Hello all! Curious how folks here handle TLS certificate ownership across teams? We recently had a renewal silently fail and the tricky part wasn’t expiry — it was figuring out who owned the endpoint and where else the same cert was reused. Are you just relying on cert-manager/ACME + alerts, or do you track ownership/runbooks somewhere?

Hello folks, I saw an open platform called Releasea (https://releasea.io/) that looks like a Backstage/IDP style approach to organizing deployments, environments, and automations, and I’ve noticed some mid-sized companies starting to adopt tools like this. Has anyone here tried it or used something similar?

👉 This community is not a billboard. If you join but do not contribute by answering questions before promoting your own materials (other than sharing opportunities in #CBWJ68W9X), your messages will be deleted and your account may be deactivated.

Hey there 👋 , I came across the

Ref architecture

diagrams on https://cloudposse.com/architecture ( which are awesome btw) Two quick questions: 1. Are these available in any editable format (e.g., Miro, Lucidchart, or even just high-res images)? 2. Are we okay to use/adapt them in internal slides and docs for our team? Thanks in advance!

This message was deleted.

Hey everyone 👋 That whole Claude Code npm leak last week really got my attention basically one small packaging mistake ended up exposing a huge amount of source code, and attackers started taking advantage of it almost immediately by uploading malicious versions of packages and impersonating internal ones. Pretty crazy how fast that escalated. It made me realize how many pipelines just build and ship code without really checking if what’s being deployed is safe or verified. So I’ve been experimenting with a setup in my homelab where I: • generate a list of everything inside my builds (SBOMs) • sign my container images using Cosign • add some basic verification rules using Kyverno so only trusted images can run I’m also looking into SLSA, but still wrapping my head around that part. Not sure yet how much this would actually help in a real-world incident like that, but it’s been a really good learning experience so far. Would love to hear how others are thinking about this or handling it in practice — still learning here 🙏

basically the goal is simple, make sure every container image that runs in production can answer three questions: what's inside it, who built it, and was it tampered with. If it can't answer all three, it doesn't get in

Hello everyone, a problem we are having is that CODEOWNERS protect filenames, example

*elasticache*

for the dba-team to approve. However, we need to have some sort of codeowners based on TF plans and resources affected. Does Atmos or AtmosPro provide this functionality? (ie. if a plan touches a PRD database, we need dba-team to approve)

hello

Hi, Any recommendations for getting into Toptal? I'm trying to join the platform—do you think I should start networking daily?

This message was deleted.

hi guys, somebody knows if is possible learn AWS (how build a IA Landing-Zone) on a Free Tier (Using OpenSearch, BedRock, AppFlow, Amazon Q?) I need learn it, I'm a self-taught student

I need to learn in depth EKS too, but I need to practice with new Gateway API on EKS and if I learn with k8s on my local computer, the real problems I can't learn well (production) and AWS is very expensive for me (not a company)

Hi is the weekly call still happening? I don't see it on my calendar anymore.

I re-joined, thanks!

Anyone out there can suggest a reliable open source SAST?

jfyi - https://depthfirst.com/nginx-rift Impacting: • *NGINX Open Source*versions 0.6.27 through 1.30.0. • *NGINX Ingress Controller*3.5.0 through 3.7.2, 4.0.0 through 4.0.1, and 5.0.0 through 5.4.1. among the list for anyone using it

Hello, everyone. My name is Pedro, and I am currently developing my thesis on AI Ethics and Governance in DevOps and Open-Source. I am at the stage of conducting interviews to understand if the issues identified in the literature are actually reflected in the daily lives of those working in DevOps. I would like to ask if you would be willing to participate in an anonymous online interview with me. Thank you!

this isnt funny anymore, https://www.zdnet.com/article/qualys-flags-a-linux-kernel-security-issue-that-could-lead-to-stolen-ssh-keys/

for anyone dreading the new billing models by github copilot, (and others) - i've been laying with https://github.com/open-jarvis/OpenJarvis as an offline alternative. ive also played with https://www.tabbyml.com/. would love to hear what you all are doing / playing with in this space (resurect #C05319EBWTW possibly @Erik Osterman (Cloud Posse))

reference article around metered billing for copilot - https://cirriustech.co.uk/blog/github-ai-credits-first-morning/

Hey, I am Vineet from Bengaluru, Java and SpringBoot developer working on API monitoring infrastructure. Building Sentinel AV - monitors REST and SOAP API endpoints for uptime, latency, performance and schema drift. Running on AWS EC2 + RDS, Dockerised, Kafka-backed alert pipeline. Happy to discuss: -> AWS infrastructure for Spring Boot services -> Kafka deployment and operations -> API monitoring patterns -> Docker + EC2 production setups

Hi guys. I have a question out of curiosity. How do you feel about AI agents and DevOps? What's the future of DevOps? Are you using AI agents in your day to day work? It's obvious that the AI agents require DevOps human sight, but I'm curious about what direction you think that DevOps is going to given AI agents invading the infrastructures on all major platforms. I got a feeling that DevOps will also be moving eventually into more the security/governance side (I could be wrong).

I'm thinking of running infracost.io POC in my company, and I'm curious if anyone here has used it? any gotchas or limitations to be aware of? Are there alternative services that track cost in Tetraform stacks/code ?

Hey everyone! Quick question for the group: If you were starting your DevOps journey over from scratch today, what are the top 2 or 3 projects you’d absolutely make sure to have on your GitHub profile? Curating a roadmap and love to hear what tools and architectures you think move the needle most right now.

https://atmos.tools/cli/commands/auth delivers a page not found error.

#CQCDCLA1M is not a billboard

Hello, Anyone here works in Engineering Team, AMD?

Hi everyone! 👋 I'm Adriel, a Senior Software Engineer joining the team from Pampanga, Philippines. I bring 7+ years of experience in building scalable systems, with a recent focus on AI-powered workflow automation using LLMs and RAG. Outside of writing clean code and designing microservices, I'm passionate about mentoring and solving complex technical challenges. Looking forward to collaborating with you all!

Hey everyone! 👋 Joining from Guatemala. I’m a Systems Engineer heavily focused on the infrastructure and platform side. I spend my days managing mission-critical backend operations, writing Terraform, and orchestrating workloads on Kubernetes and GCP. I’m currently bridging the gap between heavy infrastructure and AI by architecting scalable MLOps and RAG pipelines. I joined SweetOps because I've been a huge fan of the Cloud Posse Terraform modules and want to learn from the absolute best in the IaC and Platform Engineering space. Always happy to talk shop, so if anyone ever needs a sounding board for GCP architecture, Docker, or GKE debugging, feel free to reach out. Looking forward to learning from you all!