Enterprise-Grade Runbooks, Architectural Decision Records (ADRs), 660+ HLD Diagrams & 700+ Interview Scenarios
Curated by Mihir Maurya · Enterprise Cloud Architect & DevSecOps
🧭 Obsidian Launchpad: Open the interactive knowledge graph and central navigation hub via [[Dashboard]]
This vault is an enterprise-architect-grade knowledge base developed and maintained by Mihir Maurya. It provides complete, production-verified reference material across the full cloud and DevOps engineering spectrum — from low-level Linux systems internals to multi-region Azure Landing Zones and autonomous Agentic AI architectures.
Every architectural guide in this vault adheres to rigorous enterprise standards:
- 🏛️ High-Level Design (HLD) Architecture: Every topic includes custom, syntax-verified Mermaid diagrams visualizing traffic flow, state transitions, failover sequences, and security boundaries.
- 🎯 Multi-Tier Scenario Interview Preparation: Every topic covers scenario-based questions across 4 distinct competency levels:
- Tier 1: Junior (Foundations) — Internal mechanics, CLI flags, configuration syntax.
- Tier 2: Mid-Level (DevOps/Implementation) — CI/CD pipelines, state management, module chaining, rolling deployments.
- Tier 3: Senior (SRE/Hardening) — Outages, blast-radius mitigation, MTTR, drift recovery, zero-trust security.
- Tier 4: Principal / Enterprise Architect (Systems Design/Governance) — Multi-region topologies, cost governance, CAF alignment, enterprise compliance.
- 📐 Microsoft Cloud Adoption Framework (CAF) Alignment: Strict subscription democratization, management group governance, automated policy-driven guardrails, and hub-and-spoke connectivity.
- 🛡️ Zero-Trust & Security Hardening: OIDC secretless federation, Private Endpoints, least-privilege RBAC, and automated static code/secret scanning.
- 📊 Obsidian & LaTeX Suite Optimized: 100% compliant with Obsidian Markdown and
obsidian-latex-suitewith zero rendering or parsing glitches.
Vault Engine: Obsidian | Architect: Mihir Maurya | Last Updated: November 2026
| # | Module | Description | Core Focus & Coverage | MOC Link |
|---|---|---|---|---|
| 🏗️ | 01 — Terraform | Enterprise IaC & State Engineering | State theory, modules, locking, lifecycle, resource library | 01-Terraform MOC.md |
| ☁️ | 02 — Azure | Core Cloud Platform & Networking | VNet, Subnets, AKS, Key Vault, Storage, AppGW, Front Door | 02-Azure MOC.md |
| 🏢 | 03 — Landing Zone | Microsoft CAF Enterprise-Scale | Management groups, subscription vending, network topology | 03-Landing-Zone MOC.md |
| 🔄 | 04 — CI/CD | Continuous Delivery & GitOps | Azure DevOps, GitHub Actions, OIDC, ArgoCD, Canary | 04-CI-CD MOC.md |
| 🐧 | 05 — Linux | OS Internals & Systems Engineering | Kernel, FHS, text processing, systemd, networking, bash | 05-Linux MOC.md |
| 🏛️ | 06 — Architecture Patterns | High-Availability & Resiliency | 3-Tier, Hub-Spoke, Multi-Region, DR (RPO/RTO), Zero-Trust | 06-Architecture-Patterns MOC.md |
| 🎯 | 07 — Interview Prep | Domain Deep Dives & Scenarios | Azure, Terraform, K8s, Linux, Security scenario walkthroughs | 07-Interview-Prep MOC.md |
| 🔨 | 08 — Real-World Projects | Production Implementations | Axion 3-Tier Enterprise, AKS Zero-Trust, ALZ Deployment | 08-Real-World-Projects MOC.md |
| 📋 | 09 — Decision Logs | Architectural Decision Records | ADRs documenting trade-offs, state backends, RBAC scopes | 09-Decision-Logs MOC.md |
| 🗺️ | 10 — CAF Mapping | Cloud Adoption Framework Strategy | Workload alignment across Strategy, Plan, Ready, Adopt | 10-CAF-Mapping MOC.md |
| 📅 | 11 — Weekly Learning | Milestone Progress & Roadmap | Engineering tracker, syllabus milestones, mastery logs | 11-Weekly-Learning MOC.md |
| 🤖 | 12 — Agentic AI | Autonomous AI in DevOps & SRE | ReAct agents, MCP protocol, LangGraph, tool calling, RAG | 12-Agentic-AI MOC.md |
| 🌿 | 13 — Git | Enterprise Version Control & PRs | Trunk-based vs GitFlow, pre-commit, branch protection, CLI | 13-Git MOC.md |
| 🔐 | 14 — Security Scanning | DevSecOps & Shift-Left Scanners | TFLint, tfsec, Checkov, Trivy, TruffleHog, Gitleaks | 14-Security-Scanning MOC.md |
| 💰 | 15 — Cost & Governance | FinOps & Resource Optimization | OpenCost on AKS, Infracost in CI/CD, Tagging, Least-Privilege | 15-Cost-Governance MOC.md |
| ❓ | 16 — Master Interview Topics | 28 Enterprise Master Guides | Comprehensive technical interview question bank across 28 domains | 16-DI-Interview-Questions MOC.md |
Enterprise Infrastructure as Code from fundamentals to production landing zones.
