Learn DevOps in order, not in circles.

Terraform describes your infrastructure in code so it's repeatable, reviewable, and versioned — instead of clicking through a console and hoping someone remembers what they changed.

State is the part beginners underestimate. Terraform's state file is its source of truth about what exists. Never edit it by hand, and never leave it on a laptop — use a remote backend (S3 + DynamoDB locking is the standard AWS pattern) so your team shares one source of truth.

Always plan before you apply. terraform plan shows exactly what will change before it happens. Skipping this step is how people accidentally delete production databases.

Modules let you package reusable infrastructure patterns (a VPC, an EKS cluster) so you're not rewriting the same 200 lines for every environment.

Docker runs one container. Kubernetes runs thousands of them, reliably, across many machines — restarting what crashes, spreading load, and rolling out updates without downtime.

Pods are the smallest unit — usually one container each, though a pod can hold more. You rarely create pods directly; you describe a Deployment, and Kubernetes keeps the right number of pods running for you.

Services give a stable network identity to a moving set of pods. Pods die and get replaced constantly — a Service is what stays consistent so other things can find them.

CrashLoopBackOff is the error every beginner meets — it means your pod is starting, crashing, and Kubernetes is retrying with backoff. Always check kubectl logs and kubectl describe pod first, in that order.

Continuous Integration means every code change is automatically built and tested the moment it's pushed — catching problems in minutes, not weeks. Continuous Deployment takes it further and automatically ships changes that pass those checks.

A typical pipeline: push code → run tests → build a container image → push image to a registry → deploy to staging → (manual or automatic) promote to production.

Keep pipelines fast. A 40-minute pipeline gets skipped, ignored, or bypassed under pressure. Parallelize test suites and cache dependencies aggressively.

Treat your pipeline config as code too — reviewed, versioned, and tested like everything else in the repo.

At scale, the questions change from "does it run" to "does it survive a bad day." Networking and autoscaling are where that gets tested.

Ingress vs Service — a Service load-balances inside the cluster; an Ingress controller handles external HTTP(S) traffic, routing by host or path to the right Service, usually with TLS termination.

HPA (Horizontal Pod Autoscaler) scales pod count based on CPU, memory, or custom metrics. Pair it with resource requests and limits — without them, the scheduler is guessing, and the autoscaler has nothing reliable to measure.

Network policies default to allowing all pod-to-pod traffic — a security gap most teams don't close until an audit forces them to. Explicit-deny-by-default with targeted allow rules is the safer pattern in production.

One giant Terraform state file for your entire company is a liability — a mistake anywhere can block changes everywhere, and applies get slower as state grows.

Split state by environment and blast radius. Separate state for networking, for each environment (dev/staging/prod), and for high-change-frequency components — so a bad apply in dev can never touch prod state.

Use workspaces carefully. Terraform workspaces are useful for near-identical environments, but many teams find separate state files with shared modules easier to reason about than workspaces at real scale.

Drift happens when someone changes infra outside Terraform (console click-ops, another tool). Run terraform plan regularly even with no code changes, to catch drift before it surprises you mid-incident.

Most real security incidents in the cloud aren't exotic hacks — they're an overly broad IAM policy or a leaked key.

Least privilege means every role gets only the permissions it needs, nothing more. It's tedious to set up and it's the single biggest thing that limits damage when something does go wrong.

Never use long-lived access keys where you can avoid it. Use IAM roles with short-lived credentials — for CI/CD, OIDC federation lets your pipeline assume a role without storing any secret at all.

Secrets don't belong in code, ever — not in a repo, not in a Terraform variable file. Use a secrets manager (AWS Secrets Manager, Vault) and inject at runtime.