devops-engineer Checked

| Topic | Reference | Load When |

|-------|-----------|-----------|

| GitHub Actions | references/github-actions.md | Setting up CI/CD pipelines, GitHub workflows |

| GitLab CI/CD | references/gitlab-ci.md | Setting up GitLab pipelines, .gitlab-ci.yml, DAG/needs, environments, runners |

| Docker | references/docker-patterns.md | Containerizing applications, writing Dockerfiles |

| Kubernetes | references/kubernetes.md | K8s deployments, services, ingress, pods |

| Terraform | references/terraform-iac.md | Infrastructure as code, AWS/GCP provisioning |

| Deployment | references/deployment-strategies.md | Blue-green, canary, rolling updates, rollback |

| Platform | references/platform-engineering.md | Self-service infra, developer portals, golden paths, Backstage |

| Release | references/release-automation.md | Artifact management, feature flags, multi-platform CI/CD |

| Incidents | references/incident-response.md | Production outages, on-call, MTTR, postmortems, runbooks |

Constraints

### MUST DO

• Use infrastructure as code (never manual changes)
• Implement health checks and readiness probes
• Store secrets in secret managers (not env files)
• Enable container scanning in CI/CD
• Document rollback procedures
• Use GitOps for Kubernetes (ArgoCD, Flux)

### MUST NOT DO

• Deploy to production without explicit approval
• Store secrets in code or CI/CD variables
• Skip staging environment testing
• Ignore resource limits in containers
• Use latest tag in production
• Deploy on Fridays without monitoring

Output Templates

Provide: CI/CD pipeline config, Dockerfile, K8s/Terraform files, deployment verification, rollback procedure

### Minimal GitHub Actions Example

name: CI
on:
  push:
    branches: [main]
jobs:
  build-test-push:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
      - name: Run tests
        run: docker run --rm myapp:${{ github.sha }} pytest
      - name: Scan image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
      - name: Push to registry
        run: |
          docker tag myapp:${{ github.sha }} ghcr.io/org/myapp:${{ github.sha }}
          docker push ghcr.io/org/myapp:${{ github.sha }}

### Minimal Dockerfile Example

FROM python:3.12-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

FROM python:3.12-slim
WORKDIR /app
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY . .
USER nonroot
HEALTHCHECK --interval=30s --timeout=5s CMD curl -f http://localhost:8080/health || exit 1
CMD ["python", "main.py"]

### Rollback Procedure Example

# Kubernetes: roll back to previous deployment revision
kubectl rollout undo deployment/myapp -n production
kubectl rollout status deployment/myapp -n production

# Verify rollback succeeded
kubectl get pods -n production -l app=myapp
curl -f https://myapp.example.com/health

Always document the rollback command and verification step in the PR or change ticket before deploying.

Knowledge Reference

GitHub Actions, GitLab CI, Jenkins, CircleCI, Docker, Kubernetes, Helm, ArgoCD, Flux, Terraform, Pulumi, Crossplane, AWS/GCP/Azure, Prometheus, Grafana, PagerDuty, Backstage, LaunchDarkly, Flagger

Documentation