1---2name: devops-engineer3description: Use when designing Universal CI/CD, Multi-Cloud Infrastructure, or Observability systems.4license: MIT5---67# DevOps Architecture & Standards89## 🧠 Core Philosophy10111. **Automate Everything**: If it's done twice, script it.122. **Infrastructure as Code (IaC)**: No click-ops. All infra must be defined in code (Terraform, Pulumi, Ansible).133. **Security First**: Shift security left. Manage secrets via Vault/KMS, not env vars.144. **Observability**: You can't fix what you can't see. Logs, Metrics, and Traces are mandatory.1516## 🎛️ Decision Engine & Routing1718**STEP 1: Context Analysis**19Before acting, determine the stack components using the **Comparison Tables** below.2021### 1. Cloud Provider Selection2223| Feature | AWS | GCP | Azure | Vercel/Supabase |24| :----------- | :----------------------------------- | :---------------------------- | :-------------------------------- | :--------------------------- |25| **Best For** | Enterprise, complex granular control | Data/AI, K8s (GKE) | Enterprise Windows/AD integration | Frontend/Jamstack, Quick MVP |26| **Compute** | EC2, Lambda, ECS/EKS | GCE, Cloud Run, GKE | Azure VM, Functions, AKS | Edge Functions |27| **Storage** | S3, EBS, EFS | GCS, Persistent Disk | Blob Storage, Files | Storage Bucket |28| **Database** | RDS, DynamoDB, Aurora | Cloud SQL, Firestore, Spanner | SQL Database, CosmosDB | Postgres (Supabase) |2930### 2. Codebase Normalization Tools3132| Feature | Husky + Lint-staged | Lefthook | Biome | ESLint + Prettier |33| :----------- | :---------------------- | :------------------- | :------------------- | :--------------------- |34| **Type** | Git Hooks (Node.js) | Git Hooks (Go) | All-in-one Toolchain | Linter + Formatter |35| **Speed** | Standard | Fast | Extremely Fast | Standard |36| **Best For** | Standard JS/TS Projects | Monorepos / Polyglot | Greenfields / Speed | Legacy / Complex Rules |3738### 3. IaC Tool Selection3940| Feature | Terraform | Pulumi | Ansible | CDK (AWS/TF) |41| :----------- | :------------------------------------------ | :------------------------------ | :---------------------------- | :------------------------ |42| **Language** | HCL (Declarative) | TS/Python/Go (Imperative) | YAML (Configuration) | TS/Python (Imperative) |43| **State** | Remote state file (S3/GCS) | Pulumi Service / S3 | No state (Idempotent scripts) | CloudFormation / TF State |44| **Use Case** | Industry Standard, Multi-cloud provisioning | Dev-friendly, Logic-heavy infra | Config Mgmt, Mutable infra | AWS-centric, Type-safety |4546### 4. CI/CD Platform Selection4748| Feature | GitHub Actions | GitLab CI | Jenkins | CircleCI |49| :-------------- | :--------------------------- | :---------------------- | :-------------------------------- | :---------------------------- |50| **Integration** | Native to GitHub | Native to GitLab | Self-hosted, Plugins | Fast, SaaS-first |51| **Config** | YAML (`.github/workflows`) | YAML (`.gitlab-ci.yml`) | Groovy (Jenkinsfile) | YAML (`.circleci/config.yml`) |52| **Best For** | Open Source, Integrated flow | Integrated DevSecOps | Legacy / Highly Custom Enterprise | High Performance |5354## 📚 Dynamic Knowledge Base5556**ACTION**: Load the specific reference based on your decision above.5758- **Cloud Infrastructure** (AWS/GCP/Azure): [Load `cloud-providers.md`](references/cloud-providers.md)59- **Infrastructure as Code** (Terraform/Pulumi): [Load `iac-tools.md`](references/iac-tools.md)60- **CI/CD Pipelines** (GHA/GitLab): [Load `ci-cd-pipelines.md`](references/ci-cd-pipelines.md)61- **Containers & Orchestration** (Docker/K8s: [Load `container-orchestration.md`](references/container-orchestration.md)62- **Observability & Security** (Monitoring/Logging): [Load `observability-security.md`](references/observability-security.md)63- **Codebase Normalization** (Husky/Linting): [Load `codebase-normalization.md`](references/codebase-normalization.md)6465> [!TIP]66> **Long-tail Tools**: If a user asks for a tool NOT listed above (e.g., DigitalOcean, TravisCI), use `search_web` to find the official "Quick Start" and "Best Practices" documentation.6768## 🛡️ Security & Compliance Standards6970- **Least Privilege**: IAM roles must be scoped strictly.71- **Encryption**: At rest (KMS) and in transit (TLS 1.2+).72- **Scanning**: SAST (SonarQube), DAST (OWASP ZAP), Container Scanning (Trivy).7374## 📝 Templates7576| Template | Path | Purpose |77| ------------- | ---------------------------- | ------------------------------------------------------------------------------- |78| Release Notes | `templates/release-notes.md` | Release Notes - features, fixes, improvements. Use when publishing new releases |
kienhaminh