ASP.NET Core DevOps & Production

Skill Overview

Production-grade DevOps skill for ASP.NET Core applications. Covers containerization, cloud deployment, CI/CD pipelines, and infrastructure as code with comprehensive observability.

DevOps Skills

Docker & Containerization

dockerfile_best_practices:
  multi_stage_builds:
    - Separate build and runtime stages
    - Minimize final image size
    - Use specific base image tags

  security:
    - Run as non-root user
    - Use distroless/alpine images
    - Scan for vulnerabilities
    - Read-only filesystem

  optimization:
    - Order layers by change frequency
    - Use .dockerignore
    - Leverage build cache
    - Multi-platform builds

docker_compose:
  use_cases:
    - Local development
    - Integration testing
    - Multi-container apps
  features:
    - Service dependencies
    - Volume mounts
    - Network isolation
    - Environment variables

container_security:
  practices:
    - Non-root user
    - Drop capabilities
    - Read-only rootfs
    - Security scanning
  tools:
    - Trivy
    - Snyk
    - Docker Scout

Azure Cloud Services

compute:
  app_service:
    tiers: [Basic, Standard, Premium, Isolated]
    features:
      - Auto-scaling
      - Deployment slots
      - Custom domains
      - SSL certificates
    best_for: Web apps, APIs

  container_apps:
    features:
      - Serverless containers
      - Auto-scaling
      - Dapr integration
      - Revision management
    best_for: Microservices

  aks:
    features:
      - Managed Kubernetes
      - Node pools
      - Azure CNI
      - AAD integration
    best_for: Complex workloads

data:
  sql_database:
    tiers: [Basic, Standard, Premium]
    features:
      - Geo-replication
      - Automatic backups
      - Elastic pools

  cosmos_db:
    apis: [SQL, MongoDB, Cassandra, Gremlin]
    features:
      - Global distribution
      - Multi-model
      - Automatic scaling

  redis_cache:
    tiers: [Basic, Standard, Premium]
    features:
      - Clustering
      - Geo-replication
      - Data persistence

security:
  key_vault:
    purpose: Secrets management
    features:
      - Access policies
      - Managed identity
      - Key rotation
      - Audit logging

  managed_identity:
    types: [System-assigned, User-assigned]
    benefits:
      - No credential management
      - Automatic rotation
      - Azure AD integration

CI/CD Pipelines

github_actions:
  workflow_structure:
    - Triggers (push, PR, schedule)
    - Jobs (build, test, deploy)
    - Steps (actions, scripts)
  features:
    - Matrix builds
    - Reusable workflows
    - Environment protection
    - OIDC authentication
    - Artifact management

azure_pipelines:
  structure:
    - Stages
    - Jobs
    - Steps
  features:
    - Multi-stage pipelines
    - Deployment groups
    - Variable groups
    - Service connections

deployment_strategies:
  blue_green:
    description: Deploy to inactive slot, swap
    benefits:
      - Zero downtime
      - Instant rollback
    azure: Deployment slots

  canary:
    description: Gradual traffic shift
    benefits:
      - Risk mitigation
      - Real user testing
    implementation: Traffic manager, Azure Front Door

  rolling:
    description: Update instances incrementally
    benefits:
      - No additional resources
      - Gradual rollout
    kubernetes: Rolling update strategy

quality_gates:
  - Unit tests pass
  - Code coverage threshold
  - Static analysis clean
  - Security scan pass
  - Performance benchmarks

Kubernetes Orchestration

core_concepts:
  pods:
    - Smallest deployable unit
    - Container grouping
    - Shared network/storage

  deployments:
    - Desired state management
    - Rolling updates
    - Rollback capability

  services:
    types:
      - ClusterIP (internal)
      - NodePort (node access)
      - LoadBalancer (external)

  ingress:
    controllers:
      - NGINX
      - Traefik
      - Azure Application Gateway
    features:
      - Path-based routing
      - TLS termination
      - Host-based routing

advanced_features:
  hpa:
    metrics:
      - CPU utilization
      - Memory utilization
      - Custom metrics
    behavior:
      - Scale up policies
      - Scale down policies
      - Stabilization windows

  pdb:
    purpose: Availability during updates
    settings:
      - minAvailable
      - maxUnavailable

  network_policies:
    purpose: Pod-to-pod traffic control
    types:
      - Ingress rules
      - Egress rules

helm:
  concepts:
    - Charts
    - Values
    - Templates
    - Releases
  best_practices:
    - Parameterize values
    - Use dependencies
    - Version charts

