Foundation
Interactive Tool
DevOps Engineer Roadmap 2026
From sysadmin to Kubestronaut — an opinionated, beginner-friendly learning path distilled from real field experience. Click any subtopic for a quick explanation.
Foundation Intermediate Advanced Expert
Foundation
Operating System
Foundation
Terminal Knowledge
Foundation
Version Control Systems
Foundation
Version Control Hosting
Foundation
Containers
Intermediate
Web Servers & Proxies
Intermediate
Networking & Protocols
Intermediate
Cloud Providers
Intermediate
Serverless
Intermediate
Configuration Management
Advanced
Provisioning
Advanced
CI/CD Tools
Advanced
Secret Management
Advanced
Infrastructure Monitoring
Advanced
Artifact Management
Advanced
GitOps
Advanced
Logs Management
Advanced
Container Orchestration
Expert
Observability
Expert
Service Mesh
Expert
Cloud Design Patterns
Expert
AI-Assisted DevOps & SRE
DevOps Curriculum: 23 Topics, 128 Subtopics
Click any topic to explore the tools, concepts, and skills in detail. Descriptions are written from field experience — practical, not theoretical.
Frequently Asked Questions
The most common questions about learning DevOps, answered from field experience.
01 Learn a Programming Language Foundation
Python
The de facto scripting language of DevOps. Cloud SDKs (boto3, azure-sdk), Ansible (written in Python), Terraform providers, and countless DevOps tools expose Python APIs. Learn variables, loops, functions, and HTTP requests (the requests library). First choice for automation and integration scripts.
Go (Golang)
Docker, Kubernetes, Terraform, and Prometheus are all written in Go. Statically typed, compiled, and high-performance. Goroutines and channels provide powerful concurrency. The ideal second language for DevOps for building CLI tools and microservices.
Ruby
Chef and Vagrant are written in Ruby. Readable syntax and a rich gem ecosystem. Capistrano for deployment automation is a classic use case. Still a valid option for config management tooling; highly expressive when combined with the Rails ecosystem.
Rust
A systems programming language that guarantees memory safety at compile time. AWS Firecracker (Lambda infrastructure) and Bottlerocket (container OS) are written in Rust. Hard to learn but increasingly popular for security-critical and high-performance infrastructure tools.
JavaScript / Node.js
One of the most common runtimes for AWS Lambda, Azure Functions, and Cloudflare Workers. Used for serverless functions, CLI tools, and IaC (AWS CDK, Pulumi). The npm ecosystem is vast — use npm audit or Snyk to scan dependencies for vulnerabilities.
02 Operating System Foundation
Linux Fundamentals
Linux is the foundation of DevOps. Master basic commands (ls, cd, ps, top), understand file ownership, and navigate the terminal confidently. Start with Ubuntu or CentOS — both are widely used in production.
File System Hierarchy
/etc (config files), /var (logs and variable data), /home (user directories), /tmp (temporary files), /usr (user programs). Memorize this hierarchy — it's standard across all Linux distributions.
Process Management
List running processes with ps aux, monitor live with top/htop, terminate with kill/pkill. Manage system services with systemctl start/stop/status/enable. Which service listens on which port? Use ss -tlnp to find out.
Users & Permissions
Learn chmod 755 (rwxr-xr-x), chown user:group, and sudo. Understand groups via /etc/passwd and /etc/group. Least privilege principle: a process should only have the permissions it needs — nothing more.
Windows Server
Widely used in enterprise environments. Core components: IIS (web server), Active Directory (identity management), PowerShell (automation), and Hyper-V (virtualization). Deep Azure integration. The standard platform for .NET and enterprise Microsoft applications.
FreeBSD / Unix
A reliable Unix variant with different licensing (BSD) and architectural decisions from Linux. Netflix uses FreeBSD for content delivery. Strengths: ZFS filesystem, Jail virtualization, and an advanced network stack. Valuable perspective for understanding OS fundamentals deeply.
03 Terminal Knowledge Foundation
Shell Scripting (Bash)
Write Bash scripts to automate repetitive tasks. Variables ($VAR), loops (for/while), conditionals (if/else), and functions are your building blocks. Start with backup scripts, log cleaners, and deployment helpers.
Text Editors (vim/nano)
vim is on every server. Core commands: i (insert mode), Esc (normal mode), :w (save), :q (quit), :wq (save & quit), dd (delete line), yy+p (copy & paste). nano is an easier starting point, but vim pays off long-term.
