aspnet-core-devops

What this skill does

# ASP.NET Core DevOps & Production

## Skill Overview

Production-grade DevOps skill for ASP.NET Core applications. Covers containerization, cloud deployment, CI/CD pipelines, and infrastructure as code with comprehensive observability.

## DevOps Skills

### Docker & Containerization
```yaml
dockerfile_best_practices:
  multi_stage_builds:
    - Separate build and runtime stages
    - Minimize final image size
    - Use specific base image tags

  security:
    - Run as non-root user
    - Use distroless/alpine images
    - Scan for vulnerabilities
    - Read-only filesystem

  optimization:
    - Order layers by change frequency
    - Use .dockerignore
    - Leverage build cache
    - Multi-platform builds

docker_compose:
  use_cases:
    - Local development
    - Integration testing
    - Multi-container apps
  features:
    - Service dependencies
    - Volume mounts
    - Network isolation
    - Environment variables

container_security:
  practices:
    - Non-root user
    - Drop capabilities
    - Read-only rootfs
    - Security scanning
  tools:
    - Trivy
    - Snyk
    - Docker Scout
```

### Azure Cloud Services
```yaml
compute:
  app_service:
    tiers: [Basic, Standard, Premium, Isolated]
    features:
      - Auto-scaling
      - Deployment slots
      - Custom domains
      - SSL certificates
    best_for: Web apps, APIs

  container_apps:
    features:
      - Serverless containers
      - Auto-scaling
      - Dapr integration
      - Revision management
    best_for: Microservices

  aks:
    features:
      - Managed Kubernetes
      - Node pools
      - Azure CNI
      - AAD integration
    best_for: Complex workloads

data:
  sql_database:
    tiers: [Basic, Standard, Premium]
    features:
      - Geo-replication
      - Automatic backups
      - Elastic pools

  cosmos_db:
    apis: [SQL, MongoDB, Cassandra, Gremlin]
    features:
      - Global distribution
      - Multi-model
      - Automatic scaling

  redis_cache:
    tiers: [Basic, Standard, Premium]
    features:
      - Clustering
      - Geo-replication
      - Data persistence

security:
  key_vault:
    purpose: Secrets management
    features:
      - Access policies
      - Managed identity
      - Key rotation
      - Audit logging

  managed_identity:
    types: [System-assigned, User-assigned]
    benefits:
      - No credential management
      - Automatic rotation
      - Azure AD integration
```

### CI/CD Pipelines
```yaml
github_actions:
  workflow_structure:
    - Triggers (push, PR, schedule)
    - Jobs (build, test, deploy)
    - Steps (actions, scripts)
  features:
    - Matrix builds
    - Reusable workflows
    - Environment protection
    - OIDC authentication
    - Artifact management

azure_pipelines:
  structure:
    - Stages
    - Jobs
    - Steps
  features:
    - Multi-stage pipelines
    - Deployment groups
    - Variable groups
    - Service connections

deployment_strategies:
  blue_green:
    description: Deploy to inactive slot, swap
    benefits:
      - Zero downtime
      - Instant rollback
    azure: Deployment slots

  canary:
    description: Gradual traffic shift
    benefits:
      - Risk mitigation
      - Real user testing
    implementation: Traffic manager, Azure Front Door

  rolling:
    description: Update instances incrementally
    benefits:
      - No additional resources
      - Gradual rollout
    kubernetes: Rolling update strategy

quality_gates:
  - Unit tests pass
  - Code coverage threshold
  - Static analysis clean
  - Security scan pass
  - Performance benchmarks
```

