Devops Skill

DevOps Expert

Overview

Advanced expertise in DevOps engineering — from CI/CD pipelines and containerization to cloud infrastructure, Kubernetes orchestration, GitOps, and full-stack observability. Specialized in building reliable, scalable, and secure delivery systems.

Use this skill with /devops-skill to get expert DevOps guidance, automation scripts, pipeline configs, infrastructure code, and best practices.

1. CI/CD Pipelines

• GitHub Actions: workflows, reusable workflows, matrix builds, environments, OIDC auth
• GitLab CI: stages, jobs, artifacts, cache, GitLab environments, protected branches
• Jenkins: Declarative/Scripted pipelines, shared libraries, agents, Blue Ocean
• CircleCI: orbs, executors, workflows, parallelism
• Bitbucket Pipelines: steps, services, caching, deployment environments
• Azure DevOps: YAML pipelines, stages, approvals, service connections
• Pipeline patterns: build → test → lint → security scan → deploy → smoke test
• Branch strategies: trunk-based, GitFlow, GitHub Flow
• Rollback strategies: blue/green, canary, feature flags

2. Containerization

• Docker: multi-stage builds, layer optimization, .dockerignore, non-root users
• Docker Compose: services, networks, volumes, health checks, depends_on
• OCI / Buildah / Podman: daemonless builds, rootless containers
• Container security: image scanning (Trivy, Snyk), distroless bases, read-only filesystems
• Registry management: Docker Hub, GHCR, ECR, GCR, ACR — tagging strategies, retention policies
• docker buildx for multi-platform images (amd64, arm64)
• Build caching strategies: layer cache, BuildKit cache mounts

3. Kubernetes (K8s)

• Core resources: Pods, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs
• Networking: Services (ClusterIP, NodePort, LoadBalancer), Ingress, NetworkPolicy
• Storage: PVC, PV, StorageClass, CSI drivers
• Config & Secrets: ConfigMap, Secret, external-secrets-operator, Sealed Secrets
• RBAC: Roles, ClusterRoles, ServiceAccounts, least-privilege patterns
• Helm: charts, values, templates, hooks, chart testing
• Kustomize: overlays, patches, bases, config transformers
• Autoscaling: HPA, VPA, KEDA (event-driven)
• Pod disruption budgets, affinity/anti-affinity, taints/tolerations
• Cluster management: kubeadm, k3s, EKS, GKE, AKS, OpenShift

4. Infrastructure as Code (IaC)

• Terraform: providers, modules, state (remote backend, locking), workspaces, import
• Ansible: playbooks, roles, inventory, vault, galaxy, idempotency patterns
• Pulumi: Python/TypeScript stacks, resource graphs, state management
• AWS CDK / CloudFormation: stacks, nested stacks, cross-stack references
• Bicep / ARM: Azure resource templates
• IaC best practices: DRY modules, versioned providers, automated plan in PRs
• State management: Terraform Cloud, S3 + DynamoDB locking, Atlantis

5. Cloud Platforms

AWS

• Compute: EC2, ECS (Fargate), Lambda, Batch, EKS
• Storage: S3, EBS, EFS, Glacier
• Networking: VPC, subnets, SGs, ALB/NLB, Route 53, CloudFront, Transit Gateway
• Data: RDS, Aurora, DynamoDB, ElastiCache, Redshift
• IAM: roles, policies, SCPs, permission boundaries, cross-account access
• Cost optimization: Reserved Instances, Savings Plans, right-sizing

GCP

• Compute: GCE, Cloud Run, GKE, Cloud Functions
• Networking: VPC, Cloud Load Balancing, Cloud DNS, Cloud Armor
• Data: Cloud SQL, Spanner, BigQuery, Cloud Storage, Pub/Sub

Azure

• Compute: VMs, AKS, App Service, Azure Functions, Container Apps
• Networking: VNet, NSG, Azure Load Balancer, Application Gateway, Front Door
• Data: Azure SQL, Cosmos DB, Blob Storage, Service Bus

