Master Cheatsheet

Key Concepts

• SKUs: Basic → Standard → Premium (geo-rep, private endpoints)
• Auth: Always Managed Identity in prod. Admin user = NEVER
• ACR Tasks: Cloud builds, multi-step pipelines, trigger on git/base image
• Geo-replication: Premium only. Pushes to one, pulls from nearest
• Content Trust: Notary v2 image signing. Premium only

Memory Trick

CLI Commands

az acr create --name myacr --sku Premium
az acr build --registry myacr --image app:v1 .
az acr login --name myacr
az acr task create --name build-on-push \
  --registry myacr --image app:latest \
  --context https://github.com/org/repo \
  --branch main --git-access-token $TOKEN

Gotcha

Key Concepts

• Scaling: KEDA-based. minReplicas: 0 = scale-to-zero
• Revisions: Immutable snapshots. Traffic splitting for canary
• Dapr: Sidecar for service discovery, pub/sub, state, secrets
• Ingress: External (public) or Internal (VNet only)
• vs AKS: No K8s management. vs App Service: supports event-driven scale

Memory Trick

CLI Commands

az containerapp env create -n myenv -g rg \
  --location eastus
az containerapp create -n myapp -g rg \
  --environment myenv \
  --image myacr.azurecr.io/app:v1 \
  --target-port 8080 --ingress external \
  --min-replicas 0 --max-replicas 10

Gotcha

Key Concepts

• Control plane: Managed by Microsoft, FREE
• Node pools: System (CoreDNS) + User (your apps)
• Networking: Kubenet (NAT) vs Azure CNI (real pod IPs)
• Helm: K8s package manager — charts, values, releases
• HPA: CPU/memory autoscaler. KEDA for event-driven scaling

Memory Trick

CLI Commands

az aks create -n myaks -g rg \
  --node-count 3 --network-plugin azure \
  --attach-acr myacr
az aks get-credentials -n myaks -g rg
kubectl get pods -A
helm install myapp ./chart -f values.yaml
kubectl apply -f deployment.yaml

Gotcha

Key Concepts

• RUs: 1KB read = 1 RU · 1KB write = 5–6 RU
• Partition key: IMMUTABLE after creation. Choose wisely
• Consistency: Strong→Bounded→Session(default)→Prefix→Eventual
• Change Feed: Captures inserts + updates. NOT deletes
• Vector: DiskANN index · VectorDistance() function

Memory Trick

CLI / SDK

az cosmosdb create -n mydb -g rg
az cosmosdb sql container create \
  -a mydb -d mydb -n items -g rg \
  --partition-key-path /userId
# SDK vector query:
SELECT c.id, VectorDistance(
  c.embedding, @queryVector) AS score
FROM c ORDER BY score OFFSET 0 LIMIT 10

Gotcha

Key Concepts

• pgvector: Extension for vector storage + similarity search
• HNSW: Higher accuracy, works on empty tables. Production choice
• IVFFlat: Lower memory, needs data before build
• Operators: <=> cosine · <-> L2 · <#> inner product
• RAG: Retrieve embeddings → inject as LLM context

Memory Trick

SQL Commands

CREATE EXTENSION IF NOT EXISTS pgvector;
CREATE TABLE docs (
  id serial PRIMARY KEY,
  content text,
  embedding vector(1536)
);
CREATE INDEX ON docs USING hnsw
  (embedding vector_cosine_ops);
-- Search:
SELECT content,
  embedding <=> $1 AS distance
FROM docs ORDER BY distance LIMIT 5;

Gotcha

Key Concepts

• Vector search: Enterprise tier only (RediSearch module)
• Cache-aside: App manages cache. Miss → read DB → write cache
• Semantic cache: Cache LLM responses by embedding similarity
• TTL: Auto-expire keys. Essential for cache invalidation
• Tiers: Basic(dev) → Standard(HA) → Premium → Enterprise(vector)

Memory Trick

CLI / Commands

az redis create -n myredis -g rg \
  --sku Premium --vm-size c1
# Redis CLI:
SET user:1 "alice-data" EX 3600
GET user:1
DEL user:1
EXPIRE user:1 1800
# Python (redis-py):
r.set("key", value, ex=3600)
r.get("key")

Gotcha

Key Concepts

• Service Bus Queue: Point-to-point, ordered, guaranteed delivery
• Service Bus Topic: Pub/sub, multiple subscriptions with filters
• PeekLock: Lock → process → complete. Prevents message loss
• DLQ: Dead-letter queue for poison/expired messages
• Event Grid: Reactive routing of Azure resource events

Memory Trick

CLI / SDK

az servicebus namespace create -n myns -g rg
az servicebus queue create -n myqueue \
  --namespace myns -g rg
az eventgrid topic create -n mytopic -g rg
# Functions binding (function.json):
"type": "serviceBusTrigger",
"queueName": "myqueue",
"connection": "ServiceBusConnection"

Gotcha

Key Concepts

• Key Vault objects: Secrets · Keys · Certificates
• Auth: Managed Identity + RBAC. Never store credentials
• Soft-delete: 7–90 days recovery window
• Purge protection: Irreversible once enabled
• App Config: Non-secret settings + feature flags. KV references for secrets

Memory Trick

CLI Commands

az keyvault create -n myvault -g rg \
  --enable-purge-protection true
az keyvault secret set \
  --vault-name myvault -n dbpass \
  --value "mySecretPwd"
az role assignment create \
  --role "Key Vault Secrets User" \
  --assignee $MANAGED_IDENTITY_ID \
  --scope /subscriptions/.../vaults/myvault

Gotcha

Key Concepts

• OTel pillars: Traces (spans + TraceId) · Metrics · Logs
• TraceId: Unique per request, shared across all services
• Connection String: Use instead of deprecated InstrumentationKey
• KQL WSP: Where (filter) → Summarize (group) → Project (select)
• Alerts: Metric/log alerts → Action Groups → notifications

Memory Trick

KQL + Code

// KQL - Find slow requests:
requests
| where timestamp > ago(1h)
| where duration > 5000
| summarize avg(duration) by name
| order by avg_duration desc
| project name, avg_duration

# Python OTel setup:
from azure.monitor.opentelemetry import configure_azure_monitor
configure_azure_monitor(
  connection_string="InstrumentationKey=..."
)

Gotcha