Glossary

面试官开场最常用的句式;你自己讲架构时也可以说 let me walk you through…

Walk me through how a request gets from the extension to your backend.

system design 里每个决定后面都要跟一句 the trade-off is…

The trade-off is lower latency at the cost of a more complex failover story.

讲 Terraform state 拆分、IAM 最小权限、分集群时用

Splitting state per environment keeps the blast radius small.

口语里常缩成 SPOF,念 spoof

The dedicated line was a single point of failure, so we kept a VPN as a fallback.

设计题里算 QPS、存储量时先说这句,给自己留余地

Back-of-the-envelope, that is about 2,000 requests per second at peak.

被问「大概多少」时用;a ballpark figure / in the ballpark of

Ballpark, the EU region cost us around ten thousand a month.

My rule of thumb is to keep 30 percent headroom on the node pool.

讲成本优化、入职前 90 天计划时用

Spot runners were the low-hanging fruit on cost.

BQ 里讲拒绝需求;名词是 pushback

I pushed back on giving developers kubectl access to production.

Trust Wallet 价值观里有 extreme ownership,这个词多用

I took ownership of the migration end to end.

两个意思:新人上手(ramp-up time),或者流量逐步切(ramp up traffic)

We ramped canary traffic up from 1 to 10 to 50 percent.

The edge case is a pod that passes readiness but cannot reach the database.

和 failure path 对着说

That is the happy path; the interesting part is what happens when the upstream times out.

mTLS between services is table stakes for a wallet backend.

JD 原词。指不靠人自觉、靠机制拦住的东西:policy、admission、CI 检查

The guardrail is an admission policy, not a wiki page asking people to be careful.

平台工程的核心词:默认路径最省事,偏离要自己承担

The golden path is a Helm chart plus an ArgoCD ApplicationSet; anything else you own yourself.

Git is the source of truth; anything applied by hand is drift.

实际状态偏离声明的状态;Terraform 和 ArgoCD 都用这个词

ArgoCD flags the drift and self-heals it within a few minutes.

简历里的 0 to 1 就是 greenfield

The EU region was greenfield, so we could enforce GitOps from day one.

I built the observability stack from scratch.

The FluxCD setup had accumulated a lot of tech debt in the form of hand-written kustomizations.

设计题里主动说「这里我不会 over-engineer」是加分的

Multi-region active-active would be over-engineering for this traffic level.

Istio adds a lot of moving parts; you need a reason to pay for that.

讲错误、复盘时的自然开头

In hindsight, we should have load-tested the runner pool before cutting over.

被问数字又记不准时用,比编一个数强

Off the top of my head, it was around 40 percent, but I would want to check.

动词化用法也常见:root-cause the issue

The root cause was conntrack table exhaustion on the NAT gateway node.

故障里两个阶段:先 mitigate(回滚、切流),再 remediate(修根因)

We mitigated by rolling back, then remediated the config in the next release.

The chart ships sane defaults so most teams never touch the values file.

形容平台不给太多选择、替用户做决定

The platform is opinionated: one way to deploy, one way to get logs.

Istio gives you per-route latency histograms out of the box.

讲平台封装到什么程度时用:封太多,底层出问题时用户看不懂

Hiding Kubernetes completely becomes a leaky abstraction the first time a pod is OOMKilled.

Phase one was lift and shift; containerisation came later.

For a wallet, key material never touching the server is non-negotiable.

设计题里先跳过某个细节时用

Let me circle back to caching once the write path is clear.

承认对方观点或承认自己的方案有缺点时的缓冲

To be fair, ambient mode has closed most of that gap.

SLI 是测量,SLO 是内部目标,SLA 是对外承诺带赔偿。三个不要混着说

The SLI is the success ratio at the ingress gateway; the SLO is 99.9 percent over 30 days.

1 减 SLO 就是预算;烧完了停发布,这是 SLO 唯一有牙齿的地方

Once the error budget is exhausted, feature releases pause until it recovers.

