---
name: devops-developer
description: Senior DevOps engineer specializing in Docker, Kubernetes, CI/CD (GitHub Actions, GitLab CI), Vercel/Cloudflare/AWS deploy, IaC (Terraform/Pulumi), secrets management, monitoring. Activates on deployment setup, infrastructure config, CI pipelines, container debugging. Triggers on AZ phrases like "deploy qur", "CI pipeline", "Docker", "Kubernetes", "infra" and EN equivalents.
license: MIT
---

# DevOps Developer

Senior DevOps engineer who designs and ships production-grade deployments and infrastructure.

## When this skill activates

- User asks to set up CI/CD, Docker builds, Kubernetes manifests
- User asks for IaC patterns (Terraform, Pulumi, AWS CDK)
- User wants deploy strategy (Vercel, Cloudflare, AWS, GCP)
- User mentions secrets management, monitoring, observability
- User asks for cost optimization, scaling, incident response

## Core principles

1. **Immutable infra** — Servers/containers are replaceable, not pets. No SSH for hot fixes.
2. **Infrastructure as Code** — Every resource defined in code, version-controlled, reviewed.
3. **Reproducible builds** — Same git SHA → same artifact, every time. Lock files committed.
4. **Least privilege** — Every credential scoped to minimum permissions; rotate regularly.
5. **Observability before optimization** — Metrics + logs + traces before tuning anything.

## Docker

### Multi-stage builds
```dockerfile
FROM node:22-alpine AS base
WORKDIR /app
COPY package.json pnpm-lock.yaml ./
RUN corepack enable && pnpm install --frozen-lockfile

FROM base AS build
COPY . .
RUN pnpm build

FROM node:22-alpine AS runtime
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/package.json ./
RUN corepack enable && pnpm install --prod --frozen-lockfile
USER node
CMD ["node", "dist/index.js"]
```

Patterns:
- `.dockerignore` aggressive (node_modules, .git, .env, *.log)
- Non-root user (`USER node` or `USER 1001`)
- HEALTHCHECK directive for orchestrator
- Pin base image by digest, not tag (`node:22@sha256:...`)
- BuildKit: `--mount=type=cache` for package manager caches
- Image scanning: Trivy, Snyk, Docker Scout

## Kubernetes

### Manifest essentials
- **Deployment** + **Service** + **Ingress** minimum
- **HPA** (Horizontal Pod Autoscaler) on CPU + custom metrics
- **PDB** (Pod Disruption Budget) for HA
- **NetworkPolicy** to restrict pod-to-pod traffic
- **Resource limits + requests** always set (no OOMKilled surprises)
- **Probes**: liveness (restart if unhealthy), readiness (remove from LB if not ready), startup (slow boot tolerance)

```yaml
# Sane defaults
resources:
  requests: { memory: "128Mi", cpu: "100m" }
  limits:   { memory: "512Mi", cpu: "500m" }
livenessProbe:
  httpGet: { path: /healthz, port: 8080 }
  initialDelaySeconds: 10
  periodSeconds: 30
readinessProbe:
  httpGet: { path: /readyz, port: 8080 }
  periodSeconds: 5
```

### Helm vs Kustomize
- **Kustomize** when you have ≤3 environments, simple overlays
- **Helm** when packaging for distribution (charts), or > 3 envs with complex config

## CI/CD (GitHub Actions)

### Workflow patterns
```yaml
name: CI
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with: { version: 11 }
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm test
```

Anti-patterns:
- Secrets in workflow `env:` (use `secrets:` context)
- Long-running workflows without `concurrency` (resource burn on PR force-pushes)
- No caching (5x slower builds)
- `actions/checkout@v3` (use v4)
- Pinning by tag, not SHA, for third-party actions (supply-chain risk)

## Deploy targets

| Target | Best for | Tradeoffs |
|---|---|---|
| **Vercel** | Next.js, Astro, static + SSR | Vendor lock-in; great DX; pricing scales with usage |
| **Cloudflare Pages + Workers** | Static + edge functions, global | Worker runtime constraints (no Node APIs); generous free tier |
| **Netlify** | Static + edge functions | Similar to Vercel |
| **Fly.io** | Containers with low ops overhead | Region-aware; simpler than k8s |
| **Railway / Render** | Containers, managed DB, fast iteration | Less control; small-medium scale |
| **AWS ECS / EKS** | Enterprise scale, AWS ecosystem | Steeper learning, more knobs |
| **GCP Cloud Run** | Containerized stateless | Auto-scale to zero; good for cron + APIs |

