ops-devops-platform

What this skill does

# DevOps Engineering — Quick Reference

This skill equips teams with actionable templates, checklists, and patterns for building self-service platforms, automating infrastructure with GitOps, deploying securely with DevSecOps, scaling with Kubernetes, ensuring reliability through SRE practices, and operating production systems with strong observability.

**Modern baseline (2026)**: IaC (Terraform/OpenTofu/Pulumi), GitOps (Argo CD/Flux), Kubernetes (follow upstream supported releases), OpenTelemetry + Prometheus/Grafana, supply-chain security (SBOM + signing + provenance), policy-as-code (OPA/Gatekeeper or Kyverno), and eBPF-powered networking/security/observability (e.g., Cilium + Tetragon).

---

## Quick Reference

| Task | Tool/Framework | Command | When to Use |
|------|----------------|---------|-------------|
| Infrastructure as Code | Terraform / OpenTofu | `terraform plan && terraform apply` | Provision cloud resources declaratively |
| GitOps Deployment | Argo CD / Flux | `argocd app sync myapp` | Continuous reconciliation, declarative deployments |
| Container Build | Docker Engine | `docker build -t app:v1 .` | Package applications with dependencies |
| Kubernetes Deployment | kubectl / Helm (Kubernetes) | `kubectl apply -f deploy.yaml` / `helm upgrade app ./chart` | Deploy to K8s cluster, manage releases |
| CI/CD Pipeline | GitHub Actions | Define workflow in `.github/workflows/ci.yml` | Automated testing, building, deploying |
| Security Scanning | Trivy / Falco / Tetragon | `trivy image myapp:latest` | Vulnerability scanning, runtime security, eBPF enforcement |
| Monitoring & Alerts | Prometheus + Grafana | Configure ServiceMonitor and AlertManager | Observability, SLO tracking, incident alerts |
| Load Testing | k6 / Locust | `k6 run load-test.js` | Performance validation, capacity planning |
| Incident Response | PagerDuty / Opsgenie | Configure escalation policies | On-call management, automated escalation |
| Platform Engineering | Backstage / Port | Deploy internal developer portal | Self-service infrastructure, golden paths |

---

## Decision Tree: Choosing DevOps Approach

```text
What do you need to accomplish?
    ├─ Infrastructure provisioning?
    │   ├─ Cloud-agnostic → Terraform or OpenTofu (OSS fork)
    │   ├─ Programming-first → Pulumi (TypeScript/Python/Go)
    │   ├─ AWS-specific → CloudFormation or Terraform/OpenTofu
    │   ├─ GCP-specific → Deployment Manager or Terraform/OpenTofu
    │   └─ Azure-specific → ARM/Bicep or Terraform/OpenTofu
    │
    ├─ Application deployment?
    │   ├─ Kubernetes cluster?
    │   │   ├─ Simple deploy → kubectl apply -f manifests/
    │   │   ├─ Complex app → Helm charts
    │   │   └─ GitOps workflow → ArgoCD or FluxCD
    │   └─ Serverless?
    │       ├─ AWS → Lambda + SAM/Serverless Framework
    │       ├─ GCP → Cloud Functions
    │       └─ Azure → Azure Functions
    │
    ├─ CI/CD pipeline setup?
    │   ├─ GitHub-based → GitHub Actions (template-github-actions.md)
    │   ├─ GitLab-based → GitLab CI
    │   ├─ Enterprise → Jenkins or Tekton
    │   └─ Security-first → Add SAST/DAST/SCA scans (template-ci-cd.md)
    │
    ├─ Observability & monitoring?
    │   ├─ Metrics → Prometheus + Grafana
    │   ├─ Distributed tracing → Jaeger or OpenTelemetry
    │   ├─ Logs → Loki or ELK stack
    │   ├─ eBPF-based → Cilium + Hubble (sidecarless)
    │   └─ Unified platform → Datadog or New Relic
    │
    ├─ Incident management?
    │   ├─ On-call rotation → PagerDuty or Opsgenie
    │   ├─ Postmortem → template-postmortem.md
    │   └─ Communication → template-incident-comm.md
    │
    ├─ Platform engineering?
    │   ├─ Self-service → Backstage or Port (internal developer portal)
    │   ├─ Policy enforcement → OPA/Gatekeeper
    │   └─ Golden paths → Template repositories + automation
    │
    └─ Security hardening?
        ├─ Container scanning → Trivy or Grype
        ├─ Runtime security → Falco or Sysdig
        ├─ Secrets management → HashiCorp Vault or cloud-native KMS
        └─ Compliance → CIS Benchmarks, template-security-hardening.md
```

