Encryption in AWS: AWS Managed KMS Keys and Service Coverage (with repository of all the key policies)

AWS Managed KMS Keys have key policies (and thus access) managed by AWS compared to Customer Managed Keys (Customer managed) and AWS Owned Keys.  These are all encryption options for resources in AWS. AWS Managed KMS Keys cannot be modified by the customer and often have access implications.  Additionally, visibility and documentation of Managed KMS Keys is limited. We created a GitHub repo that programmatically scans and pulls all the available AWS Managed KMS Keys (39 services out of 117 with integration with AWS KMS) and their key (access) policies.

https://www.fogsecurity.io/blog/encryption-aws-managed-kms-keys

https://github.com/FogSecurity/aws-managed-kms-keys

https://redd.it/1e1iwpm
@r_devops

How to send a message on Teams that a BitBucket PR was created?

Hi all,

My team recently started using the Atlassian stack and with that, migrated our repos from Azure DevOps to BitBucket. We had a connection setup between ADO and Teams to alert us anytime a PR was created, but trying to set up the same flow with BitBucket doesn't seem as straightforward.

I've been googling and researching this and it looks like there used to be a BitBucket integration in Teams but it has been deprecated. What's the best way to handle this in 2024? Thanks in advance for any help!

https://redd.it/1e1iw6m
@r_devops

Leave 130k+10k bonus for 155k Contract to Hire?

I'm a tenured employee now (3 years at a startup-y place) on W2 making 130k USD base and a 10% target bonus.

I have an offer for a more senior role (but not a senior role) at another company for a very similar role of Devops for 155k W2 Contract to hire in 6 months.

Would you leave a comfortable job for a less comfortable job for 25k more?

There was also a time where my new boss was being a jerk but has since calmed down a lot. I'm still a little weary but there is a new manager between me and that boss.

Side note, I didnt get my full 10% bonus because my boss was being a jerk and instead gave me a 8% bonus to fuck with me.

Curious to know what others think? I don't want to be stupid and leave a comfortable job for a less comfortable job just because im salty at my old boss. I'm not sure if its stupid to pass up a 25k base raise or a 12k TC raise. I was aiming for more of a 20k TC raise to move.

https://redd.it/1e1n1vn
@r_devops

Employer is asking me to move to mlops

I do have almost 6 years of DevOps experience and I enjoy the challenges. Currently I work for a small startup and almost every devops related stuff is already taken care of. Pipelines run smoothly, cost is at a all time low, alerts are in place, automated housekeeping tasks.

Due to that they think that there are no more DevOps work for me. They asked me whether I could selfstudy on MLOps and move to that. What should I do, what are your thoughts, pros and cons? Thank you very much in advance.

https://redd.it/1e1nu02
@r_devops

Fessing up Friday: Share your Production Oopsie

Alright DevOps fam, let's get real for a minute. We've all been there - that moment when you hit deploy and suddenly the silence from your monitoring tools screams volumes.

So, tell us your war stories! Did you bring down a production system? How long did it take to get things back online?

I'll start: Once I decided to tackle some Dependabot alerts in a codebase I wasn't super familiar with. Bumped some Python packages with known CVEs (gotta stay secure, right?) and everything seemed OK in local testing. Fast forward to that night, when a massive dataset from a big client hit the production environment... Turns out, there weren't any tests in place to handle that specific scenario, and boom! System went down.

Lesson learned: respect the power of unfamiliar codebases and always prioritize comprehensive testing.

But hey, that's what these experiences are for, right? We learn, we adapt, and hopefully, we don't make the same mistake twice. So, share your production oopsies in the comments!

https://redd.it/1e1pwir
@r_devops

What approach you would use, VPS or AWS/Azure/GCP... ?

Given a small project example for a mechanic workshop/auto repair shop.

The project includes two main parts:

1. Landing Page: This will provide basic information about the workshop, its services, and contact details.
2. User/Admin Area:
User Area: Customers can log in to check the status of their service requests, view updates, and see related images or videos.
Admin Area: Staff can update service requests with images and videos to keep customers informed about the progress of their vehicle's service.

