From fb83e7b10eaa0a4a4857c1fa13923f4fa18164be Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:34:44 -0500
Subject: [PATCH 01/26] Add Pulumi cheat sheet

---
 pulumi.md | 304 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 304 insertions(+)
 create mode 100644 pulumi.md

diff --git a/pulumi.md b/pulumi.md
new file mode 100644
index 0000000..512c834
--- /dev/null
+++ b/pulumi.md
@@ -0,0 +1,304 @@
+# Pulumi Cheat Sheet
+
+> **Applies to:** Pulumi CLI 3.x and Pulumi Infrastructure as Code
+> **Last reviewed:** 2026-07-14
+
+A practical reference for projects, stacks, configuration, previews, deployments, drift reconciliation, imports, state recovery, and CI usage.
+
+> [!WARNING]
+> Pulumi commands operate against the currently selected stack. Run `pulumi stack` and verify the organization, project, stack, cloud account, and region before changing infrastructure.
+
+## Core concepts
+
+| Concept | Meaning |
+|---|---|
+| Project | A Pulumi program described by `Pulumi.yaml` |
+| Stack | An isolated instance of a project, such as `dev`, `stage`, or `prod` |
+| Resource | A cloud, Kubernetes, SaaS, or custom object managed by Pulumi |
+| Configuration | Per-stack values stored in `Pulumi.<stack>.yaml` |
+| Secret | An encrypted configuration value or output |
+| State | Pulumi's record of managed resources and their relationships |
+| Backend | Pulumi Cloud or a self-managed object-storage/filesystem backend |
+
+## Installation and identity
+
+```bash
+pulumi version
+pulumi about
+pulumi login
+pulumi whoami
+```
+
+Log in to a self-managed backend:
+
+```bash
+pulumi login s3://<bucket>/<prefix>
+pulumi login azblob://<container>/<prefix>
+pulumi login gs://<bucket>/<prefix>
+pulumi login file://<absolute-path>
+```
+
+Do not casually switch backends. Confirm that the intended stacks exist in the destination backend before running an update.
+
+## Create a project
+
+```bash
+pulumi new
+pulumi new <template>
+pulumi new <template> --name <project-name> --stack <stack-name>
+```
+
+Common templates can target AWS, Azure, Google Cloud, Kubernetes, TypeScript, Python, Go, .NET, Java, or YAML.
+
+## Stack management
+
+```bash
+pulumi stack ls
+pulumi stack
+pulumi stack select <stack>
+pulumi stack init <stack>
+pulumi stack rename <new-name>
+pulumi stack history
+pulumi stack output
+pulumi stack output <output-name>
+```
+
+Fully qualified stack names can use this form:
+
+```text
+<organization>/<project>/<stack>
+```
+
+Display a secret output only when necessary:
+
+```bash
+pulumi stack output <output-name> --show-secrets
+```
+
+> [!WARNING]
+> `--show-secrets` writes decrypted values to the terminal and potentially to shell history, CI logs, or screen recordings.
+
+## Configuration and secrets
+
+```bash
+pulumi config
+pulumi config get <key>
+pulumi config set <key> <value>
+pulumi config set <key> <value> --secret
+pulumi config rm <key>
+pulumi config refresh
+```
+
+Set structured values:
+
+```bash
+pulumi config set --path 'network.subnets[0].cidr' '10.10.1.0/24'
+pulumi config set --path 'network.subnets[1].cidr' '10.10.2.0/24'
+```
+
+Copy configuration between stacks only after reviewing the destination:
+
+```bash
+pulumi config cp --dest <destination-stack>
+```
+
+Prefer workload identity, OpenID Connect, service-account impersonation, or short-lived credentials over long-lived cloud keys.
+
+## Preview changes
+
+```bash
+pulumi preview
+pulumi preview --diff
+pulumi preview --refresh
+pulumi preview --save-plan <plan-file>
+```
+
+A preview should be the normal first step for production changes. Review creates, replacements, deletes, provider changes, and unexpected diffs.
+
+Exit with a nonzero status when changes are present:
+
+```bash
+pulumi preview --expect-no-changes
+```
+
+This is useful for drift or policy checks, but it will also fail for intentional pending changes.
+
+## Deploy changes
+
+```bash
+pulumi up
+pulumi up --diff
+pulumi up --plan <plan-file>
+```
+
+Noninteractive CI usage:
+
+```bash
+pulumi up --yes --non-interactive
+```
+
+> [!WARNING]
+> Do not use `--yes` interactively as a convenience flag. It removes the final confirmation barrier and is primarily intended for controlled automation.
+
+Target a specific resource only for exceptional recovery or migration work:
+
+```bash
+pulumi up --target <resource-urn>
+pulumi up --target-dependents --target <resource-urn>
+```
+
+Targeted updates can leave the stack partially converged. Follow with a full preview and update.
+
+## Refresh and drift
+
+Inspect differences between Pulumi state and the provider:
+
+```bash
+pulumi refresh --preview-only
+pulumi preview --refresh
+```
+
+Reconcile Pulumi state with the provider:
+
+```bash
+pulumi refresh
+```
+
+> [!WARNING]
+> `pulumi refresh` changes Pulumi state to match the provider. Review the preview carefully so that accidental out-of-band changes are not silently accepted.
+
+## Import existing resources
+
+Interactive import:
+
+```bash
+pulumi import
+```
+
+Import one resource:
+
+```bash
+pulumi import <type-token> <logical-name> <provider-resource-id>
+```
+
+Generate an import file, review it, and then run:
+
+```bash
+pulumi import --file <import-file.json>
+```
+
+After import, add the generated resource definition to the Pulumi program and run `pulumi preview` to ensure there is no replacement or unexpected update.
+
+## State backup and recovery
+
+Export state before manual state work:
+
+```bash
+pulumi stack export --file <stack>-backup.json
+```
+
+Restore a reviewed export:
+
+```bash
+pulumi stack import --file <stack>-backup.json
+```
+
+Inspect state operations:
+
+```bash
+pulumi state --help
+pulumi state delete <resource-urn>
+pulumi state unprotect <resource-urn>
+pulumi state repair
+```
+
+> [!CAUTION]
+> State commands bypass normal resource lifecycle behavior. Export a backup first, understand the resource dependencies, and use them only for recovery or carefully planned migrations.
+
+## Resource protection
+
+Resources created with the `protect` option cannot be deleted until protection is removed. For an emergency state-only change:
+
+```bash
+pulumi state unprotect <resource-urn>
+```
+
+Prefer changing the program and deploying normally when possible.
+
+## Logs and troubleshooting
+
+```bash
+pulumi logs
+pulumi logs --follow
+pulumi about
+pulumi plugin ls
+pulumi install
+pulumi stack history
+pulumi cancel
+```
+
+Use `pulumi cancel` only when an update is stuck and no active engine process should continue. A canceled update may require `pulumi refresh` or state repair.
+
+Enable diagnostic verbosity temporarily:
+
+```bash
+pulumi preview --logtostderr -v=3
+```
+
+Higher verbosity can expose provider requests or sensitive values. Sanitize logs before sharing them.
+
+## Destroy and remove a stack
+
+Preview destruction:
+
+```bash
+pulumi destroy --preview-only
+```
+
+Destroy managed resources:
+
+```bash
+pulumi destroy
+```
+
+Remove the empty stack record:
+
+```bash
+pulumi stack rm <stack>
+```
+
+> [!DANGER]
+> `pulumi destroy` deletes managed infrastructure. Verify the selected stack and cloud identity, inspect protected resources, confirm backups, and understand retained external dependencies before proceeding.
+
+## CI/CD baseline
+
+Typical pull-request validation:
+
+```bash
+pulumi preview --non-interactive --diff
+```
+
+Typical controlled deployment:
+
+```bash
+pulumi stack select <organization>/<project>/<stack>
+pulumi up --yes --non-interactive
+```
+
+Recommended controls:
+
+- use short-lived federated cloud credentials;
+- scope the Pulumi access token to the required organization and environment;
+- serialize updates to the same stack;
+- require preview review or policy checks for production;
+- avoid printing secret outputs;
+- retain update history and deployment logs;
+- run a post-deployment preview or health check.
+
+## References
+
+- [Pulumi CLI command reference](https://www.pulumi.com/docs/iac/cli/commands/)
+- [Pulumi stacks](https://www.pulumi.com/docs/iac/concepts/stacks/)
+- [Pulumi configuration](https://www.pulumi.com/docs/iac/concepts/config/)
+- [Pulumi state and backends](https://www.pulumi.com/docs/iac/concepts/state-and-backends/)
+- [Pulumi import](https://www.pulumi.com/docs/iac/adopting-pulumi/import/)

From a68e75907510117eb515cc76e23cc4fefb1fa0de Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:35:39 -0500
Subject: [PATCH 02/26] Add spanning tree cheat sheet

---
 spanning-tree.md | 393 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 393 insertions(+)
 create mode 100644 spanning-tree.md

diff --git a/spanning-tree.md b/spanning-tree.md
new file mode 100644
index 0000000..5363fba
--- /dev/null
+++ b/spanning-tree.md
@@ -0,0 +1,393 @@
+# Spanning Tree Protocol Cheat Sheet
+
+> **Applies to:** IEEE STP/RSTP/MSTP concepts with Cisco IOS and IOS XE examples
+> **Last reviewed:** 2026-07-14
+
+A practical reference for understanding Layer 2 loop prevention, identifying the root bridge, interpreting port roles and states, and troubleshooting common spanning-tree failures.
+
+> [!WARNING]
+> Spanning-tree changes can move the root bridge, reconverge many VLANs, or create a Layer 2 loop. Capture the current topology and verify the intended root, alternate paths, PortFast scope, and rollback plan before changing production switches.
+
+## Why spanning tree exists
+
+Redundant Layer 2 links are useful for availability, but Ethernet frames do not contain a hop limit. An active Layer 2 loop can cause broadcast storms, duplicate frames, MAC-address-table instability, and severe control-plane load.
+
+Spanning Tree Protocol (STP) exchanges Bridge Protocol Data Units (BPDUs), elects a root bridge, calculates a loop-free tree, and places redundant paths into a nonforwarding role until they are needed.
+
+## Common variants
+
+| Variant | Purpose |
+|---|---|
+| STP | Original slow-converging spanning tree behavior |
+| RSTP | Rapid convergence using alternate and backup port roles |
+| PVST+ | Cisco per-VLAN spanning tree implementation |
+| Rapid PVST+ | Cisco rapid per-VLAN implementation |
+| MSTP | Maps many VLANs into a smaller number of spanning-tree instances |
+
+Do not assume every vendor implements the same defaults or per-VLAN behavior. Verify the operating mode and interoperability requirements on every switch family.
+
+## Election logic
+
+### Root bridge
+
+The switch with the lowest Bridge ID becomes the root bridge.
+
+Bridge ID selection is based on:
+
+1. lowest bridge priority;
+2. lowest system ID extension or VLAN identifier where applicable;
+3. lowest switch MAC address.
+
+A lower numerical value wins.
+
+### Root port
+
+Each nonroot switch selects one root port: the port with the best path toward the root bridge.
+
+Selection commonly considers:
+
+1. lowest root path cost;
+2. lowest upstream bridge ID;
+3. lowest upstream port priority;
+4. lowest upstream port number.
+
+### Designated port
+
+Each Layer 2 segment selects one designated port that provides the best path toward the root. Other redundant ports become alternate, backup, or blocking/discarding depending on the mode.
+
+## Port roles
+
+| Role | Meaning |
+|---|---|
+| Root | Best path from a nonroot switch to the root bridge |
+| Designated | Forwarding port selected for a segment |
+| Alternate | Backup path to the root in RSTP/MSTP |
+| Backup | Backup path to the same shared segment |
+| Disabled | Administratively or operationally unavailable |
+
+## Port states
+
+### Classic STP
+
+| State | Behavior |
+|---|---|
+| Blocking | Receives BPDUs but does not forward user traffic |
+| Listening | Participates in topology calculation |
+| Learning | Learns source MAC addresses but does not forward user traffic |
+| Forwarding | Learns and forwards traffic |
+| Disabled | Does not participate |
+
+### RSTP and MSTP
+
+| State | Behavior |
+|---|---|
+| Discarding | Combines classic blocking, listening, and disabled behavior |
+| Learning | Learns source MAC addresses |
+| Forwarding | Learns and forwards traffic |
+
+## Inspect the current topology
+
+```text
+show spanning-tree
+show spanning-tree summary
+show spanning-tree root
+show spanning-tree vlan <vlan-id>
+show spanning-tree vlan <vlan-id> detail
+show spanning-tree interface <interface> detail
+show interfaces <interface> status
+show interfaces <interface> counters errors
+show mac address-table dynamic
+show logging
+```
+
+Questions to answer before changing anything:
+
+- Which switch is root for each VLAN or MST instance?
+- Is the root located where the design expects it?
+- Which ports are root, designated, and alternate?
+- Are BPDUs increasing on the expected links?
+- Are blocked links actually receiving BPDUs?
+- Are speed, duplex, VLAN, and trunk settings consistent on both ends?
+- Did the topology recently reconverge?
+
+## Select the root bridge
+
+Inspect first:
+
+```text
+show spanning-tree root
+show spanning-tree vlan <vlan-id>
+```
+
+Cisco root-primary and root-secondary macros:
+
+```text
+spanning-tree vlan <vlan-list> root primary
+spanning-tree vlan <vlan-list> root secondary
+```
+
+Set priority explicitly when deterministic values are required:
+
+```text
+spanning-tree vlan <vlan-list> priority <priority>
+```
+
+Bridge priority is normally configured in increments supported by the platform, commonly increments of 4096.
+
+> [!CAUTION]
+> Do not allow access-layer switches to win root election by accident. Place the primary and secondary root near the Layer 3 gateway or according to the intended traffic path.
+
+## Port cost and port priority
+
+Inspect the current decision:
+
+```text
+show spanning-tree vlan <vlan-id>
+show spanning-tree interface <interface> detail
+```
+
+Influence path selection only when the physical design and failure behavior are understood:
+
+```text
+interface <interface>
+ spanning-tree vlan <vlan-list> cost <cost>
+ spanning-tree vlan <vlan-list> port-priority <priority>
+```
+
+Prefer root placement and sound topology design over aggressive timer tuning.
+
+## PortFast and edge ports
+
+PortFast allows an endpoint-facing port to move rapidly to forwarding instead of waiting through normal convergence stages.
+
+```text
+interface <interface>
+ spanning-tree portfast
+```
+
+For a trunk connected only to a trusted endpoint such as a hypervisor or server:
+
+```text
+interface <interface>
+ spanning-tree portfast trunk
+```
+
+> [!DANGER]
+> Do not enable PortFast on links to switches, bridges, hubs, or unknown downstream devices. A redundant connection can transition immediately to forwarding and create a loop.
+
+## BPDU Guard
+
+BPDU Guard protects edge ports by placing a port into an error-disabled state if it receives a BPDU.
+
+Global default for PortFast-enabled ports:
+
+```text
+spanning-tree portfast edge bpduguard default
+```
+
+Interface configuration on platforms using classic syntax:
+
+```text
+interface <interface>
+ spanning-tree bpduguard enable
+```
+
+Verify:
+
+```text
+show spanning-tree summary
+show errdisable recovery
+show interfaces status err-disabled
+show logging
+```
+
+Investigate the downstream device and cabling before recovering the port.
+
+## Root Guard
+
+Root Guard prevents a downstream-facing port from accepting superior BPDUs and becoming the path to a new root bridge.
+
+```text
+interface <interface>
+ spanning-tree guard root
+```
+
+Use Root Guard where a downstream switch must never become root. Do not use it on a port that may legitimately become a root port after a failure.
+
+## Loop Guard
+
+Loop Guard helps prevent a non-designated port from moving to forwarding when BPDUs unexpectedly stop arriving.
+
+```text
+interface <interface>
+ spanning-tree guard loop
+```
+
+Loop Guard is commonly useful on point-to-point switch links. Validate platform interaction with Unidirectional Link Detection (UDLD), EtherChannel, and the selected spanning-tree mode.
+
+## BPDU Filter
+
+BPDU Filter suppresses BPDU transmission or processing depending on how and where it is configured.
+
+> [!DANGER]
+> BPDU Filter can effectively remove spanning-tree protection and create silent loops. Avoid interface-level BPDU filtering unless the design specifically requires it and the consequences are fully understood.
+
+## Rapid PVST+ example
+
+Inspect current mode:
+
+```text
+show spanning-tree summary
+```
+
+Configure Rapid PVST+:
+
+```text
+spanning-tree mode rapid-pvst
+```
+
+Verify every participating switch supports the intended mode and interoperability behavior before changing a production domain.
+
+## MSTP concepts
+
+Multiple Spanning Tree Protocol maps VLANs to instances. Switches are in the same MST region only when their configuration identity matches, including:
+
+- region name;
+- revision number;
+- VLAN-to-instance mapping.
+
+Example:
+
+```text
+spanning-tree mode mst
+spanning-tree mst configuration
+ name <region-name>
+ revision <revision>
+ instance <instance-id> vlan <vlan-list>
+ exit
+```
+
+Verify:
+
+```text
+show spanning-tree mst configuration
+show spanning-tree mst
+show spanning-tree mst <instance-id>
+```
+
+A mapping mismatch creates an MST region boundary even when the physical switches are adjacent.
+
+## EtherChannel interaction
+
+Spanning tree should treat a correctly formed EtherChannel as one logical link.
+
+```text
+show etherchannel summary
+show interfaces port-channel <number>
+show spanning-tree interface port-channel <number> detail
+```
+
+Member links must have consistent trunking, native VLAN, allowed VLANs, speed, duplex, and channel configuration. A partially formed channel can produce unexpected spanning-tree behavior.
+
+## Troubleshooting workflow
+
+### 1. Confirm the blast radius
+
+```text
+show logging
+show spanning-tree detail
+show processes cpu
+show interfaces counters errors
+```
+
+Look for topology changes, MAC flapping, high CPU, broadcast growth, interface errors, and repeated link transitions.
+
+### 2. Identify the root and blocked paths
+
+```text
+show spanning-tree root
+show spanning-tree vlan <vlan-id>
+```
+
+Compare actual roles against the intended diagram.
+
+### 3. Verify BPDU flow
+
+```text
+show spanning-tree vlan <vlan-id> detail
+show spanning-tree interface <interface> detail
+```
+
+Run the detail command more than once and confirm BPDU counters increase on root, designated, and blocked/alternate links where expected.
+
+### 4. Check the physical link
+
+```text
+show interfaces <interface>
+show interfaces <interface> status
+show interfaces <interface> counters errors
+```
+
+Investigate duplex mismatch, CRC errors, drops, overloaded links, unidirectional failure, optics, cabling, and transceiver alarms.
+
+### 5. Check Layer 2 consistency
+
+```text
+show interfaces trunk
+show vlan brief
+show etherchannel summary
+show running-config interface <interface>
+```
+
+Confirm both ends agree on trunking, native VLAN, allowed VLANs, channel membership, and spanning-tree protections.
+
+### 6. Examine topology changes
+
+```text
+show spanning-tree detail
+show logging | include SPANTREE|LINK|LINEPROTO
+```
+
+Identify the interface generating repeated topology changes rather than treating the root switch as the source of every event.
+
+### 7. Debug only when necessary
+
+```text
+debug spanning-tree events
+debug spanning-tree bpdu
+```
+
+> [!CAUTION]
+> Debug commands can increase control-plane load and generate substantial output. Use logging buffers, limit the duration, and disable debugging after collecting evidence.
+
+## Common failure patterns
+
+| Symptom | Likely checks |
+|---|---|
+| Unexpected root bridge | Bridge priority, new switch, superior BPDUs, Root Guard |
+| Port repeatedly changes state | Link flap, channel mismatch, unstable neighbor, physical errors |
+| Blocked port moves to forwarding | Lost BPDUs, unidirectional link, duplex mismatch, Loop Guard |
+| Access port error-disabled | BPDU Guard, downstream switch, accidental patch loop |
+| High CPU and MAC flapping | Active Layer 2 loop, EtherChannel inconsistency, lost BPDUs |
+| MST boundary appears | Region name, revision, VLAN-to-instance mapping |
+| Slow endpoint connectivity | Missing PortFast on a true endpoint port, authentication timing |
+
+## Design guidance
+
+- Choose the root and secondary root intentionally.
+- Keep the root close to the expected Layer 3 gateway and traffic path.
+- Use routed links instead of large Layer 2 failure domains where practical.
+- Use PortFast only for verified endpoints and pair it with BPDU Guard.
+- Use Root Guard at boundaries where downstream switches must not become root.
+- Use Loop Guard or UDLD where loss of BPDUs or unidirectional links is a concern.
+- Avoid unnecessary spanning-tree timer changes.
+- Keep VLAN and MST instance scope small enough to troubleshoot.
+- Document expected root ports and alternate paths.
+- Test link, switch, and port-channel failures before production rollout.
+
+## References
+
+- [Cisco: Understand and Configure STP on Catalyst Switches](https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/5234-5.html)
+- [Cisco: Troubleshoot STP Problems and Design Considerations](https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10556-16.html)
+- [Cisco: Understand Rapid Spanning Tree Protocol](https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html)
+- [Cisco: Understand Multiple Spanning Tree Protocol](https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24248-147.html)

