Practice base
Practices that work in production
40 cards: 11 studied, 29 not studied. Every card has an example and a status.
Network
Docker
Kubernetes
ArgoCD app-of-apps pattern
One root Application manages a dozen children. The cluster's GitOps state lives in one repository.
StudiedKubeconform for manifests
Validate rendered resources against the target Kubernetes schema.
Not studiedIaC
Terragrunt for DRY modules
One Terraform module — dozens of environments without copy-paste. terragrunt.hcl + include.
Ansible-lint + Molecule
Profile-based linting and role tests: converge, idempotence, verify.
Not studiedSRE
Four Golden Signals
Latency · Traffic · Errors · Saturation — the minimum mandatory dashboard for any service. From the Google SRE book.
StudiedSloth: SLO
SLOs and error budget burn alerts for Prometheus.
Not studiedCI/CD
Trivy image scanning in CI
The build fails on HIGH/CRITICAL CVEs before the push to the registry — vulnerabilities get fixed, not accumulated.
Studiedpre-commit for IaC
tflint · yamllint · detect-secrets in one .pre-commit-config.yaml — locally and in CI.
Actionlint + ShellCheck
Check workflows and shell scripts before CI runs.
Not studiedRenovate for GitLab
Scheduled MRs updating dependencies and images by digest.
Not studiedgitlab-ci-local
Run .gitlab-ci.yml jobs locally before push.
Not studiedMonitoring
Prometheus recording rules
Heavy PromQL is precomputed in the background — dashboards open in milliseconds, not 15 seconds.
StudiedThe USE method for capacity
Utilization · Saturation · Errors for every resource. The bottleneck shows up in a minute, without "let's add nodes".
StudiedHealthchecks for cron
Get notified if a job failed or never started.
Not studiedHTTP and TLS checks
Check the public site, the certificate and the availability of the probe itself.
Not studiedSecurity
kube-bench · CIS Benchmark
Automatic cluster check against 100+ CIS Kubernetes items. A Job in the cluster, a report in Slack.
StudiedNginx TLS hardening
One tls.conf — TLS 1.2/1.3, HSTS, OCSP stapling. SSL Labs A+ on every server block.
Syft: an SBOM for an image
Record what a release contains and tie the report to a specific image.
Not studiedSOPS + age for secrets
Keep encrypted configs in Git and the keys separately.
Not studiedOpenSSF Scorecard
Assess a repository: dependency pinning, dangerous workflows, maintenance.
Not studiedCrowdSec for a VPS
Attack detection from Nginx and sshd logs, blocking via a bouncer.
Not studiedzizmor
Find dangerous triggers, unpinned actions and excessive permissions in GitHub Actions.
Not studiedGrype on an SBOM
Find CVEs in a stored SBOM without rebuilding the image.
Not studiedConftest
Rego policies for YAML and other configs.
Not studiedCosign
Sign images and verify the signature before deploy.
Not studiedBackups
Linux
Platform Engineering
MLOps / LLMOps
LiteLLM
A single OpenAI-compatible gateway: keys, budgets, local and cloud models.
Not studiedLangfuse
Traces, tokens and cost of LLM requests.
Not studiedpromptfoo + garak
Prompt regression tests in CI and model vulnerability scanning.
Not studiedMLOps Zoomcamp
A learning track: MLflow, model deployment and monitoring, CI/CD for ML.
Not studiedvLLM
Your own inference server with an OpenAI-compatible API.
Not studiedAI tools
agent-scan
Check MCP servers and skills before installing.
Not studiedAgent Skills
Package a repeatable procedure as a skill for an AI agent.
Not studiedRead-only Kubernetes MCP
Agent access to the cluster: read_only, the view role, Secrets denied.
Not studiedHolmesGPT
AI analysis of Prometheus and Alertmanager alerts.
Not studiedagency-agents
Role scaffolds for subagents, tailored to your stack.
Not studied