Command snippets

aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789.dkr.ecr.us-east-1.amazonaws.com
docker tag myapp:latest 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:latest
docker push 123456789.dkr.ecr.us-east-1.amazonaws.com/myapp:latest

aws eks update-kubeconfig --name my-cluster --region us-east-1
kubectl config current-context
kubectl get nodes

aws sts assume-role --role-arn arn:aws:iam::123456789012:role/DeployRole --role-session-name deploy
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...
aws sts get-caller-identity

aws sts get-caller-identity
aws configure list

kubectl run netshoot --rm -it --image=nicolaka/netshoot --restart=Never -n <ns> -- /bin/bash
# inside: nslookup kubernetes.default, curl -v svc:port

kubectl port-forward svc/<service> 8080:80 -n <namespace>
curl -I http://localhost:8080

helm upgrade --install myrelease ./chart -n apps -f values.yaml --dry-run --debug
helm template myrelease ./chart -f values.yaml | kubectl apply --dry-run=client -f -

helm history myrelease -n apps
helm rollback myrelease <revision> -n apps
helm status myrelease -n apps

terraform import aws_instance.web i-0abc123def456
terraform state show aws_instance.web

terraform init
terraform plan -out=tfplan
terraform apply tfplan

location / {
  proxy_pass http://backend:8080;
  proxy_connect_timeout 60s;
  proxy_send_timeout 60s;
  proxy_read_timeout 60s;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
}
sudo nginx -t && sudo systemctl reload nginx

sudo tail -f /var/log/nginx/error.log
sudo nginx -t

docker logs -f <container>
docker inspect <container> --format='{{.State.ExitCode}}'

kubectl logs <pod> -n <ns> --previous
kubectl describe pod <pod> -n <ns>
kubectl get events -n <ns> --sort-by='.lastTimestamp'

kubectl describe pod <pod> -n <ns> | grep -A5 Events
kubectl get secret -n <ns>
# ensure imagePullSecrets if private registry

kubectl rollout history deploy/<name> -n <ns>
kubectl rollout undo deploy/<name> -n <ns>
kubectl rollout status deploy/<name> -n <ns>

kubectl top nodes
kubectl top pods -A --sort-by=memory

vault status
vault operator unseal
# repeat until Sealed: false

permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123:role/GithubActionsRole
      aws-region: us-east-1

- uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/build-push-action@v6
  with:
    push: true
    tags: ghcr.io/org/app:${{ github.sha }}

- uses: azure/setup-kubectl@v4
- run: kubectl apply -f k8s/
  env:
    KUBECONFIG: ${{ secrets.KUBECONFIG_B64 }}  # base64-encoded

definitions:
  services:
    docker:
      memory: 2048
pipelines:
  default:
    - step:
        services:
          - docker
        script:
          - docker build -t myapp .
          - docker push myapp

git revert HEAD
git push origin main

git stash list
git stash pop

sudo certbot renew --dry-run
sudo certbot renew
sudo systemctl reload nginx

sudo journalctl -u <service> -f --since "1 hour ago"
sudo systemctl status <service>

df -h
du -sh /* 2>/dev/null | sort -hr | head -20
sudo journalctl --vacuum-time=7d

kubectl get certificate -A
kubectl describe certificate <name> -n <ns>
echo | openssl s_client -connect app.example.com:443 2>/dev/null | openssl x509 -noout -dates

kubectl describe ingress <name> -n <ns>
kubectl get endpoints -n <ns>
kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx --tail=50

docker compose up -d --build
docker compose ps
docker compose logs -f <service>

docker build -t myapp:local .
minikube image load myapp:local
# set imagePullPolicy: IfNotPresent in deployment

kubectl config get-contexts
kubectl config use-context <context>
kubectl cluster-info

terraform state list
terraform state show aws_instance.web
terraform refresh

# Verify registry login in CI before push
docker login registry.example.com -u $CI_USER -p $CI_TOKEN
# K8s: create docker-registry secret
kubectl create secret docker-registry regcred --docker-server=... --docker-username=... --docker-password=... -n <ns>

kubectl exec -it <pod> -n <ns> -- /bin/sh
# or -c <container> if multi-container

aws logs tail /aws/lambda/my-function --follow --since 1h
aws logs describe-log-groups --log-group-name-prefix /ecs/

echo "show stat" | socat stdio /var/run/haproxy/admin.sock
curl -I http://backend:port

redis-cli -h <host> -p 6379 ping
redis-cli -h <host> INFO server

psql -h <host> -U <user> -d <db> -c "SELECT 1"
pg_isready -h <host> -p 5432

curl -I https://app.example.com
curl -v http://localhost:8080/health 2>&1 | head -30

