DevOps Ready Reckoner: Essential Cheat Sheets

A single reference page for the tools DevOps engineers reach for daily: Terraform, Kubernetes, kubectl, K3s, Docker, Docker Compose, Helm, Ansible, Git, and CI/CD. Bookmark it, search it, and use it when you need the command or YAML skeleton fast.

Terraform Cheat Sheet

Terraform manages infrastructure through declarative HCL files and a state file that tracks what exists in the real world.

CLI essentials

Project structure

project/
├── main.tf           # Primary resources
├── variables.tf      # Input variables
├── outputs.tf        # Exported values
├── providers.tf      # Provider configuration
├── versions.tf       # Terraform & provider version pins
├── terraform.tfvars  # Variable values (do not commit secrets)
└── modules/
    └── vpc/
        ├── main.tf
        ├── variables.tf
        └── outputs.tf

HCL skeleton

terraform {
  required_version = ">= 1.6.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {
    bucket = "my-tf-state"
    key    = "prod/terraform.tfstate"
    region = "ap-south-1"
  }
}

provider "aws" {
  region = var.region
}

variable "region" {
  type    = string
  default = "ap-south-1"
}

locals {
  common_tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

resource "aws_s3_bucket" "logs" {
  bucket = "${var.project}-logs"
  tags   = local.common_tags
}

output "bucket_name" {
  value = aws_s3_bucket.logs.id
}

Common patterns

kubectl Cheat Sheet

kubectl is the CLI for Kubernetes. Install it separately or use it through K3s (k3s kubectl).

Context and configuration

Pods and workloads

Deployments, Services, Ingress

Debugging and troubleshooting

Useful output formats

kubectl get pods -o jsonpath='{.items[*].metadata.name}'
kubectl get nodes -o custom-columns=NAME:.metadata.name,STATUS:.status.conditions[-1].type
kubectl get deploy myapp -o jsonpath='{.spec.replicas}'

Kubernetes YAML Quick Reference

Core API objects every DevOps engineer should recognize.

Deployment + Service + Ingress

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: production
  labels:
    app: api
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
        - name: api
          image: myregistry/api:1.2.0
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 15
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
          envFrom:
            - configMapRef:
                name: api-config
            - secretRef:
                name: api-secrets
---
apiVersion: v1
kind: Service
metadata:
  name: api
  namespace: production
spec:
  selector:
    app: api
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api
  namespace: production
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    - hosts: [api.example.com]
      secretName: api-tls
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 80

ConfigMap, Secret, HPA, PVC

apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  LOG_LEVEL: info
  FEATURE_FLAG_X: "true"
---
apiVersion: v1
kind: Secret
metadata:
  name: api-secrets
type: Opaque
stringData:
  DATABASE_URL: postgres://user:pass@db:5432/app
---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api
  minReplicas: 2
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: gp3
  resources:
    requests:
      storage: 20Gi

Service types

K3s Cheat Sheet

K3s is a lightweight, CNCF-certified Kubernetes distribution from Rancher. Ideal for edge, IoT, CI runners, and homelab clusters. It bundles containerd, CoreDNS, Traefik ingress, local-path storage, and a single binary.

Install

# Server (control plane + worker)
curl -sfL https://get.k3s.io | sh -

# Agent (join worker node)
curl -sfL https://get.k3s.io | K3S_URL=https://<server-ip>:6443 \
  K3S_TOKEN=<node-token> sh -

# Node token (on server)
sudo cat /var/lib/rancher/k3s/server/node-token

Service management

K3s vs full Kubernetes

Common install flags

# /etc/rancher/k3s/config.yaml
write-kubeconfig-mode: "0644"
tls-san:
  - "k3s.example.com"
disable:
  - traefik
cluster-cidr: "10.42.0.0/16"
service-cidr: "10.43.0.0/16"

Dockerfile Structure

A Dockerfile is a ordered list of instructions that build an OCI image layer by layer.