From 216d6988edc92ab1089c844c31e55aeddec71547 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:36:20 -0500
Subject: [PATCH 03/26] Merge Google Cloud cheat sheets

---
 google-cloud.md | 391 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 391 insertions(+)
 create mode 100644 google-cloud.md

diff --git a/google-cloud.md b/google-cloud.md
new file mode 100644
index 0000000..86905f8
--- /dev/null
+++ b/google-cloud.md
@@ -0,0 +1,391 @@
+# Google Cloud Cheat Sheet
+
+> **Applies to:** Current Google Cloud services and Google Cloud CLI (`gcloud`)
+> **Last reviewed:** 2026-07-14
+
+A practical reference for Google Cloud resource hierarchy, common services, authentication, Compute Engine, Google Kubernetes Engine, Cloud Storage, IAM, and VPC networking.
+
+> [!WARNING]
+> Verify the active account, project, region, and zone before changing resources. Google Cloud commands often succeed against whichever project is currently selected, even when it is not the project you intended.
+
+## Resource hierarchy and scope
+
+| Scope | Purpose |
+|---|---|
+| Organization | Top-level administrative boundary for a company or domain |
+| Folder | Optional grouping for departments, environments, or policy boundaries |
+| Project | Primary billing, API, IAM, quota, and resource-management boundary |
+| Region | Geographic area containing multiple zones |
+| Zone | Deployment location within a region |
+
+Projects have both a human-readable project ID and an internal project number. Many APIs and IAM relationships use one or the other, so verify which value a command expects.
+
+## Common services
+
+| Area | Services |
+|---|---|
+| Compute | Compute Engine, Cloud Run, App Engine, Cloud Functions |
+| Containers | Google Kubernetes Engine (GKE), Artifact Registry |
+| Storage | Cloud Storage, Persistent Disk, Filestore |
+| Databases | Cloud SQL, Spanner, Firestore, Bigtable, Memorystore |
+| Data and analytics | BigQuery, Dataflow, Dataproc, Pub/Sub |
+| Networking | VPC, Cloud Load Balancing, Cloud NAT, Cloud DNS, Cloud CDN, Cloud VPN, Cloud Interconnect |
+| Security | IAM, Secret Manager, Cloud KMS, Security Command Center |
+| Operations | Cloud Logging, Cloud Monitoring, Error Reporting, Trace |
+| Build and delivery | Cloud Build, Cloud Deploy, Artifact Registry |
+
+## CLI setup and identity
+
+```bash
+gcloud version
+gcloud init
+gcloud auth login
+gcloud auth list
+gcloud config configurations list
+gcloud config list
+gcloud projects list
+```
+
+Show the active account and project:
+
+```bash
+gcloud auth list --filter=status:ACTIVE
+gcloud config get-value project
+gcloud config get-value compute/region
+gcloud config get-value compute/zone
+```
+
+Set defaults:
+
+```bash
+gcloud config set project <project-id>
+gcloud config set compute/region <region>
+gcloud config set compute/zone <zone>
+```
+
+Use named configurations to separate environments or identities:
+
+```bash
+gcloud config configurations create <configuration-name>
+gcloud config configurations activate <configuration-name>
+gcloud config configurations describe <configuration-name>
+gcloud config configurations delete <configuration-name>
+```
+
+## Application Default Credentials
+
+Local user credentials for client libraries:
+
+```bash
+gcloud auth application-default login
+```
+
+Inspect the Application Default Credentials environment:
+
+```bash
+gcloud auth application-default print-access-token
+```
+
+> [!WARNING]
+> `gcloud auth login` credentials and Application Default Credentials are separate. Do not assume that authenticating the CLI also configures every SDK or application.
+
+Prefer workload identity, Workload Identity Federation, or service-account impersonation for automation instead of downloading long-lived service-account keys.
+
+## Service-account impersonation
+
+Print a short-lived access token:
+
+```bash
+gcloud auth print-access-token \
+  --impersonate-service-account=<service-account-email>
+```
+
+Set impersonation for the active CLI configuration:
+
+```bash
+gcloud config set auth/impersonate_service_account <service-account-email>
+gcloud config unset auth/impersonate_service_account
+```
+
+Verify the effective identity by testing a read-only command against the intended project before making changes.
+
+## Enable and inspect APIs
+
+```bash
+gcloud services list --enabled
+gcloud services list --available
+gcloud services enable <service-name>.googleapis.com
+gcloud services disable <service-name>.googleapis.com
+```
+
+> [!CAUTION]
+> Disabling an API can interrupt dependent workloads or management operations. Identify active resources and dependencies first.
+
+## Compute Engine
+
+Inspect instances:
+
+```bash
+gcloud compute instances list
+gcloud compute instances describe <instance> --zone=<zone>
+gcloud compute machine-types list --zones=<zone>
+```
+
+Create and access an instance:
+
+```bash
+gcloud compute instances create <instance> \
+  --zone=<zone> \
+  --machine-type=<machine-type> \
+  --image-family=debian-12 \
+  --image-project=debian-cloud
+
+gcloud compute ssh <instance> --zone=<zone>
+```
+
+Lifecycle operations:
+
+```bash
+gcloud compute instances stop <instance> --zone=<zone>
+gcloud compute instances start <instance> --zone=<zone>
+gcloud compute instances reset <instance> --zone=<zone>
+gcloud compute instances delete <instance> --zone=<zone>
+```
+
+> [!DANGER]
+> Deleting an instance can also delete attached disks when their auto-delete setting is enabled. Inspect disk attachments and backup requirements first.
+
+## Google Kubernetes Engine
+
+```bash
+gcloud container clusters list
+gcloud container clusters describe <cluster> --location=<region-or-zone>
+gcloud container clusters get-credentials <cluster> \
+  --location=<region-or-zone>
+```
+
+Create and resize a cluster:
+
+```bash
+gcloud container clusters create <cluster> \
+  --location=<region-or-zone> \
+  --num-nodes=<count>
+
+gcloud container clusters resize <cluster> \
+  --location=<region-or-zone> \
+  --num-nodes=<count>
+```
+
+Inspect available upgrades:
+
+```bash
+gcloud container get-server-config --location=<region-or-zone>
+gcloud container clusters describe <cluster> \
+  --location=<region-or-zone> \
+  --format='yaml(currentMasterVersion,currentNodeVersion,releaseChannel)'
+```
+
+Delete a cluster:
+
+```bash
+gcloud container clusters delete <cluster> \
+  --location=<region-or-zone>
+```
+
+> [!DANGER]
+> Cluster deletion removes the Kubernetes control plane and node pools. Confirm persistent-volume retention, load balancers, DNS, and external dependencies first.
+
+## Cloud Storage
+
+Use `gcloud storage` for new scripts:
+
+```bash
+gcloud storage buckets list
+gcloud storage buckets describe gs://<bucket>
+gcloud storage buckets create gs://<bucket> --location=<location>
+gcloud storage ls gs://<bucket>
+gcloud storage cp <local-file> gs://<bucket>/<object>
+gcloud storage cp gs://<bucket>/<object> <local-path>
+gcloud storage rsync --recursive <local-directory> gs://<bucket>/<prefix>
+gcloud storage rm gs://<bucket>/<object>
+```
+
+Inspect object versions and retention before bulk deletion:
+
+```bash
+gcloud storage ls --all-versions gs://<bucket>/<prefix>
+gcloud storage buckets describe gs://<bucket> \
+  --format='yaml(versioning,retentionPolicy,lifecycle)'
+```
+
+`gsutil` remains available for compatibility, but new automation should generally use `gcloud storage` unless a required feature is unavailable.
+
+## IAM and service accounts
+
+```bash
+gcloud iam roles list
+gcloud iam service-accounts list
+gcloud iam service-accounts describe <service-account-email>
+gcloud iam service-accounts create <name> \
+  --display-name='<display-name>'
+```
+
+Inspect project policy:
+
+```bash
+gcloud projects get-iam-policy <project-id>
+gcloud projects get-iam-policy <project-id> \
+  --format='table(bindings.role,bindings.members)'
+```
+
+Add or remove a binding:
+
+```bash
+gcloud projects add-iam-policy-binding <project-id> \
+  --member='serviceAccount:<service-account-email>' \
+  --role='roles/<role>'
+
+gcloud projects remove-iam-policy-binding <project-id> \
+  --member='serviceAccount:<service-account-email>' \
+  --role='roles/<role>'
+```
+
+Avoid broad primitive roles such as Owner, Editor, and Viewer for routine access. Prefer predefined or custom roles with the minimum permissions required.
+
+## VPC networking
+
+List and inspect networks:
+
+```bash
+gcloud compute networks list
+gcloud compute networks describe <network>
+gcloud compute networks subnets list
+gcloud compute routes list --filter='network:<network>'
+```
+
+Create a custom-mode VPC and subnet:
+
+```bash
+gcloud compute networks create <network> --subnet-mode=custom
+
+gcloud compute networks subnets create <subnet> \
+  --network=<network> \
+  --region=<region> \
+  --range=<cidr>
+```
+
+Firewall policy inspection:
+
+```bash
+gcloud compute firewall-rules list
+gcloud compute firewall-rules describe <rule>
+```
+
+Create an ingress rule:
+
+```bash
+gcloud compute firewall-rules create <rule> \
+  --network=<network> \
+  --direction=INGRESS \
+  --action=ALLOW \
+  --rules=tcp:<port> \
+  --source-ranges=<cidr> \
+  --target-tags=<network-tag>
+```
+
+Avoid `0.0.0.0/0` and `::/0` unless public exposure is explicitly required and protected by additional controls.
+
+## Cloud Run
+
+```bash
+gcloud run services list --region=<region>
+gcloud run services describe <service> --region=<region>
+gcloud run deploy <service> \
+  --image=<registry>/<project>/<repository>/<image>:<tag> \
+  --region=<region>
+gcloud run services update-traffic <service> \
+  --to-latest \
+  --region=<region>
+```
+
+Inspect IAM before enabling unauthenticated access.
+
+## Cloud SQL
+
+```bash
+gcloud sql instances list
+gcloud sql instances describe <instance>
+gcloud sql databases list --instance=<instance>
+gcloud sql users list --instance=<instance>
+gcloud sql backups list --instance=<instance>
+```
+
+Delete only after confirming final backups and dependent applications:
+
+```bash
+gcloud sql instances delete <instance>
+```
+
+## Logging and monitoring
+
+```bash
+gcloud logging logs list
+gcloud logging read '<filter>' --limit=<count> --freshness=<duration>
+gcloud monitoring policies list
+gcloud monitoring channels list
+```
+
+Examples:
+
+```bash
+gcloud logging read \
+  'resource.type="gce_instance" severity>=ERROR' \
+  --limit=50 \
+  --freshness=1h
+```
+
+## Output formatting and filtering
+
+```bash
+gcloud <group> <command> --help
+gcloud topic filters
+gcloud topic formats
+gcloud info
+```
+
+Useful formats:
+
+```bash
+gcloud compute instances list --format='table(name,zone.basename(),status)'
+gcloud projects list --format='value(projectId)'
+gcloud compute instances list --filter='status=RUNNING'
+```
+
+## Troubleshooting checklist
+
+1. Verify active identity with `gcloud auth list`.
+2. Verify project, region, and zone with `gcloud config list`.
+3. Confirm the required API is enabled.
+4. Check IAM permissions and organization policies.
+5. Confirm quota and regional capacity.
+6. Use `--verbosity=info` or `--verbosity=debug` temporarily.
+7. Inspect Cloud Audit Logs for denied or changed operations.
+8. Compare the command's fully expanded resource scope with the intended target.
+
+```bash
+gcloud info
+gcloud config list
+gcloud services list --enabled
+gcloud projects get-iam-policy <project-id>
+gcloud logging read 'protoPayload.status.code!=0' --limit=50
+```
+
+Debug output can contain request details and identifiers. Sanitize it before sharing.
+
+## References
+
+- [Google Cloud CLI reference](https://cloud.google.com/sdk/gcloud/reference)
+- [Authenticate for the Google Cloud CLI](https://cloud.google.com/sdk/docs/authorizing)
+- [Google Cloud products and services](https://cloud.google.com/products)
+- [Cloud Storage with the gcloud CLI](https://cloud.google.com/storage/docs/discover-object-storage-gcloud)
+- [Service-account impersonation](https://cloud.google.com/docs/authentication/use-service-account-impersonation)

