Where would you put the safety line for an agent running commands in a repo?

I have a practical question for people who care about local/CI safety.

When a coding assistant works inside a repo, it is not only editing code. It may run tests, install packages, start services, touch config files, or suggest a CI change. Some of that is normal. Some of it feels like it should require a hard stop.

In one small project, I let the agent install a package without thinking much, but I stopped when it wanted to change a CI config file because that felt less like a normal coding step.

I'm not trying to lock the assistant in a tiny read-only box. That would make it useless for many tasks. I just want a boring policy: tests are fine, read-only commands are fine, but CI/deploy/env changes need a human looking at them first.

If you were setting this up for a small team, what actions would you auto-allow, ask about, or block completely?

https://redd.it/1uscdda
@r_devops

Is anyone using Claude or similar to fully automate DevOps and Infra? What are it's limits?

Hi all, this is my first post here so please be kind :)

I am interested in knowing from your personal experiences, what the limit of AI is for fully automating the build pipeline and infrastructure.

Has anyone been doing this?

Reason I am asking is that one of my devs says this is fully automatable and no human is involved (apart from one operating the AI), and another of my developers says that this is not possible.

Any feedback from personal experiences is appreciated!

https://redd.it/1use601
@r_devops

Anthropic is giving 6 months of Claude Max 20x ($1,200 value) for free to open source contributors, applications are open now

ame across this and wanted to make sure the dev community knows about it.

Anthropic quietly expanded their Claude for Open Source program and the details are pretty generous:

6 months of Claude Max 20x
$1,200 value \- completely free
No catch, just an application

Who qualifies:

Package maintainers
Core contributors landing PRs
Anyone keeping a critical library alive

This isn't for casual users. It's specifically for people doing the unglamorous work that keeps the open source ecosystem running.

If you've been on the fence about Claude for your workflow, this is a pretty low-risk way to try the highest tier for half a year.

Apply here: anthropic.com/claude-for-open-source



Drop a comment if you're applying, would be good to know how many from this community qualify.

https://redd.it/1uslq0c
@r_devops

Bootstrapping Flux

there's several methods on setting it up on a cluster (terraform with helm, terraform with flux provider, and using the flux boostrap command). Is there any reason for using Terraform instead of flux cli on my runner? Ultimately i dont want terraform managing it.

https://redd.it/1usrq3p
@r_devops

Does anyone actually go back and hold a vendor accountable after they cause an incident

Curious how other teams handle this. when a vendor is the root cause of an incident, api outage, bad release, whatever, does anyone go back afterward and check if you're owed anything for it (credit, RCA, commitment to fix), or does that step just not really exist once the postmortem's done and everyone's moved on to the next fire.

https://redd.it/1ut42ng
@r_devops

LaunchDarkly Outage

Anyone else bit by that today? We largely were untouched until their SDK seemingly started crashing in the aftermath after we had restarted all the things. Seems a little odd that there’s no reddit thread about this so here’s one! 😂

https://redd.it/1ut3vjx
@r_devops

Learning Observability

A while back I commented on a post about my favorite focus area within DevOps. I said observability. A bunch of people DM'd me asking how to get into the space and what resources I'd recommend, so here's the list.

