--- title: "DevOps Engineer Beginner to Expert" description: "A comprehensive roadmap to master DevOps engineering from Linux fundamentals to advanced cloud-native and platform engineering concepts." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/roadmaps/post/devops-engineer-roadmap --- # DevOps Engineer Beginner to Expert This roadmap guides you from Linux fundamentals through to advanced platform engineering and MLOps. Each stage builds on the last work through them sequentially to develop a deep, well-rounded DevOps skill set. Mark topics as you complete them and revisit earlier stages to reinforce your foundations as you progress. ## Roadmap ### Stage 1: Linux Fundamentals Master the Linux command line and system basics the foundation of every DevOps workflow. #### File System & Navigation Understand the Linux directory tree, navigate with cd/ls/pwd, and manage files with cp/mv/rm. - [Linux File System Hierarchy](https://www.tldp.org/LDP/Linux-Filesystem-Hierarchy/html/) #### Users, Groups & Permissions Manage users with useradd/usermod, set file permissions with chmod/chown, and understand sudo. #### Package Management Install and update software with apt, yum/dnf, and snap. Understand package repositories. ### Stage 2: Shell Scripting Automate repetitive tasks and glue tools together with Bash scripting. #### Bash Basics Variables, conditionals (if/else), loops (for/while), and functions in Bash. - [Bash Scripting Guide](https://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html) #### Text Processing Use grep, awk, sed, cut, and sort to process and transform text streams. #### Cron Jobs & Scheduling _(recommended)_ Schedule recurring tasks using crontab and understand cron syntax. ### Stage 3: Networking Basics Understand the network concepts that underpin modern infrastructure and cloud environments. #### TCP/IP & DNS How IP addressing, subnets, DNS resolution, and routing work. - [Cloudflare: What is DNS?](https://www.cloudflare.com/learning/dns/what-is-dns/) #### HTTP/HTTPS & TLS Request/response lifecycle, status codes, headers, and TLS certificate fundamentals. #### Firewalls & Ports _(recommended)_ Configure iptables/ufw, understand inbound/outbound rules, and common service ports. #### Load Balancing Concepts _(recommended)_ Round-robin, least-connections, and health checks at the network layer. ### Stage 4: Version Control with Git Track code changes, collaborate with teams, and manage releases using Git. #### Core Git Workflow init, clone, add, commit, push, pull, and status commands. - [Pro Git Book](https://git-scm.com/book/en/v2) #### Branching & Merging Feature branches, merge vs rebase, resolving merge conflicts. #### Git Workflows _(recommended)_ Gitflow, trunk-based development, and pull request best practices. #### Tags & Releases _(recommended)_ Semantic versioning with git tags and using GitHub/GitLab releases. ### Stage 5: Containerization with Docker Package applications and their dependencies into portable, reproducible containers. #### Docker Architecture Images, containers, the Docker daemon, and the Docker Hub registry. - [Docker Official Docs](https://docs.docker.com/get-started/) #### Writing Dockerfiles FROM, RUN, COPY, ENV, EXPOSE, CMD, and ENTRYPOINT instructions. #### Docker Compose Define and run multi-container applications with docker-compose.yml. #### Image Optimization _(recommended)_ Multi-stage builds, layer caching, .dockerignore, and minimizing image size. ### Stage 6: Container Registries Store, version, and distribute container images securely. #### Docker Hub Push and pull public/private images from Docker Hub. - [Docker Hub Documentation](https://docs.docker.com/docker-hub/) #### Private Registries _(recommended)_ Use AWS ECR, GitHub Container Registry, or self-hosted Harbor. #### Image Scanning _(recommended)_ Scan for vulnerabilities using Trivy or Docker Scout before deploying. ### Stage 7: CI/CD Fundamentals Understand the principles of Continuous Integration and Continuous Delivery. #### CI/CD Concepts The pipeline stages: build, test, lint, package, deploy, and release. - [Atlassian: CI vs CD](https://www.atlassian.com/continuous-delivery/principles/continuous-integration-vs-delivery-vs-deployment) #### Pipeline as Code Define pipelines in YAML (GitHub Actions, GitLab CI) rather than through a UI. #### Artifacts & Caching _(recommended)_ Cache dependencies and pass build artifacts between pipeline stages. ### Stage 8: GitHub Actions Build automated workflows directly in your GitHub repository. #### Workflow Syntax on, jobs, steps, uses, run the building blocks of a GitHub Actions workflow. - [GitHub Actions Docs](https://docs.github.com/en/actions) #### Reusable