SSH & Remote Access
SSH lets you connect securely to remote servers. Generate a key pair with ssh-keygen, add the public key to ~/.ssh/authorized_keys. Configure multiple connections via ~/.ssh/config. Use port forwarding to create secure tunnels.
Pipes & Redirection
Chain commands with | (pipe): cat access.log | grep ERROR | wc -l. Overwrite with >, append with >>, redirect errors with 2>. Filter and transform data with grep, awk, sed, and cut. Combining these tools is extremely powerful.
Text Processing (grep/awk/sed)
Search text with grep 'ERROR' logfile, extract fields with awk '{print $2}', and substitute with sed 's/old/new/g'. These are daily tools for log analysis, data transformation, and config manipulation in production. Chained together, they are incredibly powerful.
System Performance Tools
Monitor live processes with top/htop, track memory and swap with vmstat, analyze disk I/O with iostat, and review historical data with sar. When a server slows down: uptime → free → vmstat → iostat → top. Memorize this 60-second diagnostic sequence.
04 Version Control Systems Foundation
Git Basics
git init (create repo), git add (staging), git commit (save changes), git push (send to remote), git pull (fetch from remote). Write descriptive commit messages: explain WHY you made the change, not WHAT you changed.
Branching & Merging
Create isolated branches with git checkout -b feature/my-feature. Merge back with git merge. Visualize commit history with git log --oneline --graph. Learn to resolve merge conflicts — it's an unavoidable skill.
Rebasing
git rebase main rewrites your commit history into a clean linear sequence. Use git rebase -i HEAD~3 to interactively edit the last 3 commits. Golden rule: never rebase a shared public branch — it rewrites history others depend on.
Tags & .gitignore
Tag releases with git tag v1.0.0 and share with git push origin --tags. Use .gitignore to exclude .env (secrets!), node_modules/, dist/, and __pycache__/ from tracking. gitignore.io provides ready-made templates for any stack.
05 Version Control Hosting Foundation
GitHub
The world's largest code platform. Pull Requests for code review, GitHub Actions for CI/CD, Issues for task tracking, and GitHub Pages for free static hosting. The standard platform for open source contribution.
GitLab
Self-hosted or cloud. Integrates CI/CD natively — no extra tools needed. Define powerful pipelines via .gitlab-ci.yml. Built-in Container Registry included. Popular for privacy-sensitive projects needing on-premise hosting.
Bitbucket
Atlassian's Git platform, tightly integrated with Jira and Confluence. CI/CD via Bitbucket Pipelines. The natural choice for teams already using Jira. Strong Pull Request workflows with inline commenting.
Azure Repos
Git-based source control as part of Azure DevOps. Integrates seamlessly with Azure Pipelines. Ideal for .NET projects and enterprise Microsoft ecosystems. Also supports TFVC (Team Foundation Version Control) for legacy teams.
06 Containers Foundation
Docker Fundamentals
Containers package your app and its dependencies into a portable unit — eliminating the 'it works on my machine' problem. Daily tools: docker run, docker ps -a, docker logs, docker exec -it, and docker rm.
Dockerfile
The recipe for building a Docker image. FROM (base image), RUN (execute command), COPY (copy files), WORKDIR (working directory), EXPOSE (port), CMD (default command). Use Alpine-based images to start — small and secure.
Docker Compose
Define multi-container apps (web + db + redis) in docker-compose.yml and start everything with docker compose up -d. Manage service dependencies (depends_on), networks, and volumes in one file. Essential for local development.
Container Registries
Docker Hub (public), AWS ECR, GitHub GHCR, and Azure ACR store and distribute Docker images. In CI/CD: build → push to registry → pull during deployment. Never skip versioning — tag every image you push.
LXC (Linux Containers)
The container technology that predates Docker — runs full OS containers rather than application containers. LXC runs an entire Linux distribution inside a container, providing near-VM isolation at container speed. Platforms like Proxmox use LXC under the hood.
Container Security
Run containers as a non-root user (USER directive), use read-only filesystems, and minimize Linux capabilities. Scan every image in CI with Trivy or Grype. Use distroless or scratch base images to minimize attack surface. Never deploy with the :latest tag.
07 Web Servers & Proxies Intermediate
Nginx
High-performance web server and reverse proxy. Used for static file serving, SSL/TLS termination, rate limiting, and load balancing. Learn Nginx config structure: server blocks, location blocks, and upstream groups. Every DevOps engineer must know this.
