https://www.msbiro.net/tags/devops/ Recent content in Devops on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Mon, 29 Jun 2026 07:49:50 +0100 https://www.msbiro.net/posts/back-to-basics-tls-pki/ Mon, 29 Jun 2026 07:49:50 +0100 https://www.msbiro.net/posts/back-to-basics-tls-pki/ TLS and PKI explained from the ground up: what an X.509 certificate actually contains, how the chain of trust works, what happens during a TLS handshake step by step, and how Kubernetes builds a full PKI with kubeadm that most engineers never read. Practical openssl commands throughout. https://www.msbiro.net/posts/ubuntu-2604-lts-security-container-workloads/ Thu, 30 Apr 2026 07:00:00 +0100 https://www.msbiro.net/posts/ubuntu-2604-lts-security-container-workloads/ Ubuntu 26.04 LTS 'Resolute Raccoon' just shipped. For teams running RHEL or Ubuntu on servers, this post breaks down what actually changed in security and container/Kubernetes workloads compared to 24.04 LTS, and whether it justifies starting the golden master rebuild now. https://www.msbiro.net/posts/supply-chain-attack-prevention-8-controls/ Sun, 26 Apr 2026 12:00:00 +0100 https://www.msbiro.net/posts/supply-chain-attack-prevention-8-controls/ Bitwarden CLI, Trivy, and Axios compromised in three weeks. Your EDR won't catch postinstall scripts. 8 practical controls to reduce the blast radius. https://www.msbiro.net/posts/kubernetes-1-36-security-release/ Tue, 21 Apr 2026 12:35:00 +0000 https://www.msbiro.net/posts/kubernetes-1-36-security-release/ Kubernetes 1.36 releases tomorrow with a significant security focus: user namespace isolation and SELinux volume labeling reaching GA, the end of Ingress NGINX, and a set of long-overdue removals that tighten the security posture of every cluster. https://www.msbiro.net/posts/gsd-sbom-drift-spec-driven-development/ Mon, 13 Apr 2026 05:32:00 +0000 https://www.msbiro.net/posts/gsd-sbom-drift-spec-driven-development/ Another SDD experiment: using GSD (Get Shit Done) v1.34.2 with GitHub Copilot and GPT-5.4 to bootstrap sbom-drift from a docs-only repo to working Go code. Installation, project initialization, Phase 1 execution, and honest lessons from the session. https://www.msbiro.net/posts/actui-security-hardening-dependabot-openssf-scorecard/ Thu, 02 Apr 2026 08:00:00 +0000 https://www.msbiro.net/posts/actui-security-hardening-dependabot-openssf-scorecard/ Back from KubeCon EU 2026 with a free Copilot Pro+ subscription, I turned my attention to the security posture of apple-container-tui. Here's how I added Dependabot and OpenSSF Scorecard using GitHub Actions, spec-kit, and the GitHub CLI. https://www.msbiro.net/posts/trivy-supply-chain-attack/ Sat, 21 Mar 2026 07:32:37 +0000 https://www.msbiro.net/posts/trivy-supply-chain-attack/ A comprehensive analysis of the March 2026 Trivy supply chain incident: from malicious GitHub Actions to the self-propagating CanisterWorm. https://www.msbiro.net/posts/github-copilot-roi-multi-model-roi/ Tue, 17 Mar 2026 10:00:00 +0000 https://www.msbiro.net/posts/github-copilot-roi-multi-model-roi/ Why GitHub Copilot Pro is currently the best value for developers, offering instant access to SOTA models like Claude 4.6 Sonnet and GPT-5.4, plus a look at Enterprise administration. https://www.msbiro.net/posts/actui-follow-up-team-usage-enhancements/ Fri, 27 Feb 2026 06:00:00 +0000 https://www.msbiro.net/posts/actui-follow-up-team-usage-enhancements/ Follow-up on Apple Container Terminal UI: new submenus, dedicated image management, and iterative improvements driven by real usage. https://www.msbiro.net/posts/back-to-basics-containers-linux-processes/ Fri, 20 Feb 2026 06:31:29 +0000 https://www.msbiro.net/posts/back-to-basics-containers-linux-processes/ Containers are Linux processes with namespaces and cgroups, nothing more. This article breaks down what Kubernetes securityContext, resource limits, and container escapes actually do at the kernel level, and shows you how to debug containers using standard Unix tools like nsenter and /proc. https://www.msbiro.net/posts/spec-kit-hands-on-apple-container-tui/ Thu, 12 Feb 2026 00:00:00 +0000 https://www.msbiro.net/posts/spec-kit-hands-on-apple-container-tui/ A hands-on journey building apple-container-tui from empty repository to working Go binary in 2.5 hours using spec-kit 0.1.0. Testing spec-driven development with a real POC. https://www.msbiro.net/posts/ai-cli-standardization-guidelines/ Fri, 06 Feb 2026 06:38:56 +0000 https://www.msbiro.net/posts/ai-cli-standardization-guidelines/ A practical guide to standardizing AI CLI workflows with context files, AGENTS.md, and environment management for DevSecOps. Learn how to make your AI setup portable, reproducible, and secure across tools and teams. https://www.msbiro.net/posts/github-spec-kit-spec-driven-development/ Wed, 21 Jan 2026 09:23:27 +0000 https://www.msbiro.net/posts/github-spec-kit-spec-driven-development/ A DevSecOps team leader's perspective on GitHub Spec-Kit, spec-driven development, and why structured AI workflows matter for