⭐Masterclass:

From Docker Compose to Kubernetes Manifests

A hard look at GuardDuty shortcomings

Streamlining Keycloak in Kubernetes

The hater’s guide to Kubernetes

A skeptic's first contact with Kubernetes

🔍Secret Knowledge:

Enhancing Bitnami Helm Charts Security

Cloudflare adopted OpenTelemetry for logging pipeline

Josh Grose on LinkedIn: I spent the last 3 yrs outside of observability

Did you know the CNCF has an actual cookbook? Not metaphorically!

Unfashionably secure: why we use isolated VMs

⚡Techwave:

How Figma Migrated onto K8s in Less Than 12 months

Github Copilot Autofix: Secure code 3x faster

New Kubernetes CPUManager Static Policy: Distribute CPUs Across Cores

Announcing mandatory multi-factor authentication for Azure sign-in

GitHub scales on demand with Azure Functions

🛠️HackHub: Best Tools for the Cloud

Web tool for database management

The devs are over here at devzat, chat over SSH!

CloudFormation_To_Terraform

Debugging tool for Kubernetes which tests and displays connectivity between nodes in the cluster.

Kubernetes network solution

Cheers,

Shreyans Singh

Editor-in-Chief

From Docker Compose to Kubernetes Manifests

This blog post provides a beginner-friendly guide for developers transitioning from Docker Compose to Kubernetes manifests, using Minikube for local Kubernetes development. It walks through setting up Minikube, deploying a sample application using Docker Compose, converting Docker Compose files into Kubernetes manifests with Kompose, and finally deploying the application on Kubernetes. The guide emphasizes practical steps, like generating and applying Kubernetes manifests, and validating deployments using the Minikube dashboard.

A hard look at GuardDuty shortcomings

AWS GuardDuty, while a cornerstone in cloud threat detection, isn't without its flaws. It offers good coverage and deep integration with AWS services, but its limitations in service support, detection latency, and cost can leave gaps in your security posture. Adversarial simulations and benchmarks reveal that GuardDuty can miss critical threats, and its detection can be slow, especially for high-impact, low-volume attacks like S3 ransomware.

Streamlining Keycloak in Kubernetes

In this blog post, the author, a DevOps Engineer at Tikal, shares how they automated the deployment and management of Keycloak, an open-source identity and access management solution, within a Kubernetes environment. By leveraging Kubernetes’ native capabilities, Helm, and Python, they streamlined the complex configuration process, which typically requires extensive manual adjustments. This approach not only ensures consistency and reduces manual efforts but also enables scalable and repeatable deployments.

The hater’s guide to Kubernetes

Kubernetes often gets a bad rap for being overly complex, especially for startups with small teams. Critics argue it’s over-engineering for tasks that don't need such a heavyweight solution. The key to avoiding its complexity is to use only the necessary features and ignore the rest. While Kubernetes isn’t for everyone, especially for those needing quick, ephemeral workloads, it's a solid choice if you need the robustness it offers and are careful in its application.

A skeptic's first contact with Kubernetes

The author’s first real exploration of Kubernetes revealed its core concepts like control loops, services, and workload management, which actually simplify and automate many tasks traditionally done manually. Kubernetes uses controllers to ensure that workloads meet desired states, services to manage network traffic efficiently, and storage management to handle data persistence across pods. While the system has some quirks and limitations, its approach to automating and scaling workloads has proven to be a valuable evolution in managing modern infrastructure.

Quick Start Kubernetes

The course prepares you to leverage Kubernetes for continuous development and deployment. Whether you're scaling applications to meet demand or ensuring seamless updates with minimal downtime, you'll be equipped with the skills necessary for efficient and effective Kubernetes management. This course is your gateway to becoming proficient in one of the most essential tools in the DevOps toolkit.

Enhancing Bitnami Helm Charts Security

Bitnami enhanced the security of its Helm charts using Kubescape, an open-source Kubernetes security tool that identifies misconfigurations by comparing configurations to industry best practices. By integrating Kubescape into their build pipelines, Bitnami made significant improvements such as eliminating group root dependencies, configuring immutable filesystems, and reducing misconfigured resources.

Cloudflare adopted OpenTelemetry for logging pipeline

Cloudflare recently transitioned its logging pipeline from syslog-ng to OpenTelemetry Collector to enhance performance, maintainability, and telemetry insights. This move allowed the team to leverage Go, a language more familiar to their engineers, and integrate better observability through Prometheus metrics. Despite challenges like minimizing downtime during the switch and ensuring compatibility with existing infrastructure, the migration has opened up opportunities for further improvements, such as better log sampling and migration to the OpenTelemetry Protocol (OTLP).

