Nebo Devops Cloud

DEVOPS-CLOUD SuperSkill

Заменяет: devops-automation, docker-best-practices, kubernetes-operations, ci-cd-pipelines, monitoring-observability, aws-cloud-patterns (6 скилов) Триггеры: "docker", "kubernetes", "CI/CD", "деплой", "AWS", "nginx", "systemd", "devops", "monitoring", "Helm" Атомов: 87

КОГДА ПРИМЕНЯТЬ

• Настройка CI/CD pipeline (GitHub Actions, GitLab CI)
• Docker: Dockerfile, compose, оптимизация образов
• Kubernetes: манифесты, Helm charts, troubleshooting
• Мониторинг: OpenTelemetry, Prometheus, Grafana
• AWS: Lambda, ECS, DynamoDB, CDK/Terraform
• Деплой: blue-green, canary, rolling updates

КЛЮЧЕВЫЕ ПРИНЦИПЫ

1. Multi-stage Docker builds: deps → build → runtime. Final stage только runtime artifacts + non-root user
2. K8s: always set resources: requests + limits на каждом контейнере, topologySpreadConstraints для HA
3. CI/CD: concurrency + needs: cancel-in-progress: true для stale runs, needs для зависимостей между jobs
4. Observability = traces + metrics + logs: OpenTelemetry SDK → OTLP collector → backends. Structured JSON logging
5. AWS Lambda: init outside handler: SDK clients вне handler для переиспользования между invocations
6. DynamoDB: access patterns first: Single-table design, composite keys (PK + SK), GSI для альтернативных запросов
7. IaC: CDK/Terraform over console: Всё в коде, state в remote backend, plan перед apply

ПАТТЕРНЫ И ТЕХНИКИ

Docker

FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --only=production

FROM node:22-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:22-alpine AS runtime
WORKDIR /app
RUN addgroup -g 1001 -S app && adduser -S app -u 1001 -G app
COPY --from=deps /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
USER app
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO- http://localhost:3000/healthz || exit 1
CMD ["node", "dist/server.js"]

Docker Compose

services:
  api:
    build: { context: ., target: runtime }
    depends_on:
      db: { condition: service_healthy }
    deploy:
      resources: { limits: { memory: 512M } }
    restart: unless-stopped

GitHub Actions

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    services:
      postgres:
        image: postgres:16
        options: --health-cmd pg_isready --health-interval 10s

Kubernetes

spec:
  containers:
    - resources:
        requests: { cpu: 100m, memory: 128Mi }
        limits: { cpu: 500m, memory: 512Mi }
      livenessProbe:
        httpGet: { path: /healthz, port: 8080 }
      readinessProbe:
        httpGet: { path: /ready, port: 8080 }
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: kubernetes.io/hostname
      whenUnsatisfiable: DoNotSchedule

Helm Chart

chart/
  Chart.yaml      # metadata + dependencies
  values.yaml     # default values
  templates/
    deployment.yaml
    service.yaml
    ingress.yaml
    _helpers.tpl   # template helpers

OpenTelemetry

const sdk = new NodeSDK({
  serviceName: "order-service",
  traceExporter: new OTLPTraceExporter({ url: "http://collector:4318/v1/traces" }),
  metricReader: new PeriodicExportingMetricReader({
    exporter: new OTLPMetricExporter(),
    exportIntervalMillis: 15000,
  }),
  instrumentations: [new HttpInstrumentation(), new PgInstrumentation()],
});

• Custom spans: tracer.startActiveSpan("name", async (span) => { ... span.end() })
• Custom metrics: counter, histogram, gauge через meter.create*()

AWS Lambda + DynamoDB

// Init outside handler
const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));

export const handler: APIGatewayProxyHandlerV2 = async (event) => {
  const result = await client.send(
    new GetCommand({ TableName: process.env.TABLE_NAME!, Key: { pk: id } })
  );
  return { statusCode: 200, body: JSON.stringify(result.Item) };
};

Structured Logging

logger.info("order_created", {
  orderId, customerId, amount,
  traceId: span.spanContext().traceId
});

• Всегда JSON format, severity levels, correlation IDs
• Никогда PII в логах без маскирования

ЧЕКЛИСТ

• Docker: non-root user, multi-stage, .dockerignore, HEALTHCHECK
• K8s: resource limits, probes, topology spread, secrets через SecretRef
• CI/CD: concurrency cancellation, cache dependencies, matrix testing
• Monitoring: traces + metrics + structured logs connected
• Alerts: на SLO breach, не на каждую ошибку
• IaC: remote state, план перед apply, модульная структура

ПРИМЕРЫ

Full CI/CD → Deploy pipeline

jobs:
  lint: { runs-on: ubuntu-latest, steps: [checkout, setup-node, npm ci, npm run lint] }
  test: { needs: lint, strategy: { matrix: { node: [20, 22] } } }
  build: { needs: test, steps: [docker build, docker push] }
  deploy: { needs: build, if: "github.ref == 'refs/heads/main'", environment: production }