Infrastructure as Code

terraform:
  structure:
    - Providers
    - Resources
    - Variables
    - Outputs
    - Modules
  state_management:
    - Remote backend
    - State locking
    - Workspaces
  best_practices:
    - Modular design
    - Version pinning
    - Plan before apply

bicep:
  benefits:
    - Native Azure support
    - Type safety
    - Simpler syntax
  structure:
    - Parameters
    - Variables
    - Resources
    - Outputs
    - Modules

pulumi:
  benefits:
    - Use familiar languages (C#)
    - Type checking
    - IDE support
  structure:
    - Stacks
    - Resources
    - Outputs

Monitoring & Logging

observability_pillars:
  metrics:
    tools:
      - Application Insights
      - Prometheus
      - Azure Monitor
    types:
      - Request rate
      - Error rate
      - Latency (p50, p95, p99)
      - Resource utilization

  logs:
    structured_logging:
      - Serilog
      - NLog
    aggregation:
      - Azure Log Analytics
      - ELK Stack
      - Loki
    best_practices:
      - Correlation IDs
      - Log levels
      - Sensitive data masking

  traces:
    distributed_tracing:
      - OpenTelemetry
      - Application Insights
    features:
      - Request correlation
      - Dependency tracking
      - Performance profiling

health_checks:
  types:
    - Liveness (is alive?)
    - Readiness (can serve?)
    - Startup (initialized?)
  implementation:
    - /health/live
    - /health/ready
    - Custom health checks

alerting:
  strategies:
    - Error rate spikes
    - Latency thresholds
    - Resource exhaustion
    - SLO violations
  channels:
    - Email
    - Slack
    - PagerDuty
    - Azure Monitor

Code Examples

Production-Ready Dockerfile

# Build stage
FROM mcr.microsoft.com/dotnet/sdk:9.0-alpine AS build
WORKDIR /src

# Copy csproj and restore (cached layer)
COPY ["*.csproj", "./"]
RUN dotnet restore --runtime linux-musl-x64

# Copy source and build
COPY . .
RUN dotnet build -c Release --no-restore -o /app/build

# Test stage
FROM build AS test
RUN dotnet test --no-build -c Release \
    --logger "trx" \
    --results-directory /testresults

# Publish stage
FROM build AS publish
RUN dotnet publish -c Release -o /app/publish \
    --runtime linux-musl-x64 \
    --self-contained true \
    -p:PublishTrimmed=true \
    -p:PublishSingleFile=true

# Runtime stage - distroless equivalent
FROM mcr.microsoft.com/dotnet/runtime-deps:9.0-alpine AS final

# Security: Non-root user
RUN addgroup -g 1000 appgroup && \
    adduser -u 1000 -G appgroup -D appuser

WORKDIR /app

# Copy published app with correct ownership
COPY --from=publish --chown=appuser:appgroup /app/publish .

# Switch to non-root user
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD wget --quiet --tries=1 --spider http://localhost:8080/health || exit 1

# Expose port (non-privileged)
EXPOSE 8080
ENV ASPNETCORE_URLS=http://+:8080
ENV ASPNETCORE_ENVIRONMENT=Production

# Entry point
ENTRYPOINT ["./MyApp"]

GitHub Actions Complete Workflow

name: Build, Test, and Deploy

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write
  contents: read
  packages: write
  security-events: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  AZURE_WEBAPP_NAME: myapp

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'

      - name: Restore dependencies
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore -c Release

      - name: Test with coverage
        run: |
          dotnet test --no-build -c Release \
            --logger trx \
            --collect:"XPlat Code Coverage" \
            --results-directory ./TestResults

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          files: ./TestResults/**/coverage.cobertura.xml
          fail_ci_if_error: true

      - name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-results
          path: ./TestResults

      - name: Generate version
        id: version
        run: |
          VERSION=$(date +'%Y%m%d').${{ github.run_number }}
          echo "version=$VERSION" >> $GITHUB_OUTPUT

  security-scan:
    runs-on: ubuntu-latest
    needs: build-and-test

    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  build-container:
    runs-on: ubuntu-latest
    needs: [build-and-test, security-scan]
    if: github.event_name != 'pull_request'

