DevOps & CI/CD

DevOps và Tích Hợp Liên Tục (CI/CD) 2026: Hướng Dẫn Toàn Diện, Best Practices & Xu Hướng

Từ CI/CD pipeline, GitOps, Infrastructure as Code đến Monitoring, Security — bài viết đầy đủ nhất giúp bạn nắm vững DevOps hiện đại

11/07/2026 30 phút đọc Võ Đào Huy Hoàng
Mục Lục
  1. DevOps là gì? — Triết lý & Culture
  2. CI/CD — Trái tim của DevOps
  3. Công Cụ CI/CD Phổ Biến 2026
  4. GitOps — Infrastructure as Code Nâng Cao
  5. Infrastructure as Code (IaC)
  6. Observability & Monitoring
  7. DevSecOps — Security Left-Shift
  8. Xu Hướng DevOps 2026
  9. Lộ Trình Học DevOps
  10. Kết Luận

1. DevOps là gì? — Triết lý & Culture

DevOps (Development + Operations) không chỉ là một bộ công cụ hay quy trình — đó là một văn hóa, một triết lý và một phương pháp làm việc hướng tới việc phá bỏ rào cản giữa team phát triển (Dev) và team vận hành (Ops). Năm 2026, DevOps đã trở thành tiêu chuẩn bắt buộc cho mọi tổ chức muốn phát triển phần mềm nhanh, an toàn và bền vững.

Triết lý cốt lõi của DevOps xoay quanh 3 trụ cột: People (Con người), Process (Quy trình), và Tools (Công cụ). Nhưng quan trọng hơn cả là Culture — văn hóa chia sẻ trách nhiệm, học hỏi liên tục từ thất bại, và tự động hóa mọi thứ có thể tự động hóa được.

CALMS Framework — Đánh giá tính trưởng thành DevOps

Mô hình CALMS (do Jez Humble đề xuất) là khuôn khổ phổ biến nhất để đánh giá mức độ áp dụng DevOps:

🌐
Culture
Văn hóa chia sẻ, blameless postmortem, psychological safety
→
⚙️
Automation
CI/CD, IaC, testing, deployment — tự động hóa hết sức có thể
→
📏
Lean
Value stream mapping, eliminate waste, small batches, flow
→
📊
Measurement
DORA metrics, SLI/SLO/SLA, business metrics
→
🤝
Sharing
Knowledge sharing, cross-training, community of practice
💡 DORA 4 Key Metrics (2026 benchmark):
  • Deployment Frequency: Elite = On-demand (multiple/day) 🚀
  • Lead Time for Changes: Elite = < 1 hour ⚡
  • Mean Time to Recovery (MTTR): Elite = < 1 hour 🔧
  • Change Failure Rate: Elite = 0-15% 🛡️

2. CI/CD — Trái tim của DevOps

CI/CD (Continuous Integration / Continuous Delivery/Deployment) là xương sống kỹ thuật của DevOps. Nó biến quy trình phát triển từ thủ công, chậm chạp, dễ sai sót thành quy trình tự động, nhanh chóng, đáng tin cậy.

Continuous Integration (CI) — Tích Hợp Liên Tục

CI là thực hành: developer commit code vào nhánh chính (main/trunk) ít nhất 1 lần/ngày, mỗi commit tự động trigger build + test. Mục tiêu: phát hiện lỗi sớm nhất có thể ("fail fast").

# CI Pipeline ví dụ (GitHub Actions) name: CI Pipeline on: push: branches: [main, develop] pull_request: branches: [main] jobs: build-and-test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: '20' cache: 'npm' - name: Install dependencies run: npm ci - name: Lint run: npm run lint - name: Unit Tests run: npm run test:unit -- --coverage - name: Integration Tests run: npm run test:integration - name: Build run: npm run build - name: Upload coverage uses: codecov/codecov-action@v4
🎯 CI Best Practices 2026:
  • ✅ Trunk-based development: Commit trực tiếp main, dùng short-lived feature branches (< 1 ngày)
  • ✅ Fast feedback: Pipeline < 10 phút (parallel test, cache, smart test selection)
  • ✅ Mandatory checks: Lint, type-check, unit test, integration test, security scan
  • ✅ Flaky test management: Quarantine, fix hoặc xóa test không ổn định
  • ✅ Dependency scanning: npm audit, Snyk, Dependabot tự động tạo PR update

Continuous Delivery vs Deployment (CD)

Sự khác biệt quan trọng:

