s0sta
EN NL عربي
Filters
Zo zoek je
  • Gewone woorden vinden namen, teksten en voorbeelden.
  • "twee woorden" vindt precies die zin.
  • --naam of -x vindt een optie.
  • #woord zoekt alleen in commando's.
  • @grep vindt lessen en labs die grep gebruiken.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Zet ! voor een woord om het weg te laten. OR tussen woorden betekent één ervan.
  • ↑ ↓ bewegen · Enter openen · Esc sluiten · / zoeken

Hoofdstuk 1Naam in de cursus: The map

See all 65 services on one map

DevSecOps job ads list many tool names. This guide puts the 65 most used services and tools in order: what each one does, where it sits in the delivery flow, the commands you use every day, and how to run it safely. Every service has a full command page with options and 10+ examples — click the name in code to open it.

  • 5 Lessen
  • 55 Commando's

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

1.1

Read the flow from code to production

Every service on this page has one place in the flow. Learn the flow first, then the tools.

StepWhat happensServices
1. CodeWrite code and config, review it in a pull requestgit, gh
2. CheckScan code and secrets before mergesemgrep, gitleaks, sonar-scanner, trivy (fs, config)
3. BuildBuild an image, make an SBOM, sign itdocker, syft, cosign, gitlab-runner, jenkins
4. ScanScan the image for CVEstrivy, grype
5. InfraBuild cloud resources and servers from codeterraform, ansible, packer, cloud-init, az, aws
6. DeploySync Git to the clusterargocd, flux, helm, kustomize, kubectl
7. RunServe traffic, store datanginx, haproxy, traefik, psql, redis-cli, kafka-topics …
8. ProtectSecrets, identity, hardening, runtime detectionvault, sops, kcadm, falco, kube-bench, oscap
9. WatchMetrics, logs, traces, alertspromtool, amtool, grafana-cli, logcli, fluent-bit, otelcol
10. Test from outsidePorts, TLS, web attacksnmap, zap, openssl

Onthoud

"Shift left" means the checks in steps 2–4 run on every change, automatically, before anything reaches production.

1.2

Know the 10 areas

The 65 services in 10 groups. One chapter per group.

AreaServicesChapter
Web, proxy, TLSnginx, HAProxy, Traefik, CertbotWeb
Containers, KubernetesDocker, kubectl, Helm, k3s, crictl, Kustomize, kindContainers
Git, CI/CD, GitOpsGit, GitHub CLI, GitLab Runner, Jenkins, Argo CD, FluxCI/CD
IaC and cloudTerraform, Ansible, Packer, cloud-init, Azure CLI, AWS CLIIaC
Secrets, identityVault, OpenSSL, SOPS, age, GPG, KeycloakSecrets
ObservabilityPrometheus, Alertmanager, node_exporter, Grafana, Loki, Fluent Bit, OpenTelemetry CollectorObservability
Code and supply chainTrivy, Syft, Grype, Cosign, Gitleaks, Semgrep, SonarQube, ZAPSupply chain
Host and cluster securityFalco, kube-bench, Nmap, Fail2ban, Lynis, OpenSCAP, AIDE, auditdHost security
DataPostgreSQL, MySQL/MariaDB, Redis/Valkey, MongoDB, etcd, RabbitMQ, Kafka, MinIOData
NetworkBIND, WireGuard, OpenVPN, Postfix, keepalivedNetwork

1.3

Learn them in the right order

You do not need all 65 on day one. Follow the phases of my DevSecOps path.

  1. Phase 1 (Linux): nginx, openssl, firewall-cmd, fail2ban-client, auditctl, aide, psql, mysql, rndc, postconf.
  2. Phase 2 (Azure): az, cloud-init, nginx behind an Azure load balancer.
  3. Phase 3 (IaC and CI/CD): git, gh, terraform, ansible, packer, docker, trivy, gitleaks, semgrep.
  4. Phase 4 (Kubernetes): kubectl, helm, kustomize, k3s, kind, crictl, etcdctl, promtool, grafana-cli, logcli.
  5. Phase 5 (Security and GitOps): argocd, flux, sops, vault, cosign, syft, falco, kube-bench, oscap, zap.

Op het werk

In a job interview, one real project that uses 10 of these tools together is worth more than a list of 65 names. See the portfolio chapter.

1.4

Remember the default ports

Ports appear in firewalls, Kubernetes Services and exam questions.

PortService
22SSH
25 / 587SMTP / submission (Postfix)
53DNS (BIND)
80 / 443HTTP / HTTPS (nginx, HAProxy, Traefik)
1194/udpOpenVPN
51820/udpWireGuard
2379 / 2380etcd client / peer
3000Grafana
3100Loki
3306MySQL / MariaDB
4317 / 4318OTLP gRPC / HTTP (OpenTelemetry)
5432PostgreSQL
5672 / 15672RabbitMQ AMQP / management UI
6379Redis / Valkey
6443Kubernetes API server
8080Jenkins, Traefik dashboard, many apps
8200Vault
9000SonarQube, MinIO API
9090 / 9093 / 9100Prometheus / Alertmanager / node_exporter
9092Kafka
10250kubelet
27017MongoDB

Let op

A default port open to the internet is the first thing attackers scan for. Only 80/443 (and maybe a VPN port) should be public; everything else stays on private networks.

1.5

Use the same security checklist everywhere

Every service in this guide has its own checklist, but these 8 rules apply to all of them.

  1. Patch: run supported versions; rebuild images often.
  2. Least privilege: one user / role / token per app, only the rights it needs.
  3. No secrets in Git or images: use Vault, Key Vault, SOPS or sealed secrets.
  4. Encrypt in transit: TLS everywhere, also inside the network.
  5. Private by default: bind to private addresses, firewall the rest.
  6. Log and monitor: send logs and metrics to a central place, alert on symptoms.
  7. Back up and test restores: databases, etcd, Vault, Git.
  8. Everything as code: config in Git, changes through pull requests.

Alle commando's in dit hoofdstuk