TLDR DevOps 2025-03-10

The 6 Pillars of DevSecOps is a series of research papers from the Cloud Security Alliance (CSA). The research provides a step-by-step framework to embed security into your software development lifecycle.

Each paper in the series looks at one foundational pillar of DevSecOps, offering vendor-neutral analysis and actionable guidance. Among the topics covered:

• Collective responsibility through a security-first culture.
• Pragmatic implementation with framework-agnostic strategies.
• Integrating automated security controls into your CI/CD pipeline.
• Key DevSecOps metrics such as vulnerability remediation times and deployment frequency.

Get free access to the full research bundle

Amazon EKS now enables default envelope encryption for all Kubernetes API data in clusters running version 1.28 or higher, enhancing security with AWS KMS keys. Users can choose to use AWS-managed keys or bring their own encryption keys for added protection.

GitHub Enterprise Cloud now includes Azure DevOps Basic usage rights, eliminating the need for separate payments. Users automatically gain access when logging into Azure DevOps via Microsoft Entra, with no extra charges.

Atlassian is fully transitioning Opsgenie's capabilities into its platform, embedding operations features into Jira Service Management and Compass. Opsgenie customers can migrate to Jira Service Management for end-to-end incident management or to Compass for alerting and on-call management.

Shopify built an in-house observability platform, Observe, to handle its massive scale efficiently, reducing costs and improving performance by leveraging open-source tools. This strategic move allowed better integration with internal workflows, enhanced troubleshooting, and provided deeper insights into both system health and business impact.

This article documents idiomatic Go practices, offering rationale and examples for consistent code style, naming conventions, and readability improvements. It serves as a supplement to Go's official style guide, covering topics like error variable naming, empty string checks, mutex struct organization, and avoiding redundant os.Exit(2) calls.

When systems turn red, how can you bring them back to green quickly? This guide by Datadog outlines a simple 4-step process for ensuring your organization's response to incidents is as efficient and effective as possible, using tools like on-call scheduling and incident management. Read the guide

SearXNG is a privacy-focused metasearch engine that aggregates results from various search services without tracking users.

Chroma is an open-source embedding database that facilitates the creation of Python or JavaScript Large Language Model applications with memory. It uses Sentence Transformers for embedding by default but also supports OpenAI and Cohere embeddings, enabling nearest neighbor searches instead of substring searches like traditional databases.

This article emphasizes the importance of well-structured commit messages, which aid code review, long-term maintenance, and debugging. It provides guidelines on what to include (e.g., motivation, impact, and cross-references) and what to avoid (e.g., redundant details and short-term discussions), offering practical examples to improve clarity and efficiency in software development.

Octopus 2025.1 introduces Config as Code for Runbooks, allowing users to store, manage, and version-control runbooks in Git alongside application code for better synchronization and auditability. This feature streamlines workflow management, enhances rollback capabilities, and is available now for Cloud customers, with self-hosted support coming soon.

Amazon GameLift Streams is a new capability in Amazon GameLift that allows game publishers to build and deliver a global, direct-to-player game streaming experience.

Moving from a Staff+ team lead to an org-level leader often leads to a "Performance Cliff," where previously effective skills no longer suffice, causing feelings of failure, overwhelm, and self-doubt.

Slack has launched enterprise search, which expands Slack AI to include knowledge from key applications like Google Drive and GitHub.