Workflows & Composite Actions _(recommended)_ DRY your pipelines by sharing logic across repositories. #### Secrets & Environments Manage sensitive values, approval gates, and environment-specific variables. ### Stage 9: GitLab CI/CD Use GitLab's built-in CI/CD system for powerful, integrated pipelines. #### .gitlab-ci.yml Basics Stages, jobs, scripts, image, and before_script in GitLab CI. - [GitLab CI/CD Docs](https://docs.gitlab.com/ee/ci/) #### GitLab Runners _(recommended)_ Register and configure shared and self-hosted runners for job execution. #### Environments & Deployments _(optional)_ Track deployments per environment and use dynamic child pipelines. ### Stage 10: Cloud Computing Fundamentals Understand the core concepts shared across all major cloud providers. #### Cloud Service Models IaaS vs PaaS vs SaaS understand where you manage what. - [AWS: What is Cloud Computing?](https://aws.amazon.com/what-is-cloud-computing/) #### Regions, Availability Zones & Edge How cloud providers distribute infrastructure globally for availability. #### Shared Responsibility Model What the cloud provider secures vs what you are responsible for. ### Stage 11: AWS Core Services Get hands-on with the foundational AWS services used in most production environments. #### IAM Identity & Access Management Users, groups, roles, policies, and the principle of least privilege. - [AWS IAM Docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) #### EC2 & Auto Scaling Launch instances, configure AMIs, security groups, and Auto Scaling Groups. #### S3 Simple Storage Service Buckets, objects, versioning, lifecycle policies, and static website hosting. #### VPC Virtual Private Cloud Subnets, route tables, internet gateways, NAT gateways, and VPC peering. #### RDS & Databases _(recommended)_ Managed relational databases, Multi-AZ deployments, and read replicas. ### Stage 12: Infrastructure as Code Terraform Provision and manage cloud infrastructure declaratively using Terraform. #### Terraform Core Concepts Providers, resources, data sources, variables, and outputs. - [Terraform Getting Started](https://developer.hashicorp.com/terraform/tutorials/aws-get-started) #### State Management Local vs remote state, terraform.tfstate, state locking with S3 + DynamoDB. #### Modules _(recommended)_ Write reusable, composable Terraform modules and use the public registry. #### Workspaces & Environments _(recommended)_ Manage dev/staging/prod environments using workspaces or directory isolation. ### Stage 13: Configuration Management Automate server configuration and application deployment at scale. #### Ansible Fundamentals Inventories, playbooks, tasks, handlers, roles, and ad-hoc commands. - [Ansible Docs](https://docs.ansible.com/ansible/latest/getting_started/index.html) #### Ansible Roles & Galaxy _(recommended)_ Structure playbooks with roles and reuse community roles from Ansible Galaxy. #### Idempotency Understand why idempotent tasks are critical for reliable automation. ### Stage 14: Kubernetes Core Concepts Orchestrate containerized workloads at scale with Kubernetes. #### Cluster Architecture Control plane (API server, etcd, scheduler, controller-manager) and worker nodes (kubelet, kube-proxy). - [Kubernetes Official Docs](https://kubernetes.io/docs/concepts/overview/) #### Pods, Deployments & ReplicaSets The smallest deployable unit, declarative rollouts, and replica management. #### Services & Networking ClusterIP, NodePort, LoadBalancer service types, and DNS within the cluster. #### ConfigMaps & Secrets Decouple configuration from container images and manage sensitive data. ### Stage 15: Kubernetes Workloads & Storage Go beyond basic Deployments to run stateful apps, batch jobs, and persistent storage. #### StatefulSets & DaemonSets _(recommended)_ Run stateful applications with stable network identities and per-node daemons. - [K8s: StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) #### Persistent Volumes & Claims _(recommended)_ PV, PVC, StorageClasses, and dynamic provisioning for stateful data. #### Jobs & CronJobs _(recommended)_ Run batch tasks and scheduled workloads inside a cluster. #### Resource Requests & Limits Set CPU and memory requests/limits to ensure fair scheduling and stability. ### Stage 16: Kubernetes Advanced Operations Operate and extend Kubernetes clusters at production scale. #### Ingress & Ingress Controllers Expose HTTP/S routes with NGINX or Traefik ingress controllers and TLS termination. - [K8s: Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) #### Horizontal & Vertical Pod Autoscaling _(recommended)_ HPA based on CPU/custom metrics and VPA for right-sizing resource requests. #### RBAC Role-Based Access Control