ASP.NET Core DevOps & Production

Skill Overview

Production-grade DevOps skill for ASP.NET Core applications. Covers containerization, cloud deployment, CI/CD pipelines, and infrastructure as code with comprehensive observability.

DevOps Skills

Docker & Containerization

dockerfile_best_practices:
  multi_stage_builds:
    - Separate build and runtime stages
    - Minimize final image size
    - Use specific base image tags

  security:
    - Run as non-root user
    - Use distroless/alpine images
    - Scan for vulnerabilities
    - Read-only filesystem

  optimization:
    - Order layers by change frequency
    - Use .dockerignore
    - Leverage build cache
    - Multi-platform builds

docker_compose:
  use_cases:
    - Local development
    - Integration testing
    - Multi-container apps
  features:
    - Service dependencies
    - Volume mounts
    - Network isolation
    - Environment variables

container_security:
  practices:
    - Non-root user
    - Drop capabilities
    - Read-only rootfs
    - Security scanning
  tools:
    - Trivy
    - Snyk
    - Docker Scout

Azure Cloud Services

compute:
  app_service:
    tiers: [Basic, Standard, Premium, Isolated]
    features:
      - Auto-scaling
      - Deployment slots
      - Custom domains
      - SSL certificates
    best_for: Web apps, APIs

  container_apps:
    features:
      - Serverless containers
      - Auto-scaling
      - Dapr integration
      - Revision management
    best_for: Microservices

  aks:
    features:
      - Managed Kubernetes
      - Node pools
      - Azure CNI
      - AAD integration
    best_for: Complex workloads

data:
  sql_database:
    tiers: [Basic, Standard, Premium]
    features:
      - Geo-replication
      - Automatic backups
      - Elastic pools

  cosmos_db:
    apis: [SQL, MongoDB, Cassandra, Gremlin]
    features:
      - Global distribution
      - Multi-model
      - Automatic scaling

  redis_cache:
    tiers: [Basic, Standard, Premium]
    features:
      - Clustering
      - Geo-replication
      - Data persistence

security:
  key_vault:
    purpose: Secrets management
    features:
      - Access policies
      - Managed identity
      - Key rotation
      - Audit logging

  managed_identity:
    types: [System-assigned, User-assigned]
    benefits:
      - No credential management
      - Automatic rotation
      - Azure AD integration

CI/CD Pipelines

github_actions:
  workflow_structure:
    - Triggers (push, PR, schedule)
    - Jobs (build, test, deploy)
    - Steps (actions, scripts)
  features:
    - Matrix builds
    - Reusable workflows
    - Environment protection
    - OIDC authentication
    - Artifact management

azure_pipelines:
  structure:
    - Stages
    - Jobs
    - Steps
  features:
    - Multi-stage pipelines
    - Deployment groups
    - Variable groups
    - Service connections

deployment_strategies:
  blue_green:
    description: Deploy to inactive slot, swap
    benefits:
      - Zero downtime
      - Instant rollback
    azure: Deployment slots

  canary:
    description: Gradual traffic shift
    benefits:
      - Risk mitigation
      - Real user testing
    implementation: Traffic manager, Azure Front Door

  rolling:
    description: Update instances incrementally
    benefits:
      - No additional resources
      - Gradual rollout
    kubernetes: Rolling update strategy

quality_gates:
  - Unit tests pass
  - Code coverage threshold
  - Static analysis clean
  - Security scan pass
  - Performance benchmarks

Kubernetes Orchestration

core_concepts:
  pods:
    - Smallest deployable unit
    - Container grouping
    - Shared network/storage

  deployments:
    - Desired state management
    - Rolling updates
    - Rollback capability

  services:
    types:
      - ClusterIP (internal)
      - NodePort (node access)
      - LoadBalancer (external)

  ingress:
    controllers:
      - NGINX
      - Traefik
      - Azure Application Gateway
    features:
      - Path-based routing
      - TLS termination
      - Host-based routing

advanced_features:
  hpa:
    metrics:
      - CPU utilization
      - Memory utilization
      - Custom metrics
    behavior:
      - Scale up policies
      - Scale down policies
      - Stabilization windows

  pdb:
    purpose: Availability during updates
    settings:
      - minAvailable
      - maxUnavailable

  network_policies:
    purpose: Pod-to-pod traffic control
    types:
      - Ingress rules
      - Egress rules

helm:
  concepts:
    - Charts
    - Values
    - Templates
    - Releases
  best_practices:
    - Parameterize values
    - Use dependencies
    - Version charts

