Eric Wilson

You know how in ArgoCD or Istio there's a "Control Plane" of sorts? As in, a Management Server. It's a Server that listens to responses. For example - I can set up ArgoCD on a management server that allows you to register other Kubernetes clusters to it. That way, the management server can send out all of the information to the registered clusters without every single cluster having to run ArgoCD. It lowers the management pains because there's one central server doing it all. Same rules apply with the Codiac Relay. It's the "brains of the operation". It doesn't store any data, it just relays (hence the name) the configurations you want in your clusters to the clusters. When you use the CLI, it sends the commands directly to the Relay and then the Relay communicates with the Codiac environment to manage and maintain clusters. That means you don't have to worry about local Kubeconfigs and configurations. We can test this by Execing into the Cofiac Relay. #kubernetes #devops #platformengineering

57

7 Comments

AWS Message Processing Framework for .NET is still in developer preview, but it's interesting as it encapsulates boilerplate code that probably have been written thousands of times. Looking forward to trying this library. I hope it will include some features in the future like supporting Kafka topics and Kinesis streams, and built-in support for message idempotency. https://lnkd.in/gUm9Xb-4

18

1 Comment

Agents for Amazon Bedrock support memory retention and code interpretation - now in preview. Dynamically generate code and run code snippets and enable your agents to learn and adapt over time. #AWSome #GenAI #AmazonBedrock https://lnkd.in/gAj2N9q4

7

Hardening Terraform for Federal Environments Lets talk about the supply chain risk of Terraform for a moment. If you're not familiar with Terraform, it's one of the leading Infrastructure as Code tools. It has a wide modular ecosystem for adding vendor specific resources to the terraform definitions. While this is extremely convenient to simply add an external dependency, it introduces enormous supply chain risk. The flexibility of linking external dependencies as the default behavior creates the risk. The worst part, is that by design, this is done at runtime. Every time you do a "terraform init" or "terraform plan". So if you plan to use terraform, make sure you first de-risk it, by shifting away from the default behavior. Here are some ways to harden it for use in a Federal environment and reduce the supply chain risk. - Don't use module URL sources outside of your boundary - Use only module URL sources you control - Use only module URL sources that you scan and monitor - Run terraform within the boundary and without internet access - Promote terraform modules and providers as you would any code - Don't blindly pull in any terraform module. Review all of them and clone. - Use a git you manage and pin on signed hashes (don't simply use versions) - Validate hashes of modules you download - Scan any providers you use and use providers only from trusted sources While doing additional research for this topic, I could not find anywhere where terraform did validation of the hashes on the module releases. This will fall on you to do if you want to adhere to the best practices in SSDF (Secure Software Development Framework - NIST SP 800-218). SSDF PS 1.1 talks a bit about this. Long story short, terraform puts a lot of responsibility on the practitioner to ensure it's operating in a secure way. https://lnkd.in/ewaiNZka If there are specific ways to validate and sign modules, someone please correct me. GitLab has a great blog detailing some of the supply chain attacks and risks. https://lnkd.in/e6HnQ-hv #SSDF #Terraform

18

1 Comment

Silos in the Kubernetes space isn't a bad thing. You may also see this as a "separation of concern". Originally, we all wanted the whole "don't throw things across the fence", which is true, but that turned into "everyone does everything" and that's not realistic. The reality is that especially in the Kubernetes space with how complex it is, you need folks that are particularly good at certain areas. Here are 3 key ways to implement separation of concern in the k8s realm. https://buff.ly/3XJ2aJ3 #kubernetes #devops #platformengineering

8

In this new normal of more flexible work, decision-making can be a much more complex and time-consuming process. With Microsoft Copilot in Teams, you can get to decisions quicker during and after your ... #MicrosoftTeams #msftadvocate

4

The bAWSton User Group is having a remote session this Thursday where Ruby Henry, Ph.d. who is the CEO & Technical Founder, Version^ will be discussing a problem that may not be flashy but is still critical (not every talk is about GenAI). she'll cover: - the problem - python deprecations at AWS - costs of inaction - anti-patterns - case study: tensorflow - new Snowflake deprecation data. Come join us! https://lnkd.in/eMiSvMi4