From 853e5d1238bfc5a62c1641d6bb00be4f452ad312 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:37:15 -0500
Subject: [PATCH 04/26] Merge AWS cheat sheets

---
 aws.md | 392 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 392 insertions(+)
 create mode 100644 aws.md

diff --git a/aws.md b/aws.md
new file mode 100644
index 0000000..055f6d5
--- /dev/null
+++ b/aws.md
@@ -0,0 +1,392 @@
+# Amazon Web Services Cheat Sheet
+
+> **Applies to:** Current AWS services and AWS CLI version 2
+> **Last reviewed:** 2026-07-14
+
+A practical reference for AWS account identity, IAM Identity Center authentication, common services, EC2, S3, IAM, VPC, Lambda, and RDS.
+
+> [!WARNING]
+> AWS CLI commands act against the credentials, account, region, and profile currently in use. Verify all four before making a change, especially when profiles have similar names across development and production accounts.
+
+## Account and resource model
+
+| Concept | Purpose |
+|---|---|
+| Organization | Multi-account governance and consolidated management |
+| Account | Primary security, billing, quota, and resource-isolation boundary |
+| Region | Geographic deployment area containing multiple Availability Zones |
+| Availability Zone | Isolated location within a Region |
+| ARN | Amazon Resource Name that uniquely identifies a resource |
+| Tag | Key-value metadata used for ownership, cost, policy, and automation |
+
+Use multiple accounts to separate environments and security boundaries rather than placing every workload into one account.
+
+## Common services
+
+| Area | Services |
+|---|---|
+| Compute | EC2, Lambda, ECS, EKS, Fargate, Elastic Beanstalk |
+| Storage | S3, EBS, EFS, FSx, S3 Glacier storage classes |
+| Databases | RDS, Aurora, DynamoDB, ElastiCache, Redshift |
+| Networking | VPC, Elastic Load Balancing, Route 53, CloudFront, Transit Gateway, Direct Connect, Site-to-Site VPN |
+| Security | IAM, IAM Identity Center, KMS, Secrets Manager, GuardDuty, Security Hub, WAF |
+| Operations | CloudWatch, CloudTrail, AWS Config, Systems Manager |
+| Integration | SQS, SNS, EventBridge, Step Functions, API Gateway |
+| Infrastructure as code | CloudFormation, AWS CDK, Service Catalog |
+
+## CLI setup and version
+
+```bash
+aws --version
+aws configure list
+aws configure list-profiles
+aws configure get region --profile <profile>
+```
+
+Use named profiles instead of repeatedly overwriting the default profile.
+
+## IAM Identity Center authentication
+
+Configure a profile using the interactive wizard:
+
+```bash
+aws configure sso
+```
+
+Sign in and verify identity:
+
+```bash
+aws sso login --profile <profile>
+aws sts get-caller-identity --profile <profile>
+```
+
+Sign out of cached IAM Identity Center sessions:
+
+```bash
+aws sso logout
+```
+
+AWS CLI version 2 uses browser-based Proof Key for Code Exchange by default on current releases. Use device authorization only where required:
+
+```bash
+aws sso login --profile <profile> --use-device-code
+```
+
+Prefer IAM Identity Center, role assumption, workload identity, and other short-lived credentials over long-lived IAM user access keys.
+
+## Verify identity before every change
+
+```bash
+aws sts get-caller-identity --profile <profile>
+aws configure get region --profile <profile>
+```
+
+A useful shell pattern:
+
+```bash
+export AWS_PROFILE=<profile>
+export AWS_REGION=<region>
+aws sts get-caller-identity
+```
+
+> [!CAUTION]
+> Environment variables override profile-file settings in many AWS SDK and CLI scenarios. Inspect `AWS_PROFILE`, `AWS_REGION`, `AWS_DEFAULT_REGION`, and credential variables when behavior is unexpected.
+
+## Output, queries, and pagination
+
+```bash
+aws <service> <operation> help
+aws <service> <operation> --output json
+aws <service> <operation> --output table
+aws <service> <operation> --query '<jmespath-expression>'
+aws <service> <operation> --no-cli-pager
+```
+
+Example:
+
+```bash
+aws ec2 describe-instances \
+  --query 'Reservations[].Instances[].{Name:Tags[?Key==`Name`]|[0].Value,ID:InstanceId,State:State.Name,AZ:Placement.AvailabilityZone}' \
+  --output table
+```
+
+Do not use `--no-paginate` on large inventories unless you understand the resulting API and output volume.
+
+## Amazon S3
+
+List buckets and objects:
+
+```bash
+aws s3 ls
+aws s3 ls s3://<bucket>/<prefix>/
+aws s3api get-bucket-location --bucket <bucket>
+aws s3api get-bucket-versioning --bucket <bucket>
+aws s3api get-object-lock-configuration --bucket <bucket>
+```
+
+Copy and synchronize data:
+
+```bash
+aws s3 cp <local-file> s3://<bucket>/<object>
+aws s3 cp s3://<bucket>/<object> <local-path>
+aws s3 sync <local-directory>/ s3://<bucket>/<prefix>/
+aws s3 sync s3://<bucket>/<prefix>/ <local-directory>/
+```
+
+Preview a sync that would delete destination objects:
+
+```bash
+aws s3 sync <source> <destination> --delete --dryrun
+```
+
+> [!DANGER]
+> `aws s3 sync --delete` removes objects from the destination that are absent from the source. Always run with `--dryrun`, inspect versioning and retention, and confirm the direction of the sync.
+
+Create a bucket with region-appropriate configuration:
+
+```bash
+aws s3api create-bucket \
+  --bucket <globally-unique-bucket-name> \
+  --region <region> \
+  --create-bucket-configuration LocationConstraint=<region>
+```
+
+The `us-east-1` API has special create-bucket behavior; verify the current command reference when automating bucket creation across Regions.
+
+## Amazon EC2
+
+Inventory:
+
+```bash
+aws ec2 describe-instances
+aws ec2 describe-instances --instance-ids <instance-id>
+aws ec2 describe-instance-status --include-all-instances
+aws ec2 describe-volumes --filters Name=attachment.instance-id,Values=<instance-id>
+aws ec2 describe-security-groups --group-ids <security-group-id>
+```
+
+Lifecycle operations:
+
+```bash
+aws ec2 stop-instances --instance-ids <instance-id>
+aws ec2 start-instances --instance-ids <instance-id>
+aws ec2 reboot-instances --instance-ids <instance-id>
+```
+
+Terminate only after inspecting attached storage and termination protection:
+
+```bash
+aws ec2 describe-instance-attribute \
+  --instance-id <instance-id> \
+  --attribute disableApiTermination
+
+aws ec2 terminate-instances --instance-ids <instance-id>
+```
+
+> [!DANGER]
+> Instance termination can delete EBS volumes whose `DeleteOnTermination` flag is enabled. Confirm snapshots, data ownership, Auto Scaling behavior, and replacement dependencies first.
+
+## Systems Manager Session Manager
+
+List managed instances and start a session:
+
+```bash
+aws ssm describe-instance-information
+aws ssm start-session --target <instance-id>
+```
+
+Session Manager can reduce the need for inbound SSH exposure when the instance, IAM role, agent, and network path are correctly configured.
+
+## IAM
+
+Read-only inspection:
+
+```bash
+aws iam list-users
+aws iam list-roles
+aws iam get-role --role-name <role-name>
+aws iam list-attached-role-policies --role-name <role-name>
+aws iam list-role-policies --role-name <role-name>
+aws iam get-account-authorization-details
+```
+
+Simulate a principal policy where permissions allow it:
+
+```bash
+aws iam simulate-principal-policy \
+  --policy-source-arn <principal-arn> \
+  --action-names <service:Action>
+```
+
+Avoid creating IAM users for applications. Use roles and temporary credentials. For human access, prefer IAM Identity Center.
+
+## Role assumption
+
+```bash
+aws sts assume-role \
+  --role-arn <role-arn> \
+  --role-session-name <session-name>
+```
+
+The command returns temporary credentials. Prefer profile-based role configuration, credential processes, or workload federation over manually exporting tokens.
+
+## VPC networking
+
+Inventory:
+
+```bash
+aws ec2 describe-vpcs
+aws ec2 describe-subnets
+aws ec2 describe-route-tables
+aws ec2 describe-internet-gateways
+aws ec2 describe-nat-gateways
+aws ec2 describe-network-acls
+aws ec2 describe-security-groups
+aws ec2 describe-vpc-endpoints
+```
+
+Create a VPC and subnet:
+
+```bash
+aws ec2 create-vpc --cidr-block <cidr>
+aws ec2 create-subnet \
+  --vpc-id <vpc-id> \
+  --cidr-block <cidr> \
+  --availability-zone <availability-zone>
+```
+
+Create and attach an internet gateway:
+
+```bash
+aws ec2 create-internet-gateway
+aws ec2 attach-internet-gateway \
+  --internet-gateway-id <internet-gateway-id> \
+  --vpc-id <vpc-id>
+```
+
+Security-group inspection:
+
+```bash
+aws ec2 describe-security-group-rules \
+  --filters Name=group-id,Values=<security-group-id>
+```
+
+Avoid broad inbound access from `0.0.0.0/0` or `::/0` unless public exposure is explicitly required and protected by additional controls.
+
+## Elastic Load Balancing
+
+```bash
+aws elbv2 describe-load-balancers
+aws elbv2 describe-listeners --load-balancer-arn <load-balancer-arn>
+aws elbv2 describe-target-groups
+aws elbv2 describe-target-health --target-group-arn <target-group-arn>
+```
+
+Target health often provides the fastest explanation for an apparently healthy load balancer that is not serving traffic.
+
+## AWS Lambda
+
+```bash
+aws lambda list-functions
+aws lambda get-function --function-name <function-name>
+aws lambda get-function-configuration --function-name <function-name>
+aws lambda list-versions-by-function --function-name <function-name>
+aws lambda list-event-source-mappings --function-name <function-name>
+```
+
+Invoke a function:
+
+```bash
+aws lambda invoke \
+  --function-name <function-name> \
+  --cli-binary-format raw-in-base64-out \
+  --payload '<json-payload>' \
+  <output-file>
+```
+
+Update code only after confirming the deployment package, architecture, runtime, alias, and rollback version:
+
+```bash
+aws lambda update-function-code \
+  --function-name <function-name> \
+  --zip-file fileb://<archive.zip> \
+  --publish
+```
+
+## Amazon RDS
+
+```bash
+aws rds describe-db-instances
+aws rds describe-db-clusters
+aws rds describe-db-snapshots
+aws rds describe-events --source-type db-instance --duration 1440
+```
+
+Create a manual snapshot:
+
+```bash
+aws rds create-db-snapshot \
+  --db-instance-identifier <db-instance-id> \
+  --db-snapshot-identifier <snapshot-id>
+```
+
+Delete an instance with a final snapshot:
+
+```bash
+aws rds delete-db-instance \
+  --db-instance-identifier <db-instance-id> \
+  --final-db-snapshot-identifier <final-snapshot-id>
+```
+
+> [!DANGER]
+> Avoid `--skip-final-snapshot` unless data destruction is explicitly approved and recoverability is not required. Check deletion protection, replicas, cluster membership, and application dependencies.
+
+## CloudWatch and CloudTrail
+
+```bash
+aws cloudwatch list-metrics --namespace <namespace>
+aws cloudwatch describe-alarms
+aws logs describe-log-groups
+aws logs tail <log-group-name> --since 1h --follow
+aws cloudtrail lookup-events --max-results 50
+```
+
+CloudTrail lookup is useful for recent management events but does not replace a properly configured organization trail or event data store.
+
+## Tagging and inventory
+
+```bash
+aws resourcegroupstaggingapi get-resources
+aws resourcegroupstaggingapi get-resources \
+  --tag-filters Key=<key>,Values=<value>
+```
+
+Tagging should support ownership, environment, application, cost allocation, data classification, and lifecycle automation.
+
+## Troubleshooting checklist
+
+1. Run `aws sts get-caller-identity`.
+2. Confirm profile and Region.
+3. Check whether environment variables override profile settings.
+4. Verify the exact ARN and resource Region.
+5. Check IAM policies, permission boundaries, service control policies, and resource policies.
+6. Confirm quotas and service availability.
+7. Inspect CloudTrail and service events.
+8. Retry with `--debug` only long enough to collect evidence.
+
+```bash
+aws sts get-caller-identity
+aws configure list
+aws configure list-profiles
+env | grep '^AWS_'
+```
+
+Debug logs can contain request metadata, account identifiers, endpoints, and signed-request details. Sanitize them before sharing.
+
+## References
+
+- [AWS CLI version 2 user guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html)
+- [IAM Identity Center authentication with AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html)
+- [AWS CLI command reference](https://docs.aws.amazon.com/cli/latest/reference/)
+- [STS get-caller-identity](https://docs.aws.amazon.com/cli/latest/reference/sts/get-caller-identity.html)
+- [AWS services by category](https://aws.amazon.com/products/)

From 873fa63bca24947a5b5d28a7f930b34c323432aa Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:37:47 -0500
Subject: [PATCH 05/26] Rename and modernize Git cheat sheet

