I turn it into a server from my laptop at my own home.

I'm making a software for it. I welcome your suggestions.
Pls Click -> Blog <- Pls Click

https://redd.it/1m8gpqc
@r_devops

DevOps professionals - I need your insights!


Hi everyone ☺️ I'm a postgraduate student researching racing to prove why DevOps adoption in large organisations (such as AWS, Microsoft, Google, Meta, etc) sometimes fails to match the hype.
I call it the DevOps Implementation Paradox (DIP) framework: companies adopt DevOps for prestige or branding, but face real struggles with legacy systems, culture and leadership misalignment.
For research, I'm running a quick survey (anonymous) to capture real-world challenges and enablers from engineers, SREs, DevOps leads and anyone working within this field or with CI/CD pipelines.
Your input will help expose the gap between DevOps hype and practical reality 👏🏻 and will be used ethically in my dissertation.

Copy survey link here:
https://docs.google.com/forms/d/e/1FAIpQLSf17Bd_kAM7G7OTeGIdq5Vcy-uGWlJ3NNaj1qzqFLKBzxkvjw/viewform?usp=header

Thank you for helping bridge the DevOps reality gap! Happy to share final insights with anyone interested.

https://redd.it/1m8h1rx
@r_devops

Using AI as a security coach in workflows

Yes, AI bad. Don't rely on it. It hallucinates. I agree with all of that. But please hear me out.

We're an ultra tiny shop. And our dev team is junior heavy. It's not an ideal situation. They consider things to be done if they work and don't always consider security implications. On review, we found a pretty glaring privilege escalation vulnerability in one of our APIs.

We're already running Snyk scans on code, but stuff like this slips by. And yes I know human review and other tools are fairly effective, but time is short and people miss things.

So, today I hopped into AI foundry and wrote a prompt and ran some sample code through it that I know is problematic. The initial results are promising and I intend to attach it to workflows for running against our critical micro service APIs when they change.

Before I do that, I wanted to get some feedback. I am working from the angle that I want it to scan subsets of the code and make sure good practices are being followed (authentication, tokens, etc) but I don't want to write the code for the dev. Because hallucination. For web apps, bounce it against things like OWASP top 10 rules, tell you where you screwed up, give a leading suggestion, but don't give a "here's the full fix" snippet. Because I want the devs to actually learn. And I want humans to remain firmly in the loop.

Does this sound like a good approach? If you've done this before, can you share any gotchas?

https://redd.it/1m8j7z8
@r_devops

Is the KubeCon worth attending?

I am a senior Devops. Not sure what I can get from KubeCon. Also interested in ArgoCon this November.

https://redd.it/1m8p5ec
@r_devops

Cloudflare wildcard certificates

Hi everyone,
I recently switched to using Cloudflare certificates (with DNS proxying enabled) and a wildcard cert for my domains. Just wanted to ask:

* Is this generally considered good practice?
* What are the pros and cons of using a wildcard cert with Cloudflare?
* Are there any security or scalability concerns I should be aware of compared to using individual certs?

Thanks in advance!

https://redd.it/1m8qsun
@r_devops

Why MCP(Model Context Protocol) Matters for Your AI Projects


I wrote my first article on MCP


https://www.linkedin.com/pulse/why-mcpmodel-context-protocol-matters-your-ai-projects-deepak-kumar--fmbfc?utm_source=share&utm_medium=member_android&utm_campaign=share_via

https://redd.it/1m8snzd
@r_devops

Anyone using XDR for cloud-native threat detection?

We’ve shifted most workloads to ECS and Lambda, and our old endpoint tools don’t cover squat anymore. I keep hearing about XDR as the next-gen detection approach, but it feels like half the vendors define it differently.

What are you using to detect lateral movement, container escapes, and other cloud-native threats?



https://redd.it/1m8tecu
@r_devops

How to upskill?

