r/devops

Hey Folks, need your advice badly ,

I'm building out a CI/CD flow for AKS using Azure DevOps Pipelines (not ArgoCD/GitOps for this one, using native Azure Pipelines + KubernetesManifest@1 tasks). Trying to understand what people actually do in production.

The MS Learn sample bundles CI and CD into one pipeline (Build stage → Deploy stage, same YAML file), which builds once and deploys straight to the cluster. That seems fine for a single environment, but once you add QA → UAT → Prod with a manual sign-off before prod, it starts to feel like the wrong shape.

Questions:

1. Do you run one CD pipeline with multiple stages (QA → UAT → Prod, each an Azure DevOps Environment with its own approval gates), or separate pipelines per environment (e.g. cd-nonprod and cd-prod)? What made you choose one over the other?
2. How do you handle the nonprod → prod ACR promotion? Are you doing az acr import to copy the same digest into a separate prod registry, or do you just use one ACR with RBAC-scoped repositories/tags instead of physically separate registries?
3. If CI only has push access to a nonprod ACR, what triggers the CD pipeline — a pipeline completion trigger (resources.pipelines), a manual run with an image tag parameter, or something else?
4. For those who've tried both native Azure Pipelines deploys and ArgoCD/GitOps for AKS was there a specific pain point that pushed you from one to the other?

Not looking for "just use GitOps" as the whole answer (I get the appeal); more interested in how people structure this with plain Azure DevOps pipelines if they're not on ArgoCD, since that's what I'm working with right now.

I've been working at a local startup as a DevOps engineer for the past year. I have a total of around 3 years of experience, which is considered mid-level at best. I've worked with various technologies and I'm not that confident in my technical skills but I do try my best to deliver. That's not my problem though. My problem is that communication with my manager is terrible.

I am rarely assigned any tickets. My work is a mixture of verbally assigned tasks with minimal details and initiatives I take to improve our workflows. My manager rarely joins our weekly one to one meetings so I decided to send him my task updates on teams. He doesn't reply to my messages, sometimes for days. He will only reply fast if he believes the question is important to him. He never reacts or responds to my task updates and won't review my work for months (if at all). Sometimes, when I ask him questions or try to make conversation on meetings he won't respond. When I ask again, he will laugh it off saying he heard me the first time. The kind of questions I ask are usually clarifications on my tasks, or discussion around my technical implementations.

In general, I believe I am fairly independent and I don't burden the team. My tasks are mine to deliver and I am solely responsible for them. I request guidance in a structured way and usually when I don't have enough information to move on. Even when I don't have enough context I will push through instead of waiting for weeks for an answer. The problem is that I am not responsible for the infrastructure architectural decisions, and I need the clarifications in order to do my job effectively.

I will give you a recent example:
I am asked to deploy one of our products to a test environment, but we want this product to be isolated from our other products so it's not the standard procedure.
That's pretty much what I got. I ask my manager to discuss for like 15minutes to show me what he deployed for production. He never does.

I create a list of resources I will need to deploy along with the infra design. I make the deployment. I share that with him. He shows up after a week of being AWOL to tell me some resources should be redeployed. I ask for two very specific clarifications in chat. He says we will discuss in a meeting. We join the meeting. I ask. He stays silent. I ask again. He says he heard me and he just didn't respond.

What am I supposed to do at this point? This whole thing is deeply demoralizing to me. I feel deeply disrespected and looked down upon. I am mad and sad and it's affecting my confidence and will to work and be creative and productive. I've tried a few different things since starting in this company, I've created my own tickets and shared them with him, I've tried texting him I've tried reaching out during meetings to avoid spamming him. Nothing seems to work. I dread going to work every single day. I feel lost about what to do next.

I want to stay professional but I also feel very done. I want them to fuck off but also I want to take technical experience. I want to quit but I know it's a terrible idea. What can I do to continue learning and growing within team and business goals when these are not communicated properly? What could I be doing wrong? Am I needy or is this truly as annoying and disfunctional as I think it is?

Thanks for reaching this far, any opinions, experiences or recommendations are welcome. I can take criticism as long as it is respectful, my mental health is declining fast enough already 😋

Hi all!

I’m currently digging into the "toil" of our (the company i work at's) release process, and I’m hitting a recurring bottleneck: rate-limiting configuration.