You also know that there will be a limited number of users, and even if the user base grows, it won't be accessed constantly.

Considering cost-effectiveness and long-term sustainability, what approach would you recommend?

https://redd.it/1e1r8b7
@r_devops

Does anyone really, truly care about generative AI?

I have had conversations with my coworkers about this and we seem to be aligned — GenAI, at least in its current iteration — is overhyped and largely underwhelming. I’m curious what a larger audience of tech enthusiasts thinks because I like to have my opinions challenged.

Some context — I work at a company that has put its GenAI offering at the forefront of its marketing, which seems to be pretty ubiquitous across the industry at this point. They even make a point to shove it down our throats during all hands meetings and have forced us to beta test one of the AI offerings before it went live. I’m just sort of tired of always hearing about it, how there’s a new model every other month that every tech VP on Linkedin buzzes about, and how it’s the future of everything.

As an aside, I have used coding copilots and some of their suggestions have saved me a bit of time. I usually like to write code organically so I can learn as I go, but saving time on mundane scripts/Terraform I’ve done a million times is nice. I will admit that there is some utility from a programming perspective, but I have yet to find a chatbot that impresses me.

Is there something that my coworkers and I are missing? Is AI actually doing anything to help communities or business outcomes? To me it just seems like companies are putting in half-baked chatbots and insight generation to accelerate their go to market strategies. Improving the product beyond that capability has seemingly become a secondary concern.

https://redd.it/1e1spfj
@r_devops

Advocating for one’s own promotion?

Started at a new company and have been in this new role for 1 1/2. My current tech lead has taken a new role at a new company. New tech lead, from another area is taking her place.

How it previously was - project manager and project tech lead would get together and advocate for us, for me it was mainly the tech lead. I worked with this person daily, but now she is gone. Bonuses were in part thanks to them. Project manager, has multiple projects they manage, and multiple meetings. Although this person I feel like barely has their head above water, i know I can’t reliably count on this person as a junior to know what I am working on. Although I do tell them what I work on. From our meetings it seems like they are always half way present in our conversations - cause they have a ton going on.

New tech lead, is not on the same project but since they have experience, they will be coming in to take over old tech leads spot. Old lead and new lead have connected in regards to discuss myself. I was told by old tech lead that I should advocate for myself on a possible promotion, as I’ve been hitting a significant portion of my levels responsibilities.

My dilemma is that, after looking at some of the bonus categories (outside of a promotion) work I have done, does fall into that, but it has to be nominated by another employee. Although there was some hiccups (i.e. redeployments- due to missing info) I was able to complete said tasks.

Would it be right to ask for both a bonus and promotion at said role. I would obviously make known that I feel like I have been performing outside of my level, but I am also very harsh on myself lol and I feel super damn silly asking for a bonus (again other employees nominated) and also a promotion - maybe down the line but definitely this year.

My intention is not to brag, coming from a humble place. After I have written down my accomplishments this far this year, I think I am performing above my level, as a junior to move into the next level.

Appreciate any advice

https://redd.it/1e1su7x
@r_devops

Prometheus vs Metricbeat

I come from a Kubernetes background and am used to prometheus with grafana.

I just came across metricbeat and since my company is heavily invested in Elastic I was wondering if it could somehow be a replacement for prometheus. Meaning doing metric collection and visualization of servers and containers with Elastic stack only.

Does anyone have any insights on metricbeat in comparison with prometheus?

https://redd.it/1e1sj7t
@r_devops

Transitioning from Service Engineer to DevOps?

Hi all, apologies for the typical “how do I get into DevOps” post…

I’m currently working as a service engineer doing incident management, providing support for micro services of specialised applications in my company.

I’ve been working since 19 and I’m 24 now. Skipped uni and started out in a help desk role, then moved to a role managing devices and supporting win10 incidents (hardware spec, out of box experience, using azure for Intune/ entraID). I was put at risk of redundancy last year but secured this job as a service engineer.

