Open sourced my AI security scanner

Hey!

I made an open source security scanner powered by llms, try it out, leave a star or even contribute! Would really appreciate feedback!

https://github.com/Adamsmith6300/alder-security-scanner

https://redd.it/1kx8m2v
@r_devops

Grafana setup

Hi, on may I started my first DevOps engineer job as a junior (no previous experience). My first and long time task is setting up grafana dashboards for various apps.

I was able to do so, the dashboards are fully working but now I was given a task to make them universal across the environments (dev/test/prod).

Now, I get the concept of setting it up as a variable, but I am unsure where to go from there. Our sources are named the same "prometheus-app" but the urls are prometheus."environment"...

I thought that building individual queries was the key, that I will just define it there with a variable, but from my understanding that is not possible.

Could you help me find the right way to create such setup? Can it be defined in provisioning?

We're using kubernetes, argocd, helmcharts, prometheus and grafana

I'm sorry if it's a dumb question, I'm still learning a lot and trying my best🙏🏻

Thank you all so much for your help in advance

https://redd.it/1kxad53
@r_devops

K8s operators for self hosted mongoDB?

In one project I am in a situation where self hosting mongoDB in a Kubernetes Cluster may actually be my best option.

I've seen some sweet and, apparently, very well tested and respected postgresql operators and would love to have similar abilities.

Can you recommend what you use, or would use nowadays? Need some initial push in the right direction.

Has any of your operators had any support for sending db backups outside of the cluster (push to S3, instead of just PV snapshots)?

I'm looking at official mongoDB operator, but KubeBlocks looks interesting as well.

https://redd.it/1kxcnuo
@r_devops

Calling Cloud/Cybersecurity Pros: Help My Thesis on Zero Trust Architectures

Hi everyone,

I'm conducting academic research for my thesis on zero trust architectures in cloud security within large enterprises and I need your help!

If you work in cybersecurity or cloud security at a large enterprise, please consider taking a few minutes to complete my survey. Your insights are incredibly valuable for my data collection and your participation would be greatly appreciated.

https://forms.gle/pftNfoPTTDjrBbZf9

Thank you so much for your time and contribution!

https://redd.it/1kxdmq0
@r_devops

Developers please help/guide your junior.....!!!!!

I am about to join college for btech cse in this year. I am currently learning frontend web development, currently i completed html,css and in javascript i am done till DOM Manipulation and event handling (there is still more to learn in java). But i think some time if i complete frontend, should i go for AI-ML or backend because i have little interest in AI-ML. I know basic programming in python because i had CS subject in school. Which will be the good path for me AI-ML or backend and if backend then which language. You may understand me as when you was a newbie you may also wonder about these stuffs. Although my english not too good. And anyone from usict here?

https://redd.it/1kxdy0s
@r_devops

Looking to start a career in DevOps, advice/starting points?

Hello everyone!

First post here but I am currently looking at career prospects. My background was as a primary school teacher, and I have then transitioned into the wonderful world of IT (initially as a field engineer but then was brought in to do 1st and 2nd line support - I am now in a position where when possible I’m assisting our infrastructure team).

I have had it suggested to me that DevOps would be a great career path for me, and it seems like something I could really enjoy. Currently, I have little to no experience in that area it feels, but I am a passionate learner and believe anyone can learn anything given the right support and tools. I have started doing the Scientific Computing with Python course just to begin to get into things.

What tips do you guys have? What should I focus on learning and how did you find is best to learn it? Someone has given me the advice of “just start automating everything” and I currently have that goal in mind but wanted to put it out there to see what is recommended and also, from a career perspective at what point I should look at applying for a junior role.

https://redd.it/1kxcyh7
@r_devops

Any Proxy for Mongodb?

Want to know if there is any Proxy tool available for Mongodb. My use case is I have few Serverless Functions where it connects to Mongo atlas, but since the Serverless IPs are not static I can't whitelist in Mongo atlas network access. I want to route it via a proxy where the proxy will have a static outbound ip. I've tried Mongobetween but it does not have any Auth mechanism leaving the dB wide open.