kubectl describe node <node>
kubectl get events -A --field-selector involvedObject.kind=Node
# check DiskPressure, MemoryPressure, PIDPressure

terraform workspace list
terraform workspace select prod
terraform plan

# .gitlab-ci.yml tags must match runner
# Settings → CI/CD → Runners → note tags
# tags: [docker, aws]

for lb in $(aws elbv2 describe-load-balancers --query 'LoadBalancers[*].LoadBalancerArn' --output text); do
  echo "$lb"
  aws elbv2 describe-target-health --target-group-arn $(aws elbv2 describe-target-groups --load-balancer-arn $lb --query 'TargetGroups[0].TargetGroupArn' --output text)
done

kubectl get pods -A -o json | jq -r '.items[] | select(.spec.containers[].resources.requests == null) | "\(.metadata.namespace)/\(.metadata.name)"'

kubectl top pods -A --sort-by=cpu
# vs kubectl get pods -A -o custom-columns=NS:.metadata.namespace,NAME:.metadata.name,CPU:.spec.containers[*].resources.requests.cpu

trivy image --severity HIGH,CRITICAL myapp:tag
trivy image --exit-code 1 --severity CRITICAL myapp:tag

docker images myapp --format "{{.Repository}}:{{.Tag}} {{.Size}}"
docker history myapp:latest --no-trunc | head -20

# requires s3 ls + cloudwatch or aws s3api list-objects-v2
aws s3 ls
# enable S3 Storage Lens or Cost Explorer for detail

aws ec2 describe-instances --filters Name=instance-state-name,Values=running --query 'Reservations[*].Instances[*].[InstanceId,InstanceType,LaunchTime,Tags[?Key==`Name`].Value|[0]]' --output table

aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name CPUUtilization --dimensions Name=InstanceId,Value=i-xxx --start-time $(date -u -v-7d +%Y-%m-%dT%H:%M:%S) --end-time $(date -u +%Y-%m-%dT%H:%M:%S) --period 86400 --statistics Average

# 5xx rate / total rate
sum(rate(http_requests_total{status=~"5.."}[5m]))
/
sum(rate(http_requests_total[5m]))

# by ingress
sum by (ingress) (rate(nginx_ingress_controller_requests{status=~"5.."}[5m]))

sum by (namespace, pod) (increase(kube_pod_container_status_restarts_total[1h])) > 3

# top restarters
 topk(10, sum by (pod, namespace) (kube_pod_container_status_restarts_total))

histogram_quantile(0.99,
  sum by (le) (rate(http_request_duration_seconds_bucket[5m]))
)

# ingress latency
histogram_quantile(0.99, sum by (le) (rate(nginx_ingress_controller_request_duration_seconds_bucket[5m])))

100 - (
  avg by (instance) (node_filesystem_avail_bytes{mountpoint="/"}) /
  avg by (instance) (node_filesystem_size_bytes{mountpoint="/"}) * 100
)

(certmanager_certificate_expiration_timestamp_seconds - time()) / 86400 < 14

# alert when < 7 days
(certmanager_certificate_expiration_timestamp_seconds - time()) / 86400

{namespace="apps"} |= "error" or |= "ERROR" or |= "panic"
| json
| line_format "{{.pod}} {{.message}}"

# rate of error log lines
sum(rate({namespace="apps"} |= "error" [5m])) by (pod)

fields @timestamp, @message
| filter @message like /(?i)(error|5\d\d|exception)/
| sort @timestamp desc
| limit 100

# EKS container logs
fields @timestamp, kubernetes.pod_name, @message
| filter @message like /ERROR/
| stats count() by kubernetes.pod_name

gcloud container clusters get-credentials my-cluster --region us-central1 --project my-project
kubectl config current-context
kubectl get nodes

gcloud auth configure-docker us-central1-docker.pkg.dev
docker tag myapp:latest us-central1-docker.pkg.dev/my-project/my-repo/myapp:tag
docker push us-central1-docker.pkg.dev/my-project/my-repo/myapp:tag

# Bind K8s SA to GCP SA
gcloud iam service-accounts add-iam-policy-binding GSA@PROJECT.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:PROJECT.svc.id.goog[NAMESPACE/KSA]"