    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ needs.build-and-test.outputs.version }}
            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}

      - name: Build and push
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan container image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-test.outputs.version }}
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

  deploy-staging:
    runs-on: ubuntu-latest
    needs: [build-and-test, build-container]
    if: github.ref == 'refs/heads/main'
    environment: staging

    steps:
      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy to Staging
        uses: azure/webapps-deploy@v3
        with:
          app-name: ${{ env.AZURE_WEBAPP_NAME }}-staging
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-test.outputs.version }}

      - name: Smoke test
        run: |
          sleep 60
          curl --fail --retry 3 --retry-delay 10 \
            https://${{ env.AZURE_WEBAPP_NAME }}-staging.azurewebsites.net/health

  deploy-production:
    runs-on: ubuntu-latest
    needs: [build-and-test, deploy-staging]
    if: github.ref == 'refs/heads/main'
    environment: production

    steps:
      - name: Azure Login (OIDC)
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Deploy to Production Slot
        uses: azure/webapps-deploy@v3
        with:
          app-name: ${{ env.AZURE_WEBAPP_NAME }}
          slot-name: staging
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-test.outputs.version }}

      - name: Swap slots
        run: |
          az webapp deployment slot swap \
            --name ${{ env.AZURE_WEBAPP_NAME }} \
            --resource-group myResourceGroup \
            --slot staging \
            --target-slot production

      - name: Verify deployment
        run: |
          sleep 30
          curl --fail --retry 5 --retry-delay 10 \
            https://${{ env.AZURE_WEBAPP_NAME }}.azurewebsites.net/health

Kubernetes Production Manifests

---
apiVersion: v1
kind: Namespace
metadata:
  name: myapp
  labels:
    name: myapp

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: myapp-config
  namespace: myapp
data:
  ASPNETCORE_ENVIRONMENT: "Production"
  LOGGING__LOGLEVEL__DEFAULT: "Information"

---
apiVersion: v1
kind: Secret
metadata:
  name: myapp-secrets
  namespace: myapp
type: Opaque
stringData:
  ConnectionStrings__Default: "Server=xxx;Database=xxx;..."

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: myapp
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8080"
    spec:
      serviceAccountName: myapp
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
      containers:
        - name: myapp
          image: ghcr.io/myorg/myapp:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
          envFrom:
            - configMapRef:
                name: myapp-config
            - secretRef:
                name: myapp-secrets
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 500m
              memory: 512Mi
          livenessProbe:
            httpGet:
              path: /health/live
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /health/ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: myapp
  namespace: myapp
spec:
  selector:
    app: myapp
  ports:
    - port: 80
      targetPort: 8080

---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: myapp
  namespace: myapp
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  minReplicas: 3
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70

---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: myapp
  namespace: myapp
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: myapp

Troubleshooting Guide

Common Issues

Issue	Symptoms	Resolution
Image Pull Error	ImagePullBackOff	Check registry auth, image tag
Pod CrashLoop	Continuous restarts	Check logs, liveness probe
OOMKilled	Pod terminated	Increase memory limits
Deployment Timeout	Stuck rollout	Check readiness probe
SSL/TLS Errors	Certificate issues	Verify cert-manager, secrets

Debug Checklist

step_1_container:
  - docker build locally
  - docker run and test
  - Check Dockerfile syntax
  - Verify base image

step_2_kubernetes:
  - kubectl describe pod
  - kubectl logs pod
  - kubectl get events
  - Check resource limits

step_3_networking:
  - kubectl get svc
  - kubectl get endpoints
  - Test service connectivity
  - Check ingress config

step_4_deployment:
  - Check CI/CD logs
  - Verify secrets/configs
  - Test health endpoints
  - Monitor rollout status

Assessment Criteria

• Create optimized Docker images
• Deploy to cloud platforms
• Setup complete CI/CD pipelines
• Configure monitoring and alerts
• Manage secrets securely
• Implement auto-scaling
• Setup health checks
• Configure networking
• Implement disaster recovery
• Monitor application performance

References

• Docker Documentation
• Kubernetes Documentation
• Azure App Service
• GitHub Actions
• Terraform Azure Provider