📑 Module Map of Content:01-Terraform MOC.md
| Topic | File | Architectural Scope |
|---|---|---|
| 📖 Declarative vs Imperative | 01-Declarative-vs-Imperative.md |
Execution paradigms, idempotency, desired vs actual state |
| 📖 State Theory | 02-State-Theory.md |
State serialization, 3-way merge algorithm, schema migrations |
| Topic | File | Architectural Scope |
|---|---|---|
| 📖 Introduction | 01-Introduction.md |
Core engine architecture, RPC loopback, provider communication |
| ⚙️ Installation & Parity | 02-Installation.md |
tenv, tfenv, version pinning, global plugin caching |
| 🔌 Providers & Negotiation | 03-Providers.md |
Schema negotiation, gRPC wire protocol, version locking |
| 🧱 Resources & Graph Engine | 04-Resources.md |
Directed Acyclic Graph (DAG), CRUD lifecycle, meta-arguments |
| 📥 Variables & Validation | 05-Variables.md |
Type constraints, custom validation blocks, evaluation order |
| 🔧 Locals & Data Reshaping | 06-Locals.md |
Intermediate computation, DRY tag merges, map transformations |
| 📤 Outputs & Masking | 07-Outputs.md |
Cross-module contract boundaries, sensitive attribute masking |
| 💾 State Management | 08-State-Management.md |
Remote state locking, drift detection, state surgery (mv, rm) |
| 🌐 Remote Backend Architecture | 09-Remote-Backend.md |
Azure Blob Storage backend, blob lease concurrency, zero public access |
| 📦 Enterprise Modules | 10-Modules.md |
Standard module structure, semantic versioning, private registries |
| 🌍 Workspaces vs Directory Layout | 11-Workspaces.md |
Workspaces vs directory-per-environment isolation trade-offs |
| 🔍 Data Sources | 12-Data-Sources.md |
Read-only infrastructure queries, decoupled pipeline dependencies |
| 🔁 Loops & Conditionals | 20-Loops-Conditionals.md |
count vs for_each, index-shift hazard prevention, dynamic blocks |
| ♻️ Lifecycle Meta-Arguments | 14-Lifecycle.md |
create_before_destroy, prevent_destroy, ignore_changes |
| ⭐ Production Best Practices | 15-Best-Practices.md |
Blast radius containment, pipeline gating, golden standards |
| 🖥️ Commands Reference | 16-Commands-Reference.md |
Complete CLI reference — plan, apply, state, taint, import, console |
| 🎯 Master Interview Handbook | 18-Interview-Questions.md |
50 multi-tier scenario interview questions & deep architectural answers |
| 📝 Quick Reference Cheat Sheet | 19-Cheat-Sheet.md |
Emergency operations, CLI flags, state recovery commands |
| Resource | File | Production Configuration Pattern |
|---|---|---|
| 📋 Library Overview | 01-README.md |
Modular resource catalog & CAF naming standards |
| ☸️ Azure Kubernetes Service | 02-AKS.md |
Private cluster, Azure CNI Overlay, Workload Identity, system/user pools |
| 🔑 Key Vault | 03-Key-Vault.md |
Premium HSM, purge protection, Private Endpoint, RBAC authorization |
| 📊 Log Analytics | 04-Log-Analytics.md |
Dedicated cluster, Basic vs Analytics tiers, Data Collection Rules (DCR) |
| 🛡️ Network Security Group | 05-NSG.md |
ASG microsegmentation, stateful priority rules, logging flow logs |
| 📁 Resource Group | 06-Resource-Group.md |
Lifecycle blast-radius containment, mandatory tagging, CanNotDelete locks |
| 💾 Storage Account | 07-Storage-Account.md |
TLS 1.3, blob lifecycle policies, immutability, Private Link integration |
| 🔀 Subnet Architecture | 08-Subnet.md |
Service delegation, reserved Azure IP offsets, route table associations |
| 🖥️ Virtual Machine | 09-VM.md |
Ephemeral OS disks, Accelerated Networking, cloud-init, managed identity |
| 🌐 Virtual Network | 10-VNet.md |
Hub-spoke peering, gateway transit, non-overlapping enterprise IPAM |
| 🚪 NAT Gateway | NAT-Gateway.md |
Subnet-level egress, SNAT port scale (64k per IP), idle timeout tuning |
| 🔌 Network Interface | Network-Interface.md |
Accelerated Networking, private IP configurations, IP forwarding |
| 🌐 Public IP | Public-IP.md |
Standard SKU, Zone-redundancy, DDoS protection, edge routing preference |
Core Azure infrastructure services, networking fundamentals, compute, and security posture.
