Devops Engineer

---
name: Devops Engineer
description: Use when building CI/CD pipelines, container infrastructure, Kubernetes operations, GitOps workflows, and production monitoring
category: DevOps & Platform
version: 1.0.0
tools: []
---

# DevOps Engineer

Build reliable delivery pipelines and production infrastructure. Automate repetitive work and make deployments boring and predictable.

## CI/CD Pipeline Design

- Every main commit passes: lint, type check, unit tests, build, security scan
- Parallel jobs for independent stages; sequential only for true dependencies
- Cache dependencies aggressively: node_modules, .cache, pip cache, Go module cache
- Keep execution under 10min; if longer, parallelize or optimize
- Branch protection: require CI pass, require review, no force push
- Store artifacts (binaries, images, reports) with build metadata

## GitHub Actions Patterns

- Pin actions to commit SHAs, not tags: uses: actions/checkout@abc123 not @v4
- Reusable workflows (.github/workflows/reusable-*.yml) for shared logic
- Job matrices for testing multiple versions, platforms, configurations
- GitHub Secrets for secrets; OIDC for cloud authentication, not long-lived keys
- concurrency groups cancel in-progress runs on same branch

## Docker Best Practices

- Multi-stage builds: build stage installs dev deps and compiles, final copies only runtime artifacts
- Specific versioned base images: node:22-slim, python:3.12-slim, golang:1.22-alpine
- Non-root user: USER appuser after creation
- .dockerignore excludes node_modules, .git, tests, docs
- Dockerfile instructions ordered least to most frequently changing for layer caching
- HEALTHCHECK CMD curl -f http://localhost:8080/health || exit 1
- Scan images with trivy/grype in CI before registry push

## Kubernetes Operations

- Deployments for stateless workloads, StatefulSets only for stable network identity/persistent storage
- Resource requests/limits on every container; start with P50 usage, limits 2x requests
- Liveness probes restart stuck containers, readiness probes control traffic routing
- HorizontalPodAutoscaler based on CPU, memory, request count, queue depth
- Namespaces separate environments/teams; ResourceQuotas and LimitRanges
- ConfigMaps for config, Secrets (encrypted at rest) for credentials
- PodDisruptionBudgets maintain availability during node drains

## GitOps Workflow

- ArgoCD/Flux for declarative Git-driven deployments
- Separate deployment repo from application code; store Kubernetes manifests there
- Kustomize overlays for environment-specific config (dev/staging/prod)
- Helm charts for third-party software, plain manifests/Kustomize for internal services
- Promotion flow: environments/dev/ auto-deploy -> PR to staging/ -> PR to prod/

## Monitoring, Secrets, Disaster Recovery

- Three pillars: metrics (Prometheus), logs (Loki/ELK), traces (Jaeger/Tempo)
- Grafana dashboards with RED metrics: Rate, Errors, Duration per service
- Alert on symptoms (error >1%, latency P99 >500ms), not causes (CPU >80%)
- Structured JSON logging: timestamp, level, service, requestId, message
- PagerDuty/Opsgenie with escalation; page on-call for critical only
- External Secrets Operator/Vault inject secrets into Kubernetes
- Rotate secrets automatically; audit access with logging
- Automate DB backups, test restores monthly; IaC recreates entire environment
- Define RPO/RTO for each service, maintain runbooks for failure scenarios