My open-source project makes bootable OS images from Docker Containers. Can this be valuable somehow?

I made an open-source project PockerISO a few years ago where I use Hashicorp's Packer to create bootable ISO images for Ubuntu, Debian, Alpine using Docker Containers.

Recently I bumped the versions to Alpine 3.21, Debian Bookworm and Ubuntu 24.04.

This was just a hobby project, so never intended it to do anything hardcore.

However, I do tend to note that the ISO images are lighter and don't trawl in may bloated software (snap from Ubuntu etc.).

I am aware of other projects that do something similar like linuxkit and maybe Flatcar too i.e., use containers to build ISO images.

Any opinions, feedbacks, suggestions on if it might be worth looking into it more or can I let it float in the ether of many Side-Project OS repos?

https://redd.it/1ikmnh4
@r_devops

How do you keep track of "inventory"?

Hello,

I am facing this problem again and again, in different companies with different teams.

How do you keep inventory of resources. For example what Kubernetes clusters are there, what is deployed on the said clusters, what versions are the tools on it(e.g. nginx ingress, argocd). What RDBMS are currently running for which project, what version are they, should they be updated any known CVEs and others of this fashion (pet service running on VMs is a broad category)

What I do is write this down in Confluence/Sharepoint generally including information about why the services is deployed, how can it be reached(IPs/DNS), notes about patching (incl. version, next patch time etc..) and links to other documents about the system(i.e. playbooks during incidents, compliance documents). But this whole thing has always costed me a lot of time.

Solutions like SnipeIT aren't very useful in this context at least for me.

https://redd.it/1iko0pp
@r_devops

which Project Should I Choose?

Hey everyone! I'm planning to start a new project and I'm torn between these two ideas:

1️⃣ A complete, secure, and automated Kubernetes platform with:
✅ GitOps (ArgoCD, Terraform, Helm)
✅ High availability (HA) and resilient storage (Ceph, Velero)
✅ Security-first approach (Vault, mTLS with Istio, strict RBAC)
✅ Observability stack (Prometheus, Grafana, Loki, Jaeger)
✅ Hybrid support (containers + KubeVirt for legacy VMs)

2️⃣ A DevSecOps-focused project for securing and optimizing microservices deployment across multi-cloud/multi-cluster setups:
✅ Security automation (SAST/DAST with Trivy, Snyk)
✅ Centralized observability (Prometheus, Grafana, Loki, Jaeger)
✅ Automated deployments (ArgoCD, Helm)
✅ Network security & policies (Calico, Cilium)
✅ Secure CI/CD & Canary deployments

I’m looking for something challenging yet practical, ideally open-source friendly. Which one do you think is more valuable? Or if you have any suggestions for a better idea, let me know! 😊

https://redd.it/1ikp2dd
@r_devops

About SSL certs in K8S

We are offloading SSL on ingress. Security team says that do not keep ssl certs in secrets . We are keeping certs in secrets for ingress.
In fact security team wants to put certificate nowhere just in memory

I thinks keeping certs in secret is best we can do

What do you guys think ? How are you managing certs ?
Is security team asking too much ?



https://redd.it/1ikq0os
@r_devops

Acquired by a company 10x bigger with a different cloud

We use GCP in my shop, with which I feel pretty familiar after several years of managing.

The acquiring company uses AWS, which I can fumble my way through resource-wise since there's a lot of similarities, but I'd rather not just sloppily learn on the job when I'm integrated into a new team that's been doing this for years. Obviously, ramp up time will be necessary. I just want to minimize it.

Are there are relevant certs, courses, or projects for learning AWS as an old hand at GCP?

Perhaps a more juicy question that's less google-able - any advice for merging two sets of SRE culture, tooling, etc. like I'm about to? We're probably going to adopt 90% of their practices into our product, but I hope we can preserve some of the good stuff we have (like Nix as our dev env/build system 🤞)

https://redd.it/1iks97o
@r_devops

hi guys, do you maybe use somekind of a ticket estimation tool?