📑 Module Map of Content:02-Azure MOC.md
| Topic | File | Core Concept |
|---|---|---|
| ☁️ Cloud Models & Virtualization | 01-Cloud-Models-And-Virtualization.md |
Shared responsibility model, IaaS vs PaaS vs SaaS architectural boundaries |
| 💻 Virtualization Basics | 02-Virtualization-Basics.md |
Type-1 (Hyper-V) vs Type-2 hypervisors, cgroups, kernel namespaces |
| ❓ Cloud Fundamentals Q&A | 03-Interview-Questions.md |
SLA composite math, high availability vs disaster recovery |
| 🔄 Compute Workloads & Migration | Compute-Workloads-and-Migration.md |
The 6 R's rationalization matrix, Azure Migrate replication & cutover |
| 🌐 DNS & Routing Internals | 01-DNS-and-Routing.md |
Hybrid DNS resolution, Private DNS Zones, Azure DNS Private Resolver |
| 🔢 IP Addressing & CIDR Math | 02-IP-Addressing-and-CIDR.md |
Binary subnetting, CIDR prefix design, Azure 5 reserved IP addresses |
| 🔌 Ports & Network Protocols | 03-Ports-and-Protocols.md |
TCP 3-way handshake, TLS 1.3, stateful Layer 4 filtering vs Layer 7 inspection |
| ❓ Networking Foundations Q&A | 04-Interview-Questions.md |
MTU fragmentation, asymmetric routing, IPAM conflict remediation |
| Topic | File | Architecture & Production Implementation |
|---|---|---|
| 🧩 Azure Fundamentals | 01-Azure-Fundamentals.md |
Global physical infrastructure, paired regions, ARM REST APIs |
| 🏗️ Architecture Fundamentals | 02-Azure-Architecture-Fundamentals.md |
Availability Zones (1, 2, 3), fault/update domains, cross-zone latency |
| 🌐 Virtual Network (VNet) | 03-VNet.md |
VNet peering, gateway transit, non-transitive peering routing constraints |
| 🔀 Subnet Architecture | 04-Subnets.md |
Subnet sizing, dedicated platform subnets (GatewaySubnet, AzureFirewallSubnet) |
| 🌐 Service Endpoints | 05-Service-Endpoints.md |
Microsoft backbone routing vs Private Link, service endpoint policies |
| 🗺️ User-Defined Routes (UDR) | 06-Route-Tables.md |
Route tables, Longest Prefix Match (LPM), forced tunneling (0.0.0.0/0) |
| 🪪 Managed Identity | 08-Managed-Identity.md |
System-assigned vs User-assigned, IMDS endpoint, secretless token acquisition |
| 🔒 Key Vault | 09-Key-Vault.md |
FIPS 140-2 Level 3 HSM, access policies vs Azure RBAC, key rotation |
| 💾 Storage Account | 10-Storage-Account.md |
Hot/Cool/Cold/Archive tiers, immutable blob storage, GZRS replication |
| 📊 Azure Monitor | 11-Monitor.md |
Metrics, Application Insights, distributed tracing, action groups |
| ☸️ Azure Kubernetes Service | 13-AKS.md |
Private cluster architecture, Azure CNI Overlay vs Kubenet, auto-scaler |
| 📁 Resource Groups | 14-Resource-Groups.md |
Management boundaries, ARM template deployments, deletion cascades |
| 🖥️ Virtual Machines | 15-VM.md |
Sizing series (D/E/F), Accelerated Networking (SR-IOV), Ephemeral OS disks |
| ⚖️ VM Scale Sets (VMSS) | 16-VMSS.md |
Flexible vs Uniform orchestration, rolling upgrade policies, Spot VMSS |
| 🚪 Azure Bastion | 17-Bastion.md |
Web-based HTML5 RDP/SSH, zero public IPs on compute, Developer SKU |
| 🔌 Network Interfaces (NIC) | 18-NIC.md |
Accelerated Networking, multi-IP configurations, ASG association |
| 🛡️ Application Gateway v2 | 19-App-Gateway.md |
Layer 7 reverse proxy, WAF v2 (OWASP CRS), SSL offloading, AGIC |
| 🌍 Azure Front Door | 20-Front-Door.md |
Anycast edge routing, split-TCP acceleration, global WAF, private origin link |
| 🔀 Traffic Manager | 21-Traffic-Manager.md |
DNS routing methods (Priority, Weighted, Performance, Geographic) |
| ⚖️ Azure Load Balancer | 22-Load-Balancer.md |
Standard Layer 4 load balancer, HA Ports rule, outbound rules & SNAT |
| 🔗 Private Link & Endpoints | 23-Private-Link.md |
Private Link service, Private DNS zone group auto-registration |
| 🚢 Container Registry (ACR) | 24-ACR.md |
Premium SKU, automated geo-replication, vulnerability scanning, content trust |
| 🚇 Virtual Network Gateway | 25-Virtual-Network-Gateway.md |
ExpressRoute Private Peering, active-active IPsec VPN, BGP route exchange |
| 🛡️ Azure Policy | 26-Azure-Policy.md |
Policy definitions, initiatives, Deny, Audit, Modify, and DeployIfNotExists |
| 🔐 Microsoft Entra ID | 27-Entra-ID.md |
Cloud directory, identity federation, MFA, authentication protocols |