---
 git.md | 335 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 335 insertions(+)
 create mode 100644 git.md

diff --git a/git.md b/git.md
new file mode 100644
index 0000000..716a804
--- /dev/null
+++ b/git.md
@@ -0,0 +1,335 @@
+# Git Cheat Sheet
+
+> **Applies to:** Current Git command-line workflows
+> **Last reviewed:** 2026-07-14
+
+A practical reference for repository setup, branches, commits, remotes, inspection, undo operations, rebasing, and recovery.
+
+> [!WARNING]
+> Commands such as `reset --hard`, `clean`, forced pushes, and branch deletion can permanently remove uncommitted or unreferenced work. Inspect state and create a backup branch before destructive recovery.
+
+## Identify the current repository state
+
+```bash
+git status --short --branch
+git branch --show-current
+git remote -v
+git log --oneline --decorate --graph -20
+```
+
+## Configure identity
+
+```bash
+git config --global user.name '<name>'
+git config --global user.email '<email>'
+git config --global init.defaultBranch main
+git config --list --show-origin
+```
+
+Use repository-local configuration when work and personal identities differ:
+
+```bash
+git config user.name '<name>'
+git config user.email '<email>'
+```
+
+## Create or clone a repository
+
+```bash
+git init
+git clone <repository-url>
+git clone --branch <branch> <repository-url>
+```
+
+## Inspect changes
+
+```bash
+git status
+git diff
+git diff --staged
+git diff <base>...<head>
+git log --oneline --decorate --graph --all
+git show <commit>
+git blame <file>
+```
+
+## Stage and commit
+
+```bash
+git add <file>
+git add --patch
+git restore --staged <file>
+git commit -m '<message>'
+git commit --amend
+```
+
+Use `git add --patch` to review each hunk and avoid accidentally committing unrelated changes.
+
+## Branches and switching
+
+```bash
+git branch
+git branch --all
+git switch -c <new-branch>
+git switch <branch>
+git switch -
+git branch -d <branch>
+```
+
+Force-delete a local branch only after confirming its commits are preserved elsewhere:
+
+```bash
+git branch -D <branch>
+```
+
+## Remotes
+
+```bash
+git remote -v
+git remote add <name> <url>
+git remote set-url <name> <url>
+git fetch --all --prune
+git remote show origin
+```
+
+## Pull, merge, and push
+
+```bash
+git fetch origin
+git merge origin/<branch>
+git pull --ff-only
+git push -u origin <branch>
+git push
+```
+
+Prefer `git pull --ff-only` when you do not want Git to create an implicit merge commit or rebase.
+
+## Merge a branch
+
+```bash
+git switch <target-branch>
+git fetch origin
+git merge --ff-only origin/<target-branch>
+git merge <source-branch>
+```
+
+Resolve conflicts, stage the resolved files, and complete the merge:
+
+```bash
+git status
+git add <resolved-file>
+git commit
+```
+
+Abort an in-progress merge:
+
+```bash
+git merge --abort
+```
+
+## Rebase
+
+```bash
+git fetch origin
+git rebase origin/main
+git rebase --continue
+git rebase --skip
+git rebase --abort
+```
+
+Interactive cleanup:
+
+```bash
+git rebase -i <base-commit>
+```
+
+> [!CAUTION]
+> Rebase rewrites commit IDs. Avoid rebasing shared branches unless the collaboration workflow explicitly expects it.
+
+## Stash
+
+```bash
+git stash push -m '<description>'
+git stash push --include-untracked -m '<description>'
+git stash list
+git stash show --patch stash@{0}
+git stash apply stash@{0}
+git stash pop
+git stash drop stash@{0}
+```
+
+Use `apply` instead of `pop` when you want to keep the stash until the result is verified.
+
+## Undo uncommitted changes
+
+Restore one file from the index:
+
+```bash
+git restore <file>
+```
+
+Restore both staged and working-tree content from `HEAD`:
+
+```bash
+git restore --source=HEAD --staged --worktree <file>
+```
+
+Remove untracked files only after a dry run:
+
+```bash
+git clean -nd
+git clean -nfd
+git clean -fd
+```
+
+> [!DANGER]
+> `git clean -fd` deletes untracked files and directories. Ignored files require additional flags and can include build artifacts, local configuration, or secrets.
+
+## Undo committed changes safely
+
+Create a new commit that reverses an earlier commit:
+
+```bash
+git revert <commit>
+git revert <oldest-commit>^..<newest-commit>
+```
+
+Revert is generally safer for shared branches because it preserves history.
+
+## Reset local history
+
+Inspect first:
+
+```bash
+git status
+git log --oneline --decorate -10
+git branch backup/<description>
+```
+
+Reset modes:
+
+```bash
+git reset --soft <commit>
+git reset --mixed <commit>
+git reset --hard <commit>
+```
+
+| Mode | Branch pointer | Index | Working tree |
+|---|---|---|---|
+| `--soft` | Moves | Preserved | Preserved |
+| `--mixed` | Moves | Reset | Preserved |
+| `--hard` | Moves | Reset | Reset |
+
+> [!DANGER]
+> `git reset --hard` discards tracked working-tree changes. Create a backup branch and verify the target commit before running it.
+
+## Cherry-pick
+
+```bash
+git cherry-pick <commit>
+git cherry-pick --continue
+git cherry-pick --abort
+```
+
+Apply a commit without immediately committing it:
+
+```bash
+git cherry-pick --no-commit <commit>
+```
+
+## Tags
+
+```bash
+git tag
+git tag -a <tag> -m '<message>'
+git show <tag>
+git push origin <tag>
+git push origin --tags
+```
+
+## Find a regression with bisect
+
+```bash
+git bisect start
+git bisect bad
+git bisect good <known-good-commit>
+```
+
+Test each selected commit and mark it:
+
+```bash
+git bisect good
+git bisect bad
+git bisect reset
+```
+
+Automate with a test command:
+
+```bash
+git bisect run <test-command>
+```
+
+## Recover lost commits
+
+```bash
+git reflog
+git show <reflog-commit>
+git branch recovery/<description> <reflog-commit>
+```
+
+The reflog is local and expires over time. Create a branch as soon as the desired commit is found.
+
+## Submodules
+
+```bash
+git submodule status
+git submodule update --init --recursive
+git submodule sync --recursive
+git clone --recurse-submodules <repository-url>
+```
+
+## Worktrees
+
+```bash
+git worktree list
+git worktree add ../<directory> <branch>
+git worktree add -b <new-branch> ../<directory> <base>
+git worktree remove ../<directory>
+git worktree prune
+```
+
+Worktrees are useful when multiple branches must be checked out simultaneously without repeated stashing.
+
+## Safer force push
+
+```bash
+git fetch origin
+git push --force-with-lease origin <branch>
+```
+
+> [!CAUTION]
+> `--force-with-lease` is safer than `--force`, but it still rewrites remote history. Confirm that the branch is intended to be rewritten and that no collaborator work will be lost.
+
+## Useful aliases
+
+```bash
+git config --global alias.st 'status --short --branch'
+git config --global alias.lg 'log --oneline --decorate --graph --all'
+git config --global alias.unstage 'restore --staged --'
+```
+
+## Troubleshooting checklist
+
+1. Run `git status --short --branch`.
+2. Confirm the current branch and remote.
+3. Fetch before comparing local and remote history.
+4. Inspect staged and unstaged diffs separately.
+5. Use `git reflog` before assuming a commit is lost.
+6. Create a backup branch before reset, rebase, or force-push recovery.
+7. Prefer revert for changes already shared with others.
+
+## References
+
+- [Git documentation](https://git-scm.com/docs)
+- [Pro Git book](https://git-scm.com/book/en/v2)
+- [Git glossary](https://git-scm.com/docs/gitglossary)

From ec86ac4ce730c86fb869d04d6c43b6c7ffd12dca Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:38:32 -0500
Subject: [PATCH 06/26] Rename and modernize Linux boot cheat sheet

---
 linux-boot.md | 331 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 331 insertions(+)
 create mode 100644 linux-boot.md

diff --git a/linux-boot.md b/linux-boot.md
new file mode 100644
index 0000000..0e3492b
--- /dev/null
+++ b/linux-boot.md
@@ -0,0 +1,331 @@
+# Linux Boot and Kernel Cheat Sheet
+
+> **Applies to:** Modern Linux systems using systemd, GRUB, and common distribution tooling
+> **Last reviewed:** 2026-07-14
+
+A practical reference for the Linux boot sequence, kernel command line, initramfs, systemd targets, boot troubleshooting, modules, and recovery.
+
+> [!WARNING]
+> Bootloader, kernel, initramfs, filesystem, and module changes can leave a system unbootable. Preserve a known-good kernel, console access, backups, and a tested recovery path before making changes.
+
+## Boot sequence
+
+1. **Firmware:** BIOS or UEFI initializes hardware and selects a boot entry.
+2. **Bootloader:** GRUB or another bootloader loads the kernel and initramfs.
+3. **Kernel:** The kernel initializes CPU, memory, drivers, and core subsystems.
+4. **Initramfs:** Early userspace discovers storage, unlocks encryption, assembles RAID or LVM, and mounts the real root filesystem.
+5. **PID 1:** The kernel starts the init process, commonly systemd.
+6. **Userspace:** systemd mounts filesystems, starts services, and reaches the configured target.
+
+## Identify the running system
+
+```bash
+uname -a
+uname -r
+cat /etc/os-release
+cat /proc/cmdline
+systemd-detect-virt
+systemctl get-default
+systemctl is-system-running
+```
+
+## Kernel and boot files
+
+```bash
+ls -lh /boot
+ls -lh /boot/efi
+find /boot -maxdepth 1 -type f -printf '%f\n'
+```
+
+Common files:
+
+| File | Purpose |
+|---|---|
+| `vmlinuz-*` | Compressed Linux kernel image |
+| `initrd.img-*` or `initramfs-*` | Early userspace image |
+| `config-*` | Kernel build configuration |
+| `System.map-*` | Kernel symbol map |
+| `/boot/grub/grub.cfg` | Generated GRUB configuration |
+| `/etc/default/grub` | Distribution-level GRUB defaults |
+| `/etc/fstab` | Filesystems and mount behavior |
+
+Do not edit generated `grub.cfg` files directly unless the platform explicitly requires it. Change the source configuration and regenerate the file.
+
+## Kernel command line
+
+Show current parameters:
+
+```bash
+cat /proc/cmdline
+```
+
+Common temporary troubleshooting parameters:
+
+| Parameter | Effect |
+|---|---|
+| `systemd.unit=rescue.target` | Boot into rescue mode |
+| `systemd.unit=emergency.target` | Boot into minimal emergency mode |
+| `rd.break` | Break into initramfs on supported distributions |
+| `nomodeset` | Disable normal graphics mode setting for troubleshooting |
+| `single` or `1` | Request a single-user or rescue-like boot on some systems |
+| `init=/bin/bash` | Start a shell as PID 1; use only for controlled recovery |
+
+> [!CAUTION]
+> Kernel parameters differ by distribution, bootloader, initramfs implementation, and security configuration. Temporary console edits are safer than permanent changes while diagnosing an issue.
+
+## systemd boot targets
+
+```bash
+systemctl list-units --type=target
+systemctl get-default
+systemctl set-default multi-user.target
+systemctl set-default graphical.target
+systemctl isolate rescue.target
+systemctl isolate emergency.target
+```
+
+> [!WARNING]
+> `systemctl isolate` stops units that are not required by the target and can disconnect remote sessions. Use console access for rescue operations.
+
+## Analyze boot performance
+
+```bash
+systemd-analyze
+systemd-analyze blame
+systemd-analyze critical-chain
+systemd-analyze plot > boot.svg
+```
+
+`blame` shows activation time, not necessarily the root cause. Use `critical-chain` and logs to understand ordering and dependency delays.
+
+## Inspect boot logs
+
+Current boot:
+
+```bash
+journalctl -b
+journalctl -b -p warning
+journalctl -b -u <unit>
+dmesg --human
+```
+
+Previous boot:
+
+```bash
+journalctl -b -1
+journalctl -b -1 -p warning
+```
+
+List recorded boots:
+
+```bash
+journalctl --list-boots
+```
+
+If previous boots are unavailable, persistent journal storage may not be enabled.
+
+## Service failures during boot
+
+```bash
+systemctl --failed
+systemctl status <unit>
+journalctl -b -u <unit>
+systemctl show <unit> -p After -p Before -p Requires -p Wants
+systemctl list-dependencies <unit>
+```
+
+Reset a unit's failed state only after collecting evidence:
+
+```bash
+systemctl reset-failed <unit>
+```
+
+## Filesystem and mount failures
+
+```bash
+findmnt
+findmnt --verify
+lsblk -f
+blkid
+cat /etc/fstab
+systemctl --failed --type=mount
+journalctl -b | grep -iE 'mount|filesystem|fsck'
+```
+
+Test an `fstab` change without rebooting:
+
+```bash
+sudo mount -av
+```
+
+> [!CAUTION]
+> `mount -a` can still affect live mount points. Review the exact `fstab` change and use maintenance controls for production systems.
+
+For noncritical network or removable mounts, options such as `nofail`, `_netdev`, or systemd automount behavior may prevent unnecessary boot failure, but they change availability semantics.
+
+## Initramfs inspection and rebuild
+
+Debian and Ubuntu:
+
+```bash
+lsinitramfs /boot/initrd.img-$(uname -r) | less
+sudo update-initramfs -u -k $(uname -r)
+```
+
+RHEL, Fedora, Rocky, and related systems:
+
+```bash
+lsinitrd /boot/initramfs-$(uname -r).img | less
+sudo dracut --force /boot/initramfs-$(uname -r).img $(uname -r)
+```
+
+Rebuild an initramfs when required storage, encryption, filesystem, or early-boot drivers are missing.
+
+> [!WARNING]
+> Confirm the target kernel version and verify free space in `/boot` before rebuilding. Do not overwrite the only known-good boot image without a recovery option.
+
+## GRUB configuration
+
+Inspect defaults:
+
+```bash
+cat /etc/default/grub
+```
+
+Debian and Ubuntu:
+
+```bash
+sudo update-grub
+```
+
+Common RHEL-family BIOS path:
+
+```bash
+sudo grub2-mkconfig -o /boot/grub2/grub.cfg
+```
+
+Common RHEL-family UEFI path varies by distribution and version. Determine the supported generated configuration path before running `grub2-mkconfig`.
+
+List firmware boot entries:
+
+```bash
+sudo efibootmgr -v
+```
+
+## Kernel packages
+
+Debian and Ubuntu:
+
+```bash
+dpkg -l 'linux-image*' | grep '^ii'
+apt list --installed 'linux-image*'
+```
+
+RHEL-family systems:
+
+```bash
+rpm -q kernel
+sudo grubby --default-kernel
+sudo grubby --info=ALL
+```
+
+Keep at least one known-good previous kernel until the new kernel has booted and passed validation.
+
+## Kernel modules
+
+```bash
+lsmod
+modinfo <module>
+sudo modprobe <module>
+sudo modprobe -r <module>
+journalctl -k -b
+dmesg --human | grep -i <module>
+```
+
+Persistent module loading commonly uses files under:
+
+```text
+/etc/modules-load.d/
+```
+
+Module options commonly use:
+
+```text
+/etc/modprobe.d/
+```
+
+> [!CAUTION]
+> Removing storage, network, filesystem, or security modules can interrupt the running system. Inspect module dependencies with `modinfo` and test in a nonproduction environment.
+
+## sysctl runtime settings
+
+```bash
+sysctl -a
+sysctl <key>
+sudo sysctl -w <key>=<value>
+sudo sysctl --system
+```
+
+Persistent settings are commonly stored under:
+
+```text
+/etc/sysctl.conf
+/etc/sysctl.d/*.conf
+```
+
+Capture the old value and understand namespace or container interactions before changing kernel parameters.
+
+## Kernel and hardware information
+
+```bash
+lscpu
+lsmem
+lsblk
+lspci -k
+lsusb
+cat /proc/meminfo
+cat /proc/interrupts
+cat /proc/modules
+```
+
+## Common boot failure patterns
+
+| Symptom | Checks |
+|---|---|
+| Kernel panic: unable to mount root | Root device parameter, initramfs drivers, storage discovery, filesystem support |
+| Emergency mode after mount failure | `/etc/fstab`, UUIDs, filesystem state, network mount dependencies |
+| Boot hangs waiting for a device | Missing disk, incorrect UUID, timeout behavior, encrypted-volume or LVM activation |
+| New kernel does not boot | Select previous kernel, compare initramfs and modules, inspect console logs |
+| Network unavailable after boot | Driver or firmware, predictable interface names, NetworkManager/systemd-networkd status |
+| Service delays boot | `systemd-analyze critical-chain`, unit dependencies, DNS, network-online target |
+| UEFI cannot find bootloader | EFI System Partition, NVRAM entries, Secure Boot, bootloader installation |
+
+## Recovery workflow
+
+1. Photograph or capture the console error.
+2. Try a known-good previous kernel from the bootloader.
+3. Temporarily remove quiet or splash parameters to reveal messages.
+4. Boot into rescue or emergency mode.
+5. Confirm root filesystem, `/boot`, and EFI mounts.
+6. Review the current and previous boot journal.
+7. Validate `fstab`, kernel command line, and initramfs contents.
+8. Rebuild only the affected artifact.
+9. Regenerate the bootloader configuration when required.
+10. Reboot with console access and validate services, storage, networking, and monitoring.
+
+## Security controls affecting boot
+
+- UEFI Secure Boot can reject unsigned kernels or modules.
+- Kernel lockdown can restrict low-level access when Secure Boot is active.
+- SELinux and AppArmor can block userspace actions after the kernel boots.
+- LUKS encryption may require console input, TPM integration, or network-bound disk encryption.
+- Measured boot and TPM policies can change after firmware, bootloader, or kernel updates.
+
+Do not disable a security control merely to make a system boot without first understanding the failure and the resulting exposure.
+
+## References
+
+- [Linux kernel documentation](https://docs.kernel.org/)
+- [systemd documentation](https://systemd.io/)
+- [systemd-analyze manual](https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html)
+- [GNU GRUB manual](https://www.gnu.org/software/grub/manual/grub/)