告警打在 burn rate 上,不打在 SLI 低于 SLO 上;多窗口多 burn rate 是标准答案

A 14x burn rate over one hour pages; a 1x burn rate over three days opens a ticket.

latency, traffic, errors, saturation。被问「你看什么指标」时的骨架

念 p ninety-nine;平均值没意义要说出口

Average latency looked fine; p99 had doubled because of connection pool exhaustion.

配套词:primary / secondary, handover, follow-the-sun

We ran a weekly rotation with a primary and a secondary.

动词用法:get paged, page someone。只有用户可见的问题有资格 page

I got paged at 3 a.m. for a disk-full alert that should have been a ticket.

If the primary does not acknowledge in 10 minutes, PagerDuty escalates to the secondary.

runbook 偏具体步骤,playbook 偏决策流程;面试里混用也没人纠正

Every paging alert links to a runbook with the first three things to check.

拉丁语 post mortem 是「死后」,原义是医学尸检;工程里借来指故障结束后写的那份文档:时间线、影响、根因、行动项。出处是 Google SRE 书第 15 章 Postmortem Culture: Learning from Failure,核心是 blameless —— 默认每个人当时都在用手头的信息做合理决定,追问的是系统为什么允许这个错误发生,而不是谁犯的;更早的 Etsy 那篇 Blameless PostMortems(John Allspaw, 2012)也常被引。中文「复盘」也用于项目总结,和面试官说 postmortem 更准确;PagerDuty、Atlassian 的文档也都用这个词,少数团队叫 incident review 或 retrospective。念 post-MOR-tem,重音在中间。

We ran a blameless postmortem the next day; the action item was an alert on consumer lag, not a reminder to be more careful.

日常英语里 toil 是「苦役、辛劳」;SRE 语境里是 Google SRE 书第 5 章 Eliminating Toil(Vivek Rau)给的专门定义:和运维服务相关、手动、重复、可以被自动化、战术性、没有长期价值、随服务规模线性增长的工作。它不等于「杂活」:写文档、开会不算 toil(没长期价值但不随规模涨),半夜手动重启卡住的消费者算。Google 给的目标是 SRE 时间里 toil 不超过 50%,剩下做工程。中文没有统一译法,「琐事」「重复劳动」都有人用,当面说英文 toil 最省事。面试用法:讲 on-call 改进时,「我们把 X 这个 toil 自动化掉了」比「我们优化了流程」具体得多。

Restarting stuck consumers was pure toil, so I wrote a controller that does it and pages only when the restart does not help.

念字母;讲可观测性收益时用 MTTD,讲 runbook 和自动化收益时用 MTTR

大故障时一个人只做协调不动手;缩写 IC

The incident commander keeps the timeline and decides when to roll back.

念 sev one;不同公司定义不同,面试里先问他们怎么定

A sev1 is user-facing and has no workaround.

If the price feed is down, the balance still loads; we just hide the fiat value.

过载时按优先级拒绝请求;和 rate limiting 的区别是它看的是自身健康度

Under overload the gateway sheds low-priority traffic like NFT metadata first.

下游慢时把压力传回上游,而不是无限排队

Bounded queues give you backpressure instead of an OOM.

配套:half-open 状态,outlier detection(Istio 的实现)

Istio outlier detection acts as a circuit breaker per upstream host.

讲为什么重试要 exponential backoff with jitter 和 retry budget

Without jitter every client retried at the same second and we got a retry storm.

念 eye-DEM-po-tent;讲重试安全性、GitOps reconcile 都用

The reconcile loop is idempotent, so re-running it is always safe.

把资源按用途隔开,一个坏了不拖垮全部;连接池分开、节点池分开都算

Failover to the replica was automatic; failback we did by hand the next morning.

多区域设计题第一句要表态选哪个、为什么

RTO 多久恢复,RPO 丢多少数据;先问业务要什么再设计

With an RPO of five minutes, async replication is enough; zero RPO means synchronous.

We keep about 30 percent headroom so an AZ failure does not trigger scale-up under load.

We ran a game day where we killed the primary database to test the runbook.

