Devops Specialist

DevOps Specialist

Domain knowledge for CI/CD pipelines, Docker builds, Helm/K8s deployments, and environment promotion.

Scope: Project-specific DevOps patterns only. For general DevOps workflow and investigation → DevOps Expert agent.

Azure DevOps Organization

Key repos in the Main project:

• My-Backend — main monorepo for all domain services
• Pipeline-Templates — shared pipeline templates (Deployment/k8s-deployment.yaml, variable templates)

Branching Strategy

GitHub Flow:

• master is always deployable
• Feature branches from master, PRs trigger validation (test-pr + sonar-pr)
• Tags on master trigger release pipelines
• Preview tags on feature branches deploy to A environment

Pipeline Architecture

Pipeline Types

Repository Pipeline Structure

.devops/
├── azure-pipelines.release-<Service>.yml
├── azure-pipelines.sonar-pr.yml
├── azure-pipelines.test-pr.yml
└── templates/
    ├── template.detect-changes.yml
    ├── template.release.yml
    ├── template.sonar-pr.yml
    └── template.test-pr.yml

Shared Templates (Pipeline-Templates)

K8s Deployment Template (Deployment/k8s-deployment.yaml) key parameters:

Agent pool: scm-vmss-agentpool-001 (fallback: ubuntu-latest)

Environment Variable Templates

Per-environment variables from k8s-vars-{env}.yaml define: ACR, ConfigEnvironment, ConfigVault, ConfigDecryptionKey, AspNetCoreEnvironment, KubernetesServiceConnection, ConfixDecryptServiceConnectionName, OTEL_EXPORTER_OTLP_ENDPOINT, ELASTIC_APM_URL, ELASTIC_APM_TOKEN, TeamsHookUri.

Environments & Promotion

Promotion flow: A → UAT → PAV

Docker & Container Build

Multi-Stage Dockerfile Pattern

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS base
WORKDIR /app
EXPOSE 8080

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY ["src/<Service>/Host/Host.csproj", "src/<Service>/Host/"]
RUN dotnet restore "src/<Service>/Host/Host.csproj"
COPY . .
WORKDIR "/src/src/<Service>/Host"
RUN dotnet build "Host.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "Host.csproj" -c Release -o /app/publish

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "Host.dll"]

Image Structure per Service

docker/<service-name>/
├── Dockerfile
└── k8s/
    ├── A/
    │   ├── values.yaml
    │   └── appsettings.json    # Confix-encrypted
    ├── UAT/
    └── PAV/

ACR

• Images via $(ACR) variable, tag = $(Build.SourceBranchName) (git tag, SemVer)
• Helm chart registry: $(HelmRepoName).azurecr.io (OCI-based)

Helm Deployment Flow

1. Download Docker artifact from build stage
2. Copy K8s manifests + values.yaml
3. Confix Decrypt — dotnet confix decrypt via Azure CLI service connection
4. Split BffContainer from appsettings.json → appsettings.bff.json
5. Helm login: helm registry login $(HelmRepoName).azurecr.io
6. Helm pull: oci://$(HelmRepoName).azurecr.io/deployment-ng
7. Helm upgrade --atomic --timeout=600s --create-namespace with environment values
8. Teams notification

Helm Values Set During Deployment

image.name, image.repository=$(ACR), image.tag=$(Build.SourceBranchName)
env.DEPLOYMENT_ENVIRONMENT, env.DEPLOYMENT_VAULT, env.ASPNETCORE_ENVIRONMENT
env.OTEL_EXPORTER_OTLP_ENDPOINT, env.REMOTE_CONFIGURATION_URL
envSecrets.DEPLOYMENT_DECRYPTIONKEY, envSecrets.DEPLOYMENT_SHAREDSECRET
envSecrets.REMOTE_CONFIGURATION_TOKEN

Health Probes

All services: /_health/live (liveness), /_health/ready (readiness)

Versioning & Release

• SemVer: MAJOR.MINOR.PATCH, preview: MAJOR.MINOR.PATCH-preview.N
• Release tags on master → full deployment pipeline
• Flow: feature branch → PR → merge → release tag → A (auto) → UAT (approval) → PAV (approval)

Configuration Management

Confix

Encrypts appsettings.json at rest. Pipeline decrypts using $(ConfixDecryptServiceConnectionName).

Azure Key Vault

Secrets via DEPLOYMENT_VAULT + DEPLOYMENT_DECRYPTIONKEY. Managed Identity in production.

Infrastructure as Code

• Terraform for Azure resources (I_IaC project)
• Helm for K8s packages
• ARM Templates for legacy resources
• CCOE manages foundational infra, quarterly compliance reviews

Observability

Pipeline Troubleshooting

Build Failures

Deployment Failures

Pipeline Permission Issues

Diagnostic Commands

kubectl get pods -n <ns> -l app=<svc>
kubectl logs -n <ns> -l app=<svc> --tail=100
kubectl describe pod <pod> -n <ns>
kubectl rollout status deployment/<svc> -n <ns>
kubectl rollout undo deployment/<svc> -n <ns>
helm list -n <ns>
helm history <release> -n <ns>

Key File Locations

Key Pipeline Variables