CommPulse

Overview of the GUI I wanted a real OpenShift lab on AWS to practise on, and I specifically wanted UPI — user-provisioned infrastructure — because it's the install method where nothing is hidden. You build the VPC, the load balancers and the DNS records, and the installer only takes over once that's all correctly in place. IPI hides most of that inside the installer binary; ROSA is managed. The problem with UPI is that doing it by hand is slow and easy to get wrong, and I couldn't find anything that automated the whole lifecycle for AWS. So I wrote one. **What it does** `cluster.yaml` is the only file you edit. Everything else — the Terraform variables, the Ansible variables, `install-config.yaml` — is generated from it. ``` ocplab deploy # terraform apply, wait for bootstrap, approve CSRs, finalize ocplab verify # ClusterVersion, node readiness, ClusterOperators ocplab cost # what's deployed right now, priced live ocplab repair # recreate a worker AWS reclaimed, approve its CSRs ocplab power off # graceful shutdown, as an alternative to destroying ocplab destroy # ordered teardown, including what the cluster made itself ``` Some things it handles that took me a while to get right: - **Version pinning.** One field pins the installer, the `oc` client and the RHCOS AMI together, cached locally. - **Spot instances** for compute and bootstrap, with a "minimal" profile that uses them. Not for the control plane — UPI has no ControlPlaneMachineSet, so a reclaimed master isn't replaced automatically. - **Cost visibility.** `ocplab cost` reads live AWS state and prices it, Spot at Spot rates, and it's power-state aware. - **A budget safety net.** AWS Budget with alerts, an automatic lockdown action, and a daily killswitch Lambda — managed outside Terraform so it survives a failed teardown. - **Optional capability trimming**, which cuts the container images pulled per deploy by about a third. - **Teardown that actually completes.** The ingress operator creates a load balancer, a security group and DNS records outside Terraform; the teardown removes them in the right order first. **The web UI** There's also a local browser UI (`ocplab web start`) if you'd rather not watch a 40-minute deploy in a terminal: a status dashboard, a `cluster.yaml` editor that validates before saving, and live output for every operation — including Terraform's resource-by-resource log and the installer's own log. It binds 127.0.0.1 only and runs the same commands as subprocesses, so there's no second implementation to keep in sync. **Scope** It's built for labs and PoCs, not production. Single AZ, single NAT gateway, no HA design beyond etcd's own quorum. It costs roughly $0.83–1.06/hour while it's up, so the intended flow is create, test, destroy the same day. Tested end to end against OpenShift 4.22.6 and 4.22.7. MIT licensed. https://github.com/LuixyToledo97/openshift-upi-aws Happy to answer questions, and issues are welcome if you try it and something doesn't work. submitted by /u/Financial_Spring636 to r/devops [link] [comments]

I keep seeing engineers falling into an AI architecture trap. Some engineers try to solve every problem by prompting to a LLM. Others talk about creating an agent for every usecase. So knowing how to use AI has become a core competency. Otherwise you will waste time, money and DevOps resources. If you want to solve an actual business problem without creating an infrastructure nightmare, 99% of your use cases fall into one of these 5 application architectures. Here is how to know which one to use. 1. Basic Prompting (Stateless API) The Use Case: You need to summarize text, extract sentiment, or reformat data (like turning unstructured text into JSON). The data easily fits into the context window. The Trap: Thinking you need a custom model just because the base model didn't output your exact format on the first try. Before you do anything complex, try giving the model 3 concrete examples in the prompt (few-shot prompting). That solves the problem most of the time. 2. RAG (Retrieval-Augmented Generation) The Use Case: You need the LLM to answer questions about your proprietary data (internal wikis, codebase, customer records). You query a VectorDB for the relevant context, shove that context into the prompt, and let the LLM read it. The Trap: Trying to fine-tune a model on your company wiki. Models hallucinate facts. If you need accurate, source-traceable answers based on your internal data, you need RAG, not a fine-tuned model. 3. Chaining / Workflows The Use Case: The task is too complex for one prompt and requires distinct, predictable steps. For example: Step 1 extracts raw text -> Step 2 categorizes it -> Step 3 writes a summary based on the category. The Trap: Cramming a massive, 15-part instruction into a single mega-prompt and crossing your fingers. Break it down into a predictable pipeline. It’s much easier to debug a chain of small LLM calls than one giant, confused prompt. 4. Routing The Use Case: You are dealing with high volume and need to control costs and latency. You build a router that sends simple tasks (like spelling correction) to a fast, cheap model (like Claude Haiku or GPT-4o-mini), and complex reasoning tasks to the expensive, heavy models. The Trap: Sending every single trivial API request to the most expensive flagship model available and bankrupting your cloud account. 5. Autonomous Agents The Use Case: Open-ended tasks where the exact steps aren't known in advance. The LLM is given a goal and external tools (Python interpreter, web search, internal APIs) and loops continuously, evaluating its own output until it achieves the goal. The Trap: Using agents for deterministic workflows. If you can solve a problem with a standard if/then Python script or an Ansible playbook, do it. Do not introduce probabilistic, infinite-looping agents into a workflow that just needs a standard script. The Takeaway: Don't jump straight to training models. Work your way up this list. Start with prompting. If it lacks context, use RAG. If it lacks reliability, chain it. If it lacks cost-efficiency, route it. Only use agents when absolutely necessary. Curious if anyone else has horror stories of teams trying to fine-tune models to learn internal docs? submitted by /u/SeaworthinessHour233 to r/devops [link] [comments]

