CI/CD Pipeline

Put B-tree indexes on the columns you filter and join on, prove it with EXPLAIN ANALYZE, use window functions for rankings and running totals, always use parameterized queries, and size the HikariCP pool to concurrent database work, not to the thread count.

Rebase replays your commits onto a new base for a clean linear history, but because it creates new commits it must never be done on branches others have already pulled.

The provider secures the cloud; you secure what you put in it: and nearly every breach is someone leaving their own box unlocked.

Treat the pipeline as production: short-lived OIDC credentials, throwaway runners, SHA-pinned actions, least-privilege deploy roles, and for the supply chain an internal registry, pinned dependencies, and signed artifacts with provenance.

G1 chops the heap into equal regions and greedily collects the ones with the most garbage first, trying to stay inside a pause-time budget.

ZGC keeps pauses under a millisecond by marking and moving objects concurrently, using colored pointers plus load barriers so references self-heal to the new location on first read.

Cross-account EFS from Lambda needs BOTH a network path (VPC peering + NFS 2049) AND authorization (EFS resource policy + execution-role EFS/VPC permissions); SCPs only restrict and role assumption is the wrong tool entirely.

Block the build on severity plus exploitability, fix the rest against severity-based SLAs, and allow only time-boxed, signed, expiring exceptions.

ZGC's pauses stay tiny, but if allocation outruns reclamation the app stalls waiting for memory, and ZUncommit makes bursts worse by forcing re-commit; fix it with fixed heap, pre-touch, and generational mode.

Shenandoah compacts the heap concurrently using a per-object forwarding pointer so references always reach the current copy, and Java 25's JEP 521 made it generational.

Multiple types pretended to be separate tables but secretly shared one storage, so Elasticsearch replaced them with a single implicit type, `_doc`, and the rule: one index, one kind of document.

A new string field is dynamically mapped as `text` for searching words inside it, with a `.keyword` sub-field for exact match, sort, and aggregation: you get both unless you declare otherwise.

Pick Serial for tiny heaps, Parallel for throughput batch jobs, G1 for balanced large-heap general use (the modern default), and ZGC or Shenandoah when you need consistently tiny pauses on huge heaps.

A bigger heap delays collections but makes each one scan more and pause longer, so raising `-Xmx` treats a symptom: the real fix is usually reducing allocation, plugging a leak, or choosing the right collector.

Seven strategies from 'throw it away' to 'rebuild it cloud-native,' chosen one application at a time by weighing effort against value.

RTO is how long you are down, RPO is how much data you lose, the four patterns buy you better numbers for more money, and a plan you never test is a plan that fails when it matters.

SDLC is the set of phases every project goes through; Agile is a way of moving through those phases in short, feedback-driven iterations rather than one big sequential pass.

An SBOM is a machine-readable inventory of every software component you ship, and its point is that when a vulnerability drops you can instantly query which services are affected instead of searching blind.

DevSecOps builds security into every stage as a shared, automated responsibility, and shifting left catches vulnerabilities early and cheaply so security keeps pace with frequent releases.

Elasticsearch flips the problem around: instead of scanning documents for a word, it keeps a word-to-documents map, splits it across machines, and refreshes it about once a second.

Epsilon allocates but never collects: the heap only grows until it is full and the JVM stops: and that makes it perfect for benchmarking allocation and running tiny short-lived jobs with zero GC overhead.

Liquibase is git for your database schema: ordered changeSets in a changelog, and a DATABASECHANGELOG table that remembers what has already been applied so each environment converges to the same structure safely.

Systems Manager is the whole operations toolbox for your fleet; Patch Manager is the one tool in that box that keeps the fleet patched on approved rules during approved windows.

SAST reads your code, SCA checks your dependencies, IAST watches your code run from the inside during tests, and DAST attacks your running app from the outside: each catching a different class of flaw at a different SDLC stage.

Any object bigger than half a G1 region becomes a humongous object that eats whole regions, wastes the remainder, and adds GC pressure.

Six pillars, one question per risk, scored before launch: it turns 'it feels fine' into 'here are our top three risks and the plan to close them.'

MockWebServer tests the outbound calls your service makes to downstream services; WebTestClient tests the inbound requests your own controllers receive.

Build, push to ECR, deploy with kubectl/Helm, then verify the rollout: and authenticate with short-lived OIDC credentials instead of long-lived keys that can leak and never expire.