1. OpenTelemetry
[Opentelemetry docs](https://opentelemetry.io/)
Free CNCF Course for Opentelemetry
[My favorite book on observability and Opentelemetry by Steve Flanders](https://www.amazon.com/Mastering-OpenTelemetry-Observability-Application-Infrastructure/dp/1394253125)
30 days of OTEL github repo by Julia Furst Morgado
[Opentelemetry Demo (The Standard application everyone uses to learn Opentelemetry on)](https://github.com/open-telemetry/opentelemetry-demo) It Generates traces, metrics, and logs
2. Prometheus
Prometheus Docs
[https://training.promlabs.com/](https://training.promlabs.com/) This has some free training and some paid.
https://www.youtube.com/watch?v=zZcxdWJ\_tRc&t=9277s
3. Grafana LGTM Stack or whatever backend you prefer. (I personally like the LGTM Stack since it's OSS)
[https://learn.grafana.com/](https://learn.grafana.com/)
https://www.youtube.com/watch?v=WSW1urIXsfA
4. Kubernetes ( You might as well learn the basics of Kubernetes if you are learning observability since you will run into it at every organization)
[Kodekloud (My absolute favorite resource to learn about containers and kubernetes)](https://kodekloud.com/learning-path/kubernetes)
Monitoring Kubernetes Clusters with Opentelemetry
[If you are looking to get kubernetes certified](https://killer.sh/) (They have the best practice exams)
5. Profiling
https://github.com/grafana/pyroscope
6. Other great resources
[My favorite youtube channel for Observability by Henrik Rexed](https://www.youtube.com/c/isitobservable)
SRE Books by Google
[SRE fundamentals: SLIs, SLAs and SLOs](https://cloud.google.com/blog/products/devops-sre/sre-fundamentals-slis-slas-and-slos)
Observability podcast by one of my favorites in the industry Juraci Paixão Kröhling

Let me know what else you would add

https://redd.it/1utalh7
@r_devops

what other DevOps at scale skills can I learn, and what my direction should be?

Need guidance from industry seniors,
A little brief about my experience: I have 4 yrs of experience working as a DevOps Engineer, 2 yrs in an MNC, and 2 in a startup. I have worked with the usual stack: AWS, GCP, Terraform, Kubernetes, Observability, CI/CD, Security Tools (Trivy, SonarQube). I have done it all, from designing Infra, observability, IAC, and security, from scratch to implementation. Collaborating with Devs, identifying optimization opportunities, owning everything end to end etc. I also use AI (Claude Code, MCP etc) in my day-to-day tasks.

I now want to grow & learn more on how to do DevOps at scale, like hundreds of nodes clusters or AI infrastructure. I feel there's not so much left that I can do in a startup, also again, scale.

I am confused about what other skills I can learn, and what my direction should be? In both scale & future growth terms, I have been exploring AI infrastructure currently (like GPU scheduling, LLM Observability).

https://redd.it/1uthmj6
@r_devops

Patch Tuesday MCP

I built an open-source MCP server for Microsoft Patch Tuesday that lets AI assistants like Claude, Copilot, ChatGPT, and more answer patch questions directly from official MSRC data.


Every Patch Tuesday, security teams ask the same questions: what changed, what affects us, what is being exploited, and what needs to be patched first?


Ask things like:

 “Summarize this month’s Patch Tuesday”

 “Which of these CVEs are on the CISA KEV list?”

 “Show me CVEs with an exploitation probability above 50%”

 “What older patches does KB5094123 replace?”

 “What Critical CVEs hit Windows Server 2022 this month?”



What makes it different: most vulnerability tools can look up a CVE, but they have no concept of a monthly Microsoft release, a KB article, or a product family.


This server parses the full MSRC CVRF documents, so it can answer the questions Microsoft shops actually ask on the second Tuesday of every month.


It is built around the data sources teams already trust:

* Official MSRC Security Update Guide API: Microsoft’s source for Security Update Guide and CVRF data
* EPSS scores from FIRST.org: daily-updated probability each CVE gets exploited in the next 30 days
* CISA KEV integration: confirmed-exploited CVEs with federal remediation due dates
* Supersedence chains: walks Microsoft’s “this KB replaces that KB” links so your assistant never recommends a stale patch
* Results ranked by real-world urgency: KEV/exploited → EPSS → severity → CVSS

Zero API keys, zero accounts: everything comes from public MSRC, [FIRST.org](https://FIRST.org), and CISA feeds. Run it locally or remotely. Details below:


GitHub Account: Jonny Bottles

GitHub Repo: patch-tuesday-mcp


If you triage Microsoft updates frequently, I’d love feedback. If there’s a feature you’d use, open an issue.