I'm an indie dev and honestly exhausted. I've been stuck in a support loop with Google Cloud for nearly a full year over an acknowledged platform-side bug. Here is the short version of what's happening: The Bug: My GCP project was hit with an unexpected $8,367.11 charge surge on the Gemini 2.5 Flash image generation SKU. Product Lead Logan Kilpatrick publicly acknowledged this bug on the official forums and promised affected devs would be taken care of. The "90% Cap": Google Billing gave a 90% adjustment and declared that 90% is the "maximum allowable limit" for this incident—leaving $838.26 on my account for a bug on Google's infrastructure. The "No Logs" Excuse: When I demanded backend logs or proof showing why I owe this remaining balance, support literally replied: "they do not share external-facing documentation, internal case notes, or further detailed explanations regarding their final review process." 1 Year of Support Ping-Pong: Opened a billing ticket $\rightarrow$ immediately closed and bounced back. Tier 1 agents just rotate shifts, paste identical templates, and close tickets without consent. My account currently sits with a red banner warning and an active $838.26 balance for services I never consumed. Screenshots attached: 1.Billing Support confirming the charge was caused by the Gemini 2.5 Flash bug. https://preview.redd.it/x083tf255olh1.png?width=438&format=png&auto=webp&s=f57d82c545e94f41d28eee18802a0243731f2366 Support stating the 90% adjustment is final. https://preview.redd.it/eaq8leu55olh1.png?width=690&format=png&auto=webp&s=36fb40b01c9f27c07cbd0f1d920eacd011b0575d My billing console showing the pending $838.26 balance and account warning. https://preview.redd.it/ahyl62n65olh1.png?width=690&format=png&auto=webp&s=e9403517ca4b0c93b3fbcc102633f78f35cf7f4b Support's latest response admitting they cannot provide any logs or explanation. https://preview.redd.it/ec9uxzv95olh1.png?width=1481&format=png&auto=webp&s=a59b05554a4fd661828dc2d83d32d9a7178ad05a I've documented this on the Google AI Forum and am preparing consumer complaints in Japan (消費者庁 / 消費生活センター). Has anyone ever broken through this Tier 1 "final decision" wall without an Enterprise support plan? Any advice or visibility would be really appreciated. submitted by /u/Character-Candy1120 to r/googlecloud [link] [comments]

This is likely a bit of a niche question, but I am going a tad insane trying to figure out why my old script for purging emails via a compliance search is failing. Previously (around a year ago), this script would create a new compliance search in EXO, start it, poll for progress, and then export the results and ask if you wanted to purge the emails from the relevant mailboxes. Had something come up yesterday while I was unavailable, and my old script didn't work. Messing around with it this morning, I found that while I can create a new compliance search, I cannot preview the results OR export the results. It does however, seem like I can still purge emails. Only you know, I cannot preview the emails, or verify it actually found the right emails beyond hoping that the item count from the search makes sense. Not so cool. From what I found on Microsoft's own documentation pages, it looks like the preview, and export functions will only work for on-prem exchange now, and I really do not see any alternatives. All that being said, is this Microslop making things difficult for the sake of adding some new subscription in the coming months, or is there actually a way to do this and their documentation is woefully out of date? I have a feeling the answer is going to be a resounding "no" based on an hour or so of searching, but you never know 😉 submitted by /u/TheOnlyKirb to r/sysadmin [link] [comments]