I currently have Azure fundamentals cert and CKA. Wondering how to upskill next? Is redhat administrator cert worth doing?

https://redd.it/1m8sguk
@r_devops

Trusting the Boot Process: Inside Bottlerocket's Security Architecture

https://molnett.com/blog/25-06-30-trusting-the-boot-process

Bottlerocket is a distro developed by AWS for their more sensitive container-based environments like AWS Govcloud, EKS anywhere and others. We thought it would be a good choice for us (we're building a EU-focused Serverless cloud) as many of our customers are in Healthtech, so we've used it for all our nodes, even the Kubernetes control plane.

My colleague Mikael decided to dive deeper into how the boot process works, and in a later post how it interacts with the TPM.

I would love to hear how (and if) you've solved this for your own platforms, and if so what you think of it!

https://redd.it/1m8vewk
@r_devops

DDoS attack - i think

I manage several ecommerce websites and their hosting for work. Over the years I have seen various types of attacks, as well as an increase an AI / bot traffic.

On the 3rd July I was alerted to high server activity on one of our sites. When I was reviewing the server and nginx logs, I could see the requests per hour to the site had gone from an average of 20,000 an hour to 120,000. However Sales had not increased,

Reviewing the nginx logs, I found that there was a large number of requests to a small group of category pages, never any request for CSS / JS - which stinks of bot.

Cherry picking some IP addresses, they only ever made one request.

Immediately we enabled cloudflare under attack mode, which made the traffic instantly drop, adding to the idea that this is bot traffic and not a successful marketing campaign.


I identified patterns in paths and created a rule in cloudflare to target this, allowing me to remove the under attack mode and keep the website online.

Between then and now I have been reviewing the requests hitting my rule.

A few times I downloaded and analysed 500 requests to the rule and they all read similar to this.

\- 493 Different IP addresses
\- 278 ASNs
\- 55 Countries
\- 13 URLs
\- 412 User Agents
\- 500 different query parameters


The website sells items to the UK, a large number of these requests are coming from Brazil, Singapore, Vietnam, India and Bangladesh


Checking on the rule today (25th july) so 3 weeks in - and within cloudflare I can see the rule is blocking a LOT of requests. This is showing is has presented the challenge 18k requests in the last 24 hours.

I should add, my rule is set to ignore for known bots.


Is this a DDoS Attack? I have never had one this sophisticated or last this long.

The website is not high value and the requests have been blocked for 3 weeks now yet they still continue to come in.


Any suggestions on additional things I can do to tackle this would also be welcome



https://redd.it/1m8vf0n
@r_devops

Please help me with nifi and nifikop that i'm trying to learn!

I encounter a few problems. I'm trying to install a simple HTTP nifi in my Azure Kubernetes.
I have a very simple setup, just for test. A single VM from which I can get into my AKS with k9s or kubectl commands.
I have a simple cluster made like:

```
az aks create --resource-group rg1 --name aks1 --node-count 3 --enable-cluster-autoscaler --min-count 3 --max-count 5 --network-plugin azure --vnet-subnet-id '/subscriptions/c3a46a89-745e-413b-9aaf-c6387f0c7760/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/vnet1/subnets/vnet1-subnet1' --enable-private-cluster --zones 1 2 3
```

I did tried to install different things on it for tests and they are working so I don't think there may be a problem with the cluster itself.

Steps I did for my NIFI:

1.I installed cert manager,
```
kubectl apply -f https://github.com/jetstack/cert-manager/releases/latest/download/cert-manager.yaml
```

2.
zookeper,
```
helm upgrade --install zookeeper-cluster bitnami/zookeeper \
--namespace nifi \
--set resources.requests.memory=256Mi \
--set resources.requests.cpu=250m \
--set resources.limits.memory=256Mi \
--set resources.limits.cpu=250m \
--set networkPolicy.enabled=true \
--set persistence.storageClass=default \
--set replicaCount=3 \
--version "13.8.4"
```
3.
Added nifikop with servieaccount and a clusterrolebinding,
```
kubectl create serviceaccount nifi -n nifi

kubectl create clusterrolebinding nifi-admin --clusterrole=cluster-admin --serviceaccount=nifi:nifi
```
4.
```
helm install nifikop \
oci://ghcr.io/konpyutaika/helm-charts/nifikop \
--namespace=nifi \
--version 1.14.1 \
--set metrics.enabled=true \
--set image.pullPolicy=IfNotPresent \
--set logLevel=INFO \
--set serviceAccount.create=false \
--set serviceAccount.name=nifi \
--set namespaces="{nifi}" \
--set resources.requests.memory=256Mi \
--set resources.requests.cpu=250m \
--set resources.limits.memory=256Mi \
--set resources.limits.cpu=250m
```

