diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml index 2fca521..7b2f604 100644 --- a/.github/workflows/docs-quality.yml +++ b/.github/workflows/docs-quality.yml @@ -29,17 +29,29 @@ jobs: "README.md", "CONTRIBUTING.md", "STYLE_GUIDE.md", + "visual-guides.md", "arista.md", + "aws.md", "azure.md", "cisco.md", "docker.md", - "gcloud.md", + "git.md", + "google-cloud.md", "iptables.md", "kubernetes.md", + "leaf-spine.md", + "linux-boot.md", + "pulumi.md", "rest-api.md", + "spanning-tree.md", "terraform.md", ] + supported_mermaid = re.compile( + r"^(flowchart|graph|sequenceDiagram|stateDiagram-v2|" + r"classDiagram|erDiagram|journey|gitGraph|mindmap|timeline)\b" + ) + errors = [] for filename in files: path = Path(filename) @@ -65,6 +77,26 @@ jobs: if re.search(r"\[[^\]]*\]\(\s*\)", line): errors.append(f"{filename}:{number}: empty Markdown link") + opening_count = text.count("```mermaid") + mermaid_blocks = re.findall( + r"```mermaid\s*\n(.*?)```", + text, + flags=re.DOTALL, + ) + if opening_count != len(mermaid_blocks): + errors.append(f"{filename}: unclosed Mermaid code fence") + + for index, block in enumerate(mermaid_blocks, start=1): + first_line = next( + (line.strip() for line in block.splitlines() if line.strip()), + "", + ) + if not supported_mermaid.match(first_line): + errors.append( + f"{filename}: Mermaid block {index} has an unsupported " + f"or missing diagram declaration: {first_line!r}" + ) + if errors: print("\n".join(errors)) sys.exit(1) @@ -88,13 +120,20 @@ jobs: README.md CONTRIBUTING.md STYLE_GUIDE.md + visual-guides.md arista.md + aws.md azure.md cisco.md docker.md - gcloud.md + git.md + google-cloud.md iptables.md kubernetes.md + leaf-spine.md + linux-boot.md + pulumi.md rest-api.md + spanning-tree.md terraform.md - fail: true + fail: true \ No newline at end of file diff --git a/README.md b/README.md index 60a87b6..4254222 100644 --- a/README.md +++ b/README.md @@ -11,17 +11,32 @@ Practical quick-reference notes for network engineering, Linux operations, cloud - Start with read-only inspection commands and capture the current state. - Treat `clear`, `delete`, `destroy`, `flush`, `reset`, `prune`, and `--force` operations as destructive. - Prefer official documentation for release-specific behavior. +- Use [visual-guides.md](visual-guides.md) for topology, lifecycle, state-transition, and troubleshooting diagrams. - Open a content-correction issue when a command is obsolete, unsafe, ambiguous, or vendor-specific. +## Visual guides + +The diagrams are intentionally limited to concepts where visual relationships improve understanding; command-oriented references remain text-first. + +| Concept | Visual reference | Detailed reference | +|---|---|---| +| Spanning-tree root and alternate path | [Visual guide](visual-guides.md#spanning-tree-root-and-alternate-path) | [spanning-tree.md](spanning-tree.md) | +| Leaf-spine topology | [Visual guide](visual-guides.md#leaf-spine-fabric) | [leaf-spine.md](leaf-spine.md) | +| Pulumi change lifecycle | [Visual guide](visual-guides.md#pulumi-change-lifecycle) | [pulumi.md](pulumi.md) | +| Linux boot sequence | [Visual guide](visual-guides.md#linux-boot-sequence) | [linux-boot.md](linux-boot.md) | +| Git branch and pull-request workflow | [Visual guide](visual-guides.md#git-branch-and-pull-request-workflow) | [git.md](git.md) | +| Operational troubleshooting sequence | [Visual guide](visual-guides.md#operational-troubleshooting-sequence) | [STYLE_GUIDE.md](STYLE_GUIDE.md) | + ## Networking fundamentals | Topic | Reference | |---|---| | Clos fabrics | [clos.md](clos.md) | -| Leaf-spine design | [leafspine.md](leafspine.md) | +| Leaf-spine design | [leaf-spine.md](leaf-spine.md) | | LLDP | [lldp.md](lldp.md) | | OSI model | [osi.md](osi.md) | | OSPF | [ospf.md](ospf.md) | +| Spanning Tree Protocol | [spanning-tree.md](spanning-tree.md) | | TCP | [tcp.md](tcp.md) | | UDP | [udp.md](udp.md) | @@ -45,13 +60,11 @@ Practical quick-reference notes for network engineering, Linux operations, cloud ## Cloud platforms -| Topic | Reference | +| Platform | Reference | |---|---| -| AWS services | [awscloud.md](awscloud.md) | -| AWS CLI | [awscli.md](awscli.md) | +| Amazon Web Services and AWS CLI | [aws.md](aws.md) | | Microsoft Azure and Azure CLI | [azure.md](azure.md) | -| Google Cloud services | [gcpcloud.md](gcpcloud.md) | -| Google Cloud CLI | [gcloud.md](gcloud.md) | +| Google Cloud and Google Cloud CLI | [google-cloud.md](google-cloud.md) | ## Containers, orchestration, and infrastructure as code @@ -59,6 +72,7 @@ Practical quick-reference notes for network engineering, Linux operations, cloud |---|---| | Docker and Docker Compose | [docker.md](docker.md) | | Kubernetes and kubectl | [kubernetes.md](kubernetes.md) | +| Pulumi | [pulumi.md](pulumi.md) | | Terraform | [terraform.md](terraform.md) | | Jenkins CI/CD | [jenkins-cicd.md](jenkins-cicd.md) | | Puppet | [puppet.md](puppet.md) | @@ -71,7 +85,7 @@ Practical quick-reference notes for network engineering, Linux operations, cloud | Debian | [debian.md](debian.md) | | HAProxy | [haproxy.md](haproxy.md) | | iptables | [iptables.md](iptables.md) | -| Linux boot process | [linux_kernel_boot.md](linux_kernel_boot.md) | +| Linux boot and kernel | [linux-boot.md](linux-boot.md) | | nmap | [nmap.md](nmap.md) | | Pacemaker | [pacemaker.md](pacemaker.md) | | Corosync | [corosync.md](corosync.md) | @@ -84,11 +98,15 @@ Practical quick-reference notes for network engineering, Linux operations, cloud | Topic | Reference | |---|---| -| Git | [github.md](github.md) | +| Git | [git.md](git.md) | | Kafka | [kafka.md](kafka.md) | | REST APIs | [rest-api.md](rest-api.md) | | SQL | [sql.md](sql.md) | +## Filename conventions + +New and renamed sheets use descriptive lowercase kebab-case names, such as `google-cloud.md`, `leaf-spine.md`, and `spanning-tree.md`. A platform overview and its primary CLI belong in one file when they serve the same operational audience. + ## Maintenance policy Accuracy-sensitive documents should include an **Applies to** line and a **Last reviewed** date. A review date means the examples received a documentation review; it does not guarantee compatibility with every release or environment. @@ -97,4 +115,4 @@ Repository quality checks validate the maintained documentation surface on pull ## License -Content is available under the [MIT License](LICENSE). +Content is available under the [MIT License](LICENSE). \ No newline at end of file diff --git a/STYLE_GUIDE.md b/STYLE_GUIDE.md index b9fdcba..98f46d9 100644 --- a/STYLE_GUIDE.md +++ b/STYLE_GUIDE.md @@ -4,6 +4,28 @@ Each file should help an engineer answer a specific operational question quickly. Prefer commands, decision points, expected output, and cautions over broad product descriptions. +## Filename conventions + +Use descriptive lowercase kebab-case filenames: + +```text +google-cloud.md +leaf-spine.md +spanning-tree.md +``` + +Rules: + +- Use the product or protocol name an engineer is likely to search for. +- Separate words with hyphens, not underscores or compressed spellings. +- Avoid filenames that are broader or narrower than the actual content. +- Do not name a Git reference `github.md` unless the document is specifically about GitHub rather than Git. +- Combine a platform overview and its primary CLI when they serve the same audience and would otherwise repeat concepts. +- Keep separate files when tools have different lifecycles, safety models, or operational workflows, such as Terraform and Pulumi. +- Avoid renaming stable single-word files only for cosmetic consistency. + +When renaming or merging files, update the README, cross-references, and documentation-quality workflow in the same change. + ## Required metadata for maintained sheets Place these lines immediately below the title: @@ -28,6 +50,33 @@ Do not use realistic credentials, public IP addresses belonging to third parties For state-changing commands, show a read-only verification command first and add an inline warning when the operation is destructive. +## Visual diagrams + +Use Mermaid when a diagram explains relationships that are harder to understand as a flat list. Good candidates include: + +- physical or logical topology; +- packet, request, or control-plane paths; +- state transitions; +- deployment and infrastructure lifecycles; +- decision trees; +- failure domains; +- ordered boot or troubleshooting sequences. + +Do not add a diagram merely to repeat a command list, glossary, or short numbered procedure. A diagram should make a specific concept faster to understand. + +Guidelines: + +- Keep diagrams conceptual unless the document is explicitly vendor-specific. +- Use labels that remain readable in both GitHub light and dark themes. +- Avoid custom colors and styling unless they convey essential meaning. +- Keep node and edge counts low enough to read without zooming. +- Add a short explanation before or after each diagram. +- State important simplifications and do not imply that one diagram represents every vendor or failure case. +- Link visual guides to the detailed operational reference containing commands and cautions. +- Prefer one focused diagram over a large all-in-one architecture drawing. + +The repository-wide diagrams live in [visual-guides.md](visual-guides.md). Command-heavy cloud and utility sheets remain text-first unless a topology or lifecycle diagram adds clear operational value. Topic files may embed a diagram directly when it is essential to understanding that specific page. + ## Troubleshooting order Troubleshooting sections should generally proceed in this order: diff --git a/aws.md b/aws.md new file mode 100644 index 0000000..055f6d5 --- /dev/null +++ b/aws.md @@ -0,0 +1,392 @@ +# Amazon Web Services Cheat Sheet + +> **Applies to:** Current AWS services and AWS CLI version 2 +> **Last reviewed:** 2026-07-14 + +A practical reference for AWS account identity, IAM Identity Center authentication, common services, EC2, S3, IAM, VPC, Lambda, and RDS. + +> [!WARNING] +> AWS CLI commands act against the credentials, account, region, and profile currently in use. Verify all four before making a change, especially when profiles have similar names across development and production accounts. + +## Account and resource model + +| Concept | Purpose | +|---|---| +| Organization | Multi-account governance and consolidated management | +| Account | Primary security, billing, quota, and resource-isolation boundary | +| Region | Geographic deployment area containing multiple Availability Zones | +| Availability Zone | Isolated location within a Region | +| ARN | Amazon Resource Name that uniquely identifies a resource | +| Tag | Key-value