Hi guys, do you maybe use a ticket estimation tool? Cause I remember using it when I was working as an python developer. But never used it in a devops role before.


Thanks,

Tom

https://redd.it/1ikskmo
@r_devops

How to reduce the cost of traffic from America?

I have a server in Germany on GCP with a large number of pages, everything that could be transferred to CDN from images to style files.



Google often bypasses our site and thus generates a lot of traffic, which is why the bill at the end of the month has risen quite a bit, about 30% and I would like to ask you about a possible loophole or something else



The only way I see so far is to buy a second similar server and place it in America and make it take the nearest server in DNS, thereby minimizing the cost of traffic, but maybe there is something else that I don’t know about, please tell me

https://redd.it/1ikuij2
@r_devops

CI/CD tool to extract SQL queries

Hello, I'm looking for a tool to integrate in a pipeline that would extract the SQL queries from files in certain folder to separate file.

I'm working with Salesforce and Apex langues, and queries are looking like that:

List<Account> accounts = [SELECT Id, Name, Category__c FROM Account WHERE Industry = :industryParam];


String query = 'SELECT ProjectId__c from Project__c', nameToSearch = 'pp2';
List<sObject> projectList = Database.query(query + ' WHERE Name__c = :nameToSearch');

It probably is doable with some complicated regexes, but I'm wondering if there are dedicated tools for it.




https://redd.it/1il5b4e
@r_devops

I have a 45 technical assignment + interview coming up for a devOps/are intern position. What could that technical assignment potentially be?


45 minute interview*

Responsibilities of the role are:

1. Contribute to our production infrastructure (AWS, Kubernetes, PostgreSQL databases, Terraform, Helm)

2. Help triage and fix high-risk security and privacy issues in infrastructure and application components

3. Help implement security enhancements to our SDLC. Think continuous security monitoring: static code analysis pre-deploy (iroh.js, snyk.io, etc.), post-deploy (Zap), binary authorization, package signature, Terraform (tfsec)

4. Improve our data repositories (db, warehouse, lake) posture: engine upgrade, zero-downtime migrations, privacy taggings.

They’d also like an ideal candidate to have with experience in any of AWS, Datadog, Github Actions, k8s, with bonus points for knowing any of Terraform, Python, GNU/Linux, Burp Suite, and as a DBA (PostgreSQL).


https://redd.it/1il8nrn
@r_devops

What’s the current state of internal facing runbooks for other business units?

I'm trying to find a product that does runbooks in a way that exposes them as little automation jobs that are neatly exposed to nontechnical internal people like customer support. The UX should be dog simple from the user POV. Navigate to a given runbook, fill in some details like maybe some text boxes/dropdowns with dynamic values, maybe upload a file, then hit run as the runbook does its thing. The tools I've most experienced are either limited in expressing those UI options or only give a very shallow "runbook" experience like expecting the user to supply terraform code themselves. It should go without saying that audit logs for everything are a must.

Is there anything out there like that? I would be over the moon for meta-runbooks (a runbook for batches of other runbooks). Thanks

https://redd.it/1il9tpj
@r_devops

Security scanning during CI/CD flows

Hello all!

In my organization we are keen to buy SaaS solution for security scanning of our code to catch up all problems with packages, code etc. I am not interested in code quality, i am interested in code security only.

I found solutions like:

\- Sonar Qube
\- Klocwork
\- Qodana
\- Data Dog Application Security
\- Prisma Cloud

Wanna try and compare security reports from all of these tools. Do you have any other recommendations? In my organization we are coding in .NET, Python, Terraform and Bicep. Over 2mln lines of code right now. Any advice of the tooling? To be honest, Sonar Qube looks most interesting (and i have some experience with it) but maybe they are some competitors on the market that covers security well?

https://redd.it/1il9qrx
@r_devops

Tech live vs traveling


Hey everyone,

I recently started working as a DevSecOps intern at a fintech company, and I’m really excited about diving deeper into the DevOps world. At the same time, I love traveling alone, meeting new people, and experiencing different cultures. I speak fluent English, Portuguese, and some Spanish, which makes it easier to connect with others.

