What broke?

aws sts get-caller-identity
aws configure list

kubectl run netshoot --rm -it --image=nicolaka/netshoot --restart=Never -n <ns> -- /bin/bash
# inside: nslookup kubernetes.default, curl -v svc:port

kubectl port-forward svc/<service> 8080:80 -n <namespace>
curl -I http://localhost:8080

helm history myrelease -n apps
helm rollback myrelease <revision> -n apps
helm status myrelease -n apps

location / {
  proxy_pass http://backend:8080;
  proxy_connect_timeout 60s;
  proxy_send_timeout 60s;
  proxy_read_timeout 60s;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
}
sudo nginx -t && sudo systemctl reload nginx

sudo tail -f /var/log/nginx/error.log
sudo nginx -t

docker logs -f <container>
docker inspect <container> --format='{{.State.ExitCode}}'

kubectl logs <pod> -n <ns> --previous
kubectl describe pod <pod> -n <ns>
kubectl get events -n <ns> --sort-by='.lastTimestamp'

kubectl describe pod <pod> -n <ns> | grep -A5 Events
kubectl get secret -n <ns>
# ensure imagePullSecrets if private registry

kubectl top nodes
kubectl top pods -A --sort-by=memory

vault status
vault operator unseal
# repeat until Sealed: false

sudo journalctl -u <service> -f --since "1 hour ago"
sudo systemctl status <service>

df -h
du -sh /* 2>/dev/null | sort -hr | head -20
sudo journalctl --vacuum-time=7d

kubectl get certificate -A
kubectl describe certificate <name> -n <ns>
echo | openssl s_client -connect app.example.com:443 2>/dev/null | openssl x509 -noout -dates

kubectl describe ingress <name> -n <ns>
kubectl get endpoints -n <ns>
kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx --tail=50

terraform state list
terraform state show aws_instance.web
terraform refresh

# Verify registry login in CI before push
docker login registry.example.com -u $CI_USER -p $CI_TOKEN
# K8s: create docker-registry secret
kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=... -n <ns>

kubectl exec -it <pod> -n <ns> -- /bin/sh
# or -c <container> if multi-container

aws logs tail /aws/lambda/my-function --follow --since 1h
aws logs describe-log-groups --log-group-name-prefix /ecs/

echo "show stat" | socat stdio /var/run/haproxy/admin.sock
curl -I http://backend:port

redis-cli -h <host> -p 6379 ping
redis-cli -h <host> INFO server

psql -h <host> -U <user> -d <db> -c "SELECT 1"
pg_isready -h <host> -p 5432

curl -I https://app.example.com
curl -v http://localhost:8080/health 2>&1 | head -30

kubectl describe node <node>
kubectl get events -A --field-selector involvedObject.kind=Node
# check DiskPressure, MemoryPressure, PIDPressure

# .gitlab-ci.yml tags must match runner
# Settings → CI/CD → Runners → note tags
# tags: [docker, aws]

kubectl top pods -A --sort-by=cpu
# vs kubectl get pods -A -o custom-columns=NS:.metadata.namespace,NAME:.metadata.name,CPU:.spec.containers[*].resources.requests.cpu

dig app.example.com +short
dig app.example.com ANY
nslookup app.example.com
# compare to ingress LB: kubectl get ingress -n apps

nc -zv backend.example.com 443
curl -v telnet://backend:8080
ss -tlnp | grep 8080

sudo systemctl status <service>
sudo systemctl restart <service>
sudo journalctl -u <service> -n 50 --no-pager
sudo systemctl is-active <service>

echo | openssl s_client -connect app.example.com:443 -servername app.example.com 2>/dev/null | openssl x509 -noout -dates -subject
# days left:
echo | openssl s_client -connect app.example.com:443 2>/dev/null | openssl x509 -noout -checkend 604800

vault kv put secret/apps/myapp db_password=new-secret api_key=new-key
vault kv get secret/apps/myapp
# External Secrets Operator syncs within refreshInterval

for ctx in staging prod; do
  echo "=== $ctx ==="
  kubectl --context=$ctx get deploy -n apps -o custom-columns=NAME:.metadata.name,IMAGE:.spec.template.spec.containers[0].image
done

argocd app list
argocd app get <app> --refresh
argocd app sync <app>
argocd app diff <app>

argocd app get <app> --hard-refresh
kubectl patch application <app> -n argocd --type merge -p '{"operation":{"initiatedBy":{"username":"admin"},"sync":{"revision":"HEAD"}}}'

flux get sources git -A
flux get kustomizations -A
flux reconcile source git <name> -n flux-system
flux reconcile kustomization <name> -n flux-system --with-source

# describe shows probe failures
kubectl describe pod <pod> -n <ns> | grep -A3 Liveness
# common fix — separate paths, longer initialDelaySeconds
readinessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 15
  periodSeconds: 10
livenessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 30
  failureThreshold: 3

kubectl get hpa -n <ns>
kubectl describe hpa <name> -n <ns>
kubectl get --raw "/apis/metrics.k8s.io/v1beta1/namespaces/<ns>/pods" | head
# metrics-server must be running

kubectl auth can-i create deployments -n apps
kubectl auth can-i get secrets --as=system:serviceaccount:apps:default -n apps
kubectl describe rolebinding -n apps

curl -s http://localhost:9200/_cluster/health?pretty
curl -s http://localhost:9200/_cat/indices?v
curl -s http://localhost:9200/_cat/shards?v | grep UNASSIGNED

ssh -J bastion@jump.example.com user@10.0.2.50
# ~/.ssh/config:
# Host private
#   ProxyJump bastion@jump.example.com
#   HostName 10.0.2.50
#   User deploy

sudo apt install fail2ban
sudo tee /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
port = ssh
maxretry = 5
bantime = 3600
EOF
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

chronyc tracking
chronyc sources -v
timedatectl status