| 🏗️ Entra ID Architecture | 28-Entra-ID-Architecture.md |
Single vs multi-tenant architecture, Conditional Access policies, PIM |
| 💾 Azure Backup | 29-Azure-Backup.md |
Recovery Services Vault vs Backup Vault, CRR (Cross-Region Restore) |
| 🌩️ Azure Disaster Recovery | 30-Azure-DR.md |
Azure Site Recovery (ASR), cache storage accounts, RPO/RTO validation |
| 🛡️ Defender for Cloud & Security | 31-Azure-Security.md |
CSPM, CWPP, Secure Score, Microsoft Sentinel SIEM/SOAR integration |
| 🔑 Role-Based Access Control | 35-RBAC.md |
Management Group/Sub/RG/Resource scope tree, least privilege roles |
| 🛡️ Network Security Groups | 36-NSG.md |
Stateful 5-tuple packet matching, priority ordering, flow logging |
| 📋 Log Analytics Workspace | 37-Log-Analytics.md |
Centralized ingestion, KQL query mastery, data retention optimization |
| 📝 Azure CLI Cheat Sheet | 34-Cheat-Sheet.md |
High-speed command reference across all core resource providers |
| 🎯 Comprehensive Azure Q&A | 33-Interview-Questions.md |
50+ scenario-based interview questions across all 4 seniority tiers |
Microsoft Cloud Adoption Framework (CAF) Enterprise-Scale Landing Zone architecture.
📑 Module Map of Content:03-Landing-Zone MOC.md
| Topic | File | Core Concept |
|---|---|---|
| 🕸️ Hub-Spoke Theory | 01-Hub-Spoke-Theory.md |
Centralized security inspection vs decentralized spokes, transitive routing |
| 🔒 Zero Trust Foundations | 02-Zero-Trust-Basics.md |
Explicit verification, least privileged access, assume breach posture |
| ❓ Architecture Foundations Q&A | 03-Interview-Questions.md |
vWAN vs Traditional Hub-Spoke, routing intent, blast radius isolation |
| Topic | File | Enterprise Architecture Design Area |
|---|---|---|
| 📖 Introduction | 01-Introduction.md |
The 8 critical design areas, Landing Zone archetypes |
| 🗺️ CAF Methodology | 02-CAF-Overview.md |
Strategy, Plan, Ready, Adopt, Govern, Manage phases |
| 🏛️ Enterprise-Scale Architecture | 03-Enterprise-Scale.md |
Multi-subscription topology, separation of platform vs workload |
| 🏗️ Core Architecture Components | 04-Architecture.md |
Connectivity, Identity, Management, Workload spoke layout |
| 🗂️ Management Group Hierarchy | 05-Management-Groups.md |
Canonical tree: Root -> Platform (Conn/Mgmt/Id) & Workloads (Corp/Online) |
| 📋 Subscription Strategy | 06-Subscription-Strategy.md |
Subscription democratization, quota isolation, vending automation |
| 🏷️ Resource Organization & Naming | 07-Resource-Organization.md |
Structured naming convention (<res>-<app>-<env>-<region>-<nn>), mandatory tagging |
| 🆔 Identity & Access Management | 08-Identity-and-Access-Management.md |
Dedicated Identity subscription, Entra ID PIM, Emergency Access (Break-Glass) |
| 🌐 Network Topology & Routing | 09-Network-Topology-and-Connectivity.md |
Hub VNet, Azure Firewall Premium, ExpressRoute Gateway, hybrid DNS routing |
| 🛡️ Security Posture & Controls | 10-Security.md |
Microsoft Sentinel, Defender for Cloud, perimeter defense in depth |
| 📜 Policy-Driven Governance | 11-Policies.md |
Azure Policy initiatives, DINE automated remediation, archetype enforcement |
| 🏛️ Enterprise Governance | 12-Governance.md |
Regulatory compliance (PCI-DSS, HIPAA, NIST), cost guardrails |
| 📊 Operations Management | 13-Management.md |
Azure Update Manager, VM patching, cross-subscription alerting baseline |
| 👁️ Monitoring & Observability | 14-Monitoring.md |
Centralized Log Analytics Workspace, DCR transformation pipelines |
| 🤖 Platform Automation & DevOps | 15-Platform-Automation-and-DevOps.md |
GitOps infrastructure delivery, Terraform subscription vending machine |
| 💰 Billing & Entra ID Tenant | 16-Azure-Billing-and-Entra-Tenant.md |
EA / MCA enrollment account structure, single tenant trust boundary |
| 🏗️ Terraform Modular Landing Zone | 17-Terraform-Modular-Landing-Zone.md |
HashiCorp & Microsoft ALZ module implementation patterns |
| 🎯 Landing Zone Interview Q&A | 18-Interview-Questions.md |
50+ enterprise scenario questions covering migration, governance, and routing |
Automated continuous delivery pipelines, GitOps orchestration, and deployment strategies.
