Skills of a Great DevOps Engineer in 2026

# .github/workflows/deploy.yml
# A CI/CD pipeline that builds, tests, and deploys.
# The pipeline is the heartbeat of DevOps work.

name: deploy

on:
  push:
    branches: [main]

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test -- --watchAll=false

      - name: Build
        run: npm run build

      - name: Build Docker image
        run: docker build -t my-app:${{ github.sha }} .

      - name: Push to registry
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login -u "${{ secrets.REGISTRY_USER }}" --password-stdin
          docker push my-app:${{ github.sha }}

      - name: Deploy to Kubernetes
        run: |
          kubectl set image deployment/my-app my-app=my-app:${{ github.sha }}
          kubectl rollout status deployment/my-app

# What a great DevOps engineer adds beyond this:
# - Fail fast: tests before build, lint before tests
# - Cache: node_modules and Docker layers
# - Rollback: how do we undo this in 30 seconds?
# - Security: scan the image before push
# - Observability: emit a deploy event and alert on failure
#
# The pipeline itself is easy. The judgement around it is the skill.

# A production Dockerfile
# Multi-stage build, non-root user, minimal attack surface.

# ── Stage 1: build ──
FROM node:20-slim AS builder
WORKDIR /app

COPY package*.json ./
RUN npm ci

COPY . .
RUN npm run build

# ── Stage 2: runtime ──
FROM node:20-slim AS runtime
WORKDIR /app

# Install only production dependencies
COPY package*.json ./
RUN npm ci --omit=dev && npm cache clean --force

# Copy the build output from the builder stage
COPY --from=builder /app/dist ./dist

# Run as a non-root user
RUN useradd -m appuser && chown -R appuser:appuser /app
USER appuser

EXPOSE 3000
CMD ["node", "dist/index.js"]

# What a great DevOps engineer adds:
# - Multi-stage keeps the runtime image small (100MB vs 1GB+)
# - Non-root user is a baseline security requirement
# - Copy dependencies before code for layer caching
# - No dev tools, no source, no secrets in the image
#
# The pattern is easy to copy. Knowing why each line exists
# is the skill.

# A Kubernetes deployment — production-grade
# Requests, limits, probes, rollouts, all in one file.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
        - name: my-app
          image: my-app:1.2.3
          ports:
            - containerPort: 3000
          resources:
            requests:
              cpu: "200m"
              memory: "256Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          readinessProbe:
            httpGet:
              path: /healthz
              port: 3000
            initialDelaySeconds: 5
            periodSeconds: 5
          livenessProbe:
            httpGet:
              path: /healthz
              port: 3000
            initialDelaySeconds: 30
            periodSeconds: 10
          env:
            - name: NODE_ENV
              value: production
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: password

# What a great DevOps engineer adds:
# - maxUnavailable: 0 → zero-downtime deploy
# - Requests and limits → predictable scheduling
# - Probes → kubelet can restart unhealthy pods
# - Secrets from Secret, not env literal
#
# This YAML works anywhere. The difference is knowing why
# every field is there, and what to change when a deploy
# breaks at 3 AM.