The DevOps concept map
211 concepts across 12 tracks, drawn with the 542 links between them. 202 of those links (37%) cross tracks, which is the part worth looking at: the concepts that decide DevOps interviews are rarely the ones that sit neatly inside one topic. Hover a concept to see only what it touches. Click to read it.
same trackcrosses tracks free membersbigger dot = more connections211 shown
Where the map is dense
The most-connected concepts are the ones the rest of the library keeps reaching for, which makes them the highest-leverage things to be solid on: Idempotency is a design property, not a retry setting (20), Build once, and let the artifact be the unit that moves (17), Error budgets: the arithmetic and the decision it forces (16), Failure domains: what a region, a zone and a cell actually buy you (15), and Diagnostic method: how to debug a system you did not build (15). If you are deciding where to spend a week, start with a hub rather than a leaf.
Every concept, by track
Systems Foundations19
- Everything is a queue, and the queue is where the latency lives11
- Linux processes and system calls: from application code to kernel evidence9
- DNS resolution and caching: recursion, TTLs and negative answers8
- TCP connections: handshakes, retransmissions, FIN and reset evidence8
- Linux virtual memory and page cache: read memory pressure correctly8
- Namespaces and cgroups: what a container actually is5
- TLS handshakes and certificate chains: trust, names and failures5
- HTTP versions and connection reuse: diagnose each hop5
- File descriptor exhaustion: distinguish process limits, leaks and connection demand5
- Application server diagnosis: Tomcat workers, JVM threads and downstream waits5
- Kernel patching: running versions, live patches and safe reboots4
- TCP flow control and congestion control: windows, RTT and throughput4
- Linux load average: runnable work, blocked tasks and CPU pressure4
- Shell pipelines and exit status: pipefail, PIPESTATUS and reliable automation3
- PowerShell automation: object pipelines, error handling, and remote results3
- Host firewalls: nftables rule order, connection tracking and packet evidence3
- Processes, threads and synchronization: shared memory, lost updates and lock contention3
- systemd service lifecycle: dependencies, readiness and restart behavior2
- Linux filesystem exhaustion: free bytes, inodes and deleted open files2
Cloud Architecture21
- Failure domains: what a region, a zone and a cell actually buy you15
- Cloud IAM policy evaluation: effective permissions and explicit denies8
- The cloud control plane is a dependency you forgot to design around6
- VPC subnets and routes: public reachability, NAT and return paths6
- Autoscaling control loops: signals, delay and usable capacity6
- Object storage consistency and versioning: visibility, deletion and recovery6
- Security groups and network ACLs: follow the return packet5
- Block, file and object storage: choose the interface your workload requires5
- RTO, RPO and recovery testing: prove service restoration and data loss limits5
- Cloud organization landing zones: AWS Organizations, Control Tower and account boundaries5
- Managed database failover: promotion, DNS and application recovery5
- Serverless retries and destinations: invocation modes and duplicate effects4
- Serverless execution lifecycle: initialization, reuse and concurrency3
- Load balancer health and draining: stop admission before shutdown3
- Database engine upgrades: compatibility rehearsals, cutover and recovery boundaries3
- Google Cloud resource hierarchy: IAM inheritance, service accounts and Shared VPC3
- Azure governance: management groups, subscriptions, RBAC and Azure Policy3
- CloudTrail investigation: event coverage, identity evidence and missing records3
- OpenStack architecture: compute scheduling, network ports and storage dependencies3
- Redshift query performance: queue time, data movement and workload management3
- CDN cache keys and invalidation: response variants, private data and safe releases2
Containers & Kubernetes25
- The control loop: the one idea Kubernetes is built on9
- Kubernetes architecture: control plane, nodes and failure boundaries9
- Requests are what the scheduler believes, limits are what the kernel enforces7
- Kubernetes probes and readiness gates: startup, restarts and traffic7
- Kubernetes RBAC and service accounts: identity, scope and privilege paths7
- Kubernetes scheduling constraints: affinity, taints and topology7
- Kubernetes Services and EndpointSlices: from stable name to ready backend6
- Pods, ReplicaSets and Deployments: ownership and rollout behavior5
- Container image layers and build cache: reuse, invalidation and secrets5
- OCI images and runtimes: manifests, bundles and Kubernetes boundaries5
- Container PID 1 and termination: signals, children and shutdown5
- Kubernetes node autoscaling: turn unschedulable pods into usable capacity5
- StatefulSets and stable identity: ordinals, storage and safe replacement5
- Kubernetes operators and CRDs: API contracts, reconciliation, and deletion5
- CFS quotas and throttling: what a CPU limit really enforces4
- Helm charts and releases: rendering, values, hooks and rollback limits4
- Kubernetes NetworkPolicy: isolation, additive rules and selector logic4
- Ingress controllers and Gateway API: routing objects versus data planes3
- Multi-stage container builds: control the runtime artifact3
- Kubernetes QoS and eviction: distinguish node pressure from container OOM3
- KEDA event-driven scaling: activation, HPA decisions and queue recovery3