Apache HTTP Server
The classic open-source web server. Highly configurable with .htaccess and mod_rewrite for URL rewriting. Widely preferred for PHP apps (WordPress, Drupal). Learn virtual host configuration to serve multiple sites from one server.
Reverse Proxy
Sits in front of backend app servers, handling SSL termination, load distribution, and caching. Clients talk to Nginx; Nginx talks to your app. Critical for security, scalability, and clean architecture.
Forward Proxy
Sits in front of clients, routing outbound traffic. Filters, caches, and anonymizes requests. Widely used in corporate networks for internet access control. Squid is the most well-known forward proxy tool.
Caddy
A modern web server with automatic HTTPS out of the box. It obtains and renews Let's Encrypt certificates automatically — zero configuration required. Caddyfile syntax is far simpler than Nginx config. Supports dynamic configuration via its API. An excellent choice for small to mid-sized projects.
IIS / App Servers
IIS (Internet Information Services) is Microsoft's web server for Windows and the standard runtime for ASP.NET applications. For the Java ecosystem, Tomcat, WildFly (JBoss), and WebLogic are common application servers. Spring Boot apps ship with an embedded Tomcat — no separate install needed.
08 Networking & Protocols Intermediate
TCP/IP Fundamentals
The backbone of the internet. IP addressing (IPv4/IPv6), CIDR notation (/24 = 256 addresses), subnet masks, and port numbers (80 HTTP, 443 HTTPS, 22 SSH, 5432 PostgreSQL). Use traceroute and ping to diagnose network issues.
DNS
Translates domain names (kubeatlas.com) to IP addresses. Record types: A (domain → IP), CNAME (alias), MX (email routing), TXT (SPF/DKIM verification). Query DNS with dig and nslookup. Understand TTL and propagation delay.
HTTP/HTTPS & TLS
Request/response cycle, HTTP methods (GET, POST, PUT, DELETE, PATCH), headers, and status codes (200 OK, 301 Redirect, 401 Unauthorized, 404 Not Found, 500 Server Error, 502 Bad Gateway). TLS certificate chains and Let's Encrypt for free HTTPS.
Firewalls & Ports
Firewalls filter traffic by port and IP. On Linux: ufw (simple) or iptables (powerful). In cloud: AWS Security Groups, Azure NSGs. Rule: only open the ports you need, only from the sources that need them.
Email Protocols (SMTP/DMARC/DKIM)
SMTP is the foundational protocol for email delivery. SPF defines which IPs are authorized to send email for a domain, DKIM signs messages to verify the sender's domain, and DMARC ties them together with a policy. Critical for transactional email deliverability in any SaaS product.
FTP/SFTP & SCP
FTP still appears in legacy systems — prefer SFTP as it runs securely over SSH. Use SCP for one-off remote file copies. rsync is ideal for large directory syncs using delta-transfer for efficiency. Know all three — you will encounter them in the wild.
09 Cloud Providers Intermediate
AWS (Amazon Web Services)
Market leader with the widest service catalog. Start here: EC2 (VMs), S3 (object storage), VPC (networking), IAM (identity & access), RDS (managed database), EKS (Kubernetes). Use AWS Free Tier to start for free, then target SAA-C03 certification.
Microsoft Azure
Strong choice for enterprise and .NET ecosystems. Key services: AKS (managed Kubernetes), Azure DevOps, Entra ID (formerly Azure AD), ARM templates, and Bicep. The natural choice for teams already in the Microsoft ecosystem.
Google Cloud Platform
Excels at data, ML, and Kubernetes workloads. GKE (managed Kubernetes) is considered the most mature implementation. BigQuery for large-scale data analytics, Vertex AI for ML pipelines. GCP Free Tier is generous.
Cloud Free Tiers
All three offer free tiers. AWS: t2.micro/t3.micro (750 hrs/month). Azure: B1s (750 hrs/month). GCP: e2-micro (always free). Practice hands-on without spending money. Always set a billing alert — no surprises.
DigitalOcean / Hetzner
Developer-friendly and cost-effective cloud alternatives. DigitalOcean Droplets (VMs) and DOKS (managed Kubernetes) offer a fast starting point. Hetzner delivers significantly more powerful hardware at the same price from European data centers. Worth evaluating before AWS for startups and independent projects.