From 3e9b9d3b07b5329cf8f1af1050e0d3a56ff0ed45 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:39:26 -0500
Subject: [PATCH 07/26] Rename and update leaf-spine cheat sheet

---
 leaf-spine.md | 296 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 296 insertions(+)
 create mode 100644 leaf-spine.md

diff --git a/leaf-spine.md b/leaf-spine.md
new file mode 100644
index 0000000..003a0e4
--- /dev/null
+++ b/leaf-spine.md
@@ -0,0 +1,296 @@
+# Leaf-Spine Network Architecture Cheat Sheet
+
+> **Applies to:** General routed data center fabric concepts
+> **Last reviewed:** 2026-07-14
+
+A practical reference for leaf-spine topology, capacity planning, routing, failure behavior, oversubscription, and common design choices.
+
+## Topology
+
+A leaf-spine fabric is a two-tier Clos topology:
+
+- **Leaf switches** connect servers, storage, appliances, or access networks.
+- **Spine switches** provide transit between leaf switches.
+- Every leaf normally connects to every spine.
+- Spines normally connect only to leaves in the same fabric tier.
+
+Traffic between endpoints on different leaves follows a predictable path:
+
+```text
+endpoint -> leaf -> spine -> leaf -> endpoint
+```
+
+## Why use leaf-spine
+
+- predictable hop count and latency;
+- multiple equal-cost paths;
+- horizontal scale by adding leaves or spines;
+- failure of one spine usually reduces capacity rather than disconnecting the fabric;
+- strong fit for east-west application traffic;
+- automation-friendly, repeatable topology.
+
+## Routed underlay
+
+Modern fabrics commonly use Layer 3 point-to-point links between leaf and spine switches.
+
+Typical choices:
+
+- eBGP with private autonomous system numbers;
+- OSPF or IS-IS in smaller or operator-specific designs;
+- IPv4 or IPv6 numbered links;
+- unnumbered links where platform support and operations are mature;
+- Bidirectional Forwarding Detection (BFD) for faster failure detection when justified.
+
+A routed underlay removes spanning tree from the leaf-to-spine fabric. Layer 2 loop prevention may still be required on server-facing bonds, multichassis links, legacy VLAN domains, or attached access networks.
+
+## Equal-Cost Multipath
+
+Equal-Cost Multipath (ECMP) distributes flows across available spine paths.
+
+Verify:
+
+- the routing table installs the expected number of next hops;
+- hardware forwarding tables support the required ECMP width;
+- the hash includes appropriate Layer 3 and Layer 4 fields;
+- resilient hashing behavior meets failure and maintenance requirements;
+- large flows do not create unacceptable polarization.
+
+Example operational checks vary by vendor:
+
+```text
+show ip route <prefix>
+show bgp <address-family> <prefix>
+show forwarding route <prefix>
+show interfaces counters rate
+```
+
+## Capacity and oversubscription
+
+For one leaf:
+
+```text
+downlink capacity = sum of endpoint-facing bandwidth
+uplink capacity = sum of leaf-to-spine bandwidth
+oversubscription ratio = downlink capacity / uplink capacity
+```
+
+Example:
+
+```text
+48 x 25 Gb/s downlinks = 1.2 Tb/s
+8 x 100 Gb/s uplinks   = 0.8 Tb/s
+oversubscription       = 1.5:1
+```
+
+Consider real traffic patterns, not only port speed. Storage, backup, replication, AI, virtualization, and east-west service traffic can produce very different requirements.
+
+## Scaling limits
+
+The number of leaves supported by a spine tier is limited primarily by:
+
+- available spine ports;
+- required link speed;
+- optics and cabling design;
+- routing and forwarding table capacity;
+- ECMP width;
+- power and cooling;
+- failure-domain policy.
+
+Adding a spine increases available uplink capacity only when every participating leaf can connect to it.
+
+## BGP underlay pattern
+
+A common eBGP design uses:
+
+- one autonomous system number per leaf;
+- one shared or unique autonomous system number strategy for spines;
+- point-to-point peerings between every leaf and spine;
+- loopbacks advertised through the underlay;
+- maximum-path configuration for ECMP;
+- strict prefix policy and session authentication where supported.
+
+Operational checks:
+
+```text
+show bgp summary
+show bgp neighbors
+show ip route <loopback-prefix>
+show bfd peers
+```
+
+Avoid accepting or advertising unrestricted prefixes in the fabric underlay.
+
+## Overlay options
+
+A routed underlay can support an overlay such as VXLAN with BGP EVPN.
+
+Common overlay functions:
+
+- Layer 2 segments across leaves;
+- distributed anycast gateways;
+- tenant VRFs;
+- MAC and IP advertisement;
+- host mobility;
+- integrated Layer 2 and Layer 3 services.
+
+Keep underlay and overlay troubleshooting separate:
+
+1. confirm physical links;
+2. confirm underlay routing and loopback reachability;
+3. confirm tunnel endpoint reachability;
+4. confirm EVPN control-plane routes;
+5. confirm VXLAN or encapsulation state;
+6. confirm MAC, ARP/ND, and VRF forwarding.
+
+## Server multihoming
+
+Common choices include:
+
+- active/standby bonds to one or two leaves;
+- Link Aggregation Control Protocol (LACP) to one switch;
+- multichassis LAG or MLAG to a leaf pair;
+- EVPN multihoming;
+- host routing with one or more routed interfaces.
+
+Multichassis designs introduce state synchronization, split-brain handling, peer links, and failure cases that must be tested explicitly.
+
+## Border and service leaves
+
+Specialized leaf roles may include:
+
+- border leaves for WAN, internet, cloud, or inter-data-center connectivity;
+- service leaves for firewalls, load balancers, and appliances;
+- storage leaves;
+- edge leaves for legacy Layer 2 domains;
+- superspine connectivity for multi-pod or larger Clos designs.
+
+Do not create unnecessary hairpin paths through a distant service leaf without understanding bandwidth and failure impact.
+
+## Failure behavior
+
+| Failure | Expected effect in a healthy design |
+|---|---|
+| One leaf-to-spine link | Reduced path count for one leaf |
+| One spine | Reduced fabric capacity, connectivity retained |
+| One leaf | Endpoints on that leaf lose connectivity unless multihomed |
+| One server link | Bonding, routing, or application redundancy handles failure |
+| Control-plane session | ECMP path removed after protocol detection and convergence |
+| Optic degradation | Errors or drops may occur before a hard link failure |
+
+Test both hard failures and partial failures such as packet loss, unidirectional links, MTU mismatch, and high error rates.
+
+## Maximum Transmission Unit
+
+The underlay must support the overlay packet plus encapsulation overhead.
+
+Verify end to end:
+
+```text
+show interfaces <interface>
+ping <destination> size <size> do-not-fragment
+```
+
+Syntax varies by platform. Validate the maximum supported packet across host, leaf, spine, border, and appliance paths.
+
+## Cabling and addressing
+
+Recommended practices:
+
+- use deterministic port maps;
+- label both ends of every cable;
+- reserve consistent leaf and spine interface ranges;
+- generate point-to-point addressing from source-of-truth data;
+- use loopbacks for stable router IDs and tunnel endpoints;
+- record optic type, serial number, and expected distance;
+- validate polarity and lane mapping for parallel optics.
+
+## Monitoring
+
+Track at minimum:
+
+- interface state, errors, discards, and utilization;
+- optic power and temperature;
+- routing adjacency state and flap count;
+- BFD state;
+- ECMP next-hop count;
+- control-plane CPU and memory;
+- route and MAC table utilization;
+- latency and packet loss between fabric nodes;
+- overlay tunnel and EVPN route state where applicable.
+
+Streaming telemetry is often more useful than slow polling for microbursts and rapid convergence events.
+
+## Troubleshooting workflow
+
+### 1. Confirm scope
+
+Determine whether the issue affects one endpoint, one leaf, one rack, one spine path, one VRF, or the whole fabric.
+
+### 2. Check physical state
+
+```text
+show interfaces status
+show interfaces counters errors
+show interfaces transceiver
+```
+
+### 3. Check underlay adjacency
+
+```text
+show bgp summary
+show ospf neighbor
+show bfd peers
+```
+
+### 4. Check routes and ECMP
+
+```text
+show ip route <destination>
+show forwarding route <destination>
+```
+
+Confirm the expected number of next hops.
+
+### 5. Test loopback and path reachability
+
+Use sourced pings and traceroute from the relevant VRF or routing instance.
+
+### 6. Check overlay state
+
+Inspect EVPN routes, tunnel endpoints, VNIs, VRFs, MAC entries, and ARP or neighbor-discovery state.
+
+### 7. Compare intended and actual configuration
+
+Use the source of truth, generated configuration, and recent change history. Avoid making one-off CLI changes that create drift.
+
+## Common problems
+
+| Symptom | Likely checks |
+|---|---|
+| Only one rack affected | Leaf state, server links, leaf uplinks, rack power |
+| Reduced throughput | Missing ECMP paths, optic errors, hashing, oversubscription |
+| Intermittent loss | Bad optic, MTU mismatch, partial link failure, microbursts |
+| Overlay unreachable | Underlay loopbacks, VTEP reachability, EVPN sessions, VNI mapping |
+| One large flow is slow | Per-flow hashing and path utilization |
+| Routes missing on one leaf | BGP policy, address family, max-prefix, session state |
+| MLAG-host failure | Peer link, keepalive, split brain, LACP state |
+
+## Design checklist
+
+- Define rack, leaf, spine, and pod failure domains.
+- Select underlay and overlay protocols deliberately.
+- Calculate port count and oversubscription for current and future demand.
+- Confirm ECMP width and forwarding-table capacity.
+- Define loopback, point-to-point, ASN, VNI, VLAN, and VRF allocation.
+- Standardize MTU.
+- Decide how servers and appliances are multihomed.
+- Build deterministic cabling and interface maps.
+- Automate configuration from a source of truth.
+- Test maintenance and failure scenarios before production.
+- Monitor both control-plane convergence and data-plane forwarding.
+
+## References
+
+- [RFC 7938: Use of BGP for Routing in Large-Scale Data Centers](https://www.rfc-editor.org/rfc/rfc7938)
+- [RFC 8365: A Network Virtualization Overlay Solution Using EVPN](https://www.rfc-editor.org/rfc/rfc8365)
+- [RFC 7348: Virtual eXtensible Local Area Network](https://www.rfc-editor.org/rfc/rfc7348)

From a80ddb7a3ddc2f29ca996796a5cb744e476792b8 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:39:35 -0500
Subject: [PATCH 08/26] Remove superseded Google Cloud overview

---
 gcpcloud.md | 81 -----------------------------------------------------
 1 file changed, 81 deletions(-)
 delete mode 100644 gcpcloud.md

diff --git a/gcpcloud.md b/gcpcloud.md
deleted file mode 100644
index c107311..0000000
--- a/gcpcloud.md
+++ /dev/null
@@ -1,81 +0,0 @@
-### GCP (Google Cloud Platform) Cheat Sheet
-
-#### Introduction to GCP
-Google Cloud Platform (GCP) is a suite of cloud computing services that runs on the same infrastructure that Google uses internally for its end-user products.
-
-- **Purpose**: Offers services for computing, storage, networking, Big Data, Machine Learning, and the Internet of Things (IoT), as well as cloud management, security, and developer tools.
-
----
-
-#### Core GCP Services
-**Compute Engine**
-- Provides scalable virtual machines.
-- Use Cases: Hosting web applications, running backend servers.
-
-**App Engine**
-- Platform as a Service (PaaS) for building scalable web applications and mobile backends.
-- Use Cases: Building and deploying applications without worrying about the underlying infrastructure.
-
-**Cloud Storage**
-- Object storage service for storing and accessing data.
-- Use Cases: Storing application data, backups, and disaster recovery.
-
-**Cloud SQL**
-- Managed relational database service.
-- Supported Databases: MySQL, PostgreSQL, SQL Server.
-
-**BigQuery**
-- Serverless, highly scalable, and cost-effective multi-cloud data warehouse.
-- Use Cases: Business intelligence, data analysis, and reporting.
-
-#### Networking Services
-**Virtual Private Cloud (VPC)**
-- Provides networking functionality to the cloud resources.
-- Use Cases: Network isolation and protection, subnets, IP ranges, network routes, and firewalls.
-
-**Cloud Load Balancing**
-- Fully distributed, software-defined, managed service for all your traffic.
-- Use Cases: Distributing user traffic across multiple instances.
-
-**Cloud CDN (Content Delivery Network)**
-- Uses Google's globally distributed edge points to accelerate content delivery.
-- Use Cases: Delivering web and video content with speed and reliability.
-
-#### Advanced Services
-**Kubernetes Engine**
-- Managed environment for deploying, managing, and scaling containerized applications using Google infrastructure.
-- Use Cases: Running containerized applications.
-
-**Cloud Functions**
-- Event-driven serverless compute platform.
-- Use Cases: Building and connecting cloud services with code.
-
-**Cloud AI and Machine Learning**
-- Integrated AI and machine learning services ranging from pre-trained models to customizable ML tools.
-- Use Cases: Implementing machine learning models for various applications.
-
-#### Security and Identity Services
-**Cloud Identity and Access Management (IAM)**
-- Manages access control to GCP resources.
-- Use Cases: Defining who (identity) has what access (role) to which resource.
-
-**Cloud Security Command Center**
-- Comprehensive security management and data risk platform for GCP.
-- Use Cases: Preventing and responding to threats to your GCP assets.
-
-**Cloud Key Management Service**
-- Cloud-hosted key management service integrated with IAM and audit logging.
-- Use Cases: Managing encryption for your cloud services.
-
-#### Developer and Management Tools
-**Cloud SDK**
-- Command-line interface for Google Cloud Platform products and services.
-- Use Cases: Managing GCP resources and services via the command line.
-
-**Stackdriver**
-- Provides monitoring, logging, and diagnostics.
-- Use Cases: Monitoring the performance and health of your applications.
-
-**Cloud Build**
-- Continuous integration, delivery, and deployment platform.
-- Use Cases: Building, testing, and deploying software.