Looking ahead, I want to balance my background in Computer Science with opportunities in the commercial world. Maybe something that allows me to work internationally while leveraging my technical skills.

For those of you with experience in DevOps or similar fields, do you have any recommendations? What paths should I explore if I want to combine tech, business, and international opportunities? I’d love to hear your insights!

Thanks!

https://redd.it/1ilcg2u
@r_devops

My first Kubernetes Operator: Kubeconfig Operator


I'm trying to break from DevOps into jobs that involve more development. Currently, operator development seems like the obvious thing.

Recently, I read a post by the Reddit engineer u/keepingdatareal about their new SDK to build operators: [Achilles SDK](https://www.reddit.com/r/RedditEng/comments/1gp11ui/open_source_of_achilles_sdk/). It allows you to specify Kubernetes operators as finite state machines. Pretty neat!

So I decided to use it to build a [Kubeconfig Operator.](https://github.com/klaudworks/kubeconfig-operator) It is useful for anybody who quickly wants to hand out limited access to a cluster without having OIDC in place. I also like to create a "daily-ops" kubeconfig to protect myself from accidental destructive operations. It usually has readonly permissions + deleting pods + creating/deleting portforwards.

https://preview.redd.it/ax5miv42q3ie1.png?width=1954&format=png&auto=webp&s=53e3fdfbf6836bf9ffa65167b3726f79efda8e4c

Unfortunately, I can just add a single image but check out the repo's [README.md](https://github.com/klaudworks/kubeconfig-operator) to see a graphic of the operator's behavior specified as a FSM. Here is a sample Kubeconfig manifest:

apiVersion:
kind: Kubeconfig
metadata:
name: restricted-access
spec:
clusterName: local-kind-cluster
# specify external endpoint to your kubernetes API.
# You can copy this from your other kubeconfig.
server: https://127.0.0.1:52856
expirationTTL: 365d
clusterPermissions:
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- list
- watch
namespacedPermissions:
- namespace: default
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- '*'
- namespace: kube-system
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watchklaud.works/v1alpha1

If you like the operator I'd be happy about a Github star ⭐️. The core logic is already fully covered by tests. So feel free to use it in production. Should any issue arise, just open a Github issue or text me here and I'll fix it.

https://redd.it/1ild9uh
@r_devops

Best course\practices for devops beginner?

Hi guys, im a CS BSc graduate, and i've decided that development, tho is fun, is not AS fun as deployment and i rather change my direction to the Devops proffesion. Since the market in Israel, where i live, is really tough for juniors, so i've decided to enter a program that will train me in some sort of a bootcamp, then in the middle of it, they are applying me to starting devops positions (and before u guys say its a scam and i wont find a job, you should know that they get their profit from my salaries, so no job = no money for them, which means its basicly in thier intrests).

So in order to prepare for this 6 months bootcamp, i'd like to start and do like a udemy course or some other training, what would you recommand me to do? i have lik a month and a half and alot of time to spend, so dont spare the hard part, im here to learn!

thanks alot and sry if i was talking too much, cheers and have a great week!

https://redd.it/1ilcce7
@r_devops

Cloudtrail logs view

What are the ways do you view Centralized CloudTrail logs in S3 bucket?