Alibaba Cloud
Market leader in Asia-Pacific. For operations requiring China market access, it is not an alternative to AWS/Azure — it is a necessity. ECS (VMs), OSS (object storage), and ACK (Kubernetes) are its AWS equivalents. Note the separate registration and data sovereignty rules for China regions.
10 Serverless Intermediate
Functions as a Service (FaaS)
Run code without managing servers. The cloud provider handles scaling automatically — you only pay when the function runs. Ideal for event-driven and low-traffic workloads. Less suited for long-running or high-throughput processes.
AWS Lambda
Amazon's FaaS service. Triggered by S3 events, API Gateway, SQS messages, DynamoDB Streams, and CloudWatch Events. 1 million requests/month free. Watch for cold start latency — especially with JVM runtimes.
Azure Functions
Microsoft's FaaS service. Supports HTTP, Timer, Blob Storage, Service Bus, and Cosmos DB triggers. Runs .NET, Node.js, Python, Java, and PowerShell. Durable Functions enable long-running orchestration workflows.
Event-Driven Architecture
Design systems where services communicate via events (message queues, streams) rather than direct API calls. Loose coupling enables independent scaling. Key tools: AWS EventBridge, Azure Event Grid, and Apache Kafka.
GCP Cloud Functions
Google's FaaS service. Triggered by HTTP, Pub/Sub, Cloud Storage, Firestore, and Cloud Scheduler events. Supports Node.js, Python, Go, Java, and .NET runtimes. For containerized serverless workloads, Cloud Run offers a more flexible alternative.
Cloudflare Workers
Edge serverless platform running on V8. Executes requests in under a millisecond at 300+ PoPs worldwide. Language-agnostic with Wasm support. Ideal for request/response manipulation, A/B testing, and edge-side rendering. KV, R2, and Durable Objects for state management.
11 Configuration Management Intermediate
Ansible
Agentless automation: only SSH access to target servers is required — no extra agent to install. YAML-based Playbooks automate server configuration, package installation, and application deployment. The easiest config management tool to learn.
Idempotency
The core principle of configuration management: running the same configuration 10 times must produce the same result as running it once. This means you can safely apply it repeatedly. Ansible modules are designed with this principle built in.
Ansible Playbooks
YAML files composed of plays and tasks. Each task runs a module: apt/yum (install packages), copy/template (file management), service (control services), command/shell (run commands). Variables and Jinja2 templates add powerful flexibility.
Ansible Roles
Package Playbook logic into reusable, structured Roles and share them via Ansible Galaxy. Standard structure: tasks/, handlers/, templates/, defaults/, and vars/ directories. Essential for large-scale infrastructure projects.
Chef
Ruby-based config management tool. Model your infrastructure with 'Cookbooks' and 'Recipes'. Agent-based: the Chef Client runs on each server and pulls its catalog from the Chef Server. Test Cookbooks automatically in CI with Test Kitchen. Steeper learning curve than Ansible but powerful in large enterprises.
Puppet
Define system configurations with a declarative DSL — Puppet determines 'what should be', you don't specify 'how'. Agent-based: each node pulls its catalog from the master every 30 minutes and converges to the desired state. Strong tooling for large-scale inventory, reporting, and compliance management.
12 Provisioning Advanced
Terraform
The industry standard for Infrastructure as Code. Supports AWS, Azure, GCP, and 100+ providers. Core workflow: terraform init (setup), plan (preview), apply (deploy), destroy (clean up). Write readable, powerful HCL configurations.
Infrastructure as Code (IaC)
Manage infrastructure with version-controlled code instead of clicking through a UI. See who changed what and when (git blame), review changes before applying (PRs), and parameterize the same code for dev/staging/prod environments.
Terraform State
Terraform tracks created resources in terraform.tfstate. Store it remotely in S3 (AWS) or Azure Blob as a remote backend. Use state locking (DynamoDB or built-in) for team collaboration. Never edit it manually.
AWS CloudFormation
Amazon's native IaC tool. Define AWS resources with JSON or YAML templates, grouped into Stacks. Less portable than Terraform but more deeply integrated with AWS services. A solid option for AWS-only projects.
Pulumi
Write infrastructure code in real programming languages (TypeScript, Python, Go, C#) — no need to learn HCL. Adds full language paradigms (loops, conditionals, classes) to declarative infrastructure. Writing tests is far more natural. Manages AWS, Azure, GCP, and Kubernetes from the same codebase.
