Practical DevOps Commands, CI/CD Automation & IaC Best Practices

This article collects the core commands, patterns, and hands-on examples you need to build reliable CI/CD pipelines, manage container orchestration, write Terraform and Kubernetes manifests, and automate security scanning and monitoring. It’s engineered to be actionable: copy-paste friendly, opinionated where needed, and light on fluff.

Overview: What a Modern DevOps Toolkit Should Do

At its heart, DevOps is about repeatability, speed, and safety. That means you want a small set of repeatable commands and manifests that reliably create, test, deploy, monitor, and roll back changes. Whether you’re using GitOps, pipeline-driven CI/CD, or hybrid flows, the same primitives show up: lint, plan, test, build, push, deploy, observe, alert.

A practical toolkit groups those primitives by intent: local development commands (fast feedback), CI commands (deterministic, containerized), and infra-as-code (immutable declarations). That separation reduces cognitive load and makes automation predictable. It also enables you to move work from humans into pipelines with minimal surprise.

This article links to a curated repo that implements many of the concepts below — including a DevOps commands collection, Terraform and Kubernetes manifests, and CI templates you can adapt instantly. See the repository: DevOps commands collection.

CI/CD Pipelines Automation: Templates, Triggers, and Best Practices

CI/CD pipelines should be declarative, fast for feedback, and capable of reproducing the same output in production. Start with three pipeline stages: build (artifact creation), test (unit/integration/security), and deploy (canary/blue-green). Make sure each stage is idempotent and has explicit inputs and outputs.

Use container images for deterministic builds. In pipeline YAMLs, pin base images and cache dependencies to reduce flakiness and runtime. Integrate security scanning into the pipeline: SAST during build, dependency scanning at a dependency step, and container scanning before pushing images.

Automate environment promotion with approvals for production. Implement automated rollbacks on health-check failures and define a clear runbook for manual intervention. If you’re using GitOps, put pipeline artifacts (image tags, Helm values, Kustomize overlays) into the repository that the cluster operator watches.

Container Orchestration Tools: Kubernetes Patterns and Practical Advice

Kubernetes is the de-facto orchestration layer for cloud-native workloads, but it’s easy to overcomplicate manifests. Keep manifests small and composable: use Deployments for workloads, Services for networking abstraction, and ConfigMaps/Secrets to separate config from code. Prefer resource requests/limits and basic probes to avoid noisy neighbors.

Adopt a layered approach to manifests: base Kubernetes objects, overlays for environments (dev/stage/prod), and pipeline-driven patching (like kustomize or Helm value files). For multi-cluster setups, centralize policies (networking, RBAC) and replicate workload manifests with controlled parameterization.

For orchestration tools beyond Kubernetes, consider managed services (ECS, GKE Autopilot, AKS) when operational overhead is a concern. For complex stateful systems, evaluate operators and StatefulSets, but start with stateless microservices and attach stateful services via managed databases.

Infrastructure as Code (IaC): Terraform and Manifest Hygiene

IaC gives you reproducible environments and versioned infrastructure. Terraform is widely used for cloud-provisioning; use module boundaries to separate concerns (networking, compute, storage). Always run terraform plan in CI and require approval for terraform apply in production environments.

Store Terraform state securely — remote state backends like S3 with DynamoDB locking or Terraform Cloud are essential for team workflows. Use workspaces or per-environment state to avoid accidental cross-environment changes. Validate changes with automated plan checks and drift detection.

For Kubernetes manifests, prefer generated manifests from templates (Helm) or pure overlays (kustomize) and keep manifests alongside corresponding Terraform outputs where needed. Example templates and concrete manifests are available in the linked repository: Terraform and Kubernetes manifests.

Monitoring and Incident Response: From Metrics to Playbooks

Monitoring is both signal and process. Build simple, actionable dashboards and health checks first — availability, latency, and error rate are primary signals. Instrument apps with structured logs, distributed tracing, and metrics exporters (Prometheus is an industry-standard metrics collector).

Define alert thresholds with escalation windows and implement alert fatigue controls (grouping, deduplication, severity tiers). Every alert should map to a documented runbook that includes quick checks, mitigation steps, and rollback criteria. Automate incident creation and notify via your communication channels with context and links to dashboards.

Post-incident, capture blameless retrospectives and convert findings to code changes: improved health checks, circuit breakers, test additions, or IaC tweaks. Store runbooks in versioned documentation and, when possible, automate remediation steps as runbook scripts or automation playbooks.

Security Scanning in DevOps: Integrate Early, Fail Fast

Shift-left security into the pipeline: static analysis (SAST), dependency scanning, container image scanning (Snyk, Trivy), and secrets scanning (git-secrets, detect-secrets). Fail builds when high-severity issues are detected and create tickets for medium/low issues to be triaged.