ClusterRoles, Roles, RoleBindings, and ServiceAccounts. #### Network Policies _(recommended)_ Restrict pod-to-pod communication using Kubernetes Network Policies. ### Stage 17: Helm Kubernetes Package Manager Template and package Kubernetes manifests for repeatable, versioned deployments. #### Helm Chart Structure Chart.yaml, values.yaml, templates, helpers, and the _helpers.tpl file. - [Helm Docs](https://helm.sh/docs/) #### Templating with Go Templates Use {{ .Values }}, conditionals, loops, and named templates in Helm. #### Chart Repositories & OCI Registries _(recommended)_ Host charts on GitHub Pages, Artifact Hub, or push to OCI-compatible registries. #### Helm Hooks & Tests _(optional)_ Run pre/post-install jobs and validate deployments with helm test. ### Stage 18: GitOps Use Git as the single source of truth for declarative infrastructure and application state. #### GitOps Principles Declarative config, versioned history, automated reconciliation, and self-healing. - [OpenGitOps](https://opengitops.dev/) #### ArgoCD _(recommended)_ Deploy and sync Kubernetes manifests automatically from a Git repository with ArgoCD. - [ArgoCD Docs](https://argo-cd.readthedocs.io/en/stable/) #### Flux CD _(optional)_ CNCF-graduated GitOps toolkit for continuous delivery to Kubernetes. ### Stage 19: Observability Logging Collect, aggregate, and search logs from applications and infrastructure. #### Structured Logging JSON log formats, log levels, correlation IDs, and log context best practices. #### ELK / EFK Stack _(recommended)_ Collect with Fluentd/Filebeat, store in Elasticsearch, visualize in Kibana. - [Elastic: Getting Started](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started.html) #### Loki & Grafana _(recommended)_ Lightweight log aggregation with Loki, queried via LogQL in Grafana. ### Stage 20: Observability Metrics Collect time-series metrics to understand system health and performance trends. #### Prometheus Scrape metrics with Prometheus, write PromQL queries, and configure alerting rules. - [Prometheus Docs](https://prometheus.io/docs/introduction/overview/) #### Grafana Dashboards Build dashboards, panels, and variables to visualize Prometheus metrics. #### Exporters _(recommended)_ node_exporter, kube-state-metrics, blackbox_exporter for infra and app metrics. #### Alertmanager _(recommended)_ Route, deduplicate, and silence alerts; integrate with PagerDuty, Slack, and email. ### Stage 21: Observability Tracing Track requests as they flow through distributed microservices. #### Distributed Tracing Concepts Traces, spans, context propagation, and the OpenTelemetry data model. - [OpenTelemetry Docs](https://opentelemetry.io/docs/) #### Jaeger & Tempo _(recommended)_ Deploy Jaeger or Grafana Tempo as a tracing backend and query trace data. #### Instrumenting Applications _(recommended)_ Add OpenTelemetry SDKs to Node.js, Python, and Go services. ### Stage 22: Security DevSecOps Shift security left and integrate it into every stage of the delivery pipeline. #### Static Application Security Testing (SAST) Scan source code for vulnerabilities using Semgrep, SonarQube, or Bandit. - [Semgrep](https://semgrep.dev/docs/) #### Dependency Scanning (SCA) Detect vulnerable third-party packages using Dependabot, Snyk, or OWASP Dependency-Check. #### Container Image Scanning Scan Docker images for CVEs with Trivy or Grype in your CI pipeline. #### Secrets Detection Prevent credentials from reaching Git with detect-secrets, GitGuardian, or gitleaks. ### Stage 23: Security Cloud & Kubernetes Hardening Apply security best practices to cloud workloads and Kubernetes clusters. #### CIS Benchmarks _(recommended)_ Apply CIS benchmarks for Linux, Docker, and Kubernetes to harden configurations. - [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks) #### Pod Security Standards Enforce privileged, baseline, and restricted pod policies using PSA/PSP. #### OPA / Kyverno _(recommended)_ Define and enforce admission policies in Kubernetes with Open Policy Agent or Kyverno. #### Secrets Management _(recommended)_ Store and inject secrets using HashiCorp Vault or AWS Secrets Manager. ### Stage 24: Service Mesh Manage service-to-service communication, security, and observability with a mesh layer. #### Service Mesh Concepts _(recommended)_ Sidecar proxy pattern, control plane vs data plane, and mTLS between services. - [Istio Docs](https://istio.io/latest/docs/concepts/what-is-istio/) #### Istio _(optional)_ Traffic management, circuit breaking, retries, and observability with Istio. #### Linkerd _(optional)_ Lightweight CNCF service mesh focused on simplicity and low resource overhead. ### Stage 25: Infrastructure Testing Validate your