AWS CDK
AWS Cloud Development Kit. Define type-safe AWS infrastructure with TypeScript, Python, Java, or Go — it generates CloudFormation under the hood. The Construct Library provides high-level, best-practice components. Strong developer experience with VS Code autocomplete and refactoring support.
13 CI/CD Tools Advanced
GitHub Actions
Automate workflows directly in your GitHub repo. Define workflows in .github/workflows/*.yml. Supports push, PR, schedule, and manual triggers. 2000 minutes/month free. Thousands of ready-made actions in the Marketplace.
Jenkins
The veteran open-source automation server with 1800+ plugins. Jenkinsfile (Groovy) enables pipeline-as-code. Self-hosted: full control but higher maintenance overhead. Powerful for large, complex multi-stage pipelines.
Azure DevOps Pipelines
Microsoft's CI/CD service. YAML-based pipelines, tight Azure integration, and multi-stage (build → test → staging → prod) deployment support. Best choice for .NET projects and the Microsoft ecosystem. Strong Library and variable group management.
GitLab CI
Built into GitLab — no extra setup. Define stages (test, build, deploy) in .gitlab-ci.yml. GitLab Runners execute each job in isolated containers. Built-in Container Registry and dependency scanning make it a strong DevSecOps platform.
CircleCI
Speed-focused cloud CI/CD platform. Parallel job execution and dynamic config dramatically reduce test times. Docker-first: each step runs in an isolated container. The Orbs system enables reusable pipeline components. A solid GitHub Actions alternative for small to mid-sized teams.
TeamCity
JetBrains' CI/CD server. Kotlin DSL for build configuration, powerful build chains, and comprehensive test reporting. Rich plugin ecosystem with deep IDE integration. Preferred in large Java/JVM projects and teams using IntelliJ IDEA. Available as self-hosted or TeamCity Cloud.
14 Secret Management Advanced
HashiCorp Vault
The gold standard for secrets. Securely store, rotate, and audit access to passwords, API keys, TLS certificates, and database credentials. Dynamic secrets generate database credentials on-demand with a short TTL — leaked secrets expire quickly.
Kubernetes Secrets
Base64-encoded key-value pairs stored in Kubernetes. Important: base64 is encoding, not encryption — secrets are stored unencrypted in etcd by default. Harden with Sealed Secrets or External Secrets Operator + Vault.
Environment Variables
The simplest secret injection method: never hardcode into source code — inject as env vars. Know the limits: visible in process listings, can leak into logs. Use .env for dev, a proper secrets manager for production.
Secret Rotation
Automatically rotate credentials on a schedule. Limits the damage of a leaked secret. HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault automate this process. Manual rotation is error-prone — automate it.
AWS Secrets Manager
AWS-native secret management service. Automatic rotation via Lambda integration, fine-grained IAM access control, and CloudTrail audit logging. Deep integration with ECS, Lambda, and EKS. More features than AWS SSM Parameter Store, but costs more.
Azure Key Vault
Azure's native service for keys, certificates, and secrets. Optional HSM-backed hardware encryption. Inject secrets and certificates into Kubernetes pods via Azure RBAC and Managed Identity. Microsoft CA integration enables automated certificate lifecycle management.
15 Infrastructure Monitoring Advanced
Prometheus
Open-source metrics collection system. Scrapes /metrics endpoints from services and stores them as time-series data. Write powerful queries with PromQL: e.g. rate(http_requests_total[5m]). CNCF-graduated industry standard.
Grafana
Visualization layer for Prometheus, Loki, InfluxDB, and 50+ data sources. Build dashboards for CPU, memory, request rates, error percentages, and latency. Define alerting rules and send notifications to Slack or PagerDuty.
Node Exporter
Prometheus exporter for Linux hardware and OS metrics: CPU usage, memory, disk I/O, and network traffic. A core component of server monitoring — install it on every Linux server. Runs on port 9100.
Alerting Rules
Prometheus AlertManager sends notifications to Slack, PagerDuty, or email when metrics cross thresholds. Write meaningful alerts: every notification must be actionable. Use a Dead Man's Switch to monitor your monitoring system itself.
Datadog
SaaS full-stack observability platform. Unifies metrics, logs, and traces in a single interface. 500+ integrations, APM, and a powerful alert engine. The agent auto-discovers services on every server it's installed on. Expensive but saves significant time in enterprise environments.
Zabbix
Open-source, self-hosted enterprise monitoring platform. Monitor physical servers, network devices, and applications via agents or agentless (SNMP, IPMI, JMX). Automatic discovery, customizable templates, and flexible alerting. A strong choice for large on-premise and hybrid infrastructures.
