Cloud DevOps

Not this skill: application code that happens to run in a container (its domain skill), or reading production signals during an incident (observability).

Preflight

Establish infrastructure context and active cluster/workspace across Linux/macOS (bash) or Windows (PowerShell):

# Linux / macOS
ls .github/workflows/ Dockerfile* helm/ chart/ *.tf 2>/dev/null || true
kubectl config current-context          # which cluster are you actually pointed at?
terraform workspace show 2>/dev/null || true

# Windows (PowerShell)
Get-ChildItem -Path .github/workflows, Dockerfile*, helm, chart, *.tf -ErrorAction SilentlyContinue
kubectl config current-context          # which cluster are you actually pointed at?
terraform workspace show 2>$null

The wrong kube context is the single most expensive mistake available here. Read it before every session, not once.

Workflow

1. Inspect what already exists — pipeline, image, chart, IaC, deployment ownership — before proposing a change. Who applies this, and from where?
2. Write down the failure domain, the rollback path, the secret flow, and the one signal that says it worked. A change without a stated rollback is not ready to plan.
3. Make the smallest declarative change. Pin external actions by SHA, images by digest, providers by version — a floating tag is a supply-chain hole and a reproducibility hole at once.
4. Validate locally without mutating anything live (see the dry-run table).
5. Prove runtime health with rollout status, events, and a workload smoke. The pipeline going green is not the signal.

For implementation work, produce the concrete infrastructure artifact requested (workflow, image definition, manifests, chart, or IaC), keep the diff smallest, and report validation evidence plus the remaining runtime boundary. A delivery checkpoint states what changed, what passed locally, and what still requires an authorized apply or live rollout.

Dry Run Before Apply

Every one of these is read-only. There is no reason to skip them.

Verify the Rollout, Not the Pipeline

# Linux / macOS
kubectl rollout status deploy/<name> --timeout=180s
kubectl get events --sort-by=.lastTimestamp | tail -20
kubectl get pod -l app=<name> -o jsonpath='{.items[*].status.containerStatuses[*].imageID}'

# Windows (PowerShell)
kubectl rollout status deploy/<name> --timeout=180s
kubectl get events --sort-by=.lastTimestamp | Select-Object -Last 20
kubectl get pod -l app=<name> -o jsonpath='{.items[*].status.containerStatuses[*].imageID}'

The last one is the one people skip. With a mutable tag (:latest), a failed build leaves the old image serving while the sync reports healthy — Argo CD says Synced, the pipeline is green, and the running digest is yesterday's. Compare that digest against the artifact you just built; if they differ, the deploy did not happen.

Reference Routing

Open a file only when its trigger fires.

• Symptom matches a known outage: real-world-cases.md
• Pipeline or runner edit: ci-cd-best-practices.md
• Authoring an image: dockerfile-standards.md; debugging a running container: docker-operations.md
• Chart templates, values, or probe misconfiguration: helm-standards.md; install, upgrade, rollback: helm-workflow.md
• Terraform or Pulumi structure: iac-principles.md; plan, state locking, or drift: iac-operations.md
• Choosing canary, blue-green, or feature-flag-gated rollout and its rollback trigger: progressive-rollout.md
• Live-editing an ArgoCD-managed resource, or verifying a :latest/CI-blocked homelab deploy: gitops-homelab-deploy.md
• Picking managed services: cloud-patterns.md; functions or cold starts: serverless-patterns.md

See Reference Map for specialized references and sub-domain guides.

Stop

• The kube context or Terraform workspace is not the one you intended. Stop before any command that mutates.
• No rollback path exists for this change. Define it first; a deploy without a reversal is a cutover.
• The running digest does not match the artifact just built. The deploy did not happen — do not report success.

Rules

• Hand off security scans to security-ops, telemetry and incident response to observability, and git delivery to git-workflow.
• No apply, deploy, deletion, or production mutation without explicit confirmation.
• Use short-lived identity/OIDC; never place credentials in manifests or workflow logs. A secret echoed by a debug step is a leaked secret.
• Build once and promote the same immutable artifact by digest across environments.
• Kubernetes workloads need resource requests and limits, liveness and readiness probes, and a PodDisruptionBudget so a node drain cannot evict the last replica. Liveness that duplicates readiness restarts a healthy pod under load.
• Under a GitOps controller (Argo CD, Flux): inspect the desired-versus-live diff, fix desired state in the repository instead of forcing a sync by hand, and treat pruning as dangerous for shared objects.
• Terraform state is production data: remote backend, locking, versioned, never edited by hand. terraform apply without a saved plan applies something nobody reviewed.
• Logs, metrics, traces, SLOs, and alerting and live outage response belong to observability. Keep rollout mechanics here.

Checklist

• Blast radius, secret flow, and rollback path stated before the change.
• Configuration lints, renders, or plans cleanly with no live mutation.
• External actions, images, and providers pinned.
• Rollout status green and the running digest matches the artifact just built.