From 9af7aaf876d22f151bc51e75dd7ffc4f6b3e3b45 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:39:42 -0500
Subject: [PATCH 09/26] Remove superseded Google Cloud CLI sheet

---
 gcloud.md | 141 ------------------------------------------------------
 1 file changed, 141 deletions(-)
 delete mode 100644 gcloud.md

diff --git a/gcloud.md b/gcloud.md
deleted file mode 100644
index bf5de66..0000000
--- a/gcloud.md
+++ /dev/null
@@ -1,141 +0,0 @@
-# Google Cloud CLI Cheat Sheet
-
-> **Applies to:** Current Google Cloud CLI (`gcloud`)
-> **Last reviewed:** 2026-07-14
-
-A practical reference for authentication, configuration, Compute Engine, GKE, Cloud Storage, IAM, and networking.
-
-## Authentication and configuration
-
-```bash
-gcloud version
-gcloud init
-gcloud auth login
-gcloud auth list
-gcloud config configurations list
-gcloud config list
-gcloud config set project <project-id>
-gcloud config set compute/region <region>
-gcloud config set compute/zone <zone>
-gcloud projects list
-```
-
-For local Application Default Credentials used by client libraries:
-
-```bash
-gcloud auth application-default login
-```
-
-> [!WARNING]
-> Do not confuse user CLI credentials with Application Default Credentials. Use workload identity or service-account impersonation for automation instead of downloading long-lived keys whenever possible.
-
-## Service-account impersonation
-
-```bash
-gcloud auth print-access-token \
-  --impersonate-service-account=<service-account-email>
-
-gcloud config set auth/impersonate_service_account <service-account-email>
-gcloud config unset auth/impersonate_service_account
-```
-
-## Compute Engine
-
-```bash
-gcloud compute instances list
-gcloud compute instances describe <instance> --zone=<zone>
-gcloud compute instances create <instance> \
-  --zone=<zone> \
-  --machine-type=<machine-type> \
-  --image-family=debian-12 \
-  --image-project=debian-cloud
-gcloud compute ssh <instance> --zone=<zone>
-gcloud compute instances stop <instance> --zone=<zone>
-gcloud compute instances start <instance> --zone=<zone>
-gcloud compute instances delete <instance> --zone=<zone>
-```
-
-## Google Kubernetes Engine
-
-```bash
-gcloud container clusters list
-gcloud container clusters describe <cluster> --location=<region-or-zone>
-gcloud container clusters get-credentials <cluster> \
-  --location=<region-or-zone>
-gcloud container clusters create <cluster> \
-  --location=<region-or-zone> \
-  --num-nodes=3
-gcloud container clusters resize <cluster> \
-  --location=<region-or-zone> \
-  --num-nodes=<count>
-gcloud container clusters delete <cluster> \
-  --location=<region-or-zone>
-```
-
-## Cloud Storage
-
-Use the current `gcloud storage` command group for new scripts:
-
-```bash
-gcloud storage buckets list
-gcloud storage buckets create gs://<bucket> --location=<location>
-gcloud storage ls gs://<bucket>
-gcloud storage cp <local-file> gs://<bucket>/<object>
-gcloud storage cp gs://<bucket>/<object> <local-path>
-gcloud storage rsync --recursive <local-directory> gs://<bucket>/<prefix>
-gcloud storage rm gs://<bucket>/<object>
-```
-
-`gsutil` remains available in many installations, but do not introduce it into new automation unless compatibility requires it.
-
-## IAM and service accounts
-
-```bash
-gcloud iam roles list
-gcloud iam service-accounts list
-gcloud iam service-accounts create <name> \
-  --display-name="<display-name>"
-gcloud projects get-iam-policy <project-id>
-gcloud projects add-iam-policy-binding <project-id> \
-  --member="serviceAccount:<service-account-email>" \
-  --role="roles/<role>"
-```
-
-Avoid project-owner and broad primitive roles. Prefer predefined or custom roles with the minimum required permissions.
-
-## VPC networking
-
-```bash
-gcloud compute networks list
-gcloud compute networks describe <network>
-gcloud compute networks create <network> --subnet-mode=custom
-gcloud compute networks subnets list
-gcloud compute networks subnets create <subnet> \
-  --network=<network> \
-  --region=<region> \
-  --range=<cidr>
-gcloud compute firewall-rules list
-gcloud compute firewall-rules create <rule> \
-  --network=<network> \
-  --direction=INGRESS \
-  --action=ALLOW \
-  --rules=tcp:<port> \
-  --source-ranges=<cidr>
-```
-
-## Output and troubleshooting
-
-```bash
-gcloud <group> <command> --help
-gcloud info
-gcloud topic formats
-gcloud compute instances list \
-  --format='table(name,zone.basename(),status,networkInterfaces[0].networkIP)'
-gcloud components update
-```
-
-## References
-
-- [Google Cloud CLI documentation](https://cloud.google.com/sdk/gcloud)
-- [Cloud Storage with the gcloud CLI](https://cloud.google.com/storage/docs/discover-object-storage-gcloud)
-- [Service-account impersonation](https://cloud.google.com/docs/authentication/use-service-account-impersonation)

From 3b178a6b61a4568cdf7e5a9ad4dfc133808075c9 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:39:47 -0500
Subject: [PATCH 10/26] Remove superseded AWS overview

---
 awscloud.md | 114 ----------------------------------------------------
 1 file changed, 114 deletions(-)
 delete mode 100644 awscloud.md

diff --git a/awscloud.md b/awscloud.md
deleted file mode 100644
index dbfc8a5..0000000
--- a/awscloud.md
+++ /dev/null
@@ -1,114 +0,0 @@
-### AWS Cloud Cheat Sheet
-
-#### Introduction to AWS Cloud
-
-Amazon Web Services (AWS) is a comprehensive cloud platform offering over 200 fully featured services from data centers globally.
-
-- **Purpose**: Provides scalable and cost-effective cloud computing solutions.
-
-#### Core AWS Services
-
-**EC2 (Elastic Compute Cloud)**
-
-- Provides scalable virtual servers.
-- Use Cases: Hosting web applications, running backend servers.
-
-**S3 (Simple Storage Service)**
-
-- Object storage service with high scalability.
-- Use Cases: Storing images, videos, backups, static web hosting.
-
-**RDS (Relational Database Service)**
-
-- Managed relational database service.
-- Supported Databases: MySQL, PostgreSQL, Oracle, SQL Server, MariaDB, Amazon Aurora.
-
-**Lambda**
-
-- Serverless compute service.
-- Use Cases: Running code in response to events, backend services.
-
-**VPC (Virtual Private Cloud)**
-
-- Provides an isolated section of the AWS Cloud to launch resources.
-- Use Cases: Networking setup, defining subnets, route tables, network gateways.
-
-#### Advanced AWS Services
-
-**Elastic Beanstalk**
-
-- Platform as a Service (PaaS) for deploying applications.
-- Use Cases: Easy deployment and scaling of web applications.
-
-**CloudFormation**
-
-- Infrastructure as Code service to model and set up AWS resources.
-- Use Cases: Automating infrastructure provisioning.
-
-**Elastic Kubernetes Service (EKS)**
-
-- Managed Kubernetes service.
-- Use Cases: Running containerized applications.
-
-**DynamoDB**
-
-- NoSQL database service.
-- Use Cases: High-performance, scalable applications.
-
-**Route 53**
-
-- Scalable Domain Name System (DNS) web service.
-- Use Cases: Domain registration, DNS routing, health checking.
-
-#### AWS Security and Identity Services
-
-**IAM (Identity and Access Management)**
-
-- Manages access to AWS services and resources.
-- Use Cases: Creating and managing AWS users and groups, permissions.
-
-**Cognito**
-
-- Provides user identity and data synchronization.
-- Use Cases: User authentication for mobile and web applications.
-
-**Key Management Service (KMS)**
-
-- Managed service to create and control encryption keys.
-- Use Cases: Encrypting data stored in other AWS services.
-
-#### AWS Monitoring and Management Tools
-
-**CloudWatch**
-
-- Monitoring service for AWS cloud resources and applications.
-- Use Cases: Collecting and tracking metrics, setting alarms.
-
-**CloudTrail**
-
-- Service that provides a record of actions taken by a user, role, or AWS service.
-- Use Cases: Compliance auditing, operational auditing.
-
-**AWS Config**
-
-- Tracks AWS resource configurations and changes.
-- Use Cases: Compliance, security analysis, resource change tracking.
-
-#### AWS Networking Services
-
-**Direct Connect**
-
-- Establishes a dedicated network connection from on-premises to AWS.
-- Use Cases: Reducing network costs, increasing bandwidth.
-
-**API Gateway**
-
-- Service for creating, publishing, maintaining, and securing APIs.
-- Use Cases: API management for serverless applications.
-
-**Elastic Load Balancing (ELB)**
-
-- Automatically distributes incoming application traffic.
-- Use Cases: Fault tolerance, traffic distribution across multiple instances.
-
-

From 7675e160f105286b3498d739b788c2514421d94a Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:39:52 -0500
Subject: [PATCH 11/26] Remove superseded AWS CLI sheet

---
 awscli.md | 137 ------------------------------------------------------
 1 file changed, 137 deletions(-)
 delete mode 100644 awscli.md

diff --git a/awscli.md b/awscli.md
deleted file mode 100644
index 189c341..0000000
--- a/awscli.md
+++ /dev/null
@@ -1,137 +0,0 @@
-### AWS CLI Cheat Sheet
-
-#### Introduction to AWS CLI
-The AWS Command Line Interface (CLI) is a powerful tool to interact with AWS services, enabling scripting and automation for efficient cloud management.
-
-- **Purpose**: Manage AWS services, automate tasks, and script operations.
-
----
-
-#### Configuration and Setup
-**Configure AWS CLI**
-- `aws configure`
-- Sets up AWS credentials (Access Key, Secret Key) and default region.
-
-**View Configuration**
-- `aws configure list`
-- Lists the current AWS CLI configuration settings.
-
-**Using Profiles**
-- `aws configure --profile [profile_name]`
-- Configure multiple profiles for different AWS accounts or roles.
-
-#### Amazon S3 (Simple Storage Service)
-**List S3 Buckets**
-- `aws s3 ls`
-- Lists all S3 buckets in the account.
-
-**Create S3 Bucket**
-- `aws s3 mb s3://[bucket-name]`
-- Creates a new S3 bucket.
-
-**Copy Files to/from S3**
-- `aws s3 cp [local_path] s3://[bucket-name]/[object]`
-- `aws s3 cp s3://[bucket-name]/[object] [local_path]`
-- Copies files to or from S3.
-
-**Sync Local Directory with S3**
-- `aws s3 sync [local_path] s3://[bucket-name]`
-- Synchronizes contents of a local directory with an S3 bucket.
-
-#### EC2 (Elastic Compute Cloud)
-**List EC2 Instances**
-- `aws ec2 describe-instances`
-- Displays information about EC2 instances.
-
-**Start/Stop EC2 Instances**
-- `aws ec2 start-instances --instance-ids [instance_id]`
-- `aws ec2 stop-instances --instance-ids [instance_id]`
-- Starts or stops specified EC2 instances.
-
-**Create EC2 Key Pair**
-- `aws ec2 create-key-pair --key-name [key_name]`
-- Creates a new key pair for EC2 instances.
-
-**Launch EC2 Instance**
-- `aws ec2 run-instances --image-id [ami_id] --count [number] --instance-type [type] --key-name [key_name]`
-- Launches a specified number of EC2 instances.
-
-**Terminate EC2 Instance**
-- `aws ec2 terminate-instances --instance-ids [instance_id]`
-- Terminates specified EC2 instances.
-
-#### IAM (Identity and Access Management)
-**List IAM Users**
-- `aws iam list-users`
-- Lists all IAM users in the AWS account.
-
-**Create IAM User**
-- `aws iam create-user --user-name [username]`
-- Creates a new IAM user.
-
-**Attach Policy to User**
-- `aws iam attach-user-policy --policy-arn [policy_arn] --user-name [username]`
-- Attaches a managed policy to an IAM user.
-
-**Create IAM Role**
-- `aws iam create-role --role-name [role_name] --assume-role-policy-document [policy_json]`
-- Creates a new IAM role with specified trust relationships.
-
-#### Networking with VPC
-**Describe VPCs**
-- `aws ec2 describe-vpcs`
-- Lists all VPCs in the account.
-
-**Create VPC**
-- `aws ec2 create-vpc --cidr-block [cidr_block]`
-- Creates a new VPC with the specified CIDR block.
-
-**Create Subnet**
-- `aws ec2 create-subnet --vpc-id [vpc_id] --cidr-block [cidr_block]`
-- Creates a subnet in a specified VPC.
-
-**Create Internet Gateway**
-- `aws ec2 create-internet-gateway`
-- Creates an internet gateway for VPC.
-
-**Attach Internet Gateway to VPC**
-- `aws ec2 attach-internet-gateway --internet-gateway-id [igw_id] --vpc-id [vpc_id]`
-- Attaches an internet gateway to a VPC.
-
-#### AWS Lambda
-**List Lambda Functions**
-- `aws lambda list-functions`
-- Lists AWS Lambda functions in the account.
-
-**Create Lambda Function**
-- `aws lambda create-function --function-name [name] --runtime [runtime] --role [role_arn] --handler [handler] --zip-file fileb://[file_path]`
-- Creates a new Lambda function.
-
-**Invoke Lambda Function**
-- `aws lambda invoke --function-name [name] --payload [payload] [output_file]`
-- Invokes a Lambda function with specified payload.
-
-**Update Lambda Function Code**
-- `aws lambda update-function-code --function-name [name] --zip-file fileb://[file_path]`
-- Updates the code of an existing Lambda function.
-
-#### AWS RDS (Relational Database Service)
-**List RDS Instances**
-- `aws rds describe-db-instances`
-- Lists all RDS instances in the account.
-
-**Create RDS Instance**
-- `aws rds create-db-instance --db-instance-identifier [id] --allocated-storage [size] --db-instance-class [class] --engine [engine] --master-username [username] --master-user-password [password]`
-- Creates a new RDS database instance.
-
-**Delete RDS Instance**
-- `aws rds delete-db-instance --db-instance-identifier [id] --skip-final-snapshot`
-- Deletes an RDS database instance.
-
----
-
-#### Tips for Using AWS CLI
-- **Scripting and Automation**: Integrate AWS CLI commands into scripts for automation of AWS services.
-- **Output Formatting**: Use the `--output` option to format the CLI output as json, text, or table.
-- **Version Update**: Regularly update AWS CLI to the latest version for new features and improvements.
-- **Help and Documentation**: Use `aws [service] [command] help` for detailed information and examples.

From fe99732d96f50522405f085f69f2f68aded59d1f Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:39:59 -0500
Subject: [PATCH 12/26] Rename Git cheat sheet

---
 github.md | 104 ------------------------------------------------------
 1 file changed, 104 deletions(-)
 delete mode 100644 github.md

diff --git a/github.md b/github.md
deleted file mode 100644
index 74a1c85..0000000
--- a/github.md
+++ /dev/null
@@ -1,104 +0,0 @@
-### Git Cheat Sheet
-
-#### Introduction to Git
-
-Git is a distributed version control system used for tracking changes in source code during software development. It's designed for coordinating work among programmers, but it can be used to track changes in any set of files.
-
-- **Purpose**: Version control, collaboration, and source code management.
-
-#### Basic Git Commands
-
-```bash
-# Initializing a Repository
-git init
-
-# Cloning a Repository
-git clone [url]
-
-# Adding Files
-git add [file]  # Add a specific file
-git add .       # Add all new and changed files
-
-# Committing Changes
-git commit -m "[commit message]"
-
-# Pulling Changes
-git pull [remote] [branch]
-
-# Pushing Changes
-git push [remote] [branch]
-```
-
-#### Branching and Merging
-
-```bash
-# Creating a Branch
-git branch [branch-name]
-
-# Switching Branches
-git checkout [branch-name]
-
-# Merging a Branch
-git merge [branch-name]
-
-# Deleting a Branch
-git branch -d [branch-name]
-```
-
-#### Viewing Changes
-
-```bash
-# Status of Working Directory
-git status
-
-# View Commit History
-git log
-
-# Compare Changes
-git diff
-```
-
-#### Remote Repositories
-
-```bash
-# Adding a Remote Repository
-git remote add [remote-name] [url]
-
-# Viewing Remote Repositories
-git remote -v
-
-# Fetching Remote Changes
-git fetch [remote-name]
-```
-
-#### Advanced Git Operations
-
-```bash
-# Stashing Changes
-git stash
-git stash pop
-
-# Rebasing
-git rebase [branch-name]
-
-# Cherry-Picking
-git cherry-pick [commit-hash]
-```
-
-#### Troubleshooting and Undoing
-
-```bash
-# Reverting Changes
-git revert [commit-hash]
-
-# Resetting
-git reset [file]  # Unstage a file
-git reset --hard [commit-hash]  # Reset to a specific commit
-```
-
-#### Tips for Using Git
-
-
-- **Regular Commits**: Make small, frequent commits for better tracking and easier troubleshooting.
-- **Clear Commit Messages**: Write clear, descriptive commit messages.
-- **Branching Strategy**: Follow a consistent branching strategy like Git Flow or Feature Branch Workflow. 