Khía cạnh Continuous Delivery Continuous Deployment Định nghĩa Code luôn ở trạng thái sẵn sàng deploy Mọi thay đổi pass pipeline → tự động deploy production Human approval ✅ Cần approve thủ công ❌ Không cần (fully automated) Risk level 🟢 Thấp hơn 🔴 Cao hơn (cần test cực tốt) Phù hợp Enterprise, regulated, critical systems SaaS, consumer apps, high velocity teams Rollback Manual trigger Automated (health check fail → rollback)
⚠️ Điều kiện tiên quyết cho Continuous Deployment:
  • 🧪 Test coverage > 80% (unit + integration + e2e)
  • 📊 Observability đầy đủ: metrics, logs, traces, alerts
  • 🔄 Automated rollback capability
  • 🎭 Feature flags cho progressive delivery
  • 🤖 Chaos engineering thường xuyên

Pipeline Architecture — Kiến trúc Pipeline Hiện Đại

Pipeline 2026 không còn là linear stages đơn giản — nó là DAG (Directed Acyclic Graph) với parallelization, conditional execution, và dynamic pipelines.

📥
Source
Git push / PR / Schedule / Webhook
→
🔨
Build
Compile, lint, type-check, dependency install
→
🧪
Test
Unit → Integration → Contract → E2E (parallel)
→
🔒
Security
SAST, DAST, SCA, Secret scan, Container scan
→
📦
Package
Docker image, Helm chart, Artifact registry
→
🚀
Deploy
Staging → Canary → Blue/Green → Production
→
✅
Verify
Smoke test, Health check, Metrics validation
# GitHub Actions - Matrix strategy cho parallel testing jobs: test: strategy: matrix: os: [ubuntu-latest, windows-latest, macos-latest] node: ['18', '20', '22'] exclude: - os: windows-latest node: '18' runs-on: ${{ matrix.os }} steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: ${{ matrix.node }} - run: npm ci && npm test

3. Công Cụ CI/CD Phổ Biến 2026

Năm 2026, market CI/CD được chia thành 3 nhóm chính: SaaS (cloud-native), Self-hosted, và Hybrid. Lựa chọn phụ thuộc vào compliance, scale, và team size.

Bảng So Sánh CI/CD Tools 2026

Tool Loại Free Tier YAML Config Docker Support GitOps Native Best For
GitHub Actions SaaS ✅ 2000 min/tháng ✅ Native ✅ First-class Via Actions 🏆 GitHub repos, OSS, SMB
GitLab CI/CD SaaS/Self-hosted ✅ 400 min/tháng ✅ .gitlab-ci.yml ✅ Built-in registry ✅ Native Enterprise, all-in-one platform
Jenkins Self-hosted ✅ Free (open source) ❌ Jenkinsfile (Groovy) ✅ Via plugins ❌ Plugin needed Legacy, complex customization
CircleCI SaaS ✅ 30000 credits ✅ config.yml ✅ Docker executor ❌ Limited High performance, macOS builds
Buildkite Hybrid ✅ Free for OSS ✅ pipeline.yml ✅ Agent-based ❌ Manual Scale, security, self-hosted agents
Woodpecker CI Self-hosted ✅ Completely free ✅ .woodpecker.yml ✅ Native ❌ No Lightweight, Drone fork, Gitea
Tekton K8s-native ✅ CNCF project ✅ CRD (YAML) ✅ Native K8s ✅ ArgoCD integration Kubernetes-native pipelines

GitHub Actions Deep Dive — King of CI/CD 2026

GitHub Actions thống trị market share (~45% 2026) nhờ tích hợp sâu với GitHub, marketplace khổng lồ (>15,000 actions), và pricing hợp lý.

# .github/workflows/ci-cd.yml — Production-ready pipeline name: CI/CD Production on: push: branches: [main] tags: ['v*'] pull_request: branches: [main] workflow_dispatch: inputs: environment: type: choice options: [staging, production] default: staging env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} jobs: # ===== CI STAGE ===== ci: uses: ./.github/workflows/reusable-ci.yml secrets: inherit # ===== SECURITY SCAN ===== security: needs: ci runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: scan-type: 'fs' scan-ref: '.' format: 'sarif' output: 'trivy-results.sarif' - name: Upload Trivy results to GitHub Security uses: github/codeql-action/upload-sarif@v3 with: sarif_file: 'trivy-results.sarif' - name: Secret scan (GitLeaks) uses: gitleaks/gitleaks-action@v2 # ===== BUILD & PUSH IMAGE ===== build: needs: [ci, security] runs-on: ubuntu-latest permissions: contents: read packages: write attestations: write id-token: write steps: - uses: actions/checkout@v4 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 - name: Log in to Container Registry uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract metadata id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=ref,event=branch type=ref,event=pr type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=sha - name: Build and push uses: docker/build-push-action@v5 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max provenance: true sbom: true # ===== DEPLOY STAGING ===== deploy-staging: needs: build if: github.ref == 'refs/heads/main' uses: ./.github/workflows/reusable-deploy.yml with: environment: staging image: ${{ needs.build.outputs.image }} secrets: inherit # ===== DEPLOY PRODUCTION (manual approval) ===== deploy-production: needs: deploy-staging if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v') environment: production uses: ./.github/workflows/reusable-deploy.yml with: environment: production image: ${{ needs.build.outputs.image }} secrets: inherit
💡 GitHub Actions Pro Tips 2026:
  • 🔄 Reusable workflows: DRY với uses: ./.github/workflows/...
  • ⚡ Action caching: actions/cache + docker layer caching = 50-70% faster builds
  • 🏷️ Semantic versioning tags: Tự động tag major.minor.patch từ commit message
  • 🔐 OIDC + Cloud provider: Không cần long-lived secrets (AWS/GCP/Azure)
  • 📦 Artifact attestation: SLSA Level 3 provenance, SBOM generation