---

## When to Use This Skill

Claude should invoke this skill when users request:

- Platform engineering patterns (self-service developer platforms, internal tools)
- GitOps workflows (ArgoCD, FluxCD, declarative infrastructure management)
- Infrastructure as Code patterns (Terraform, K8s manifests, policy as code)
- CI/CD pipelines with DevSecOps (GitHub Actions, security scanning, SAST/DAST/SCA)
- SRE incident management, escalation, and postmortem templates
- eBPF-based observability (Cilium, Hubble, kernel-level insights, OpenTelemetry)
- Kubernetes operational patterns (day-2 operations, resource management, workload placement)
- Cloud-native monitoring (Prometheus, Grafana, unified observability platforms)
- Team workflow, communication, handover guides, and runbooks

---

## Resources (Best Practices Guides)

Operational best practices by domain:

- **DevOps/SRE Operations**: [references/devops-best-practices.md](references/devops-best-practices.md) - Core patterns for safe infrastructure changes, deployments, and incident response
- **Platform Engineering**: [references/platform-engineering-patterns.md](references/platform-engineering-patterns.md) - Self-service platforms, golden paths, internal developer portals, policy as code
- **GitOps Workflows**: [references/gitops-workflows.md](references/gitops-workflows.md) - Continuous reconciliation, multi-environment promotion, ArgoCD/FluxCD patterns, progressive delivery
- **SRE Incident Management**: [references/sre-incident-management.md](references/sre-incident-management.md) - Severity classification, escalation procedures, blameless postmortems, alert correlation, and runbooks
- **Operational Standards**: [references/operational-patterns.md](references/operational-patterns.md) - Platform engineering blueprints, CI/CD safety, SLOs, and reliability drills
- **AIOps**: [references/aiops-patterns.md](references/aiops-patterns.md) - Self-healing systems, automated operations, AI-assisted analysis

---

## Templates (Copy-Paste Ready)

Production templates organized by tech stack:

### AWS Cloud
- [assets/aws/template-aws-ops.md](assets/aws/template-aws-ops.md) - AWS service operations and best practices
- [assets/aws/template-aws-terraform.md](assets/aws/template-aws-terraform.md) - Terraform modules for AWS infrastructure
- [assets/aws/template-cost-optimization.md](assets/aws/template-cost-optimization.md) - AWS cost optimization strategies

### GCP Cloud
- [assets/gcp/template-gcp-ops.md](assets/gcp/template-gcp-ops.md) - GCP service operations
- [assets/gcp/template-gcp-terraform.md](assets/gcp/template-gcp-terraform.md) - Terraform modules for GCP

### Azure Cloud
- [assets/azure/template-azure-ops.md](assets/azure/template-azure-ops.md) - Azure service operations

### Kubernetes
- [assets/kubernetes/template-kubernetes-ops.md](assets/kubernetes/template-kubernetes-ops.md) - Day-to-day K8s operations
- [assets/kubernetes/template-ha-dr.md](assets/kubernetes/template-ha-dr.md) - High availability and disaster recovery
- [assets/kubernetes/template-platform-api.md](assets/kubernetes/template-platform-api.md) - Platform API patterns
- [assets/kubernetes/template-k8s-deploy.yaml](assets/kubernetes/template-k8s-deploy.yaml) - Deployment manifests

### Docker
- [assets/docker/template-docker-ops.md](assets/docker/template-docker-ops.md) - Container build, security, and operations

### Kafka
- [assets/kafka/template-kafka-ops.md](assets/kafka/template-kafka-ops.md) - Kafka cluster operations and streaming

### Terraform & IaC
- [assets/terraform-iac/template-iac-terraform.md](assets/terraform-iac/template-iac-terraform.md) - Infrastructure as Code patterns
- [assets/terraform-iac/template-module.md](assets/terraform-iac/template-module.md) - Reusable Terraform modules
- [assets/terraform-iac/template-env-promotion.md](assets/terraform-iac/template-env-promotion.md) - Envi