Deployment patterns and strategies for DevOps architects

Deployment Strategies
- Rolling: Update instances gradually, zero-downtime if health checks configured
- Blue/Green: Two identical environments, switch traffic. Instant rollback, full isolation
- Canary: Route small % of traffic to new version. Risk mitigation, gradual rollout
- Feature Flags: Deploy code behind flags, enable per-user/region. No deploy for rollout
- Recommendation: Blue/Green for critical services, Rolling for stateless workers

Container Orchestration (Kubernetes)
- Pod design: One container per concern, sidecar for logging/proxy
- Service mesh (Istio/Linkerd): Traffic management, observability, mTLS, circuit breaking
- Auto-scaling: HPA (CPU/memory), KEDA (event-driven), VPA (resource recommendations)
- Resource management: Requests (guaranteed), Limits (burst cap), QoS classes
- Storage: PersistentVolumeClaims for stateful workloads, configMaps/secrets for config

Infrastructure as Code
- Terraform for cloud resources, Helm for Kubernetes manifests
- State management: Remote state (S3/GCS) with locking (DynamoDB)
- GitOps (ArgoCD/Flux): Git as single source of truth, automated sync
- Policy as Code: OPA/Rego for compliance validation in CI/CD

Observability Stack
- Metrics (Prometheus): Counters, gauges, histograms for system health
- Logging (Loki/ELK): Structured logging, log levels, correlation IDs
- Tracing (Jaeger/Tempo): Distributed tracing for request flows
- Alerting: SLO-based alerting (burn rate), not static thresholds
- Dashboards: Four golden signals (latency, traffic, errors, saturation)

CI/CD Pipeline Design
- Stage 1: Lint + test (parallel, fast feedback, <5 min)
- Stage 2: Build + SAST scan (container scan, dependency check)
- Stage 3: Integration tests (staging environment, <15 min)
- Stage 4: Deploy to production (gated by approvals)
- Stage 5: Smoke tests + monitoring (automated rollback on failure)