16 Artifact Management Advanced
Container Registries
Docker Hub (public), AWS ECR, GitHub GHCR, and Azure ACR. In CI/CD: after a build, push the image to the registry; pull it during deployment. Run security scanning (Trivy, Grype) on images in the registry — don't deploy vulnerable images.
Nexus Repository
Self-hosted artifact manager for Maven, npm, Docker, PyPI, NuGet, and more. Used as an internal mirror in corporate environments with restricted internet access. Understand the proxy + hosted + group repository concepts.
JFrog Artifactory
Enterprise-grade artifact management: advanced caching, multi-site replication, binary analysis, and Xray security scanning. Widely used in DevSecOps pipelines. The more comprehensive enterprise alternative to Nexus.
Semantic Versioning
Use MAJOR.MINOR.PATCH format (e.g. 2.1.3). MAJOR: incompatible API change, MINOR: backwards-compatible feature, PATCH: bug fix. Never use :latest in production — you must always know which version is running. Use immutable image tags.
CloudSmith
Fully managed, cloud-native artifact registry service. Supports Docker, Maven, npm, PyPI, Helm, Terraform, and 25+ formats. A self-hosted-free alternative to Nexus/Artifactory for startups that don't want to manage infrastructure. Upstream proxy caching and geographic replication available.
GitHub Packages
Artifact registry integrated directly into GitHub. Supports Maven, npm, Docker, NuGet, and RubyGems. Native integration with GitHub Actions pipelines — publish automatically after a successful build. Free for public repos; private repos incur storage charges separate from Actions minutes.
17 GitOps Advanced
GitOps Principles
Git is the Single Source of Truth for infrastructure and application state. All changes flow through Pull Requests — auditable, reviewable, and reversible. No manual kubectl apply. No snowflake servers. Everything tracked in Git.
ArgoCD
Kubernetes-native GitOps controller. Watches your Git repo and automatically syncs the cluster to the desired state. A clean UI lets you visually track application health. Scale with App of Apps and ApplicationSet for multi-cluster management.
Flux
CNCF-graduated GitOps toolkit. An alternative to ArgoCD with a more modular, composable approach. CLI-first, less UI. Flexible for managing multiple clusters and sources (Git repos, Helm registries, OCI artifacts). Smaller teams often prefer Flux.
Pull-Based Deployment
The inverse of traditional CI push: the cluster pulls changes from Git, rather than a CI server pushing to the cluster. The CI system has no direct cluster access — more secure. Compromised CI credentials can't reach the cluster.
18 Logs Management Advanced
ELK Stack
Elasticsearch (search & storage) + Logstash (collect & parse) + Kibana (visualize). Centralize logs from all services in one place. Query with KQL in Kibana. Powerful but resource-intensive — smaller teams may prefer Loki.
Loki + Grafana
Prometheus-inspired log aggregation. Indexes labels (app, env, pod), not log content — drastically lower storage cost. Integrates natively with Grafana so you see metrics and logs on the same dashboard. Ideal for cloud-native workloads.
Structured Logging
Write logs as JSON: {"level": "ERROR", "service": "api", "user_id": 123, "msg": "..."}. Machine-queryable. Use the right log level: DEBUG (dev), INFO (normal operation), WARN (potential issue), ERROR (failed operation), FATAL (system crash).
Centralized Logging
All services ship logs to one central system. Without it, debugging a distributed system means SSH-ing into 20 different servers. Centralized logging is not a luxury — it's an operational necessity for any system with more than one service.
Graylog
Open-source, self-hosted log aggregation and analysis platform. Collects logs from diverse sources via GELF format and Syslog. Runs on Elasticsearch but uses its own modern UI. Stream-based log routing and alerting are strong points. Lower resource footprint than a full ELK stack.
Fluentd / Fluent Bit
CNCF-graduated log forwarding tools. Fluentd (Ruby, wide plugin ecosystem) and its lightweight sibling Fluent Bit (C-based, ideal as a Kubernetes sidecar) collect logs from sources and forward them to destinations (Elasticsearch, Loki, S3, Datadog). Runs as a DaemonSet in Kubernetes.
19 Container Orchestration Advanced
Kubernetes Fundamentals
Kubernetes (K8s) automates deploying, scaling, and self-healing containers. Core concepts: Node (server), Pod (1+ containers), Namespace (isolation), Cluster (entire system), Control Plane (the brain), and kubelet (the node agent).