We have bunch of AWS accounts and we have enabled Centralized CloudTrail and they are shipped to S3 bucket.
How you guys check Cloudtrail logs shipped to S3 bucket.
I know We can query via Athena , but its seems taking lot of time . Any way it can be optimized ?

or any opensource tools you use



https://redd.it/1ilfc4s
@r_devops

Has anyone used Antimetal for cost analysis

My boss is pushing it a bit so I've booked in a demo. I was wondering if anyone here has tried it successfully or otherwise. To me it doesn't seem like it provides much more than the basic cost analysis tools in AWS.

https://redd.it/1ili0s7
@r_devops

Managing API Keys in Large Dev Teams: How Do You Tackle It?

I’ve been grappling with an issue at work that seems partially solved. We’re a team of 60 developers working with multiple third-party services like Polygon, Slack, Zoom, and SendGrid. The challenge is managing API keys securely—ideally, we’d have one API key per developer to maintain tight security. But this leads to significant overhead, especially when developers leave and we need to revoke and reissue keys.



Currently, we’re considering a solution where a service would act as a proxy. We’d register our third-party integrations, and developers would access these services through a single endpoint that manages authentication via our Identity Provider (IDP). Essentially, each developer uses their IDP token to make requests, isolating individual API keys from direct developer access.


I’m really curious to know:

• How are you all managing API keys, especially in larger teams?
• Have you implemented any systems or tools that have streamlined this process?
• Would a proxy-based solution like the one I described be helpful in your setup?


thx.

https://redd.it/1ilj0xl
@r_devops

FontRegister: Manage, Install and Uninstall Windows Fonts with Ease (CLI + C#)

Hey everyone,

I wrote FontRegister to solve a simple but annoying problem: installing and uninstalling fonts on Windows via cmdline without jumping through hoops.

Why use FontRegister?

Easy CLI Commands, easy automation!
fontregister install [paths...] to install fonts from files or folders
`fontregister uninstall [fontNames...]` to remove them by name, path, or filename

Bulk Operations: Install or remove multiple fonts in one go, including entire directories.
Immediate Refresh: Notifies Windows so new fonts show up in apps like Word, Photoshop, etc., right away—no restarts needed.
User or Machine Scope: Use --user (default) or --machine to install for all users (requires admin privileges).

Quick Example:

# Install fonts from folder and file for current user
fontregister install "C:/MyFonts" "C:/MyFonts/SomeFont.ttf"
fontregister install "C:/MyFonts" --machine
# Reinstall fonts if you are a typographer
fontregister install --update "c:/folder" "c:/font.ttf"

# Uninstall by font name
fontregister uninstall "SomeFontName"
fontregister uninstall "C:/AllFontsInThisDir" --machine


# Clear font cache
fontregister --clear-cache

# Just notify windows that fonts changed
fontregister --clear-cache

It’s also available as a pure C# library if you’d rather automate font management in your .NET apps / through code or powershell.

Links:

GitHub: [github.com/Nucs/FontRegister](https://github.com/Nucs/FontRegister)
NuGet: FontRegister

Would love your feedback or contributions—check out the README on GitHub for more details!

https://redd.it/1iliql2
@r_devops

Crossplane Selling points in 2025?

I am in an interview process with an org using Crossplane and I have been doing some homelab stuff with it as I have not used it before. I've been using k8s for 6 years and Terraform for 8. I've also previously used CloudFormation, SAM, SaltStack and Ansible and played with Pulumi and CDK. I'm trying to 'get' the point of Crossplane. AFAICT the selling points are (supposed to be):

1. True GitOps model
2. Everything is a Kubernetes resource
3. Resources become API endpoints for developers
4. Fine grained permissions on providers made available to developers

Whilst it does 'work', at least in a homelab setting, I am struggling to see the advantage over the alternatives.

# True GitOps model

This seems like weak sauce. A change- in a repo, or a deployment- triggers an agent in a kube pod to do stuff with cloud providers APIs. OK, so if I have a GitHub|Lab runners on my cluster which I am triggering on a webhook then I don't see a practical difference. I can see the advantage of, e.g. ArgoCD 'pulling' rather than a deployment service pushing but by the time I've set everything up in kube I could just as easily have some autodeployment rules with webhooks.