metadata used for ownership, cost, policy, and automation | + +Use multiple accounts to separate environments and security boundaries rather than placing every workload into one account. + +## Common services + +| Area | Services | +|---|---| +| Compute | EC2, Lambda, ECS, EKS, Fargate, Elastic Beanstalk | +| Storage | S3, EBS, EFS, FSx, S3 Glacier storage classes | +| Databases | RDS, Aurora, DynamoDB, ElastiCache, Redshift | +| Networking | VPC, Elastic Load Balancing, Route 53, CloudFront, Transit Gateway, Direct Connect, Site-to-Site VPN | +| Security | IAM, IAM Identity Center, KMS, Secrets Manager, GuardDuty, Security Hub, WAF | +| Operations | CloudWatch, CloudTrail, AWS Config, Systems Manager | +| Integration | SQS, SNS, EventBridge, Step Functions, API Gateway | +| Infrastructure as code | CloudFormation, AWS CDK, Service Catalog | + +## CLI setup and version + +```bash +aws --version +aws configure list +aws configure list-profiles +aws configure get region --profile +``` + +Use named profiles instead of repeatedly overwriting the default profile. + +## IAM Identity Center authentication + +Configure a profile using the interactive wizard: + +```bash +aws configure sso +``` + +Sign in and verify identity: + +```bash +aws sso login --profile +aws sts get-caller-identity --profile +``` + +Sign out of cached IAM Identity Center sessions: + +```bash +aws sso logout +``` + +AWS CLI version 2 uses browser-based Proof Key for Code Exchange by default on current releases. Use device authorization only where required: + +```bash +aws sso login --profile --use-device-code +``` + +Prefer IAM Identity Center, role assumption, workload identity, and other short-lived credentials over long-lived IAM user access keys. + +## Verify identity before every change + +```bash +aws sts get-caller-identity --profile +aws configure get region --profile +``` + +A useful shell pattern: + +```bash +export AWS_PROFILE= +export AWS_REGION= +aws sts get-caller-identity +``` + +> [!CAUTION] +> Environment variables override profile-file settings in many AWS SDK and CLI scenarios. Inspect `AWS_PROFILE`, `AWS_REGION`, `AWS_DEFAULT_REGION`, and credential variables when behavior is unexpected. + +## Output, queries, and pagination + +```bash +aws help +aws --output json +aws --output table +aws --query '' +aws --no-cli-pager +``` + +Example: + +```bash +aws ec2 describe-instances \ + --query 'Reservations[].Instances[].{Name:Tags[?Key==`Name`]|[0].Value,ID:InstanceId,State:State.Name,AZ:Placement.AvailabilityZone}' \ + --output table +``` + +Do not use `--no-paginate` on large inventories unless you understand the resulting API and output volume. + +## Amazon S3 + +List buckets and objects: + +```bash +aws s3 ls +aws s3 ls s3://// +aws s3api get-bucket-location --bucket +aws s3api get-bucket-versioning --bucket +aws s3api get-object-lock-configuration --bucket +``` + +Copy and synchronize data: + +```bash +aws s3 cp s3:/// +aws s3 cp s3:/// +aws s3 sync / s3://// +aws s3 sync s3://// / +``` + +Preview a sync that would delete destination objects: + +```bash +aws s3 sync --delete --dryrun +``` + +> [!DANGER] +> `aws s3 sync --delete` removes objects from the destination that are absent from the source. Always run with `--dryrun`, inspect versioning and retention, and confirm the direction of the sync. + +Create a bucket with region-appropriate configuration: + +```bash +aws s3api create-bucket \ + --bucket \ + --region \ + --create-bucket-configuration LocationConstraint= +``` + +The `us-east-1` API has special create-bucket behavior; verify the current command reference when automating bucket creation across Regions. + +## Amazon EC2 + +Inventory: + +```bash +aws ec2 describe-instances +aws ec2 describe-instances --instance-ids +aws ec2 describe-instance-status --include-all-instances +aws ec2 describe-volumes --filters Name=attachment.instance-id,Values= +aws ec2 describe-security-groups --group-ids +``` + +Lifecycle operations: + +```bash +aws ec2 stop-instances --instance-ids +aws ec2 start-instances --instance-ids +aws ec2 reboot-instances --instance-ids +``` + +Terminate only after inspecting attached storage and termination protection: + +```bash +aws ec2 describe-instance-attribute \ + --instance-id \ + --attribute disableApiTermination + +aws ec2 terminate-instances --instance-ids +``` + +> [!DANGER] +> Instance termination can delete EBS volumes whose `DeleteOnTermination` flag is enabled. Confirm snapshots, data ownership, Auto Scaling behavior, and replacement dependencies first. + +## Systems Manager Session Manager + +List managed instances and start a session: + +```bash +aws ssm describe-instance-information +aws ssm start-session --target +``` + +Session Manager can reduce the need for inbound SSH exposure when the instance, IAM role, agent, and network path are correctly configured. + +## IAM + +Read-only inspection: + +```bash +aws iam list-users +aws iam list-roles +aws iam get-role --role-name +aws iam list-attached-role-policies --role-name +aws iam list-role-policies --role-name +aws iam get-account-authorization-details +``` + +Simulate a principal policy where permissions allow it: + +```bash +aws iam simulate-principal-policy \ + --policy-source-arn \ + --action-names +``` + +Avoid creating IAM users for applications. Use roles and temporary credentials. For human access, prefer IAM Identity Center. + +## Role assumption + +```bash +aws sts assume-role \ + --role-arn \ + --role-session-name +``` + +The command returns temporary credentials. Prefer profile-based role configuration, credential processes, or workload federation over manually exporting tokens. + +## VPC networking + +Inventory: + +```bash +aws ec2 describe-vpcs +aws ec2 describe-subnets +aws ec2 describe-route-tables +aws ec2 describe-internet-gateways +aws ec2 describe-nat-gateways +aws ec2 describe-network-acls +aws ec2 describe-security-groups +aws ec2 describe-vpc-endpoints +``` + +Create a VPC and subnet: + +```bash +aws ec2 create-vpc --cidr-block +aws ec2 create-subnet \ + --vpc-id \ + --cidr-block \ + --availability-zone +``` + +Create and attach an internet gateway: + +```bash +aws ec2 create-internet-gateway +aws ec2 attach-internet-gateway \ + --internet-gateway-id \ + --vpc-id +``` + +Security-group inspection: + +```bash +aws ec2 describe-security-group-rules \ + --filters Name=group-id,Values= +``` + +Avoid broad inbound access from `0.0.0.0/0` or `::/0` unless public exposure is explicitly required and protected by additional controls. + +## Elastic Load Balancing + +```bash +aws elbv2 describe-load-balancers +aws elbv2 describe-listeners --load-balancer-arn +aws elbv2 describe-target-groups +aws elbv2 describe-target-health --target-group-arn +``` + +Target health often provides the fastest explanation for an apparently healthy load balancer that is not serving traffic. + +## AWS Lambda + +```bash +aws lambda list-functions +aws lambda get-function --function-name +aws lambda get-function-configuration --function-name +aws lambda list-versions-by-function --function-name +aws lambda list-event-source-mappings --function-name +``` + +Invoke a function: + +```bash +aws lambda invoke \ + --function-name \ + --cli-binary-format raw-in-base64-out \ + --payload '' \ + +``` + +Update code only after confirming the deployment package, architecture, runtime, alias, and rollback version: + +```bash +aws lambda update-function-code \ + --function-name \ + --zip-file fileb:// \ + --publish +``` + +## Amazon RDS + +```bash +aws rds describe-db-instances +aws rds describe-db-clusters +aws rds describe-db-snapshots +aws rds describe-events --source-type db-instance --duration 1440 +``` + +Create a manual snapshot: + +```bash +aws rds create-db-snapshot \ + --db-instance-identifier \ + --db-snapshot-identifier +``` + +Delete an instance with a final snapshot: + +```bash +aws rds delete-db-instance \ + --db-instance-identifier \ + --final-db-snapshot-identifier +``` + +> [!DANGER] +> Avoid `--skip-final-snapshot` unless data destruction is explicitly approved and recoverability is not required. Check deletion protection, replicas, cluster membership, and application dependencies. + +## CloudWatch and CloudTrail + +```bash +aws cloudwatch list-metrics --namespace +aws cloudwatch describe-alarms +aws logs describe-log-groups +aws logs tail --since 1h --follow +aws cloudtrail lookup-events --max-results 50 +``` + +CloudTrail lookup is useful for recent management events but does not replace a properly configured organization trail or event data store. + +## Tagging and inventory + +```bash +aws resourcegroupstaggingapi get-resources +aws resourcegroupstaggingapi get-resources \ + --tag-filters Key=,Values= +``` + +Tagging should support ownership, environment, application, cost allocation, data classification, and lifecycle automation. + +## Troubleshooting checklist + +1. Run `aws sts get-caller-identity`. +2. Confirm profile and Region. +3. Check whether environment variables override profile settings. +4. Verify the exact ARN and resource Region. +5. Check IAM policies, permission boundaries, service control policies, and resource policies. +6. Confirm quotas and service availability. +7. Inspect CloudTrail and service events. +8. Retry with `--debug` only long enough to collect evidence. + +```bash +aws sts get-caller-identity +aws configure list +aws configure list-profiles +env | grep '^AWS_' +``` + +Debug logs can contain request metadata, account identifiers, endpoints, and signed-request details. Sanitize them before sharing. + +## References + +- [AWS CLI version 2 user guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html) +- [IAM Identity Center authentication with AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html) +- [AWS CLI command reference](https://docs.aws.amazon.com/cli/latest/reference/) +- [STS get-caller-identity](https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html) +- [AWS services by category](https://aws.amazon.com/products/) diff --git a/awscli.md b/awscli.md deleted file mode 100644 index 189c341..0000000 --- a/awscli.md +++ /dev/null @@ -1,137 +0,0 @@ -### AWS CLI Cheat Sheet - -#### Introduction to AWS CLI -The AWS Command Line Interface (CLI) is a powerful tool to interact with AWS services, enabling scripting and automation for efficient cloud management. - -- **Purpose**: Manage AWS services, automate tasks, and script operations. - ---- - -#### Configuration and Setup -**Configure AWS CLI** -- `aws configure` -- Sets up AWS credentials (Access Key, Secret Key) and default region. - -**View Configuration** -- `aws configure list` -- Lists the current AWS CLI configuration