devops-automator

这段内容是审核时保存的快照。外部来源才是完整且最新的版本。

---
name: devops-automator
description: 'Expert DevOps engineer for CI/CD, IaC, Kubernetes, and deployment automation. Activate on: CI/CD, GitHub Actions, Terraform, Docker, Kubernetes, Helm, ArgoCD, GitOps, deployment pipeline,
  infrastructure as code, container orchestration. NOT for: application code (use language skills), database schema (use data-pipeline-engineer), API design (use api-architect).'
allowed-tools: Read,Write,Edit,Bash(docker:*,kubectl:*,terraform:*,helm:*,gh:*)
metadata:
  category: DevOps & Site Reliability
  pairs-with:
  - skill: site-reliability-engineer
    reason: Ensure deployed code is healthy
  - skill: security-auditor
    reason: Secure the deployment pipeline
  tags:
  - ci-cd
  - terraform
  - docker
  - kubernetes
  - gitops
---

# DevOps Automator

Expert DevOps engineer specializing in CI/CD pipelines, infrastructure as code, container orchestration, and deployment automation.

## Activation Triggers

**Activate on:** "CI/CD", "GitHub Actions", "deployment pipeline", "Terraform", "infrastructure as code", "IaC", "Docker", "Kubernetes", "K8s", "Helm", "container orchestration", "GitOps", "ArgoCD", "deployment automation", "secrets management", "monitoring setup"

**NOT for:** Application development → language skills | Database design → `data-pipeline-engineer` | API design → `api-architect`

## Quick Start

1. **Define deployment strategy**: Blue/Green, Canary, or Rolling
2. **Choose IaC tool**: Terraform for cloud resources, Helm for K8s apps
3. **Design CI stages**: lint → test → security scan → build → deploy
4. **Implement GitOps**: Config repo synced by ArgoCD
5. **Add observability**: Prometheus metrics, structured logging

## Core Capabilities

| Domain | Tools & Technologies |
|--------|---------------------|
| **CI/CD** | GitHub Actions, GitLab CI, Jenkins |
| **IaC** | Terraform, AWS CDK, Pulumi |
| **Containers** | Docker, Kubernetes, Helm |
| **GitOps** | ArgoCD, Flux, Kustomize |
| **Monitoring** | Prometheus, Grafana, ELK/EFK |

## Architecture Patterns

### CI/CD Pipeline Flow
```
Code Commit → Build → Test → Security Scan → Package
                                              ↓
Monitor ← Release Staging ← Smoke Tests ← Deploy Dev
                 ↓
         Manual Approval
                 ↓
         Deploy Production
```

### GitOps Architecture
```
App Repo ──CI──▶ Config Repo ──ArgoCD──▶ K8s Cluster
                     ▲                        │
                     └────Continuous Sync─────┘
```

## Reference Files

Full working examples are in `./references/`:

| File | Description | Lines |
|------|-------------|-------|
| `github-actions-patterns.yaml` | Complete CI/CD pipeline | 217 |
| `terraform-eks-module.tf` | Production EKS cluster | 282 |
| `kubernetes-deployment.yaml` | Deployment + HPA + ArgoCD | 200 |
| `dockerfile-multistage.dockerfile` | Optimized multi-stage build | 51 |

## Anti-Patterns (AVOID These)

### 1. YAML Copy-Paste Proliferation
**Symptom**: Nearly identical workflow files duplicated across repositories
**Fix**: Reusable workflows, Helm charts, Kustomize bases, Terraform modules

### 2. Hardcoded Secrets in Code
**Symptom**: API keys, passwords committed to git
**Fix**: Secret managers (Vault, AWS SM), sealed secrets, env vars from secure sources

### 3. No Rollback Strategy
**Symptom**: No plan for deployment failure, manual intervention required
**Fix**: Blue/green, canary with automated rollback, ArgoCD auto-revert

### 4. Monolithic CI Pipeline
**Symptom**: Single 45-minute pipeline rebuilding everything on every commit
**Fix**: Parallel jobs, caching, incremental builds, path-based triggers

### 5. No Resource Limits
**Symptom**: K8s pods without CPU/memory limits consuming all host resources
**Fix**: Always set requests/limits, use LimitRanges and ResourceQuotas

### 6. Running as Root in Containers
**Symptom**: Dockerfile without USER instruction, pods running privileged
**Fix**: Add USER instruction, set securityContext.runAsNonRoot: