Anyone actually happy with their API security setup in production?

We’ve got 30+ microservices and most are exposing APIs; some public, some internal. We're using gateway-based auth and some inline rate limiting, but anything beyond that feels like patchwork.

We’re seeing more noise from bug bounty reports and struggling to track exposure across services. Anyone got a setup they trust for real API security coverage?

https://redd.it/1m7j8gj
@r_devops

Jenkins pipeline deploying NPM library to Sonatype Nexus Repo

Hi! I'm trying to deploy my custom NPM library to my repo using jenkin's pipeline,

I already have done this with maven artifacts but I need help to adjust the step to push a npm lib,

so far my stage looks like this:

   stage('push artifact to nexus') {
      steps {
        nexusArtifactUploader artifacts: [
          artifactId: 'custom-npm-lib',
          classifier: '',
          file: '???',
          type: 'tar???'],
        credentialsId: 'ffffffff-ffff-ffff-ffff-ffffffffffff',
        groupId: '????',
        nexusUrl: 'my-nexus-hostname:8584',
        nexusVersion: 'nexus3',
        protocol: 'http',
        repository: 'my-npm-repo',
        version: '0.0.1'
      }
   }

so, the question is, do I do a 'npm publish' o 'npm deploy'?? or whats the equivalent to mvn package? then, what would it be an example of nexusArtifactUploader to push the lib to the repo? thnx in advance

https://redd.it/1m7mgb4
@r_devops

Performance regression testing on PRs

Curious how teams approach performance regression testing on PRs. At what stage or scale does automating these checks (e.g., latency, throughput, resource usage) become a mission-critical part of your workflow, versus a nice-to-have? What triggers that shift on your teams?

https://redd.it/1m7qvvz
@r_devops

Looking for a DevOps Mentor (K8s, Helm, Jenkins, Vault, Terraform, Jira Integration, Monitoring & Logging)

I’m Ujjwal, currently on a focused journey to sharpen my DevOps skills and step up to the next level. I’ve been working hands-on with AWS, Docker, Kubernetes, and CI/CD pipelines, and I’m now looking for a mentor who can guide me with real-world practices and insights.

I’m especially looking to learn from someone experienced in:
🔹 Kubernetes (K8s) – Deployments, Services, Ingress, Node Affinity, etc.
🔹 Helm – Chart templating, custom values, production deployments
🔹 Jenkins – Declarative pipelines, GitHub/webhook integration
🔹 Vault – Secrets management in Kubernetes and CI/CD
🔹 Terraform – Infrastructure as Code (AWS preferred)
🔹 Jira Integration – With GitHub/Jenkins for DevOps workflows
🔹 Monitoring & Logging – Prometheus, Grafana, Loki, ELK stack

I’d love to connect with a mentor (even informally — weekly chat or async DMs) who’s worked in production environments and can share tips, common pitfalls, and guidance.

https://redd.it/1m7rtgs
@r_devops

Aspire: modeling distributed systems without YAML or glue code

We’re building a new toolchain for distributed apps, and we’d love your feedback

Hi everyone 👋

I help work on Aspire, a toolchain we’re building at Microsoft to make it easier to develop and operate distributed applications. Aspire started as a dev-first way to model multi-service .NET apps, but it’s evolving into something broader: a polyglot, code-first way to define, run, test, and (eventually) deploy full systems.

It handles things like:
• Service discovery and dependency modeling
• Container orchestration (locally or remotely)
• Config and connection string wiring
• Built-in OpenTelemetry support
• A dashboard that understands your actual app graph

We just published our public roadmap (https://github.com/dotnet/aspire/discussions/10644) outlining where we’re headed over the next 6 months. Key themes include:
• Better support for Python and JavaScript
• Real testing tools (dashboards, mocking, CI replay)
• Multi-environment deployment modeling
• Clearer CI/CD guidance (yes, we know this is rough right now)
• Less glue, less YAML, more visibility

We’re also using Aspire internally at Microsoft to build real services, so the feedback loop between devs and the platform is tight.

If you’ve ever wired up a bunch of containers, env vars, secrets, and config files just to get a “basic” system running… this is the kind of pain we’re trying to reduce.

📣 We’d love your take:
• What’s missing from your dev/test/deploy workflows?
• Would something like this help (or get in the way)?
• What’s too “magic”? What would you want to control?

Would love to hear your thoughts, and if you want to hang out or ask questions live, we just opened a Discord: aka.ms/aspire-discord

Thanks for reading!


https://redd.it/1m7tq8g
@r_devops

Late-Bloomer Sysadmin (35, Family Plans) – DevOps or Cloud Engineering for Career Growth?

Hi everyone,

I’m a 35-year-old sysadmin! I’m a late bloomer in IT, with about two-three years of beginner-level experience. I’m married, planning to start a family soon, and currently working remotely with decent but not great pay. My job is stable but bit boring to me, so I’m looking to switch to a future-proof career that offers better pay, remote flexibility, and work-life balance.