### Kubernetes Orchestration
```yaml
core_concepts:
  pods:
    - Smallest deployable unit
    - Container grouping
    - Shared network/storage

  deployments:
    - Desired state management
    - Rolling updates
    - Rollback capability

  services:
    types:
      - ClusterIP (internal)
      - NodePort (node access)
      - LoadBalancer (external)

  ingress:
    controllers:
      - NGINX
      - Traefik
      - Azure Application Gateway
    features:
      - Path-based routing
      - TLS termination
      - Host-based routing

advanced_features:
  hpa:
    metrics:
      - CPU utilization
      - Memory utilization
      - Custom metrics
    behavior:
      - Scale up policies
      - Scale down policies
      - Stabilization windows

  pdb:
    purpose: Availability during updates
    settings:
      - minAvailable
      - maxUnavailable

  network_policies:
    purpose: Pod-to-pod traffic control
    types:
      - Ingress rules
      - Egress rules

helm:
  concepts:
    - Charts
    - Values
    - Templates
    - Releases
  best_practices:
    - Parameterize values
    - Use dependencies
    - Version charts
```

### Infrastructure as Code
```yaml
terraform:
  structure:
    - Providers
    - Resources
    - Variables
    - Outputs
    - Modules
  state_management:
    - Remote backend
    - State locking
    - Workspaces
  best_practices:
    - Modular design
    - Version pinning
    - Plan before apply

bicep:
  benefits:
    - Native Azure support
    - Type safety
    - Simpler syntax
  structure:
    - Parameters
    - Variables
    - Resources
    - Outputs
    - Modules

pulumi:
  benefits:
    - Use familiar languages (C#)
    - Type checking
    - IDE support
  structure:
    - Stacks
    - Resources
    - Outputs
```

### Monitoring & Logging
```yaml
observability_pillars:
  metrics:
    tools:
      - Application Insights
      - Prometheus
      - Azure Monitor
    types:
      - Request rate
      - Error rate
      - Latency (p50, p95, p99)
      - Resource utilization

  logs:
    structured_logging:
      - Serilog
      - NLog
    aggregation:
      - Azure Log Analytics
      - ELK Stack
      - Loki
    best_practices:
      - Correlation IDs
      - Log levels
      - Sensitive data masking

  traces:
    distributed_tracing:
      - OpenTelemetry
      - Application Insights
    features:
      - Request correlation
      - Dependency tracking
      - Performance profiling

health_checks:
  types:
    - Liveness (is alive?)
    - Readiness (can serve?)
    - Startup (initialized?)
  implementation:
    - /health/live
    - /health/ready
    - Custom health checks

alerting:
  strategies:
    - Error rate spikes
    - Latency thresholds
    - Resource exhaustion
    - SLO violations
  channels:
    - Email
    - Slack
    - PagerDuty
    - Azure Monitor
```

## Code Examples

### Production-Ready Dockerfile
```dockerfile
# Build stage
FROM mcr.microsoft.com/dotnet/sdk:9.0-alpine AS build
WORKDIR /src

# Copy csproj and restore (cached layer)
COPY ["*.csproj", "./"]
RUN dotnet restore --runtime linux-musl-x64

# Copy source and build
COPY . .
RUN dotnet build -c Release --no-restore -o /app/build

# Test stage
FROM build AS test
RUN dotnet test --no-build -c Release \
    --logger "trx" \
    --results-directory /testresults

# Publish stage
FROM build AS publish
RUN dotnet publish -c Release -o /app/publish \
    --runtime linux-musl-x64 \
    --self-contained true \
    -p:PublishTrimmed=true \
    -p:PublishSingleFile=true

# Runtime stage - distroless equivalent
FROM mcr.microsoft.com/dotnet/runtime-deps:9.0-alpine AS final

# Security: Non-root user
RUN addgroup -g 1000 appgroup && \
    adduser -u 1000 -G appgroup -D appuser

WORKDIR /app

# Copy published app with correct ownership
COPY --from=publish --chown=appuser:appgroup /app/publish .

# Switch to non-root user
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD wget --quiet --tries=1 --spider http://localhost:8080/health || exit 1

# Expose port (non-privileged)
EXPOSE 8080
ENV ASPNETCORE_URLS=http://+:8080
ENV ASPNETCORE_ENVIRONMENT=Production

# Entry point
ENTRYPOINT ["./MyApp"]
```

### GitHub Actions Complete Workflow
```yaml
name: Build, Test, and Deploy

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write
  c