settings. - -**Using Profiles** -- `aws configure --profile [profile_name]` -- Configure multiple profiles for different AWS accounts or roles. - -#### Amazon S3 (Simple Storage Service) -**List S3 Buckets** -- `aws s3 ls` -- Lists all S3 buckets in the account. - -**Create S3 Bucket** -- `aws s3 mb s3://[bucket-name]` -- Creates a new S3 bucket. - -**Copy Files to/from S3** -- `aws s3 cp [local_path] s3://[bucket-name]/[object]` -- `aws s3 cp s3://[bucket-name]/[object] [local_path]` -- Copies files to or from S3. - -**Sync Local Directory with S3** -- `aws s3 sync [local_path] s3://[bucket-name]` -- Synchronizes contents of a local directory with an S3 bucket. - -#### EC2 (Elastic Compute Cloud) -**List EC2 Instances** -- `aws ec2 describe-instances` -- Displays information about EC2 instances. - -**Start/Stop EC2 Instances** -- `aws ec2 start-instances --instance-ids [instance_id]` -- `aws ec2 stop-instances --instance-ids [instance_id]` -- Starts or stops specified EC2 instances. - -**Create EC2 Key Pair** -- `aws ec2 create-key-pair --key-name [key_name]` -- Creates a new key pair for EC2 instances. - -**Launch EC2 Instance** -- `aws ec2 run-instances --image-id [ami_id] --count [number] --instance-type [type] --key-name [key_name]` -- Launches a specified number of EC2 instances. - -**Terminate EC2 Instance** -- `aws ec2 terminate-instances --instance-ids [instance_id]` -- Terminates specified EC2 instances. - -#### IAM (Identity and Access Management) -**List IAM Users** -- `aws iam list-users` -- Lists all IAM users in the AWS account. - -**Create IAM User** -- `aws iam create-user --user-name [username]` -- Creates a new IAM user. - -**Attach Policy to User** -- `aws iam attach-user-policy --policy-arn [policy_arn] --user-name [username]` -- Attaches a managed policy to an IAM user. - -**Create IAM Role** -- `aws iam create-role --role-name [role_name] --assume-role-policy-document [policy_json]` -- Creates a new IAM role with specified trust relationships. - -#### Networking with VPC -**Describe VPCs** -- `aws ec2 describe-vpcs` -- Lists all VPCs in the account. - -**Create VPC** -- `aws ec2 create-vpc --cidr-block [cidr_block]` -- Creates a new VPC with the specified CIDR block. - -**Create Subnet** -- `aws ec2 create-subnet --vpc-id [vpc_id] --cidr-block [cidr_block]` -- Creates a subnet in a specified VPC. - -**Create Internet Gateway** -- `aws ec2 create-internet-gateway` -- Creates an internet gateway for VPC. - -**Attach Internet Gateway to VPC** -- `aws ec2 attach-internet-gateway --internet-gateway-id [igw_id] --vpc-id [vpc_id]` -- Attaches an internet gateway to a VPC. - -#### AWS Lambda -**List Lambda Functions** -- `aws lambda list-functions` -- Lists AWS Lambda functions in the account. - -**Create Lambda Function** -- `aws lambda create-function --function-name [name] --runtime [runtime] --role [role_arn] --handler [handler] --zip-file fileb://[file_path]` -- Creates a new Lambda function. - -**Invoke Lambda Function** -- `aws lambda invoke --function-name [name] --payload [payload] [output_file]` -- Invokes a Lambda function with specified payload. - -**Update Lambda Function Code** -- `aws lambda update-function-code --function-name [name] --zip-file fileb://[file_path]` -- Updates the code of an existing Lambda function. - -#### AWS RDS (Relational Database Service) -**List RDS Instances** -- `aws rds describe-db-instances` -- Lists all RDS instances in the account. - -**Create RDS Instance** -- `aws rds create-db-instance --db-instance-identifier [id] --allocated-storage [size] --db-instance-class [class] --engine [engine] --master-username [username] --master-user-password [password]` -- Creates a new RDS database instance. - -**Delete RDS Instance** -- `aws rds delete-db-instance --db-instance-identifier [id] --skip-final-snapshot` -- Deletes an RDS database instance. - ---- - -#### Tips for Using AWS CLI -- **Scripting and Automation**: Integrate AWS CLI commands into scripts for automation of AWS services. -- **Output Formatting**: Use the `--output` option to format the CLI output as json, text, or table. -- **Version Update**: Regularly update AWS CLI to the latest version for new features and improvements. -- **Help and Documentation**: Use `aws [service] [command] help` for detailed information and examples. diff --git a/awscloud.md b/awscloud.md deleted file mode 100644 index dbfc8a5..0000000 --- a/awscloud.md +++ /dev/null @@ -1,114 +0,0 @@ -### AWS Cloud Cheat Sheet - -#### Introduction to AWS Cloud - -Amazon Web Services (AWS) is a comprehensive cloud platform offering over 200 fully featured services from data centers globally. - -- **Purpose**: Provides scalable and cost-effective cloud computing solutions. - -#### Core AWS Services - -**EC2 (Elastic Compute Cloud)** - -- Provides scalable virtual servers. -- Use Cases: Hosting web applications, running backend servers. - -**S3 (Simple Storage Service)** - -- Object storage service with high scalability. -- Use Cases: Storing images, videos, backups, static web hosting. - -**RDS (Relational Database Service)** - -- Managed relational database service. -- Supported Databases: MySQL, PostgreSQL, Oracle, SQL Server, MariaDB, Amazon Aurora. - -**Lambda** - -- Serverless compute service. -- Use Cases: Running code in response to events, backend services. - -**VPC (Virtual Private Cloud)** - -- Provides an isolated section of the AWS Cloud to launch resources. -- Use Cases: Networking setup, defining subnets, route tables, network gateways. - -#### Advanced AWS Services - -**Elastic Beanstalk** - -- Platform as a Service (PaaS) for deploying applications. -- Use Cases: Easy deployment and scaling of web applications. - -**CloudFormation** - -- Infrastructure as Code service to model and set up AWS resources. -- Use Cases: Automating infrastructure provisioning. - -**Elastic Kubernetes Service (EKS)** - -- Managed Kubernetes service. -- Use Cases: Running containerized applications. - -**DynamoDB** - -- NoSQL database service. -- Use Cases: High-performance, scalable applications. - -**Route 53** - -- Scalable Domain Name System (DNS) web service. -- Use Cases: Domain registration, DNS routing, health checking. - -#### AWS Security and Identity Services - -**IAM (Identity and Access Management)** - -- Manages access to AWS services and resources. -- Use Cases: Creating and managing AWS users and groups, permissions. - -**Cognito** - -- Provides user identity and data synchronization. -- Use Cases: User authentication for mobile and web applications. - -**Key Management Service (KMS)** - -- Managed service to create and control encryption keys. -- Use Cases: Encrypting data stored in other AWS services. - -#### AWS Monitoring and Management Tools - -**CloudWatch** - -- Monitoring service for AWS cloud resources and applications. -- Use Cases: Collecting and tracking metrics, setting alarms. - -**CloudTrail** - -- Service that provides a record of actions taken by a user, role, or AWS service. -- Use Cases: Compliance auditing, operational auditing. - -**AWS Config** - -- Tracks AWS resource configurations and changes. -- Use Cases: Compliance, security analysis, resource change tracking. - -#### AWS Networking Services - -**Direct Connect** - -- Establishes a dedicated network connection from on-premises to AWS. -- Use Cases: Reducing network costs, increasing bandwidth. - -**API Gateway** - -- Service for creating, publishing, maintaining, and securing APIs. -- Use Cases: API management for serverless applications. - -**Elastic Load Balancing (ELB)** - -- Automatically distributes incoming application traffic. -- Use Cases: Fault tolerance, traffic distribution across multiple instances. - - diff --git a/gcloud.md b/gcloud.md deleted file mode 100644 index bf5de66..0000000 --- a/gcloud.md +++ /dev/null @@ -1,141 +0,0 @@ -# Google Cloud CLI Cheat Sheet - -> **Applies to:** Current Google Cloud CLI (`gcloud`) -> **Last reviewed:** 2026-07-14 - -A practical reference for authentication, configuration, Compute Engine, GKE, Cloud Storage, IAM, and networking. - -## Authentication and configuration - -```bash -gcloud version -gcloud init -gcloud auth login -gcloud auth list -gcloud config configurations list -gcloud config list -gcloud config set project -gcloud config set compute/region -gcloud config set compute/zone -gcloud projects list -``` - -For local Application Default Credentials used by client libraries: - -```bash -gcloud auth application-default login -``` - -> [!WARNING] -> Do not confuse user CLI credentials with Application Default Credentials. Use workload identity or service-account impersonation for automation instead of downloading long-lived keys whenever possible. - -## Service-account impersonation - -```bash -gcloud auth print-access-token \ - --impersonate-service-account= - -gcloud config set auth/impersonate_service_account -gcloud config unset auth/impersonate_service_account -``` - -## Compute Engine - -```bash -gcloud compute instances list -gcloud compute instances describe --zone= -gcloud compute instances create \ - --zone= \ - --machine-type= \ - --image-family=debian-12 \ - --image-project=debian-cloud -gcloud compute ssh --zone= -gcloud compute instances stop --zone= -gcloud compute instances start --zone= -gcloud compute instances delete --zone= -``` - -## Google Kubernetes Engine - -```bash -gcloud container clusters list -gcloud container clusters describe --location= -gcloud container clusters get-credentials \ - --location= -gcloud container clusters create \ - --location= \ - --num-nodes=3 -gcloud container clusters resize \ - --location= \ - --num-nodes= -gcloud container clusters delete \ - --location= -``` - -## Cloud Storage - -Use the current `gcloud storage` command group for new scripts: - -```bash -gcloud storage buckets list -gcloud storage buckets create gs:// --location= -gcloud storage ls gs:// -gcloud storage cp gs:/// -gcloud storage cp gs:/// -gcloud storage rsync --recursive gs:/// -gcloud storage rm gs:/// -``` - -`gsutil` remains available in many installations, but do not introduce it into new automation unless compatibility requires it. - -## IAM and service accounts - -```bash -gcloud iam roles list -gcloud iam service-accounts list -gcloud iam service-accounts create \ - --display-name="" -gcloud projects get-iam-policy -gcloud projects add-iam-policy-binding \ - --member="serviceAccount:" \ - --role="roles/" -``` - -Avoid project-owner and broad primitive roles. Prefer predefined or custom roles with the minimum required permissions. - -## VPC networking - -```bash -gcloud compute networks list -gcloud compute networks describe -gcloud compute networks create --subnet-mode=custom -gcloud compute networks subnets list -gcloud compute networks subnets create \ - --network= \ - --region= \ - --range= -gcloud compute firewall-rules list -gcloud compute firewall-rules create \ - --network= \ - --direction=INGRESS \ - --action=ALLOW \ - --rules=tcp: \ - --source-ranges= -``` - -## Output and troubleshooting - -```bash -gcloud --help -gcloud info -gcloud topic formats -gcloud compute instances list \ - --format='table(name,zone.basename(),status,networkInterfaces[0].networkIP)' -gcloud components update -``` - -## References - -- [Google Cloud CLI documentation](https://cloud.google.com/sdk/gcloud) -- [Cloud Storage with the gcloud CLI](https://cloud.google.com/storage/docs/discover-object-storage-gcloud) -- [Service-account impersonation](https://cloud.google.com/docs/authentication/use-service-account-impersonation) diff --git a/gcpcloud.md b/gcpcloud.md deleted file mode 100644 index c107311..0000000 --- a/gcpcloud.md +++ /dev/null @@ -1,81 +0,0 @@ -### GCP (Google Cloud Platform) Cheat Sheet - -#### Introduction to GCP -Google Cloud Platform (GCP) is a suite of cloud computing services that runs on the same infrastructure that Google uses internally for its end-user products. - -- **Purpose**: Offers services for computing, storage, networking, Big Data, Machine Learning, and the Internet of Things (IoT), as well as cloud management, security, and developer tools. - ---- - -#### Core GCP Services -**Compute Engine** -- Provides scalable virtual machines. -- Use Cases: Hosting web applications, running backend servers. - -**App Engine** -- Platform as a Service (PaaS) for building scalable web applications and mobile backends. -- Use Cases: Building and deploying applications without worrying about the underlying infrastructure. - -**Cloud Storage** -- Object storage service for storing and accessing data. -- Use Cases: Storing application data, backups, and disaster recovery. - -**Cloud SQL** -- Managed relational database service. -- Supported Databases: MySQL, PostgreSQL, SQL Server. - -**BigQuery** -- Serverless, highly scalable, and cost-effective multi-cloud data warehouse. -- Use Cases: Business intelligence, data analysis, and reporting. - -#### Networking Services -**Virtual Private Cloud (VPC)** -- Provides networking functionality to the cloud resources. -- Use Cases: Network isolation and protection, subnets, IP ranges, network routes, and firewalls. - -**Cloud Load Balancing** -- Fully distributed, software-defined, managed service for all your traffic. -- Use Cases: Distributing user traffic across multiple instances. - -**Cloud CDN (Content Delivery Network)** -- Uses Google's globally distributed edge points to accelerate content delivery. -- Use Cases: Delivering web and video content with speed and reliability. - -#### Advanced Services -**Kubernetes Engine** -- Managed environment for deploying, managing, and scaling containerized applications using Google infrastructure. -- Use Cases: Running containerized applications. - -**Cloud Functions** -- Event-driven serverless compute platform. -- Use Cases: Building and connecting cloud services with code. - -**Cloud AI and Machine Learning** -- Integrated AI and machine learning services ranging from pre-trained models to customizable ML tools. -- Use Cases: Implementing machine learning models for various applications. - -#### Security and Identity Services -**Cloud Identity and Access Management (IAM)** -- Manages access control to GCP resources. -- Use Cases: Defining who (identity) has what access (role) to which resource. - -**Cloud Security Command Center** -- Comprehensive security management and data risk platform for GCP. -- Use Cases: Preventing and responding to threats to your GCP assets. - -**Cloud Key Management Service** -- Cloud-hosted key management service integrated with IAM and audit logging. -- Use Cases: Managing encryption for your cloud services. - -#### Developer and Management Tools -**Cloud SDK** -- Command-line interface for Google Cloud Platform products and services. -- Use Cases: Managing GCP resources and services via the command line. - -**Stackdriver** -- Provides monitoring, logging, and diagnostics. -- Use Cases: Monitoring the performance and health of your applications. - -**Cloud Build** -- Continuous integration, delivery, and deployment platform. -- Use Cases: Building, testing, and deploying software. diff --git a/git.md b/git.md new file mode 100644 index 0000000..716a804 --- /dev/null +++ b/git.md @@ -0,0 +1,335 @@ +# Git Cheat Sheet + +> **Applies to:** Current Git command-line workflows +> **Last reviewed:** 2026-07-14 + +A practical reference for repository setup, branches, commits, remotes, inspection, undo operations, rebasing, and recovery. + +> [!WARNING] +> Commands such as `reset --hard`, `clean`, forced pushes, and branch deletion can permanently remove uncommitted or unreferenced work. Inspect state and create a backup branch before destructive recovery. + +## Identify the current repository state + +```bash +git status --short --branch +git branch --show-current +git remote -v +git log --oneline --decorate --graph -20 +``` + +## Configure identity + +```bash +git config --global user.name '' +git config --global user.email '' +git config --global init.defaultBranch main +git config --list --show-origin +``` + +Use repository-local configuration when work and personal identities differ: + +```bash +git config user.name '' +git config user.email '' +``` + +## Create or clone a repository + +```bash +git init +git clone +git clone --branch +``` + +## Inspect changes + +```bash +git status +git diff +git diff --staged +git diff ... +git log --oneline --decorate --graph --all +git show +git blame +``` + +## Stage and commit + +```bash +git add +git add --patch +git restore --staged +git commit -m '' +git commit --amend +``` + +Use `git add --patch` to review each hunk and avoid accidentally committing unrelated changes. + +## Branches and switching + +```bash +git branch +git branch --all +git switch -c +git switch +git switch - +git branch -d +``` + +Force-delete a local branch only after confirming its commits are preserved elsewhere: + +```bash +git branch -D +``` + +## Remotes + +```bash +git remote -v +git remote add +git remote set-url +git fetch --all --prune +git remote show origin +``` + +## Pull, merge, and push + +```bash +git fetch origin +git merge origin/ +git pull --ff-only +git push -u origin +git push +``` + +Prefer `git pull --ff-only` when you do not want Git to create an implicit merge commit or rebase. + +## Merge a branch + +```bash +git switch +git fetch origin +git merge --ff-only origin/ +git merge +``` + +Resolve conflicts, stage the resolved files, and complete the merge: + +```bash +git status +git add +git commit +``` + +Abort an in-progress merge: + +```bash +git merge --abort +``` + +## Rebase + +```bash +git fetch origin +git rebase origin/main +git rebase --continue +git rebase --skip +git rebase --abort +``` + +Interactive cleanup: + +```bash +git rebase -i +``` + +> [!CAUTION] +> Rebase rewrites commit IDs. Avoid rebasing shared branches unless the collaboration workflow explicitly expects it. + +## Stash + +```bash +git stash push -m '' +git stash push --include-untracked -m '' +git stash list +git stash show --patch stash@{0} +git stash apply stash@{0} +git stash pop +git stash drop stash@{0} +``` + +Use `apply` instead of `pop` when you want to keep the stash until the result is verified. + +## Undo uncommitted changes + +Restore one file from the index: + +```bash +git restore +``` + +Restore both staged and working-tree content from `HEAD`: + +```bash +git restore --source=HEAD --staged --worktree +``` + +Remove untracked files only after a dry run: + +```bash +git clean -nd +git clean -nfd +git clean -fd +``` + +> [!DANGER] +> `git clean -fd` deletes untracked files and directories. Ignored files require additional flags and can include build artifacts, local configuration, or secrets. + +## Undo committed changes safely + +Create a new commit that reverses an earlier commit: + +```bash +git revert +git revert ^.. +``` + +Revert is generally safer for shared branches because it preserves history. + +## Reset local history + +Inspect first: + +```bash +git status +git log --oneline --decorate -10 +git branch backup/ +``` + +Reset modes: + +```bash +git reset --soft +git reset --mixed +git reset --hard +``` + +| Mode | Branch pointer | Index | Working tree | +|---|---|---|---| +| `--soft` | Moves | Preserved | Preserved | +| `--mixed` | Moves | Reset | Preserved | +| `--hard` | Moves | Reset | Reset | + +> [!DANGER] +> `git reset --hard` discards tracked working-tree changes. Create a backup branch and verify the target commit before running it. + +## Cherry-pick + +```bash +git cherry-pick +git cherry-pick --continue +git cherry-pick --abort +``` + +Apply a commit without immediately committing it: + +```bash +git cherry-pick --no-commit +``` + +## Tags + +```bash +git tag +git tag -a -m '' +git show +git push origin +git push origin --tags +``` + +## Find a regression with bisect + +```bash +git bisect start +git bisect bad +git bisect good +``` + +Test each selected commit and mark it: + +```bash +git bisect good +git bisect bad +git bisect reset +``` + +Automate with a test command: + +```bash +git bisect run +``` + +## Recover lost commits + +```bash +git reflog +git show +git branch recovery/ +``` + +The reflog is local and expires over time. Create a branch as soon as the desired commit is found. + +## Submodules + +```bash +git submodule status +git submodule update --init --recursive +git submodule sync --recursive +git clone --recurse-submodules +``` + +## Worktrees + +```bash +git worktree list +git worktree add ../ +git worktree add -b ../ +git worktree remove ../ +git worktree prune +``` + +Worktrees are useful when multiple branches must be checked out simultaneously without repeated stashing. + +## Safer force push + +```bash +git fetch origin +git push --force-with-lease origin +``` + +> [!CAUTION] +> `--force-with-lease` is safer than `--force`, but it still rewrites remote history. Confirm that the branch is intended to be rewritten and that no collaborator work will be lost. + +## Useful aliases + +```bash +git config --global alias.st 'status --short --branch' +git config --global alias.lg 'log --oneline --decorate --graph --all' +git config --global alias.unstage 'restore --staged --' +``` + +## Troubleshooting checklist + +1. Run `git status --short --branch`. +2. Confirm the current branch and remote. +3. Fetch before comparing local and remote history. +4. Inspect staged and