Using Claude Code for DevOps: what works, what breaks, and what to lock down

1. Why DevOps engineers are suddenly looking at Claude Code

Most AI tools for developers stop at suggesting code.
Claude Code is different.

Claude Code runs inside your terminal and can:

• Read your repository
• Inspect YAML, Terraform, scripts
• Run real commands like kubectl, terraform, docker, grep
• Operate with your existing credentials

That last point is why DevOps engineers are paying attention.

In infrastructure work, most time is spent:

• Reading configs
• Explaining failures
• Debugging state
• Translating intent into YAML or CLI flags

Claude Code sits exactly at that layer — not above it.

That makes it useful, but also dangerous if misunderstood.

---

2. What Claude Code actually is (and is not)

Claude Code is not:

• A chatbot
• A read‑only assistant
• A safe sandbox by default

Claude Code executes commands as your user.

If you can run this in your shell:

kubectl delete pod my-pod

Claude Code can run it too — unless you restrict it.

---

Minimal setup (what most engineers start with)

Install Claude Code:

curl -fsSL https://claude.ai/install.sh | bash

Start it inside a repo:

cd infra-repo
claude

At this point, Claude Code:

• Reads files in the repo
• Sees your git history
• Inherits environment variables
• Inherits kubeconfig / cloud credentials

This is where its power comes from — and where mistakes begin.

---

3. Where Claude Code genuinely helps DevOps work

Used carefully, Claude Code can remove a lot of mental overhead.

✅ Explaining broken Kubernetes behavior

Example prompt:

This pod is stuck in Pending. Inspect the manifests and explain why.

Claude Code can:

• Read Deployment / StatefulSet YAML
• Notice PVC usage
• Explain scheduling or storage constraints

This is faster than:

• Jumping between files
• Mentally simulating scheduler logic

---

✅ Debugging configuration drift

Claude Code is good at answering:

• “What changed between these two versions?”
• “Why did this Helm upgrade fail?”
• “Which values are no longer valid?”

It works well because:

• Infra problems are often configuration diffs
• Not algorithmic logic

---

✅ Writing boring but correct boilerplate

Examples:

• Kubernetes probes
• Resource requests / limits
• Terraform module structure
• GitHub Actions YAML

This is where AI shines without risk, because:

• Output is reviewed
• Applied manually
• No direct execution needed

---

4. Where Claude Code breaks down (important)

Claude Code fails in predictable ways.

❌ It does not understand “importance”

It treats:

• Prod cluster
• Dev cluster
• Test repo

as equally valid contexts, unless you enforce boundaries.

---

❌ It can be confidently wrong

Claude Code may:

• Suggest deleting resources to “fix” an issue
• Recommend changes that mask the real problem
• Optimize for speed, not safety

This is especially risky for:

• Stateful workloads
• Storage
• Databases
• Production clusters

---

❌ It inherits too much power by default

If your shell has:

• Admin cloud credentials
• Prod kubeconfig
• Write access everywhere

Claude Code does too.

That is not an AI problem — it’s a DevOps hygiene problem.

---

5. What you MUST lock down before using Claude Code seriously

This is the most important section of the post.

✅ Use a non‑production kubeconfig

Create a read‑only or dev‑only kubeconfig and export it before running Claude:

export KUBECONFIG=~/.kube/dev-config
claude

Never point Claude Code at prod by default.

✅ Prefer read‑only workflows

Good use cases:

• Explain
• Review
• Diff
• Suggest

Bad use cases:

• Apply
• Delete
• Migrate
• Scale stateful systems

✅ Treat Claude Code like a junior engineer

• It can move fast
• It needs supervision
• It should not operate alone

If you wouldn’t let a junior engineer run terraform apply unsupervised, don’t let an AI do it either.

6. When you should NOT use AI agents at all

Avoid Claude Code when:

• Incident response is ongoing
• Data integrity is at risk
• You don’t fully understand the system yet
• You’re debugging something nondeterministic

AI is best used before and after incidents — not during peak stress.

---

7. The right mental model

Claude Code is best thought of as:

A fast, tireless pair‑programmer for infrastructure — not an operator.

It helps you:

• Think
• Explain
• Prepare

It should not:

• Decide
• Act autonomously
• Touch production unsupervised

---

Final takeaway

Claude Code is powerful because it operates where DevOps work actually happens — the terminal.

That same power makes it risky if you treat it like a chatbot.

Used with:

• clear boundaries
• limited credentials
• human judgement

it can save real time.

Used blindly, it can create incidents instead of preventing them.