Erik Godding Boye’s Post

𝗥𝗲𝗱 𝗛𝗮𝘁’𝘀 𝗚𝗶𝘁𝗟𝗮𝗯 𝗕𝗿𝗲𝗮𝗰𝗵: 𝗪𝗵𝗮𝘁 𝗜𝘁 𝗠𝗲𝗮𝗻𝘀 𝗳𝗼𝗿 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿𝘀, 𝗮𝗻𝗱 𝗛𝗼𝘄 𝘁𝗼 𝗥𝗲𝘀𝗽𝗼𝗻𝗱 Over the past few days, Red Hat confirmed a security incident involving a GitLab system used by its Consulting division. An extortion group claims to have exfiltrated 570GB of data from nearly 28,000 internal projects. Reports suggest that some consulting engagement data (which often contains architecture diagrams, configuration files, and even credentials) may have been impacted. While Red Hat stresses its core software supply chain is secure, if your organization has worked with Red Hat Consulting, it’s prudent to assume engagement artifacts could be exposed. Here’s what I recommend:  • 𝗥𝗼𝘁𝗮𝘁𝗲 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀 𝗮𝗻𝗱 𝘀𝗲𝗰𝗿𝗲𝘁𝘀 𝗶𝗺𝗺𝗲𝗱𝗶𝗮𝘁𝗲𝗹𝘆 — cloud keys, SSH keys, API tokens, and database credentials.  • 𝗛𝗮𝗿𝗱𝗲𝗻 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗽𝗮𝘁𝗵𝘀 — enforce MFA everywhere, reduce standing privileges, and remove unused accounts.  • 𝗠𝗼𝗻𝗶𝘁𝗼𝗿 𝗳𝗼𝗿 𝗮𝗻𝗼𝗺𝗮𝗹𝗶𝗲𝘀 — suspicious logins, unexpected Git activity, or changes to infrastructure. Manual remediation at scale is slow and risky. This is where 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗮𝘂𝘁𝗼𝗺𝗮𝘁𝗶𝗼𝗻 𝗮𝗻𝗱 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 𝗮𝘀 𝗖𝗼𝗱𝗲 (𝗜𝗮𝗖) become critical. By codifying your response, you make recovery actions repeatable, provable, and fast. Tools like Perforce Puppet enable you to:  • Enforce password and SSH key resets at scale  • Distribute new secrets safely via Vault or cloud KMS  • Automate token and certificate rotation with repeatable workflows  • Prove compliance with audit-ready reports Breaches like this most recent one at Red Hat highlight a hard truth: even trusted partners can become attack vectors. Now is the time to assess your exposure, rotate broadly, and ensure you have automation in place to accelerate the response when incidents inevitably arise. https://lnkd.in/gNZvWkpv

Sharing an observation about the emergence and prominence of DevSecOps as a practice fueling security automation in "Code-to-Cloud" In today's multi-cloud, hybrid environments, the line between applications and infrastructure is dissolving. DevSecOps has emerged as the modern way to automate security across this complex landscape, driven by cloud-native technologies. The trend is moving towards unified “code-to-cloud” security platforms that provide a single, correlated view of risk spanning the entire software development lifecycle—from the first line of code to cloud workloads in production. This convergence creates powerful opportunities: 1) Unified Visibility: Correlate runtime threats back to vulnerable code and developer commits. 2) End-to-End Automation: Automated scanning of code, open-source dependencies, infrastructure-as-code, cloud posture, workloads, and APIs. 3) Developer-First Experience: Deliver actionable security insights directly within developer workflows to speed up secure software delivery. The future of security lies in unified, intelligent platforms that manage security risks in DevOps at scale —abstracting application complexity while safeguarding multi-cloud , hybrid-cliud estates. #DevSecOps #CloudSecurity #CodeToCloud