unstaged diffs separately. +5. Use `git reflog` before assuming a commit is lost. +6. Create a backup branch before reset, rebase, or force-push recovery. +7. Prefer revert for changes already shared with others. + +## References + +- [Git documentation](https://git-scm.com/docs) +- [Pro Git book](https://git-scm.com/book/en/v2) +- [Git glossary](https://git-scm.com/docs/gitglossary) diff --git a/github.md b/github.md deleted file mode 100644 index 74a1c85..0000000 --- a/github.md +++ /dev/null @@ -1,104 +0,0 @@ -### Git Cheat Sheet - -#### Introduction to Git - -Git is a distributed version control system used for tracking changes in source code during software development. It's designed for coordinating work among programmers, but it can be used to track changes in any set of files. - -- **Purpose**: Version control, collaboration, and source code management. - -#### Basic Git Commands - -```bash -# Initializing a Repository -git init - -# Cloning a Repository -git clone [url] - -# Adding Files -git add [file] # Add a specific file -git add . # Add all new and changed files - -# Committing Changes -git commit -m "[commit message]" - -# Pulling Changes -git pull [remote] [branch] - -# Pushing Changes -git push [remote] [branch] -``` - -#### Branching and Merging - -```bash -# Creating a Branch -git branch [branch-name] - -# Switching Branches -git checkout [branch-name] - -# Merging a Branch -git merge [branch-name] - -# Deleting a Branch -git branch -d [branch-name] -``` - -#### Viewing Changes - -```bash -# Status of Working Directory -git status - -# View Commit History -git log - -# Compare Changes -git diff -``` - -#### Remote Repositories - -```bash -# Adding a Remote Repository -git remote add [remote-name] [url] - -# Viewing Remote Repositories -git remote -v - -# Fetching Remote Changes -git fetch [remote-name] -``` - -#### Advanced Git Operations - -```bash -# Stashing Changes -git stash -git stash pop - -# Rebasing -git rebase [branch-name] - -# Cherry-Picking -git cherry-pick [commit-hash] -``` - -#### Troubleshooting and Undoing - -```bash -# Reverting Changes -git revert [commit-hash] - -# Resetting -git reset [file] # Unstage a file -git reset --hard [commit-hash] # Reset to a specific commit -``` - -#### Tips for Using Git - - -- **Regular Commits**: Make small, frequent commits for better tracking and easier troubleshooting. -- **Clear Commit Messages**: Write clear, descriptive commit messages. -- **Branching Strategy**: Follow a consistent branching strategy like Git Flow or Feature Branch Workflow. diff --git a/google-cloud.md b/google-cloud.md new file mode 100644 index 0000000..86905f8 --- /dev/null +++ b/google-cloud.md @@ -0,0 +1,391 @@ +# Google Cloud Cheat Sheet + +> **Applies to:** Current Google Cloud services and Google Cloud CLI (`gcloud`) +> **Last reviewed:** 2026-07-14 + +A practical reference for Google Cloud resource hierarchy, common services, authentication, Compute Engine, Google Kubernetes Engine, Cloud Storage, IAM, and VPC networking. + +> [!WARNING] +> Verify the active account, project, region, and zone before changing resources. Google Cloud commands often succeed against whichever project is currently selected, even when it is not the project you intended. + +## Resource hierarchy and scope + +| Scope | Purpose | +|---|---| +| Organization | Top-level administrative boundary for a company or domain | +| Folder | Optional grouping for departments, environments, or policy boundaries | +| Project | Primary billing, API, IAM, quota, and resource-management boundary | +| Region | Geographic area containing multiple zones | +| Zone | Deployment location within a region | + +Projects have both a human-readable project ID and an internal project number. Many APIs and IAM relationships use one or the other, so verify which value a command expects. + +## Common services + +| Area | Services | +|---|---| +| Compute | Compute Engine, Cloud Run, App Engine, Cloud Functions | +| Containers | Google Kubernetes Engine (GKE), Artifact Registry | +| Storage | Cloud Storage, Persistent Disk, Filestore | +| Databases | Cloud SQL, Spanner, Firestore, Bigtable, Memorystore | +| Data and analytics | BigQuery, Dataflow, Dataproc, Pub/Sub | +| Networking | VPC, Cloud Load Balancing, Cloud NAT, Cloud DNS, Cloud CDN, Cloud VPN, Cloud Interconnect | +| Security | IAM, Secret Manager, Cloud KMS, Security Command Center | +| Operations | Cloud Logging, Cloud Monitoring, Error Reporting, Trace | +| Build and delivery | Cloud Build, Cloud Deploy, Artifact Registry | + +## CLI setup and identity + +```bash +gcloud version +gcloud init +gcloud auth login +gcloud auth list +gcloud config configurations list +gcloud config list +gcloud projects list +``` + +Show the active account and project: + +```bash +gcloud auth list --filter=status:ACTIVE +gcloud config get-value project +gcloud config get-value compute/region +gcloud config get-value compute/zone +``` + +Set defaults: + +```bash +gcloud config set project +gcloud config set compute/region +gcloud config set compute/zone +``` + +Use named configurations to separate environments or identities: + +```bash +gcloud config configurations create +gcloud config configurations activate +gcloud config configurations describe +gcloud config configurations delete +``` + +## Application Default Credentials + +Local user credentials for client libraries: + +```bash +gcloud auth application-default login +``` + +Inspect the Application Default Credentials environment: + +```bash +gcloud auth application-default print-access-token +``` + +> [!WARNING] +> `gcloud auth login` credentials and Application Default Credentials are separate. Do not assume that authenticating the CLI also configures every SDK or application. + +Prefer workload identity, Workload Identity Federation, or service-account impersonation for automation instead of downloading long-lived service-account keys. + +## Service-account impersonation + +Print a short-lived access token: + +```bash +gcloud auth print-access-token \ + --impersonate-service-account= +``` + +Set impersonation for the active CLI configuration: + +```bash +gcloud config set auth/impersonate_service_account +gcloud config unset auth/impersonate_service_account +``` + +Verify the effective identity by testing a read-only command against the intended project before making changes. + +## Enable and inspect APIs + +```bash +gcloud services list --enabled +gcloud services list --available +gcloud services enable .googleapis.com +gcloud services disable .googleapis.com +``` + +> [!CAUTION] +> Disabling an API can interrupt dependent workloads or management operations. Identify active resources and dependencies first. + +## Compute Engine + +Inspect instances: + +```bash +gcloud compute instances list +gcloud compute instances describe --zone= +gcloud compute machine-types list --zones= +``` + +Create and access an instance: + +```bash +gcloud compute instances create \ + --zone= \ + --machine-type= \ + --image-family=debian-12 \ + --image-project=debian-cloud + +gcloud compute ssh --zone= +``` + +Lifecycle operations: + +```bash +gcloud compute instances stop --zone= +gcloud compute instances start --zone= +gcloud compute instances reset --zone= +gcloud compute instances delete --zone= +``` + +> [!DANGER] +> Deleting an instance can also delete attached disks when their auto-delete setting is enabled. Inspect disk attachments and backup requirements first. + +## Google Kubernetes Engine + +```bash +gcloud container clusters list +gcloud container clusters describe --location= +gcloud container clusters get-credentials \ + --location= +``` + +Create and resize a cluster: + +```bash +gcloud container clusters create \ + --location= \ + --num-nodes= + +gcloud container clusters resize \ + --location= \ + --num-nodes= +``` + +Inspect available upgrades: + +```bash +gcloud container get-server-config --location= +gcloud container clusters describe \ + --location= \ + --format='yaml(currentMasterVersion,currentNodeVersion,releaseChannel)' +``` + +Delete a cluster: + +```bash +gcloud container clusters delete \ + --location= +``` + +> [!DANGER] +> Cluster deletion removes the Kubernetes control plane and node pools. Confirm persistent-volume retention, load balancers, DNS, and external dependencies first. + +## Cloud Storage + +Use `gcloud storage` for new scripts: + +```bash +gcloud storage buckets list +gcloud storage buckets describe gs:// +gcloud storage buckets create gs:// --location= +gcloud storage ls gs:// +gcloud storage cp gs:/// +gcloud storage cp gs:/// +gcloud storage rsync --recursive gs:/// +gcloud storage rm gs:/// +``` + +Inspect object versions and retention before bulk deletion: + +```bash +gcloud storage ls --all-versions gs:/// +gcloud storage buckets describe gs:// \ + --format='yaml(versioning,retentionPolicy,lifecycle)' +``` + +`gsutil` remains available for compatibility, but new automation should generally use `gcloud storage` unless a required feature is unavailable. + +## IAM and service accounts + +```bash +gcloud iam roles list +gcloud iam service-accounts list +gcloud iam service-accounts describe +gcloud iam service-accounts create \ + --display-name='' +``` + +Inspect project policy: + +```bash +gcloud projects get-iam-policy +gcloud projects get-iam-policy \ + --format='table(bindings.role,bindings.members)' +``` + +Add or remove a binding: + +```bash +gcloud projects add-iam-policy-binding \ + --member='serviceAccount:' \ + --role='roles/' + +gcloud projects remove-iam-policy-binding \ + --member='serviceAccount:' \ + --role='roles/' +``` + +Avoid broad primitive roles such as Owner, Editor, and Viewer for routine access. Prefer predefined or custom roles with the minimum permissions required. + +## VPC networking + +List and inspect networks: + +```bash +gcloud compute networks list +gcloud compute networks describe +gcloud compute networks subnets list +gcloud compute routes list --filter='network:' +``` + +Create a custom-mode VPC and subnet: + +```bash +gcloud compute networks create --subnet-mode=custom + +gcloud compute networks subnets create \ + --network= \ + --region= \ + --range= +``` + +Firewall policy inspection: + +```bash +gcloud compute firewall-rules list +gcloud compute firewall-rules describe +``` + +Create an ingress rule: + +```bash +gcloud compute firewall-rules create \ + --network= \ + --direction=INGRESS \ + --action=ALLOW \ + --rules=tcp: \ + --source-ranges= \ + --target-tags= +``` + +Avoid `0.0.0.0/0` and `::/0` unless public exposure is explicitly required and protected by additional controls. + +## Cloud Run + +```bash +gcloud run services list --region= +gcloud