Is there any proxy or tool or way in which I can handle this use case?

https://redd.it/1kxh01g
@r_devops

I've just assigned you a junior devops engineer. What do you do?

You're the sole devops person at a small SaaS company. After months of asking, you've finally been given an additional devops resource. The catch: despite your insistence, it's a fresh-grad junior engineer with a basic comp-sci degree from an unremarkable school. You must perform your existing workload, which is appropriately sized for a single devops engineer (so clearly this is a fictional scenario) while shaping your new junior into a meaningfully contributing member of your fledgling devops team.

What is your plan?

https://redd.it/1kxgwhx
@r_devops

Best tools for managing Jira tickets that have been assigned to you?

Hey, I suck at this. Great at all of the engineering aspects of my job, but I find Jira to be annoying and difficult to deal with. It kind of acts like a speed bump in my workflow.

We have an on-prem instance and I can generate a PAT.

Does anyone know of tools to make Jira easier to handle? From creating tickets, linking them, logging work, etc?

Or even recommendations for the best ways to manage your account in an on-prem instance to make it easier to deal with a large volume of ad-hoc tasks mixed with epics, sprints, etc?

https://redd.it/1kxmw7a
@r_devops

I think I fucked it up

Hey there

I'm a mid DevOps engineer, Work for a small-mid size company
Yesterday I was trying to implement a Transparent proxy to gain insights of the traffic coming out of the AWS vpc (because right now we don't have any or almost any) and I ended up leaving production down for 9 hours, my fault.

I think that along with my boss, I'm the only one interested in having observability or insights of what's really happening in the project at the network level or the app level, and stop guessing whenever a problem arises at the network, app or costs level, what I mean is that the BE or FE team have no idea of what's going on and just keep pushing features, and the boss of my boss (which also is the CTO of the company I work on) keeps asking us and pushing us about the costs or the performance of the app.

I could be with them in not giving a damn sht about the state of the project, however I don't feel comfortable with that, and I really want to have a compliant project in the most way.

Now I'm concerned about getting fired lol, this has been my first DevOps job, but it is what it is, and if I have to go, then I will have to accept it.

Also for you guys I will be glad to hear about how getting involved in today's jobs hiring process, like which skills I have to know and how to differentiate myself from the others.







https://redd.it/1kxng5w
@r_devops

Practical DevSecOps Course 1/10

Hi all,

Earlier this year I purchased the CDP course from Practical DevSecOps. I remember being on the fence about it and read some posts here and even though I wasn't 100% sold on it, went ahead and purchased it.

I wanted to make this post so others could find it before purchasing it. The course is the worst course I HAVE EVER TAKEN! The videos (there's not many of them) appear to be AI generated and they simply read the pdf or doc you get access to for each module. The labs are just copy/paste. There's not a lot of learning.... they just give you what to paste in a terminal window.

At the end, they give you a gitlab file that outlines an entire pipeline. This is ok but you could easily just use GitLab's own study resources/docs to build this or find an example.

Lastly, the whole certification part is literally useless. No one even knows (or cares) about their certs. The certification has no value in the industry.

I know they have other courses like API security that look interesting tbh and some other ones. Those might be better, but the DevOps Pro one is not great. I found it to be repetitive, boring, and ultimately not worth the cost.



https://redd.it/1kxoa7y
@r_devops

Hybrid Cloud-Edge Architecture: Balancing On-Prem Security with SaaS-like UX - Seeking DevOps Perspectives

Hey DevOps community,

I'm working on an interesting architecture for Ceneca (ceneca.ai) and would love your thoughts.

We're building an on-premise AI data analyst tool with a twist - trying to provide a SaaS-like experience while keeping all data processing strictly on-prem⁠⁠.

Our current approach involves:

1. Docker-based deployment for the core agent⁠⁠​Outbound mTLS tunnel to a cloud portal for UI access⁠⁠​

2. SSO integration (Okta/Azure AD) for authentication⁠⁠​

3. Zero data storage in the cloud - only encrypted query results traverse the tunnel⁠⁠​

Some questions:

1. What potential security vulnerabilities should we be watching out for in this hybrid architecture?

2. How would you handle scaling and high availability in this setup?

3. What monitoring and observability practices would you recommend for tracking the health of the mTLS tunnel?

Would love some thoughts, thanks. Please let me know if you think the present approach is over-engineered or can be simplified.

https://redd.it/1kxlzae
@r_devops

How should a beginner start learning DevOps in 2025? What courses, tools, or paths do you recommend?