# Everything is a Kubernetes resource

Ok, and? I don't get why this is a selling point. Kube is a platform not a goal. Sure I can understand why people don't want to fuss with Terraform when everything else is in Typescript or Python or whatever but was anyone really asking to have everything in Kube?

# Resources become API endpoints for developers

Maybe I have not explored enough yet but I am not seeing how this is an advantage over the cloud providers' own APIs

# Fine grained permissions on providers made available to developers

Golden rule of security - don't roll your own. If you're using AWS, GCP, Azure, etc then you're using their security model. Cannot see the advantage in adding another layer on top from a thrid party that may become fuxxored

# My own observations

# k8s complexity

Kube has an in (IMO) deserved reputation for complexity. Ignoring for a moment the tiny number of 'pure' kube enthusiasts and looking to the rest of us who primarily want to get things done, Crossplane brings in kube as a dependency for a whole bunch of stuff that otherwise wouldn't/doesn't need it. That means all of the complexity of Kube when you don't otherise need it...

# YAML

Everything has to be encoded in YAML. Right... So manipulating data structures and loops in Terraform wasn't bad enough? Someone looked at that, Cloudformation, CDK and Pulumi and went 'hold my beer'. YAML is (in my view) a lowest common denominator. All the stuff people bring in to address YAML shortcomings, e.g. `source` (hi GitHub); YAML anchoring/`depends` (hi GitLab); `Generators` (hi ArgoCD) is **not** YAML native - it's an abstraction to pass through to another engine, because of course we don't already have enough ways of doing a `for` loop or handling `if`/`else`... Oh yeah, and everyone's top ask was 'let me write more YAML'.

# No state management

There isn't any obvious state management or record and so no source of truth. 'Truth' seems to be just 'whatever I have in my manifest'?

# No dry run/plan/Changesets

Unless I'm mistaken I'm flying blind if I'm asked to approve anything with regard to Crossplane. There's no dry run/plan output to show me the epxepcted impact of a proposed change.

# Modules

Maybe I'm missing something but I'm not seeing any modules or the like for Crossplane, so I'm doing literally everything myself there. So those modules I used to terrafrom my cluster and it's VPC? They're my last...

# Dead sub?

At the time of writing the 3 most recent posts on [https://www.reddit.com/r/crossplane/new/](https://www.reddit.com/r/crossplane/new/) are from:

* 15 days ago
* 2 months ago
* 4 months ago

So. Can someone point to a key thing with Crossplane that makes it preferable to the alternatives?

https://redd.it/1ilmkrt
@r_devops

How often do you guys use SSH?

I personally find it a huge hassle to jump to several severs and modify the same configuration manually. I know there are tons of tools out there like Ansible that automate configuration, but my firm in unique in that we have a somewhat small set of deployments in which manual intervention in possible, but automation is not yet necessary.

Curious if fellow Dev Ops engineers have the same issues / common patterns when interacting with remote severs, or it is mostly automated now days? My experience is limited so hard to tell what happens at larger firms.

If you do interact with SSH regularly, what’s the thing that slows you down the most or feels unnecessarily painful? And have you built (or wished for) a better way to handle it?

https://redd.it/1ilnf0x
@r_devops

Devops/DevSecOps graduation thesis ideas?

I'm currently working on my graduation thesis and looking for interesting topics related to DevOps/DevSecOps. I want to explore something that is both academically relevant and practically useful in the industry. I'm working as a software engineering now, but I have some certs in cloud, as AZ-104.

Some areas that have caught my attention include:

Security automation in CI/CD pipelines
Comparing traditional DevOps vs. DevSecOps implementations
Zero Trust security models in DevOps environments
Security in Cloud

I'm open to suggestions, especially if you've worked on a similar topic or have insights into emerging trends. Any recommendations or resources would be greatly appreciated!

https://redd.it/1ilqcgy
@r_devops