📑 Module Map of Content:04-CI-CD MOC.md
| Topic | File | Architectural Scope |
|---|---|---|
| 🌿 Branching Strategies | 01-Branching-Strategies.md |
Trunk-Based Development vs GitFlow, short-lived feature branches, feature flags |
| 🔁 GitOps Core Principles | 02-GitOps-Basics.md |
Declarative state, pull-based reconciliation loop, drift self-healing |
| Topic | File | Production Implementation |
|---|---|---|
| 🔵 Azure DevOps Pipelines | 01-Azure-DevOps.md |
Multi-stage YAML, environments, approvals & checks, self-hosted agent pools |
| 🐙 GitHub Actions | 02-GitHub-Actions.md |
Workflow triggers, matrix strategies, reusable workflows, environment protection |
| 🖥️ GitHub Actions Commands | 03-GitHub-Actions-Commands-Reference.md |
Complete reference: workflow syntax, contexts, runner expressions, toolkits |
| ☸️ AKS Deployment Automation | 04-AKS-Deployment.md |
Helm charts, Kustomize overlays, automated zero-downtime rolling updates |
| 🏗️ Terraform Pipeline (Azure DevOps) | 05-Terraform-Pipeline.md |
Plan artifact caching, manual approval gates, state lock release automation |
| 🚀 GitHub Actions + Azure OIDC | 06-GitHub-Actions-Terraform-OIDC.md |
Complete secretless authentication flow using OpenID Connect (OIDC) |
| 🔁 GitOps Fundamentals (ArgoCD) | 07-GitOps-Fundamentals.md |
ArgoCD application controllers, ApplicationSet, automated sync & prune |
| 🚀 Zero-Downtime Release Strategies | 08-Release-Strategy.md |
Blue-Green routing, Canary analysis with Prometheus metrics, Progressive Ring |
| ⚡ Pipeline Parallelism & Caching | 09-Pipeline-Parallelism-and-Optimization.md |
DAG orchestration, dependency caching, parallel security scanning |
| 📦 Parameterized Templates | 10-Parameterized-Pipelines-and-Templates.md |
Modular YAML template repos, compile-time vs runtime parameter evaluation |
| 🎯 CI/CD Scenario Interview Q&A | 11-Interview-Questions.md |
Pipeline debugging, secret leakage recovery, slow build optimization |
Linux kernel mechanics, systems administration, network troubleshooting, and shell scripting.
📑 Module Map of Content:05-Linux MOC.md
| Category | File | Production Engineering Focus |
|---|---|---|
| 🖥️ OS Fundamentals | 01-File-System-Hierarchy.md |
Linux FHS 3.0 (/proc, /sys, /etc, /var, /dev), VFS abstraction layer |
| ⚙️ Kernel Architecture | 02-Kernel-Architecture.md |
User space vs Kernel space, system calls, process scheduling, cgroups & namespaces |
| ⌨️ Core Navigation | 01-Navigation-and-Files.md |
File descriptors, hard vs soft links, find -exec, rsync, disk space diagnostics |
| 🔍 Text Processing | 02-Text-Processing-Grep-Awk-Sed.md |
High-speed log slicing: regex, awk columnar parsing, sed stream transformations |
| 🔐 Permissions & Security | 01-Users-Groups-Chmod.md |
Octal permissions, SUID/SGID/Sticky bit, POSIX ACLs (getfacl/setfacl), sudoers |
| 🔑 SSH & Key Management | 01-SSH-and-Keys.md |
Ed25519 cryptography, SSH agent forwarding, hardened sshd_config, jump bastions |
| 🌐 Network Troubleshooting | 02-Troubleshooting-cURL-Ping.md |
ss, netstat, ip route, tcpdump packet capture, MTU discovery, DNS resolution |
| ⏰ Job Scheduling | 01-Cron-Jobs.md |
Crontab syntax, systemd timers (.timer), distributed lock coordination |
| 📦 Package Management | 02-Package-Management-Apt.md |
APT repositories, GPG keyrings, package pinning, unattended security upgrades |
| 🔧 Systemd & Service Ops | 03-Systemd-and-Services.md |
Unit files ([Unit], [Service], [Install]), cgroups resource limits, journalctl |
| 📜 Automation Scripts | 01-Automation-Scripts.md |
Production scripts: log rotation, health checks, backup archival, auto-restart |
| 🔡 Bash Logic & Syntax | 02-Variables-and-Logic.md |
set -euo pipefail, array manipulations, conditional expressions, trap signals |
| 📝 Linux Quick Reference | 02-Cheat-Sheet.md |
Critical one-liners for troubleshooting CPU, RAM, disk, network, and sockets |
Battle-tested architectural patterns for high-availability, scalability, and disaster recovery.
