Chase Hulderman

This week's issue explores the role of DevOps in AI/ML, future trends in distributed systems, and secure multi-cloud authentication. Also covered are Kubernetes security with AppArmor and a new Google data center. Featured tools include RunCVM for secure container isolation in VMs, Tools for automated structured logging for applications, and tooling out of grafana labs for load testing.

1

This week's issue covers the deprecation of AWS CodeCommit, a Kubernetes enhancement for OCI artifacts as volume sources, Google Cloud's VMware Engine updates, monorepo practices, and a new CNCF Sandbox project. Featured tools include a serverless HTTP proxy, developer automation for “grunt work”, and a vendor-neutral OCI artifact registry.

5

This is a notable increase in the number of S3 buckets that a single account can have, and I could see this being a welcome improvement for folks that use a lot of S3 buckets. It should be mentioned that with this change comes the possibility of a new fee, $0.02 per additional general purpose bucket (when you have more than 2,000 S3 buckets in your account). So you still probably want to be smart about the number of S3 buckets you create. #aws #s3 #cloudstorage #awspricing https://lnkd.in/eQFNd48c

3

More AWS Identity Launches! Yesterday, we launched support for the AWS CLI to get credentials from Identity Center using OAuth2 Authorization Code Grant + PKCE. If you're a real OAuth standards nerd, it's also using dynamic client registration. That's certainly a mouthful, but what this means is that now you can sign into the AWS CLI without using device code, which is faster and more secure(much more phishing resistant). https://lnkd.in/gfTtEqVH Happy pre:invent!

146

8 Comments

Some interesting addition to https://lnkd.in/gwnCi_5z in this New Year! A great post by Dan Farrelly on the principles of Durable Executions https://lnkd.in/gVZY-Hvr A great post by Jack Kleeman about implementing persistent state machines with XState and Restate https://lnkd.in/gfnpKutF Use GitHub notifications to keep yourself updated about new content

24

WarpStream is a like 'Aurora Kafka' that is managed cloud native architecture reimplantation and no on-promise design of Kafka compatible. save cost by using S3 and reduce cross az data. But most people aren't aware or agree that, 99.99% of apps do not need any cross az high availability. They do need the same az HA and rapid DR recovery with lost control. Not bills. even if you do cross az, you should stop at 2. https://lnkd.in/gdMX-ZFb

1

This may be 7 years old, but Hemi Trickey's description of "Agents" is one of the best I have seen. The term "Agent" has been popping up everywhere recently with people are trying to describe the "new, wonderful systems designs in an AI world". Solutions with AI enabled components, specifically where the solutions are a composite of independently small functionally contained components that ultimately integrate and work in concert to deliver an outcome...Micro Services. Agent enabled architecture is nothing new. It doesn't need AI to make it an Agent. The only differentiator with AI enabled Agent components, are their use to deliver a probabilistic output and to take updated inputs to "learn" and adjust subsequent outputs; this can either refine, improve or on the opposite end of the scale reinforce incorrect outputs. Now imagine if you string multiple AI enabled Agents together in a system to deliver an outcome in concert. It is possible that each AI enabled Agent adjust from outputs processed by the other Agents in the system. What influence will their various independent probabilistic outputs could impact the final outcome? The most important question is; What is your use case, the outcome required, and therefore what is your tolerance for accuracy vs probability? #demystifyAI #Agents #architecture #microservices #techsavvy

5

re:invent begins!(pre:invent ends?) Significant Launch: new AWS organizations policy type: declarative policies. Declarative policies allow you to craft policy that help you to achieve specific security outcomes, configurations, or behaviors. This is different than identity policy types like SCP or RCP that you to use to manage requests by your IAM principals, or to your AWS resources. For example, you can write a declarative policy that enforces the VPC block public access setting for all the accounts in your AWS organization. Declarative policies make it simpler for you to write policies for specific security outcomes, and I'm a huge fan as this is going to be both simpler for customers secure their environments, but also gives a powerful new capability for AWS service teams to use to deliver security features for their customers. And that's not all - declarative policies has compliance reporting AND custom error message functionality. We're so excited to bring you this capability!

110

6 Comments

This week's issue covers Kubernetes CRD validation, new GCP workflow connectors, AI hype critique, and sys admin books. Also, tools for better K8s Job orchestration, package management, and local/remote (Remocal?) development.

8

2 Comments

Watch out for potential cost increases in AWS EKS starting April 1st! I recently discovered a significant jump of over $1K in charges on an account I handle cost optimization for during May reviews. Amazon EKS clusters running on a Kubernetes version in the extended support window will now incur a charge of $0.60 per cluster per hour, effective from the April 2024 billing cycle. Stay informed to manage your costs effectively. #aws #eks #costoptimization StreamingFinTech LLC Check out more details here: https://lnkd.in/e4MRvE_r