没挂但变慢、部分失败,健康检查看不出来的那种

A gray failure like 5 percent packet loss is worse than a clean outage.

feature flag 的一种用法:不用发版就能关掉功能

告警打在用户能感知的东西上,不打在 CPU 高这种原因上

We moved from cause-based alerts like high CPU to symptom-based alerts on error ratio.

Alert fatigue was the real problem: 200 alerts a week and nobody read them.

K8s 和 Istio 都这么分;讲 Istio 时 istiod 是控制面,Envoy sidecar 是数据面

controller 的核心:不断把实际状态拉向期望状态;ArgoCD 也是这个词

The operator's reconcile loop compares desired and actual state every few seconds.

mutating 改对象,validating 只放行或拒绝;简历上的 Java Agent 注入就是 mutating

I wrote a mutating admission webhook in Go that injects the Java agent.

We manage the pipeline as a CRD and an operator built with Operator SDK.

缩写 PDB;node drain 和升级时保证最少可用副本

Without a PDB, a node upgrade can take down every replica at once.

HPA 按指标加副本,VPA 调 requests,KEDA 按队列深度这类外部指标

Karpenter 直接按 pod 需求开节点,不走 node group;AWS 上现在的默认选择

GKE 叫 node pool,EKS 叫 node group

Spot nodes carry a taint so only stateless workloads with the toleration land there.

requests 决定调度和 QoS,limits 决定 OOMKill 和 throttling

Guaranteed / Burstable / BestEffort,决定 eviction 顺序

念 oom-killed;exit code 137

Exit code 137 means OOMKilled; the first thing I check is the memory limit versus the JVM heap.

CFS quota 导致的延迟毛刺;p99 高但 CPU 使用率不高时想到它

CPU throttling showed up as p99 spikes even though average utilisation was 40 percent.

eviction 是节点压力赶走 pod,preemption 是高优先级 pod 挤走低优先级

readiness 失败摘流量,liveness 失败重启;liveness 配错会造成重启风暴

Cordon the node first, then drain it respecting PDBs.

SIGTERM 之后要先摘流量再退出;preStop sleep 是常见的补丁

We add a preStop sleep so the endpoint is removed before the process gets SIGTERM.

sidecar 每个 pod 一个 Envoy;ambient 用节点级 ztunnel,省资源但更新;诚实说没在规模上运维过 ambient

念 em-TLS;PeerAuthentication STRICT 模式

Istio gives us mTLS between services without touching application code.

VS 管怎么路由(权重、header 匹配),DR 管到了目标怎么处理(subset、连接池、outlier)

mirroring 也叫 shadowing,复制一份请求到新版本但不返回给用户

We mirrored 10 percent of production traffic to the new version before shifting any real traffic.

Envoy 的被动健康检查,连续 5xx 就把这个 endpoint 摘一段时间

Gateway API 正在替代 Ingress 资源,Istio 已支持

默认 deny-all 再放行是标准答案;需要 CNI 支持(Calico / Cilium)

AWS 叫 IRSA(IAM Roles for Service Accounts),GCP 叫 Workload Identity;不再往 pod 里塞长期 AK

With IRSA each service account maps to one IAM role, so there are no long-lived keys in the cluster.

替代了 PodSecurityPolicy;三个级别 privileged / baseline / restricted

ClusterIP 是 iptables 或 IPVS 规则,不是真实进程;Cilium 可以完全绕过 kube-proxy

ndots:5 导致外部域名先查 4 次集群内后缀;高 QPS 服务 DNS 慢的经典原因

Service 后面真正的 pod IP 列表;readiness 失败就从这里摘掉

多租户里一个应用吃光节点资源拖累别人;答案是 requests/limits、quota、独立节点池

chart 是模板,values 是参数,release 是装进集群的一个实例

S3 + DynamoDB 锁是 AWS 上的标准答案;新版本 S3 原生锁也行

State lives in S3 with DynamoDB locking so two applies cannot race.

面试里要说清楚:plan 在 PR 里看,apply 只在 merge 后跑

JD 原词。在 PR 里评论 atlantis plan / atlantis apply,plan 结果回贴 PR,带锁防并发

Atlantis posts the plan on the PR and locks the directory until it is applied or unlocked.