GitLab CI/CD — All-in-One Platform

GitLab mạnh ở integrated platform: SCM + CI/CD + Registry + Security + Deploy + Monitoring trong 1 tool. Phù hợp enterprise cần compliance, air-gapped, self-hosted.

# .gitlab-ci.yml — GitLab CI/CD với DAG (needs:) stages: - validate - test - security - build - deploy variables: DOCKER_DRIVER: overlay2 DOCKER_TLS_CERTDIR: "/certs" # ===== VALIDATE ===== lint: stage: validate image: node:20-alpine script: - npm ci - npm run lint rules: - if: $CI_PIPELINE_SOURCE == "merge_request_event" - if: $CI_COMMIT_BRANCH == "main" # ===== TEST (PARALLEL) ===== unit-test: stage: test image: node:20-alpine script: - npm ci - npm run test:unit -- --coverage coverage: '/Lines\s*:\s*(\d+\.\d+%)/' artifacts: reports: coverage_report: coverage_format: cobertura path: coverage/cobertura-coverage.xml integration-test: stage: test image: node:20-alpine services: - name: postgres:16-alpine alias: db variables: DATABASE_URL: postgres://test:test@db:5432/test script: - npm ci - npm run test:integration # ===== SECURITY ===== sast: stage: security include: - template: Security/SAST.gitlab-ci.yml dependency-scan: stage: security include: - template: Security/Dependency-Scanning.gitlab-ci.yml container-scan: stage: security include: - template: Security/Container-Scanning.gitlab-ci.yml # ===== BUILD ===== build-image: stage: build image: docker:24-cli services: - docker:24-dind script: - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA . - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA rules: - if: $CI_COMMIT_BRANCH == "main" - if: $CI_COMMIT_TAG # ===== DEPLOY (DAG with needs:) ===== deploy-staging: stage: deploy needs: [build-image] environment: name: staging url: https://staging.example.com script: - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n staging - kubectl rollout status deployment/app -n staging --timeout=300s rules: - if: $CI_COMMIT_BRANCH == "main" deploy-production: stage: deploy needs: [deploy-staging] environment: name: production url: https://example.com when: manual script: - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -n production - kubectl rollout status deployment/app -n production --timeout=300s rules: - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/

4. GitOps — Infrastructure as Code Nâng Cao

GitOps (do Weaveworks đề xuất 2017) là mô hình vận hành infrastructure và applications dùng Git làm single source of truth. Năm 2026, GitOps trở thành standard cho Kubernetes production.

4 nguyên tắc GitOps:

  1. Declarative: Hệ thống được mô tả declarative (YAML/Helm/Kustomize)
  2. Versioned & Immutable: Git repo lưu desired state, history đầy đủ, audit trail
  3. Pulled Automatically: Agent trong cluster tự pull & apply (không push từ CI)
  4. Continuously Reconciled: Controller liên tục so sánh actual vs desired, auto-remediate drift
👨‍💻
Developer
Git commit → PR → Merge
→
📦
Git Repo
Source of Truth
(Infra + App manifests)
⬇
🤖
GitOps Agent
ArgoCD / Flux
(runs INSIDE cluster)
⬇
☸️
Kubernetes Cluster
Actual State = Desired State
Auto-reconcile drift

ArgoCD & Flux — 2 Tools GitOps Hàng Đầu

Feature ArgoCD Flux v2 Architecture Controller + RepoServer + Dex Controllers (source, kustomize, helm, notification) UI ✅ Rich UI, visual diff, RBAC ❌ CLI-first, Weave GitOps UI (paid) Multi-tenancy ✅ AppProject, RBAC ✅ Tenant controllers Helm/Kustomize ✅ Native support ✅ Native controllers Progressive Delivery ✅ Argo Rollouts integration ✅ Flagger integration Policy/Admission ✅ OPA Gatekeeper, Kyverno ✅ Same Best For Teams cần UI, visual debugging GitOps purists, CNCF, GitLab native