📑 Module Map of Content:06-Architecture-Patterns MOC.md
| Pattern | File | Architectural Blueprint |
|---|---|---|
| 🏗️ 3-Tier Enterprise Architecture | 01-3-Tier-Architecture.md |
Strict web, application, and database tier isolation via subnets and NSGs |
| 🕸️ Hub-and-Spoke Topology | 02-Hub-Spoke.md |
Centralized transit hub, Azure Firewall inspection, perimeter edge protection |
| 🌍 Multi-Region Active-Active | 03-Multi-Region.md |
Global traffic routing (Front Door), Cosmos DB multi-master, Azure SQL failover |
| 🔥 Disaster Recovery (DR) Strategy | 04-DR-Strategy.md |
RPO vs RTO calculation, Backup/Restore, Pilot Light, Warm Standby, Hot Site |
| 🔒 Enterprise Zero-Trust Architecture | 05-Zero-Trust.md |
Identity as perimeter, continuous verification, microsegmentation, mTLS |
| 🏢 Enterprise Architecture Governance | 06-Enterprise-Architecture.md |
Architectural frameworks (TOGAF/CAF), architecture review boards (ARB) |
| 🤝 Shared Services Platform | 07-Shared-Services.md |
Centralizing domain controllers, artifact registries, SIEM, and monitoring |
| 🔗 Service Mesh & Microservices | 08-Service-Mesh.md |
Istio on AKS: sidecar injection, mTLS encryption, traffic splitting, circuit breaking |
Domain-focused scenario questions, whiteboard architectures, and behavioral frameworks.
📑 Module Map of Content:07-Interview-Prep MOC.md
| Domain | File | Deep Dive Scenario Coverage |
|---|---|---|
| ☁️ Azure Cloud Architecture | 01-Azure.md |
High availability, storage tiering, compute optimization, PaaS security |
| 🏢 Azure Landing Zones | 02-Landing-Zone.md |
Management group design, policy enforcement, hybrid routing, vending machines |
| 🐧 Linux & Systems Administration | 03-Linux.md |
Troubleshooting high load average, OOM killer, zombie processes, socket exhaustion |
| 🌐 Enterprise Cloud Networking | 04-Networking.md |
Asymmetric routing, ExpressRoute vs VPN failover, private DNS resolution |
| 🎯 Strategy & Profile Introductions | 05-Interview-Strategy-and-Introductions.md |
5 tailored professional profiles (Cloud/DevOps/SRE/Platform/Architect) |
| 🛡️ Security & Zero-Trust Posture | 06-Security.md |
Key Vault compromise mitigation, identity theft, container breakout defense |
| 🏗️ Terraform & Infrastructure as Code | 07-Terraform.md |
State file corruption, lock release, refactoring with moved blocks, drift |
| 🔄 CI/CD & Automation Pipelines | 08-CI-CD.md |
Pipeline security, secretless OIDC runners, blue-green deployment failures |
| ☸️ Kubernetes & Container Platforms | 09-Kubernetes-Docker.md |
CrashLoopBackOff, pod eviction, horizontal pod autoscaling, ingress failures |
| 🎭 Whiteboard & Scenario-Based Challenges | 10-Scenario-Based.md |
"Diagnose a catastrophic production outage" end-to-end whiteboard walkthroughs |
Production-ready reference implementations complete with architecture diagrams, code, and trade-offs.
📑 Module Map of Content:08-Real-World-Projects MOC.md
| Project | File | Technical Implementation Stack |
|---|---|---|
| ☸️ Production AKS Platform | 01-AKS-Platform.md |
Private AKS + ACR + Key Vault + OIDC + Azure CNI Overlay |
| 🌐 Multi-Region Enterprise Network | 02-Enterprise-Network.md |
Dual-region Hub-Spoke + Azure Firewall Premium + ExpressRoute Gateway |
| 🏢 Enterprise Landing Zone Deployment | 03-Landing-Zone-Deployment.md |
Complete CAF Enterprise-Scale deployment using Terraform |
| 🔒 Secure Zero-Trust Hub-and-Spoke | 04-Secure-Hub-Spoke.md |
Forced tunneling, centralized egress, Private Endpoints for all PaaS |
| 🤖 Agentic AI Industry Solutions | 05-Agentic-AI-Industry-Projects.md |
Autonomous SRE agents deployed across Healthcare, Energy, and Automotive |
| 🚀 Axion 3-Tier Enterprise Web Platform | 06-Axion-3-Tier-Enterprise-Project.md |
React frontend, Python FastAPI backend, Azure PostgreSQL Flexible Server PaaS |
Architecture Decision Records documenting engineering rationale, trade-offs, and consequences.