定时 plan 看有没有非零 diff;有人 ClickOps 了就能抓到

贬义;drift 的主要来源

Every ClickOps change shows up as drift in the nightly plan.

模块要 pin 版本;根模块和子模块的边界怎么切是常见追问

同一份代码多套状态;很多团队更喜欢按目录分环境而不是 workspace

The RDS instance has prevent_destroy so a bad refactor cannot delete it.

ArgoCD 的引导模式;简历上用过,要能讲为什么后来还要 ApplicationSet

generator 有 list、cluster、git directory、matrix 几种

A git directory generator creates one Application per service folder automatically.

wave 控制资源先后(先 CRD 后 CR),hook 跑 PreSync / PostSync 任务(如数据库迁移)

self-heal 把手改的东西拉回来,prune 删掉 Git 里已经没有的资源;prune 要小心开

GitOps 是 pull:集群里的 agent 去拉 Git;CI 直接 kubectl apply 是 push

GitHub Actions 到 AWS 不用长期 key 的标准做法;短期 token 换 IAM role

GitHub Actions assumes the role through OIDC, so there is no AWS key stored in the repo.

Secret sprawl was the real risk: the same key lived in three CI systems and a wiki.

External Secrets 从云 secret manager 同步,Sealed Secrets 加密后进 Git,SOPS 文件级加密

Trust Wallet 2025 年底 extension 事件就是这一类;讲 CI 安全时必提

A compromised build dependency is a supply chain attack; signing and provenance are the defence.

念 S-bomb;列出镜像里所有依赖,漏洞出来时能查影响面

配合 admission policy 只允许签过名的镜像跑

Images are signed with cosign and the admission policy rejects anything unsigned.

念 salsa;证明这个制品是哪次构建、从哪个 commit 产出的

第三方 GitHub Action 要 pin 到 commit SHA,不要 pin tag

We pin third-party actions to a full commit SHA, not a tag.

Gatekeeper 是 OPA 的 K8s 封装;Kyverno 用 yaml 写策略更简单

Trivy、X-ray;区分「扫出来」和「阻断」两个阶段

把安全检查提前到 PR 阶段;DevSecOps 的标准说法

不信任网络位置,每个请求都验身份;Cloudflare Access / Tunnel 是他们大概率在用的实现

zero trust 语境下常被 Cloudflare Tunnel 或 SSM Session Manager 替代

K8s API server audit、CloudTrail;安全题里「谁在什么时候改了什么」靠它

CIDR 念 cider;设计题里 CIDR 规划别和其他区域重叠是常见追问

NAT gateway 按流量计费,是 AWS 账单里常见的隐形大头

Half the network bill was NAT gateway egress from pods pulling images.

访问 S3、ECR 走 endpoint 不走 NAT,省钱也更安全

SG 有状态、挂在实例上;NACL 无状态、挂在子网上

ALB 七层,NLB 四层;gRPC 和固定 IP 需求选 NLB

简历上 PVC 迁移单 AZ 就是为了这个;topology-aware routing 是另一条路

AWS 叫 spot,GCP 叫 preemptible 或 spot VM;要能讲被回收时怎么处理

AWS 前两个,GCP 是 CUD

showback 只展示,chargeback 真扣预算;简历上的 GKE Metering 看板是 showback

每个用户 / 每千次请求多少钱;比总账单更有说服力的成本指标

Cost per thousand requests dropped 30 percent after moving runners to spot.

Cloudflare 的核心概念:请求先到最近的 PoP

Cloudflare 后面的真实服务;要讲怎么保证只有 Cloudflare 能打到 origin(authenticated origin pulls、IP allowlist)

We lock the origin down so only Cloudflare IPs can reach the load balancer.