Pods & Deployments
A Pod is K8s's smallest deployable unit. A Deployment defines desired replica count and rolling update strategy. Rolling updates let you upgrade with zero downtime. kubectl rollout undo rolls back instantly if something goes wrong.
Services & Ingress
A Service exposes Pods on a stable IP/DNS (ClusterIP: internal, NodePort: node's IP, LoadBalancer: cloud LB). Ingress routes external HTTP/HTTPS traffic to the correct Service by path or hostname, with SSL termination.
Helm Charts
Kubernetes' package manager. Charts bundle Deployments, Services, ConfigMaps, and other resources into versioned packages. helm install, upgrade, and rollback. Find thousands of charts — NGINX, Prometheus, Grafana — on Artifact Hub.
Docker Swarm
Docker's built-in container orchestration mode. Far simpler than Kubernetes — easy to learn, set up in minutes. Initialize with docker swarm init, deploy services with docker service create. A good starting point for small teams and simple workloads that don't justify K8s complexity.
GKE / EKS / AKS
Managed Kubernetes services from cloud providers. The control plane is managed by the provider — you only manage worker nodes. GKE (Google) is the most mature, EKS (AWS) the most widely used, AKS (Azure) integrates with the Microsoft ecosystem. Recommended for getting started — managing your own K8s cluster is a significant operational burden.
20 Observability Expert
The Three Pillars
True observability rests on three pillars: Metrics (what is happening — numerical state indicators), Logs (what happened — event records), Traces (why it happened — request flow tracking). Monitoring tells you something is wrong; observability tells you why.
OpenTelemetry
Vendor-neutral instrumentation framework. Add the OpenTelemetry SDK to your app once, then export to any backend — Jaeger, Grafana Tempo, Datadog. Instrument once, migrate freely. Rapidly becoming the CNCF standard for telemetry.
Distributed Tracing
Track a single request as it flows through multiple microservices. See exactly where latency or errors occur in the chain: Service A → Service B → Database. Unnecessary in monoliths; life-saving in microservice architectures.
Jaeger & Zipkin
Open-source distributed tracing tools. Visualize traces as flame graphs and Gantt charts to pinpoint slow spans and bottlenecks. Jaeger originated at Uber and is a CNCF project. Zipkin was pioneered at Twitter.
Datadog APM
SaaS Application Performance Monitoring solution. Auto-instrumentation, service maps, and continuous profiling let you find CPU and memory hotspots in production. Combines Log Management, Infrastructure, and APM in one platform. Also accepts OpenTelemetry data.
New Relic
Full-stack observability SaaS platform. Browser monitoring, mobile APM, synthetic monitoring, and infrastructure monitoring under one roof. Flexible analytics with NRQL (New Relic Query Language). A free tier is available. Popular in large engineering organizations for distributed tracing and alert correlation.
21 Service Mesh Expert
Istio
The most widely adopted service mesh implementation; uses Envoy as a sidecar proxy. Provides mutual TLS (mTLS) for zero-trust networking, circuit breaking, retry policies, canary routing, and detailed telemetry. Centrally manages the network layer for microservices. Steep learning curve.
Consul
HashiCorp's service mesh and service discovery solution. Works in non-Kubernetes environments (VMs, bare metal) — a key differentiator from Istio. Connect provides mutual TLS; tight Vault integration for secrets. Single tool for service discovery, health checking, and configuration management.
Linkerd
CNCF-graduated, Rust-based ultra-lightweight service mesh. Consumes far fewer CPU and memory resources than Istio. Simplicity of installation and daily operation is the primary goal. Sidecar proxies are auto-injected; certificate management is built in. The right choice when simplicity and low overhead matter most.
Envoy Proxy
The high-performance C++ data plane proxy trusted by both Istio and Consul. Supports gRPC, HTTP/2, and HTTP/3. Can be used standalone as an edge proxy, API gateway, or sidecar. Dynamic configuration via the xDS API. Understanding how Envoy works is critical for understanding any service mesh.
22 Cloud Design Patterns Expert
High Availability (HA)
Design systems to survive failures with no single point of failure (SPOF). Deploy across multiple Availability Zones, add health checks, and configure automatic failover. Define your target SLA: 99.9% uptime = ~8.7 hours of allowed downtime per year.