I'm completely new to devops but very interested in starting a career in it, i have some basic programming knowledge in web dev(Reactjs) but I'm not sure what the best starting point is , is there any course you would recommend i start with ? Thank you.

https://redd.it/1kxtz0f
@r_devops

The skills no one teaches engineers: mindset, people smarts, and the books that rewired me

I got laid off from Amazon after COVID when they outsourced our BI team to India and replaced half our workflow with automation. The ones who stayed weren’t better at SQL or Python - they just had better people skills.

For two months, I applied to every job on LinkedIn and heard nothing. Then I stopped. I laid in bed, doomscrolled 5+ hours a day, and watched my motivation rot. I thought I was just tired. Then my gf left me - and that cracked something open.

In that heartbreak haze, I realized something brutal: I hadn’t grown in years. Since college, I hadn’t finished a single book - five whole years of mental autopilot.

Meanwhile, some of my friends - people who foresaw the layoffs, the AI boom, the chaos - were now running startups, freelancing like pros, or negotiating raises with confidence. What did they all have in common? They never stop self growth and they read. Daily.

So I ran a stupid little experiment: finish one book. Just one. I picked a memoir that mirrored my burnout. Then another. Then I tried a business book. Then a psychology one. I kept going. It’s been 7 months now, and I’m not the same person.

Reading daily didn’t just help me “get smarter.” It reprogrammed how I think. My mindset, work ethic, even how I speak in interviews - it all changed. I want to share this in case someone else out there feels as stuck and brain-fogged as I did. You’re not lazy. You just need better inputs. Start feeding your mind again.

As someone with ADHD, reading daily wasn’t easy at first. My brain wanted dopamine, not paragraphs. I’d reread the same page five times. That’s why these tools helped - they made learning actually stick, even on days I couldn’t sit still. Here’s what worked for me:
- The Almanack of Naval Ravikant: This book completely rewired how I think about wealth, happiness, and leverage. Naval’s mindset is pure clarity.

- Principles by Ray Dalio: The founder of Bridgewater lays out the rules he used to build one of the biggest hedge funds in the world. It’s not just about work - it’s about how to think. Easily one of the most eye-opening books I’ve ever read.

- Can’t Hurt Me by David Goggins: NYT Bestseller. His brutal honesty about trauma and self-discipline lit a fire in me. This book will slap your excuses in the face.

- Deep Work by Cal Newport: Productivity bible. Made me rethink how shallow my work had become. Best book on regaining focus in a distracted world.

- The Psychology of Money by Morgan Housel: Super digestible. Helped me stop making emotional money decisions. Best finance book I’ve ever read, period.


Other tools & podcasts that helped
- Lenny’s Newsletter: the best newsletter if you're in tech or product. Lenny (ex-Airbnb PM) shares real frameworks, growth tactics, and hiring advice. It's like free mentorship from a top-tier operator.

- BeFreed: A friend who worked at Google put me on this. It’s a smart reading & book summary app that lets you customize how you read/listen: 10 min skims, 40 min deep dives, 20 min podcast-style explainers, or flashcards to help stuff actually stick.

it also remembers your favs, highlights, goals and recommend books that best fit your goal.

I tested it on books I’d already read and the deep dives covered ~80% of the key ideas. Now I finished 10+ books per month and I recommend it to all my friends who never had time or energy to read daily.

- Ash: A friend told me about this when I was totally burnt out. It’s like therapy-lite for work stress - quick check-ins, calming tools, and mindset prompts that actually helped me feel human again.

- The Tim Ferriss Show - podcast – Endless value bombs. He interviews top performers and always digs deep into their habits and books.

Tbh, I used to think reading was just a checkbox for “smart” people. Now I see it as survival. It’s how you claw your way back when your mind is broken.