Hi guys, I'm needing your guidance here. I work in an automation-focused role that gradually became much more technical than operational. A lot of my job is taking broken/manual processes, improving them, and building automations around them. In practice, that means dealing with business rules, integrations, permissions, data sources, testing, edge cases, etc. However, I still consider myself junior technically. My current challenge is that the company is becoming more restrictive about external/unapproved automation tools, so I’m trying to move everything into approved internal tools and infrastructure. The problem is that access is granted gradually, permissions change, and some features depend on other teams. Stakeholders often just see that “the automation isn’t ready,” while a lot of the delay is actually caused by access, security, infrastructure, or dependencies. I’ve started communicating blockers and development stages more clearly, but I’m curious about how this is normally handled in US/European companies. How much responsibility is usually placed on the developer when delivery is blocked by access or another team? And how do you manage expectations when something sounds simple from the business side but isn’t simple technically? submitted by /u/Kooky-Internet8806 to r/devops [link] [comments]

https://preview.redd.it/tj068f1g1cjh1.png?width=2107&format=png&auto=webp&s=35fb64e37f0fe01bc985df9e0407adee6f055cee https://preview.redd.it/7a3lvq2k1cjh1.png?width=1695&format=png&auto=webp&s=da48778e9b362485b942eb4f05a59f1b7256cb40 My usage this month was around IDR 170.000 but I was charged IDR 3 million. Why is that? The support bot said: Since your July usage ( Rp 863,006 ) was already paid and your August usage is only ( Rp 168,763 ), these charges of IDR 1,000,000 and IDR 2,000,000 processed today are highly likely due to one of the following reasons: Temporary Authorization Holds: When you update payment details, add a new card, or reach certain verification checkpoints, Google or your bank may place temporary authorization holds (often in round numbers like IDR 1,000,000 or 2,000,000) to verify your card's validity. These are not actual charges and will be automatically released back to your account by your bank within a few business days. Multiple Google Billing Accounts: If you use the same credit card for other Google services (such as Google Ads, Google Workspace, or a separate Google Cloud Billing account), these charges may have originated from those services. submitted by /u/rfajr to r/googlecloud [link] [comments]

We got the Azure notice about upgrading our Storage and Blob accounts from GPv1 to GPv2 ahead of the October 13th automatic migration deadline. The Azure portal makes it look incredibly easy with a simple "one-click" in-place upgrade button for the Storage Accounts which have been identified as GPv1 and Blob. Documentation says zero downtime and zero data loss. However, I know GPv2 flips the billing model (cheaper storage, much higher transaction costs). For anyone who has already gone through this migration: Did you just click the upgrade button and wing it? If so, did your bill spike unpredictably? Did you actually pull Azure Monitor metrics first? If you audited transaction volumes, what thresholds made you hesitate or re-architect a workload? Any hidden gotchas? Did you run into issues with default access tiers (Hot vs. Cool) or legacy ZRS replication during the flip? Since Microsoft is going to auto-upgrade us anyway in October, I want to know if it is worth digging into the transaction logs manually or if I am overthinking a routine upgrade. Appreciate any real-world horror stories or "it went fine" reassurances! submitted by /u/nomadicviking024 to r/AZURE [link] [comments]

submitted by /u/codingdecently to r/FinOps [link] [comments]

After working with Kubernetes in production, I've noticed that some of the most annoying incidents aren't caused by obvious failures. They're often caused by small configuration decisions that look perfectly reasonable during review. Things like: missing resource requests/limits incorrect probes overly permissive RBAC missing PodDisruptionBudgets unsafe container configuration incorrect readiness behaviour services without appropriate timeouts configuration drift between environments I'm curious what the DevOps community has actually encountered in production. What's one Kubernetes configuration mistake that caused you a real incident? I'd especially like to hear about the less obvious ones that aren't caught by the usual linters. submitted by /u/nerd3n to r/devops [link] [comments]