GitOps Workflow Thực Tế

# ArgoCD Application — App of Apps Pattern apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: production-root namespace: argocd finalizers: - resources-finalizer.argocd.argoproj.io spec: project: production source: repoURL: https://github.com/myorg/infra-gitops path: environments/production targetRevision: main destination: server: https://kubernetes.default.svc namespace: argocd syncPolicy: automated: prune: true selfHeal: true allowEmpty: false syncOptions: - CreateNamespace=true - PrunePropagationPolicy=foreground - PruneLast=true retry: limit: 5 backoff: duration: 5s factor: 2 maxDuration: 3m ignoreDifferences: - group: apps kind: Deployment jsonPointers: - /spec/replicas --- # environments/production/argocd-apps.yaml (App of Apps) apiVersion: argoproj.io/v1alpha1 kind: ApplicationSet metadata: name: production-microservices namespace: argocd spec: generators: - git: repoURL: https://github.com/myorg/infra-gitops revision: main directories: - path: environments/production/services/* template: metadata: name: '{{path.basename}}' spec: project: production source: repoURL: https://github.com/myorg/infra-gitops path: '{{path}}' targetRevision: main destination: server: https://kubernetes.default.svc namespace: '{{path.basename}}' syncPolicy: automated: prune: true selfHeal: true
🎯 GitOps Benefits 2026:
  • 📝 Audit trail đầy đủ: Ai, khi nào, thay đổi gì — tất cả trong Git history
  • 🔄 Rollback = git revert: 30 giây quay lại version trước, zero config drift
  • 🔒 Security: Không cần cấp quyền kubectl cho developer, chỉ cần write access Git repo
  • 🛡️ Drift detection: ArgoCD/Flux liên tục reconcile, auto-heal hoặc alert khi drift
  • 🌳 Multi-cluster: Quản lý hàng chục cluster từ 1 Git repo (App of Apps)

5. Infrastructure as Code (IaC) — Quản Lý Infra Bằng Code

IaC biến infrastructure (servers, networks, databases, LB, DNS, IAM...) thành code có thể version, review, test, và deploy tự động. Năm 2026, IaC không còn optional — nó là mandatory cho production.

Terraform & OpenTofu — Declarative IaC King

Terraform (HashiCorp) vẫn là #1 market share (~60%). Tuy nhiên, license change 2023 (BUSL) dẫn đến OpenTofu (fork CNCF, MPL-2.0) nhanh chóng trở thành alternative phổ biến, compatible 100% với Terraform 1.5.x.

# main.tf — Terraform/OpenTofu AWS EKS Cluster terraform { required_version = ">= 1.6" required_providers { aws = { source = "hashicorp/aws" version = "~> 5.0" } kubernetes = { source = "hashicorp/kubernetes" version = "~> 2.23" } helm = { source = "hashicorp/helm" version = "~> 2.10" } } backend "s3" { bucket = "myorg-terraform-state" key = "eks/production/terraform.tfstate" region = "ap-southeast-1" encrypt = true dynamodb_table = "terraform-locks" } } provider "aws" { region = var.aws_region default_tags { tags = { Environment = var.environment ManagedBy = "terraform" Repository = "github.com/myorg/infra" } } } # VPC with public/private subnets across 3 AZs module "vpc" { source = "terraform-aws-modules/vpc/aws" version = "~> 5.0" name = "${var.environment}-vpc" cidr_block = "10.0.0.0/16" azs = ["ap-southeast-1a", "ap-southeast-1b", "ap-southeast-1c"] private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"] enable_nat_gateway = true single_nat_gateway = var.environment != "production" enable_dns_hostnames = true enable_dns_support = true } # EKS Cluster module "eks" { source = "terraform-aws-modules/eks/aws" version = "~> 19.0" cluster_name = "${var.environment}-eks" cluster_version = "1.28" vpc_id = module.vpc.vpc_id subnet_ids = module.vpc.private_subnets eks_managed_node_groups = { general = { name = "general" instance_types = ["m6i.xlarge"] capacity_type = "ON_DEMAND" min_size = 3 max_size = 20 desired_size = 5 } spot = { name = "spot" instance_types = ["m6i.xlarge", "m5.xlarge", "m5a.xlarge"] capacity_type = "SPOT" min_size = 0 max_size = 50 desired_size = 10 } } } # Helm releases via Terraform resource "helm_release" "aws_load_balancer_controller" { name = "aws-load-balancer-controller" repository = "https://aws.github.io/eks-charts" chart = "aws-load-balancer-controller" namespace = "kube-system" version = "1.6.2" set { name = "clusterName" value = module.eks.cluster_name } set { name = "serviceAccount.create" value = "false" } set { name = "serviceAccount.name" value = "aws-load-balancer-controller" } }
💡 Terraform/OpenTofu Best Practices 2026:
  • 📦 Modules: Dùng module registry (terraform-aws-modules, cloudposse) — đừng viết từ đầu
  • 🔒 State backend: S3 + DynamoDB locking, encryption, versioning
  • 🌿 Workspaces/Environments: Separate state per env (dev/staging/prod)
  • 🧪 Testing: Terratest (Go), kitchen-terraform, checkov (policy as code)
  • 📝 Documentation: terraform-docs auto-generate README từ variables/outputs
  • 🔄 CI/CD: Plan trong PR, Apply sau merge (manual approval cho prod)

