7 Essential Tools Every SRE/DevOps/SysAdmin Should Master in 2025

# Example Kubernetes Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-application
  labels:
    app: web-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app
  template:
    metadata:
      labels:
        app: web-app
    spec:
      containers:
      - name: web-container
        image: nginx:1.21
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "250m"
          limits:
            memory: "128Mi"
            cpu: "500m"
---
apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  selector:
    app: web-app
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  type: LoadBalancer

# Essential kubectl commands
kubectl get pods --all-namespaces
kubectl describe deployment web-application
kubectl logs -f deployment/web-application
kubectl exec -it pod-name -- /bin/bash
kubectl apply -f deployment.yaml
kubectl rollout status deployment/web-application
kubectl scale deployment web-application --replicas=5

# Troubleshooting commands
kubectl get events --sort-by=.metadata.creationTimestamp
kubectl top nodes
kubectl top pods

# AWS EC2 Instance
resource "aws_instance" "web_server" {
  ami           = "ami-0c55b159cbfafe1d0"
  instance_type = "t3.micro"
  
  tags = {
    Name        = "WebServer"
    Environment = "Production"
  }
}

# Azure Virtual Machine
resource "azurerm_linux_virtual_machine" "web_vm" {
  name                = "web-vm"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  size                = "Standard_B1s"
  
  admin_username = "adminuser"
  
  network_interface_ids = [
    azurerm_network_interface.main.id,
  ]
  
  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }
  
  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-focal"
    sku       = "20_04-lts-gen2"
    version   = "latest"
  }
}

# Google Cloud Compute Instance
resource "google_compute_instance" "web_instance" {
  name         = "web-instance"
  machine_type = "e2-micro"
  zone         = "us-central1-a"
  
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }
  
  network_interface {
    network = "default"
    access_config {
      // Ephemeral public IP
    }
  }
}

# modules/vpc/main.tf
resource "aws_vpc" "main" {
  cidr_block           = var.cidr_block
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = var.vpc_name
  }
}

resource "aws_subnet" "public" {
  count             = length(var.public_subnets)
  vpc_id            = aws_vpc.main.id
  cidr_block        = var.public_subnets[count.index]
  availability_zone = var.availability_zones[count.index]
  
  map_public_ip_on_launch = true
  
  tags = {
    Name = "${var.vpc_name}-public-${count.index + 1}"
  }
}

# Root main.tf
module "vpc" {
  source = "./modules/vpc"
  
  vpc_name           = "production-vpc"
  cidr_block         = "10.0.0.0/16"
  public_subnets     = ["10.0.1.0/24", "10.0.2.0/24"]
  availability_zones = ["us-west-2a", "us-west-2b"]
}

# Remote state configuration
terraform {
  backend "s3" {
    bucket = "terraform-state-bucket"
    key    = "production/terraform.tfstate"
    region = "us-west-2"
    
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

# Essential Terraform commands
terraform init
terraform plan -out=tfplan
terraform apply tfplan
terraform destroy
terraform import aws_instance.example i-1234567890abcdef0
terraform state list
terraform state show aws_instance.web_server

# prometheus.yml configuration
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "alert_rules.yml"

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']
  
  - job_name: 'node-exporter'
    static_configs:
      - targets: ['node-exporter:9100']
  
  - job_name: 'kubernetes-pods'
    kubernetes_sd_configs:
      - role: pod
    relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true

# CPU Usage
100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)

# Memory Usage
(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100

# Disk Usage
100 - ((node_filesystem_avail_bytes * 100) / node_filesystem_size_bytes)

# HTTP Request Rate
rate(http_requests_total[5m])

# Error Rate
rate(http_requests_total{status=~"5.."}[5m]) / rate(http_requests_total[5m])

# Response Time Percentiles
histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m]))

# alert_rules.yml
groups:
  - name: system_alerts
    rules:
      - alert: HighCPUUsage
        expr: 100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High CPU usage detected"
          description: "CPU usage is above 80% for more than 5 minutes on {{ $labels.instance }}"
      