10

In this post I captured a brief conversation where I ask Claude to help me generate an architecture diagram using mermaid.js. #ai #aws #genai #claude #anthropic https://lnkd.in/gWPZpYxN

11

I am sharing one of the outstanding blogs on Delta Lake on medallion architecture. It's worth reading through and helps clarify a few small but highly important points in building a solution. https://lnkd.in/gEuNbHsv #continueslearning

30

1 Comment

#AWSLambda SnapStart for Python and #dotnet is now GA! 🍾 I've been looking forward to this. Put SnapStart with AOT and Powertools for AWS, and you've got an awesome #serverless toolkit! 🚀

28

Steph Gooch recently released a great article about Spring Cleaning your AWS Costs. Her article was great, and emphasizes removing idle resources (S3 buckets, EBS snapshots), and creating a prioritized list. 👇 Rahul Subramaniam and myself discussed it on our stream last week: https://lnkd.in/g885fzVC Steph's article: https://lnkd.in/gJHCs2Mk At CloudFix, we have automated finder/fixers for most of the points that Steph brought up. - Enable S3 Intelligent Tiering - https://lnkd.in/g3pkkZvq - Get rid of unused AMIs and EBS volumes - https://lnkd.in/g6Swa-xU - RDS Multi-AZ Deployments that could be Single AZ - https://lnkd.in/gACUrhB3 - Move managed services to graviton - https://lnkd.in/gfbh7v7Z & https://lnkd.in/g3qeQ-5q If you need to do spring cleaning in your AWS account, consider CloudFix your Roomba - always looking for bits to clean up so you can spend your time doing something else (like migrating to serverless or deploying AI)! #aws #costoptimization

15

This will resonate if you work or have worked with AWS CloudFormation templates. Verbose and long, building CF templates can get complicated quickly since each component in defined at a painstaking detail. Resourceful read on DEV.to! How Hoang Le's team reduced 1000 lines of JSON CloudFormation code to just 50 lines of CDK code. https://lnkd.in/gNCBucaa

4

Capital One's journey to serverless architecture has taught our teams a lot. I'm excited to share our best practices, so others can leverage the potential of serverless computing within a massive-scale environment. Get all the info and learn more about our serverless-first approach: https://lnkd.in/enmW66GU

188

12 Comments

There are several different ways to bootstrap Kubernetes. The question is which is the most efficient for YOUR workflow. I'd argue for just about every workflow (aside from managed k8s), Talos is a solid way to go. It's a Linux distro that's built specifically to run Kubernetes, but you don't have to configure it. In this video, I break down how to deploy it. https://buff.ly/3ShHi7R #kubernetes #devops #platformengineering

15

Modern Software Architecture is a Joke, Exhibit number 122454676: Move joins into the application layer Complex joins are another area where extensive database resources can be required. Rather than joining data in the database, move as much of that joining logic as you can into the application layer. By refactoring your code in this manner, you can reduce the load on your database significantly, while increasing your scalability. https://lnkd.in/dABS99kV

54

58 Comments

Chapter 7 of Terraform in Depth has been released to the early access program! This is the chapter on Continuous Integration and Code Quality. It's absolutely my favorite chapter and the one that teams already using Terraform will get the most out of. This is the largest chapter in the book so far (in fact we had to split CD off from the typically CICD bundle because the content for both was so huge). In it I break down all of the different tools in the Terraform ecosystem for maintaining code quality, with examples of how to use them. I also talk about how you can validate your code against both Terraform and OpenTofu. This chapter also spawned an entire open source project, which I'll be discussing more in a future post! #OpenTofu #Terraform https://mng.bz/vPem

57

1 Comment

Learn how to use Kyverno, the native policy engine for Kubernetes, to enforce policies, validate configurations, and manage resources dynamically within your Kubernetes clusters. https://lnkd.in/gaDZkFm9

48

2 Comments