BPF, programming languages, infrastructure as code security, open standards and OpenTelemetry, integration testing for large microservice architectures and more. I hope readers enjoy seeing the state of the art advance week-by-week as much as I do.

StackHawk sponsors Devops Weekly

The shift to rapid, frequent deployments over the past decade initially left application security behind. Modern AppSec belongs in the CI/CD pipeline.
https://sthwk.com/app-sec-in-pipeline

News

BPF is already super interesting. With BTF and CO-RE the distribution story gets much easier, with the ability to provide standalone executables that don’t rely on compilers and other tools on the client.
http://www.brendangregg.com/blog/2020-11-04/bpf-co-re-btf-libbpf.html

Both Go, and more recently Rust, are increasingly popular for infrastructure tooling. This post has a nice comparison of the languages, looking at the main similarities and differences.
https://bitfieldconsulting.com/golang/rust-vs-go

A talk I gave recently about configuration security. The move to infrastructure as code brings with it some interesting security challenges, the slides talk about some patterns to help address.
https://speakerdeck.com/garethr/configuration-security-is-a-developer-problem

A quick look at the future of OpenTelemetry and the place of open standards in advancing the state of the art of the observability and monitoring tool.
https://mhausenblas.medium.com/reminiscing-control-theory-and-the-future-of-observability-ba947f6da7b0

A nice introduction to contract testing, and the problem it solves. Having problems scaling integration tests? Features a Node.js example but it’s applicable to other stacks too.
https://codersociety.com/blog/articles/contract-testing-pact

A post on some of the challenges with serverless architectures. It mainly makes the case the the disadvantages and challenges are trade offs that you should make for other advantages, which sometimes is going to be true and at other times now.
https://talkingserverless.com/2020/10/28/mitigating-serverless-challenges/

A nice introduction to using Traefik for canary deployments and weighted load balancing.
https://iximiuz.com/en/posts/traefik-canary-deployments-with-weighted-load-balancing

Events

WTF is Cloud Native, and Why Should I Care? Find out the answers to both of these questions in a special webinar hosted by Pini Reznik, co-founder of Container Solutions. Join him 12 November at 13:00 CET. This free, 90-minute event is part of the Bristol tech Festival. Register now.
https://bit.ly/388Sf5p

Books

GitOps: What You Need to Know Now,a new e-book by Ian Miell, a Cloud Native engineer at Container Solutions, explains what this workflow is, the problems it was intended to solve, and how it does that. It also compares some common GitOps tools and explores alternatives. Get your free copy here:
https://bit.ly/3oWxIHA