# Deployment annotation:
# iam.gke.io/gcp-service-account: GSA@PROJECT.iam.gserviceaccount.com

az aks get-credentials --resource-group my-rg --name my-aks
kubectl config current-context
kubectl get nodes

az acr login --name myregistry
docker tag myapp:latest myregistry.azurecr.io/myapp:tag
docker push myregistry.azurecr.io/myapp:tag

az ad app federated-credential create \
  --id $APP_ID \
  --parameters '{
    "name": "github-main",
    "issuer": "https://token.actions.githubusercontent.com",
    "subject": "repo:org/repo:ref:refs/heads/main",
    "audiences": ["api://AzureADTokenExchange"]
  }'
# then azure/login@v2 with client-id, tenant-id, subscription-id

pg_dump -h <host> -U <user> -d <db> -Fc -f backup-$(date +%F).dump
# custom format (-Fc) supports parallel restore
aws s3 cp backup-$(date +%F).dump s3://my-backups/postgres/

mysqldump -h <host> -u <user> -p --single-transaction --routines <db> > backup-$(date +%F).sql
gzip backup-$(date +%F).sql
aws s3 cp backup-$(date +%F).sql.gz s3://my-backups/mysql/

mongodump --uri="mongodb://user:pass@host:27017/app" --archive=backup-$(date +%F).gz --gzip
aws s3 cp backup-$(date +%F).gz s3://my-backups/mongo/

redis-cli -h <host> BGSAVE
redis-cli -h <host> LASTSAVE
# copy /var/lib/redis/dump.rdb to backup storage
scp redis-host:/var/lib/redis/dump.rdb ./backup-$(date +%F).rdb

velero backup create apps-$(date +%F) --include-namespaces apps --wait
velero backup describe apps-$(date +%F)
velero backup logs apps-$(date +%F)

ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-$(date +%F).db \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key
etcdctl snapshot status /backup/etcd-$(date +%F).db

terraform state pull > terraform.tfstate.backup-$(date +%F).json
# remote backend: enable S3 versioning on state bucket
aws s3api list-object-versions --bucket my-tf-state --prefix prod/terraform.tfstate

aws rds create-db-snapshot --db-instance-identifier mydb --db-snapshot-identifier mydb-pre-upgrade-$(date +%F)
aws rds wait db-snapshot-available --db-snapshot-identifier mydb-pre-upgrade-$(date +%F)
aws rds describe-db-snapshots --db-instance-identifier mydb

aws rds restore-db-instance-from-db-snapshot \
  --db-instance-identifier mydb-restore-test \
  --db-snapshot-identifier mydb-pre-upgrade-2026-06-21
# verify app against restore-test endpoint before cutover

aws s3 sync /etc/nginx s3://my-backups/nginx/$(hostname)/ --exclude "*.tmp"
aws s3 sync s3://my-backups/nginx/$(hostname)/ ./restore-test/ --dryrun

dig app.example.com +short
dig app.example.com ANY
nslookup app.example.com
# compare to ingress LB: kubectl get ingress -n apps

nc -zv backend.example.com 443
curl -v telnet://backend:8080
ss -tlnp | grep 8080

sudo systemctl status <service>
sudo systemctl restart <service>
sudo journalctl -u <service> -n 50 --no-pager
sudo systemctl is-active <service>

echo | openssl s_client -connect app.example.com:443 -servername app.example.com 2>/dev/null | openssl x509 -noout -dates -subject
# days left:
echo | openssl s_client -connect app.example.com:443 2>/dev/null | openssl x509 -noout -checkend 604800

#!/bin/bash
# /usr/local/bin/backup.sh — install via cron: 0 2 * * * /usr/local/bin/backup.sh
set -euo pipefail
BACKUP_DIR=/var/backups
DATE=$(date +%F)
pg_dump -U app appdb | gzip > "$BACKUP_DIR/appdb-$DATE.sql.gz"
find "$BACKUP_DIR" -name 'appdb-*.sql.gz' -mtime +14 -delete
aws s3 cp "$BACKUP_DIR/appdb-$DATE.sql.gz" s3://my-backups/cron/

# 1. Create parallel user
CREATE USER app_v2 WITH PASSWORD 'new-secret';
GRANT ALL ON DATABASE appdb TO app_v2;
GRANT ALL ON ALL TABLES IN SCHEMA public TO app_v2;
# 2. Update K8s secret + rollout restart
kubectl create secret generic db-creds --from-literal=password=new-secret -n apps --dry-run=client -o yaml | kubectl apply -f -
kubectl rollout restart deploy/myapp -n apps

kubectl create secret generic app-secrets \
  --from-literal=API_KEY=new-key \
  -n apps --dry-run=client -o yaml | kubectl apply -f -
kubectl rollout restart deploy/myapp -n apps
kubectl rollout status deploy/myapp -n apps

kubectl exec -it deploy/myapp -n apps -- env | grep AWS
kubectl exec -it deploy/myapp -n apps -- aws sts get-caller-identity
# expect role ARN matching ServiceAccount annotation

