# Nebo Devops Cloud

> DEVOPS-CLOUD SuperSkill

- Skill: `lifenewjob/nebo-devops-cloud` (Agent Skill)
- Install (CLI): `npx skillmds@latest add lifenewjob/nebo-devops-cloud`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lifenewjob/nebo-devops-cloud/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: lifenewjob (https://skillmd.com/u/lifenewjob)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/lifenewjob/nebo-devops-cloud

---


# DEVOPS-CLOUD SuperSkill
> Заменяет: devops-automation, docker-best-practices, kubernetes-operations, ci-cd-pipelines, monitoring-observability, aws-cloud-patterns (6 скилов)
> Триггеры: "docker", "kubernetes", "CI/CD", "деплой", "AWS", "nginx", "systemd", "devops", "monitoring", "Helm"
> Атомов: 87

## КОГДА ПРИМЕНЯТЬ
- Настройка CI/CD pipeline (GitHub Actions, GitLab CI)
- Docker: Dockerfile, compose, оптимизация образов
- Kubernetes: манифесты, Helm charts, troubleshooting
- Мониторинг: OpenTelemetry, Prometheus, Grafana
- AWS: Lambda, ECS, DynamoDB, CDK/Terraform
- Деплой: blue-green, canary, rolling updates

## КЛЮЧЕВЫЕ ПРИНЦИПЫ

1. **Multi-stage Docker builds**: deps → build → runtime. Final stage только runtime artifacts + non-root user
2. **K8s: always set resources**: requests + limits на каждом контейнере, topologySpreadConstraints для HA
3. **CI/CD: concurrency + needs**: `cancel-in-progress: true` для stale runs, `needs` для зависимостей между jobs
4. **Observability = traces + metrics + logs**: OpenTelemetry SDK → OTLP collector → backends. Structured JSON logging
5. **AWS Lambda: init outside handler**: SDK clients вне handler для переиспользования между invocations
6. **DynamoDB: access patterns first**: Single-table design, composite keys (PK + SK), GSI для альтернативных запросов
7. **IaC: CDK/Terraform over console**: Всё в коде, state в remote backend, plan перед apply

## ПАТТЕРНЫ И ТЕХНИКИ

### Docker
```dockerfile
FROM node:22-alpine AS deps
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --only=production

FROM node:22-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:22-alpine AS runtime
WORKDIR /app
RUN addgroup -g 1001 -S app && adduser -S app -u 1001 -G app
COPY --from=deps /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
USER app
EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s CMD wget -qO- http://localhost:3000/healthz || exit 1
CMD ["node", "dist/server.js"]
```

### Docker Compose
```yaml
services:
  api:
    build: { context: ., target: runtime }
    depends_on:
      db: { condition: service_healthy }
    deploy:
      resources: { limits: { memory: 512M } }
    restart: unless-stopped
```

### GitHub Actions
```yaml
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    services:
      postgres:
        image: postgres:16
        options: --health-cmd pg_isready --health-interval 10s
```

### Kubernetes
```yaml
spec:
  containers:
    - resources:
        requests: { cpu: 100m, memory: 128Mi }
        limits: { cpu: 500m, memory: 512Mi }
      livenessProbe:
        httpGet: { path: /healthz, port: 8080 }
      readinessProbe:
        httpGet: { path: /ready, port: 8080 }
  topologySpreadConstraints:
    - maxSkew: 1
      topologyKey: kubernetes.io/hostname
      whenUnsatisfiable: DoNotSchedule
```

### Helm Chart
```
chart/
  Chart.yaml      # metadata + dependencies
  values.yaml     # default values
  templates/
    deployment.yaml
    service.yaml
    ingress.yaml
    _helpers.tpl   # template helpers
```

### OpenTelemetry
```typescript
const sdk = new NodeSDK({
  serviceName: "order-service",
  traceExporter: new OTLPTraceExporter({ url: "http://collector:4318/v1/traces" }),
  metricReader: new PeriodicExportingMetricReader({
    exporter: new OTLPMetricExporter(),
    exportIntervalMillis: 15000,
  }),
  instrumentations: [new HttpInstrumentation(), new PgInstrumentation()],
});
```
- Custom spans: `tracer.startActiveSpan("name", async (span) => { ... span.end() })`
- Custom metrics: counter, histogram, gauge через `meter.create*()`

### AWS Lambda + DynamoDB
```typescript
// Init outside handler
const client = DynamoDBDocumentClient.from(new DynamoDBClient({}));

export const handler: APIGatewayProxyHandlerV2 = async (event) => {
  const result = await client.send(
    new GetCommand({ TableName: process.env.TABLE_NAME!, Key: { pk: id } })
  );
  return { statusCode: 200, body: JSON.stringify(result.Item) };
};
```

### Structured Logging
```typescript
logger.info("order_created", {
  orderId, customerId, amount,
  traceId: span.spanContext().traceId
});
```
- Всегда JSON format, severity levels, correlation IDs
- Никогда PII в логах без маскирования

## ЧЕКЛИСТ
- [ ] Docker: non-root user, multi-stage, .dockerignore, HEALTHCHECK
- [ ] K8s: resource limits, probes, topology spread, secrets через SecretRef
- [ ] CI/CD: concurrency cancellation, cache dependencies, matrix testing
- [ ] Monitoring: traces + metrics + structured logs connected
- [ ] Alerts: на SLO breach, не на каждую ошибку
- [ ] IaC: remote state, план перед apply, модульная структура

## ПРИМЕРЫ

### Full CI/CD → Deploy pipeline
```yaml
jobs:
  lint: { runs-on: ubuntu-latest, steps: [checkout, setup-node, npm ci, npm run lint] }
  test: { needs: lint, strategy: { matrix: { node: [20, 22] } } }
  build: { needs: test, steps: [docker build, docker push] }
  deploy: { needs: build, if: "github.ref == 'refs/heads/main'", environment: production }
```