270
Reddit DevOps. #devops Thanks @reddit2telegram and @r_channels
Inquest — Autonomous AI Infrastructure Investigation | Nebius AI Hackathon Demo
https://www.youtube.com/watch?v=ZvImEHQ09UY
https://redd.it/1xjrekr
@r_devops
Datadog: We're paying the bill, so why the hell can't we access our cost data?
I've been voluntold to analyse our Datadog costs because our bills keep going up, and we're paying extra for new features if we go over the committed spend. It's a bit mismanaged across the org. Naturally, I need billing data to do the analysis (and do some MI outside of Datadog).
These endpoints all return `403 Forbidden`:
* `/api/v2/usage/historical_cost`
* `/api/v2/usage/estimated_cost`
* `/api/v2/cost_by_tag/monthly_cost_attribution`
I'm an Admin with all relevant billing and usage permissions. Other usage endpoints work fine, and I can see usage data in the UI.
We buy Datadog through a reseller, and I suspect our organisation is a child org under the reseller's parent org. I think that explains why I can't access historical cost data through the API.
Our reseller has gone quiet for quite some time. I've contacted Datadog Sales and Support (I have no idea why we have a direct connection via a shared Slack channel even though we're not direct customers), but they've basically ghosted me.
We're paying for the service, our bills are increasing, and I'm trying to understand where the money goes. Why is accessing our own cost data such a nightmare?
Has anyone dealt with anything similar?
https://redd.it/1xjgjek
@r_devops
Who is leading the pack in AI workloads AWS or Azure?
I am curious to know who is leading the pack in terms of market share on AI workloads AWS or Azure or GCP?
Yesterday couple people contacted me I ironically both asking for "Experience delivering ML workloads on Microsoft Azure, including Azure Machine Learning or Azure Databricks"
https://redd.it/1xjemaz
@r_devops
Q4 SaaS audit just ended and I feel like an idiot — we’ve been paying Datadog to observe less and less of our stack every quarter
wrapped our quarterly SaaS + infrastructure review yesterday. first time we actually put the observability line item next to what we’re getting for it. bad move for my mood.
DD spend this year is up \~40% vs last year. we can’t point to a single new capability that justified it. just more data, at a higher rate, with a bill we’ve quietly learned to accept.
the part that actually got me: someone asked “are we using everything we’re paying for?” and the honest answer is no — because we’ve been sampling down on high-volume services to control cost. we have known blind spots we’re not fixing because fixing them means a higher bill. let that sink in. we’re paying for observability and making deliberate choices to observe less.
so I pushed the team to actually evaluate alternatives instead of defaulting to “Grafana will fix it” for the fourth year running.
we’ve looked at the usual shortlist. signoz — solid OSS story, support was slow when we hit issues in prod. new relic — pricing model is not meaningfully different from DD. grafana cloud — needs 2 engineers just to maintain it, that’s not saving us anything.
then during our AWS Summit debrief, one of our partners mentioned TrueWatch. SG-based, OTel-native, usage-based pricing, claims to be 40-50% cheaper than DD for equivalent coverage. we’re currently on trial.
what actually got my attention wasn’t the pricing — it was the support model. we’ve had a few P1s at 11pm SGT where DD support was basically an async ticket queue. TrueWatch has a local team and actual SLA windows in SGT. we have Indonesia-based engineers on our team and the timezone reality is genuinely different when your vendor is built for APAC vs treating APAC as an afterthought.
but I’m not sold. the concerns are real:
* it’s a growing platform. the integrations list is shorter than DD’s.
* internal buy-in is harder when the name doesn’t ring a bell to leadership
* I don’t know enough about their global coverage to be confident if we expand outside SEA
genuinely curious what the r/devops experience is on this. has anyone here actually moved to something outside the top 4? specifically interested in whether APAC-based teams have found tools that are actually built for this operating context.
and if you’re still on DD, are you actually happy with it, or have you just accepted the cost as the cost of doing business?
https://redd.it/1xj9ncm
@r_devops
Github Account Got Suspended
It has been almost 3 days.. I was actively pushing my repos and working hard to create a opensource project. During this crucial time my account got suspended and now I'm really don't know what to do next.. do you guys faced such issues or do anyone know how long will it takes to unflag your account?
https://redd.it/1xj54ol
@r_devops
looking for a study partner to learn about devops
hello, I am a beginner programmer that's looking to learn about devops. i've made a web app, and also am currently learning algorithms and python. looking to see if anyone knows what devops is essentially thank you
https://redd.it/1xiwurc
@r_devops
Any one from Delhi/Dwarka for INFRA coffee discussion this weekend.