Right now, I’m torn between DevOps and Cloud Engineering. I like automation, which points me toward DevOps, but I’m concerned about the steep learning curve. Cloud engineering feels closer to my current sysadmin role but might be less exciting and not sure about the learning curve too.

I can dedicate 1–2 hours a day for studying during the initial phase of this career transition. How tough is the learning curve for each path? Which is easier to transition into for someone like me? And which offers better long-term growth and opportunities in today’s job market for a late starter?

FYI: Not limited to DevOps or Cloud only — please feel free to share other options as well!"

Please kindly don't give the generic "Age is just a number thingy, but I’d really appreciate some brutally honest advice." Thanks in advance for any practical advice!

https://redd.it/1m7rtfx
@r_devops

azure app services - containers deployment

Hello everyone,

recently I've got an issue with one func app and one web app, both linux. the old deployments was packing the app as a zip and deployed on those 2 app services. my issue came after I tried to deploy as a container. on deployment history, and on portal it's clearly says that was deployed from container. even the app service dont startup with the wrong docker credentials. but i have found that those app services are still reading from the old .zip that remained on those app services even of i deploy as a container.

does anybody encountered this from switching the deployment mode from . zip to container? did you find any solution?

https://redd.it/1m7vt8o
@r_devops

Suggestions and review

I am trying to get into devops role, currently i am working in WITCH in my current role i am working on automation framework which is in python. I have not completely real world experience for devops but in my current project is use of github actions and jenkins so i have been learning these two alongwith docker and kubernetes. For past 3 months. I have prepared a resume but my resume is not even getting shortlisted to at least give test or interview. Please suggest if there is anything that i should update to my resume.


https://www.dropbox.com/scl/fi/cczcuu47rlognrose3cit/IMG20250724114919.jpg?rlkey=nw1c97dlfn7fcerplqybz8h2l&st=nkhiwm8b&dl=0


https://redd.it/1m7wv4d
@r_devops

How we automated Unity editor workflows with AI — open devops story behind the scenes

Hey folks 👋

I wanted to share something from the devops side of a project I’ve been building called Code Maestro. It’s a Unity-based tool designed to speed up repetitive editor tasks — like auto-fixing scripts, organizing assets, placing prefabs, and more. While it’s technically a Unity tool, it also became an interesting devops challenge in terms of automation, tooling, and team-less CI-like behavior.

🔧 DevOps angle:

No external server — everything runs locally as a standalone AI-powered assistant
Uses a custom lightweight task queue internally — almost like a mini CI/CD pipeline for Unity scenes
We explored different ways of triggering agents from scripts, GUI buttons, and even shell calls
Built internal logging/feedback layers to self-assess output correctness (kinda like unit tests for AI decisions)

💬 Would love to hear your thoughts:

If you’ve ever done internal tooling in Unity or another engine — what was your approach to testing / automation?
Any favorite practices for dealing with AI or agent-based flows in game dev or scripting pipelines?

The code and experiments are open:
🔗 GitHub: https://github.com/codemaestroai/advanced-unity-mcp

P.S. I’m not promoting anything commercial — just looking to exchange ideas with people working on internal tools, AI workflows, or Unity devops

https://redd.it/1m7xpbw
@r_devops

Process vs autonomy/trust

I read this article from an engineer who worked as an SRE at Google for 16 years and this stuck with me:

>More process doesn’t mean more control, it usually just means more friction

It was surprising, I imagined a massive company like Google would be full of processes to keep things safe and would promote processes.

Setting up processes makes me feel at ease tbh. Most of the time it works. But as things get more messy, keeping track of the many playbooks etc is difficult. I feel it keeps getting harder for me to even know if they're still relevant. But where do you draw the trust line ? How rigid should safeguard rails be?

An 'it depends' question of course but I'd like to hear your thought process on this

ps. the article is more centred on this thinking process for incident management but if you want to check it out it's this one: https://rootly.com/blog/when-process-becomes-latency-optimizing-incident-response-cadence

https://redd.it/1m7yuuu
@r_devops

I'm a full stack software engineer who want to transition to devOps.

I have 1.5 YOE as a software developer as of now based in India. In my current role im using a lot of aws microservices and learning CI/CD,IaC and all. with my experience level is this possible to get a job in devOps field?? also wherever i get the video tutorials and they all seem like you literally need each and everything from that tech stack to really get a job,is this true? I need guidance on how I should proceed with all this.

https://redd.it/1m82zvq
@r_devops

AI FOMO - is anyone using AI at work beside writing code?

I use Claude for kick starting a lot of my projects and scripts, but is there another way of using AI to my advantage? Some things that specifically come to mind:

- n8n is popping everywhere. Did anyone automate some workflow with it in a meaningful way?
- Logging and error analysis?
- IaC reviews?
- CI/CD optimizations

I want to specifically focus on the "bring your own AI" part, instead of relying on new SaaS stuff to buy or implement.

Any ideas or fun projects would be nice to learn from.