Disclaimer: This is an independent, self-built project and is not an official Microsoft tool or service.

[\#PatchTuesday](https://www.facebook.com/hashtag/patchtuesday?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#CyberSecurity](https://www.facebook.com/hashtag/cybersecurity?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#VulnerabilityManagement](https://www.facebook.com/hashtag/vulnerabilitymanagement?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#MCP](https://www.facebook.com/hashtag/mcp?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#AI](https://www.facebook.com/hashtag/ai?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#Claude](https://www.facebook.com/hashtag/claude?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#Microsoft](https://www.facebook.com/hashtag/microsoft?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#MSRC](https://www.facebook.com/hashtag/msrc?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#OpenSource](https://www.facebook.com/hashtag/opensource?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R) [\#InfoSec](https://www.facebook.com/hashtag/infosec?__cft__[0]=AZaWsH2HX7cjwn_HLMKdlYZlZrEg7wbsP3srqtM9cou8N53dEtHuqAjwKBI6vfqVkZGEEcSsMK6aZ1BOvTnxFDC5V7cFJ18tSCeMLupNz2bnqNURqxph6OnrpqjR_0iZZ7jcw-FzFNgXtIfOHb8wVsBG4AhDfAIvM3_Tsdh1rBoJx1lSpGzwTCS12K9JI6W89sk&__tn__=*NK-R)

https://redd.it/1ut3zcs
@r_devops

How does your engineering team preserve context when senior engineers leave?

I've been thinking about this problem lately and wanted to hear how other engineering teams deal with it.

As our systems grow, it feels like engineering knowledge gets scattered everywhere—GitHub PRs, Jira tickets, Slack threads, docs, dashboards, runbooks, and people's heads.

Some situations I've seen:

A senior engineer leaves, and suddenly nobody knows why a service was designed a certain way.
A production incident happens, and engineers spend more time searching Slack, GitHub, Jira, and Grafana than actually fixing the issue.
Someone asks, "If we change this service, what else could break?" and nobody is completely sure.
New engineers spend weeks asking teammates where information lives instead of building features.
Six months later, nobody remembers why a particular architectural decision was made.

I'm curious how larger engineering organizations handle this.

How do you preserve engineering context over time?
What tools or processes have actually worked well?
What's still frustrating about your current setup?
Are there any problems you've just accepted because there isn't a good solution?
If you could magically fix one pain point around engineering knowledge or context, what would it be?

I'm especially interested in hearing from teams with 50+ engineers or companies running lots of services.

Would love to learn how this works at your company.

https://redd.it/1utlhjq
@r_devops

Server Migration

I joined an organization recently and most of their severs in Dev and Prod hit EOL about 2 months ago. How do I migrate the servers to new ones Thats still maintain by Azure. Most of the severs have K8s running on them.

https://redd.it/1uttqdj
@r_devops

What Jenkins Agent Architecture Are You Using in Production in 2026?

I'm interested in understanding what the current industry standard looks like.

There seem to be several approaches:

Static VM/EC2 Agents
Docker-based Agents
Kubernetes Pod Agents
Hybrid setups

For those running Jenkins in production:

Which approach are you using?
Why did your team choose it?
What challenges have you faced?
If you were building a new Jenkins platform today, would you still choose the same architecture?

I'm looking for real-world experiences rather than theoretical comparisons.

Thanks!

https://redd.it/1uua7n4
@r_devops

The whole frontend + backend + db split in k8s, help

I've been a full-stack dev with responsibilities for the servers since '01, so it was a big change for me when I finally went with a big company that had people to do it. It also ment that I was suddenly working with kubernetes. Since everything was set up, it haven't been a big jump but I wanted to learn, so I set up my own 3 node k8s and have been playing with it since. Running full pipeline with dev, production, linting, security scans and all.