Hey, I'm new in the city, and looking for likeminded folks to chat and discuss current INFRA change happing.
https://redd.it/1xijzfm
@r_devops
Dealing with Colleague's AI-generated Code Reviews
As the title says, a new colleague recently joined our team, and he uses AI for everything. Not a single Slack message of his comes from his fingertips unfiltered.
The real pain point has been PR reviews. Our team is small, so reviews are hard to come by. I expected that having another teammate would make things smoother since we could share the review load, but his reviews don't add value, and they actually slow down our development cycle more than before.
I like to break my changes into small, digestible chunks that are easy to review. The problem is that he runs Opus 5.5 on xhigh against every change, and it nitpicks things that aren't even in the PR. It could be a two-line documentation change, and he'll comment that some existing code elsewhere in the same file, outside the scope of the change, needs to be modified. He then marks the pull request as "Changes requested" and doesn't re-review it for days on end.
How would you go about discussing this kindly with him?
https://redd.it/1xij5hc
@r_devops
Late 30's IT dude , looking for honest review
https://redd.it/1xi28j1
@r_devops
Kestrix: CI/CD pipelines defined in HCL outside the repositories, with DAG-based triggers
https://redd.it/1xid1m5
@r_devops
Devops with AI..
I've recently met a former colleague who currently works as a DevOps engineer at a company that forces its employees to use AI (Claude, I guess). Each employee has an AI budget that he HAS TO use every month. I believe the goal is increasing productivity per employee.
I have a lot of concerns about this approach to work, especially from the perspective of security, privacy, data leaks, and having a non-open-source AI app installed locally. What if the tool is hacked? What if my credentials are leaked? What if AI hallucinates and deletes non-recoverable data?
On the other hand, I understand this might be the new industry standard. If yes, I don't think there's a point of resisting change since the train will leave without me.
I would like to see what the perspective of other industry experts is and how they navigate this topic. Are you an early adopter? Or do you prefer to wait until the storm passes?
https://redd.it/1xhl0h8
@r_devops
The $87K API key leak had nothing to do with .env
Every time someone posts about a leaked API key, the top advice is the same. Put it in .env, add .env to .gitignore, done.
After the OpenCode breach and the LiteLLM mess this month I went back through the leaked key stories people posted this year. Found 10, with bills from $2 to about $87K. Not one was "I pushed my .env to GitHub".
Where the keys actually were:
\> In the JS bundle. A VITE_ variable in a gitignored .env, repo scanner said clean, then the build shipped it to every visitor. One scan of 978 AI-built apps found 37 doing this.
\> In an agent config file. LiteLLM's master key sat in opencode.json, got force pushed over but never revoked, and was used 136 days later.
\> In someone else's tool. Keys saved in OpenCode's console got drained, one person lost $5,200 of company credits.
\> In a WordPress backup plugin. One root AWS key reused across sites, tested on Aug 23, used 56 days later for about $8K of Bedrock.
\> In old Google keys that quietly gained generative AI access. That's the $87K one.
\> In nobody's leak at all. Someone got into an Anthropic console through email login and created 3 new keys, $5,473 in a few hours.
And then last week Railway got hit. Attackers decrypted customer environment variables straight from the platform, and Railway told everyone to rotate every key. Gitignored, never pushed, stolen anyway.
What actually helped was boring:
\> Hard spending caps. The one person who had one lost a few minutes of usage and that was it.
\> An alert isn't a cap. The $87K team's budget alert fired at $550, five hours in.
\> Revoke, don't clean up. Force pushing doesn't un-leak anything.
\> Delete keys you don't use, and know where every key lives (Infisical, Vault, whatever you already have).
\> Don't count on a refund. The $87K bill got $55K off, they still owe about $32K.
I'm not saying stop using .env locally. I'm saying "it's gitignored" isn't the end of the conversation.
https://redd.it/1xhoqdk
@r_devops
How do you prevent analytical queries from tanking your transactional database?
I was checking out how to build a live operational dashboard for a logistics app and found out about composed vs. converged HTAP architectures.
I’ve always been warned never to run heavy analytical aggregations on the primary transactional DB because the contention spikes your transaction latency. But a guide I was reading explained how HTAP systems are handling this now. A “converged” system runs both through the same engine (which sounds risky for resource contention), while a “composed” system actually separates the compute engines and keeps them in sync through shared storage or replication, so each side stays optimised for its own workload.
Apparently, you’re supposed to measure p99 transaction latency while the analytical queries are running, not separately.