Pulumi & Crossplane — IaC Dùng Ngôn Ngữ Thực & K8s-Native

Pulumi cho phép viết IaC bằng TypeScript, Python, Go, C#, Java — tận dụng full power của programming language (loops, functions, classes, package manager). Crossplane biến Kubernetes thành control plane cho cloud resources (CRD cho RDS, S3, VPC...).

# Pulumi TypeScript — AWS EKS Cluster import * as pulumi from "@pulumi/pulumi"; import * as aws from "@pulumi/aws"; import * as eks from "@pulumi/eks"; import * as k8s from "@pulumi/kubernetes"; const config = new pulumi.Config(); const environment = config.get("environment") || "dev"; const region = config.get("aws:region") || "ap-southeast-1"; // VPC with 3 AZs const vpc = new aws.ec2.Vpc("main", { cidrBlock: "10.0.0.0/16", enableDnsHostnames: true, enableDnsSupport: true, tags: { Name: `${environment}-vpc`, Environment: environment }, }); const privateSubnets = ["ap-southeast-1a", "ap-southeast-1b", "ap-southeast-1c"] .map((az, i) => new aws.ec2.Subnet(`private-${az}`, { vpcId: vpc.id, cidrBlock: `10.0.${i + 1}.0/24`, availabilityZone: az, tags: { Name: `${environment}-private-${az}`, Type: "private" }, })); // EKS Cluster với Pulumi EKS package (high-level abstraction) const cluster = new eks.Cluster(`${environment}-eks`, { name: `${environment}-eks`, version: "1.28", vpcId: vpc.id, privateSubnetIds: privateSubnets.map(s => s.id), instanceType: "m6i.xlarge", desiredCapacity: 5, minSize: 3, maxSize: 20, nodeGroupOptions: { spotInstanceTypes: ["m6i.xlarge", "m5.xlarge"], spotDesiredCapacity: 10, spotMinSize: 0, spotMaxSize: 50, }, tags: { Environment: environment, ManagedBy: "pulumi" }, }); // Export kubeconfig export const kubeconfig = cluster.kubeconfig; export const clusterName = cluster.eksCluster.name; // Deploy Helm chart (AWS Load Balancer Controller) const albController = new k8s.helm.v3.Chart("aws-load-balancer-controller", { chart: "aws-load-balancer-controller", version: "1.6.2", namespace: "kube-system", fetchOpts: { repo: "https://aws.github.io/eks-charts" }, values: { clusterName: cluster.eksCluster.name, serviceAccount: { create: false, name: "aws-load-balancer-controller" }, }, }, { provider: cluster.provider });
Khía cạnh Terraform/OpenTofu Pulumi Crossplane Language HCL (DSL) TypeScript, Python, Go, C#, Java Kubernetes YAML (CRD) State Management Remote backend (S3, Consul...) Pulumi Service / Self-hosted Kubernetes etcd (GitOps native) Testing Terratest, kitchen-terraform Native unit test (Jest, pytest, go test) K8s integration test Drift Detection terraform plan pulumi preview / refresh Continuous reconciliation Learning Curve 🟢 Thấp (HCL đơn giản) 🟡 Trung bình (cần biết PL) 🔴 Cao (cần am hiểu K8s) Best For Multi-cloud, team lớn, compliance Dev-heavy teams, complex logic GitOps purists, K8s-native orgs

6. Observability & Monitoring — Nhìn Thấu Hệ Thống

Observability ≠ Monitoring. Monitoring = "biết hệ thống có bị down không". Observability = "hiểu tại sao hệ thống bị down và debug thế nào". 3 trụ cột: Metrics, Logs, Traces + Profiles (continuous profiling).