Infrastructure as Code

terraform:
  structure:
    - Providers
    - Resources
    - Variables
    - Outputs
    - Modules
  state_management:
    - Remote backend
    - State locking
    - Workspaces
  best_practices:
    - Modular design
    - Version pinning
    - Plan before apply

bicep:
  benefits:
    - Native Azure support
    - Type safety
    - Simpler syntax
  structure:
    - Parameters
    - Variables
    - Resources
    - Outputs
    - Modules

pulumi:
  benefits:
    - Use familiar languages (C#)
    - Type checking
    - IDE support
  structure:
    - Stacks
    - Resources
    - Outputs

Monitoring & Logging

observability_pillars:
  metrics:
    tools:
      - Application Insights
      - Prometheus
      - Azure Monitor
    types:
      - Request rate
      - Error rate
      - Latency (p50, p95, p99)
      - Resource utilization

  logs:
    structured_logging:
      - Serilog
      - NLog
    aggregation:
      - Azure Log Analytics
      - ELK Stack
      - Loki
    best_practices:
      - Correlation IDs
      - Log levels
      - Sensitive data masking

  traces:
    distributed_tracing:
      - OpenTelemetry
      - Application Insights
    features:
      - Request correlation
      - Dependency tracking
      - Performance profiling

health_checks:
  types:
    - Liveness (is alive?)
    - Readiness (can serve?)
    - Startup (initialized?)
  implementation:
    - /health/live
    - /health/ready
    - Custom health checks

alerting:
  strategies:
    - Error rate spikes
    - Latency thresholds
    - Resource exhaustion
    - SLO violations
  channels:
    - Email
    - Slack
    - PagerDuty
    - Azure Monitor

Code Examples

Production-Ready Dockerfile

# Build stage
FROM mcr.microsoft.com/dotnet/sdk:9.0-alpine AS build
WORKDIR /src

# Copy csproj and restore (cached layer)
COPY ["*.csproj", "./"]
RUN dotnet restore --runtime linux-musl-x64

# Copy source and build
COPY . .
RUN dotnet build -c Release --no-restore -o /app/build

# Test stage
FROM build AS test
RUN dotnet test --no-build -c Release \
    --logger "trx" \
    --results-directory /testresults

# Publish stage
FROM build AS publish
RUN dotnet publish -c Release -o /app/publish \
    --runtime linux-musl-x64 \
    --self-contained true \
    -p:PublishTrimmed=true \
    -p:PublishSingleFile=true

# Runtime stage - distroless equivalent
FROM mcr.microsoft.com/dotnet/runtime-deps:9.0-alpine AS final

# Security: Non-root user
RUN addgroup -g 1000 appgroup && \
    adduser -u 1000 -G appgroup -D appuser

WORKDIR /app

# Copy published app with correct ownership
COPY --from=publish --chown=appuser:appgroup /app/publish .

# Switch to non-root user
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD wget --quiet --tries=1 --spider http://localhost:8080/health || exit 1

# Expose port (non-privileged)
EXPOSE 8080
ENV ASPNETCORE_URLS=http://+:8080
ENV ASPNETCORE_ENVIRONMENT=Production

# Entry point
ENTRYPOINT ["./MyApp"]

GitHub Actions Complete Workflow

name: Build, Test, and Deploy

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write
  contents: read
  packages: write
  security-events: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  AZURE_WEBAPP_NAME: myapp

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      - name: Restore dependencies
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore -c Release

      - name: Test with coverage
        run: |
          dotnet test --no-build -c Release \
            --logger trx \
            --collect:"XPlat Code Coverage" \
            --results-directory ./TestResults

