Personal knowledge base · DevOps
I systematize practices.
I put them to work.
devops-kb is a personal map of the best DevOps practices. Every card follows the same structure: problem → solution → example → adoption status. It works as long as it gets applied.
Practices
40 cards: 11 studied, 29 not studied. Problem, solution, example and done criteria.
Findings
42 repositories in three selections: DevOps, Platform/DevSecOps, MLOps/LLMOps and AI tools.
Digest
The week's highlights: security, TLS, Linux and AI infrastructure — and what to do in your own setup.
New practices · October 29, 2026
21 cards: DevOps, Platform/DevSecOps, MLOps/LLMOps and AI tools.
Renovate for GitLab
Scheduled MRs updating dependencies and images by digest.
Not studiedgitlab-ci-local
Run .gitlab-ci.yml jobs locally before push.
Not studiedOpenSSF Scorecard
Assess a repository: dependency pinning, dangerous workflows, maintenance.
Not studiedagent-scan
Check MCP servers and skills before installing.
Not studiedAnsible-lint + Molecule
Profile-based linting and role tests: converge, idempotence, verify.
Not studiedCrowdSec for a VPS
Attack detection from Nginx and sshd logs, blocking via a bouncer.
Not studiedzizmor
Find dangerous triggers, unpinned actions and excessive permissions in GitHub Actions.
Not studiedGrype on an SBOM
Find CVEs in a stored SBOM without rebuilding the image.
Not studiedLiteLLM
A single OpenAI-compatible gateway: keys, budgets, local and cloud models.
Not studiedLangfuse
Traces, tokens and cost of LLM requests.
Not studiedpromptfoo + garak
Prompt regression tests in CI and model vulnerability scanning.
Not studiedMLOps Zoomcamp
A learning track: MLflow, model deployment and monitoring, CI/CD for ML.
Not studiedAgent Skills
Package a repeatable procedure as a skill for an AI agent.
Not studiedBackstage
A service catalog, templates and TechDocs in an internal portal.
Not studiedvLLM
Your own inference server with an OpenAI-compatible API.
Not studiedRead-only Kubernetes MCP
Agent access to the cluster: read_only, the view role, Secrets denied.
Not studiedHolmesGPT
AI analysis of Prometheus and Alertmanager alerts.
Not studiedagency-agents
Role scaffolds for subagents, tailored to your stack.
Not studiedConftest
Rego policies for YAML and other configs.
Not studiedSloth: SLO
SLOs and error budget burn alerts for Prometheus.
Not studiedCosign
Sign images and verify the signature before deploy.
Not studiedPractices · October 11, 2026
Restic: a restore drill
Verify a snapshot and restore the data into a separate directory.
Not studiedHealthchecks for cron
Get notified if a job failed or never started.
Not studiedHTTP and TLS checks
Check the public site, the certificate and the availability of the probe itself.
Not studiedGoss after deploy
Check services, configs and HTTP responses on the VPS.
Not studiedActionlint + ShellCheck
Check workflows and shell scripts before CI runs.
Not studiedKubeconform for manifests
Validate rendered resources against the target Kubernetes schema.
Not studiedSyft: an SBOM for an image
Record what a release contains and tie the report to a specific image.
Not studiedSOPS + age for secrets
Keep encrypted configs in Git and the keys separately.
Not studiedStudied
ss -tulpan instead of netstat
A modern netstat replacement for sockets and processes. Dozens of times faster on busy hosts.
StudiedHadolint in pre-commit
Automatic Dockerfile validation before commit: apt without --no-install-recommends, pinned versions, safe USER.
ArgoCD app-of-apps pattern
One root Application manages a dozen children. The cluster's GitOps state lives in one repository.
StudiedTerragrunt for DRY modules
One Terraform module — dozens of environments without copy-paste. terragrunt.hcl + include.
Four Golden Signals
Latency · Traffic · Errors · Saturation — the minimum mandatory dashboard for any service. From the Google SRE book.
StudiedTrivy image scanning in CI
The build fails on HIGH/CRITICAL CVEs before the push to the registry — vulnerabilities get fixed, not accumulated.
Studiedpre-commit for IaC
tflint · yamllint · detect-secrets in one .pre-commit-config.yaml — locally and in CI.
Prometheus recording rules
Heavy PromQL is precomputed in the background — dashboards open in milliseconds, not 15 seconds.
StudiedThe USE method for capacity
Utilization · Saturation · Errors for every resource. The bottleneck shows up in a minute, without "let's add nodes".
Studiedkube-bench · CIS Benchmark
Automatic cluster check against 100+ CIS Kubernetes items. A Job in the cluster, a report in Slack.
StudiedNginx TLS hardening
One tls.conf — TLS 1.2/1.3, HSTS, OCSP stapling. SSL Labs A+ on every server block.
Key principles
Practicality
Only what actually applies at work — no theory for theory's sake.
Gaps first
Start with the areas where knowledge is most lacking.
Applied = paid off
A card is valuable only once it is put to use, not once it is read.