From 22cd752706d36a7224e885cd2bfdc11d03618077 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:40:08 -0500
Subject: [PATCH 13/26] Rename Linux boot cheat sheet

---
 linux_kernel_boot.md | 74 --------------------------------------------
 1 file changed, 74 deletions(-)
 delete mode 100644 linux_kernel_boot.md

diff --git a/linux_kernel_boot.md b/linux_kernel_boot.md
deleted file mode 100644
index 58e0132..0000000
--- a/linux_kernel_boot.md
+++ /dev/null
@@ -1,74 +0,0 @@
-### Linux Kernel and Boot Process Cheat Sheet
-
-#### Introduction to the Linux Kernel
-
-
-
-The Linux kernel is the core part of Linux operating systems. It's responsible for managing the system's resources and the communication between hardware and software components. As an open-source kernel, it's widely used in various distributions like Ubuntu, Fedora, and Debian.
-
-
-#### Linux Kernel Components
-
-
-- **Process Management**: Handles processes, scheduling, and multitasking.
-- **Memory Management**: Manages memory allocation and paging.
-- **Device Drivers**: Interface for communicating with hardware devices.
-- **System Calls**: Interface for applications to access kernel functions.
-- **Networking**: Manages network protocols and data transmission.
-- **File Systems**: Handles data storage, retrieval, and organization.
-
-
-#### The Linux Boot Process
-
-
-1. **BIOS/UEFI Initialization**: The system's firmware initializes hardware and finds a bootable device.
-
-2. **Bootloader (GRUB/LILO)**: The bootloader presents a menu and loads the selected kernel into memory. GRUB (GRand Unified Bootloader) is commonly used.
-
-3. **Kernel Initialization**: The kernel initializes devices, mounts the root filesystem, and starts init (or systemd) which is the first user-space process.
-
-4. **Init/Systemd Process**: Responsible for starting system services and user-space applications.
-
-
-#### Behind the Scenes in the Linux Kernel
-
-
-- **Kernel Mode vs. User Mode**: The kernel operates in kernel mode with full access to hardware, while applications run in user mode with limited access.
-
-- **Interrupts and Context Switching**: The kernel handles interrupts (signals from hardware devices) and manages context switching between processes.
-
-- **Modules**: The kernel can load and unload modules at runtime, allowing for dynamic support of different devices.
-
-- **Filesystem Hierarchy**: The kernel adheres to a specific filesystem hierarchy for organizing system files and directories.
-
-
-#### Important Kernel Directories and Files
-
-
-- **/boot**: Contains boot loader and kernel files.
-- **/proc**: Virtual filesystem providing access to kernel and process information.
-- **/sys**: Interface to kernel data structures.
-- **/dev**: Special files representing devices.
-- **/etc**: Configuration files for the system.
-
-
-#### Kernel Configuration and Compilation
-
-
-- **Configuring the Kernel**: `make menuconfig` allows customization of kernel features.
-- **Compiling the Kernel**: `make` and `make install` compile and install the kernel.
-
-
-#### Kernel Debugging and Monitoring
-
-
-- **dmesg**: Displays kernel-related messages.
-- **/var/log**: Contains system log files.
-- **SystemTap, kdump**: Tools for debugging and analyzing kernel performance.
-
-
-#### Security in the Linux Kernel
-
-
-- **SELinux/AppArmor**: Security modules for enforcing access control policies.
-- **Firewall (iptables/nftables)**: Kernel-level firewall for packet filtering.

From 9e02fe4a27f0fa71f94f611f98006f9f0fd7cdf7 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:40:13 -0500
Subject: [PATCH 14/26] Rename leaf-spine cheat sheet

---
 leafspine.md | 76 ----------------------------------------------------
 1 file changed, 76 deletions(-)
 delete mode 100644 leafspine.md

diff --git a/leafspine.md b/leafspine.md
deleted file mode 100644
index b803f1e..0000000
--- a/leafspine.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# Leaf-Spine Network Architecture Cheat Sheet
-
-## Introduction to Leaf-Spine Architecture
-
-Leaf-spine is a two-layer network topology composed of leaf switches and spine switches. It's designed to minimize latency and manage increasing east-west network traffic in data centers efficiently.
-
-- **Function**: Provides high-bandwidth, low-latency connectivity across network nodes.
-- **Use Cases**: Data center networking, cloud services, large enterprise networks.
-
-## Key Components
-
-- **Leaf Switches**: Connect to servers, storage systems, or other end-point devices. Each leaf switch is connected to every spine switch.
-- **Spine Switches**: Backbone of the network, providing interconnectivity between leaf switches. Spine switches only connect to leaf switches — never to each other.
-- **East-West Traffic**: Traffic that flows within the data center, typically between servers or storage systems. Leaf-spine is optimized for this traffic pattern.
-- **North-South Traffic**: Traffic flowing in and out of the data center (client to server). Handled at the leaf layer via border or edge leaf switches.
-
-## Design Principles
-
-- **Scalability**: Easily scalable by adding more leaf or spine switches without redesigning the network.
-- **Reduced Latency**: Any two endpoints are always exactly two hops apart (leaf → spine → leaf), giving predictable, uniform latency.
-- **Load Balancing**: Traffic is distributed evenly across all spine switches using ECMP (Equal-Cost Multi-Path) routing.
-- **Non-blocking Architecture**: Designed to avoid network congestion by ensuring sufficient bandwidth at every stage.
-- **No Spanning Tree**: Because leaf-spine uses IP routing (not bridging) between tiers, Spanning Tree Protocol (STP) is eliminated at the fabric level.
-
-## Implementation Considerations
-
-- **Sizing**: Proper sizing of leaf and spine switches based on port capacity and throughput requirements.
-  - Number of spine switches = oversubscription ratio target
-  - Number of leaf switches = number of servers ÷ ports per leaf
-- **Redundancy**: Each leaf connects to every spine, providing inherent path redundancy. Loss of a spine switch only reduces bandwidth, not connectivity.
-- **Cabling**: Efficient cabling strategies to manage the increased density of connections. Use structured cabling or pre-terminated fiber bundles.
-- **Routing Protocols**: Use of routing protocols like BGP (preferred in modern designs) or OSPF for dynamic routing within the architecture.
-- **Oversubscription**: Plan the ratio of downlink (server-facing) to uplink (spine-facing) bandwidth. Common targets are 3:1 or 4:1.
-
-## BGP in Leaf-Spine (Modern Design)
-
-BGP is increasingly the preferred routing protocol for leaf-spine fabrics, especially in large-scale environments:
-
-- Each leaf and spine runs BGP.
-- Leaf switches are eBGP peers with spine switches using unique ASNs per device.
-- Benefits: simple, scalable, fine-grained policy control, and vendor-agnostic.
-- Alternative: iBGP with route reflectors, or OSPF for smaller deployments.
-
-## Benefits of Leaf-Spine Architecture
-
-- **High Performance**: Optimized for high-bandwidth, low-latency networking.
-- **Predictable Latency**: Uniform two-hop latency regardless of server location.
-- **Flexibility**: Supports various types of traffic, including data, storage, and voice.
-- **Simplified Management**: Easier to manage and troubleshoot compared to traditional three-tier (core/distribution/access) architectures.
-- **Vendor Agnostic**: Works with any vendor's switches that support standard routing protocols.
-
-## Comparison: Leaf-Spine vs Traditional Three-Tier
-
-| Feature | Leaf-Spine | Three-Tier (Core/Dist/Access) |
-|---|---|---|
-| Latency | Uniform, 2 hops | Variable, 4–6 hops |
-| East-West Traffic | Optimized | Not optimized |
-| Scalability | High (add leaf or spine) | Limited by core capacity |
-| Spanning Tree | Eliminated | Required |
-| Complexity | Lower | Higher |
-| Cost | Higher upfront | Lower upfront |
-
-## Common Use Cases
-
-- **Data Center Networks**: Ideal for modern data centers with high inter-server traffic.
-- **Cloud Environments**: Supports the dynamic and scalable nature of cloud services.
-- **High-Performance Computing**: Suitable for environments requiring fast computation and data retrieval.
-- **Hyperconverged Infrastructure (HCI)**: Pairs well with HCI platforms like VMware vSAN or Nutanix.
-
-## Deployment Tips
-
-- **Network Virtualization**: Consider VXLAN overlays (with BGP EVPN) for multi-tenant environments and Layer 2 extension across leaf switches.
-- **Capacity Planning**: Regularly review network utilization for capacity planning and upgrades. Monitor spine uplink utilization closely.
-- **Monitoring and Analytics**: Implement network monitoring and analytics tools (e.g., streaming telemetry) for performance tracking and proactive issue detection.
-- **Automation**: Leaf-spine fabrics are well suited to automation via tools like Ansible, Terraform, or vendor-specific APIs (e.g., Arista eAPI, Cisco NXAPI).
-- **Test Before Production**: Validate ECMP behavior and failover scenarios in a lab or staging environment before production deployment.

From bba6af132a0263fe4be5c4a1f5a1a32cc816ea2a Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:40:33 -0500
Subject: [PATCH 15/26] Update repository index and filenames

---
 README.md | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 60a87b6..0be90fe 100644
--- a/README.md
+++ b/README.md
@@ -18,10 +18,11 @@ Practical quick-reference notes for network engineering, Linux operations, cloud
 | Topic | Reference |
 |---|---|
 | Clos fabrics | [clos.md](clos.md) |
-| Leaf-spine design | [leafspine.md](leafspine.md) |
+| Leaf-spine design | [leaf-spine.md](leaf-spine.md) |
 | LLDP | [lldp.md](lldp.md) |
 | OSI model | [osi.md](osi.md) |
 | OSPF | [ospf.md](ospf.md) |
+| Spanning Tree Protocol | [spanning-tree.md](spanning-tree.md) |
 | TCP | [tcp.md](tcp.md) |
 | UDP | [udp.md](udp.md) |
 
@@ -45,13 +46,11 @@ Practical quick-reference notes for network engineering, Linux operations, cloud
 
 ## Cloud platforms
 
-| Topic | Reference |
+| Platform | Reference |
 |---|---|
-| AWS services | [awscloud.md](awscloud.md) |
-| AWS CLI | [awscli.md](awscli.md) |
+| Amazon Web Services and AWS CLI | [aws.md](aws.md) |
 | Microsoft Azure and Azure CLI | [azure.md](azure.md) |
-| Google Cloud services | [gcpcloud.md](gcpcloud.md) |
-| Google Cloud CLI | [gcloud.md](gcloud.md) |
+| Google Cloud and Google Cloud CLI | [google-cloud.md](google-cloud.md) |
 
 ## Containers, orchestration, and infrastructure as code
 
@@ -59,6 +58,7 @@ Practical quick-reference notes for network engineering, Linux operations, cloud
 |---|---|
 | Docker and Docker Compose | [docker.md](docker.md) |
 | Kubernetes and kubectl | [kubernetes.md](kubernetes.md) |
+| Pulumi | [pulumi.md](pulumi.md) |
 | Terraform | [terraform.md](terraform.md) |
 | Jenkins CI/CD | [jenkins-cicd.md](jenkins-cicd.md) |
 | Puppet | [puppet.md](puppet.md) |
@@ -71,7 +71,7 @@ Practical quick-reference notes for network engineering, Linux operations, cloud
 | Debian | [debian.md](debian.md) |
 | HAProxy | [haproxy.md](haproxy.md) |
 | iptables | [iptables.md](iptables.md) |
-| Linux boot process | [linux_kernel_boot.md](linux_kernel_boot.md) |
+| Linux boot and kernel | [linux-boot.md](linux-boot.md) |
 | nmap | [nmap.md](nmap.md) |
 | Pacemaker | [pacemaker.md](pacemaker.md) |
 | Corosync | [corosync.md](corosync.md) |
@@ -84,11 +84,15 @@ Practical quick-reference notes for network engineering, Linux operations, cloud
 
 | Topic | Reference |
 |---|---|
-| Git | [github.md](github.md) |
+| Git | [git.md](git.md) |
 | Kafka | [kafka.md](kafka.md) |
 | REST APIs | [rest-api.md](rest-api.md) |
 | SQL | [sql.md](sql.md) |
 
+## Filename conventions
+
+New and renamed sheets use descriptive lowercase kebab-case names, such as `google-cloud.md`, `leaf-spine.md`, and `spanning-tree.md`. A platform overview and its primary CLI belong in one file when they serve the same operational audience.
+
 ## Maintenance policy
 
 Accuracy-sensitive documents should include an **Applies to** line and a **Last reviewed** date. A review date means the examples received a documentation review; it does not guarantee compatibility with every release or environment.

From c4011da3162ed723e1102e42bee713684160a79d Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:40:46 -0500
Subject: [PATCH 16/26] Document filename and consolidation conventions

---
 STYLE_GUIDE.md | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/STYLE_GUIDE.md b/STYLE_GUIDE.md
index b9fdcba..3a32cf8 100644
--- a/STYLE_GUIDE.md
+++ b/STYLE_GUIDE.md
@@ -4,6 +4,28 @@
 
 Each file should help an engineer answer a specific operational question quickly. Prefer commands, decision points, expected output, and cautions over broad product descriptions.
 
+## Filename conventions
+
+Use descriptive lowercase kebab-case filenames:
+
+```text
+google-cloud.md
+leaf-spine.md
+spanning-tree.md
+```
+
+Rules:
+
+- Use the product or protocol name an engineer is likely to search for.
+- Separate words with hyphens, not underscores or compressed spellings.
+- Avoid filenames that are broader or narrower than the actual content.
+- Do not name a Git reference `github.md` unless the document is specifically about GitHub rather than Git.
+- Combine a platform overview and its primary CLI when they serve the same audience and would otherwise repeat concepts.
+- Keep separate files when tools have different lifecycles, safety models, or operational workflows, such as Terraform and Pulumi.
+- Avoid renaming stable single-word files only for cosmetic consistency.
+
+When renaming or merging files, update the README, cross-references, and documentation-quality workflow in the same change.
+
 ## Required metadata for maintained sheets
 
 Place these lines immediately below the title:
@@ -50,4 +72,4 @@ Troubleshooting sections should generally proceed in this order:
 
 ## References
 
-Prefer official project documentation, standards documents, vendor command references, and RFCs. Avoid copying large passages. Link to the authoritative source and summarize the operational implication.
\ No newline at end of file
+Prefer official project documentation, standards documents, vendor command references, and RFCs. Avoid copying large passages. Link to the authoritative source and summarize the operational implication.

