DevOps best practices

1. Culture before tools #

Collaboration and shared responsibility.

CALMS principles #

• Culture: product teams responsible end to end (« you build it, you run it »), mistakes treated as learning opportunities.
• Automation: build, test, deployment and infrastructure without manual intervention.
• Lean: small batches, continuous flow, fewer queues.
• Measurement: data-driven decisions (DORA, SLO).
• Sharing: documentation, runbooks, code reviews and public post-mortems.

2. Delivering continuously #

CI/CD and trunk-based development.

A typical pipeline #

# .gitlab-ci.yml
stages: [build, test, scan, deploy-preprod, deploy-prod]
build:
  stage: build
  script: [docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA ., docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA]
test:
  stage: test
  script: [make test, make lint]
scan:
  stage: scan
  script: [trivy image --exit-code 1 --severity CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA, gitleaks detect --source .]
deploy-preprod:
  stage: deploy-preprod
  script: [helm upgrade --install app ./chart -n preprod --set image.tag=$CI_COMMIT_SHA --atomic --wait]
deploy-prod:
  stage: deploy-prod
  when: manual
  only: [main]
  script: [helm upgrade --install app ./chart -n prod --set image.tag=$CI_COMMIT_SHA --atomic --wait]

• Small, frequent changes on the main branch (trunk-based), feature flags to hide work in progress.
• A single artifact built once, promoted from one environment to the next.
• Automated rollback (--atomic, helm rollback, kubectl rollout undo).

3. Infrastructure as Code and GitOps #

Everything is in Git.

Principles #

# Infrastructure décrite en code, revue et testée
terraform fmt -check && terraform validate && terraform plan -out=tfplan
tflint && checkov -d .

# GitOps : Git est la source de vérité, un agent réconcilie le cluster
argocd app create shop --repo https://git.exemple.fr/shop/deploy.git --path k8s/prod --dest-server https://kubernetes.default.svc --dest-namespace prod --sync-policy automated --self-heal
argocd app diff shop && argocd app history shop

Common mistake: « Urgent » manual changes in production create drift: fix in Git, then let automation apply it.

4. Security, reliability and learning #

DevSecOps, SLOs and post-mortems.

Integrating security and measuring #

• Shift-left: scanning dependencies (SCA), secrets, images and IaC right in the CI.
• SLOs and error budget: define a reliability target and arbitrate between new features and stability.
• Healthy on-call: actionable alerts, runbooks, fair rotation.
• Blameless post-mortems: timeline, contributing causes, actions tracked until closure.

# SLO de disponibilité 99,9 % sur 30 jours -> budget d'erreur ≈ 43 minutes
# Taux de consommation du budget (PromQL)
1 - (sum(rate(http_requests_total{status!~"5.."}[30d])) / sum(rate(http_requests_total[30d])))
# DORA : fréquence de déploiement (tags de release)
git tag --list 'v*' --sort=-creatordate --format='%(creatordate:short) %(refname:short)' | head -20

Good practice: Start by measuring the four DORA metrics, then improve one constraint at a time (batch size, build time, flaky tests, approval process).

Reference diagram and quick check #

Visualize the principle and check it from the command line.

Reference diagram #

git log --oneline --since='7 days ago' | wc -l          # fréquence des changements
kubectl rollout history deployment/api