DevOps&SRE Library

Securing CI/CD for an open source project: lessons from Cilium

Cilium runs in the kernel-level networking path of millions of Kubernetes pods. If our supply chain were compromised, the blast radius would not be small. Hardening the project against that scenario is something we work on continuously, and we wanted to write down what we actually do, in detail. Most of what follows isn't Cilium-specific: any open source project running CI/CD on GitHub Actions can apply these patterns.

https://cilium.io/blog/2026/05/06/securing-cicd-open-source-lessons-from-cilium

How I Learned to Stop Worrying and Love the Reconciliation Loop

You've got ten Claude Code agents running. Each is working on a different issue. Agent 3 just created a PR that conflicts with Agent 7's changes. Agent 5 has been stuck on "Analyzing codebase…" for 45 minutes. Welcome to multi-agent chaos. Turns out, scaling AI coding agents from 1 to 10+ is a completely different problem from running a single agent in a terminal.

https://medium.com/@bobbydeveaux/how-i-learned-to-stop-worrying-and-love-the-reconciliation-loop-32928d0d80cf

Миссия на сегодня: — обновить платформу, не обновляя весь Kubernetes; — встроить AppSec, не остановив релизы; — пережить падение хранилища секретов; — защитить LLM и понять, куда исчезли все токены; — усложнить Admission-политики, не положив API-сервер. Если звучит как особенно бодрое дежурство — приходите 15 октября на DevOps-трек конференции Orion soft «Большая игра». Там эти сценарии разберут по архитектуре, коду и результатам тестов. 📍 Москва Принять миссию

Kubernetes is migrating from SPDY to WebSockets

I maintain an app that builds on top of kubernetes port forwarding, so i track KEP-4006 because the streaming protocol underneath keeps changing. I wrote about this back in april 2024 around Kubernetes 1.30, and six releases later it's changed enough to be worth another look.

https://kftray.app/blog/kubernetes-spdy-to-websockets

Server-side apply: what happens when you run kubectl apply

Server-side apply matters because Kubernetes objects are shared state: it moves field ownership into the API server, so apply-style tools can surface conflicts instead of hiding them as silent overwrites.

https://learnkube.com/server-side-apply-kubernetes

How Netflix Simplified Batch Compute with Kueue

As a part of the journey to transition Netflix's compute infrastructure to be more Kubernetes-native, we have leaned into incorporating components from the Kubernetes ecosystem into our container platform Titus. One example of this is our use of Kueue, a cloud-native job queueing system for batch workloads, which has largely replaced the custom queuing and scheduling logic in our homegrown managed batch solution Compute Managed Batch (CMB).

https://medium.com/netflix-techblog/how-netflix-simplified-batch-compute-with-kueue-87860682629c

openrig

A harness wraps a model. A rig wraps your harnesses. Define your agent team in YAML, boot it with one command. Claude Code and Codex in the same rig, managed as one system. OpenRig turns AI coding agents from a pile of terminal sessions into a persistent, organized team. Talk to a lead agent about the outcome you want; it can coordinate specialists across teams and bring you results and decisions that need your attention. Start with a repository and one useful change, then keep the team's work and context at the same addresses.

https://github.com/mvschwarz/openrig

whiteboard

Whiteboard is an open-source desktop app where humans and agents can architect software together in a common workspace.

https://github.com/devdotfast/whiteboard

walgithub

walgit with a GitHub Enterprise Server facade — git over smart HTTP from an object-store bucket