Instruction reference

Multi-stage production template

# syntax=docker/dockerfile:1

# --- Build stage ---
FROM golang:1.22-alpine AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /app .

# --- Runtime stage ---
FROM gcr.io/distroless/static-debian12:nonroot
WORKDIR /
COPY --from=builder /app /app
USER nonroot:nonroot
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s CMD ["/app", "healthcheck"]
ENTRYPOINT ["/app"]

Node.js example

FROM node:20-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev

FROM node:20-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY --from=deps /app/node_modules ./node_modules
COPY . .
USER node
EXPOSE 3000
CMD ["node", "server.js"]

.dockerignore essentials

.git
node_modules
dist
*.log
.env
Dockerfile*
docker-compose*
README.md
.terraform

Build and run

docker build -t myapp:1.0.0 .
docker build --target builder -t myapp:build .
docker run -d -p 8080:8080 --name myapp myapp:1.0.0
docker exec -it myapp sh
docker logs -f myapp

Docker Compose YAML Structure

Compose defines multi-container applications in a single YAML file. Compose Specification v2 is the current standard (use docker compose, not legacy docker-compose).

Top-level keys

Full stack template

name: mystack

services:
  api:
    build:
      context: ./api
      dockerfile: Dockerfile
      target: production
    image: myregistry/api:${TAG:-latest}
    restart: unless-stopped
    ports:
      - "8080:8080"
    environment:
      DATABASE_URL: postgres://app:secret@db:5432/app
      REDIS_URL: redis://cache:6379/0
    env_file:
      - .env
    depends_on:
      db:
        condition: service_healthy
      cache:
        condition: service_started
    networks:
      - backend
    volumes:
      - api-data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 20s
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: app
      POSTGRES_PASSWORD: secret
      POSTGRES_DB: app
    volumes:
      - pg-data:/var/lib/postgresql/data
    networks:
      - backend
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U app -d app"]
      interval: 10s
      timeout: 5s
      retries: 5

  cache:
    image: redis:7-alpine
    networks:
      - backend

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
    depends_on:
      - api
    networks:
      - backend
      - frontend
    profiles:
      - proxy

networks:
  backend:
    driver: bridge
  frontend:
    driver: bridge

volumes:
  pg-data:
  api-data:

Compose CLI

Helm Cheat Sheet

Helm is the package manager for Kubernetes. Charts are templated YAML bundles versioned and released as units.

CLI

Chart structure

mychart/
├── Chart.yaml
├── values.yaml
├── templates/
│   ├── deployment.yaml
│   ├── service.yaml
│   ├── ingress.yaml
│   └── _helpers.tpl
└── charts/          # Subchart dependencies

values.yaml snippet

replicaCount: 3
image:
  repository: myregistry/api
  tag: "1.2.0"
  pullPolicy: IfNotPresent
service:
  type: ClusterIP
  port: 80
ingress:
  enabled: true
  host: api.example.com
resources:
  limits:
    cpu: 500m
    memory: 512Mi

Ansible Quick Reference

Ansible automates configuration management and ad-hoc tasks over SSH (or WinRM) with YAML playbooks.

CLI

Inventory (INI)

[webservers]
web1 ansible_host=10.0.1.10
web2 ansible_host=10.0.1.11

[webservers:vars]
ansible_user=ubuntu
ansible_ssh_private_key_file=~/.ssh/id_ed25519

Playbook skeleton

---
- name: Configure web servers
  hosts: webservers
  become: true
  vars:
    app_port: 8080
  tasks:
    - name: Install nginx
      ansible.builtin.package:
        name: nginx
        state: present

    - name: Deploy config
      ansible.builtin.template:
        src: nginx.conf.j2
        dest: /etc/nginx/nginx.conf
      notify: Reload nginx

  handlers:
    - name: Reload nginx
      ansible.builtin.service:
        name: nginx
        state: reloaded

Common modules

Git & CI/CD Quick Reference

Git essentials

GitHub Actions workflow skeleton

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: npm

      - run: npm ci
      - run: npm test
      - run: npm run build

  terraform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform fmt -check
        working-directory: infra
      - run: terraform init -backend=false
        working-directory: infra
      - run: terraform validate
        working-directory: infra

Pipeline stages (mental model)

Linux & Shell One-Liners

For deeper Linux coverage, see Linux Fundamentals. These one-liners cover daily DevOps tasks.

Observability Quick Reference

Prometheus PromQL starters

rate(http_requests_total[5m])
histogram_quantile(0.99, sum(rate(http_request_duration_seconds_bucket[5m])) by (le))
up{job="kubernetes-pods"} == 0

Incident checklist

• What changed? (deploy, config, traffic, dependency)
• Is it global or isolated? (one pod, one AZ, all users)
• Check: kubectl get pods, events, recent deploys, dashboards, error rate
• Mitigate first (rollback, scale, feature flag), root-cause second
• Document timeline and write a blameless postmortem