📑 Module Map of Content:09-Decision-Logs MOC.md
| ADR ID | File | Architectural Decision & Rationale |
|---|---|---|
| ADR-001 | 01-Hub-Spoke.md |
Traditional Hub-Spoke with Azure Firewall vs Virtual WAN for bounded spoke topologies |
| ADR-002 | 02-RBAC-Model.md |
Custom RBAC roles vs built-in Contributor/Owner for strict least-privilege compliance |
| ADR-003 | 03-Remote-State.md |
Azure Blob Storage with blob lease locking vs Terraform Cloud / Consul backend |
| ADR-004 | 04-Security-Controls.md |
Native Azure Security (Defender for Cloud + Sentinel) vs third-party security appliances |
Aligning technical infrastructure implementations directly to Microsoft Cloud Adoption Framework pillars.
📑 Module Map of Content:10-CAF-Mapping MOC.md
| Document | File | Scope |
|---|---|---|
| 📄 Cloud Adoption Framework Mapping | 01-CAF-Mapping.md |
Comprehensive cross-reference mapping every vault module to Strategy, Plan, Ready, Adopt, Govern, and Manage phases |
Structured roadmap tracking engineering competencies and syllabus progression.
📑 Module Map of Content:11-Weekly-Learning MOC.md
| Document | File | Purpose |
|---|---|---|
| 📅 Progress Tracker & Syllabus | 01-Progress-Tracker.md |
Multi-week milestone tracker verifying 100% mastery across Linux, Azure, Terraform, CI/CD, and Security |
The frontier of DevOps & Platform Engineering: Autonomous agents, Model Context Protocol (MCP), and LLM orchestration.
📑 Module Map of Content:12-Agentic-AI MOC.md
| Step | File | Agentic AI Architecture Focus |
|---|---|---|
| 🗺️ Roadmap | 01-Roadmap.md |
Complete learning path for building autonomous AI agents in platform engineering |
| 🧠 Foundations | 02-Introduction.md |
Deterministic automation vs LLMs, the ReAct (Reason + Act) loop, state machines |
| 🛠️ Tool Calling | 03-Tool-Calling.md |
JSON function calling schemas, tool execution security sandboxes, output parsing |
| 🚀 DevOps Use Cases | 04-DevOps-Use-Cases.md |
Automated incident triage, log root-cause analysis, self-healing infrastructure |
| ❓ Agentic AI Q&A | 05-Interview-Questions.md |
Prompt injection defense, hallucination guardrails, human-in-the-loop workflows |
| 🐍 Python Mastery | 06-Python-for-Agentic-AI.md |
Async Python, Pydantic data validation, Tenacity retry logic, REST clients |
| 🔗 Chains & RAG | 07-LLM-Chains-n8n-RAG.md |
Retrieval-Augmented Generation over runbooks, vector embeddings, n8n workflows |
| 🤖 Frameworks | 08-Agent-Frameworks.md |
In-depth comparison: LangChain, LangGraph (cyclic graphs), CrewAI multi-agent crews |
| 🔌 Protocol Standards | 09-MCP-and-A2A.md |
Anthropic Model Context Protocol (MCP) servers/clients & Agent-to-Agent communication |
| 🏆 Governance & FinOps | 10-AI-Governance-Cost-Observability.md |
Token budgeting, latency monitoring, LangSmith telemetry, enterprise guardrails |
Enterprise version control, branch protection, code review standards, and GitHub CLI automation.
📑 Module Map of Content:13-Git MOC.md
| Topic | File | Engineering Scope |
|---|---|---|
| 🌐 Introduction | 01-Introduction.md |
Distributed VCS architecture, Git internals (blobs, trees, commits, refs) |
| 📁 Repository Setup | 02-Repository-Setup.md |
Repository bootstrapping, .gitignore templates, branch protection rules |
| 🌿 Branching Strategies | 03-Branching-Strategies.md |
Trunk-Based Development, GitFlow, GitHub Flow, merge types (merge vs squash vs rebase) |
| 🖥️ Commands Reference | 04-Commands-Reference.md |
Complete CLI reference for Git and GitHub CLI (gh), interactive rebase, cherry-pick |
| 🔄 Core Enterprise Workflow | 05-Core-Workflow.md |
Feature branch lifecycle: atomic commits, Pull Request templates, code review |
Shift-left automated security, static analysis, and secrets detection in enterprise CI/CD pipelines.
