devops-deployment

SKILL.md

DevOps & Deployment Skill

Comprehensive frameworks for CI/CD pipelines, containerization, deployment strategies, and infrastructure automation.

Note: If disableSkillShellExecution is enabled (CC 2.1.91), the Docker install check won't run. Verify Docker is available for container operations: docker --version.

Overview

Setting up CI/CD pipelines

Containerizing applications

Deploying to Kubernetes or cloud platforms

Implementing GitOps workflows

Managing infrastructure as code

Planning release strategies

Pipeline Architecture
┌─────────────┐   ┌─────────────┐   ┌─────────────┐   ┌─────────────┐
│    Code     │──>│    Build    │──>│    Test     │──>│   Deploy    │
│   Commit    │   │   & Lint    │   │   & Scan    │   │  & Release  │
└─────────────┘   └─────────────┘   └─────────────┘   └─────────────┘
       │                 │                 │                 │
       v                 v                 v                 v
   Triggers         Artifacts          Reports          Monitoring

Key Concepts

CI/CD Pipeline Stages

Lint & Type Check - Code quality gates

Unit Tests - Test coverage with reporting

Security Scan - npm audit + Trivy vulnerability scanner

Build & Push - Docker image to container registry

Deploy Staging - Environment-gated deployment

Deploy Production - Manual approval or automated

Container Best Practices

Multi-stage builds minimize image size:

Stage 1: Install production dependencies only

Stage 2: Build application with dev dependencies

Stage 3: Production runtime with minimal footprint

Security hardening:

Non-root user (uid 1001)

Read-only filesystem where possible

Health checks for orchestrator integration

Kubernetes Deployment

Essential manifests:

Deployment with rolling update strategy

Service for internal routing

Ingress for external access with TLS

HorizontalPodAutoscaler for scaling

Security context:

runAsNonRoot: true

allowPrivilegeEscalation: false

readOnlyRootFilesystem: true

Drop all capabilities

Deployment Strategies

Strategy
Use Case
Risk

Rolling
Default, gradual replacement
Low - automatic rollback

Blue-Green
Instant switch, easy rollback
Medium - double resources

Canary
Progressive traffic shift
Low - gradual exposure

Rolling Update (Kubernetes default):

strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 25%
    maxUnavailable: 0  # Zero downtime

Secrets Management

Use External Secrets Operator to sync from cloud providers:

AWS Secrets Manager

HashiCorp Vault

Azure Key Vault

GCP Secret Manager

References

Docker Patterns

Load: Read("${CLAUDE_SKILL_DIR}/references/docker-patterns.md")

Key topics covered:

Multi-stage build examples with 78% size reduction

Layer caching optimization

Security hardening (non-root, health checks)

Trivy vulnerability scanning

Docker Compose development setup

CI/CD Pipelines

Load: Read("${CLAUDE_SKILL_DIR}/references/ci-cd-pipelines.md")

Key topics covered:

Branch strategy (Git Flow)

GitHub Actions caching (85% time savings)

Artifact management

Matrix testing

Complete backend CI/CD example

Kubernetes Basics

Load: Read("${CLAUDE_SKILL_DIR}/references/kubernetes-basics.md")

Key topics covered:

Health probes (startup, liveness, readiness)

Security context configuration

PodDisruptionBudget

Resource quotas

StatefulSets for databases

Helm chart structure

Environment Management

Load: Read("${CLAUDE_SKILL_DIR}/references/environment-management.md")

Key topics covered:

External Secrets Operator

GitOps with ArgoCD

Terraform patterns (remote state, modules)

Zero-downtime database migrations

Alembic migration workflow

Rollback procedures

Observability

Load: Read("${CLAUDE_SKILL_DIR}/references/observability.md")

Key topics covered:

Prometheus metrics exposition

Grafana dashboard queries (PromQL)

Alerting rules for SLOs

Golden signals (SRE)

Structured logging

Distributed tracing (OpenTelemetry)

Railway Deployment

Load: Read("${CLAUDE_SKILL_DIR}/rules/railway-deployment.md")

Key topics covered:

railway.json configuration, Nixpacks builds

Environment variable management, database provisioning

Multi-service setups, Railway CLI workflows

References: ${CLAUDE_SKILL_DIR}/references/railway-json-config.md, ${CLAUDE_SKILL_DIR}/references/nixpacks-customization.md, ${CLAUDE_SKILL_DIR}/references/multi-service-setup.md

Deployment Strategies

Load: Read("${CLAUDE_SKILL_DIR}/references/deployment-strategies.md")

Key topics covered:

Rolling deployment

Blue-green deployment

Canary releases

Traffic splitting with Istio

Deployment Checklist & Templates

Load: Read("${CLAUDE_SKILL_DIR}/references/checklists-and-templates.md") for pre/during/post-deployment checklists, Helm chart structure, template reference table, and extended thinking triggers.

Related Skills

zero-downtime-migration - Database migration patterns for zero-downtime deployments

security-scanning - Security scanning integration for CI/CD pipelines

ork:monitoring-observability - Monitoring and alerting for deployed applications

ork:database-patterns - Python/Alembic migration workflow for backend deployments

portless (upstream) - Named .localhost URLs for multi-service local dev (portless alias api 8080)

Key Decisions

Decision
Choice
Rationale

Container user
Non-root (uid 1001)
Security best practice, required by many orchestrators

Deployment strategy
Rolling update (default)
Zero downtime, automatic rollback, resource efficient

Secrets management
External Secrets Operator
Syncs from cloud providers, GitOps compatible

Health checks
Separate startup/liveness/readiness
Prevents premature traffic, enables graceful shutdown

Capability Details

Load: Read("${CLAUDE_SKILL_DIR}/references/capability-details.md") for full keyword index and problem-solution mapping across all 6 capabilities (ci-cd, docker, kubernetes, infrastructure-as-code, deployment-strategies, observability).