2

In this Mob Mentality Show episode, we dive into the journey of Jeff Morgan, a coach in Continuous Delivery (CD) and lean thinking. Known for his role in advocating for CD within companies, Jeff shares how his experiences with software development and his recent shift into the café business have shaped his philosophy on people and just-in-time. This discussion explores how Jeff’s approach to Agile and CD evolved, his journey into Extreme Programming (XP), and how mob programming impacted his perspective on teamwork and Continuous Integration (CI). https://lnkd.in/gaQKVkPa https://lnkd.in/gCvuhEQr **Jeff’s Agile and CD Journey** We start with Jeff’s introduction to Agile, discussing the early days of his career when dev practices didn’t include CD and the impact of adopting CD in high-stakes projects like Y2K. Jeff describes how learning from Thoughtworks influenced his views on XP and CD, and how he became an advocate, eventually taking CD to different organizations. He also shares what it was like discussing with Woody Zuill and Llewellyn Falco and reflects on the transformative role mob programming has played in his career. **From Pairing to Mobbing**   For Jeff, mob programming was not initially appealing, but over time it became his preferred approach for helping teams. We explore how mobbing enhances CI, tightens communication, and fosters collective learning. Jeff explains how mobbing enables "just-in-time" discussions that align teams on what to build and how it allows real-time feedback on other team members’ learning. Jeff also examines the transition from pairing to mobbing, the challenges of mob programming with CI/CD, and why mobbing helps him “get the whole system in the room” for tackling complex problems. **Quality Without QA?**   We dive into the controversial idea of achieving high quality without traditional Quality Assurance (QA). Jeff opens up about years spent wrestling with the role of QA in Agile/CD environments and shares experiments with “test-infected” developers—who took full ownership of quality. He reflects on the pitfalls of relying on “heavyweight” traditional QA processes and automated tests, which often create lean waste, add handoffs, and introduce brittle, flakey tests. Jeff and hosts Austin and Chris discuss whether “shift left” is merely a shift away from QA, the Deming Red Bead experiment’s relevance, and whether there’s a happy journey for QA professionals on CD teams. Chris Lucian

9

5 Comments

A big re:invent launch I'm a big fan of: EKS Hybrid Nodes. Hybrid nodes allow you to add nodes to your cluster that aren't EC2 instances.. AKA nodes that are in your on-prem, or maybe even another cloud. The Identity nerd part of me really likes the nice integrations that give you the choice of SSM Hybrid Activations, or IAM roles anywhere to solve for the nodes Identity an allow it to join your cluster, and I also really like that after your node is joined to the cluster you can use IRSA, or EKS Pod Identities to give AWS credentials to your workloads running on that node! If given the choice and unless my organization had strong reasons not too, I'd probably use SSM hybrid activations for the node identity so I could also manage that node using SSM as well. So this is another new way to get AWS credentials to your workloads not running in AWS, and doing it in a kubernetesy-way is fantastic. Hats off to the teams involved!

80

4 Comments

This week's issue highlights the deprecation of Istio's in-cluster operator, updates in Kubernetes 1.31 for PodAffinity and resource allocation, and the announcement of Alibaba's Canal Mesh. Also covered are the upcoming KubeCon schedule and a critical ingress-nginx vulnerability. Featured tools include Kardinal for ephemeral development environments, Karpenter for Kubernetes autoscaling, and LocalStack for AWS integration testing.

4

AWS Repeats Same Critical RCE Vulnerability 3 Times in 4 Years Amazon Web Services (AWS) has introduced the same remote code execution (RCE) vulnerability three times over the last four years through its Neuron SDK, highlighting critical lapses in securing its Python package installation processes. Despite previous warnings and fixes, the same dependency confusion vulnerability has resurfaced with new package releases in its software ecosystem. The issue was first discovered in April 2022 when Giraffe Security flagged a vulnerability in AWS’s Neuron SDK, a set of Python libraries enabling machine learning workloads on AWS’s specialized hardware. The problem stemmed from AWS’s official installation instructions and documentation, which recommended a command like the following: pip install transformers-neuronx --extra-index-url=https://lnkd.in/eCKZGCEA At a glance, the command seems simple, instructing Python’s pip package manager to install the package transformers-neuronx from the AWS-specific repository (https://lnkd.in/eCKZGCEA). However, this approach contains a hidden danger rooted in how pip handles the parameters. Stay Connected to Sidharth Sharma, CPA, CISA, CISM, CFE, CDPSE for content related to Cyber Security. #CyberSecurity #JPMC #Technology #InfoSec #DataProtection #DataPrivacy #ThreatIntelligence #CyberThreats #NetworkSecurity #CyberDefense #SecurityAwareness #ITSecurity #SecuritySolutions #CyberResilience #DigitalSecurity #SecurityBestPractices #CyberRisk #SecurityOperations 

1

FSI customers will be pleased to see this feature being supported in Amazon API Gateway now. No more workarounds with NLBs, ALBs, or VPCE ENIs as target groups. George Mao 🙌 penned the workaround almost 5 years ago in his blog https://lnkd.in/gunKN9Pn Heeki Park 👏 must be happy to write this new feature blog that deprecates his own workaround (built based on George's blog). This pattern can now be archived in the pages of history at Serverlessland.com 😀 https://lnkd.in/gkcWJ2Si

32

The seventh video in the series about SRE Concepts/Topics is about two topics "white-box" and "black-box" Monitoring. White-box monitoring is a type of distributed monitoring system along with black-box monitoring. While black-box monitoring deals with externally visible resources such as disk space, CPU usage, and other physical variables, white box testing focuses more on applications running on the servers and other internals such as logs. #SRE  #DEVOPS  #SiteReliability  #AGILE  #marcelkoert  #melomarit #testing #blackbox #whtebox #monitoring

Kyverno policies can validate, mutate, generate, and cleanup Kubernetes resources, and verify image signatures and artifacts to help secure the software supply chain. The Kyverno CLI can be used to test policies and validate resources as part of a CI/CD pipeline. https://kyverno.io

1