devops-engineer

Define a workflow with test, build, and deploy jobs that run on push to main. Use docker/build-push-action to build and push images to a registry, add Trivy for vulnerability scanning, and gate production deployments behind environment approvals.

Use multi-stage builds to separate dependency installation from the runtime image, run as a non-root user, pin base image versions instead of latest, and add a HEALTHCHECK instruction. Keep images small with alpine or slim variants and exclude files via .dockerignore.

Use rolling updates for standard releases, blue-green when you need instant rollback, and canary deployments with Flagger or Istio for high-risk changes. Always configure readiness and liveness probes so traffic shifts only to healthy pods.

Yes, it generates Terraform configurations for AWS services including ECS Fargate, RDS PostgreSQL, load balancers, and IAM roles. It follows best practices like S3 backend state locking, secrets in SSM or Secrets Manager, and modular reusable components.

Follow the runbook pattern: triage via dashboards, then rollback with kubectl rollout undo or ArgoCD rollback to a previous revision. Verify error rates and latency after rollback, then document a blameless postmortem with timeline, root cause, and action items.

Avoid deploying without explicit approval, staging validation, or a documented rollback procedure. Never store secrets in code or CI variables, skip container resource limits, use the latest tag in production, or deploy on Fridays without monitoring coverage.