If you’re burnt out, heartbroken, or just numb - don’t wait for motivation. Pick up any book that speaks to what you’re

feeling. Let it rewire you. Let it remind you that people before you have already written the answers.

You don’t need to figure everything out alone. You just need to start reading again.

https://redd.it/1kxuufw
@r_devops

Self-hosted IDP for K8s management

Hi guys, my company is trying to explore options for creating a self-hosted IDP to make cluster creation and resource management easier, especially since we do a lot of work with Kubernetes and Incus. The end goal is a form-based configuration page that can create Kubernetes clusters with certain requested resources. From research into Backstage, k0rdent, kusion, kasm, and konstruct, I can tell that people don't suggest using Backstage unless you have a lot of time and resources (team of devs skilled in Typescript and React especially), but it also seems to be the best documented. As of right now, I'm trying to set up a barebones version of what we want on Backstage and am just looking for more recent advice on what's currently available.

Also, I remember seeing some comments that Port and Cortex offer special self-hosted versions for companies with strict (airgapped) security requirements, but Port's website seems to say that isn't the case anymore. Has anyone set up anything similar using either of these two?

I'm generally just looking for any people's experiences regarding setting up IDPs and what has worked best for them. Thank you guys and I appreciate your time!

https://redd.it/1kxtbhl
@r_devops

Suggestion on a DevOps project ...

Hey guys, I am planning to build some DevOps projects for my portfolio and I need your help. I do not want to create a project on something I have already thoroughly worked on like CI/CD pipelines, K8s clusters, Serverless Containerizations.

What I want to build is real solution that solves a real DevOps problem, perhaps an automation, or a wrapper over Terraform, maybe something using Ansible, etc. Basically, I want to it to be super specific at the same highlight my knowledge. To give you an example, in my previous work place I had to make a CLI tool for automatic Backups from on-prem to Cloud. It was a very elaborate tool.

With that in mind, if guys can share such issues/incidents/tickets from present or past that can help me devise a solution would be a great help. I really tried brainstorming ideas but I am having difficulties with it.

Thanks in advance guys!

Edit: I would be super interested in making Terraform Wrappers because I have never done that, but I am struggling to narrow down a use case.

https://redd.it/1kxvgdd
@r_devops

Writing policies in natural language instead of Rego / OPA

There are 2 problem with Open Policy Agent and the Rego language that it uses under the hood:

1. It is cumbersome, so writing even a single policy takes a lot of effort
2. Each policy project needs to start from scratch because policies aren't re-usable

Combined, these two problems lead to the reality that's far from ideal: most teams do not implement policy-as-code at all, and most of those who do tend to have inadequate coverage. It's simply too hard!

What if instead of Rego you could write policies as you'd describe them to a fellow engineer?

For example, here's a natural language variant of a sensible policy:

> No two aws_security_group_rule resources may define an identical ingress rule (same security-group ID, protocol, from/to port, and CIDR block).

But in Rego, that'd require looping, a helper function, and still would only capture a very specific scenario (example).

We initially built it as a feature of Infrabase (a github app that flags security issues in infrastructure pull requests), but then thought that rule prompts belogs best in GitHub, and created this repo.

PLEASE IGNORE THE PRODUCT! It's linked in the repo but we don't want to be flagged as "vendor spam". This post is only about rules repo, structure, conventions etc.

Here's the repo: https://github.com/diggerhq/infrabase-rules

Does it even make sense? Which policies cannot be captured this way?

https://redd.it/1kxzssj
@r_devops

Showcasing non-IT work experience vs relevant projects on resumes?

Hey everyone, I wanted to get your thoughts, insights or advice on the matter regarding work experiences and projects. So typically, for recruiters, hiring managers, and employers, work experience (i.e. internships, jobs, etc.) is valued over projects, especially since it establishes one's work history and years of experience. However, when job seekers are applying to roles that have a specific industry or niche (i.e. DevOps, software development, cybersecurity, database administration), my understanding is that employers will prioritize work experiences that involve the technical skills, roles, and responsibilities associated with them.

