devops-deployment

# DevOps & Deployment Skill Comprehensive frameworks for CI/CD pipelines, containerization, deployment strategies, and infrastructure automation. > **Note:** If `disableSkillShellExecution` is enabled (CC 2.1.91), the Docker install check won't run. Verify Docker is available for container operations: `docker --version`. ## Overview - Setting up CI/CD pipelines - Containerizing applications - Deploying to Kubernetes or cloud platforms - Implementing GitOps workflows - Managing infrastructure as code - Planning release strategies ## Pipeline Architecture ``` ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ Code │─>│ Build │─>│ Test │─>│ Deploy │ │ Commit │ │ Lint │ │ Scan │ │ Release │ └──────────┘ └──────────┘ └──────────┘ └──────────┘ triggers artifacts reports monitoring ``` ## Key Concepts ### CI/CD Pipeline Stages 1. **Lint & Type Check** - Code quality gates 2. **Unit Tests** - Test coverage with reporting 3. **Security Scan** - npm audit + Trivy vulnerability scanner 4. **Build & Push** - Docker image to container registry 5. **Deploy Staging** - Environment-gated deployment 6. **Deploy Production** - Manual approval or automated ### Container Best Practices **Multi-stage builds** minimize image size: - Stage 1: Install production dependencies only - Stage 2: Build application with dev dependencies - Stage 3: Production runtime with minimal footprint **Security hardening**: - Non-root user (uid 1001) - Read-only filesystem where possible - Health checks for orchestrator integration ### Kubernetes Deployment **Essential manifests**: - Deployment with rolling update strategy - Service for internal routing - Ingress for external access with TLS - HorizontalPodAutoscaler for scaling **Security context**: - `runAsNonRoot: true` - `allowPrivilegeEscalation: false` - `readOnlyRootFilesystem: true` - Drop all capabilities ### Deployment Strategies | Strategy | Use Case | Risk | |----------|----------|------| | **Rolling** | Default, gradual replacement | Low - automatic rollback | | **Blue-Green** | Instant switch, easy rollback | Medium - double resources | | **Canary** | Progressive traffic shift | Low - gradual exposure | **Rolling Update** (Kubernetes default): ```yaml strategy: type: RollingUpdate rollingUpdate: maxSurge: 25% maxUnavailable: 0 # Zero downtime ``` ### Secrets Management Use External Secrets Operator to sync from cloud providers: - AWS Secrets Manager - HashiCorp Vault - Azure Key Vault - GCP Secret Manager --- ## References ### Docker Patterns **Load: `Read("references/docker-patterns.md")`** Key topics covered: - Multi-stage build examples with 78% size reduction - Layer caching optimization - Security hardening (non-root, health checks) - Trivy vulnerability scanning - Docker Compose development setup ### OrchestKit Delta (house rules) **Load: `Read("references/ork-delta.md")`** Key topics covered: - CI concurrency groups, the sub-5-minute feedback budget, path filtering - Service-container health gating, SHA-pinned deploys, CDN invalidation order - Kubernetes probe budget, request/limit baseline, PodDisruptionBudget floor - External Secrets refresh interval, ArgoCD prune plus selfHeal, Terraform state locking - Alert thresholds with dwell windows, request-id log binding, rollback rehearsal ### Railway Deployment **Load: `Read("rules/railway-deployment.md")`** Key topics covered: - railway.json configuration, Nixpacks builds - Environment variable management, database provisioning - Multi-service setups, Railway CLI workflows - References: `references/railway-json-config.md`, `references/nixpacks-customization.md`, `references/multi-service-setup.md` ### Deployment Strategies **Load: `Read("references/deployment-strategies.md")`** Key topics covered: - Rolling deployment (`maxUnavailable` / `maxSurge`) - Blue-green deployment (service-selector switch and rollback) - Canary releases (replica-ratio traffic split) --- ## Upstream coverage (do not restate) This skill wraps third-party products. Vendor mechanics are not restated here; fetch them from the source below. Where a row says "house subset stays in X", that file keeps only OrchestKit's threshold, config or ordering decision, not the vendor tutorial. | Topic | Fetch from | |-------|-----------| | GitHub Actions workflow syntax, matrix builds, artifact upload/download, cache mechanics | https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax (house cache-key subset stays in `rules/devops-ci-caching.md`) | | Trigger filters (`on.push.paths`, schedules, `workflow_dispatch`) | https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow | | Service containers for integration tests | https://docs.github.com/en/actions/tutorials/use-containerized-services/use-docker-service-containers | | Deployment environments and approval gates | https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments | | Protected branches and required status checks | https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches (house approval counts stay in `rules/devops-branch-protection.md`) | | Kubernetes probe semantics and every probe field | https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ (house probe numbers stay in `references/ork-delta.md`) | | Requests, limits, quotas and QoS classes | https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ (house baseline stays in `references/ork-delta.md`) | | PodDisruptionBudget semantics and eviction API | https://kubernetes.io/docs/tasks/run-application/configure-pdb/ (house `minAvailable` floor stays in `references/ork-delta.md`) | | StatefulSets, ordinal identity, volumeClaimTemplates | https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ | | Helm chart authoring, templating and values files | https://helm.sh/docs/topics/charts/ (the chart directory layout we use stays in `references/checklists-and-templates.md`) | | External Secrets Operator CRD fields and backends | https://external-secrets.io/latest/api/externalsecret/ (house refresh/creation policy stays in `references/ork-delta.md`) | | ArgoCD automated sync, prune and self-heal | https://argo-cd.readthedocs.io/en/stable/user-guide/auto_sync/ (house retry/backoff stays in `references/ork-delta.md`) | | Terraform S3 backend and state locking | https://developer.hashicorp.com/terraform/language/backend/s3 (house backend config stays in `references/ork-delta.md`) | | Terraform module composition and variable files | https://developer.hashicorp.com/terraform/language/modules | | Alembic revision, upgrade and downgrade CLI | https://alembic.sqlalchemy.org/en/latest/tutorial.html (the zero-downtime migration ordering stays in `rules/devops-db-migrations.md`) | | Prometheus client instrumentation (Counter, Histogram, exposition) | https://prometheus.github.io/client_python/ | | PromQL functions (`rate`, `histogram_quantile`) for dashboards | https://prometheus.io/docs/prometheus/latest/querying/functions/ | | Prometheus alerting rule syntax | https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/ (house thresholds and dwell windows stay in `references/ork-delta.md`) | | OpenTelemetry FastAPI auto-instrumentation and manual spans | https://opentelemetry-python-contrib.readthedocs.io/en/latest/instrumentation/fastapi/fastapi.html | | structlog context binding | https://www.structlog.org/en/stable/contextvars.html (the bind-then-call ordering stays in `references/ork-delta.md`) | | Trivy severity filtering and scan configuration | https://trivy.dev/latest/docs/configuration/filtering/ (the house image-scan CI wiring stays in `references/docker-patterns.md`, the weekly-scan schedule and severity floor in `references/ork-delta.md`) | | CloudFront invalidation semantics and cost | https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Invalidation.html (the sync-then-invalidate order stays in `references/ork-delta.md`) | | Pre-launch security, load-testing and monitoring checklists | `ork:security-patterns`, `ork:testing-perf`, `ork:monitoring-observability` (the deploy-day checklist stays in `references/checklists-and-templates.md`) | --- ## Deployment Checklist & Templates Load: `Read("references/checklists-and-templates.md")` for pre/during/post-deployment checklists, Helm chart structure, template reference table, and extended thinking triggers. --- ## Related Skills - `ork:security-patterns` - Security scanning and hardening patterns for CI/CD pipelines - `ork:monitoring-observability` - Prometheus, Grafana and alerting for deployed applications - `ork:database-patterns` - Python/Alembic migration workflow for backend deployments - `portless` (upstream) - Named `.localhost` URLs for multi-service local dev (`portless alias api 8080`) ## Key Decisions | Decision | Choice | Rationale | |----------|--------|-----------| | Container user | Non-root (uid 1001) | Security best practice, required by many orchestrators | | Deployment strategy | Rolling update (default) | Zero downtime, automatic rollback, resource efficient | | Secrets management | External Secrets Operator | Syncs from cloud providers, GitOps compatible | | Health checks | Separate startup/liveness/readiness | Prevents premature traffic, enables graceful shutdown | ## Capability Details Load: `Read("references/capability-details.md")` for full keyword index and problem-solution mapping across all 6 capabilities (ci-cd, docker, kubernetes, infrastructure-as-code, deployment-strategies, observability).