Какие решал DevOps задачи?

Какие DevOps задачи я решал

Хотя я в первую очередь Python developer, за 10+ лет работы я регулярно сталкивался с DevOps задачами. Расскажу о своем опыте и подходе.

1. Infrastructure as Code (IaC)

# Использовал Docker для контейнеризации приложений

# Dockerfile для Python приложения
"""
FROM python:3.11-slim

WORKDIR /app

COPY pyproject.toml poetry.lock ./
RUN pip install poetry && poetry install --no-dev

COPY . .

EXPOSE 8000
CMD ["uvicorn", "app:app", "--host", "0.0.0.0"]
"""

# docker-compose.yml для локальной разработки
"""
version: '3.9'

services:
  web:
    build: .
    ports:
      - "8000:8000"
    environment:
      - DATABASE_URL=postgresql://user:pass@db:5432/mydb
    depends_on:
      - db
  
  db:
    image: postgres:15
    environment:
      - POSTGRES_PASSWORD=password
      - POSTGRES_DB=mydb
    volumes:
      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:
"""

2. Continuous Integration / Continuous Deployment (CI/CD)

# GitHub Actions workflow

"""
name: CI/CD Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    
    steps:
      - uses: actions/checkout@v3
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: |
          pip install poetry
          poetry install
      
      - name: Run tests
        run: poetry run pytest --cov=app tests/
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost/test
      
      - name: Upload coverage
        uses: codecov/codecov-action@v3
      
      - name: Lint
        run: poetry run ruff check .
      
      - name: Type check
        run: poetry run mypy app/
  
  deploy:
    needs: test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v3
      
      - name: Deploy to production
        run: |
          curl -X POST https://api.dokku.example.com/deploy \
            -H "Authorization: Bearer ${{ secrets.DOKKU_TOKEN }}" \
            -d '{"branch": "main"}'
"""

3. Мониторинг и Логирование

# Настройка мониторинга на production

from prometheus_client import Counter, Histogram, Gauge
import logging

# Метрики
request_count = Counter(
    'http_requests_total',
    'Total HTTP requests',
    ['method', 'status']
)

response_time = Histogram(
    'http_request_duration_seconds',
    'HTTP request latency',
    buckets=(0.1, 0.5, 1.0, 2.0)
)

# Логирование в структурированном формате
logging.basicConfig(
    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
)

logger = logging.getLogger(__name__)
logger.setLevel(logging.INFO)

4. Database Migration и Backup

# Использовал Alembic для миграций (или Goose для raw SQL)

# Alembic миграция
"""
alembic revision --autogenerate -m "Add user email field"

alembic upgrade head  # Применить миграцию
alembic downgrade -1  # Откатить
"""

# Backup стратегия PostgreSQL
"""
#!/bin/bash
# backup.sh

BACKUP_DIR="/backups"
DB_NAME="mydb"
BACKUP_FILE="$BACKUP_DIR/backup-$(date +%Y%m%d-%H%M%S).sql"

pg_dump -U postgres $DB_NAME > $BACKUP_FILE
gzip $BACKUP_FILE

# Удалить старые backups (старше 30 дней)
find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete
"""

5. Kubernetes Deployment

# Kubernetes manifests для развертывания

# deployment.yaml
"""
apiVersion: apps/v1
kind: Deployment
metadata:
  name: python-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: python-app
  template:
    metadata:
      labels:
        app: python-app
    spec:
      containers:
      - name: app
        image: myregistry/python-app:latest
        ports:
        - containerPort: 8000
        env:
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              name: app-secrets
              key: database-url
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 8000
          initialDelaySeconds: 10
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready
            port: 8000
          initialDelaySeconds: 5
          periodSeconds: 5

---
apiVersion: v1
kind: Service
metadata:
  name: python-app
spec:
  selector:
    app: python-app
  ports:
  - protocol: TCP
    port: 80
    targetPort: 8000
  type: LoadBalancer
"""

6. Environment Configuration Management

# Управление переменными окружения

from pydantic import BaseSettings
import os

class Settings(BaseSettings):
    # Database
    database_url: str = os.getenv(
        'DATABASE_URL',
        'postgresql://localhost/mydb'
    )
    
    # API
    api_port: int = 8000
    debug: bool = False
    
    # Secrets
    secret_key: str = os.getenv('SECRET_KEY', 'dev-key')
    jwt_secret: str = os.getenv('JWT_SECRET')
    
    # External services
    redis_url: str = os.getenv('REDIS_URL', 'redis://localhost')
    slack_webhook: str = os.getenv('SLACK_WEBHOOK', '')
    
    class Config:
        env_file = '.env'
        env_file_encoding = 'utf-8'

settings = Settings()