      - alert: HighMemoryUsage
        expr: (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100 > 90
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "High memory usage detected"
          description: "Memory usage is above 90% for more than 5 minutes on {{ $labels.instance }}"
      
      - alert: ServiceDown
        expr: up == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Service is down"
          description: "{{ $labels.job }} service is down on {{ $labels.instance }}"

{
  "dashboard": {
    "title": "System Overview",
    "panels": [
      {
        "title": "CPU Usage",
        "type": "graph",
        "targets": [
          {
            "expr": "100 - (avg by (instance) (irate(node_cpu_seconds_total{mode=\"idle\"}[5m])) * 100)",
            "legendFormat": "{{ instance }}"
          }
        ]
      }
    ]
  }
}

# inventory/hosts
[webservers]
web1.example.com ansible_host=192.168.1.10
web2.example.com ansible_host=192.168.1.11

[databases]
db1.example.com ansible_host=192.168.1.20
db2.example.com ansible_host=192.168.1.21

[production:children]
webservers
databases

[production:vars]
ansible_user=ubuntu
ansible_ssh_private_key_file=~/.ssh/production.pem

# deploy-web-app.yml
---
- name: Deploy Web Application
  hosts: webservers
  become: yes
  vars:
    app_name: "my-web-app"
    app_version: "1.2.3"
    
  tasks:
    - name: Update package cache
      apt:
        update_cache: yes
        cache_valid_time: 3600
    
    - name: Install required packages
      apt:
        name:
          - nginx
          - python3
          - python3-pip
        state: present
    
    - name: Create application directory
      file:
        path: "/opt/{{ app_name }}"
        state: directory
        owner: www-data
        group: www-data
        mode: '0755'
    
    - name: Download application
      get_url:
        url: "https://releases.example.com/{{ app_name }}-{{ app_version }}.tar.gz"
        dest: "/tmp/{{ app_name }}-{{ app_version }}.tar.gz"
    
    - name: Extract application
      unarchive:
        src: "/tmp/{{ app_name }}-{{ app_version }}.tar.gz"
        dest: "/opt/{{ app_name }}"
        remote_src: yes
        owner: www-data
        group: www-data
    
    - name: Configure nginx
      template:
        src: nginx.conf.j2
        dest: "/etc/nginx/sites-available/{{ app_name }}"
      notify: restart nginx
    
    - name: Enable nginx site
      file:
        src: "/etc/nginx/sites-available/{{ app_name }}"
        dest: "/etc/nginx/sites-enabled/{{ app_name }}"
        state: link
      notify: restart nginx
    
    - name: Start and enable services
      systemd:
        name: "{{ item }}"
        state: started
        enabled: yes
      loop:
        - nginx
        - "{{ app_name }}"
  
  handlers:
    - name: restart nginx
      systemd:
        name: nginx
        state: restarted

# roles/database/tasks/main.yml
---
- name: Install PostgreSQL
  package:
    name: postgresql
    state: present
  
- name: Configure PostgreSQL
  template:
    src: postgresql.conf.j2
    dest: /etc/postgresql/13/main/postgresql.conf
  notify: restart postgresql

- name: Create database
  postgresql_db:
    name: "{{ db_name }}"
    state: present
  become_user: postgres

# Using Ansible Vault for secrets
- name: Set database password
  postgresql_user:
    name: "{{ db_user }}"
    password: "{{ vault_db_password }}"
    priv: "{{ db_name }}:ALL"
  become_user: postgres

