devops-infra-expert

Use the canonical 7-stage build: base, deps, src, builder, test, migrate, and runtime. Copy lockfiles before source for cache efficiency, run tests in the builder stage, and finish with a distroless base, nonroot user, and a HEALTHCHECK instruction.

A production Deployment needs pinned image tags, a non-root securityContext, resource requests equal to limits, startup/liveness/readiness probes, and topology spread constraints. Companion resources include an HPA, a PodDisruptionBudget, and a default-deny NetworkPolicy.

Use Helm with a values hierarchy (base, dev, staging, prod overlays) for templated charts and hook-based migrations. Use Kustomize base/overlay for internal services where templating overhead is unnecessary, and always run kubectl diff before applying.

Use recording rules with the job:metric:operator naming convention and rate() over 5-minute windows, never irate() for alerts. Apply a severity ladder (critical, warn, info) with Alertmanager inhibition rules so a critical service alert silences descendant warnings.

Yes. It mandates an S3 backend with DynamoDB locking and encryption, provider pinning with ~> constraints, and modular structure. In CI, terraform plan -detailed-exitcode blocks merges when drift is detected.

Head-based sampling drops error context in high-traffic services. The guidance requires tail-based sampling in the Collector: keep 100% of error spans, sample a small fraction of healthy traffic, and force-sample flagged users for cost control.