Automate context-aware scans: scan IaC for misconfigurations (tfsec, Checkov), run dynamic security tests in staging (DAST), and include runtime protections such as Kubernetes Pod Security Policies or OPA Gatekeeper for policy enforcement. Maintain a baseline of allowed vulnerabilities and a remediation SLA.

Audit and rotate secrets frequently. Use short-lived credentials when possible and store secrets in a managed secret store (HashiCorp Vault, AWS Secrets Manager). Integrate secrets retrieval into workloads using identity-based access rather than long-lived secrets in manifests.

Cloud Infrastructure Workflows: Pipelines, Cost, and Governance

Cloud workflows demand governance: tag resources by environment, owner, and cost center; automate alerts for budget thresholds; and apply policy-as-code to prevent risky provisioning. Make cost visibility part of the CI/CD pipeline reports (estimated monthly cost for new resources).

Automate ephemeral environments for feature branches with predictable teardown. Use IaC templates to spin up short-lived environments that mirror production configs, then destroy them automatically after testing. This reduces “works on my machine” surprises and keeps costs down.

Implement role-based access control for infra changes. Require pull requests, code review, and CI plan checks for any change that affects production resources. Keep the number of approvers minimal but strict for sensitive changes to strike a balance between speed and safety.

Practical Commands & Examples: Fast Reference

Below are compact, copy-paste friendly commands and snippets you’ll use daily. They’re intentionally terse — put them in your repo’s CLI helper scripts to standardize usage across the team.

# Build and scan Docker image
docker build -t myapp:${CI_COMMIT_SHORT_SHA} .
trivy image --severity HIGH,CRITICAL myapp:${CI_COMMIT_SHORT_SHA}

# Terraform: plan with remote backend
terraform init -backend-config="bucket=infra-state-prod"
terraform plan -var="env=prod"

# Kubernetes: apply overlay and rollout status
kubectl apply -k overlays/prod
kubectl rollout status deployment/myapp -n prod

Add these to your repository under a tools/ or scripts/ directory and ensure CI reuses the same commands to avoid drift between developer workflows and automated runs.

If you prefer a larger, curated collection of ready-made scripts and manifests, see the repository that contains examples and pipeline templates you can adapt: CI/CD pipelines automation.

Operational Checklist: When to Automate vs. When to Manual

Automate tasks that are repetitive, time-consuming, or error-prone: provisioning, deployments, rollbacks, scans, and tests. Keep manual steps for high-risk changes that need human judgment (e.g., architectural changes, emergency fixes) but route them through the same code-review and staging processes.

An operational checklist helps enforce consistency: (1) run local lint/tests, (2) open a PR, (3) pipeline runs build/test/scan, (4) environment promotion with approvals, (5) monitor after deployment, (6) rollback if critical. Codify this checklist in CONTRIBUTING.md or team docs.

Measure the effectiveness of automation with metrics: deployment frequency, lead time for changes, mean time to recovery (MTTR), and change failure rate. Use these to prioritize further automation work and identify friction points.

Semantic Core (Keyword Clusters)

Suggested Micro-markup

To increase SERP visibility and support voice/featured-snippet responses, add FAQ schema for the Q&A below and Article schema with headline, description, mainEntity, and author. Example: use JSON-LD for FAQ (included at end of page). That makes short answers eligible for voice search and improves CTR.

Links & Backlinks

This guide references a single curated repository that implements many patterns shown above: DevOps commands collection. For quick access to IaC examples, see the repo’s Terraform modules and manifests: Terraform and Kubernetes manifests. The repo also contains CI templates for pipeline automation: CI/CD pipelines automation.

FAQ

1. How do I get started with a minimal CI/CD pipeline?

   Create three stages: build (containerize), test (unit + quick integration), deploy (to staging). Use a pipeline YAML with image pinning, caching, and a terraform plan step for infra changes. Add security scanning to the build stage and require manual approval for production deploys.

2. When should I use Terraform vs. Kubernetes manifests?

   Use Terraform for cloud provisioning (networks, databases, managed services). Use Kubernetes manifests (Helm/Kustomize) to describe workload deployments inside clusters. Tie them together by exporting Terraform outputs (like load balancer names) into manifests or Helm values during pipeline runs.

3. What’s the fastest way to add security scanning to my pipeline?

   Start with dependency scanning (SCA) and container image scanning (Trivy). Add SAST for your main language, and run tfsec/Checkov on Terraform. Configure the pipeline to fail on critical findings and report medium findings to an automated ticketing queue.