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          files: ./TestResults/**/coverage.cobertura.xml
          fail_ci_if_error: true

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-results
          path: ./TestResults

      - name: Generate version
        id: version
        run: |
          VERSION=$(date +'%Y%m%d').${{ github.run_number }}
          echo "version=$VERSION" >> $GITHUB_OUTPUT

  security-scan:
    runs-on: ubuntu-latest
    needs: build-and-test

    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  build-container:
    runs-on: ubuntu-latest
    needs: [build-and-test, security-scan]
    if: github.event_name != 'pull_request'

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ needs.build-and-test.outputs.version }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan container image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-test.outputs.version }}
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

  deploy-staging:
    runs-on: ubuntu-latest
    needs: [build-and-test, build-container]
    if: github.ref == 'refs/heads/main'
    environment: staging

    steps:
      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy to Staging
        uses: azure/webapps-deploy@v3
        with:
          app-name: ${{ env.AZURE_WEBAPP_NAME }}-staging
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-test.outputs.version }}

      - name: Smoke test
        run: |
          sleep 60
          curl --fail --retry 3 --retry-delay 10 \
            https://${{ env.AZURE_WEBAPP_NAME }}-staging.azurewebsites.net/health

  deploy-production:
    runs-on: ubuntu-latest
    needs: [build-and-test, deploy-staging]
    if: github.ref == 'refs/heads/main'
    environment: production

    steps:
      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy to Production Slot
        uses: azure/webapps-deploy@v3
        with:
          app-name: ${{ env.AZURE_WEBAPP_NAME }}
          slot-name: staging
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-test.outputs.version }}

      - name: Swap slots
        run: |
          az webapp deployment slot swap \
            --name ${{ env.AZURE_WEBAPP_NAME }} \
            --resource-group myResourceGroup \
            --slot staging \
            --target-slot production

      - name: Verify deployment
        run: |
          sleep 30
          curl --fail --retry 5 --retry-delay 10 \
            https://${{ env.AZURE_WEBAPP_NAME }}.azurewebsites.net/health

Kubernetes Production Manifests

---
apiVersion: v1
kind: Namespace
metadata:
  name: myapp
  labels:
    name: myapp

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: myapp-config
  namespace: myapp
data:
  ASPNETCORE_ENVIRONMENT: "Production"
  LOGGING__LOGLEVEL__DEFAULT: "Information"

---
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
  namespace: myapp
type: Opaque
stringData:
  ConnectionStrings__Default: "Server=xxx;Database=xxx;..."

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: myapp
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
    spec:
      serviceAccountName: myapp
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
      containers:
        - name: myapp
          image: ghcr.io/myorg/myapp:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
          envFrom:
            - configMapRef:
                name: myapp-config
            - secretRef:
                name: myapp-secrets
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health/live
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: myapp
spec:
  selector:
    app: myapp
  ports:
    - port: 80
      targetPort: 8080

---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp
  namespace: myapp
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 3
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: myapp
  namespace: myapp
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: myapp

Troubleshooting Guide

Common Issues

Debug Checklist

step_1_container:
  - docker build locally
  - docker run and test
  - Check Dockerfile syntax
  - Verify base image

step_2_kubernetes:
  - kubectl describe pod
  - kubectl logs pod
  - kubectl get events
  - Check resource limits

step_3_networking:
  - kubectl get svc
  - kubectl get endpoints
  - Test service connectivity
  - Check ingress config

step_4_deployment:
  - Check CI/CD logs
  - Verify secrets/configs
  - Test health endpoints
  - Monitor rollout status

Assessment Criteria

• Create optimized Docker images
• Deploy to cloud platforms
• Setup complete CI/CD pipelines
• Configure monitoring and alerts
• Manage secrets securely
• Implement auto-scaling
• Setup health checks
• Configure networking
• Implement disaster recovery
• Monitor application performance

References

• Docker Documentation
• Kubernetes Documentation
• Azure App Service
• GitHub Actions
• Terraform Azure Provider