From db542d6e62c7ebfd95ccc067a22d653a77be1135 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:41:01 -0500
Subject: [PATCH 17/26] Validate consolidated and renamed documentation

---
 .github/workflows/docs-quality.yml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml
index 2fca521..0b79917 100644
--- a/.github/workflows/docs-quality.yml
+++ b/.github/workflows/docs-quality.yml
@@ -30,13 +30,19 @@ jobs:
               "CONTRIBUTING.md",
               "STYLE_GUIDE.md",
               "arista.md",
+              "aws.md",
               "azure.md",
               "cisco.md",
               "docker.md",
-              "gcloud.md",
+              "git.md",
+              "google-cloud.md",
               "iptables.md",
               "kubernetes.md",
+              "leaf-spine.md",
+              "linux-boot.md",
+              "pulumi.md",
               "rest-api.md",
+              "spanning-tree.md",
               "terraform.md",
           ]
 
@@ -89,12 +95,18 @@ jobs:
             CONTRIBUTING.md
             STYLE_GUIDE.md
             arista.md
+            aws.md
             azure.md
             cisco.md
             docker.md
-            gcloud.md
+            git.md
+            google-cloud.md
             iptables.md
             kubernetes.md
+            leaf-spine.md
+            linux-boot.md
+            pulumi.md
             rest-api.md
+            spanning-tree.md
             terraform.md
           fail: true

From a6a9aec661863abcaab766a8e1fb8bed230f90fb Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:46:41 -0500
Subject: [PATCH 18/26] Add focused Mermaid visual guides

---
 visual-guides.md | 190 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 190 insertions(+)
 create mode 100644 visual-guides.md

diff --git a/visual-guides.md b/visual-guides.md
new file mode 100644
index 0000000..c4677bc
--- /dev/null
+++ b/visual-guides.md
@@ -0,0 +1,190 @@
+# Infrastructure Visual Guides
+
+> **Applies to:** General infrastructure and network engineering concepts
+> **Last reviewed:** 2026-07-14
+
+These Mermaid diagrams supplement the detailed cheat sheets with quick topology, lifecycle, and troubleshooting views. They are intentionally conceptual: use the linked reference pages for commands, platform differences, safety warnings, and implementation details.
+
+## Spanning tree: root and alternate path
+
+Related reference: [spanning-tree.md](spanning-tree.md)
+
+In a redundant Layer 2 triangle, spanning tree elects a root bridge and keeps one redundant path from forwarding. The alternate path can transition to forwarding after a topology failure.
+
+```mermaid
+flowchart TB
+    Root["SW1<br/>Root bridge"]
+    SW2["SW2<br/>Root port toward SW1"]
+    SW3["SW3<br/>Root port toward SW1"]
+    UsersA["Access devices"]
+    UsersB["Access devices"]
+
+    Root ---|"Designated / forwarding"| SW2
+    Root ---|"Designated / forwarding"| SW3
+    SW2 -. "Alternate / discarding on one side" .- SW3
+    SW2 --- UsersA
+    SW3 --- UsersB
+```
+
+The exact blocked side depends on root-path cost and bridge or port tie-breakers. The diagram does not imply that the same physical port always blocks.
+
+## Leaf-spine fabric
+
+Related reference: [leaf-spine.md](leaf-spine.md)
+
+Every leaf connects to every spine. Traffic between endpoints on different leaves normally uses one spine hop, providing predictable path length and multiple equal-cost routes.
+
+```mermaid
+flowchart TB
+    Spine1["Spine 1"]
+    Spine2["Spine 2"]
+
+    Leaf1["Leaf 1"]
+    Leaf2["Leaf 2"]
+    Leaf3["Leaf 3"]
+
+    Rack1["Rack / endpoints"]
+    Rack2["Rack / endpoints"]
+    Rack3["Rack / endpoints"]
+
+    Spine1 --- Leaf1
+    Spine1 --- Leaf2
+    Spine1 --- Leaf3
+    Spine2 --- Leaf1
+    Spine2 --- Leaf2
+    Spine2 --- Leaf3
+
+    Leaf1 --- Rack1
+    Leaf2 --- Rack2
+    Leaf3 --- Rack3
+```
+
+A healthy routed fabric normally loses capacity rather than reachability when one spine fails, assuming every leaf still has another working spine path.
+
+## Pulumi change lifecycle
+
+Related reference: [pulumi.md](pulumi.md)
+
+Pulumi evaluates program code and stack configuration, previews the proposed change, applies approved changes through provider APIs, and records resource state in the selected backend.
+
+```mermaid
+flowchart LR
+    Code["Pulumi program"]
+    Config["Stack configuration<br/>and encrypted secrets"]
+    Preview["pulumi preview"]
+    Review{"Expected change?"}
+    Update["pulumi up"]
+    Providers["Cloud, Kubernetes,<br/>SaaS, or custom provider APIs"]
+    Infra["Actual infrastructure"]
+    State["Pulumi state backend"]
+    Investigate["Fix code, config,<br/>identity, or drift"]
+    Refresh["pulumi refresh<br/>after review"]
+
+    Code --> Preview
+    Config --> Preview
+    Preview --> Review
+    Review -->|Yes| Update
+    Review -->|No| Investigate
+    Investigate --> Preview
+    Update --> Providers
+    Providers --> Infra
+    Update --> State
+    Infra --> Refresh
+    Refresh --> State
+```
+
+A preview is not a substitute for validating the selected stack, cloud identity, region, policy controls, and rollback plan.
+
+## Linux boot sequence
+
+Related reference: [linux-boot.md](linux-boot.md)
+
+The boot process moves from firmware into the bootloader, kernel, early userspace, PID 1, and finally normal services and login targets.
+
+```mermaid
+flowchart TD
+    Power["Power on or reboot"]
+    Firmware["BIOS / UEFI<br/>hardware initialization"]
+    BootEntry["Boot entry and bootloader"]
+    Kernel["Linux kernel<br/>CPU, memory, drivers"]
+    Initramfs["Initramfs / early userspace<br/>storage, encryption, LVM, RAID"]
+    RootFS["Real root filesystem"]
+    PID1["PID 1<br/>usually systemd"]
+    Units["Mounts, devices, sockets,<br/>and service units"]
+    Target["Configured target<br/>and user access"]
+
+    Power --> Firmware
+    Firmware --> BootEntry
+    BootEntry --> Kernel
+    Kernel --> Initramfs
+    Initramfs --> RootFS
+    RootFS --> PID1
+    PID1 --> Units
+    Units --> Target
+```
+
+A failure should be investigated at the earliest incomplete stage: firmware entry, bootloader, kernel, initramfs, root filesystem, or userspace service activation.
+
+## Git branch and pull-request workflow
+
+Related reference: [git.md](git.md)
+
+A small branch-based workflow keeps changes isolated, reviewable, and recoverable before they reach the shared default branch.
+
+```mermaid
+flowchart LR
+    Main["main"]
+    Branch["Create feature branch"]
+    Edit["Edit and inspect diff"]
+    Commit["Commit focused changes"]
+    Push["Push branch"]
+    PR["Open pull request"]
+    Checks{"Review and checks pass?"}
+    Fix["Update branch<br/>or resolve conflicts"]
+    Merge["Merge or squash"]
+    UpdatedMain["Updated main"]
+
+    Main --> Branch
+    Branch --> Edit
+    Edit --> Commit
+    Commit --> Push
+    Push --> PR
+    PR --> Checks
+    Checks -->|No| Fix
+    Fix --> Edit
+    Checks -->|Yes| Merge
+    Merge --> UpdatedMain
+```
+
+Use `git status`, staged and unstaged diffs, and a backup branch before destructive history repair.
+
+## Operational troubleshooting sequence
+
+Related guidance: [STYLE_GUIDE.md](STYLE_GUIDE.md)
+
+This sequence is reusable across network, Linux, cloud, and infrastructure-as-code troubleshooting.
+
+```mermaid
+flowchart TD
+    Scope["Confirm scope and symptoms"]
+    Observe["Inspect state without changing it"]
+    Evidence["Collect logs, counters,<br/>timestamps, and recent changes"]
+    Compare["Compare intended and actual state"]
+    Cause{"Likely cause supported<br/>by evidence?"}
+    More["Gather narrower evidence"]
+    Correct["Apply the least disruptive correction"]
+    Verify["Verify service and failure recovery"]
+    Record["Document change, evidence,<br/>and rollback state"]
+
+    Scope --> Observe
+    Observe --> Evidence
+    Evidence --> Compare
+    Compare --> Cause
+    Cause -->|No| More
+    More --> Evidence
+    Cause -->|Yes| Correct
+    Correct --> Verify
+    Verify --> Record
+```
+
+Avoid using a diagram merely to restate a flat command list. Mermaid is most valuable for relationships, paths, decisions, state transitions, and failure domains.
\ No newline at end of file

From 5502333e036ab02f80bc8d2844a00ab6f6be0349 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:46:58 -0500
Subject: [PATCH 19/26] Link focused visual guides

---
 README.md | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 0be90fe..b76eee7 100644
--- a/README.md
+++ b/README.md
@@ -11,8 +11,20 @@ Practical quick-reference notes for network engineering, Linux operations, cloud
 - Start with read-only inspection commands and capture the current state.
 - Treat `clear`, `delete`, `destroy`, `flush`, `reset`, `prune`, and `--force` operations as destructive.
 - Prefer official documentation for release-specific behavior.
+- Use [visual-guides.md](visual-guides.md) for topology, lifecycle, state-transition, and troubleshooting diagrams.
 - Open a content-correction issue when a command is obsolete, unsafe, ambiguous, or vendor-specific.
 
+## Visual guides
+
+| Concept | Visual reference | Detailed reference |
+|---|---|---|
+| Spanning-tree root and alternate path | [Visual guide](visual-guides.md#spanning-tree-root-and-alternate-path) | [spanning-tree.md](spanning-tree.md) |
+| Leaf-spine topology | [Visual guide](visual-guides.md#leaf-spine-fabric) | [leaf-spine.md](leaf-spine.md) |
+| Pulumi change lifecycle | [Visual guide](visual-guides.md#pulumi-change-lifecycle) | [pulumi.md](pulumi.md) |
+| Linux boot sequence | [Visual guide](visual-guides.md#linux-boot-sequence) | [linux-boot.md](linux-boot.md) |
+| Git branch and pull-request workflow | [Visual guide](visual-guides.md#git-branch-and-pull-request-workflow) | [git.md](git.md) |
+| Operational troubleshooting sequence | [Visual guide](visual-guides.md#operational-troubleshooting-sequence) | [STYLE_GUIDE.md](STYLE_GUIDE.md) |
+
 ## Networking fundamentals
 
 | Topic | Reference |
@@ -101,4 +113,4 @@ Repository quality checks validate the maintained documentation surface on pull
 
 ## License
 
-Content is available under the [MIT License](LICENSE).
+Content is available under the [MIT License](LICENSE).
\ No newline at end of file

From 74cd02b76fc0b7a352d64fa6c3c6f34b2f829d03 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:47:18 -0500
Subject: [PATCH 20/26] Document purposeful Mermaid usage

---
 STYLE_GUIDE.md | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/STYLE_GUIDE.md b/STYLE_GUIDE.md
index 3a32cf8..9aaeb94 100644
--- a/STYLE_GUIDE.md
+++ b/STYLE_GUIDE.md
@@ -50,6 +50,33 @@ Do not use realistic credentials, public IP addresses belonging to third parties
 
 For state-changing commands, show a read-only verification command first and add an inline warning when the operation is destructive.
 
+## Visual diagrams
+
+Use Mermaid when a diagram explains relationships that are harder to understand as a flat list. Good candidates include:
+
+- physical or logical topology;
+- packet, request, or control-plane paths;
+- state transitions;
+- deployment and infrastructure lifecycles;
+- decision trees;
+- failure domains;
+- ordered boot or troubleshooting sequences.
+
+Do not add a diagram merely to repeat a command list, glossary, or short numbered procedure. A diagram should make a specific concept faster to understand.
+
+Guidelines:
+
+- Keep diagrams conceptual unless the document is explicitly vendor-specific.
+- Use labels that remain readable in both GitHub light and dark themes.
+- Avoid custom colors and styling unless they convey essential meaning.
+- Keep node and edge counts low enough to read without zooming.
+- Add a short explanation before or after each diagram.
+- State important simplifications and do not imply that one diagram represents every vendor or failure case.
+- Link visual guides to the detailed operational reference containing commands and cautions.
+- Prefer one focused diagram over a large all-in-one architecture drawing.
+
+The repository-wide diagrams live in [visual-guides.md](visual-guides.md). Topic files may embed a diagram directly when it is essential to understanding that specific page.
+
 ## Troubleshooting order
 
 Troubleshooting sections should generally proceed in this order:
@@ -72,4 +99,4 @@ Troubleshooting sections should generally proceed in this order:
 
 ## References
 
-Prefer official project documentation, standards documents, vendor command references, and RFCs. Avoid copying large passages. Link to the authoritative source and summarize the operational implication.
+Prefer official project documentation, standards documents, vendor command references, and RFCs. Avoid copying large passages. Link to the authoritative source and summarize the operational implication.
\ No newline at end of file

From eab36e85ab84f285a02836a547813f078f683014 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:47:37 -0500
Subject: [PATCH 21/26] Validate visual guide links and Mermaid blocks

---
 .github/workflows/docs-quality.yml | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docs-quality.yml b/.github/workflows/docs-quality.yml
index 0b79917..7b2f604 100644
--- a/.github/workflows/docs-quality.yml
+++ b/.github/workflows/docs-quality.yml
@@ -29,6 +29,7 @@ jobs:
               "README.md",
               "CONTRIBUTING.md",
               "STYLE_GUIDE.md",
+              "visual-guides.md",
               "arista.md",
               "aws.md",
               "azure.md",
@@ -46,6 +47,11 @@ jobs:
               "terraform.md",
           ]
 
+          supported_mermaid = re.compile(
+              r"^(flowchart|graph|sequenceDiagram|stateDiagram-v2|"
+              r"classDiagram|erDiagram|journey|gitGraph|mindmap|timeline)\b"
+          )
+
           errors = []
           for filename in files:
               path = Path(filename)
@@ -71,6 +77,26 @@ jobs:
                   if re.search(r"\[[^\]]*\]\(\s*\)", line):
                       errors.append(f"{filename}:{number}: empty Markdown link")
 
+              opening_count = text.count("```mermaid")
+              mermaid_blocks = re.findall(
+                  r"```mermaid\s*\n(.*?)```",
+                  text,
+                  flags=re.DOTALL,
+              )
+              if opening_count != len(mermaid_blocks):
+                  errors.append(f"{filename}: unclosed Mermaid code fence")
+
+              for index, block in enumerate(mermaid_blocks, start=1):
+                  first_line = next(
+                      (line.strip() for line in block.splitlines() if line.strip()),
+                      "",
+                  )
+                  if not supported_mermaid.match(first_line):
+                      errors.append(
+                          f"{filename}: Mermaid block {index} has an unsupported "
+                          f"or missing diagram declaration: {first_line!r}"
+                      )
+
           if errors:
               print("\n".join(errors))
               sys.exit(1)
@@ -94,6 +120,7 @@ jobs:
             README.md
             CONTRIBUTING.md
             STYLE_GUIDE.md
+            visual-guides.md
             arista.md
             aws.md
             azure.md
@@ -109,4 +136,4 @@ jobs:
             rest-api.md
             spanning-tree.md
             terraform.md
-          fail: true
+          fail: true
\ No newline at end of file

From 2cfbd2b9980a6922bd686184ea6955991576ab34 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:48:03 -0500
Subject: [PATCH 22/26] Clarify visual guide purpose

---
 README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/README.md b/README.md
index b76eee7..4254222 100644
--- a/README.md
+++ b/README.md
@@ -16,6 +16,8 @@ Practical quick-reference notes for network engineering, Linux operations, cloud
 
 ## Visual guides
 
+The diagrams are intentionally limited to concepts where visual relationships improve understanding; command-oriented references remain text-first.
+
 | Concept | Visual reference | Detailed reference |
 |---|---|---|
 | Spanning-tree root and alternate path | [Visual guide](visual-guides.md#spanning-tree-root-and-alternate-path) | [spanning-tree.md](spanning-tree.md) |

From b1711d5045b716dcaad1055a1170bb877d89fb85 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:48:41 -0500
Subject: [PATCH 23/26] Clarify central visual guide scope

---
 STYLE_GUIDE.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/STYLE_GUIDE.md b/STYLE_GUIDE.md
index 9aaeb94..98f46d9 100644
--- a/STYLE_GUIDE.md
+++ b/STYLE_GUIDE.md
@@ -75,7 +75,7 @@ Guidelines:
 - Link visual guides to the detailed operational reference containing commands and cautions.
 - Prefer one focused diagram over a large all-in-one architecture drawing.
 
-The repository-wide diagrams live in [visual-guides.md](visual-guides.md). Topic files may embed a diagram directly when it is essential to understanding that specific page.
+The repository-wide diagrams live in [visual-guides.md](visual-guides.md). Command-heavy cloud and utility sheets remain text-first unless a topology or lifecycle diagram adds clear operational value. Topic files may embed a diagram directly when it is essential to understanding that specific page.
 
 ## Troubleshooting order
 

From 3328d78d5224adcacaff9b78d7581d860c5c0188 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:49:09 -0500
Subject: [PATCH 24/26] Clarify visual guide scope

---
 visual-guides.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/visual-guides.md b/visual-guides.md
index c4677bc..5144453 100644
--- a/visual-guides.md
+++ b/visual-guides.md
@@ -5,6 +5,8 @@
 
 These Mermaid diagrams supplement the detailed cheat sheets with quick topology, lifecycle, and troubleshooting views. They are intentionally conceptual: use the linked reference pages for commands, platform differences, safety warnings, and implementation details.
 
+The collection is deliberately limited to concepts where visual relationships improve comprehension. Command-oriented cloud, CLI, and utility references remain text-first rather than receiving decorative diagrams.
+
 ## Spanning tree: root and alternate path
 
 Related reference: [spanning-tree.md](spanning-tree.md)

From e52bbef28b51dc014bd7f89b7815871b3524bfd5 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:49:26 -0500
Subject: [PATCH 25/26] Keep visual references focused


From 3190516d7ed609ccf478e997d35cbf9fad63db49 Mon Sep 17 00:00:00 2001
From: Anton Flor <tonyflores85@gmail.com>
Date: Tue, 14 Jul 2026 16:49:56 -0500
Subject: [PATCH 26/26] Confirm visual guide rationale