Given this case, what would be the case then for work experiences that are not directly related (or even irrelevant) to the targeted job roles? Take for instance, I have past work experience in project management, outreach and recruitment, higher education, etc. These industries are essentially non-IT, in comparison to the more technical IT roles related to software development, DevOps, etc. Yet, different projects I've undertaken use relevant technologies and tools that are used by professionals within the IT industry.

What do employers and hiring managers ultimately prioritize for resumes? Should all work experience be included as much as possible, regardless of whether they're unrelated to the targeted job roles? Or should job applicants consider sacrificing irrelevant jobs in favor of the more relevant projects? (I forgot to mention that this is mostly geared towards junior / entry-level / mid-level roles)

https://redd.it/1ky232c
@r_devops

Beginner’s Guide to the Grafana Open Source Ecosystem Blog

I’ve been exploring the LGTM stack and put together a beginner-friendly intro to the Grafana ecosystem. See how tools like Loki, Tempo, Mimir & more fit together for modern monitoring.

https://blog.prateekjain.dev/beginners-guide-to-the-grafana-open-source-ecosystem-433926713dfe?sk=466de641008a76b69c5ccf11b2b9809b

https://redd.it/1ky3rpk
@r_devops

To all the new prospects

It's good to see so many new people interested in DevOps. Our field definitely needs fresh perspectives. But I've seen a common issue. A lot of folks entering DevOps, especially if they're coming straight from college or some internships, don't always have a gut feel for the intense, unpredictable side of live operational work. They might know about certain tools, but they haven't always built up the deep resilience or the sharp, practical problem-solving skills you get from really tough, real-world challenges.

Think about what it's like on a working fishing boat. Imagine a vessel where its constant, reliable operation is absolutely essential for the crew to make their living. At the same time, this boat is often run on a tight budget, meaning ingenuity and making the most of what you have are more common than expensive, easy fixes. This boat isn't for fun. It's a vital piece of equipment. People's livelihoods and their safety absolutely depend on it running reliably, day after day. That makes its operation critical. And with limited resources, every repair or challenge demands clever solutions. You've got to make do, get creative, and find smart ways forward with what you've already got.

Things inevitably go wrong on that boat. Often it happens far from shore, in bad weather or tough conditions. When that occurs, the results are immediate and serious. An engine failure isn't some abstract problem. It’s a critical situation that needs to be diagnosed and fixed right now, with practical skills. There's no option to just pass the problem up the chain. That kind of environment forces you to become truly resourceful. It teaches you to solve complex problems when you're under serious pressure. You learn to understand the whole system because one small failure can affect everything else. You also develop a real toughness and a calm focus. Panicking doesn't help when you're dealing with a crisis.

This type of experience, where you're constantly adapting and learning by doing, with real responsibility and clear results, is incredibly valuable. It builds a kind of practical wisdom and resilience that's tough to get from more sheltered learning situations. Some internships are great for introducing tools. But they might not expose you to the actual stress and uncertainty of a live system failure. They may not show you how to make critical decisions when you don't have all the answers.

The parallels to the DevOps world are strong. We manage systems that are absolutely production critical. When they fail, the impact is right now, affecting users, company money, and its reputation. And while some companies have huge budgets, many DevOps teams work with limits. They need to find smart, efficient solutions instead of just throwing more money at every problem. We need people who can think on their feet. We need folks who can diagnose tricky issues across connected systems and stay effective when the pressure is high. We need that same ingenuity and resilience you'd find on that fishing boat, the kind that comes from real necessity.

So, if you're looking to build a solid foundation for a DevOps career, I'd really encourage you to look for experiences that genuinely challenge you. Find situations that force you to develop these core skills. Don't just focus on learning tools by themselves. Try to understand how systems actually work, how they break, and how you can fix them when the stakes are high. It's often true that the most effective people in DevOps also have a strong track record as successful developers. They don't just know that systems operate; they understand how they are built from the code on up. That deep insight is incredibly valuable. It’s also a fundamental truth that operating a system is only as good as its implementation. You can't effectively run or automate something that was poorly designed or built in the first place. No amount of operational heroism can truly make up for a flawed foundation.

Look for opportunities that push you to be resourceful, to take real ownership, and to keep