history surgery, recovery, and pull-request hygiene.
Open study →- devops
- git
- rebase
- merge
- interview
- DevOps
Cherry-pick, Revert, Reset & Reflog Recovery
Cluster · Git
Cherry-pick copies one commit's changes onto another branch as a new commit. Revert adds an inverse commit. Reset moves a branch pointer. Reflog is the local record of where HEAD used to point, and it is how you get a commit back after a bad rebase or reset.
Open study →- devops
- git
- rebase
- merge
- interview
- DevOps
Branching, PR Hygiene, Bisect, Worktrees & Hooks
Cluster · Git
Day-to-day collaboration is branching policy, pull-request hygiene, bisect, worktrees, and hooks. Trunk-based development keeps main releasable with short branches. Bisect is a binary search over commits. Worktrees are extra checkouts on one object database.
Open study →- devops
- git
- rebase
- merge
- interview
- DevOps
Supply Chain Security — Signing, SBOMs & OIDC Federation
Cluster · CI/CD Pipelines
OIDC federation, Sigstore/cosign, SBOMs, admit-time policy, and CI permissions hygiene for supply-chain defense.
Open study →- devops
- cicd
- pipelines
- artifacts
- supply-chain
- oidc
- sbom
- caching
- progressive-delivery
- interview
- DevOps
Pipeline Anatomy — Stages, Gates, Environments & Promotion
Cluster · CI/CD Pipelines
Stages, soft/hard gates, environments, and build-once promotion anatomy with GitHub Actions sketch + promotion helpers.
Open study →- devops
- cicd
- pipelines
- artifacts
- supply-chain
- oidc
- sbom
- caching
- progressive-delivery
- interview
- DevOps
CI/CD Pipelines — Stages, Artifacts, Caching & Supply Chain
Cluster · CI/CD Pipelines
Interview hub on CI/CD pipeline design: stages/gates, immutable artifacts, CI speed, branching/previews, and supply-chain controls (OIDC/SBOM/signing).
Open study →- devops
- cicd
- pipelines
- artifacts
- supply-chain
- oidc
- sbom
- caching
- progressive-delivery
- interview
- DevOps
CI Performance — Caching, Parallelism & Flaky Jobs
Cluster · CI/CD Pipelines
CI caching layers, parallelism/sharding, flake economics, and metrics that actually drive feedback time.
Open study →- devops
- cicd
- pipelines
- artifacts
- supply-chain
- oidc
- sbom
- caching
- progressive-delivery
- interview
- DevOps
Branching, Previews & Environment Promotion
Cluster · CI/CD Pipelines
Trunk-based vs GitFlow, ephemeral PR previews, environment promotion state machine, config vs artifact separation.
Open study →- devops
- cicd
- pipelines
- artifacts
- supply-chain
- oidc
- sbom
- caching
- progressive-delivery
- interview
- DevOps
Artifacts & Registries — Digests, Provenance & Immutability
Cluster · CI/CD Pipelines
Digests vs tags, SLSA/provenance, registry immutability, and digest-handoff patterns for staging→prod.
Open study →- devops
- cicd
- pipelines
- artifacts
- supply-chain
- oidc
- sbom
- caching
- progressive-delivery
- interview
- DevOps
Kubernetes Workloads — Deployments, Probes, Resources & Progressive Delivery
Cluster · Kubernetes Workloads
Controllers reconcile desired vs actual. Deployments own ReplicaSets that own Pods. Probes gate traffic and restarts. Requests/limits set QoS and scheduling. Rollouts need PDBs and a progressive strategy. This hub maps the cluster; Ingress/Gateway stays in the Private Networking pages.
Open study →- devops
- kubernetes
- deployments
- probes
- resources
- rollouts
- hpa
- interview
- DevOps
Rolling, Blue-Green & Canary — Strategies, PDBs & Blast Radius
Cluster · Kubernetes Workloads
RollingUpdate trades surge capacity for gradual replacement. Blue-green switches a Service between two Deployments. Canary shifts a fraction of traffic (Flagger/Argo Rollouts). PDBs bound voluntary disruption so you do not drain yourself offline.
Open study →- devops
- kubernetes
- rolling-update
- blue-green
- canary
- pdb
- progressive-delivery
- interview
- DevOps
Requests, Limits & QoS — CPU Throttling, Memory OOM & Scheduling
Cluster · Kubernetes Workloads
Requests drive scheduling; limits cap cgroups. Guaranteed / Burstable / BestEffort decide who dies under pressure. CPU over limit throttles; memory over limit OOMs. Overcommit without quotas is how noisy neighbors win.
Open study →- devops
- kubernetes
- resources
- qos
- cpu-throttling
- oom
- scheduling
- interview
- DevOps
Probes & Pod Lifecycle — Liveness, Readiness, Startup & PreStop
Cluster · Kubernetes Workloads
Startup probes buy slow boots. Readiness gates Service traffic. Liveness restarts stuck processes — never point it at a dependent database or you restart-storm yourself. PreStop plus terminationGracePeriodSeconds is how you drain cleanly.
Open study →- devops
- kubernetes
- probes
- liveness
- readiness
- startup
- lifecycle
- interview
- DevOps
Pods, ReplicaSets & Deployments — Desired State & Controllers
Cluster · Kubernetes Workloads
The Deployment controller owns ReplicaSets that own Pods. Labels and selectors wire the tree. maxUnavailable/maxSurge and revision history define how a rollout moves. Prefer Deployments over hand-managing ReplicaSets.
Open study →- devops
- kubernetes
- deployments
- replicasets
- pods
- controllers
- interview
- DevOps
HPA, VPA & Autoscaling Gotchas — Metrics, Stabilization & Thrash
Cluster · Kubernetes Workloads
HPA scales replicas from CPU/memory/custom/external metrics. Stabilization windows stop flap. VPA changes requests/limits and fights HPA if both target the same resource. Queue consumers often need custom metrics, not raw CPU.
Open study →- devops
- kubernetes
- hpa
- vpa
- autoscaling
- metrics
- interview