- Pod disruption budgets: keeping maintenance from removing too many replicas3
- OpenShift operations: platform Operators, admission rules and application routing3
- Service mesh traffic and identity: Istio sidecars, ambient mode and authorization3
- Kubernetes backup and restoration: objects, volumes and application consistency2
Declarative Infrastructure17
- Terraform architecture: configuration, providers, plans and state10
- Terraform state locking: concurrent writers, stale plans and recovery8
- State and drift: why infrastructure as code needs a ledger7
- Immutable infrastructure, and the replacement nobody planned for7
- Ansible architecture: inventory, modules, handlers and repeatable change6
- Terraform modules: input contracts, outputs and provider ownership6
- Ansible rolling patching: batches, drains, failures and recovery4
- Terraform resource addresses: safe renames, moved blocks and keyed instances4
- Terraform import: adopting existing infrastructure without accidental changes4
- Terraform lifecycle rules: replacement ordering, destroy protection and drift ownership4
- Terraform drift remediation: adopt, restore or delegate a change4
- Terraform secrets in state and plans: redaction, persistence and access4
- Terraform workspaces: state separation and environment isolation3
- Terraform provider locking and upgrades: review more than a version number3
- Terraform tests and policy checks: choose evidence for each infrastructure claim3
- CloudFormation change sets, drift, and failed rollback recovery3
- Ansible roles and collections: reusable configuration with controlled inputs2
Delivery & GitOps26
- Build once, and let the artifact be the unit that moves17
- Deploying is not releasing11
- CI/CD pipeline architecture: dependencies, artifacts and trust boundaries11
- Rollback compatibility across application, database and message versions10
- GitOps: reconciliation, not deployment8
- Git branching strategies: trunk, release branches and integration cost7
- Semantic versioning: compatibility, prereleases and dependency ranges7
- Code review: ownership, change size and infrastructure evidence7
- Pipeline test selection: preserve coverage when tests are slow or flaky6
- Git merge vs rebase: commit identity and shared history5
- Canary deployments: traffic control, evidence and promotion5
- Pipeline caches and reproducible builds: reuse inputs without trusting stale outputs5
- Delivery metrics: measure rework alongside speed4
- Argo CD architecture: rendering, reconciliation and application health4
- Azure Pipelines architecture: stages, agents and protected resources4
- GitOps push and pull architectures: credentials and reconciliation ownership4
- Git objects and references: commits, trees, blobs and HEAD4
- Git cherry-pick and backports: dependencies, traceability and release testing4
- Git bisect: find a regression with a trustworthy test4
- Git merge queues and required checks: test the integration candidate4
- Git reflog, reset and revert: recovering work and shared history3
- Maven and Gradle dependency resolution: explaining what actually entered the build3
- Mobile CI/CD: signing custody, store rollouts and recovery for installed clients3
- Argo CD sync waves and hooks: phase ordering, health gates and migration failures3
- Jenkins controller and agent architecture: executors, isolation and credentials2
- Azure DevOps templates and resource checks: enforce release controls beyond YAML2
Observability & Reliability18
- Error budgets: the arithmetic and the decision it forces16
- Cardinality and label discipline: why metrics explode7
- Alert on symptoms, not causes7
- Metrics, logs and traces: designing evidence for production questions7
- Prometheus metric types: counters, gauges, histograms and useful queries7
- SLIs and SLOs: valid events, good outcomes and measurement boundaries5
- Prometheus recording rules: useful aggregates and reliable evaluation5
- OpenTelemetry Collector architecture: follow telemetry, queues and failure boundaries5
- Alertmanager routing, grouping and inhibition: delivering useful pages4
- Prometheus scraping and staleness: missing is not zero4
- PromQL vector matching: joins, missing results and uniqueness4
- Grafana dashboards: operational questions, query correctness, and provisioning4
- Multi-window burn-rate alerts: budget arithmetic and recovery signals3
- Alert fatigue and alert lifecycle: ownership, actionability and retirement3
- Prometheus native histograms: query distributions and migrate without blind spots3
- Head and tail trace sampling: selection bias, routing and memory budgets3
- JMeter performance testing: workload models, assertions and credible results3
- Trace propagation across queues: message context, batch links and retry attempts3
Debugging Production13
- Diagnostic method: how to debug a system you did not build15
- Mitigate before you diagnose8
- Connection pool exhaustion: trace waits before increasing capacity8
- Cascading failure mechanics: how one slow dependency kills healthy services5
- Incident severity and command roles: impact, coordination and handoffs5
- Postmortems and corrective actions: evidence, contributing conditions and verification5
- Production change correlation: timelines, cohorts and causal evidence5
- CrashLoopBackOff investigation: find why the process exits5
- Memory leaks versus cache growth: prove what remains after work finishes5
- ITSM change enablement: incident, problem and release records across service tools5
- Slow database queries: distinguish bad plans, lock waits and storage pressure5
- Incident communication: confirmed impact, uncertainty and update cadence3