念 waff;managed rules 加自定义规则

crypto 是 DDoS 重灾区;Cloudflare 在 L3/L4 和 L7 都挡

分层:Cloudflare 边缘、网关、服务内部;按什么 key 限(IP、API key、钱包地址)是追问点

swill.fun 就跑在上面,可以拿来举例

不开入站端口就能把内网服务暴露给通过身份验证的人;替代 VPN 和堡垒机

同一个 IP 在全球多个 PoP 宣告,就近接入;Cloudflare 的 DNS 和网络都靠它

多区域切流的最简单办法,代价是 TTL 内切不干净

serverless 和新节点都有这个问题

简历上 AWS EU 的动机;数据必须存在某个地理范围内

多账号结构、SSO、网络、日志、guardrails 的一整套起手式

AWS 按环境或团队分账号是隔离和成本归属的基础;SCP 在 OU 上做护栏

AWS Organizations 层面的权限上限,root 也绕不过

被问「可观测性怎么建」先说三个各解决什么问题,再说怎么关联

label 组合数;user_id 这种高基数 label 会把 Prometheus 打爆

Putting wallet address on a label would blow up cardinality; that belongs in logs or traces.

SLO 的 SLI 都应该先做成 recording rule,告警和看板都查它

histogram_quantile 是从 bucket 估算的,不是精确值;bucket 边界要按 SLO 阈值设

多集群设计题里的标准答案之一;Thanos sidecar 上传 S3,querier 聚合

本地 Prometheus 15 天,长期进对象存储;日志同理分 hot / warm / cold

OTel 的核心:trace ID 通过 header(traceparent)在服务间传下去

Without context propagation you get islands of spans instead of one trace.

head 在入口决定采不采,便宜但会丢慢请求;tail 在 collector 看完整个 trace 再决定,能保留所有错误

receiver → processor → exporter 三段;部署成 agent(DaemonSet)或 gateway

auto-instrumentation(agent 注入)和 manual;简历上 Java Agent 注入就是 auto

RED 看服务:Rate, Errors, Duration;USE 看资源:Utilisation, Saturation, Errors

JSON 一行一条,带 trace_id 字段才能和 trace 关联

JD 原词。按堆栈聚合错误、带 release 和用户上下文;和 metrics 的分工是「哪一行代码」vs「多少比例」

Sentry tells you which line threw; Prometheus tells you what fraction of requests failed.

Sentry 的功能:按版本看 crash-free 率;客户端(extension / mobile)团队最看这个

Grafana dashboard 的 JSON 进 Git,用 Grafana Operator 或 Terraform provider 部署

低流量服务没有足够样本算 SLI,靠拨测补

只有用户可见且需要人立刻处理的才 page,其他进工单

简历上把 GCP flow log 转成 Prometheus 指标;讲怎么看流量模式和排查安全组问题

消息队列的核心 SLI,不是成功率

阻塞在 channel 或没被取消的 goroutine 永远不退出;pprof goroutine 数持续涨就是它

A goroutine leak showed up as the goroutine count climbing in pprof over a day.

每个出站调用都要带 ctx;HTTP 和 gRPC 都会把 deadline 传给下游

The handler's context carries the deadline, so the database call gives up when the client already has.

sync.Map 只适合读多写少、key 固定的场景;Trust Wallet 那个落选反馈就点名了滥用 sync.Map

go test -race;面试里主动说 CI 跑 -race 是加分

errgroup.WithContext 是并发扇出的标准写法;有界并发用 semaphore 或 worker pool

fmt.Errorf 里用 %w;sentinel error 和自定义 error 类型的取舍

默认 http.Client 没有超时;连接池参数在 Transport 上(MaxIdleConnsPerHost 默认只有 2)

The default MaxIdleConnsPerHost is 2, which is why we saw connection churn under load.

收到 SIGTERM 后先 readiness 失败、等 in-flight 请求完成、再 Shutdown

日志、metrics、auth、tracing 都在这一层;OTel 有现成的 interceptor

DeadlineExceeded、Unavailable 可重试,InvalidArgument 不可;重试策略按状态码区分

字段只加不删、不复用编号

CPU、heap、goroutine、block、mutex 五种 profile;生产上通过 /debug/pprof 采

容器里设 GOMEMLIMIT 和 memory limit 对齐,避免 OOMKilled

深度追问才会到;知道 go build -gcflags=-m 能看就行

简历上 DaoCloud 的服务发现就是 watch API server;informer 是带本地缓存和 resync 的 watch

An informer keeps a local cache and hands you add, update and delete events instead of polling.

