Hi all, I’m learning Kubernetes right now for work (I use Colima + kubectl) - what is the best way to do so with AI?

I’ve used docker before in previous projects and studied concepts of containers in school - im no expert but I should know enough to learn Kubernetes.

I started the Udemy + kodekloud course: Kubernetes for the absolute beginners - Hands on. I’m not sure if it’s relevant for 2026 - so far it’s asking me to manually write yaml files, which I’m sure is important, but do I really need to be able to write yaml files with vscode extensions and AI that writes it for me?

So basically, what’s the best way to learn Kubernetes in 2026? I would appreciate any courses I should complete after my current one or a roadmap.

I have around a month or so to be good enough to collaborate with our platform and aws teams.

To begin with this is my first post or i don't know what it is called on reddit,

Apologies for the mistakes in my English please ignore it,

But I really want to switch from system admin job to DevSecOps

About myself

I have 12 years of experience starting from desktop support Engineer to laptop repairing to Data center to Monitoring to Asset management to system administration, I have knowledge of both windows and Linux operating system and currently managing Windows and Linux server (QA) no prod since my senior have never let me work on prod server even though I have worked with him since 7 years, handled a US based client for 3 years working with his team and currently handling two clients one with just some basic needs regarding systems and O365 and second with Linux servers, kind of devops but not fully the second client have a deployment using jenkins ( fetch the code from got repo, call the specific server through ssh and run the deployment and build script)

Worked with a friend's company as a contractor on his client for 6 months which ended last December and since then no work on core devops, started learning k8s and currently learning it but not able to give 100% to it also leaning python scripting and bash scripting by the help or AI can read the code and understand what it does but can not write with full confidence

I know the tools below tools

Terraform

Github

Github pipeline

Jenkins ( basic free style pipeline)

Got the idea of Sonarqube while working as a contractor but it was short lived

Understanding New relic as now the client wants to setup it

AWS basic

Azure basic and ADO basic

GCP not so much

Done a course in cybersecurity as well from local institute but not able to perform handson

I honestly want to work in Devsecops

I am already 38 and according to me not earning enough (peer pressure)

Any suggestions any help or direction is appreciated

I am even ready to do an unpaid internship ( beside the job since i have responsibilities)

Call it desperation, determination or pressure but I really want to work in Devsecops domain

Please help

Hey guys! we've got a couple of internal services that will occasionally throw timeout errors under load. They retry, recover, and users never seem to notice.

The annoying part is that it's been happening long enough that nobody really reacts to it anymore. Every incident review ends up with the same general response that it's just something we've always seen.

Now I'm wondering if thats just the reality of distributed systems, or if we've gotten too comfortable ignoring something that probly deserved a closer look a while ago.

How do you decide when intermittent timeouts have crossed the line from something you live with to something worth digging into?

Running Falco in our EKS clusters right now for runtime detection, paired with Kyverno for admission control and Cosign/Vault for supply chain signing/secrets. Been solid so far, but I keep seeing Tetragon and KubeArmor come up as alternatives, especially for teams who want enforcement (block, not just alert) rather than detect-and-notify.

Curious what people are actually running in production and why:

• If you moved off Falco, what pushed you? Overhead, rule fatigue, lack of enforcement?
• Anyone running Tetragon specifically for the eBPF enforcement piece? Is it worth the Cilium tie-in if you're not already on Cilium for CNI?
• KubeArmor folks: how's LSM behavior in practice across different node kernel configs (AppArmor vs BPF-LSM)? Heard that's where it gets messy.
• Tracee: anyone using this seriously in prod or is it mostly a DFIR/forensics tool for you?

Not looking to rip out Falco, just trying to figure out if there's a compelling reason to add enforcement on top, or if pairing Falco with Falco Talon covers that gap well enough.

Former DevOps consultants, bootstrapped an AWS premier partner and exited to NTT Data, now we advise people building services companies.