Resolve conflicts by choosing or combining the clashing lines; undo a pushed commit with git revert (adds an inverting commit), never with reset + force-push on shared branches because that rewrites history others already have.

CI proves the code is good, Continuous Delivery keeps it release-ready behind a button, and Continuous Deployment presses that button automatically.

One versioned Shared Library plus a tiny per-service config replaces thousands of copy-pasted pipelines, and the branch name decides the environment with an approval gate before Prod.

A feature flag is a runtime switch that turns functionality on or off without a redeploy, decoupling deployment from release so you can test in production, roll out gradually, and roll back instantly.

Pass a `Filters` argument so AWS returns only matching resources: it transfers less data, runs faster, and powers compliance scans, idle-resource cleanup, inventory reports, and remediation triggers.

Iterate `Reservations` then `Instances` in a double loop, but in production add paginators, error handling with retries, server-side filters, structured logging, and IAM role credentials: never hardcoded keys.

RCA traces an incident to systemic causes, and a blameless post-mortem records it focusing on the system not the person, producing tracked fixes so the same failure cannot recur.

Match capacity to demand: right-size, auto-scale (even to zero), buy Spot and Savings Plans, tier cold storage, and schedule shutdowns, so you cut idle cost without touching the capacity real traffic needs.

EKS gives each Pod a real VPC IP and pre-warms spare IPs per node, so subnets drain fast; avoid exhaustion with more CIDR space, prefix delegation, IPv6, and proactive monitoring.

Slow with normal CPU and memory means the system is waiting, not computing, so trace latency across application, Kubernetes, node, networking, and control plane because CPU and memory are only two of many signals.

First confirm and size impact, then check what changed, then mitigate first (usually rollback), while communicating, and do root-cause only after service is restored, because every minute of outage costs users and you can investigate safely once stable.

Follow the request hop by hop from the outside in – DNS, load balancer and ingress, Service and Pod readiness, auth service, then logs and traces – and the first hop that fails is your culprit.

CI passing but CD failing means the code is fine but the deployment broke, so read the CD log, then the cluster events and pod logs, and roll back to the last known-good version while preserving evidence.

Concurrent pushes get separate pipeline runs in parallel, shared resources are guarded by concurrency locks, and a matrix build auto-expands one job across parameter combinations.

Keep secrets out of code, logs, and images; fetch them at runtime from a dedicated secret store as masked variables; and prefer short-lived, rotated, audited credentials over static keys.

SonarQube gates code quality, Trivy and Grype scan for known CVEs, Nexus and Artifactory store trusted artifacts, and SAST reads the code while DAST attacks the running app.

Always mitigate first to stop the bleeding – replace unhealthy instances, grow storage, roll back the deploy – and only then do the longer-term fix that prevents it from happening again.

Compare every signal before and after the deploy at the exact release timestamp: if latency jumped only on the new version right at that moment, the deploy is the cause, and rolling back to the last known-good version is the fastest safe restore.

p99 is the latency 1 in 100 requests exceeds: track percentiles because the average hides the slow tail, and p99 is hard to improve because it is driven by rare correlated slow events.

SLI is what you measure, SLO is the internal target you hold yourself to, and SLA is the external contract with penalties: set the SLO stricter than the SLA to keep a buffer.

A blameless postmortem is an honest after-incident document focused on fixing systems rather than blaming people, because only psychological safety produces the truthful account needed to prevent recurrence.

An error budget is 100% minus your SLO: the failures you are allowed. Teams spend it on feature risk while it lasts, then freeze features and fix reliability once it is gone.

An SLI is the actual measured quality of the service from the user's perspective, and an SLO is the target that SLI must meet: the measurement versus the goal.

Drift is reality diverging from the declared configuration due to out-of-band changes; detect it with terraform plan and reconcile by re-applying, updating the config to match, or importing untracked resources.

Incident management is a five-step lifecycle: detect, triage, respond, fix (mitigate first), and blameless postmortem, designed to restore service fast and then learn from what happened.

On-call rotation puts one clearly responsible first responder on duty per shift, backed by alerting tools (PagerDuty/Opsgenie) that page and escalate, chat tools for coordination, and runbooks for step-by-step fixes.

Toil is manual, repetitive, automatable work that scales with the service and leaves nothing behind: reduce it by measuring it and engineering it away.

AWS returns results one capped page at a time with a NextToken, so you must loop until the token is gone: a Boto3 paginator does that loop correctly for you, avoiding the silent partial results that break automation in large accounts.