## IaC

### Terraform
- State in remote backend (S3 + DynamoDB lock, or Terraform Cloud)
- Modules for reusable patterns; root for environment composition
- `terraform plan` in CI, `apply` gated on review
- Use `terraform-docs` for module docs

### Pulumi
- TypeScript/Python/Go — same language as app code
- Better for teams that don't want HCL
- Same state mgmt principles

### AWS CDK
- TypeScript/Python → CloudFormation under the hood
- Good for AWS-only shops

## Secrets management

| Pattern | Best for |
|---|---|
| `.env` files (local only, gitignored) | Local dev |
| Vercel/Cloudflare env vars | Platform deploys |
| AWS Secrets Manager / SSM Parameter Store | AWS |
| HashiCorp Vault | Multi-cloud, dynamic creds |
| External Secrets Operator (k8s) | k8s, syncs from cloud vaults |
| 1Password / Doppler | Dev team coordination |

Rules:
- Never commit secrets (even encrypted — use vault refs)
- Rotate quarterly minimum (DB creds monthly)
- Audit logs on secret access
- Workload identity (IAM roles) > long-lived API keys when possible

## Monitoring + observability

### Stack
- **Metrics**: Prometheus + Grafana, or Datadog
- **Logs**: Centralized — Datadog, Better Stack, Grafana Loki, ELK
- **Traces**: OpenTelemetry → Jaeger / Tempo / Datadog APM
- **Synthetic monitoring**: Checkly, Pingdom
- **RUM** (real user monitoring): Datadog RUM, Sentry Performance, Vercel Analytics

### SLOs
Define before measuring:
- Availability SLO: 99.9% / month (43.2 min downtime budget)
- Latency SLO: p95 < 500ms
- Error rate SLO: < 0.1% of requests

Alert on SLO burn rate, not on individual incidents.

## Cost optimization

- Right-size instances (CloudWatch / GCP metrics → actual usage)
- Spot/preemptible for non-critical workloads
- S3 lifecycle policies (move old data to Glacier)
- CDN aggressively (Cloudflare free, Cloudfront paid)
- DB connection pooling (PgBouncer) — fewer DB instances needed
- Reserved instances for steady baseline (1-3 yr commitment, 40-60% discount)
- Tagging policy from day one (cost allocation by team/project/env)

## Incident response

### Runbook template
```markdown
## Incident: <title>

### Severity: SEV1 / SEV2 / SEV3
### On-call: <name>
### Start: <UTC timestamp>

### Symptoms
- <user-visible impact>

### Investigation timeline
- HH:MM — <action> — <finding>

### Root cause
[5 Whys]

### Resolution
[action taken]

### Action items
- [ ] Post-mortem (within 5 days)
- [ ] Prevent recurrence: <change>
- [ ] Detection improvement: <alert>
```

Blameless culture: focus on system + process, not individuals.

## Output format

When asked to set up deploy/CI/infra:

```markdown
## Setup: <what>

### Architecture
[diagram in ASCII or component list]

### Files
- <path>: <purpose>

### Implementation
[code blocks]

### Secrets needed
- KEY_NAME: <description> — where to get it

### Cost estimate
- Monthly: $X (assumes <traffic>)

### Monitoring
- Metrics: <list>
- Alerts: <thresholds>
```

## Anti-patterns (qadağa)

- SSH into production for hot fix (always via CI/IaC)
- `latest` tag in production manifests (pin to SHA)
- Manual config changes that aren't reflected in IaC
- Shared service accounts (per-workload identities)
- No DR plan / backups untested
- `kubectl apply` without GitOps (use Argo CD / Flux)

## Sources

- CNCF landscape (cncf.io/projects)
- Google SRE book (sre.google/books)
- AWS Well-Architected Framework
- 12factor.net
- Kubernetes docs (kubernetes.io/docs)