Prometheus + Grafana Stack — Golden Standard

📈
Prometheus
TSDB, PromQL, Service Discovery, Alerting
←
🎯
Exporters
Node, kube-state, cadvisor, postgres, redis...
→
🚨
Alertmanager
Deduplication, grouping, inhibition, routing
→
📊
Grafana
Dashboards, Explore, Alerting UI, Plugins
→
📝
Loki
Log aggregation (labels-based, cheap)
→
🔍
Tempo
Distributed tracing (object storage)
→
⚡
Pyroscope
Continuous profiling (CPU, memory, goroutine)
# PrometheusRule — Alerting Rules cho Production apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: name: application-alerts namespace: monitoring labels: prometheus: k8s role: alert-rules spec: groups: - name: application.rules rules: - alert: HighErrorRate expr: | sum(rate(http_requests_total{status=~"5.."}[5m])) by (service, namespace) / sum(rate(http_requests_total[5m])) by (service, namespace) > 0.05 for: 2m labels: severity: critical team: backend annotations: summary: "High error rate on {{ $labels.service }}" description: "{{ $value | humanizePercentage }} of requests returning 5xx" runbook_url: "https://runbooks.myorg.com/high-error-rate" - alert: HighLatencyP99 expr: | histogram_quantile(0.99, sum(rate(http_request_duration_seconds_bucket[5m])) by (le, service, namespace) ) > 1 for: 5m labels: severity: warning annotations: summary: "High P99 latency on {{ $labels.service }}" description: "P99 latency is {{ $value }}s" - alert: PodCrashLooping expr: | rate(kube_pod_container_status_restarts_total[15m]) > 0 for: 5m labels: severity: critical annotations: summary: "Pod {{ $labels.pod }} crash looping" description: "Container {{ $labels.container }} restarted {{ $value }} times/min" - alert: DiskSpaceCritical expr: | (node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"}) < 0.1 for: 10m labels: severity: critical annotations: summary: "Disk space critical on {{ $labels.instance }}" description: "Only {{ $value | humanizePercentage }} disk space remaining"
💡 Observability Best Practices 2026:
  • 🎯 SLI/SLO/SLA: Define SLO (availability 99.9%, latency P99 < 500ms), error budget alerts
  • 🔗 Correlation: Link metrics → logs → traces (exemplars, trace IDs in logs)
  • 💰 Cost control: Recording rules, downsampling, retention policies (hot/warm/cold)
  • 🤖 AI-assisted: K8sGPT, Grafana ML, anomaly detection (seasonal, residual)
  • 📱 On-call: PagerDuty/Opsgenie integration, runbook links, auto-escalation

OpenTelemetry — Vendor-Neutral Observability

OpenTelemetry (OTel) là standard CNCF cho instrumentation. Năm 2026, OTel là default cho mọi language (auto-instrumentation Java, .NET, Node, Python, Go). 1 instrument → export đến bất kỳ backend nào (Prometheus, Datadog, New Relic, Jaeger, Tempo...).

# OpenTelemetry Collector Config — Gateway Pattern receivers: otlp: protocols: grpc: endpoint: 0.0.0.0:4317 http: endpoint: 0.0.0.0:4318 prometheus: config: scrape_configs: - job_name: 'kubernetes-pods' kubernetes_sd_configs: - role: pod relabel_configs: - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape] action: keep regex: true processors: batch: timeout: 10s send_batch_size: 1024 memory_limiter: check_interval: 1s limit_mib: 1500 spike_limit_mib: 512 attributes: actions: - key: k8s.namespace.name action: insert value: ${K8S_NAMESPACE} - key: deployment.environment action: insert value: production tail_sampling: decision_wait: 30s num_traces: 50000 expected_new_traces_per_sec: 1000 policy: - name: errors type: status_code status_code: { status_codes: [ERROR] } - name: slow type: latency latency: { threshold_ms: 500 } - name: probabilistic type: probabilistic probabilistic: { sampling_percentage: 10 } exporters: prometheusremotewrite: endpoint: https://prometheus.myorg.com/api/v1/write tls: insecure: false loki: endpoint: https://loki.myorg.com/loki/api/v1/push tempo: endpoint: tempo.myorg.com:4317 tls: insecure: false service: pipelines: metrics: receivers: [otlp, prometheus] processors: [batch, memory_limiter, attributes] exporters: [prometheusremotewrite] logs: receivers: [otlp] processors: [batch, memory_limiter, attributes] exporters: [loki] traces: receivers: [otlp] processors: [batch, memory_limiter, tail_sampling, attributes] exporters: [tempo]

7. DevSecOps — Security Left-Shift

DevSecOps = tích hợp security vào mọi stage của SDLC (Software Development Life Cycle), không phải bolt-on ở cuối. Năm 2026: "Security is everyone's responsibility", shift-left, automation-first.