run services describe --region= +gcloud run deploy \ + --image=///: \ + --region= +gcloud run services update-traffic \ + --to-latest \ + --region= +``` + +Inspect IAM before enabling unauthenticated access. + +## Cloud SQL + +```bash +gcloud sql instances list +gcloud sql instances describe +gcloud sql databases list --instance= +gcloud sql users list --instance= +gcloud sql backups list --instance= +``` + +Delete only after confirming final backups and dependent applications: + +```bash +gcloud sql instances delete +``` + +## Logging and monitoring + +```bash +gcloud logging logs list +gcloud logging read '' --limit= --freshness= +gcloud monitoring policies list +gcloud monitoring channels list +``` + +Examples: + +```bash +gcloud logging read \ + 'resource.type="gce_instance" severity>=ERROR' \ + --limit=50 \ + --freshness=1h +``` + +## Output formatting and filtering + +```bash +gcloud --help +gcloud topic filters +gcloud topic formats +gcloud info +``` + +Useful formats: + +```bash +gcloud compute instances list --format='table(name,zone.basename(),status)' +gcloud projects list --format='value(projectId)' +gcloud compute instances list --filter='status=RUNNING' +``` + +## Troubleshooting checklist + +1. Verify active identity with `gcloud auth list`. +2. Verify project, region, and zone with `gcloud config list`. +3. Confirm the required API is enabled. +4. Check IAM permissions and organization policies. +5. Confirm quota and regional capacity. +6. Use `--verbosity=info` or `--verbosity=debug` temporarily. +7. Inspect Cloud Audit Logs for denied or changed operations. +8. Compare the command's fully expanded resource scope with the intended target. + +```bash +gcloud info +gcloud config list +gcloud services list --enabled +gcloud projects get-iam-policy +gcloud logging read 'protoPayload.status.code!=0' --limit=50 +``` + +Debug output can contain request details and identifiers. Sanitize it before sharing. + +## References + +- [Google Cloud CLI reference](https://cloud.google.com/sdk/gcloud/reference) +- [Authenticate for the Google Cloud CLI](https://cloud.google.com/sdk/docs/authorizing) +- [Google Cloud products and services](https://cloud.google.com/products) +- [Cloud Storage with the gcloud CLI](https://cloud.google.com/storage/docs/discover-object-storage-gcloud) +- [Service-account impersonation](https://cloud.google.com/docs/authentication/use-service-account-impersonation) diff --git a/leaf-spine.md b/leaf-spine.md new file mode 100644 index 0000000..003a0e4 --- /dev/null +++ b/leaf-spine.md @@ -0,0 +1,296 @@ +# Leaf-Spine Network Architecture Cheat Sheet + +> **Applies to:** General routed data center fabric concepts +> **Last reviewed:** 2026-07-14 + +A practical reference for leaf-spine topology, capacity planning, routing, failure behavior, oversubscription, and common design choices. + +## Topology + +A leaf-spine fabric is a two-tier Clos topology: + +- **Leaf switches** connect servers, storage, appliances, or access networks. +- **Spine switches** provide transit between leaf switches. +- Every leaf normally connects to every spine. +- Spines normally connect only to leaves in the same fabric tier. + +Traffic between endpoints on different leaves follows a predictable path: + +```text +endpoint -> leaf -> spine -> leaf -> endpoint +``` + +## Why use leaf-spine + +- predictable hop count and latency; +- multiple equal-cost paths; +- horizontal scale by adding leaves or spines; +- failure of one spine usually reduces capacity rather than disconnecting the fabric; +- strong fit for east-west application traffic; +- automation-friendly, repeatable topology. + +## Routed underlay + +Modern fabrics commonly use Layer 3 point-to-point links between leaf and spine switches. + +Typical choices: + +- eBGP with private autonomous system numbers; +- OSPF or IS-IS in smaller or operator-specific designs; +- IPv4 or IPv6 numbered links; +- unnumbered links where platform support and operations are mature; +- Bidirectional Forwarding Detection (BFD) for faster failure detection when justified. + +A routed underlay removes spanning tree from the leaf-to-spine fabric. Layer 2 loop prevention may still be required on server-facing bonds, multichassis links, legacy VLAN domains, or attached access networks. + +## Equal-Cost Multipath + +Equal-Cost Multipath (ECMP) distributes flows across available spine paths. + +Verify: + +- the routing table installs the expected number of next hops; +- hardware forwarding tables support the required ECMP width; +- the hash includes appropriate Layer 3 and Layer 4 fields; +- resilient hashing behavior meets failure and maintenance requirements; +- large flows do not create unacceptable polarization. + +Example operational checks vary by vendor: + +```text +show ip route +show bgp +show forwarding route +show interfaces counters rate +``` + +## Capacity and oversubscription + +For one leaf: + +```text +downlink capacity = sum of endpoint-facing bandwidth +uplink capacity = sum of leaf-to-spine bandwidth +oversubscription ratio = downlink capacity / uplink capacity +``` + +Example: + +```text +48 x 25 Gb/s downlinks = 1.2 Tb/s +8 x 100 Gb/s uplinks = 0.8 Tb/s +oversubscription = 1.5:1 +``` + +Consider real traffic patterns, not only port speed. Storage, backup, replication, AI, virtualization, and east-west service traffic can produce very different requirements. + +## Scaling limits + +The number of leaves supported by a spine tier is limited primarily by: + +- available spine ports; +- required link speed; +- optics and cabling design; +- routing and forwarding table capacity; +- ECMP width; +- power and cooling; +- failure-domain policy. + +Adding a spine increases available uplink capacity only when every participating leaf can connect to it. + +## BGP underlay pattern + +A common eBGP design uses: + +- one autonomous system number per leaf; +- one shared or unique autonomous system number strategy for spines; +- point-to-point peerings between every leaf and spine; +- loopbacks advertised through the underlay; +- maximum-path configuration for ECMP; +- strict prefix policy and session authentication where supported. + +Operational checks: + +```text +show bgp summary +show bgp neighbors +show ip route +show bfd peers +``` + +Avoid accepting or advertising unrestricted prefixes in the fabric underlay. + +## Overlay options + +A routed underlay can support an overlay such as VXLAN with BGP EVPN. + +Common overlay functions: + +- Layer 2 segments across leaves; +- distributed anycast gateways; +- tenant VRFs; +- MAC and IP advertisement; +- host mobility; +- integrated Layer 2 and Layer 3 services. + +Keep underlay and overlay troubleshooting separate: + +1. confirm physical links; +2. confirm underlay routing and loopback reachability; +3. confirm tunnel endpoint reachability; +4. confirm EVPN control-plane routes; +5. confirm VXLAN or encapsulation state; +6. confirm MAC, ARP/ND, and VRF forwarding. + +## Server multihoming + +Common choices include: + +- active/standby bonds to one or two leaves; +- Link Aggregation Control Protocol (LACP) to one switch; +- multichassis LAG or MLAG to a leaf pair; +- EVPN multihoming; +- host routing with one or more routed interfaces. + +Multichassis designs introduce state synchronization, split-brain handling, peer links, and failure cases that must be tested explicitly. + +## Border and service leaves + +Specialized leaf roles may include: + +- border leaves for WAN, internet, cloud, or inter-data-center connectivity; +- service leaves for firewalls, load balancers, and appliances; +- storage leaves; +- edge leaves for legacy Layer 2 domains; +- superspine connectivity for multi-pod or larger Clos designs. + +Do not create unnecessary hairpin paths through a distant service leaf without understanding bandwidth and failure impact. + +## Failure behavior + +| Failure | Expected effect in a healthy design | +|---|---| +| One leaf-to-spine link | Reduced path count for one leaf | +| One spine | Reduced fabric capacity, connectivity retained | +| One leaf | Endpoints on that leaf lose connectivity unless multihomed | +| One server link | Bonding, routing, or application redundancy handles failure | +| Control-plane session | ECMP path removed after protocol detection and convergence | +| Optic degradation | Errors or drops may occur before a hard link failure | + +Test both hard failures and partial failures such as packet loss, unidirectional links, MTU mismatch, and high error rates. + +## Maximum Transmission Unit + +The underlay must support the overlay packet plus encapsulation overhead. + +Verify end to end: + +```text +show interfaces +ping size do-not-fragment +``` + +Syntax varies by platform. Validate the maximum supported packet across host, leaf, spine, border, and appliance paths. + +## Cabling and addressing + +Recommended practices: + +- use deterministic port maps; +- label both ends of every cable; +- reserve consistent leaf and spine interface ranges; +- generate point-to-point addressing from source-of-truth data; +- use loopbacks for stable router IDs and tunnel endpoints; +- record optic type, serial number, and expected distance; +- validate polarity and lane mapping for parallel optics. + +## Monitoring + +Track at minimum: + +- interface state, errors, discards, and utilization; +- optic power and temperature; +- routing adjacency state and flap count; +- BFD state; +- ECMP next-hop count; +- control-plane CPU and memory; +- route and MAC table utilization; +- latency and packet loss between fabric nodes; +- overlay tunnel and EVPN route state where applicable. + +Streaming telemetry is often more useful than slow polling for microbursts and rapid convergence events. + +## Troubleshooting workflow + +### 1. Confirm scope + +Determine whether the issue affects one endpoint, one leaf, one rack, one spine path, one VRF, or the whole fabric. + +### 2. Check physical state + +```text +show interfaces status +show interfaces counters errors +show interfaces transceiver +``` + +### 3. Check underlay adjacency + +```text +show bgp summary +show ospf neighbor +show bfd peers +``` + +### 4. Check routes and ECMP + +```text +show ip route +show forwarding route +``` + +Confirm the expected number of next hops. + +### 5. Test loopback and path reachability + +Use sourced pings and traceroute from the relevant VRF or routing instance. + +### 6. Check overlay state + +Inspect EVPN routes, tunnel endpoints, VNIs, VRFs, MAC entries, and ARP or neighbor-discovery state. + +### 7. Compare intended and actual configuration + +Use the source of truth, generated configuration, and recent change history. Avoid