If you are running live analytics on operational data, how are you keeping the two from interfering with each other?
https://redd.it/1xhtfxb
@r_devops
Interview tomorrow (5+ YOE DevOps), CV deep-dive, but I’ve been caught in reorg purgatory doing nothing for months. How do I spin this?
I have an interview tomorrow for a DevOps Engineer position (I have 5+ YOE). The recruiter explicitly told me the interview will be a deep-dive through my CV.
I’m in a massive bind regarding my current/most recent role and need some urgent advice on how to frame it.
**The Situation:**
* **Early this year:** I was the lead engineering resource tasked with getting a major product production-ready. The literal *day* it was ready, a massive reorg hit. The product was stripped from me, and most of its target end-users were laid off.
* **Immediately following:** I was pivoted to head up another large project for a different internal product. I busted my ass, completed it successfully, and my manager was impressed. Then... *another* reorg hit. This product was also taken away.
* **The past 5+ months:** My team was merged with another to form a new SRE team for a completely separate product. The scope was entirely undefined. In fact, one colleague's sole task for the last 4 months was just *figuring out what our responsibilities are*.
Because of this reorg limbo, **I have had zero actual engineering work to do for months.** I’ve repeatedly met with my manager and skip-level to voice concerns, but I just get generic corporate hand-waving about a "clear roadmap ahead."
**The Dilemma for Tomorrow:**
If they deep-dive into what I am doing *right now*, I see three options, and they all feel terrible:
1. **The Brutal Truth:** Admit I’ve been sitting on my hands doing nothing due to corporate dysfunction. (Worried this looks toxic or makes me look unmotivated).
2. **The Total Lie:** Pretend I’m still actively working on those two successful deployment projects and that they were never taken away. (Worried because my poor recall will make it obvious I haven't touched the code recently, and I'll have to fabricate metrics, current challenges, and future roadmaps).
3. **The Middle Ground:** Pretend I *just* transitioned off those projects a few weeks ago (similar issue as option 2).
How do I handle this in a technical deep-dive without sounding like a liar or a slacker? Has anyone successfully spun "reorg purgatory" to a hiring manager?
Thanks in advance!
**TL;DR:** 5+ YOE DevOps engineer with a CV deep-dive interview tomorrow. This year, I built and completed two major projects, but back-to-back corporate reorgs stripped them away. I've spent the last 4 months in team-merger purgatory doing absolutely nothing. Do I tell the truth, lie and pretend I'm still on the projects, or find a middle ground without looking like a slacker?
https://redd.it/1xhpyph
@r_devops
Seeking Guidance from DevOps Professionals | Career Transition Advice
I have 5 years of overall IT experience, including 3.5 years in Application & Production Support and experience in Storage Administration.
My current skill set includes application monitoring, incident management, troubleshooting, SQL Server, Windows Server, IIS, AppDynamics, and Linux fundamentals. I am also an AWS Certified Cloud Practitioner.
I am interested in transitioning into DevOps or Cloud Engineering and would love to learn from professionals who have made a similar career move.
I would appreciate your guidance on a few questions:
• Is it realistic to transition from Application/Production Support to DevOps with my current experience?
• Which skills should I prioritize to become job-ready: Linux, scripting, Git, Jenkins, Docker, Kubernetes, Terraform, or AWS?
• Would you recommend moving directly into a junior DevOps role, or transitioning through a Cloud Support, Platform Support, or SRE role?
• How much hands-on project experience is typically expected by recruiters when considering candidates transitioning from support roles?
I am ready to put in the work and build practical skills alongside my current job. I would appreciate honest advice, learning resources, or insights from anyone who has made a similar transition.
https://redd.it/1xhnl2s
@r_devops
Do you think Devops is less exposed to « IA replacement » than a software engineer ?
I am a fullstack dev and I’m not really serene about the future of my job.
Im thinking about reorienting towards devops.
Do you think it’s at least a bit safer or every IT jobs are definitly doomed?
https://redd.it/1xjd9dv
@r_devops
Has the recent vulnpocalypse changed how you think about infrastructure security?
With the recent wave of high-profile vulnerabilities, I'm curious whether it's changed how anyone is approaching infrastructure security.
Are you mostly continuing with business as usual: keeping up with patches, applying mitigations, and moving on?
Or has it pushed you toward more preventative security measures, such as:
Reducing your attack surface by minimizing what's installed and running.
Moving toward immutable infrastructure.
Implementing stricter least-privilege policies.
Isolating workloads to limit the blast radius of a compromise.