5. nifi-cluster.yaml
```
apiVersion: nifi.konpyutaika.com/v1
kind: NifiCluster
metadata:
name: simplenifi
namespace: nifi
spec:
service:
headlessEnabled: true
labels:
cluster-name: simplenifi
zkAddress: "zookeeper-cluster-headless.nifi.svc.cluster.local:2181"
zkPath: /simplenifi
clusterImage: "apache/nifi:2.4.0"
initContainers:
- name: init-nifi-utils
image: esolcontainerregistry1.azurecr.io/nifi/nifi-resources:9
imagePullPolicy: Always
command: ["sh", "-c"]
securityContext:
runAsUser: 0
args:
- |
rm -rf /opt/nifi/extensions/* && \
cp -vr /external-resources-files/jars/* /opt/nifi/extensions/
volumeMounts:
- name: nifi-external-resources
mountPath: /opt/nifi/extensions
oneNifiNodePerNode: true
readOnlyConfig:
nifiProperties:
overrideConfigs: |
nifi.sensitive.props.key=thisIsABadSensitiveKeyPassword
nifi.cluster.protocol.is.secure=false

# Disable HTTPS
nifi.web.https.host=
nifi.web.https.port=

# Enable HTTP
nifi.web.http.host=0.0.0.0
nifi.web.http.port=8080

nifi.remote.input.http.enabled=true
nifi.remote.input.secure=false

nifi.security.needClientAuth=false
nifi.security.allow.anonymous.authentication=false
nifi.security.user.authorizer: "single-user-authorizer"
managedAdminUsers:
- name: myadmin
identity: [email protected]
pod:
labels:
cluster-name: simplenifi
readinessProbe:
exec:
command:
- bash
- -c
- curl -f https://localhost:8080/nifi-api
initialDelaySeconds: 20
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 6
nodeConfigGroups:
default_group:
imagePullPolicy: IfNotPresent
isNode: true
serviceAccountName: default
storageConfigs:
- mountPath: "/opt/nifi/nifi-current/logs"
name: logs

reclaimPolicy: Delete
pvcSpec:
accessModes:
- ReadWriteOnce
storageClassName: "default"
resources:
requests:
storage: 10Gi
- mountPath: "/opt/nifi/extensions"
name: nifi-external-resources
pvcSpec:
accessModes:
- ReadWriteOnce
storageClassName: "default"
resources:
requests:
storage: 4Gi
resourcesRequirements:
limits:
cpu: "1"
memory: 2Gi
requests:
cpu: "1"
memory: 2Gi
nodes:
- id: 1
nodeConfigGroup: "default_group"
- id: 2
nodeConfigGroup: "default_group"
propagateLabels: true
nifiClusterTaskSpec:
retryDurationMinutes: 10
listenersConfig:
internalListeners:
- containerPort: 8080
type: http
name: http
- containerPort: 6007
type: cluster
name: cluster
- containerPort: 10000
type: s2s
name: s2s
- containerPort: 9090
type: prometheus
name: prometheus
- containerPort: 6342
type: load-balance
name: load-balance
sslSecrets:
create: true
singleUserConfiguration:
enabled: true
secretKeys:
username: username
password: password
secretRef:
name: nifi-single-user
namespace: nifi
```
6. nifi-service.yaml

```
apiVersion: v1
kind: Service
metadata:
name: nifi-http
namespace: nifi
spec:
selector:
app: nifi
cluster-name: simplenifi
ports:

port: 8080
targetPort: 8080
protocol: TCP
name: http
```

The problems I can't get over are the next. When I try to add any process into the nifi interface or do anything I get the error:

Node 0.0.0.0:8080 is unable to fulfill this request due to: Transaction ffb3ecbd-f849-4d47-9f68-099a44eb2c96 is already in progress.