# Encrypt sensitive data
ansible-vault encrypt group_vars/production/vault.yml

# Run playbooks with vault
ansible-playbook -i inventory/hosts deploy-web-app.yml --ask-vault-pass

# Check syntax
ansible-playbook --syntax-check deploy-web-app.yml

# Dry run
ansible-playbook -i inventory/hosts deploy-web-app.yml --check

# Run specific tags
ansible-playbook -i inventory/hosts deploy-web-app.yml --tags "configuration"

# Multi-stage build for Node.js application
FROM node:18-alpine AS builder

WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force

COPY . .
RUN npm run build

# Production stage
FROM node:18-alpine AS production

# Create non-root user
RUN addgroup -g 1001 -S nodejs && \
    adduser -S nextjs -u 1001

WORKDIR /app

# Copy built application
COPY --from=builder --chown=nextjs:nodejs /app/dist ./dist
COPY --from=builder --chown=nextjs:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=nextjs:nodejs /app/package.json ./package.json

USER nextjs

EXPOSE 3000

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/health || exit 1

CMD ["node", "dist/server.js"]

# docker-compose.yml
version: '3.8'

services:
  web:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=development
      - DATABASE_URL=postgresql://user:password@db:5432/myapp
    volumes:
      - .:/app
      - /app/node_modules
    depends_on:
      - db
      - redis
    networks:
      - app-network

  db:
    image: postgres:14-alpine
    environment:
      POSTGRES_DB: myapp
      POSTGRES_USER: user
      POSTGRES_PASSWORD: password
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - ./init.sql:/docker-entrypoint-initdb.d/init.sql
    ports:
      - "5432:5432"
    networks:
      - app-network

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
    networks:
      - app-network

  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - ./ssl:/etc/nginx/ssl
    depends_on:
      - web
    networks:
      - app-network

volumes:
  postgres_data:
  redis_data:

networks:
  app-network:
    driver: bridge

# Security scanning
docker scan myapp:latest

# Multi-architecture builds
docker buildx build --platform linux/amd64,linux/arm64 -t myapp:latest .

# Resource limits
docker run -d \
  --name myapp \
  --memory="512m" \
  --cpus="1.0" \
  --restart=unless-stopped \
  myapp:latest

# Health monitoring
docker run -d \
  --name myapp \
  --health-cmd="curl -f http://localhost:3000/health || exit 1" \
  --health-interval=30s \
  --health-timeout=3s \
  --health-retries=3 \
  myapp:latest

# Initialize GitFlow
git flow init

# Start new feature
git flow feature start new-monitoring-dashboard

# Finish feature
git flow feature finish new-monitoring-dashboard

# Start release
git flow release start 1.2.0

# Finish release
git flow release finish 1.2.0

# Start hotfix
git flow hotfix start critical-security-fix

# Finish hotfix
git flow hotfix finish critical-security-fix

# .gitignore for Terraform
*.tfstate
*.tfstate.*
.terraform/
*.tfvars
.terraform.lock.hcl

# Pre-commit hooks for quality
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/antonbabenko/pre-commit-terraform
    rev: v1.77.0
    hooks:
      - id: terraform_fmt
      - id: terraform_validate
      - id: terraform_docs
      - id: terraform_tflint

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.4.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-yaml
      - id: check-added-large-files

#!/bin/bash
# .git/hooks/pre-push

# Run tests before push
echo "Running tests..."
npm test

if [ $? -ne 0 ]; then
    echo "Tests failed. Push aborted."
    exit 1
fi

# Run security scan
echo "Running security scan..."
npm audit

if [ $? -ne 0 ]; then
    echo "Security vulnerabilities found. Push aborted."
    exit 1
fi

echo "All checks passed. Proceeding with push."

# Semantic commit messages
git commit -m "feat: add Prometheus monitoring for API endpoints"
git commit -m "fix: resolve memory leak in worker processes"
git commit -m "docs: update deployment procedures"
git commit -m "refactor: optimize database connection pooling"

# Interactive rebase for clean history
git rebase -i HEAD~3

# Signing commits for security
git config --global user.signingkey YOUR_GPG_KEY
git config --global commit.gpgsign true

# Useful aliases
git config --global alias.lg "log --oneline --graph --decorate --all"
git config --global alias.st "status -s"
git config --global alias.co "checkout"
git config --global alias.br "branch"