Tightening runtime monitoring and application execution controls.
Improving visibility into what's actually running in your environment.
I'm curious whether these incidents have changed anyone's security strategy, or if it's just another (particularly exhausting) round of patching. Would love to hear how people are approaching this problem.
https://redd.it/1xjfw5p
@r_devops
How do you maintain one Helm chart across 50+ customer clusters you don't control
For some context, we deploy one application into customer-owned clusters. Mostly EKS, AKS and GKE in the customer's own cloud account, plus a few on-prem.
\- 55 clusters today, more coming
\- Single Helm chart, one values file per customer
When we started, the chart was clean but now it has conditionals everywhere and I am wondering if it’s the right approach. We add ifs for ingress controllers, storage classes, private registries and whatever k8s version is deployed in the cluster… Now with all the “ifs” mess, nobody wants to touch the template anymore.
What do you guys do in prod? Please no vendor pitches, more interested in what works (or fails) in this situation.
https://redd.it/1xjd1u1
@r_devops
Stuck Between IT and RKE2: Need Advice on Operating Without Sudo Access
>Hey guys,
>
>I am currently implementing an RKE2 setup in my DevOps team to handle deployments and deliveries for our application.
>
>The problem is that I won't have direct root access to the servers, so access to root-owned directories is also restricted. If I want to install anything, requests have to be raised to the IT team, and they will get it installed. (The thing I hate about MNCs they're too paranoid and too slow as well, iykyk.)
>
>But here's the frustrating part: the "installation" done by the IT team is often just placing the downloaded packages in my accessible directory... duh!!!
>
>So then I need to contact them again and have them actually complete the installation and setup using their root access. And even after the installation is completed, there will still be situations where I'll need elevated privileges to manage pods, services, deployments, and other operational tasks.
>
>I can't exactly request sudo access, so at this point I honestly don't know what I'm supposed to do or what request i need to raise as well.
>
>My requirement is very minimal for now, as I am only experimenting with this(but will be mandated in future). I won't be connecting remote agents, just a single server, and based on my application requirements I narrowed the packages required to the following:
>
>
>
>rke2-images-core.linux-amd64.tar.gz
rke2-images-cilium.linux-amd64.tar.gz
rke2.linux-amd64.tar.gz
>
>
>
>Based on the documentation, I tried using customized paths and accessing the binaries directly to complete the setup, but I still got stuck at some point where root access was required. I don't want to go into everything I did to get there, so yeah, if you guys can suggest the minimum set of steps or activities that I can request from the IT team, which would allow me to effectively use and manage this RKE2 setup afterward, that would be really helpful.
>
https://redd.it/1xj9ajw
@r_devops
Binance hack and a DevOps laptop
https://redd.it/1xj4flc
@r_devops
Passed the AWS Cloud Practitioner (CLF-C02) exam — sharing my study plan, resources & pro exam tips!
https://youtu.be/fH7CaAw--vc
https://redd.it/1xiivfg
@r_devops
DevOps conferences in Europe 2027
Hi everyone,
What are some quality conferences in Europe worth visiting in 2027?
https://redd.it/1xijx97
@r_devops
I landed a "devops" role as a junior
30K\~ DAU, I have full ownership over an infra under AWS/multiple on premise servers.
we use ECS, terraform, instead of ansible I use a deploy.sh that i give to my boxes with terraform, no graceful deploys. we have our own orchestrator (K8S like) for stateful containers that we have to spin up and down very often (median 1 min of uptime per container) with unsafe code coming from AI/users.
I took the place of someone who left that company and explained me nothing, we are 2 devs, nobody understands how this entire infra works expect me. have been adding observability a lot using cloudwatch, multiple alerts so I page myself at the right times, it's stable but we need to scale to at least 5x (an objective the hierarchy gave me). it currently costs 3.5k/month in aws/on premise servers. btw it's not a classical rest api where you run stateless apis and that's it.
I just discovered how redis worked under a distributed system like this, it's quite good :) I have been a postgresql guy but redis has been a saver for our threat model.
I often read here that you should put everything : EKS + K8S, ansible, terraform, make HA, grafana etc.. but since I manage this entire infra I have been resilient to all of this. If I refactor everything right now they have nobody to do the backend (which is also what I do here) -> "startup" role where one guy has multiple roles.
for the terraform it's all AI, I have been doing a lot of modifications and have created a terraform plan under ci cd so I can review myself, I removed a lot of "destruction" like the database, i versioned the s3, versioned the terraform state, put it to a private s3 etc...
there have been big big security issues (xss, csrf, cookie stealing, untrusted code that owns the entire box, shared passwords, untrusted s3 location so you could overwrite other users...) that were there before I got here
nothing rly interesting maybe for you guys in this experience but I have learned a lot, it has been a crescendo experience where i'm getting to understand more and more which tools to put there because I am the one who owns it 100%, and have to also do features (backend) so not much time either.
https://redd.it/1xigylx
@r_devops
How do you contain your agents' accesses?