But I didn't do anything into the nifi to have anything in progress.

The second problem is that, even though I have the singleuserconfiguration on true with the secret applied and etc, (i didn't post the secret here, but it is applied in the cluster) it still logs me directly without asking for an username and password. And I do have these:

nifi.security.allow.anonymous.authentication=false
nifi.security.user.authorizer: "single-user-authorizer"

I tried to ask another person from my team but he has no idea about nifi, or doesn't care to help me. I tried to read the documentation over and over and I just don't understand anymore. I'm trying this for a week already, please help me I'll give you a 6pack of beer, a burger, a pizza ANYTHING.

This is a cluster that I'm trying to make for a test, is not production ready, I don't need it to be production ready. I just need this to work. I'll be here if you guys need more info from me.

https://imgur.com/a/D77TGff Image with the nifi cluster and error

https://redd.it/1m8xlt4
@r_devops

Looking for Real-World Production Terraform or Pulumi Configurations

Hi,

I'm building a tool for simplifying cloud provisioning and deployment workflows, and I'd really appreciate some input from this community.

If you're willing to share, I'm looking for examples of **complex, real-world Terraform or Pulumi configurations used in production**. These can be across any cloud provider and should ideally reflect real organizational use (with all sensitive data redacted, of course).

To make the examples more useful, it would help if you could include:

* A brief description of what the configuration is doing (e.g., multi-region failover, hybrid networking, autoscaling setup, etc.)
* The general **company size or scale** (e.g., startup, mid-size, enterprise)
* Any interesting constraints, edge cases, or reasons why the config was structured that way

Thanks in advance!

https://redd.it/1m8ysnq
@r_devops

Troubleshooting woes?

How have you dealt with troubleshooting in a new role? I recently got a title change from a graduate and know there are more responsibilities but what do I do when my team is too busy to help if needed?
I used to rely a lot on my buddy I was told to shadow and now can sort certain errors without her but I'm worried it's a bad thing about me needing help at times, given its my second year and they only added me on callout this year, but what when they're all busy and I'm stuck? I do Google and check AI (AWS Q for code) but systems are different and AI always says the wrong things while Google says a lot of different things

https://redd.it/1m927r8
@r_devops

Boot reset a linux screen without entering password or bios?

Hello all,

The venue I work for has a couple of 11.6" screens that use linux 4.4 with Ubuntu 18. It was installed at the same time as our narrowcasting software and so the company locked it on all possible sides, disabled bios, everything and didn't give us a password.

We gave them a ring and they say they can't help us out, unless we pay a good amount of $$$.

I was wondering if there is a way for me to reset the full computer and put new Ubuntu on it myself? I already tried a boot USB in the service input at startup, pressing any button it had at restart, all standard passwords, etc. Sadly no result

We would like to reset it because we are changing narrowcasting software, but the screens itself are still find and so we would like to keep using them with the new system.

Anyone got any clue how to fully reset it (it's okay if it's 100% wiped)

Screen / pc used: https://cf-assets.s3.amazonaws.com/LINQ11.6touch.pdf

Specs:
LINQ 11.6” PRO TOUCH SERIES
Architecture ARM64
Ubuntu 18.04.3 LTS
Linux 4.4.167
Digital signage AiO tablet
RK3399 11.6" AiO Tablet
Model: ST116
ST116-RK3399-S

Thank you!

https://redd.it/1m955sq
@r_devops

Git Gud: Setting Up a Better Git Config

I've been slowly refining my `.gitconfig` over time to make Git less frustrating and more productive.

In this blog post, I cover some of the quality-of-life improvements and hidden config gems that have really helped me out, like:

* Making `git commit` show full diffs in the editor
* Sorting branches and tags by most recent activity or version number
* Prettifying diffs with `diff-so-fancy`
* Auto-setting upstream remotes so I don’t have to type `--set-upstream` every time
* Git aliases and shell aliases to save keystrokes
* Enabling background maintenance to reduce repo bloat
* GPG commit signing for that sweet “Verified” badge
* Enabling rerere (yes, it’s a real thing) to auto-resolve repeat merge conflicts
* Bonus: editor tweaks, typo suggestions, whitespace highlighting, and more

It's aimed at developers who already use Git but want to *tune* it to better fit their workflow.