infrastructure code with automated tests before it reaches production. #### Terraform Testing _(recommended)_ Use Terratest or terraform test to write unit and integration tests for modules. - [Terratest Docs](https://terratest.gruntwork.io/docs/) #### Kitchen-Terraform / Checkov _(recommended)_ Policy-as-code compliance scanning for Terraform with Checkov or tfsec. #### Kubernetes Manifest Testing _(recommended)_ Lint and validate manifests with kubeval, kubeconform, and Polaris. ### Stage 26: Cost Optimization Understand and reduce cloud spending without sacrificing reliability or performance. #### Cloud Cost Visibility AWS Cost Explorer, tagging strategies, and budget alerts. - [AWS Cost Explorer](https://aws.amazon.com/aws-cost-management/aws-cost-explorer/) #### Right-sizing & Reserved Instances _(recommended)_ Match instance types to workload needs and use Savings Plans or Reserved Instances. #### Spot Instances & Preemptible VMs _(recommended)_ Run fault-tolerant workloads on Spot/Preemptible instances for up to 90% savings. #### FinOps Practices _(optional)_ Cross-team cost accountability, showback/chargeback models, and FinOps Foundation principles. ### Stage 27: Disaster Recovery & Backup Design systems to survive failures and recover from data loss or outages. #### RTO & RPO Define Recovery Time Objective and Recovery Point Objective for each service. #### Backup Strategies Automated backups for databases, volumes, and object storage with retention policies. - [AWS Backup Docs](https://docs.aws.amazon.com/aws-backup/latest/devguide/whatisbackup.html) #### Multi-Region & Cross-Zone Architecture _(recommended)_ Design for availability zone and region failure using active-active or active-passive patterns. ### Stage 28: Site Reliability Engineering (SRE) Apply SRE principles to balance reliability with the speed of software delivery. #### SLIs, SLOs & SLAs Define measurable reliability targets and track them with error budgets. - [Google SRE Book](https://sre.google/sre-book/table-of-contents/) #### Error Budgets _(recommended)_ Use error budgets to make data-driven decisions about feature releases vs reliability work. #### Incident Management Runbooks, on-call rotations, post-mortems, and blameless culture. #### Chaos Engineering _(optional)_ Proactively test system resilience with tools like Chaos Monkey, LitmusChaos, or AWS FIS. ### Stage 29: Platform Engineering Build Internal Developer Platforms (IDPs) that improve developer experience and productivity. #### Internal Developer Platforms _(recommended)_ Concepts behind IDPs: golden paths, self-service infrastructure, and platform teams. - [platformengineering.org](https://platformengineering.org/blog/what-is-platform-engineering) #### Backstage _(optional)_ Deploy Spotify Backstage as a developer portal with a software catalog and TechDocs. #### Crossplane _(optional)_ Provision cloud resources from Kubernetes using Crossplane Compositions and XRDs. ### Stage 30: Advanced Kubernetes Patterns Extend and customize Kubernetes with operators, webhooks, and advanced scheduling. #### Custom Resource Definitions (CRDs) _(recommended)_ Extend the Kubernetes API with your own resource types. - [K8s: CRDs](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) #### Operators _(optional)_ Encode operational knowledge as Kubernetes controllers using Operator SDK or Kubebuilder. #### Admission Webhooks _(optional)_ Mutating and validating admission webhooks for policy enforcement and injection. #### Advanced Scheduling _(recommended)_ Node affinity, taints/tolerations, topology spread constraints, and priority classes. ### Stage 31: Multi-Cloud & Hybrid Cloud Design and operate workloads that span multiple cloud providers or on-premises environments. #### Multi-Cloud Strategy _(recommended)_ Evaluate use cases for multi-cloud vs single-cloud: portability, vendor lock-in, and compliance. #### Terraform Multi-Provider _(recommended)_ Manage AWS, GCP, and Azure resources within a single Terraform configuration. - [Terraform Providers](https://registry.terraform.io/browse/providers) #### Federated Kubernetes _(optional)_ Manage workloads across multiple clusters with Cluster API or Google Anthos. ### Stage 32: AI & MLOps Foundations Understand how DevOps principles extend into the machine learning lifecycle. #### MLOps Concepts _(optional)_ CI/CD for ML models, experiment tracking, model registries, and feature stores. - [MLflow Docs](https://mlflow.org/docs/latest/index.html) #### Kubeflow Pipelines _(optional)_ Orchestrate ML workflows on Kubernetes using Kubeflow. #### GPU Workloads on Kubernetes _(optional)_ Configure NVIDIA device plugins and resource limits for GPU-accelerated pods.