After seeing how much easier current AI tools have made it to write code we started building tools for helping our customers and day to day work. Some of the decisions we've made so far:

1. Build out the code in separate services to keep each part well-contained. It feels AI does a far better job with smaller pieces than with larger.
2. Deploy them through lambda.
3. Use a monorepo so the AI can easily see how different things work together.
4. Migrated some apps built in Lovable into our repo.
5. All the building is done with Makefiles
6. Created a registry so it is easier for AI to add new tools in a consistent manner and so we can analyze our inventory of what exists in our development.
7. Using make for building cuz Claude made that decision when we barely had anything and I'm a dinosaur at heart.

Now, I have a monorepo with multiple different languages, a registry that I want to be the single source of truth for what I have, and a build system from the 80s. And I was curious what would people recommend for the build system rather than building a whole bunch of custom scripts?

​

I am planning to have my docker images to be multi architecture and for it my plan is to have two codebuilds for arm and amd when they both succeeds event bridge will invoke a lambda and lambda will merge the images into one

But I am unable to think a way to set up event my current plan is something like when codebuilds are triggered if anyone succeeds let's say arm build then event bridge will match the source version and and if the other build also success then it will invoke lambda

Apparently there is no ability to compare source version in eventbridge and I would have to invoke lambda and lambda has to compare the source version

Is there any way I can implement this

how do you handle production patching for EC2 instances in your environment?

I'm interested in learning about real-world production practices.

Some questions:

• Do you use AWS Systems Manager Patch Manager, Patch Policies, or another approach?
• Do you patch EC2 instances in place, or do you replace them with new AMIs (immutable infrastructure)?
• How do you schedule maintenance windows and minimize downtime?
• How do you handle Auto Scaling Groups during patching?
• What's your rollback strategy if a patch causes issues?
• Do you test patches in dev/staging before production?
• How much of the process is automated versus manually approved?

I'd really appreciate hearing how your organization handles production patching at scale, along with any best practices or lessons learned.

Inspired by a similar post I saw last week.

Small companies man... had similar issues in a couple now. Larger companies with IaC and decent management? No issues. Never thought to ask whether they use IaC in the interview, kind of expected the bare minimum of standards. Will definitely do so if I join another small company.

Small team here and I keep running into the same thing. The reasoning behind half our setup lives in two people's heads.

Not in the runbooks, not in Confluence, not in the repo. Someone new joins and rediscovers everything the hard way and when one of those two is out we just stall.

It got noticeably worse once we started leaning on Claude Code and Cursor for real work. The agents read whatever context files we give them and treat it as truth, so now stale knowledge doesn't just slow a person down, it gets confidently baked into code by something that has no idea the decision changed months ago.

So I wonder how this actually works at bigger shops. Is there anyone whose job includes keeping that stuff current or does it just live with whoever happens to remember? And has anyone here had a documentation process survive past the first busy quarter or does it always quietly die?

Not looking for tool recommendations just trying to work out whether we're unusually bad at this or whether it's the normal state of things.

Senior DevOps here. AI is being pushed into every part of the pipeline right now, and I want to cut past the hype and hear real production experience.

Two questions:

Where have you put AI into production in your DevOps process and it genuinely adds value? (e.g. CI/CD, code review, IaC generation, monitoring/alerting, incident response, log analysis, documentation)

Where did it not prove worthwhile? Think cost, alert noise, false positives, or maintenance overhead that outweighed the benefit.

Thanks.

I work in two companies, one very big that have a giant budget to spend on Datadog, and another small one, that don't have that very big budget.

On the small company we are looking to migrate from Prometheus + Grafana + Alert Manager to something cloud based. Mostly because we are a small team (3 people only) and we don't have time to spend maintaining the infrastructure for it to run.

Now, is there some good alternative to Datadog? Datadog is the king, but is brutally expensive.

I've tried Signoz, looked promising, but is bad. They documentation is bad, there are just general ideas without details (they assume that you know a lot from I don't know where), they support is lame (they only have a chat to "Interact with a Human", that takes days to receive an answer, and their UI is buggy. Really bad experience.