SAST / DAST / SCA / Container Scan — 4 Chân Vị Security Testing

Loại Tên đầy đủ Khi nào chạy Quét gì Tools phổ biến 2026 SAST Static Application Security Testing CI (pre-commit, PR, merge) Source code, bytecode, IaC Semgrep, CodeQL, SonarQube, Checkmarx DAST Dynamic Application Security Testing Staging/Pre-prod (running app) Running app (API, UI, auth) OWASP ZAP, Burp Suite, Nuclei SCA Software Composition Analysis CI (dependency change), Scheduled 3rd party deps (CVE, license) Dependabot, Renovate, Snyk, Trivy, Grype Container Scan Container Image Vulnerability Scan CI (post-build), Registry (scheduled) Base image, OS packages, app deps Trivy, Grype, Syft, Docker Scout, Clair
# GitHub Actions - Comprehensive Security Pipeline name: Security Scanning on: push: branches: [main] pull_request: schedule: - cron: '0 2 * * 1' # Weekly full scan jobs: sast-semgrep: name: SAST (Semgrep) runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: returntocorp/semgrep-action@v1 with: config: >- p/ci p/secrets p/owasp-top-ten p/security-audit generate-sarif: true - name: Upload SARIF uses: github/codeql-action/upload-sarif@v3 with: sarif_file: semgrep.sarif sast-codeql: name: SAST (CodeQL) runs-on: ubuntu-latest permissions: security-events: write steps: - uses: actions/checkout@v4 - uses: github/codeql-action/init@v3 with: languages: javascript,typescript,python,go - uses: github/codeql-action/analyze@v3 sca-dependency: name: SCA (Trivy + Dependabot) runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Run Trivy (fs scan for vulns + licenses) uses: aquasecurity/trivy-action@master with: scan-type: 'fs' format: 'sarif' output: 'trivy-fs.sarif' severity: 'CRITICAL,HIGH' - uses: github/codeql-action/upload-sarif@v3 with: sarif_file: trivy-fs.sarif container-scan: name: Container Scan (Trivy) needs: [build] # assumes build job pushes image runs-on: ubuntu-latest steps: - name: Scan image uses: aquasecurity/trivy-action@master with: image-ref: 'ghcr.io/myorg/myapp:${{ github.sha }}' format: 'sarif' output: 'trivy-image.sarif' severity: 'CRITICAL,HIGH' exit-code: '1' # fail on critical/high - uses: github/codeql-action/upload-sarif@v3 with: sarif_file: trivy-image.sarif dast-zap: name: DAST (OWASP ZAP) if: github.event_name == 'pull_request' runs-on: ubuntu-latest services: zap: image: owasp/zap2docker-stable:2.14.0 options: -u root -p 8080:8080 steps: - name: ZAP Baseline Scan uses: zaproxy/action-baseline@v0.12.0 with: target: 'https://staging.myapp.com' fail_action: true issue_threshold: 'WARNING'

Policy as Code — OPA Gatekeeper & Kyverno

Policy as Code = codify security/compliance policies (ReGo cho OPA, YAML cho Kyverno) và enforce tại admission control (K8s) hoặc CI pipeline. Không còn manual checklist.

# Kyverno Policy - Require resource limits, non-root, read-only rootfs apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: pod-security-standards annotations: policies.kyverno.io/title: Pod Security Standards policies.kyverno.io/category: Pod Security policies.kyverno.io/severity: critical spec: validationFailureAction: Enforce background: true rules: - name: require-resource-limits match: any: - resources: kinds: [Pod] validate: message: "CPU and memory limits are required" pattern: spec: containers: - resources: limits: cpu: "?*" memory: "?*" - name: require-non-root match: any: - resources: kinds: [Pod] validate: message: "Containers must not run as root" pattern: spec: securityContext: runAsNonRoot: true containers: - securityContext: runAsNonRoot: true allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - "ALL" - name: restrict-host-namespaces match: any: - resources: kinds: [Pod] validate: message: "Host namespaces (pid, network, ipc) are not allowed" deny: conditions: - all: - key: "{{ request.object.spec.hostPID }}" operator: Equals value: true - key: "{{ request.object.spec.hostNetwork }}" operator: Equals value: true - key: "{{ request.object.spec.hostIPC }}" operator: Equals value: true - name: require-latest-image-tag match: any: - resources: kinds: [Deployment, StatefulSet, DaemonSet, Job, CronJob] validate: message: "Image tag 'latest' is not allowed. Use semantic versioning." deny: conditions: - all: - key: "{{ request.object.spec.template.spec.containers[*].image }}" operator: MatchesRegex value: ".*:latest$"
🎯 DevSecOps Maturity Model 2026:
  • 🟢 Level 1: SAST/SCA in CI, dependabot/renovate auto-PR
  • 🟡 Level 2: Container scan, DAST in staging, secret scanning
  • 🟠 Level 3: Policy as Code (OPA/Kyverno), admission control, SBOM generation
  • 🔴 Level 4: Runtime security (Falco, Tetragon), eBPF-based threat detection
  • 🟣 Level 5: AI-assisted remediation, auto-fix PRs, predictive vulnerability mgmt

9. Lộ Trình Học DevOps 2026 — Từ Zero đến Senior

DevOps rộng khủng khiếp. Đừng cố học hết cùng lúc. Lộ trình tối ưu (≈ 6-12 tháng tùy background):