So now I want to transition more towards a DevOps or SRE role…but I don’t know what steps I could take from a service engineering role to get there. I know that both require a lot of technical knowledge and experience, and aren’t roles you just start out in. That’s why I want to know what direction I should be steering in. I’m willing to put the time and effort in because I have a lot of curiosity towards these areas of IT… I love automation (did quite a bit in my previous role using powershell), enjoy configuration, IT infrastructure/ops, how everything fits together to deliver a product or service.

I do have basic knowledge of cloud (got az-104 and GCP ACE), microservice architecture, use splunk/dynatrace for monitoring/logs… know Linux and networking fundamentals. Can script with bash powershell or python. Have played around with terraform, gitlabCI, docker and kubernetes with home projects.

Should I just apply for internal DevOps engineer roles (big company)? Anything I can do in my current role that might help my chances of breaking into DevOps? Would love to hear people who had a similar path and got there.

Welcoming any advice. Cheers.




https://redd.it/1e1tv37
@r_devops

Has remote connectivity slowed corp devops adoption down?

Anecdotally, it seems to be increasingly common to see apps and websites with notifications that “this app will unavailable from <ungoldy hour> to <ungodly hour>” over the weekend.

While I understand that this may be necessary for legacy systems, I suspect that a lot of it is due to a lack of confidence in deployments in more recently built software (or more cynically for OT).

In the past a robust deployment strategy would mean you didn’t have drive into the office to babysit a weekend deployment. Now it seems like the perception is that one can just wake up, remote in at midnight, or over the weekend, deploy and deal with issues without making sure deployments are bulletproof.


https://redd.it/1e21c9v
@r_devops

Advice Needed on CI/CD Services for Multi-Platform Android USB Device Testing

I’m currently developing an MTP (Media Transfer Protocol) library and need to test it on real Android devices via USB across multiple platforms, including macOS (Intel and ARM), Windows, and Linux. Given the complexity, I’m looking for CI/CD services that can facilitate this kind of testing without having all the devices and platforms physically present.

I prefer everything to be remote only, including the USB devices. In my research, some device farms have remote debugging, but I'm not sure if they allow USB port forwarding or have virtual USB forwarding services.

In case this can't be achieved online, I'm willing to set up a local CI/CD setup on a dedicated local PC if I have to, but I'm unsure how to virtualize macOS for ARM on the local PC.

I would be grateful for your suggestions.

Thanks

https://redd.it/1e27twk
@r_devops

How do you get good at programming?!

Dumb rant, but I just don’t get it. The only metric I really have is HackerRank and LeetCode. I can solve a medium in like over an hour and sometimes a day. But that’s not nearly fast enough for what employers want. Every time I hit the technical portion of an interview my brain becomes a dumpster fire of duhhhh.

So what’s your secrets? Is it just grinding over and over again? Do I need to take some course on algorithms and data structures until the information is distilled?

If anyone had moments of epiphany and would share how it finally clicked, I’ll love you.

>!jk, I’m incapable of love, but I will appreciate the knowledge share!<







https://redd.it/1e28yqo
@r_devops

What’s the one development tool you can’t live without?

As developers, we all have that one tool we rely on daily. Whether it's an IDE, a version control system, or a debugging tool, these essentials keep our workflow smooth and efficient.
What's the one development tool you can't live without?
Share your favorites and let's see what makes our developer lives easier and more productive!

https://redd.it/1e2elhq
@r_devops

How to pick the Observability Platform for your Organization?

Almost every SRE, DevOps, and Leadership spent time picking the right observability product. I hope this article will help you in making the decision. This is a vendor-neutral article and we are not aligning ourselves with any product. Please have a look and provide your feedback. Also would love to know what you are using currently in the comments.


https://www.cloudraft.io/blog/guide-to-observability

https://redd.it/1e2gsff
@r_devops

How I deployed my web app with $0

Hey, there.