- Redis troubleshooting: memory accounting, eviction and latency evidence3
Security in the Pipeline19
- Secrets management: issuance, delivery, rotation and revocation12
- Identity, not network position: the idea zero trust is actually about9
- Your supply chain is a graph, and you only see the first layer9
- Workload identity federation and OIDC: issuer, audience and subject9
- Windows update rings: staged patches, restarts and rollout evidence6
- Active Directory Domain Services: forests, domains, controllers and DNS5
- Microsoft Entra ID versus Active Directory: protocols and migration boundaries5
- Kerberos tickets: TGTs, service principals and clock failures4
- Intune enrollment: device identity, MDM and the management extension4
- RBAC, ABAC and least privilege: decide who can change what4
- SAST, DAST and dependency scanning: coverage and release decisions4
- Vault dynamic secrets: leases, renewal, revocation and connection pools3
- Intune compliance and Conditional Access: evaluation versus enforcement3
- LDAP directory queries: bind identity, search scope and secure transport3
- Group Policy processing: scope, precedence and effective settings3
- OAuth access tokens and scopes: authorize the intended resource3
- Checkmarx release gates: scan identity, engine completion and finding triage3
- Qualys remediation: authenticated coverage, asset identity and trustworthy closure3
- PKI certificate issuance and renewal: prove identity and verify the served certificate2
Infrastructure at Scale16
- Idempotency is a design property, not a retry setting20
- Saturation and utilisation targets: why systems fall over before they are full15
- Napkin math: sizing a system before you draw it10
- Timeout budgets and deadline propagation: bounding useful request work8
- Queue delivery guarantees: acknowledgments, redelivery and effects7
- Transactional outbox and inbox: close database-to-message gaps6
- Data pipeline recovery: checkpoints, repeatable backfills and publication checks6
- Reliable webhooks: authentication, durable acceptance and duplicate delivery5
- Retries, backoff and jitter: control repeated work5
- Circuit breakers and bulkheads: contain dependency failures4
- Distributed locks and fencing tokens: reject work from an expired owner4
- Kafka partitions and consumer offsets: ordering, rebalances and replay4
- Rate limiting algorithms: bursts, windows and shared quotas3
- REST API contracts: HTTP methods, conditional updates and compatibility3
- Database normalization and denormalization: dependencies, historical facts and read models3
- NoSQL access patterns: keys, hot partitions and read consistency2
Platform & Cloud Economics14
- Platform as a product: measuring adoption and developer outcomes11
- A total nobody can divide is unmanageable8
- Internal developer platforms and golden paths: supported delivery with ownership7
- Cloud cost allocation and tagging: reconcile spend to real owners7
- Service catalogs: ownership, dependencies and reliable metadata6
- Developer self-service: automate actions inside policy boundaries3
- Showback and chargeback: choose shared-cost rules teams can act on3
- Cloud rightsizing: workload evidence, failure headroom and realized savings3
- Cloud Foundry and PCF: staging, droplets, routing and release recovery3
- Cognitive load as the constraint a platform is designed against1
- Abstraction leakage: designing for the moment the platform's model stops matching the system1
- Internal SLOs: what a platform owes the teams building on it1
- Migration cost asymmetry: why a better platform does not get adopted1
- The contribution contract: who owns a feature that a user of the platform built1
AI Infrastructure15
- The KV cache is what decides how many users you can serve8
- Model quality degrades without touching a single infrastructure metric7
- An agent can act as a confused deputy7
- Tokens are the unit of cost, latency and capacity at once6
- AI code review: evidence, evaluation and safe automation boundaries6
- AI-assisted development lifecycle: requirements, evidence and release authority6
- Prefill and decode are two different workloads on one GPU5
- Model artifact provenance: promote the evaluated release, including its dependencies5
- Why GPUs break the assumptions schedulers are built on4
- Model-serving batching and queueing: throughput within latency bounds4
- AI-generated infrastructure: validating plans, permissions and intended effects3
- Prompt injection in repository automation: defend the execution boundary3
- GPU memory allocation: separate live tensors, cached blocks and fragmentation3
- Agent development lifecycle: contracts, evaluations and controlled tool execution3
- MLOps data contracts: point-in-time features, training-serving consistency and promotion3
The Engineering Craft8
- The incident narrative: explain decisions with evidence7
- Project narratives: technical decisions, personal scope and honest evidence7
- Cross-team ownership negotiation: make responsibility executable5
- Operational tradeoffs under deadlines: bounded risk and follow-up ownership4
- Mentoring through operational work: build independent diagnosis safely4
- Leading a production migration: sequencing, evidence and recovery3
- Toil reduction: choose automation that earns its maintenance cost3
- Operational runbooks: decision steps, stop conditions and rehearsal evidence3
The map is for orientation. If you would rather be told what to do in order, the start-here path sequences the same material by background and stage, and the courses walk it front to back.