# Cost breakdown by service for last month
aws ce get-cost-and-usage \
  --time-period Start=$(date -d "last month" +%Y-%m-01),End=$(date +%Y-%m-01) \
  --granularity MONTHLY \
  --metrics "BlendedCost" \
  --group-by Type=DIMENSION,Key=SERVICE \
  --query 'ResultsByTime[].Groups[].{Service:Keys[0],Cost:Metrics.BlendedCost.Amount}' \
  --output table

# Create a $500/month budget with 80% alert
aws budgets create-budget \
  --account-id $(aws sts get-caller-identity --query Account --output text) \
  --budget '{"BudgetName":"MonthlySpend","BudgetLimit":{"Amount":"500","Unit":"USD"},"TimeUnit":"MONTHLY","BudgetType":"COST"}' \
  --notifications-with-subscribers '[{"Notification":{"NotificationType":"ACTUAL","ComparisonOperator":"GREATER_THAN","Threshold":80},"Subscribers":[{"SubscriptionType":"EMAIL","Address":"you@thedatashark.com"}]}]'

# Opt in to Compute Optimizer (free)
aws compute-optimizer update-enrollment-status --status Active

# Get rightsizing recommendations
aws compute-optimizer get-ec2-instance-recommendations \
  --query 'instanceRecommendations[].{
    Instance:instanceArn,
    Current:currentInstanceType,
    Finding:finding,
    Recommended:recommendationOptions[0].instanceType,
    MonthlySavings:recommendationOptions[0].estimatedMonthlySavings.value
  }' \
  --output table

# Check average CPU utilisation over 30 days
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
  --start-time $(date -d "30 days ago" --utc +%FT%TZ) \
  --end-time $(date --utc +%FT%TZ) \
  --period 86400 --statistics Average Maximum \
  --query 'sort_by(Datapoints,&Timestamp)[].{Date:Timestamp,Avg:Average,Max:Maximum}' \
  --output table

# Check current Spot vs On-Demand pricing
aws ec2 describe-spot-price-history \
  --instance-types m5.xlarge \
  --product-descriptions "Linux/UNIX" \
  --start-time $(date --utc +%FT%TZ) \
  --query 'SpotPriceHistory[].{AZ:AvailabilityZone,Price:SpotPrice}' \
  --output table

# Launch Spot with interruption handling
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type m5.xlarge \
  --instance-market-options '{"MarketType":"spot","SpotOptions":{"SpotInstanceType":"one-time","InstanceInterruptionBehavior":"terminate"}}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=spot-worker}]'

{
  "Rules": [{
    "ID": "auto-tiering",
    "Status": "Enabled",
    "Filter": { "Prefix": "" },
    "Transitions": [
      { "Days": 30,  "StorageClass": "STANDARD_IA" },
      { "Days": 90,  "StorageClass": "INTELLIGENT_TIERING" },
      { "Days": 365, "StorageClass": "GLACIER_IR" }
    ],
    "NoncurrentVersionExpiration": { "NoncurrentDays": 90 },
    "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 7 }
  }]
}

aws s3api put-bucket-lifecycle-configuration \
  --bucket your-bucket-name \
  --lifecycle-configuration file://lifecycle-policy.json

# Stop dev instances at 8pm IST (14:30 UTC) Mon-Fri
aws events put-rule \
  --name "StopDevInstances" \
  --schedule-expression "cron(30 14 ? * MON-FRI *)" \
  --state ENABLED

# Start dev instances at 9am IST (03:30 UTC) Mon-Fri
aws events put-rule \
  --name "StartDevInstances" \
  --schedule-expression "cron(30 3 ? * MON-FRI *)" \
  --state ENABLED

# Quick manual stop of all dev instances
aws ec2 describe-instances \
  --filters "Name=tag:Environment,Values=dev" "Name=instance-state-name,Values=running" \
  --query 'Reservations[].Instances[].InstanceId' --output text | \
  xargs aws ec2 stop-instances --instance-ids

# See all Docker networks
docker network ls

# Inspect bridge network details
docker network inspect bridge

# See Docker iptables NAT rules
sudo iptables -t nat -L DOCKER -n --line-numbers

docker run -d --name web nginx:alpine
docker run -d --name db  postgres:15-alpine -e POSTGRES_PASSWORD=secret

# This FAILS on the default bridge — no DNS by name
docker exec web ping -c2 db
# ping: bad address 'db'

# IP works — but hardcoding IPs in production is wrong
docker inspect db --format '{{.NetworkSettings.IPAddress}}'

# Create a custom bridge network
docker network create \
  --driver bridge \
  --subnet 192.168.10.0/24 \
  --gateway 192.168.10.1 \
  app-network

# Start containers on the custom network
docker run -d --name web --network app-network nginx:alpine
docker run -d --name db  --network app-network postgres:15-alpine \
  -e POSTGRES_PASSWORD=secret

