Cloud-Native Development Guide 2026: Kubernetes, GitOps and Observability

1. Codebase     — One repo, multiple deploys (dev/staging/prod)
2. Dependencies — Declared in requirements.txt/package.json (not system deps)
3. Config       — Environment variables, not hardcoded
4. Backing services — Treat DB/Redis/S3 as attached resources
5. Build/Release/Run — Strict separation; never patch prod code
6. Processes    — Stateless, share-nothing; persistence in DB/cache
7. Port binding — Self-contained; expose HTTP via port
8. Concurrency  — Scale via process model (horizontal scaling)
9. Disposability — Fast startup, graceful shutdown (SIGTERM handler)
10. Dev/prod parity — Same tools in dev and prod
11. Logs        — Treat as event streams; write to stdout
12. Admin tasks — One-off tasks as separate processes (migrations, etc.)

# Multi-stage build — minimal production image
FROM python:3.12-slim AS builder

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends     build-essential libpq-dev && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY requirements.txt .

# Install into venv
RUN python -m venv /opt/venv &&     /opt/venv/bin/pip install --no-cache-dir -r requirements.txt

# Production image
FROM python:3.12-slim

# Security: install only runtime deps
RUN apt-get update && apt-get install -y --no-install-recommends     libpq5 curl && rm -rf /var/lib/apt/lists/*

# Security: don't run as root
RUN groupadd -r app && useradd -r -g app app

WORKDIR /app

# Copy venv from builder
COPY --from=builder /opt/venv /opt/venv

# Copy application code
COPY --chown=app:app . .

ENV PATH="/opt/venv/bin:$PATH"
ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1

USER app
EXPOSE 8000

# Graceful shutdown
STOPSIGNAL SIGTERM

HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3   CMD curl -f http://localhost:8000/health || exit 1

CMD ["gunicorn", "app.main:app",      "--workers", "4",      "--worker-class", "uvicorn.workers.UvicornWorker",      "--bind", "0.0.0.0:8000",      "--timeout", "30",      "--graceful-timeout", "30"]

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  labels:
    app: myapp
    version: v1.2.3
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1         # can have 4 pods during update
      maxUnavailable: 0   # never go below 3 pods
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      terminationGracePeriodSeconds: 60  # match app shutdown time
      containers:
        - name: myapp
          image: myregistry/myapp:v1.2.3  # always pin exact version!
          ports:
            - containerPort: 8000
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: myapp-secrets
                  key: database-url
            - name: REDIS_URL
              valueFrom:
                configMapKeyRef:
                  name: myapp-config
                  key: redis-url
          resources:
            requests:
              memory: "256Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /ready
              port: 8000
            initialDelaySeconds: 5
            periodSeconds: 5
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 10"]  # drain before shutdown

GitOps workflow:

1. Developer pushes code to feature branch
2. CI runs tests + builds Docker image + pushes to registry
3. CI updates Helm values (image.tag: v1.2.4) in git-ops repo
4. ArgoCD detects drift between git state and cluster state
5. ArgoCD automatically syncs cluster to match git
6. Slack notification: deployment complete

Benefits:
- Git is the source of truth (auditable, reversible)
- Deployment = git commit (easy to revert)
- No kubectl access needed (ArgoCD has it)
- Approval gates via PR review

# Grafana LGTM Stack (Loki + Grafana + Tempo + Mimir)
# Deploy with Helm
helm repo add grafana https://grafana.github.io/helm-charts

# Loki (logs aggregation)
helm install loki grafana/loki-stack   --set promtail.enabled=true   --set grafana.enabled=false  # use separate Grafana

# Tempo (distributed tracing)
helm install tempo grafana/tempo

# Mimir (long-term metrics storage)
helm install mimir grafana/mimir-distributed

# All accessible from Grafana dashboards