Our Enterprise DevOps Dispatch is online!

Our weekly dispatch is online. Sign up if you don't want to miss one: https://techaccelerationandresilience.com/short-notes/dispatch-0823

#devops #sre #platformengineering #dispatch #newsletter #techstrategy

https://redd.it/119amr5
@r_devops

🚀 DevOps Isn't Just CI/CD – Let's Talk About Real Deployment Challenges

Hey folks 👋

I just published a new blog post where I dive into the **real-world complexities of DevOps deployments** — way beyond just wiring up GitHub Actions or Jenkins pipelines.

🔗 Read it here: [https://norbix.dev/posts/devops-deployment/](https://norbix.dev/posts/devops-deployment/)

Here’s what I cover:

* Why “CI/CD” is just the **tip of the iceberg**
* Hidden realities like config drift, rollbacks, release approvals, and hybrid infra
* Real-life tips for teams that manage **cloud-native, on-prem, or mixed environments**
* Thoughts on blue/green, canary, GitOps, and platform engineering

💬 I’d love your thoughts:

* How do you **handle deployments** in your org?
* Do you manage full lifecycle (build → release → monitor) as part of DevOps?
* Any horror stories (or wins) you'd like to share?

Let’s get beyond the buzzwords and talk actual **deployment engineering**.

\#DevOps #SRE #PlatformEngineering #CI/CD #norbix

https://redd.it/1kie9fi
@r_devops

Bringing trust to your CI System

How would you even know if your build pipeline was compromised — not your code, the system that builds it?

That question is basically what pulled me down a rabbit hole last weekend. I was just going back to basics, re-reading the fundamentals of secure software delivery, and somehow landed right back on the one question that always pops up eventually: how much does anyone actually trust CI?

Because if someone quietly got a foothold in a build system, the artifact that comes out the other end still looks completely legitimate. Nothing downstream catches it, because most pipelines are built to just trust the artifact by default. That's the same pattern behind incidents like SolarWinds and Codecov — not application bugs, trust failures in the delivery path itself.

So I went down the rabbit hole properly — the current SLSA framework, provenance, in-toto attestations, the whole "how do you actually prove what happened during a build" question. Turns out the industry's answer is pretty elegant: provenance is a verifiable record of what happened during the build. Attestation is how that record gets proven, cryptographically, at every step after.

A few late nights later, my notes turned into something worth keeping — a handbook I know I'll come back to, more than once. The whole thing distills into one line I keep coming back to:

Git → Build → Artifact → Deploy → Runtime — identity, evidence, and independent verification at every boundary.

If you operate any part of a software delivery path to production, ask yourself that question today.

Read the handbook at https://securesoftwaredelivery.wckd14.xyz/

\#PlatformEngineering #SupplyChainSecurity #SLSA #SSDLC #DevSecOps

https://redd.it/1v7cj9j
@r_devops