# EC2 Management
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,InstanceType,PublicIpAddress]' --output table

aws ec2 start-instances --instance-ids i-1234567890abcdef0
aws ec2 stop-instances --instance-ids i-1234567890abcdef0

# S3 Operations
aws s3 sync ./local-folder s3://my-bucket/folder/ --delete
aws s3 cp large-file.zip s3://my-bucket/ --storage-class GLACIER
aws s3api put-bucket-policy --bucket my-bucket --policy file://bucket-policy.json

# CloudFormation
aws cloudformation create-stack --stack-name my-infrastructure --template-body file://template.yaml --parameters ParameterKey=Environment,ParameterValue=production

aws cloudformation update-stack --stack-name my-infrastructure --template-body file://template.yaml --capabilities CAPABILITY_IAM

# EKS Management
aws eks update-kubeconfig --region us-west-2 --name my-cluster
aws eks describe-cluster --name my-cluster --query 'cluster.status'

# RDS Operations
aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier,DBInstanceStatus,Engine,DBInstanceClass]' --output table

aws rds create-db-snapshot --db-instance-identifier mydb --db-snapshot-identifier mydb-snapshot-$(date +%Y%m%d)

#!/bin/bash
# automated-backup.sh

# Set variables
INSTANCE_ID="i-1234567890abcdef0"
SNAPSHOT_DESCRIPTION="Automated backup $(date +%Y-%m-%d_%H-%M-%S)"

# Get volume IDs
VOLUME_IDS=$(aws ec2 describe-instances \
  --instance-ids $INSTANCE_ID \
  --query 'Reservations[*].Instances[*].BlockDeviceMappings[*].Ebs.VolumeId' \
  --output text)

# Create snapshots
for VOLUME_ID in $VOLUME_IDS; do
  echo "Creating snapshot for volume: $VOLUME_ID"
  
  SNAPSHOT_ID=$(aws ec2 create-snapshot \
    --volume-id $VOLUME_ID \
    --description "$SNAPSHOT_DESCRIPTION" \
    --query 'SnapshotId' \
    --output text)
  
  # Tag the snapshot
  aws ec2 create-tags \
    --resources $SNAPSHOT_ID \
    --tags Key=Name,Value="Backup-$VOLUME_ID-$(date +%Y%m%d)" \
           Key=Environment,Value=production \
           Key=AutomatedBackup,Value=true
  
  echo "Snapshot created: $SNAPSHOT_ID"
done

# Clean up old snapshots (older than 7 days)
OLD_SNAPSHOTS=$(aws ec2 describe-snapshots \
  --owner-ids self \
  --query "Snapshots[?StartTime<='$(date -d '7 days ago' --iso-8601)'].SnapshotId" \
  --output text)

for SNAPSHOT_ID in $OLD_SNAPSHOTS; do
  echo "Deleting old snapshot: $SNAPSHOT_ID"
  aws ec2 delete-snapshot --snapshot-id $SNAPSHOT_ID
done

# Azure CLI
az login
az account set --subscription "Production"
az vm list --output table
az storage blob upload --account-name mystorageaccount --container-name mycontainer --name myblob --file ./local-file.txt

# Google Cloud CLI
gcloud auth login
gcloud config set project my-project-id
gcloud compute instances list
gcloud storage cp ./local-file.txt gs://my-bucket/

# Kubernetes across clouds
kubectl config get-contexts
kubectl config use-context production-cluster
kubectl get nodes --show-labels

# GitHub Actions with AWS CLI
name: Deploy to AWS
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-west-2
      
      - name: Deploy to S3
        run: |
          aws s3 sync ./dist s3://my-website-bucket --delete
          aws cloudfront create-invalidation --distribution-id E1234567890 --paths "/*"

# Deploy a full-stack application using all tools
1. Version control with Git
2. Containerize with Docker
3. Infrastructure with Terraform
4. Configuration with Ansible
5. Orchestration with Kubernetes
6. Monitoring with Prometheus
7. Management with Cloud CLIs