# DNS by name works automatically
docker exec web ping -c2 db
# PING db (192.168.10.3) — success!

# Connect an existing container to a second network
docker network connect monitoring-net web

# No -p port mapping needed — binds directly to host port 80
docker run -d --network host --name nginx-host nginx:alpine
curl http://localhost:80   # connects directly — zero NAT overhead

docker swarm init --advertise-addr 192.168.1.10

docker network create \
  --driver overlay \
  --subnet 10.0.0.0/24 \
  --attachable \
  app-overlay

docker service create --name web --network app-overlay --replicas 3 -p 80:80 nginx:alpine

# Enable promiscuous mode on host NIC
sudo ip link set eth0 promisc on

# Create macvlan network
docker network create \
  --driver macvlan \
  --subnet 192.168.1.0/24 \
  --gateway 192.168.1.1 \
  --ip-range 192.168.1.192/27 \
  --opt parent=eth0 \
  macvlan-net

# Container gets a real IP on your LAN
docker run -d --name pihole --network macvlan-net \
  --ip 192.168.1.200 pihole/pihole:latest

# Reachable from any device on your network
ping 192.168.1.200

# Container gets only loopback — no network access
docker run --network none --rm alpine ip addr show
# Only lo (127.0.0.1) — completely isolated

# Check container's DNS config
docker exec web cat /etc/resolv.conf
# nameserver 127.0.0.11

# Add network aliases — multiple names for one container
docker run -d --name primary-db \
  --network app-network \
  --network-alias database \
  --network-alias db \
  postgres:15-alpine

# DNS round-robin — run 3 containers with same alias
for i in 1 2 3; do
  docker run -d --name "api-$i" --network app-network --network-alias api nginx:alpine
done
docker run --rm --network app-network alpine nslookup api
# Returns all 3 IPs — basic load balancing via DNS

services:
  # Public-facing proxy — on public-net only
  nginx:
    image: nginx:alpine
    ports: ["80:80", "443:443"]
    networks: [public-net]

  # App bridges both networks
  app:
    image: myapp:latest
    networks: [public-net, private-net]
    environment:
      - DB_HOST=postgres

  # Database — private-net only, NOT reachable from nginx
  postgres:
    image: postgres:15-alpine
    networks: [private-net]

  redis:
    image: redis:7-alpine
    networks: [private-net]

networks:
  public-net:
    driver: bridge
  private-net:
    driver: bridge
    internal: true  # No outbound internet

## 1. Which networks is the container on?
docker inspect CONTAINER --format '{{json .NetworkSettings.Networks}}' | python3 -m json.tool

## 2. Check IP, gateway, DNS
docker exec CONTAINER ip addr show
docker exec CONTAINER ip route show
docker exec CONTAINER cat /etc/resolv.conf

## 3. Test DNS resolution
docker exec CONTAINER nslookup OTHER_CONTAINER
docker exec CONTAINER nslookup google.com

## 4. Test TCP connectivity
docker exec CONTAINER nc -zv OTHER_CONTAINER 5432

## 5. Run a debug container (netshoot has everything)
docker run --rm -it \
  --network container:PROBLEM_CONTAINER \
  nicolaka/netshoot bash
# netshoot includes: tcpdump, nmap, curl, dig, ss, iperf3 and more

## 6. Capture traffic between containers
docker run --rm -it \
  --network container:CONTAINER_NAME \
  --cap-add NET_ADMIN \
  nicolaka/netshoot \
  tcpdump -i eth0 -nn

docker network create app1-net
docker network create app2-net

# App1 and App2 are completely isolated
docker run -d --name app1-web --network app1-net nginx:alpine
docker run -d --name app2-web --network app2-net nginx:alpine

# Connect Prometheus to both (monitoring access without cross-app access)
docker network connect app1-net prometheus
docker network connect app2-net prometheus

# Find all subjects with cluster-admin
kubectl get clusterrolebindings \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.roleRef.name}{"\t"}{range .subjects[*]}{.kind}/{.name}{" "}{end}{"\n"}{end}' \
  | grep cluster-admin

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: deploy-manager
rules:
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch", "update", "patch"]

# Enforce restricted policy on production namespace
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  seccompProfile:
    type: RuntimeDefault
  capabilities:
    drop: ["ALL"]

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
---
# Allow frontend → backend traffic only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels: { app: backend }
  policyTypes: [Ingress]
  ingress:
  - from:
    - podSelector:
        matchLabels: { app: frontend }
    ports: [{ protocol: TCP, port: 8080 }]

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources: ["secrets"]
  providers:
  - aescbc:
      keys:
      - name: key1
        secret: <base64-encoded-32-byte-key>
  - identity: {}

# Generate a 32-byte encryption key
head -c 32 /dev/urandom | base64

# Re-encrypt all existing secrets after enabling
kubectl get secrets --all-namespaces -o json | kubectl replace -f -

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
  resources: [{ group: "", resources: ["secrets"] }]
- level: RequestResponse
  resources: [{ group: "", resources: ["pods/exec", "pods/portforward"] }]
- level: None
  users: ["system:kube-proxy"]
  verbs: ["watch"]
- level: Metadata