🔗 [**Read it here → Git Gud: Setting Up a Better Git Config**](https://micahkepe.com/blog/gitconfig/)

Would love to hear if there’s anything you think I missed—or if you have your own favorite `.gitconfig` tweaks or aliases.

https://redd.it/1m95els
@r_devops

I was just asked by Google to go through a round of Interviews

To be honest, I'm surprised that my resume passed the algorithm, and I'm equally surprised that my lack of a CS degree also didn't affect the outcome. So, truly, I'm kinda honoured and flattered that they still wanted to go forward.

I've never gone through tech interviews at a FAANG company before - and I heard that they are soul crushing. I just submitted my availability for my first 45-min interview in 2.5 weeks time.

They sent me an email to prepare (shit myself) over some core concepts:

* Arrays and Strings
* Linked Lists
* Trees and Graphs
* Hash Maps/Tables
* Sorting and Searching Algorithms


I'm already sweating bullets. I'm good at coding, but not CS level good. How fucked am I? I feel like I'm pretty fucked. The fucking feels real. I checked out [prepare.sh](https://prepare.sh) and leetcode to see if I can narrow my challenges down but there are still like way too many tests to possibly go through in time.

The pressure from being in front of people to code is already anxiety inducing enough. I'm so over my head.

https://redd.it/1m983mt
@r_devops

I got 4 rejection emails today, one with an internal recommendation too. Can I get a sanity check on my resume please?

I've been on and off looking for a new job for about a year now. I got laid off in May and have ramped up my efforts since then including getting my CKA cert and almost ready for the AWS SysOps cert. I've scored a few interviews over the last year, but nothing since May, and keep getting hit with "We've chosen to go with another candidate". The rejection emails from today included a DevOps position where I have all the skills and experience that were listed on the job position but I got insta-rejected, even with the internal recommendation.

I know the job market is tough right now and that a lot of these openings are being flooded with talented candidates, which means my resume needs to be on point. I've crafted my resume with the help of ChatGPT, but getting some feedback from real people might point out areas that could be improved. If you could find a few spare minutes to review my resume and provide any feedback I would be extremely grateful. Thanks!

Resume: https://imgur.com/a/seh2Wl1

https://redd.it/1m97i8e
@r_devops

Just Launched: JS Deobfuscator

Hey devs 👋

I just launched a free tool called JS Deobfuscator – it helps you convert obfuscated, minified, or packed JavaScript into readable code.

🔧 Features:
• Handles complex proxy/function chains
• String/array unpacking
• Optional beautify-only mode
• Dark/light theme
• One-click download or copy

Would love for you to try it and give me feedback — what works, what doesn’t, and what you’d like to see next!

👉 https://jsdeobfuscator.com

Thanks in advance 🙌


https://redd.it/1m9ch3n
@r_devops

Dev ops pathway.

40m looking to switch careers, I’ve been working in the rock climbing industry my whole life and would love to settle into something less physical and more reliable for my growing family.

I’m currently studying dev ops through a very lengthy course on UDemy. It’s going pretty slow as I work full time, and I have a newborn baby.

I have a decent understanding of Linux/bash and have taken a few python courses previously. I can create and manage virtual machines both manually and automated. The course will cover slot of the tools as well.

My question is what would be a good positions to start applying for if I wanted ti switch careers before I finish my schooling?
What’s the very beginning of the path to dev ops?

Help desk? System admin? Coffee gopher?

https://redd.it/1m9hvvl
@r_devops

Is it possible to configure WSL2 so that containers expose the same port on both the WSL2 environment and the host system? Specifically, if a container is running on localhost:8000 within WSL2, can it be accessed on localhost:8000 from the Windows host or external networks?

I was able to set up my WSL2 so that the containers run on WSL2, but I can't reach the backend at all from outside of the container, which makes my local setup completely useless.

https://redd.it/1m9hpq5
@r_devops