Josh Grose on LinkedIn: I spent the last 3 yrs outside of observability

Josh Grose (ex-Principal PM, Splunk), after three years away from the observability space, was surprised to find that despite companies spending around 30% of their cloud budgets on monitoring, reliability hasn't improved significantly. He observed that even when Service Level Agreements (SLAs) are met, it often comes at the cost of developer productivity and experience. Engineering leaders are frustrated with the high costs and limited improvements in key metrics like Mean Time to Recovery (MTTR) and development speed, leading to the perception that observability has become an expensive and ineffective necessity.

Did you know the CNCF has an actual cookbook? Not metaphorically!

The "Cloud Native Community Cookbook" is a unique collection of recipes put together by the CNCF and Equinix Metal, born out of the increased time people spent at home during the COVID-19 pandemic. Instead of focusing on cloud technologies, this cookbook brings together food recipes shared by members of the Cloud Native community, originally exchanged in Equinix Metal's Slack channel.

Unfashionably secure: why we use isolated VMs

While modern cloud architectures often favor shared, multi-tenant environments for efficiency and scalability, Thinkst Canary opts for a less trendy but highly secure approach by using isolated virtual machines (VMs) for each customer. This choice prioritizes security by ensuring that each customer's data and services are completely separated, reducing the risk of cross-customer data breaches. Although this method comes with higher operational costs and complexity, it provides a stronger security boundary, making it easier to manage risks and sleep better at night.

How Figma Migrated onto K8s in Less Than 12 months

Figma completed its migration to Kubernetes in under a year by meticulously planning and executing a well-scoped transition. Initially running services on AWS's ECS, Figma faced limitations such as complex stateful workloads and limited auto-scaling. The decision to move to Kubernetes (EKS) was driven by its broader functionality, including support for StatefulSets, Helm charts, and advanced scaling options from the CNCF ecosystem. By Q1 2024, Figma had migrated most core services with minimal impact on users, resulting in enhanced reliability, reduced costs, and a more flexible compute platform.

Github Copilot Autofix: Secure code 3x faster

Copilot Autofix, now available in GitHub Advanced Security, is an AI-powered tool designed to help developers fix code vulnerabilities more than three times faster than manual methods. It analyzes vulnerabilities, explains their significance, and offers code suggestions for quick remediation. This accelerates the fixing process for both new vulnerabilities and existing security debt, significantly reducing the time and effort required for secure coding. Copilot Autofix is included by default for GHAS customers and also available for open source projects starting in September.

New Kubernetes CPUManager Static Policy: Distribute CPUs Across Cores

Kubernetes v1.31 introduces a new alpha feature called "distribute-cpus-across-cores" for the CPUManager's static policy. This option aims to enhance performance by spreading CPUs more evenly across physical cores, rather than clustering them on fewer cores. This reduces contention and resource sharing between CPUs on the same core, which can boost performance for CPU-intensive applications. To use this feature, users need to adjust their Kubernetes configuration to enable it. Currently, it cannot be combined with other CPUManager options, but future updates will address this limitation.

Announcing mandatory multi-factor authentication for Azure sign-in

Microsoft is making multi-factor authentication (MFA) mandatory for all Azure sign-ins to enhance security and protect against cyberattacks. Starting in the latter half of 2024, Azure users will need to use MFA to access the Azure portal and admin centers, with broader enforcement for other Azure tools like CLI and PowerShell set for early 2025. MFA, which adds an extra layer of security by requiring more than just a password, is shown to block over 99% of account compromises.

GitHub scales on demand with Azure Functions

GitHub faced scalability issues with its internal data pipeline, which struggled to handle the massive amount of data it collects daily. To address this, GitHub partnered with Microsoft to use Azure Functions' new Flex Consumption plan, which allows serverless functions to scale dynamically based on demand. This solution has enabled GitHub to efficiently process up to 1.6 million events per second, addressing their growth challenges and improving performance with minimal overhead.

commandprompt/pgmanage

PgManage is a modern graphical database client for PostgreSQL, focusing on management features and built on the now-dormant OmniDB project.

quackduck/devzat

Devzat is a chat service accessible via SSH that replaces the traditional shell prompt with a chat interface, allowing you to connect from any device with SSH capabilities.

aperswal/CloudFormation_To_Terraform

The CloudFormation to Terraform Converter is a tool that automates the migration of AWS CloudFormation templates to Terraform configuration files.

bloomberg/goldpinger

Goldpinger monitors Kubernetes networking by making calls between its instances and providing Prometheus metrics for visualization and alerts.

ZTE/Knitter

Knitter is a Kubernetes CNI plugin that supports multiple network interfaces for pods, allowing custom network configurations across various cloud environments.

📢 If your company is interested in reaching an audience of developers and, technical professionals, and decision makers, you may want toadvertise with us.

If you have any comments or feedback, just reply back to this email.

Thanks for reading and have a great day!