making one-off CLI changes that create drift. + +## Common problems + +| Symptom | Likely checks | +|---|---| +| Only one rack affected | Leaf state, server links, leaf uplinks, rack power | +| Reduced throughput | Missing ECMP paths, optic errors, hashing, oversubscription | +| Intermittent loss | Bad optic, MTU mismatch, partial link failure, microbursts | +| Overlay unreachable | Underlay loopbacks, VTEP reachability, EVPN sessions, VNI mapping | +| One large flow is slow | Per-flow hashing and path utilization | +| Routes missing on one leaf | BGP policy, address family, max-prefix, session state | +| MLAG-host failure | Peer link, keepalive, split brain, LACP state | + +## Design checklist + +- Define rack, leaf, spine, and pod failure domains. +- Select underlay and overlay protocols deliberately. +- Calculate port count and oversubscription for current and future demand. +- Confirm ECMP width and forwarding-table capacity. +- Define loopback, point-to-point, ASN, VNI, VLAN, and VRF allocation. +- Standardize MTU. +- Decide how servers and appliances are multihomed. +- Build deterministic cabling and interface maps. +- Automate configuration from a source of truth. +- Test maintenance and failure scenarios before production. +- Monitor both control-plane convergence and data-plane forwarding. + +## References + +- [RFC 7938: Use of BGP for Routing in Large-Scale Data Centers](https://www.rfc-editor.org/rfc/rfc7938) +- [RFC 8365: A Network Virtualization Overlay Solution Using EVPN](https://www.rfc-editor.org/rfc/rfc8365) +- [RFC 7348: Virtual eXtensible Local Area Network](https://www.rfc-editor.org/rfc/rfc7348) diff --git a/leafspine.md b/leafspine.md deleted file mode 100644 index b803f1e..0000000 --- a/leafspine.md +++ /dev/null @@ -1,76 +0,0 @@ -# Leaf-Spine Network Architecture Cheat Sheet - -## Introduction to Leaf-Spine Architecture - -Leaf-spine is a two-layer network topology composed of leaf switches and spine switches. It's designed to minimize latency and manage increasing east-west network traffic in data centers efficiently. - -- **Function**: Provides high-bandwidth, low-latency connectivity across network nodes. -- **Use Cases**: Data center networking, cloud services, large enterprise networks. - -## Key Components - -- **Leaf Switches**: Connect to servers, storage systems, or other end-point devices. Each leaf switch is connected to every spine switch. -- **Spine Switches**: Backbone of the network, providing interconnectivity between leaf switches. Spine switches only connect to leaf switches — never to each other. -- **East-West Traffic**: Traffic that flows within the data center, typically between servers or storage systems. Leaf-spine is optimized for this traffic pattern. -- **North-South Traffic**: Traffic flowing in and out of the data center (client to server). Handled at the leaf layer via border or edge leaf switches. - -## Design Principles - -- **Scalability**: Easily scalable by adding more leaf or spine switches without redesigning the network. -- **Reduced Latency**: Any two endpoints are always exactly two hops apart (leaf → spine → leaf), giving predictable, uniform latency. -- **Load Balancing**: Traffic is distributed evenly across all spine switches using ECMP (Equal-Cost Multi-Path) routing. -- **Non-blocking Architecture**: Designed to avoid network congestion by ensuring sufficient bandwidth at every stage. -- **No Spanning Tree**: Because leaf-spine uses IP routing (not bridging) between tiers, Spanning Tree Protocol (STP) is eliminated at the fabric level. - -## Implementation Considerations - -- **Sizing**: Proper sizing of leaf and spine switches based on port capacity and throughput requirements. - - Number of spine switches = oversubscription ratio target - - Number of leaf switches = number of servers ÷ ports per leaf -- **Redundancy**: Each leaf connects to every spine, providing inherent path redundancy. Loss of a spine switch only reduces bandwidth, not connectivity. -- **Cabling**: Efficient cabling strategies to manage the increased density of connections. Use structured cabling or pre-terminated fiber bundles. -- **Routing Protocols**: Use of routing protocols like BGP (preferred in modern designs) or OSPF for dynamic routing within the architecture. -- **Oversubscription**: Plan the ratio of downlink (server-facing) to uplink (spine-facing) bandwidth. Common targets are 3:1 or 4:1. - -## BGP in Leaf-Spine (Modern Design) - -BGP is increasingly the preferred routing protocol for leaf-spine fabrics, especially in large-scale environments: - -- Each leaf and spine runs BGP. -- Leaf switches are eBGP peers with spine switches using unique ASNs per device. -- Benefits: simple, scalable, fine-grained policy control, and vendor-agnostic. -- Alternative: iBGP with route reflectors, or OSPF for smaller deployments. - -## Benefits of Leaf-Spine Architecture - -- **High Performance**: Optimized for high-bandwidth, low-latency networking. -- **Predictable Latency**: Uniform two-hop latency regardless of server location. -- **Flexibility**: Supports various types of traffic, including data, storage, and voice. -- **Simplified Management**: Easier to manage and troubleshoot compared to traditional three-tier (core/distribution/access) architectures. -- **Vendor Agnostic**: Works with any vendor's switches that support standard routing protocols. - -## Comparison: Leaf-Spine vs Traditional Three-Tier - -| Feature | Leaf-Spine | Three-Tier (Core/Dist/Access) | -|---|---|---| -| Latency | Uniform, 2 hops | Variable, 4–6 hops | -| East-West Traffic | Optimized | Not optimized | -| Scalability | High (add leaf or spine) | Limited by core capacity | -| Spanning Tree | Eliminated | Required | -| Complexity | Lower | Higher | -| Cost | Higher upfront | Lower upfront | - -## Common Use Cases - -- **Data Center Networks**: Ideal for modern data centers with high inter-server traffic. -- **Cloud Environments**: Supports the dynamic and scalable nature of cloud services. -- **High-Performance Computing**: Suitable for environments requiring fast computation and data retrieval. -- **Hyperconverged Infrastructure (HCI)**: Pairs well with HCI platforms like VMware vSAN or Nutanix. - -## Deployment Tips - -- **Network Virtualization**: Consider VXLAN overlays (with BGP EVPN) for multi-tenant environments and Layer 2 extension across leaf switches. -- **Capacity Planning**: Regularly review network utilization for capacity planning and upgrades. Monitor spine uplink utilization closely. -- **Monitoring and Analytics**: Implement network monitoring and analytics tools (e.g., streaming telemetry) for performance tracking and proactive issue detection. -- **Automation**: Leaf-spine fabrics are well suited to automation via tools like Ansible, Terraform, or vendor-specific APIs (e.g., Arista eAPI, Cisco NXAPI). -- **Test Before Production**: Validate ECMP behavior and failover scenarios in a lab or staging environment before production deployment. diff --git a/linux-boot.md b/linux-boot.md new file mode 100644 index 0000000..0e3492b --- /dev/null +++ b/linux-boot.md @@ -0,0 +1,331 @@ +# Linux Boot and Kernel Cheat Sheet + +> **Applies to:** Modern Linux systems using systemd, GRUB, and common distribution tooling +> **Last reviewed:** 2026-07-14 + +A practical reference for the Linux boot sequence, kernel command line, initramfs, systemd targets, boot troubleshooting, modules, and recovery. + +> [!WARNING] +> Bootloader, kernel, initramfs, filesystem, and module changes can leave a system unbootable. Preserve a known-good kernel, console access, backups, and a tested recovery path before making changes. + +## Boot sequence + +1. **Firmware:** BIOS or UEFI initializes hardware and selects a boot entry. +2. **Bootloader:** GRUB or another bootloader loads the kernel and initramfs. +3. **Kernel:** The kernel initializes CPU, memory, drivers, and core subsystems. +4. **Initramfs:** Early userspace discovers storage, unlocks encryption, assembles RAID or LVM, and mounts the real root filesystem. +5. **PID 1:** The kernel starts the init process, commonly systemd. +6. **Userspace:** systemd mounts filesystems, starts services, and reaches the configured target. + +## Identify the running system + +```bash +uname -a +uname -r +cat /etc/os-release +cat /proc/cmdline +systemd-detect-virt +systemctl get-default +systemctl is-system-running +``` + +## Kernel and boot files + +```bash +ls -lh /boot +ls -lh /boot/efi +find /boot -maxdepth 1 -type f -printf '%f\n' +``` + +Common files: + +| File | Purpose | +|---|---| +| `vmlinuz-*` | Compressed Linux kernel image | +| `initrd.img-*` or `initramfs-*` | Early userspace image | +| `config-*` | Kernel build configuration | +| `System.map-*` | Kernel symbol map | +| `/boot/grub/grub.cfg` | Generated GRUB configuration | +| `/etc/default/grub` | Distribution-level GRUB defaults | +| `/etc/fstab` | Filesystems and mount behavior | + +Do not edit generated `grub.cfg` files directly unless the platform explicitly requires it. Change the source configuration and regenerate the file. + +## Kernel command line + +Show current parameters: + +```bash +cat /proc/cmdline +``` + +Common temporary troubleshooting parameters: + +| Parameter | Effect | +|---|---| +| `systemd.unit=rescue.target` | Boot into rescue mode | +| `systemd.unit=emergency.target` | Boot into minimal emergency mode | +| `rd.break` | Break into initramfs on supported distributions | +| `nomodeset` | Disable normal graphics mode setting for troubleshooting | +| `single` or `1` | Request a single-user or rescue-like boot on some systems | +| `init=/bin/bash` | Start a shell as PID 1; use only for controlled recovery | + +> [!CAUTION] +> Kernel parameters differ by distribution, bootloader, initramfs implementation, and security configuration. Temporary console edits are safer than permanent changes while diagnosing an issue. + +## systemd boot targets + +```bash +systemctl list-units --type=target +systemctl get-default +systemctl set-default multi-user.target +systemctl set-default graphical.target +systemctl isolate rescue.target +systemctl isolate emergency.target +``` + +> [!WARNING] +> `systemctl isolate` stops units that are not required by the target and can disconnect remote sessions. Use console access for rescue operations. + +## Analyze boot performance + +```bash +systemd-analyze +systemd-analyze blame +systemd-analyze critical-chain +systemd-analyze plot > boot.svg +``` + +`blame` shows activation time, not necessarily the root cause. Use `critical-chain` and logs to understand ordering and dependency delays. + +## Inspect boot logs + +Current boot: + +```bash +journalctl -b +journalctl -b -p warning +journalctl -b -u +dmesg --human +``` + +Previous boot: + +```bash +journalctl -b -1 +journalctl -b -1 -p warning +``` + +List recorded boots: + +```bash +journalctl --list-boots +``` + +If previous boots are unavailable, persistent journal storage may not be enabled. + +## Service failures during boot + +```bash +systemctl --failed +systemctl status +journalctl -b -u +systemctl show -p After -p Before -p Requires -p Wants +systemctl list-dependencies +``` + +Reset a unit's failed state only after collecting evidence: + +```bash +systemctl reset-failed +``` + +## Filesystem and mount failures + +```bash +findmnt +findmnt --verify +lsblk -f +blkid +cat /etc/fstab +systemctl --failed --type=mount +journalctl -b | grep -iE 'mount|filesystem|fsck' +``` + +Test an `fstab` change without rebooting: + +```bash +sudo mount -av +``` + +> [!CAUTION] +> `mount -a` can still affect live mount points. Review the exact `fstab` change and use maintenance controls for production systems. + +For noncritical network or removable mounts, options such as `nofail`, `_netdev`, or systemd automount behavior may prevent unnecessary boot failure, but they change availability semantics. + +## Initramfs inspection and rebuild + +Debian and Ubuntu: + +```bash +lsinitramfs /boot/initrd.img-$(uname -r) | less +sudo update-initramfs -u -k $(uname -r) +``` + +RHEL, Fedora, Rocky, and related systems: + +```bash +lsinitrd /boot/initramfs-$(uname -r).img | less +sudo dracut --force /boot/initramfs-$(uname -r).img $(uname -r) +``` + +Rebuild an initramfs when required storage, encryption, filesystem, or early-boot drivers are missing. + +> [!WARNING] +> Confirm the target kernel version and verify free space in `/boot` before rebuilding. Do not overwrite the only known-good boot image without a recovery option. + +## GRUB configuration + +Inspect defaults: + +```bash +cat /etc/default/grub +``` + +Debian and Ubuntu: + +```bash +sudo update-grub +``` + +Common RHEL-family BIOS path: + +```bash +sudo grub2-mkconfig -o /boot/grub2/grub.cfg +``` + +Common RHEL-family UEFI path varies by distribution and version. Determine the supported generated configuration path before running `grub2-mkconfig`. + +List firmware boot entries: + +```bash +sudo efibootmgr -v +``` + +## Kernel packages + +Debian and Ubuntu: + +```bash +dpkg -l 'linux-image*' | grep '^ii' +apt list --installed 'linux-image*' +``` + +RHEL-family systems: + +```bash +rpm -q kernel +sudo grubby --default-kernel +sudo grubby --info=ALL +``` + +Keep at least one known-good previous kernel until the new kernel has booted and passed validation. + +## Kernel modules + +```bash +lsmod +modinfo +sudo modprobe +sudo modprobe -r +journalctl -k -b +dmesg --human | grep -i +``` + +Persistent module loading commonly uses files under: + +```text +/etc/modules-load.d/ +``` + +Module options commonly use: + +```text +/etc/modprobe.d/ +``` + +> [!CAUTION] +> Removing storage, network, filesystem, or security modules can interrupt the running system. Inspect module dependencies with `modinfo` and test in a nonproduction environment. + +## sysctl runtime settings + +```bash +sysctl -a +sysctl +sudo sysctl -w = +sudo sysctl --system +``` + +Persistent settings are commonly stored under: + +```text +/etc/sysctl.conf +/etc/sysctl.d/*.conf +``` + +Capture the old value and understand namespace or container interactions before changing kernel parameters. + +## Kernel and hardware information + +```bash +lscpu +lsmem +lsblk +lspci -k +lsusb +cat /proc/meminfo +cat /proc/interrupts +cat /proc/modules +``` + +## Common boot failure patterns + +| Symptom | Checks | +|---|---| +| Kernel panic: unable to mount root | Root device parameter, initramfs drivers, storage discovery, filesystem support | +| Emergency mode after mount failure | `/etc/fstab`, UUIDs, filesystem state, network mount dependencies | +| Boot hangs waiting for a device | Missing disk, incorrect UUID, timeout behavior, encrypted-volume or LVM activation | +| New kernel does not boot | Select previous kernel, compare initramfs and modules, inspect console logs | +| Network unavailable after boot | Driver or firmware, predictable interface names, NetworkManager/systemd-networkd status | +| Service delays boot | `systemd-analyze critical-chain`, unit dependencies, DNS, network-online target | +| UEFI cannot find bootloader | EFI System Partition, NVRAM entries, Secure Boot, bootloader installation | + +## Recovery workflow + +1. Photograph or capture the console error. +2. Try a known-good previous kernel from the bootloader. +3. Temporarily remove quiet or splash parameters to reveal messages. +4. Boot into rescue or emergency mode. +5. Confirm root filesystem, `/boot`, and EFI mounts. +6. Review the current and previous boot journal. +7. Validate `fstab`, kernel command line, and initramfs contents. +8. Rebuild only the affected artifact. +9. Regenerate the bootloader configuration when required. +10. Reboot with console access and validate services, storage, networking, and monitoring. + +## Security controls affecting boot + +- UEFI Secure Boot can reject unsigned kernels or modules. +- Kernel lockdown can restrict low-level access when Secure Boot is active. +- SELinux and AppArmor can block userspace actions after the kernel boots. +- LUKS encryption may require console input, TPM integration, or network-bound disk encryption. +- Measured boot and TPM policies can change after firmware, bootloader, or kernel updates. + +Do not disable a security control merely to make a system boot without first understanding the failure and the resulting exposure. + +## References + +- [Linux kernel documentation](https://docs.kernel.org/) +- [systemd documentation](https://systemd.io/) +- [systemd-analyze manual](https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html) +- [GNU GRUB manual](https://www.gnu.org/software/grub/manual/grub/) diff --git a/linux_kernel_boot.md b/linux_kernel_boot.md deleted file mode 100644 index 58e0132..0000000 --- a/linux_kernel_boot.md +++ /dev/null @@ -1,74 +0,0 @@ -### Linux Kernel and Boot Process Cheat Sheet - -#### Introduction to the Linux Kernel - - - -The Linux kernel is the core part of Linux operating systems. It's responsible for managing the system's resources and the communication between hardware and software components. As an open-source kernel, it's widely used in various distributions like Ubuntu, Fedora, and Debian. - - -#### Linux Kernel Components - - -- **Process Management**: Handles processes, scheduling, and multitasking. -- **Memory Management**: Manages memory allocation and paging. -- **Device Drivers**: Interface for communicating with hardware devices. -- **System Calls**: Interface for applications to access kernel functions. -- **Networking**: Manages network protocols and data transmission. -- **File Systems**: Handles data storage, retrieval, and organization. - - -#### The Linux Boot Process - - -1. **BIOS/UEFI Initialization**: The system's firmware initializes hardware and finds a bootable device. - -2. **Bootloader (GRUB/LILO)**: The bootloader presents a menu and loads the selected kernel into memory. GRUB (GRand Unified Bootloader) is commonly used. - -3. **Kernel Initialization**: The kernel initializes devices, mounts the root filesystem, and starts init (or systemd) which is the first user-space process. - -4. **Init/Systemd Process**: Responsible for starting system services and user-space applications. - - -#### Behind the Scenes in the Linux Kernel - - -- **Kernel Mode vs. User Mode**: The kernel operates in kernel mode with full access to hardware, while applications run in user mode with limited access. - -- **Interrupts and Context Switching**: The kernel handles interrupts (signals from hardware devices) and manages context switching between processes. - -- **Modules**: The kernel can load and unload modules at runtime, allowing for dynamic support of different devices. - -- **Filesystem Hierarchy**: The kernel adheres to a specific filesystem hierarchy for organizing system files and directories. - - -#### Important Kernel Directories and Files - - -- **/boot**: Contains boot loader and kernel files. -- **/proc**: Virtual filesystem providing access to kernel and process information. -- **/sys**: Interface to kernel data structures. -- **/dev**: Special files representing devices. -- **/etc**: Configuration files for the system. - - -#### Kernel Configuration and Compilation - - -- **Configuring the Kernel**: `make menuconfig` allows customization of kernel features. -- **Compiling the Kernel**: `make` and `make install` compile and install the kernel. - - -#### Kernel Debugging and Monitoring - - -- **dmesg**: Displays kernel-related messages. -- **/var/log**: Contains system log files. -- **SystemTap, kdump**: Tools for debugging and analyzing kernel performance. - - -#### Security in the Linux Kernel - - -- **SELinux/AppArmor**: Security modules for enforcing access control policies. -- **Firewall (iptables/nftables)**: Kernel-level firewall for packet filtering. diff --git a/pulumi.md b/pulumi.md new file mode 100644 index 0000000..512c834 --- /dev/null +++ b/pulumi.md @@ -0,0 +1,304 @@ +# Pulumi Cheat Sheet + +> **Applies to:** Pulumi CLI 3.x and Pulumi Infrastructure as Code +> **Last reviewed:** 2026-07-14 + +A practical reference for projects, stacks, configuration, previews, deployments, drift reconciliation, imports, state recovery, and CI usage. + +> [!WARNING] +> Pulumi commands operate against the currently selected stack. Run `pulumi stack` and verify the organization, project, stack, cloud account, and region before changing infrastructure. + +## Core concepts + +| Concept | Meaning | +|---|---| +| Project | A Pulumi program described by `Pulumi.yaml` | +| Stack | An isolated instance of a project, such as `dev`, `stage`, or `prod` | +| Resource | A cloud, Kubernetes, SaaS, or custom object managed by Pulumi | +| Configuration | Per-stack values stored in `Pulumi..yaml` | +| Secret | An encrypted configuration value or output | +| State | Pulumi's record of managed resources and their relationships | +| Backend | Pulumi Cloud or a self-managed object-storage/filesystem backend | + +## Installation and identity + +```bash +pulumi version +pulumi about +pulumi login +pulumi whoami +``` + +Log in to a self-managed backend: + +```bash +pulumi login s3:/// +pulumi login azblob:/// +pulumi login gs:/// +pulumi login file:// +``` + +Do not casually switch backends. Confirm that the intended stacks exist in the destination backend before running an update. + +## Create a project + +```bash +pulumi new +pulumi new