But looking there, they are the only ones having like "close" experience to Datadog. We tried New Relic in the past, but they have all metrics and log scattered over the place without correlation. Also tried BetterStack but lacks a lot of features compared to other things.

So, is there some good observability platform cloud-based that I'm not aware of, outside Datadog? I'm not completely closed to self-hosting as long as it takes low effort to maintain.

I am getting less comfortable with using repo instruction files as a safety boundary.

They are useful for preferences: commands to run, folders to avoid, how to format the final answer. But if an agent can read config files or logs, I do not think "please redact secrets" in a markdown file is enough.

In one small debug task, I asked the agent to inspect config safely, and I still felt nervous when it started summarizing values instead of just saying which setting was wrong. Nothing bad happened, but it made the boundary feel too soft.

A rule file can remind the agent to be careful, but it cannot be the thing that catches the secret after the agent already saw it.

For people running agents near CI, logs, or config: do you handle redaction at the tool/runtime layer, or do you rely on instructions and review?

We’re on AWS Activate credits and just realized NAT Gateway (hourly plus data processing charges) is eating up about 80% of our total AWS spend. Didn’t expect it to be anywhere near that high until we actually looked at Cost Explorer.

We know some of the usual fixes exist, like VPC endpoints for S3/DynamoDB, consolidating NAT Gateways in non-HA environments, maybe switching to NAT instances for low-traffic dev setups, but haven’t touched any of it yet and want to understand what actually works before we start ripping things apart.

For anyone who’s dealt with this:

- Did VPC endpoints actually move the needle for you, or was it a small dent?

- Has anyone swapped NAT Gateway for NAT instances and found it worth the extra ops work?

- Is 80% just absurdly high, or is this more common than it feels right now?

Trying to figure out if we’re missing something obvious in our architecture or if this is just what NAT Gateway costs look like at our traffic level. Any pointers appreciated.

Hi everyone,

I'm learning CI/CD and would love to understand how it's managed in enterprise environments.

A few questions:

• Which CI/CD tool(s) do you use (GitHub Actions, Jenkins, GitLab CI, Azure DevOps, CircleCI, etc.), and why did your team choose them?
• How do you structure your CI/CD pipelines across dev, QA, stage, and production environments?
• Do you use separate CI and CD pipelines, or a single end-to-end pipeline? Why?
• How do you promote artifacts between environments (rebuild vs. promote the same artifact/image)?
• How do multiple engineers collaborate on pipeline changes (branching strategy, PRs, code reviews, approvals)?
• What are the typical stages in your CI and CD pipelines (build, test, security scans, deployment, approvals, etc.)?
• How do you manage environment-specific configuration and secrets?
• What are the biggest lessons or best practices you've learned from running CI/CD in production?

I'm especially interested in real-world workflows using GitHub Actions, Jenkins, GitLab CI, Azure DevOps, or similar tools.

Thanks!

We've got OpenAI and Anthropic calls scattered across a handful of services now, and nobody can tell me month to month what's driving the bill until the invoice shows up. No real attribution back to which service or team is burning the tokens. Started looking at logging and a proxy setup since the vendor dashboards alone aren't cutting it.

Im working on AI infrastructure and have been thinking about where small language models actually make the most sense.

Suppose you had a 300M parameter model and your goal wasnt to compete with large frontier models at everything, but instead to consistently outperform much larger models (2B–20B) on one specific use case.

What would you optimize it for?

A few ideas that came to my mind:
Code generation for a narrow domain
Structured data extraction
Document classification
Workflow or agent planning
Log analysis
Something else entirely

I’m less interested in benchmark scores and more interested in real-world workflows where a small model could genuinely be the better choice because of specialization, latency, reliability, or deployment constraints(but ofc i also want benchmark scores to be good too lol).

If you had to pick one domain where a highly specialized 300M model could become the obvious choice over much larger models, what would it be, and why?

I’m building one personal project, a platform where DevOps can create ai workflows without coding(drag and drop/ chatbot) , like n8n but for DevOps. But firstly I want to ask you guys who is working in the industry, some questions to get clarity what to build.
A example of the workflow can be taking data from the aws cloud watch for perticular project and if there’s any perticular event which needs attention then send email for summary of that to user.