As we’re into the second half of the year, we’d like to take this opportunity to provide an update on the most recent changes in our Long-Term Support (LTS) releases. #LTS releases are published for the Enterprise versions of VictoriaMetrics and are designed for production workloads under #SLA, providing long-term support lines of releases for VictoriaMetrics customers. Every LTS line receives bug and security fixes for 12 months after the initial release. New LTS lines are published every 6 months, meaning the latest two LTS lines are supported at any moment. This gives you half a year to migrate to the new LTS lines for #VictoriaMetrics Enterprise users. Note: All the bugfixes and security fixes, which are included in LTS releases, are available in the latest open source release.  Learn more about the H2 2025 updates in this blog post https://hubs.li/Q03Lm6Yl0 #Monitoring #Observability #DevOps

Traditional secret scanning tools are teetering on the edge of irrelevance as they falter under modern development pressures🚨 They lead to: 🟠 Alert fatigue 🟠 Inconsistent remediation 🟠 Secrets leaking beyond version control Cloud-native systems, ephemeral infrastructure, and diverse authentication formats in multi-cloud environments have exposed their pitfalls【4:0†source】. The new guard led by HashiCorp advocates for: 🟠 Real-time detection directly in developer IDEs 🟠 Pre-commit scanning fortified with context-aware options 🟠 Comprehensive coverage across CI/CD pipelines, containers, and even communication platforms【4:0†source】. Industry luminaries like GitHub and Trivy are already threading security into earlier stages of development, championing prevention over reaction. And in a power move, organizations are pivoting towards OIDC-based workload identities to eliminate static credentials wherever possible【4:0†source】. Moreover, HashiCorp is revolutionizing with dynamic secrets and automated rotations, embodied in tools such as Vault. The future? Limits on exposure windows and relieved credential management pains【4:0†source】. As more cloud providers, like Azure, natively support these trends, it's clear the seas are changing【4:0†source】. Which side will you choose: the sinking traditional methods or the rising tide of innovation? 🌊🔥 #DevOps #Security #CloudComputing #Innovation #HashiCorp #Trivy #GitHub #Azure 🔗https://lnkd.in/d2gW3EZE 👉 Post of the day: https://lnkd.in/dACBEQnZ 👈

Hey System Admins 👋 What's the Next Step in Your Career? You're the expert on stability. You understand the servers, the network, and the constant demand for uptime. The path to a DevOps role will be a powerful evolution of your existing skills. It's not about throwing away your knowledge, it's about adding a powerful layer of automation and scalability on top. 👉 Swipe through the carousel below to see the 5 key areas that could be your next great focus.   If you’re ready to transition your deep operational knowledge into a future-proof, automation-focused role, we can help. Follow us and watch our page for the announcement of our next CloudOps Bootcamp intake - we're launching tracks designed specifically for your career upgrade! #SysAdmin #CareerTransition #DevOps #CloudOpsAcademy 

Unlock the power of seamless, secure, and scalable Kubernetes deployments! 🌐✨ Whether you're new to Kubernetes or optimizing mature clusters, consistent best practices are essential. This infographic highlights key strategies across networking, security, RBAC, high availability, backups, patching, upgrades, and more. 🛡️📈 🔑 Top takeaways: - Collaborate with networking & security teams for robust infrastructure - Automate RBAC and enforce auditing for compliance - Plan for high availability and data protection - Centralize logging & monitoring for actionable insights If you're leading or contributing to cloud-native projects, adopting these best practices fuels reliability, scalability, and innovation. Let's learn from each other! 🚀 💬 How do you and your team approach Kubernetes best practices? Drop your tips or questions below ⬇️ #Kubernetes #CloudNative #DevOps #Containers #Microservices #CloudComputing #SRE #PlatformEngineering #KubernetesCommunity #BestPractices #TechLeadership #Innovation #Infosec #InfrastructureAsCode #ITsecurity #TechTrends

Exciting news for the cloud-native community! The Nutanix Kubernetes Platform (NKP) is now available through Platform One, simplifying the deployment and management of secure, scalable Kubernetes clusters for DoD programs. NKP delivers: - Enterprise-grade Kubernetes with built-in security and compliance - Multi-cluster management for hybrid and multi-cloud environments - Automation and lifecycle management to simplify operations This marks a significant advancement in accelerating application modernization across mission-critical environments. Learn more about how NKP is driving secure, agile, and resilient cloud-native adoption. #Kubernetes #CloudNative #DevSecOps #PlatformOne #Nutanix #FederalTech