But now I want to build something. So I have a few react project running for testing. And I want to make the backend + database split right.

Locally, I am used to run environment variables in the .env file so I can switch between local and dev backends and/or local and dev databases for testing.

In the setup at work, there is a doohickey that controls the environment variables. I just alter files in a git repo and upload, or set it from command line. An enterprise-grade thing developed by the entity I work for. I just want to do it the regular kubernetes way.

So where do I put my database server and port location in a k8s setup? my buddy, mister chatgpt, suggest ConfigMap, coupled with Secret for the password. Is this just a barebone thing or is it how most do it?


Secondly, I don't think putting the database in the backend-pod is the right thing given it writes and reads to it and that sounds wrong. My little buddy suggest that I use either CloudNativePG or set it up as a PersistentVolumeClaim. Is there any other way as well? What would be the preffered way? I assume if I ever get to the stage I make something of this projects public, I am going to publish it to a could service which has their own database stuff so for my own pleasure that is not much of a concern, or is it?

Just curious to know how on track I am.

https://redd.it/1uucsj2
@r_devops

Article: Model caching for AI workloads on GKE/Kubernetes without re-downloading weights

The basic idea is to use node-local storage as a shared model cache so new inference pods can reuse existing weights. It significantly reduces startup time and cuts down on repeated network transfers, especially when autoscaling.

I wrote up the approach, some implementation details on GKE:

https://hrittikhere.com/posts/model-caching-kubernetes-gke

Curious how others are handling model distribution at scale. Are you using node-local caches, RWX storage, image-based models, or something else?

https://redd.it/1uuke1c
@r_devops

Thoughts on the bindplane acquisition?

How are people feeling about bindplane being acquired by dynatrace? Mainly, are people hesitant to adopt it now since they are owned by one of the big observability companies?


And for those who are using bindplane today, have you seen any changes since the acquisition?

https://redd.it/1uuwu5w
@r_devops

To break into devops

Hi All,

Completely out from DevOps, may i know what's the programming language to learn for today's DevOps?

https://redd.it/1uuxoa4
@r_devops

Where is the line for automated agents fixing CI failures?

I am curious how people here would handle AI agents around CI failures.

A simple version sounds useful: CI fails, the agent reads the log, tries to reproduce it, proposes a patch, and comments with the command it ran. That would save time on the boring failures.

But I do not fully trust the next step. I have wanted an agent to handle the boring CI failure, but I stopped when I realized it might comment confidently before it had reproduced the failure locally.

The part that worries me is not the patch itself. It is the noise around it: wrong diagnosis, extra PR comments, fixing the symptom, or making the pipeline greener while the actual issue is still there.

If you were allowing this in a small team, what would you require before the agent comments or pushes a fix? Reproduction command, exact log link, human approval, or only draft patches?

https://redd.it/1uuzyxo
@r_devops

Weekly Self Promotion Thread

Hey r/devops, welcome to our weekly self-promotion thread!

Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!

https://redd.it/1uv3kzk
@r_devops

Help in implementing CICD for Snowflake Objects.

Hey all. I am building a POC for deploying Snowflake objects like table, stream, task, stage etc... to multiple environments like DEV/QA (single only) & PROD with the help of CICD and used Github actions for it.

I have never built something like this before and never worked on project consisting CICD in it.

So, I have used Schemachange library to detect schemachange and sqlfluff for SQL linting. Also using some python scripts to build backup of existing DB snapshot before deployment and rollback script if anything break during deployment.

I am testing this in DEV env only but i am confused how can i validate the objects that are being created with schemachange library and SQL files (which contain DDLs of objects). like how can I verify that the object created is correctly build in the target or not.

and if there is any other suggestion / best practice you guys have that is also welcome on how can i improve the CICD pipeline for it.

Thanks

Bots and moderators I am 100% human only don't remove my post!!!

https://redd.it/1uv7sbp
@r_devops