Right now, we have our limits (e.g., token buckets, thresholds) defined as part of our static config, which is baked into our container images. Whenever we need to tune these for a traffic spike or emergency throttle, it forces a full CI/CD deployment aka build, push, wait for rollout, and pray the new pod doesn't have a startup issue.

It feels fundamentally wrong to bounce a production service just to change a numerical threshold.

I’m looking into moving this "knob-turning" out of the deployment pipeline and into a centralized, runtime-synced store (like Redis), so we can tweak values on the fly without a code push.

Is anyone else using a "Config-as-a-Service" or dynamic sidecar pattern for this, or have we missed a super obvious solution lol thanks guys :)

I am officially declaring the start (in my mind) of #MRBA

That stands for "Make Releases Boring Again"

This was prompted by a Release Engineer job posting that was your usual "just be on 24/7 on every communication channel during release windows". So every few months, you over activate my nervous system and it takes until the next release for it to finally calm down only to be activated again? No thanks.

I need to be doing automation, environment config hardening, observability tweaking. Not "monitoring Slack in case someone reports an issue". 😒

Releases need to be boring. The more boring, the more both dev AND ops sleep. With the added bonus of not over-rewarding heroics. 😏

Release day hype/fanfare/stress is for shit like clothing, games, etc. Not the newest feature for your internal app with 10 users.

We've had offline evals as part of our CI for a while now, but last month we got hit with something that none of our CI runs flagged. Our production inputs had drifted and users were asking things our test set just didn't cover, and output quality on that section of things had degraded for weeks. So unfortunately, our existing evals gave me a false sense of safety because they can only ever test what I thought to put in them.

So now I'm trying to figure out actually sampling and scoring real production responses, not just CI runs against a fixed dataset.

Main things I'm rubber ducking:

Sampling. Are people scoring all live traffic or some percentage?

Alerting. I want to know when quality drops on live traffic, but I’m not trying creat another annoying alert channel. And then if/when it goes off who/what owns the response?

I have 3 yrs of experience as a cloud engineer/devops worked in same company from start got one promotion and good hike all along . Want to switch to now and thinking on doing CKA certification is it worth having ?

Hey r/devops, welcome to our weekly self-promotion thread!

Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!

Everyone talks about moving to the cloud, but is it always the right choice?

For a small business with stable workloads (website, email, file storage, backups, internal apps), does buying a server once and running it for 5–7 years make more financial sense than paying cloud bills every month?

I'm asking because I'm building ComputeLabs (computelabs.in) and trying to decide on a long-term infrastructure strategy. If you were starting a small infrastructure for business today with a limited budget, what services would you offer that generate recurring monthly revenue?

I'd love to hear real experiences from people who run infrastructure or do businesses from home network not just theory or marketing.

I am a pentester. My manager had given me a task for cicd integration with checkmarx. I can understand the basic stuff but I am unable to come up with material for the following:

1. How do manage secrets in the pipeline (someone suggested me aws kms)
2. How to run authenticated scans (apps using okta) using pipeline
3. Capturing traffic to run the scans on them.

I would appreciate if someone can help me in this scenario as my job depends on it.

I am currently building a central "Cluster-as-a-Service" platform nd deal with automated cluster provisioning, multi-tenant setup, observability work, kubernetes security etc. I also contribute upstream to K8s-sigs. The company I work for is rather unknown and I would love to be at a bigger brand with a real engineering culture. (I have gotten a few faang interviews in the last month, but declined one myself and did not get more offers).

I now have an offer at a well-known fintech where I would work on owning CI/CD pipeline templates (GitHub Actions/Jenkins), and some more terraform templates plus policy work. Dev teams manage their own infra/CI-CD day-to-day, the team has no direct Kubernetes/Linux/scaling ownership and everything's serverless. However it is a well-known tech brand and I would get 35% more salary (which bumps my salary to slightly above market, not much tho).

My worry: My long-term goal is deep infra/platform roles (K8s internals, distributed systems, SRE-adjacent work). I'm concerned 1-2 years here erodes my skills in that area and I navigate myself into a build tooling and devex niche? What is your take on that move? Would I limit myself too much or can I easily move back to infra platform work later, i.e., would owning CI/CD/tooling be seen as equivalent experience to K8s internals, distributed systems, and observability work when I try to move back later?

