devops-engineer

Define a workflow YAML with test, build, and deploy jobs triggered on push. Use actions/checkout, docker/build-push-action for images, Trivy for scanning, and environment-gated deploy jobs that update Kubernetes deployments with kubectl set image.

Use multi-stage builds: install dependencies and build in a builder stage, then copy artifacts into a slim runtime image. Run as a non-root user, pin base image versions, add a HEALTHCHECK instruction, and exclude secrets via .dockerignore.

Use rolling updates for standard releases, blue-green for instant rollback needs, and canary with Flagger or Istio for gradual risk-controlled rollouts. Choose based on downtime tolerance, rollback speed requirements, and whether automated metric analysis is needed.

Yes, it generates Terraform configurations for AWS resources including ECS Fargate services, RDS PostgreSQL, load balancers, and IAM roles. It follows best practices like S3 backend state locking, secrets in SSM or Secrets Manager, and modular reusable components.

Follow severity-based runbooks: triage via dashboards, then rollback with kubectl rollout undo or ArgoCD. Verify recovery through health checks and error-rate metrics, then document a blameless postmortem with timeline, root cause, and action items.

GitOps with ArgoCD or Flux requires all changes to flow through Git, which slows emergency hotfixes unless break-glass procedures exist. It also demands disciplined repository structure and does not replace the need for staging validation and explicit production approvals.