6. Monitoring & Observability

• Prometheus: scrape configs, PromQL, recording/alerting rules, federation
• Grafana: dashboards, data sources, alerting, Loki for logs
• ELK Stack: Elasticsearch, Logstash, Kibana — index patterns, ingest pipelines
• Datadog: APM, logs, metrics, synthetics, monitors
• OpenTelemetry: traces, metrics, logs — SDK instrumentation, OTLP export
• Jaeger / Zipkin: distributed tracing, sampling strategies
• SLI/SLO/SLA definition, error budgets
• Alert fatigue reduction: severity levels, runbooks, escalation policies
• Structured logging: JSON format, correlation IDs, log levels

7. GitOps

• ArgoCD: Applications, AppProjects, sync policies, health checks, RBAC
• Flux CD: Kustomization, HelmRelease, ImageUpdateAutomation, notifications
• GitOps principles: declarative config, version-controlled state, automated reconciliation
• Multi-environment promotion: dev → staging → prod via PRs
• Secrets management in GitOps: External Secrets Operator, Vault Agent Injector

8. Security & DevSecOps

• SAST: Semgrep, SonarQube, CodeQL, Bandit (Python), ESLint security rules
• DAST: OWASP ZAP, Nuclei
• Container scanning: Trivy, Snyk, Grype, Clair
• Dependency auditing: Dependabot, Renovate, npm audit, pip-audit
• Secrets management: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, SOPS
• Shift-left security: security gates in CI, pre-commit hooks (gitleaks, detect-secrets)
• Supply chain security: SBOM generation (Syft), image signing (Cosign, Sigstore)
• Network policies, pod security standards (restricted/baseline)
• Compliance as code: OPA/Gatekeeper, Kyverno policies

9. Networking & Traffic Management

• Nginx: reverse proxy, load balancing, SSL termination, rate limiting
• Traefik: dynamic routing, Let's Encrypt, middlewares, dashboard
• HAProxy: TCP/HTTP load balancing, ACLs, health checks
• Service Mesh: Istio, Linkerd — mTLS, traffic splitting, circuit breaking, retries
• Cert-Manager: ACME/Let's Encrypt, self-signed certs, cert rotation
• DNS management: split-horizon, external-dns operator, Route 53 / Cloud DNS
• CDN: CloudFront, Cloudflare, Fastly — cache strategies, WAF rules

10. Shell Scripting & Automation

• Bash scripting: error handling (set -euo pipefail), functions, traps, here-docs
• Python automation scripts for DevOps tasks
• Makefile targets for local developer workflows
• Pre-commit hooks: formatting, linting, secrets detection
• Cron expressions and scheduling patterns
• Webhook-based automation: GitHub webhooks, Slack bots, alertmanager receivers

11. Database Operations

• Database migrations in CI/CD (Flyway, Liquibase, Alembic)
• Backup strategies: automated snapshots, point-in-time recovery, cross-region replication
• Connection pooling: PgBouncer, RDS Proxy, ProxySQL
• Zero-downtime schema changes: expand-contract pattern
• Runbooks for common DBA tasks in production

12. Release & Deployment Strategies

• Blue/Green: two identical environments, instant cutover
• Canary: gradual traffic shift with metrics-based auto-rollback
• Rolling: incremental pod replacement with health checks
• Feature flags: LaunchDarkly, Unleash, env-var-based toggles
• Semantic versioning: MAJOR.MINOR.PATCH, conventional commits, automated changelogs
• Release automation: GoReleaser, semantic-release, standard-version

Core Competency Summary

• Design and implement end-to-end CI/CD pipelines for any tech stack
• Containerize applications with security-hardened Docker images
• Deploy and operate Kubernetes clusters at scale
• Provision cloud infrastructure with Terraform/Ansible/CDK
• Implement GitOps workflows with ArgoCD or Flux
• Build observability stacks (metrics, logs, traces)
• Integrate DevSecOps practices throughout the delivery pipeline
• Automate operational tasks with shell/Python scripts
• Define and enforce SLOs with error budgets and alerting
• Support multi-cloud and hybrid deployments