# after SA annotation change
kubectl rollout restart deploy -n apps
kubectl get pods -n apps -o jsonpath='{range .items[*]}{.metadata.name}{" SA="}{.spec.serviceAccountName}{"\n"}{end}'

vault kv put secret/apps/myapp db_password=new-secret api_key=new-key
vault kv get secret/apps/myapp
# External Secrets Operator syncs within refreshInterval

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
      - http01:
          ingress:
            class: nginx

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-dns
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: ops@example.com
    privateKeySecretRef:
      name: letsencrypt-dns
    solvers:
      - dns01:
          route53:
            region: us-east-1
            hostedZoneID: Z123456
# Certificate dnsNames: [example.com, '*.example.com']

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: internal-ca
  namespace: apps
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: internal-tls
  namespace: apps
spec:
  secretName: internal-tls
  issuerRef:
    name: internal-ca
  dnsNames:
    - svc.apps.svc.cluster.local

for ctx in staging prod; do
  echo "=== $ctx ==="
  kubectl --context=$ctx get deploy -n apps -o custom-columns=NAME:.metadata.name,IMAGE:.spec.template.spec.containers[0].image
done

terraform workspace list
terraform workspace select staging && terraform plan -no-color > /tmp/plan-staging.txt
terraform workspace select prod && terraform plan -no-color > /tmp/plan-prod.txt
diff -u /tmp/plan-staging.txt /tmp/plan-prod.txt || true

argocd app list
argocd app get <app> --refresh
argocd app sync <app>
argocd app diff <app>

argocd app get <app> --hard-refresh
kubectl patch application <app> -n argocd --type merge -p '{"operation":{"initiatedBy":{"username":"admin"},"sync":{"revision":"HEAD"}}}'

flux get sources git -A
flux get kustomizations -A
flux reconcile source git <name> -n flux-system
flux reconcile kustomization <name> -n flux-system --with-source

pipeline {
  agent any
  stages {
    stage('Deploy') {
      steps {
        withKubeConfig([credentialsId: 'kubeconfig']) {
          sh 'kubectl apply -f k8s/'
          sh 'kubectl rollout status deploy/myapp -n apps'
        }
      }
    }
  }
}

# describe shows probe failures
kubectl describe pod <pod> -n <ns> | grep -A3 Liveness
# common fix — separate paths, longer initialDelaySeconds
readinessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 15
  periodSeconds: 10
livenessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 30
  failureThreshold: 3

kubectl get hpa -n <ns>
kubectl describe hpa <name> -n <ns>
kubectl get --raw "/apis/metrics.k8s.io/v1beta1/namespaces/<ns>/pods" | head
# metrics-server must be running

sum by (pod, namespace) (rate(container_cpu_cfs_throttled_seconds_total[5m]))

# top throttled
 topk(10, sum by (pod) (rate(container_cpu_cfs_throttled_seconds_total[5m])))

sum by (pod, namespace) (container_memory_working_set_bytes)
/
sum by (pod, namespace) (kube_pod_container_resource_limits{resource="memory"}) * 100

# OOM risk > 90%

kubectl auth can-i create deployments -n apps
kubectl auth can-i get secrets --as=system:serviceaccount:apps:default -n apps
kubectl describe rolebinding -n apps

curl -s http://localhost:9200/_cluster/health?pretty
curl -s http://localhost:9200/_cat/indices?v
curl -s http://localhost:9200/_cat/shards?v | grep UNASSIGNED

deploy:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl config use-context org/cluster
    - kubectl apply -f k8s/
    - kubectl rollout status deploy/myapp -n apps
  only:
    - main

name: Deploy Pages
on:
  push:
    branches: [main]
permissions:
  contents: read
  pages: write
  id-token: write
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/configure-pages@v5
      - uses: actions/upload-pages-artifact@v3
        with:
          path: ./public
      - uses: actions/deploy-pages@v4

ssh -J bastion@jump.example.com user@10.0.2.50
# ~/.ssh/config:
# Host private
#   ProxyJump bastion@jump.example.com
#   HostName 10.0.2.50
#   User deploy

sudo apt install fail2ban
sudo tee /etc/fail2ban/jail.local <<'EOF'
[sshd]
enabled = true
port = ssh
maxretry = 5
bantime = 3600
EOF
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

chronyc tracking
chronyc sources -v
timedatectl status