1. what are the tasks you have already automated ??

2. Do you guys trust ai for reasoning over any infrastructure related problems ??

3. What are the tasks that can be repeated and can be done by ai ? if you have any idea.

4. What are the platforms you use for these tasks.(Ex. Aws cloudwatch, Jenkins, Prometheus, Grafana,etc)

5. Can this project be helpful in the field

Open for discussion.
Thank you!!

Every backup thread ends with "an untested backup is not a backup," everyone upvotes, and then (in my experience) nobody has an automated restore test anywhere.

Genuinely curious about the state of practice:

1. Do you restore-test on a schedule, or only when something breaks / an audit demands it?
2. If you automated it, what did you build? (ephemeral instance? scripts like pgbackrest_auto? CI job?)
3. If you didn't, what stopped you? (time? nowhere safe to restore to? nobody asked?)
4. For those with SOC 2/ISO: did the audit change anything, or did you just produce a doc that says you test quarterly?

Trying to understand if this gap is real or if I just keep landing in teams that are bad at it.

I'm curious to know how different developers save their API keys, tokens and anything that is used in their web apps and projects, do you store them in notepad like me or have a more elegant way to do things? :)

For those on platform or DevOps teams, what does your planning process look like?

We have no problem writing docs and roadmaps for product features, but it doesn’t always feel like it aligns with the rest of the business.

Do you have Product Design Docs? Technical design docs? Quarterly roadmaps? Or is it mostly just tickets? Curious how other teams handle it.

I feel like every time I try to do structured planning it just gets blown up in numerous ways.

Just curious, standard procedure, you have something working locally, you push your code and your CI/CD pipeline fails. Locally everything seems OK and you fail to reproduce the error.

What do you actually do at that point? Genuinely curious what people's real routine looks like here — not the textbook answer, the actual "it's 5pm and CI fails" routine 😅

Also wondering: is this even still a big thing in 2026 now that lockfiles and containers have gotten so good, or is it basically a solved problem for most of you?

Hi everyone,
I have a question about development environments and would love to hear how others handle this.

Our current stack is:
- Ruby on Rails (authentication)
- React (frontend)
- Flask/Python (API)

Right now, every developer has to run all three services locally. I’m considering moving the Rails authentication service to a shared Linux development server and having developers run only the React dev server and Flask API locally. The goal is to reduce the number of services each developer needs to keep running.

For those of you using a similar architecture:
Is this a reasonable approach?

How would you set it up for multiple developers?

Would each developer have their own Rails instance and environment variables, or would you share a single authentication service?

Are there any pitfalls (performance, debugging, authentication issues, etc.) that I should be aware of before going down this path?

I’d appreciate any advice or examples of how your team handles a setup like this.

Thanks in advance!

Hi everyone

I'm looking for an idea for my semester project, and I thought about building a Terraform Visualizer.

The idea is simple: it takes a Terraform state file, visualizes the infrastructure, and lets you save it as an image.

My question is if I build this, would you find it useful?

I'm asking because I would like to be able to justify the project's usefulness when presenting it to my teacher.

Also, I plan to keep it open source, so anyone can use it.

Heads up if you're running Grafana OnCall's plugin-install flow, CVE-2026-63087 lets anyone reconfigure it with zero auth. Repo's archived, so there's no patch coming from upstream.

If you're still migrating off it and need some time, there's a small fix you can apply yourself and build from source in the meantime. Wrote up the actual vulnerable code + a verified patch: emphere.com/blog/cve-2026-63087-grafana-oncall-install-bypass

The install endpoint has zero auth on it - no token, no check, just the two public default IDs (stack_id 5, org_id 100) mint you a fresh one. The fix proposed adds an install secret only the operator holds, plus stops trusting a client-supplied admin role during the token bootstrap.

One caveat if you apply it: the secret is a contract change, so your own install clients (Helm, provisioning) have to start sending it too, or they'll lock themselves out. That's in the writeup too.