♾️ DevOps Bible

# Core workflow terraform init # download providers and modules terraform validate # validate configuration syntax terraform plan # preview changes — ALWAYS review first terraform apply # apply approved changes terraform destroy # remove resources # Environment structure environments/ ├── dev/ │ └── main.tf ├── stage/ │ └── main.tf └── prod/ └── main.tf # Module structure modules/ ├── vpc/ ├── subnet/ ├── security-group/ ├── eks/ └── rds/ # Remote backend config terraform { backend "s3" { bucket = "my-tfstate" key = "prod/terraform.tfstate" region = "us-east-1" dynamodb_table = "terraform-locks" encrypt = true } }

# Basic playbook structure - hosts: web become: yes tasks: - name: Install Nginx apt: name: nginx state: present - name: Start and enable nginx systemd: name: nginx state: started enabled: yes - name: Deploy config from template template: src: nginx.conf.j2 dest: /etc/nginx/nginx.conf notify: Restart nginx handlers: - name: Restart nginx systemd: name: nginx state: restarted # Run playbook ansible-playbook -i inventory playbook.yml ansible-playbook -i inventory playbook.yml --check # dry run ansible-playbook -i inventory playbook.yml --tags install # Ansible Vault ansible-vault encrypt secrets.yml ansible-vault decrypt secrets.yml ansible-vault edit secrets.yml

# Example Dockerfile FROM nginx:alpine COPY ./html /usr/share/nginx/html EXPOSE 80 CMD ["nginx", "-g", "daemon off;"] # Container Lifecycle Flow docker create → docker start → docker ps → docker stop → docker pause → docker unpause → docker restart → docker kill → docker rm # Common commands docker build -t myapp:1.0.0 . docker run -d myapp:1.0.0 docker ps # running containers docker logs docker inspect docker stats # resource usage docker rm -f docker system prune -a # clean up

# ConfigMap example apiVersion: v1 kind: ConfigMap metadata: name: app-config data: APP_NAME: myapp APP_ENV: production # Secret example apiVersion: v1 kind: Secret metadata: name: db-secret type: Opaque data: username: YWRtaW4= # base64 encoded password: cGFzc3dvcmQ= # PVC example apiVersion: v1 kind: PersistentVolumeClaim metadata: name: pvc-data spec: accessModes: - ReadWriteOnce resources: requests: storage: 10Gi storageClassName: fast-storage

# GitOps repository structure apps/ ├── my-app/ │ ├── base/ │ │ ├── deployment.yaml │ │ ├── service.yaml │ │ └── configmap.yaml │ └── overlays/ │ ├── dev/ (kustomization.yaml, values.yaml) │ ├── staging/ │ └── prod/ # Argo CD sync policies Manual: Sync only when manually triggered Automatic: Sync automatically on changes Automatic + Prune: Sync and remove resources no longer in Git Automatic + Self Heal: Sync and revert any drift automatically # Key commands argocd app get my-app argocd app diff my-app argocd app sync my-app argocd app rollback my-app

# PromQL examples rate(http_requests_total[5m]) # requests per second sum(rate(http_requests_total{status=~"5.."}[5m])) # error rate (5xx) 100 - avg by (instance) (rate(node_cpu_seconds_total{mode="idle"}[5m]) * 100) # CPU usage % # Alerting rule example groups: - name: api.alerts rules: - alert: HighErrorRate expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.05 for: 5m labels: severity: critical annotations: summary: "High error rate detected"