Hey !
I guess most of us have a lot of admin accesses to tools like AWS, k8s clusters, Datadog, GitHub etc.
How do you contain your agents to read-only or curated permissions? Without restraining your own accesses.
I do have some sort of hook as a guard + a setup on pi.dev that copy my config and extract the read-only accesses only to do so, but it's never completely opaque.
https://redd.it/1xid62t
@r_devops
Suggest a good laptop for DevOps under ₹90,000 in India
Hi everyone!
I'm looking to buy a new laptop with a budget of ₹90,000 for learning and working with DevOps.
My primary use cases will be:
Docker and Docker Compose
Kubernetes and Minikube/kind
AWS (EKS, EC2, CI/CD, etc.)
Jenkins, Terraform, Ansible and Linux
Running multiple containers and virtual machines
Programming and general development
I'm not looking for a gaming laptop specifically. My priority is performance, multitasking, Linux compatibility, cooling and long-term reliability.
I'd appreciate recommendations based on real-world experience, especially from people working in DevOps or cloud engineering in India.
Thanks!
https://redd.it/1xhn43x
@r_devops
building is so easy and verification becomes bottleneck now !!
now we all know .. building/coding is easy with lot of ai tools/coding agents.. and pressure we are seeing during the deployment cycles verification and human in the loop cycle..
and wondering how are you guys handling it? we have team of 15+ and multiple teams and using Asana agents they have long runing agents and produce features/bug fixes super fast.. but determinstic verification lacks..
https://redd.it/1xhs0o2
@r_devops
CloudFlare Tunnel with pre-auth (and multiple IdPs)
I am working on setting up CloudFlare tunneling for a SaaS product in order to get WAF in front of the application and potentially use the CDN for faster distribution.
In the process there was also a requirement to move over to using pre-authentication in front of our SaaS solution, so that all requests are authenticated before they even hit our servers (similar to Azures application proxy).
It was suggested to use CloudFlare access, but this seems to more targetted towards internal apps and replacing / addition to a VPN in order to get ZTNA.
What would be a good way be to setup this pre-authentication? To me it seems there is no CloudFlare solution that handles this, so either I have to setup something to handle this check on CloudFlare or find a different vendor.
https://redd.it/1xhnx2t
@r_devops
blacksmith vs depot vs namespace alternatives, anything else worth a trial?
we were on buildjet until it shut down in march, been back on stock github runners since and the builds are noticeably slower. team of about 25, linux x64 mostly with a bit of arm
blacksmith, depot, namespace and avrea all look the same on the pricing pages so i cant pick, and every comparison i find is written by one of them lol. also seeing warpbuild and runs-on mentioned
if you picked one and stuck with it, what made you choose it? or did you try a couple and bounce off one
https://redd.it/1xhq1sj
@r_devops
I recreated a Node2Shell RCE attack in the form of an interactive exercise
On 21 October 2026, Google released patched versions of its Brotli compression library for CVE-2026-111497, a vulnerability nicknamed Node2Shell. It is an out-of-bounds write in the Brotli decoder. Node and many Python stacks bundle their own copy of Brotli, so patching libbrotli on the host doesn't fix them.
I made an interactive, hands-on lab exercise on this vulnerability. The goal is to give engineers a general overview of the attack vector and the response. You'll exploit a service as an attacker, then switch roles to the on-call engineer: upgrade the runtimes, rebuild and redeploy the images, verify the fix, and rotate the deploy token the attacker read from memory.
I did my best to highlight all the details, but if you notice any issues or inconsistencies, please let me know!
https://ransomleak.com/exercises/http2shell-rce/
https://redd.it/1xhohrx
@r_devops
Preparing for OCTA and CCA
Hey guys,
I'm preparing to get the CCA and OCTA cert to become golden kubestronuat, i see that the kode cloud cuurses are 20 hrs each, is it really necessary to go with that courses? also i saw that kyverno kode cloud course is so deprecated, is this true? i need to get them fast because cks will expire and i dont want to do it again xD
Thank you so much.
https://redd.it/1xhlud8
@r_devops