هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.
$ مستخدم عادي# بصلاحية root (أو مع sudo)
Read the flow from code to production
Every service on this page has one place in the flow. Learn the flow first, then the tools.
| Step | What happens | Services |
|---|---|---|
| 1. Code | Write code and config, review it in a pull request | git, gh |
| 2. Check | Scan code and secrets before merge | semgrep, gitleaks, sonar-scanner, trivy (fs, config) |
| 3. Build | Build an image, make an SBOM, sign it | docker, syft, cosign, gitlab-runner, jenkins |
| 4. Scan | Scan the image for CVEs | trivy, grype |
| 5. Infra | Build cloud resources and servers from code | terraform, ansible, packer, cloud-init, az, aws |
| 6. Deploy | Sync Git to the cluster | argocd, flux, helm, kustomize, kubectl |
| 7. Run | Serve traffic, store data | nginx, haproxy, traefik, psql, redis-cli, kafka-topics … |
| 8. Protect | Secrets, identity, hardening, runtime detection | vault, sops, kcadm, falco, kube-bench, oscap |
| 9. Watch | Metrics, logs, traces, alerts | promtool, amtool, grafana-cli, logcli, fluent-bit, otelcol |
| 10. Test from outside | Ports, TLS, web attacks | nmap, zap, openssl |
تذكّر
"Shift left" means the checks in steps 2–4 run on every change, automatically, before anything reaches production.
Know the 10 areas
The 65 services in 10 groups. One chapter per group.
| Area | Services | Chapter |
|---|---|---|
| Web, proxy, TLS | nginx, HAProxy, Traefik, Certbot | Web |
| Containers, Kubernetes | Docker, kubectl, Helm, k3s, crictl, Kustomize, kind | Containers |
| Git, CI/CD, GitOps | Git, GitHub CLI, GitLab Runner, Jenkins, Argo CD, Flux | CI/CD |
| IaC and cloud | Terraform, Ansible, Packer, cloud-init, Azure CLI, AWS CLI | IaC |
| Secrets, identity | Vault, OpenSSL, SOPS, age, GPG, Keycloak | Secrets |
| Observability | Prometheus, Alertmanager, node_exporter, Grafana, Loki, Fluent Bit, OpenTelemetry Collector | Observability |
| Code and supply chain | Trivy, Syft, Grype, Cosign, Gitleaks, Semgrep, SonarQube, ZAP | Supply chain |
| Host and cluster security | Falco, kube-bench, Nmap, Fail2ban, Lynis, OpenSCAP, AIDE, auditd | Host security |
| Data | PostgreSQL, MySQL/MariaDB, Redis/Valkey, MongoDB, etcd, RabbitMQ, Kafka, MinIO | Data |
| Network | BIND, WireGuard, OpenVPN, Postfix, keepalived | Network |
Learn them in the right order
You do not need all 65 on day one. Follow the phases of my DevSecOps path.
- Phase 1 (Linux):
nginx,openssl,firewall-cmd,fail2ban-client,auditctl,aide,psql,mysql,rndc,postconf. - Phase 2 (Azure):
az,cloud-init,nginxbehind an Azure load balancer. - Phase 3 (IaC and CI/CD):
git,gh,terraform,ansible,packer,docker,trivy,gitleaks,semgrep. - Phase 4 (Kubernetes):
kubectl,helm,kustomize,k3s,kind,crictl,etcdctl,promtool,grafana-cli,logcli. - Phase 5 (Security and GitOps):
argocd,flux,sops,vault,cosign,syft,falco,kube-bench,oscap,zap.
في العمل
In a job interview, one real project that uses 10 of these tools together is worth more than a list of 65 names. See the portfolio chapter.
Remember the default ports
Ports appear in firewalls, Kubernetes Services and exam questions.
| Port | Service |
|---|---|
| 22 | SSH |
| 25 / 587 | SMTP / submission (Postfix) |
| 53 | DNS (BIND) |
| 80 / 443 | HTTP / HTTPS (nginx, HAProxy, Traefik) |
| 1194/udp | OpenVPN |
| 51820/udp | WireGuard |
| 2379 / 2380 | etcd client / peer |
| 3000 | Grafana |
| 3100 | Loki |
| 3306 | MySQL / MariaDB |
| 4317 / 4318 | OTLP gRPC / HTTP (OpenTelemetry) |
| 5432 | PostgreSQL |
| 5672 / 15672 | RabbitMQ AMQP / management UI |
| 6379 | Redis / Valkey |
| 6443 | Kubernetes API server |
| 8080 | Jenkins, Traefik dashboard, many apps |
| 8200 | Vault |
| 9000 | SonarQube, MinIO API |
| 9090 / 9093 / 9100 | Prometheus / Alertmanager / node_exporter |
| 9092 | Kafka |
| 10250 | kubelet |
| 27017 | MongoDB |
انتبه
A default port open to the internet is the first thing attackers scan for. Only 80/443 (and maybe a VPN port) should be public; everything else stays on private networks.
Use the same security checklist everywhere
Every service in this guide has its own checklist, but these 8 rules apply to all of them.
- Patch: run supported versions; rebuild images often.
- Least privilege: one user / role / token per app, only the rights it needs.
- No secrets in Git or images: use Vault, Key Vault, SOPS or sealed secrets.
- Encrypt in transit: TLS everywhere, also inside the network.
- Private by default: bind to private addresses, firewall the rest.
- Log and monitor: send logs and metrics to a central place, alert on symptoms.
- Back up and test restores: databases, etcd, Vault, Git.
- Everything as code: config in Git, changes through pull requests.
كل الأوامر في هذا الفصل
gitghsemgrepgitleakssonar-scannertrivydockersyftcosigngitlab-runnerjenkinsgrypeterraformansiblepackercloud-initazawsargocdfluxhelmkustomizekubectlnginxhaproxytraefikpsqlredis-clikafka-topicsvaultsopskcadmfalcokube-benchoscappromtoolamtoolgrafana-clilogclifluent-bitotelcolnmapzapopensslfirewall-cmdfail2ban-clientauditctlaidemysqlrndcpostconfk3skindcrictletcdctl