compliance, auditability, and team collaboration. https://www.msbiro.net/posts/k8s-security-2025-graduates-2026-preview/ Mon, 08 Dec 2025 10:05:05 +0000 https://www.msbiro.net/posts/k8s-security-2025-graduates-2026-preview/ Recap of Kubernetes security features that reached stable in 2025 + predictions for 2026 graduates. DevSecOps guide to production hardening. https://www.msbiro.net/posts/back-to-basics-sshd-hardening/ Wed, 03 Dec 2025 16:03:07 +0000 https://www.msbiro.net/posts/back-to-basics-sshd-hardening/ Back-to-basics sshd_config hardening for 2025: opinionated settings to disable root login, enforce key auth, modern ciphers, and timeouts. Secure your Linux servers from the ground up—no Kubernetes required https://www.msbiro.net/posts/building-my-first-ai-agent-for-blog-publishing/ Sun, 09 Nov 2025 16:11:07 +0000 https://www.msbiro.net/posts/building-my-first-ai-agent-for-blog-publishing/ How I built an AI-powered automation agent to humanize, verify, and publish blog articles in minutes. A practical journey from chatbot to AI CLI tools. https://www.msbiro.net/posts/runc-container-breakout-vulnerabilities-2025/ Fri, 07 Nov 2025 06:45:00 +0000 https://www.msbiro.net/posts/runc-container-breakout-vulnerabilities-2025/ A summary of the recently disclosed runc container breakout vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) and the recommended actions. https://www.msbiro.net/posts/grafana-dashboard-configuration-with-gitops/ Mon, 12 May 2025 11:34:03 +0000 https://www.msbiro.net/posts/grafana-dashboard-configuration-with-gitops/ Starting with version 12, Grafana introduces the experimental Git Sync feature, enabling users to manage dashboards using a GitOps approach. This feature connects Grafana to a GitHub repository to synchronize dashboard JSON files, allowing version control, collaboration through pull requests, and seamless automated deployment of dashboards. Git Sync offers a scalable way to manage dashboards in complex environments, enhancing traceability, auditing, and consistency across multiple instances. https://www.msbiro.net/posts/resolving-operation-not-permitted-cyberark-conjur-cloud-cli-macos/ Fri, 17 Jan 2025 16:20:03 +0000 https://www.msbiro.net/posts/resolving-operation-not-permitted-cyberark-conjur-cloud-cli-macos/ This post details a troubleshooting journey resolving the 'Operation Not Permitted' error when running the CyberArk Conjur Cloud CLI on macOS 15.2. The issue stems from macOS quarantining the binary, which can be fixed by removing the quarantine attribute via the xattr command. Follow this step-by-step guide to get your Conjur Cloud CLI up and running smoothly on macOS. https://www.msbiro.net/posts/kubeweekly-k8s-newsletter/ Thu, 25 Jan 2024 11:30:03 +0000 https://www.msbiro.net/posts/kubeweekly-k8s-newsletter/ KubeWeekly is a curated newsletter delivering the latest Kubernetes and CNCF community news, articles, and videos straight to your inbox. As an editor during early 2024, I help select and share valuable content to keep the cloud-native community informed and connected. Discover how to subscribe and join this vibrant ecosystem of Kubernetes enthusiasts and professionals. https://www.msbiro.net/posts/resolving-podman-log-rotation-issue-conjur-enterprise-129/ Wed, 24 May 2023 17:30:03 +0000 https://www.msbiro.net/posts/resolving-podman-log-rotation-issue-conjur-enterprise-129/ This post addresses a log rotation issue seen in CyberArk Conjur 12.9 container deployments running on Podman. Unlike Docker, Podman requires the container to be recreated with the AUDIT_WRITE capability added and a specific permission set on the Nginx log directory for proper log rotation. The resolution was developed collaboratively with CyberArk support and is now documented for future updates. Essential guidance for operators using Podman with Conjur containers. https://www.msbiro.net/posts/troubleshooting-conjur-follower-setup-postgres-connectivity/ Mon, 21 Nov 2022 11:23:03 +0000 https://www.msbiro.net/posts/troubleshooting-conjur-follower-setup-postgres-connectivity/ This post covers troubleshooting a CyberArk Conjur follower setup issue where the follower pod could connect to the Conjur API leader but failed to connect to the Postgres database, causing replication to stall and system errors. The solution involved verifying Postgres connectivity using openssl s_client with TLS, revealing a network load balancer misconfiguration that was subsequently corrected. Learn how to use this simple openssl command for effective container and network diagnostics. https://www.msbiro.net/posts/cyberark-conjur-authenticators-integrations/ Mon, 22 Aug 2022 10:26:03 +0000 https://www.msbiro.net/posts/cyberark-conjur-authenticators-integrations/ detailing the variety of authenticators such as host/user API key, OIDC, AWS IAM, Kubernetes with SPIFFE-compliant mutual TLS, and more. Learn how these authenticators enable secure secrets retrieval and integrations with popular DevOps tools and cloud platforms, enhancing security and flexibility for dynamic environments.