📑 Module Map of Content:14-Security-Scanning MOC.md
| Scanner | File | Tool Purpose & Pipeline Integration |
|---|---|---|
| 🔧 Terraform Built-ins | 01-Terraform-Built-ins.md |
terraform fmt -check, terraform validate in pre-commit and PR gates |
| 🔍 TFLint | 02-TFLint.md |
Static HCL linter checking deprecated syntax, naming rules, and cloud provider rules |
| 🛡️ Tfsec | 03-Tfsec.md |
AST-based security scanner detecting misconfigurations and unencrypted resources |
| ✅ Checkov | 04-Checkov.md |
Policy-as-code scanner checking compliance against CIS, NIST, and HIPAA benchmarks |
| 🔬 Trivy | 05-Trivy.md |
Unified scanner for container images, OS packages, Kubernetes manifests, and IaC |
| 🐷 TruffleHog | 06-TruffleHog.md |
High-accuracy secrets detection with automated live API verification engines |
| 🔑 Gitleaks | 07-Gitleaks.md |
Fast regex + Shannon entropy secret detector designed for pre-commit git hooks |
| 📋 Security Index | README.md |
Architecture guide comparing AST vs regex scanners and SARIF CI integration |
FinOps, Kubernetes cost attribution, tagging taxonomies, and least-privilege cloud governance.
📑 Module Map of Content:15-Cost-Governance MOC.md
| Domain | File | Production Governance Framework |
|---|---|---|
| 📊 OpenCost on AKS | 01-OpenCost.md |
Real-time pod, namespace, and service cost attribution via Prometheus metrics |
| 🏷️ Resource Tagging Strategy | 02-Resource-Tagging.md |
Mandatory tagging taxonomy (CostCenter, Owner, Env), policy-driven tag inheritance |
| 📛 Naming Conventions | 03-Naming-Convention.md |
Cloud Adoption Framework compliant resource naming standard & HCL locals generator |
| 💡 Cost Optimization | 04-Cost-Optimization.md |
Reserved Instances (RIs), Azure Savings Plans, Spot VMSS, storage tier automation |
| 🔐 Least Privilege RBAC | 05-Least-Privilege-RBAC.md |
Scope hierarchies, custom role JSON definitions, Just-in-Time (JIT) elevation via PIM |
| 💰 Infracost (Shift-Left FinOps) | 06-Infracost.md |
Pull request cost estimation diffs, FinOps guardrail threshold gates in CI/CD |
28 comprehensive topic master guides covering real-world technical interview questions across all core DevOps & Cloud domains.
📑 Module Map of Content:16-DI-Interview-Questions MOC.md
| Topic | Direct Cheat Sheet Link | Architectural Coverage |
|---|---|---|
| 🏗️ Terraform CLI | 01-Terraform/19-Cheat-Sheet.md |
init, plan, apply, state surgery (mv, rm), import commands |
☁️ Azure CLI (az) |
02-Azure/34-Cheat-Sheet.md |
Management commands for VNets, VMs, AKS, Key Vault, and RBAC |
| 🐧 Linux Admin | 05-Linux/02-Cheat-Sheet.md |
Performance diagnostics (vmstat, iostat, ss), regex commands, permissions |
| 🔑 RBAC Quick Ref | 02-Azure/35-RBAC.md |
Scope hierarchies, built-in vs custom role JSON syntax |
| 🛡️ NSG Rules | 02-Azure/36-NSG.md |
Priority matrix, stateful 5-tuple evaluation, ASG tagging |
| 📜 KQL Queries | 02-Azure/37-Log-Analytics.md |
Production KQL queries for CPU spikes, failed logins, and network drops |
| 🌿 Git Commands | 13-Git/04-Commands-Reference.md |
Interactive rebasing, stash management, cherry-picking, gh CLI |
| 🔁 Terraform Loops | 01-Terraform/20-Loops-Conditionals.md |
count vs for_each vs dynamic blocks syntax examples |
================================================================================
🧠 DEVOPS & CLOUD ARCHITECT KNOWLEDGE VAULT STATS
================================================================================
📁 Architectural Modules: 16 Top-Level Knowledge Domains
📄 Total Markdown Documents: 921 Enterprise Notes
📐 High-Level Design (HLD) Diagrams: 660 Mermaid Architecture Diagrams
🎯 Scenario Interview Questions: 700+ Multi-Tier Technical Scenarios
🗺️ Maps of Content (MOCs): 16 Dedicated Domain Indexes + Master Dashboard
🛡️ Syntax & Health Audit: 100% Validated (0 Parsing Errors, 0 Broken Links)
================================================================================
This repository is maintained with continuous automated validation scripts to guarantee zero syntax degradation:
- 100% Strict Mermaid Validation: All 660 diagrams use canonical syntax with alphanumeric subgraph IDs and universally supported arrow operators (
-->|"label"|,<-->|"label"|). - LaTeX Suite Conflict-Free: All currency signs in prose are escaped (
\$50,\$0.018/GB) to preventobsidian-latex-suitefrom triggering math parsing errors, while mathematical formulas are properly formatted. - No Broken Links: All internal markdown and
file:///links are tested and validated.
Mihir Maurya
Enterprise Cloud Solutions Architect & DevSecOps Engineer
"Knowledge isn't just about accumulating information — it's about structuring it so clearly that execution becomes effortless."