**3:47 AM.** Your deployment failed. Again. 💀 The security team flagged hardcoded secrets in your pipeline. Your sprint demo is in 6 hours. Sound familiar? Here's what most DevOps teams don't realize: Security doesn't have to be the enemy of speed. **The game-changer?** Native security integration that actually *accelerates* your workflow. Imagine deploying with confidence, knowing your secrets are automatically managed across Kubernetes, GitHub Actions, Terraform, and Azure DevOps. No more emergency calls. No more compromised launches. No more choosing between security and velocity. **The reality:** Your existing tools can become your security superpower when they work *with* you, not against you. **Real talk:** What's your biggest nightmare in balancing fast deployments with bulletproof security? #DevOps #AppSec #CloudSecurity #Kubernetes #GitHubActions #Terraform #AzureDevOps #SoftwareDevelopment #Tech #Security #DevSecOps #CloudNativeSecurity #CICDSecurity #ApplicationSecurity #InfrastructureAsCode #SecurityAutomation #SecretsManagement #DeploymentSecurity #ShiftLeftSecurity #SecureDevelopment Click here: https://bit.ly/47agDAH

🚀 Why Every DevOps Engineer Must Understand Networking! 🌐 If you’re learning DevOps but skipping Networking, you’re missing a huge piece of the puzzle 🧩 Because… 👉 Without networking, there’s no connectivity, no deployment, no monitoring — basically, no DevOps magic! ⚙️✨ Let’s understand what makes Networking so critical ⬇️ 🌍 1️⃣ How the Internet Works: Every request you send (like opening Google 🌐) travels through multiple layers, routers, and protocols before you see a response. Knowing this helps you troubleshoot latency, DNS issues, or downtime like a pro! 🧠 🧩 2️⃣ OSI vs TCP/IP Model: Think of them as the blueprint of communication. 📦 OSI (7 Layers): From physical cable 🔌 to application data 🧑💻 📡 TCP/IP (4 Layers): The simplified real-world model used everywhere! Understanding these helps you trace where issues actually occur during data flow. 🔁 3️⃣ Protocols You Must Know: 🧾 HTTP/HTTPS – Web communication 📧 SMTP – Mail delivery 🔑 SSH – Secure remote access 📦 FTP/SFTP – File transfers 🌐 DNS – Domain resolution 💬 ICMP – Network diagnostics (ping!) 💻 4️⃣ Client-Server Architecture: Every web app follows this — client sends request 📩, server sends response 📤. As a DevOps engineer, you manage both sides using Nginx, Apache, or Load Balancers ⚙️ 🧱 5️⃣ Firewalls, IP & MAC Address: Firewall = Gatekeeper 🚪 IP Address = House Address 🏠 MAC Address = Your Device’s Fingerprint 🆔 Knowing these helps in setting up secure servers 🔒, managing access, and debugging connectivity. 💬 Pro Tip: A strong DevOps engineer isn’t just about CI/CD — they know how systems talk to each other! 🤝 So before mastering Docker 🐳 or Kubernetes ☸️, master the basics of Networking 🌐 🔥 #DevOps #Networking #LearningJourney #TechSkills #CareerGrowth #CloudComputing #Linux #Automation #EngineerLife #TrainWithShubham

Traditional PAM wasn’t built for today’s multi-cloud, automation-driven enterprises. It still struggles with: ❌ Fragmented tools that require multiple solutions ❌ Poor DevOps integration and weak machine identity support ❌ Long, complex deployment cycles ❌ High TCO Akeyless Modern PAM Solution is built for machine identities, hybrid infrastructure, and Zero Trust. ✔ Zero-Knowledge encryption with Distributed Fragment Cryptography ✔ Passwordless + Zero-Standing Privileges + MFA ✔ Full machine identity support (API tokens, JWTs, SPIFFE) ✔ Native DevOps integrations (CLI, Docker, K8s, CI/CD) ✔ Fully managed SaaS ✔ Up to 70% lower TCO #PAM #SRA #DevOps #CloudSecurity