DevOps: From Code to Production

Pipeline Stages ```yaml # GitHub Actions production-grade CI/CD pipeline name: CI/CD Pipeline on: push: branches: [main] pull_request: branches: [main]

jobs: # Stage 1: Code Quality (run on every PR) lint-and-type-check: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: { node-version: 20, cache: npm } - run: npm ci - run: npm run lint - run: npm run type-check

# Stage 2: Tests (parallel for speed) test: runs-on: ubuntu-latest needs: lint-and-type-check strategy: matrix: test-suite: [unit, integration] services: postgres: image: postgres:15 env: POSTGRES_DB: testdb POSTGRES_PASSWORD: test ports: ["5432:5432"] steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: { node-version: 20, cache: npm } - run: npm ci - run: npm run test:${{ matrix.test-suite }} -- --coverage - uses: codecov/codecov-action@v3 # track coverage over time

# Stage 3: Security Scan security: runs-on: ubuntu-latest needs: test steps: - uses: actions/checkout@v4 - run: npm audit --audit-level=high - uses: snyk/actions/node@master env: SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

# Stage 4: Build Docker image build: runs-on: ubuntu-latest needs: [test, security] if: github.ref == 'refs/heads/main' outputs: image-tag: ${{ steps.meta.outputs.tags }} steps: - uses: actions/checkout@v4 - uses: docker/build-push-action@v5 with: push: true tags: ghcr.io/myorg/myapp:${{ github.sha }}

# Stage 5: Deploy to staging deploy-staging: needs: build runs-on: ubuntu-latest environment: staging steps: - uses: azure/k8s-deploy@v4 with: manifests: k8s/staging/ images: ghcr.io/myorg/myapp:${{ github.sha }}

# Stage 6: Smoke tests against staging smoke-tests: needs: deploy-staging runs-on: ubuntu-latest steps: - run: npm run test:smoke -- --base-url=https://staging.example.com

# Stage 7: Production deploy (manual approval gate) deploy-production: needs: smoke-tests runs-on: ubuntu-latest environment: production # requires manual approval in GitHub steps: - uses: azure/k8s-deploy@v4 with: manifests: k8s/production/ strategy: canary percentage: 20 # start with 20% traffic ```

Terraform for Cloud Infrastructure ```hcl # terraform/main.tf production web app infrastructure terraform { required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } } backend "s3" { bucket = "my-terraform-state" key = "prod/terraform.tfstate" region = "us-east-1" } }

# Variables variable "environment" { default = "production" } variable "app_name" { default = "my-app" } variable "instance_count" { default = 2 }

# ECS Service (containerized app) resource "aws_ecs_service" "app" { name = "${var.app_name}-${var.environment}" cluster = aws_ecs_cluster.main.id task_definition = aws_ecs_task_definition.app.arn desired_count = var.instance_count

deployment_circuit_breaker { enable = true rollback = true # auto-rollback on deployment failure }

load_balancer { target_group_arn = aws_lb_target_group.app.arn container_name = "app" container_port = 3000 } }

# RDS Database with automated backups resource "aws_db_instance" "postgres" { identifier = "${var.app_name}-db" engine = "postgres" engine_version = "15.3" instance_class = "db.t3.medium" allocated_storage = 100 storage_encrypted = true backup_retention_period = 7 # 7 days of backups backup_window = "03:00-04:00" maintenance_window = "sun:04:00-sun:05:00" deletion_protection = true # prevent accidental deletion tags = { Environment = var.environment, Application = var.app_name } } ```

Monitoring & Alerting ```yaml # Prometheus alert rules (alerts.yml) groups: - name: application rules: - alert: HighErrorRate expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.05 for: 2m annotations: summary: "High error rate on {{ $labels.service }}" description: "Error rate is {{ $value | humanizePercentage }}"

- alert: HighLatency expr: histogram_quantile(0.95, http_request_duration_seconds_bucket) > 0.5 for: 5m annotations: summary: "p95 latency above 500ms"

- alert: PodCrashLooping expr: rate(kube_pod_container_status_restarts_total[15m]) > 0 for: 5m annotations: summary: "Pod {{ $labels.pod }} is crash looping" ```