Thanks!

https://redd.it/1m8461p
@r_devops

Web Dev

hello guys , hope you are all good

i want to ask about web dev cause i heard that i will need to learn front end from somme people for the 2nd year CS , so what i should learn and is it really that i will not need html , because i started to learn it

at the end , thank you to every one that responded to me

https://redd.it/1m88sx6
@r_devops

Technical interview with food delivery company

So I passed the initial screening interview and now have the first technical interview scheduled for a company I can’t name yet that has a known food delivery app. I have around 5 years of DevOps experience, and a good knowledge of most of the tools of the trade (docker, kubernetes, terraform, ansible, helm, kustomize, argocd…). Thing is, I never worked with mobile apps so I’m looking for any advice on what to prepare outside my scope or on how it can be different for me.

https://redd.it/1m89fz2
@r_devops

End to end CI/CD pipeline for a C application

I know the interwebs are chock a block with pipelines for Java/python, but I am an programmers who still loves his C. Recently after being away for several years due to personal reasons, I have taken up a C project for a client. Just wanted to know about the opensource options for an end to end CI/CD pipeline for a C project.

Github > Jenkins > GCC > sonarcube > trivy > Cmake or Ninja > Nexus > docker > kubernates

Is this correct ? My doubt is whether GCC and CMake can be integrated as part of this pipeline. Reason is for Java there is Maven. Do we have something for C that compiles and builds similar to maven?

Any help is most appreciated. Much obliged.



https://redd.it/1m8be6y
@r_devops

How to Sort Work Item View Differently

Hi All,


Does anyone know how to change the sort criteria to match the order of Work Items within the Backlog tab? We have resources that are utilized across multiple backlogs (I've told management many times this is a bad idea), so as a work-around, we've updated the Priority Field for our Features (and related Stories, Tasks, and Bugs) to hold the same priority, this way when someone comes into the Work Item view, they can see all of their work (via the Assigned to Me dropdown), prioritized from highest to lowest priority. The problem is, the Work Item view keeps moving around items within the same priority by which one has been most recently updated, which is not necessarily their top item to work on within the Feature. Any help is greatly appreciated, thanks! <3

https://redd.it/1m8e1rf
@r_devops

I turn it into a server from my laptop at my own home.

I'm making a software for it. I welcome your suggestions.
Pls Click -> Blog <- Pls Click

https://redd.it/1m8gpqc
@r_devops

DevOps professionals - I need your insights!


Hi everyone ☺️ I'm a postgraduate student researching racing to prove why DevOps adoption in large organisations (such as AWS, Microsoft, Google, Meta, etc) sometimes fails to match the hype.
I call it the DevOps Implementation Paradox (DIP) framework: companies adopt DevOps for prestige or branding, but face real struggles with legacy systems, culture and leadership misalignment.
For research, I'm running a quick survey (anonymous) to capture real-world challenges and enablers from engineers, SREs, DevOps leads and anyone working within this field or with CI/CD pipelines.
Your input will help expose the gap between DevOps hype and practical reality 👏🏻 and will be used ethically in my dissertation.

Copy survey link here:
https://docs.google.com/forms/d/e/1FAIpQLSf17Bd_kAM7G7OTeGIdq5Vcy-uGWlJ3NNaj1qzqFLKBzxkvjw/viewform?usp=header

Thank you for helping bridge the DevOps reality gap! Happy to share final insights with anyone interested.

https://redd.it/1m8h1rx
@r_devops

Using AI as a security coach in workflows

Yes, AI bad. Don't rely on it. It hallucinates. I agree with all of that. But please hear me out.

We're an ultra tiny shop. And our dev team is junior heavy. It's not an ideal situation. They consider things to be done if they work and don't always consider security implications. On review, we found a pretty glaring privilege escalation vulnerability in one of our APIs.

We're already running Snyk scans on code, but stuff like this slips by. And yes I know human review and other tools are fairly effective, but time is short and people miss things.

So, today I hopped into AI foundry and wrote a prompt and ran some sample code through it that I know is problematic. The initial results are promising and I intend to attach it to workflows for running against our critical micro service APIs when they change.

Before I do that, I wanted to get some feedback. I am working from the angle that I want it to scan subsets of the code and make sure good practices are being followed (authentication, tokens, etc) but I don't want to write the code for the dev. Because hallucination. For web apps, bounce it against things like OWASP top 10 rules, tell you where you screwed up, give a leading suggestion, but don't give a "here's the full fix" snippet. Because I want the devs to actually learn. And I want humans to remain firmly in the loop.

Does this sound like a good approach? If you've done this before, can you share any gotchas?

https://redd.it/1m8j7z8
@r_devops

Is the KubeCon worth attending?

I am a senior Devops. Not sure what I can get from KubeCon. Also interested in ArgoCon this November.

https://redd.it/1m8p5ec
@r_devops

Cloudflare wildcard certificates

Hi everyone,
I recently switched to using Cloudflare certificates (with DNS proxying enabled) and a wildcard cert for my domains. Just wanted to ask:

* Is this generally considered good practice?
* What are the pros and cons of using a wildcard cert with Cloudflare?
* Are there any security or scalability concerns I should be aware of compared to using individual certs?

Thanks in advance!

https://redd.it/1m8qsun
@r_devops