# Использование
app = FastAPI(debug=settings.debug)

7. Scaling и Load Balancing

# Nginx configuration для load balancing

"""
upstream python_app {
    server app1:8000;
    server app2:8000;
    server app3:8000;
}

server {
    listen 80;
    server_name api.example.com;
    
    # Redirect HTTP to HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name api.example.com;
    
    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;
    
    location / {
        proxy_pass http://python_app;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
}
"""

8. Health Checks и Graceful Shutdown

from fastapi import FastAPI
from contextlib import asynccontextmanager
import asyncio

app = FastAPI()

# Health check endpoints
@app.get('/health')
async def health_check():
    """Используется load balancer'ом для проверки живо ли приложение"""
    return {'status': 'ok'}

@app.get('/ready')
async def readiness_check():
    """Проверяет готовность обрабатывать трафик"""
    # Проверяем БД подключение
    try:
        await db.execute('SELECT 1')
    except:
        return {'status': 'not_ready'}, 503
    
    return {'status': 'ready'}

# Graceful shutdown
@asynccontextmanager
async def lifespan(app: FastAPI):
    # Startup
    await init_db()
    print('App started')
    
    yield  # App running
    
    # Shutdown
    print('Shutting down...')
    await cleanup_db()
    print('Shutdown complete')

app = FastAPI(lifespan=lifespan)

9. Logging Aggregation и Centralized Logging

# Отправка логов в ELK Stack

from pythonjsonlogger import jsonlogger
import logging

# JSON логирование для Logstash
logger = logging.getLogger()
logger.setLevel(logging.INFO)

handler = logging.StreamHandler()
formatter = jsonlogger.JsonFormatter()
handler.setFormatter(formatter)
logger.addHandler(handler)

# Структурированные логи
logger.info('Request processed', extra={
    'user_id': 123,
    'endpoint': '/api/users',
    'status': 200,
    'duration_ms': 45,
    'timestamp': datetime.utcnow().isoformat()
})

10. Security и SSL/TLS

# SSL сертификаты с Let's Encrypt

"""
установка certbot:
sudo apt install certbot python3-certbot-nginx

получение сертификата:
sudo certbot certonly --nginx -d api.example.com

automated renewal (cron):
0 12 * * * /usr/bin/certbot renew --quiet
"""

# HSTS headers для безопасности
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=['https://example.com'],
    allow_credentials=True,
    allow_methods=['*'],
    allow_headers=['*'],
)

# Securely storing secrets
class SecretsManager:
    """Использую AWS Secrets Manager или Vault"""
    
    def get_secret(self, secret_name):
        # В production используем:
        # - AWS Secrets Manager
        # - HashiCorp Vault
        # - Kubernetes Secrets
        # - Azure Key Vault
        pass

11. Disaster Recovery и High Availability

# Multi-region deployment

"""
Архитектура HA:

Region 1 (Primary):
  - 3x Application servers
  - PostgreSQL Primary
  - Redis Master

Region 2 (Secondary):
  - 3x Application servers
  - PostgreSQL Replica (read-only)
  - Redis Replica

Глобальный Load Balancer распределяет трафик
"""

# Database replication
class DatabaseHA:
    def setup_replication(self):
        """
        PostgreSQL replication setup:
        
        Primary server:
        - wal_level = replica
        - max_wal_senders = 10
        - max_replication_slots = 10
        
        Replica server:
        - standby_mode = on
        - primary_conninfo = '...'
        """
        pass

12. Мой DevOps Чеклист

"""
Перед production deployment:

[ ] Docker image создан и протестирован
[ ] CI/CD pipeline зеленый (все тесты прошли)
[ ] Environment переменные сконфигурированы
[ ] Database миграции готовы
[ ] Backup стратегия в месте
[ ] Monitoring настроен (Prometheus, Grafana)
[ ] Логирование настроено
[ ] Health checks работают
[ ] Load balancer настроен
[ ] SSL сертификат установлен
[ ] Graceful shutdown реализован
[ ] Disaster recovery plan есть
[ ] Security audit пройден
[ ] Documentation обновлена
[ ] Rollback процедура протестирована
"""

Заключение

Хотя я backend developer, DevOps был необходимой частью работы:

• Понимание инфраструктуры помогает писать better код
• Сам могу задеплоить — не завису от ops
• Понимаю performance implications
• Могу отладить production issues

Мой подход: Automation First

• CI/CD вместо ручных deployments
• Infrastructure as Code вместо ручной конфигурации
• Monitoring вместо реактивного фиксинга
• Documentation вместо знаний в голове