  1. 🌱 Giai đoạn 1: Foundation (4-6 tuần)
    • Linux CLI, shell scripting (bash/zsh), SSH, systemd
    • Networking: DNS, HTTP/HTTPS, TLS, Load Balancer, TCP/IP, CIDR, VPC
    • Git: branching strategy (GitFlow, Trunk-based), rebase, cherry-pick, bisect
    • Docker: Dockerfile best practices, multi-stage build, compose, networking, volumes
  2. 🐳 Giai đoạn 2: Container Orchestration (4-6 tuần)
    • Docker Swarm: 1 tuần (hiểu orchestration basics)
    • Kubernetes: 3-5 tuần (CKA-level: Pod, Deployment, Service, Ingress, ConfigMap, Secret, PV/PVC, StatefulSet, HPA, RBAC, Helm, Operators)
    • Hands-on: Minikube → Kind → EKS/GKE/AKS cluster thật
  3. ⚙️ Giai đoạn 3: CI/CD & Automation (4-6 tuần)
    • GitHub Actions / GitLab CI: từ basic đến advanced (matrix, reusable, OIDC, self-hosted runners)
    • Pipeline patterns: monorepo, multi-env, progressive delivery, feature flags
    • Testing pyramid: unit → integration → contract → e2e → chaos engineering
  4. 🏗️ Giai đoạn 4: Infrastructure as Code (3-4 tuần)
    • Terraform/OpenTofu: modules, workspaces, state, testing (Terratest), CI/CD integration
    • Pulumi (optional): TypeScript cho complex logic
    • Cloud provider: AWS (core services), hoặc GCP/Azure
  5. 📊 Giai đoạn 5: Observability & Security (4-6 tuần)
    • Prometheus/Grafana/Loki/Tempo/Pyroscope stack (kube-prometheus-stack)
    • OpenTelemetry instrumentation (auto + manual), Collector
    • DevSecOps: SAST/DAST/SCA/Container scan, Policy as Code (Kyverno), SBOM, SLSA
  6. 🚀 Giai đoạn 6: Advanced & Specialization (Tiếp tục)
    • GitOps (ArgoCD/Flux), Platform Engineering (Backstage), Service Mesh (Istio/Cilium)
    • Cost optimization (FinOps), Disaster Recovery, Multi-region/Active-Active
    • Chứng chỉ: CKA, CKAD, CKS, AWS/Azure/GCP DevOps Pro, Terraform Associate
📚
Resources
KodeKloud, A Cloud Guru, Linux Academy
→
🛠️
Practice
Home lab (Proxmox), AWS Free Tier, GitHub Codespaces
→
📝
Projects
Deploy real app, contribute OSS, write blog
→
🎓
Certify
CKA, CKAD, CKS, Cloud Certs
💡 Mẹo học hiệu quả:
  • 🎯 Project-based: Mỗi tuần deploy 1 thứ thật (blog, API, monitoring stack...)
  • 📝 Blog/TIL: Viết lại thứ vừa học — củng cố kiến thức + portfolio
  • 🤝 Community: Tham gia CNCF Vietnam, DevOps Vietnam, Discord/Slack communities
  • 💰 Home lab: Proxmox + 3 mini PC (N100) = cluster K8s thật < $500

10. Kết Luận

DevOps năm 2026 không còn là "Dev + Ops" — nó là một hệ sinh thái hoàn chỉnh bao gồm: Culture (CALMS), Automation (CI/CD, IaC, GitOps), Observability (Metrics/Logs/Traces/Profiles), Security (DevSecOps, Policy as Code, Supply Chain), và Platform Engineering (IDP, Golden Paths).

Những team/organization thành công nhất năm 2026 có đặc điểm chung:

  • 🚀 Deployment frequency cao: Multiple deployments/day, lead time < 1 giờ
  • 🛡️ Security baked-in: Shift-left, policy as code, SBOM, SLSA Level 3
  • 📊 Data-driven: SLO-based alerting, error budget, chaos engineering thường xuyên
  • 🤖 AI-augmented: Copilot cho code, AIOps cho ops, AI-assisted remediation
  • 👥 Platform-first: IDP giảm cognitive load, self-service, golden paths

Nếu bạn mới bắt đầu: đừng overwhelmed. Học theo lộ trình, từng bước một, practice hands-on. DevOps là marathon, không phải sprint. Công cụ thay đổi (Jenkins → GitHub Actions, Terraform → OpenTofu, Prometheus → VictoriaMetrics...), nhưng nguyên tắc cốt lõi không đổi: Automation, Observability, Security, Culture.

Hành trình DevOps của bạn bắt đầu từ commit đầu tiên được CI/CD tự động test và deploy. 🚀