https://github.com/rgodha24/walgithub

🎇Главная идея DevSecOps: безопасность перестаёт тормозить разработку. Вместо проверок «после релиза» всё встроено в пайплайн: код проходит SAST, контейнеры сканируются, инфраструктура проверяется на комплайенс. В итоге релизы выходят быстрее и при этом безопаснее. Этому и учит курс DevSecOps от Академии Codeby на практике: ⏺9 модулей, 48 занятий, 90% практики ⏺Стек: Docker, Kubernetes, Terraform, Vault, Ansible, Prometheus ⏺Финальный экзамен в стиле OSCP — только реальные задачи ⏺Авторы — практики: внедрение Zero Trust, построение SOC, разработка DevSec-инструментов под Burp Suite Инженеры, которые умеют встраивать безопасность в CI/CD, сегодня в дефиците на стыке ИБ и DevOps — компании поняли, что «сначала сделать, потом чинить» обходится дороже. 👉 Старт курса 5 октября ➡Программа и регистрация Бесплатная консультация — @CodebyAcademyBot

How We Built a Data Warehouse Using ClickHouse

When the scripts that generate the data for letsencrypt.org/stats broke yet again, we decided to retire it rather than repair it. Let’s Encrypt issues six to ten million certificates each day, producing a large volume of logs that keeps growing. It became increasingly time-consuming and difficult to answer questions about our own issuance like “how many certificates use the ‘shortlived’ profile.” Using raw logs, this requires finding, parsing and extracting relevant portions of loglines. Querying the database behind our issuance API is not a practical option, as it’s built for transactions rather than analysis. We’d also used a log search SaaS product, but our bills were growing much faster than we’d like, and while it was fine for searching, it wasn’t able to do the analytic workloads we needed. We knew we could dream bigger and better.

https://letsencrypt.org/2026/09/17/clickhouse.html

git-bug

Distributed, offline-first bug tracker embedded in git

https://github.com/git-bug/git-bug

Библиотека практик: проактивная защита контейнеров 8 октября, 11:00 — стрим «Лаборатории Касперского» для тех, кто пишет и выкатывает сервисы в контейнерах. Возможности Kaspersky Container Security, обзор контейнерных угроз и экспертная дискуссии о лучших практиках работы с контейнерными инфраструктурами. Зарегистрироваться

ax

Declare an agentic task with workspaces and gateway specifications. AX sandboxes it, wires up its workspace, fences its network, and helps running it at scale. AX is a high-throughput, declarative orchestrator to run billions of autonomous agent workloads in a cluster. It runs on top of Agent Substrate for sandboxed execution and is built to run billions of tasks per cluster. If you have used Kubernetes, ax will feel similar.

https://github.com/google/ax

atlas

Atlas is source control for coding agents. Every agent run produces checkpoints: commits are linked back to the session that made it alongside the prompts, tool calls, and reasoning. You see which agent did exactly what and why. Run Claude Code, Codex, Atlas's own agent, or anything from the ACP registry side by side against the same codebase, with shared memory so switching agents mid-task doesn't mean starting over.

https://github.com/pacifio/atlas

gortex

High-performance code-intelligence engine for AI agents and IDE, supports 257 languages, multi repositories, based on graph, with access via CLI, MCP Server, and API. AI coding agents teammate - expose only needed information, cutting token usage up to 50x. 100% local.

https://github.com/zzet/gortex

drop

Linux sandboxing that doesn't get in your way

https://github.com/wrr/drop

rune

Rune is a fast, GPU-accelerated, full-featured IDE and terminal multiplexer, suitable both for automatic and manual programming.

https://github.com/unstablebuild/rune

Optimizing Kubernetes pod deployments for reliability with topology spread constraints

Pod distribution plays a much bigger role in reliability than you might think. By adding a few lines to your manifest, you can ensure your deployments are zone-redundant and evenly scalable. The feature is called topology spread constraints, and in this blog, we'll explain how it works in full detail.

https://www.gremlin.com/blog/optimizing-kubernetes-pod-deployments-for-reliability-with-topology-spread-constraints

How we tracked down a 16-year-old SQLite bug

At the end of last year, our uptime was pretty shaky. Many of these outages were caused by a single bug, deep in SQLite. It took months of intense forensics to track it down.

https://tailscale.com/blog/sqlite-wal-reset-bug