Auto Scaling
Automatically add or remove instances based on traffic load. Avoid over-provisioning costs and capacity-induced outages. Core tools: AWS Auto Scaling Groups, Azure VMSS, and Kubernetes HPA (Horizontal Pod Autoscaler).
Load Balancing
Distribute traffic across multiple instances to prevent any single server from becoming a bottleneck. Learn the difference between L4 (TCP/UDP) and L7 (HTTP/HTTPS) load balancers. Algorithms: round-robin, least connections, IP hash. Auto-remove unhealthy instances.
Multi-Region Deployment
Deploy to geographically close regions for global users — reduces latency and provides resilience against regional outages. Understand the trade-off between active-active (every region serves traffic) and active-passive (standby region waits) architectures.
Caching Strategies
CDN (static content: CloudFront, Cloudflare), application-level (Redis, Memcached), and database query caching layers. Cache-aside, write-through, and write-behind patterns. TTL and cache invalidation management — one of the two hard problems in computer science. Dramatically reduces latency and cost for read-heavy workloads.
Disaster Recovery (DR)
RPO (Recovery Point Objective: how much data loss is acceptable?) and RTO (Recovery Time Objective: how quickly must you recover?). Strategies: Pilot Light, Warm Standby, and Multi-Site Active-Active. DR plans that aren't regularly tested don't work — run drills on your runbooks and database recovery procedures.
23 AI-Assisted DevOps & SRE Expert
k8sgpt
CNCF Sandbox project; open-source CLI that analyzes your Kubernetes cluster with AI. Sends kubectl describe output to OpenAI, Claude, or Ollama to answer 'Why is this CrashLoopBackOff?' in plain English. Run k8sgpt analyze --explain for a first diagnosis in minutes.
GitHub Copilot for Infrastructure
AI code completion for Terraform HCL, Kubernetes YAML, Dockerfiles, and CI/CD pipelines. Generates working code from natural-language comments. Significantly reduces IaC authoring time; always review and security-validate generated code.
PagerDuty AIOps
Market-leading AI platform for incident management. Reduces hundreds of alerts to a single actionable incident via real-time correlation and noise reduction. ML model learns from historical events to automatically identify which alert represents a real problem. Delivers summary reports and suggested next steps to the on-call engineer.
Robusta
The most popular open-source Kubernetes AI monitoring platform. Automatically runs playbooks on alert: collects pod logs, queries node status, pulls relevant Prometheus metrics, and sends a formatted summary to Slack. HolmesGPT enables natural-language queries ('Why is this deployment slow?').
AI-Powered Runbook Automation
Integrate LLMs into incident response workflows. Tools like Causely automatically build causality chains between events; incident.io AI generates automatic post-mortem summaries. Emerging pattern: trigger alert → LLM selects runbook → automated diagnostic steps → human approval → remediation. Human oversight is critical — LLMs cannot always be held accountable for validated steps.
How long does it take to become a DevOps engineer?
Studying 2–3 hours daily, starting from Linux and programming fundamentals, it typically takes 12–18 months to reach a job-ready level. Learning Docker and Kubernetes takes 3–4 months, setting up CI/CD pipelines 1–2 months, and preparing for cloud certifications (AWS SAA, CKA) 2–3 months each.
What do I need to know to start learning DevOps?
If you're starting from scratch, your first stop should be the Linux command line and basic networking concepts (TCP/IP, DNS, HTTP). Once you've learned a programming language — Python or Go — you can move on to Git, Docker, and CI/CD. A background in software development or system administration speeds up the process but is not required.
Which DevOps certification should I get?
For beginners, AWS Solutions Architect Associate (SAA-C03) or KCNA is a good entry point. If you're focused on Kubernetes, CKA (Certified Kubernetes Administrator) is the industry standard. For advanced levels, CKS (security) and CKAD (application developer) are complementary. All five certifications together form the Kubestronaut credential.
What's the difference between DevOps and SRE?
DevOps is a culture and set of practices emphasizing collaboration and automation between development and operations teams. SRE (Site Reliability Engineering) is a specific role pioneered by Google that applies software engineering principles to operational problems. SREs work with SLAs, SLOs, and error budgets; DevOps is a broader transformation philosophy.
Do I need to learn every tool in this roadmap?
No. This roadmap shows the full DevOps ecosystem — you're not expected to know every tool. Deep knowledge in one tool per category is far more valuable than surface-level familiarity with all of them. If your fundamentals are solid, you can pick up new tools quickly.
Reference: roadmap.sh/devops
· Simplified and adapted from field experience