I'm curious how teams are dealing with query performance over time as applications evolve.

A few questions I'd love to hear your experience on:

\- How do you identify queries that need to be rewritten?

\- How do you ensure schema changes (indexes, partitions, column changes, etc.) don't negatively impact production?

\- Is this mostly a manual process, or do you use any tools to analyze query patterns and recommend improvements?

\- Have you ever had an outage or major performance issue because a query or schema change wasn't optimized?

I'm exploring this space and trying to understand whether this is a pain point worth solving. I'd really appreciate hearing about your workflows, the tools you use, and what's still frustrating today.

Hi everyone,

I’m currently an SDET (exp 1 year, total exp 2 years) at a Tier 1 tech company and I’m planning my move into a platform engineer role. I love building tools and want to be closer to product development and feature ownership.

For those who have successfully made this pivot:

Did you find it easier to transfer internally or interview elsewhere?

How did you bridge the gap in System Design if your daily work was focused on automation frameworks?

What was the single most helpful thing you did to prove you were ready?

Appreciate any insights or "traps" to avoid!

I'm curious how experienced DevOps engineers got started with freelancing or part-time consulting.

I currently work full-time as a DevOps engineer and have experience with AWS, Kubernetes, Terraform, Docker, Linux, CI/CD, monitoring, and cloud infrastructure. I'm not looking for job offers here—I want to understand how people successfully transitioned into freelance work.

Some questions I have:

• How did you land your first client?
• Did you use Upwork, Toptal, LinkedIn, personal networking, or something else?
• What services were easiest to sell when starting out?
• Did you build a portfolio, blog, GitHub projects, or open-source contributions first?
• How did you decide your hourly rate?
• What mistakes should someone avoid when starting?

I'd really appreciate hearing about your experiences and what worked for you. Thanks!

Once I got past a couple of machines, SSH-ing into each to run

docker/kubectl/systemctl stopped scaling. Curious how others handle

it. one tool, a stitched-together stack, or just tmux and grit?

Where does your approach start to hurt?

I'm curious about where these roles are most popular and well compensated.

• Which countries offer the highest salaries for DevOps, SRE, and Forward Deployed Engineers?
• Where is the demand strongest?
• Are Forward Deployed Engineer roles mostly concentrated in the US, or are they common elsewhere as well?
• How do compensation and work-life balance compare across regions?

Would love to hear from people working in different countries and companies.

I often see many SRE and DevOps roles globally, but Forward Deployed Engineer positions seem much rarer. I'm wondering whether that's because they're concentrated in specific countries or mostly found in certain types of companies.

If possible, please mention:

• Country/region
• Role (DevOps, SRE, FDE, etc.)
• Years of experience
• Company type (startup, product company, consulting, FAANG, enterprise)
• Approximate salary range (if comfortable sharing)
• Work-life balance and on-call expectations

More details would help everyone understand the differences better. Thanks!

Best way to restrict AWS/Cloudflare app to specific desktops?

We are building a fee payment application for a school organization.

**Stack:** DB/Backend on AWS and frontend on Cloudflare.

**The challenge:** We need to restrict payment work flow used by cashiers to specific systems, while the read fees access should be able to be accessed from anywhere.

The desktops are unmanaged, regular PCs, residing in different branches in different cities. They are all connected via standard consumer ISPs (no static IPs, no company intranet).

As we are already using Cloudflare, is this something that can be achieved with Cloudflare Zero Trust free tier?

I have never worked with this restriction before, SO I am open to any suggestions. And as this is a very low budget project, I'm looking for something that costs as less as possible (Preferably free).

Hi, so I'm in my last year of university.I started my journey as a backend engineer, back in when I was in college.I always wanted to move to DevOps but didn't move because I thought I should have knowledge about the architecture and different concepts related to it like databases, networking,System design etc.After learning and practicing these concepts, I move towards learning famously used tools like docker, kubernetes,aws,terraform.

Now I want to do projects, not the ones where i build architecture on aws and post on LinkedIn.I want to do projects which teaches me real life job problems like how to handle deployments, where to look when things goes wrong,cost optimization etc.I believe that, these skills will make me standout as a DevOps engineer.

So I want to ask everyone how did you practice this DevOps stuff ??

Python / Bash scripting is enough right?

No need to focus on objected oriented code like a software dev ?