Wanted to share my experiences in case it might be useful for anyone who is looking for similar solutions.

So I built web applications and I wanted to cloud host it for free or very close to this number as a starting point. After some consideration and exploration o decided to go with GCP and launch with Cloud Run.

It was simple. I create separate docker containers for my frontend and backend and uploaded to the artifact registry. With cloud run I pointed to these artifacts.

For DB I use mangodb atlas free tier.

As of today the cost are $0, that will change when more users will be using my web app, but at that point that will mean that product has some product for so it is safe to invest.

Please share your experience

https://redd.it/1e2knds
@r_devops

First Project, Trouble Deploying

Hi all! I’m a newbie trying to understand DevOps better, and I’m having trouble deploying on docker. I’ve gone in circles, and I could use a tutor. Where the best place for quick one on one help (fees ok)?

https://redd.it/1e2qtw8
@r_devops

Going Multi-Cloud, AWS Training REsources?

Hello,

As per the title, our CTO has decided that it's too risky to be beholden to a single cloud provider (Azure) and we're going multi-cloud with AWS as the secondary cloud.

Only problem is that we have at best patchy experience with AWS.

I've been looking at training resources to bring the team up to speed but there is so many out there (AWS SkillBuilder, acloudguru, pluralsight, cloudacademy, udemy, etc ..) that it's hard to say what is actually good and perhaps more relevant, up to date.

I've heard good things about the certifications courses by Adrian Cantrill but I'm not fussed about certs, I just want our team to avoid making silly mistakes from being used to doing it the Azure way.

I should add that I fully expect us to make silly mistakes, I'd like to try to minimize them.

While we have a ring fenced training budget for this project this doesn't stretch to in-person training for our small team of 4.

We heavily use AKS so EKS is our main target but also other stuff (Service Bus, Storage Accounts, SQL, etc ...). Ideally we want to cover general stuff first and then deep dive into the services we need to use: EKS, SNS/SQS, RDS, probably lambda too as we have quite a lot of Functions still.

Any suggestions most welcomed


Thanks

https://redd.it/1e2y88t
@r_devops

Github actions using for helm deployment

Hi everyone,

I'm looking for advice on the best way to deploy Helm charts to a Kubernetes cluster. Here's my current setup:

I have two repositories:
Repository A: Contains the microservice code.
Repository B: Contains the shared Helm charts.

I have two ideas on how to approach the deployment process:

Trigger Workflow Approach:
When changes are pushed to Repository A (the microservice code), a workflow is triggered.
This workflow then triggers a deployment process in Repository B (the Helm charts).

Helm-Git Plugin Approach:
Using the Helm-Git plugin to deploy directly from the Git repository.
However, I've encountered issues with this plugin during testing and it doesn't seem to work reliably.

Given these two options, I'm leaning towards the first approach, but I'm open to any advice or alternative methods that might be more effective.

Has anyone dealt with a similar setup? What would be the best practice for deploying Helm charts in this scenario? Any tips or suggestions would be greatly appreciated!

Thanks in advance!

https://redd.it/1e2yhb6
@r_devops

Advice on optimizing CI pipelines in Azure DevOps

I have no experience with ci cd pipelines and have to optimize ci pipelines on azure devops.

It’s using classic editor which seems to have limitations. The tasks In the ci pipeline are the asp.net tasks like build, test, restore etc.

The bottleneck is the coverity security scan. What are some things I can look into to reduce the time that is taking?

https://redd.it/1e30vso
@r_devops

Best approach to handle secrets which created manually?

Hey, most of our secrets are generated through terraform with the creation of resources, for example - Redis - users creation - creates a secret and stores it in secrets manager.

Sometimes we have to deal with secrets that we get from third-party tools, like a access tokens.

What you guys think is the best way to handle these kind of secrets? We can just create these secrets in secret manager manually but I dont sure this is the right approach

https://redd.it/1e31fld
@r_devops