Go 的惯用测试写法;take-home 里用这个写法是加分项

私钥在用户设备上,服务端永远没有;这是 Trust Wallet 和交易所的本质区别,后端所有设计都从这句推

Because the wallet is non-custodial, nothing on our side can move funds; the backend only reads chain state and serves data.

12 或 24 个词,能推出所有私钥;泄露等于全丢

交易在设备上签名,后端只负责广播

联网 / 不联网;硬件钱包是冷的

钱包读余额、发交易都是调节点的 JSON-RPC;eth_getBalance、eth_sendRawTransaction

The backend fronts a pool of RPC nodes so the app never talks to a single provider directly.

Alchemy、Infura、QuickNode;自建节点 vs 买服务是成本和可靠性的取舍

archive 保留所有历史状态,查历史余额要它,存储贵好几倍

把链上事件整理成可查询的数据库;交易历史、代币余额都靠它,不能每次去扫链

reorg 会让已经显示的交易消失;显示「已确认」前等几个块

We wait for finality before marking a deposit confirmed, because a reorg can drop the block.

nonce 必须连续,卡住一笔后面全堵;后端估 gas 的服务是常见的可用性痛点

EVM 兼容链共享工具链;L2 便宜快但有自己的最终性规则

Trust Wallet 支持 100+ 链,意味着几十套异构节点要一起运维

历史上被盗最多的一类基础设施

钱包内 swap 是后端调多个 DEX 报价再选最优,是一条典型的对外依赖链

JD 里「developers building on Trust Wallet」主要就是 dApp 开发者

后端大部分是链下服务:价格、通知、索引、推送

流量洪峰的典型触发源,设计题里可以拿来举例

钱包用户的主要损失来源;安全团队的日常

深水区,听得懂就行

C++ 写的,extension / mobile / desktop 共用;体现「一套核心多端」的架构

Claude Code、Copilot、Cursor;说清楚你用哪个、用在哪一步

模型自己调工具、跑命令、看结果再改;和「补全」的区别要能一句话说清

The agentic part is that it runs the tests, reads the failure and fixes it, instead of just suggesting a line.

JD 原词。可复用的提示结构:角色 + 约束 + 示例 + 输出格式

CLAUDE.md、AGENTS.md 这类放在 repo 里的约束;swill.fun 的分层规则就是现成例子

We keep the conventions in a CLAUDE.md so every session starts with the same guardrails.

AI 语境下指:权限边界、只读模式、需要人确认的操作、不能碰生产

The guardrail is simple: the agent can plan Terraform but a human applies.

讲 AI 写 Terraform 编 provider 参数、写 K8s 编字段的真实例子

把 Grafana、K8s、GitHub 这类系统以标准接口接给模型;讲权限模型时要提最小权限和只读

An MCP server for Grafana lets the agent pull the dashboard during an incident without giving it write access.

念 rag;把 runbook 和 postmortem 喂给模型的常见方式

prompt 改了怎么知道变好了:固定一组用例跑分

跑在 PR 上的 reviewer;要能讲误报、噪音、代码泄露三个问题怎么处理

告警触发后自动汇总日志、trace、最近变更,给 on-call 一个起点;边界是它只建议不执行

deployment frequency, lead time for changes, change failure rate, time to restore;JD 说 measuring impact 就是这四个

We measure AI impact through DORA: lead time dropped, and change failure rate did not go up.

从 commit 到上生产

inner 是本地写码测试的分钟级循环,outer 是 PR 到上线;AI 目前主要加速 inner

平台工程的目标函数:减少开发者要知道的东西

把内部开发者当用户,有 roadmap、有反馈渠道;对应 JD 的 interfacing with users

可复用的 AI 工作流封装;swill.fun 的 /cover-letter 就是一个,面试里可以拿来当例子