What happened On Aug 1, an IAM access key belonging to one of our accounts was compromised through a supply chain compromise — the key was exposed via a third party in our toolchain, not by us publishing it. This was a programmatic access key, so MFA (enforced on all human identities from day one) was never in the path. We caught it and reported it to AWS Support within 4 hours , well inside the 48-hour public-contract cancellation window. The case then sat unassigned for 14 days. As of today that's 20 days, still open, still no resolution. Where the bill is now Total USD 477,505.20 Contract creation (0 months) USD 4,800.00 Usage Fee | us-east-1 USD 472,705.20 47,270,520 Units @ USD 0.01 The part I don't understand We never activated the product. Specifically: - The Marketplace console still shows "Set up product" for this agreement - No License ID was ever issued - CloudTrail shows zero Marketplace events in our account after the initial compromise window on Aug 1 - We have never had credentials for, or logged into, anything on the seller's side Yet 47.2 million billable units were metered against us in us-east-1. As I understand the SaaS flow, usage on this kind of product is submitted by t he seller calling `BatchMeterUsage` against the entitlement's `CustomerIdentifier` — from the seller's own infrastructure, not from our account. If that's right, then nothing in our account was ever in the path, and no control we have could have stopped it. Revoking the key, deleting the attacker's IAM user, applying SCPs — none of it touches seller-side metering. The unit count has been static for several days now, so metering appears to have stopped, but the agreement status is the thing I can't get a straight answer on. Support so far Seller support (automated) told us Marketplace transactions are not their department and to contact AWS. AWS support has pointed at the seller for anything usage-related. The payer account has now escalated and asked AWS to investigate the agreement and stop metering. Still waiting. There is no phone line and no chat. The only channel is tickets, and they've been sitting for 20 days. Questions for people who actually know the internals For a SaaS contract-with-consumption product, is metering purely seller-side ? Is there any circumstance where usage gets attributed to a buyer account without the buyer ever completing registration? Does "Set up product" persisting in the console reliably mean the fulfillment/`ResolveCustomer` handshake never happened — or is that just stale console state that doesn't update? Is there any way for a buyer to see the registration record for their own entitlement? Anything in the Agreement APIs, CUR, or elsewhere that shows when/whether `ResolveCustomer` was called? The 48-hour window: AWS Customer Service can process a full refund on a public contract without seller involvement. Does that path survive a case sitting unassigned for 14 days, or is the window enforced strictly on wall-clock time regardless of AWS-side latency? Has anyone here had Marketplace usage fees (not just the contract fee) reversed after a credential compromise? Contract fee reversals I've seen written up. Usage fees at this scale, never. To be blunt about the stakes: we're a small company. We cannot pay $472k for consumption we did not generate, on a product we never activated, after cutting off access in under 4 hours. I'm trying to understand the metering mechanics, and whether there's a path here other than waiting on a ticket queue. submitted by /u/Round_Vegetable3764 to r/aws [link] [comments]

Azure weekly update #33 is here. This week Azure rolled out key networking and SQL platform improvements, new Copilot and healthcare agent offerings, and important service lifecycle updates including Azure VMware Solution retirement planning. Detailed list: * Launched | Generally Available: Summarized advertised gateway prefixes for route advertisement . This feature allows for advertising aggregated prefixes instead of every individual virtual network address space, which is great for large hub-and-spoke deployments. * Announcing: Azure Copilot introduces direct access to agents . Users can now select specific Azure Copilot agents like Troubleshooting or Deployment to move more quickly from questions to action. * Launched | Generally Available: Azure Databricks Lakebase in four additional regions . Lakebase is now available in North Central US, France Central, Germany West Central, and East Asia, expanding regional options for workloads. * Launched | Generally Available: Azure SQL updates for mid-August 2026 . This update brings enhancements to Azure SQL, including customizable keyboard shortcuts within Visual Studio Code. * In preview | Public Preview: SQL Formatter in MSSQL extension . The SQL Formatter is now in public preview, offering more customizable formatting options to help streamline development. * Launched | Generally Available: Azure SQL Database provisioning in MSSQL extension . You can now create and connect to a fully managed cloud database directly from your editor at no cost. * Launched | Generally Available: vCore Customization: Disable Multithreading and Configurable Constrained Cores . This new capability gives users greater control over virtual CPU configurations to optimize performance and reduce licensing costs. * Launched | Generally Available: BYON (Bring Your Own NIC) in Azure Site Recovery . Azure Site Recovery now supports attaching existing, pre-provisioned NICs in the target region for failover scenarios. * Retirement: Azure VMware Solution License-included service will be retired August 30, 2027 . Customers should be aware that the AVS license-included service will be retired on August 30, 2027, requiring transition planning. * Launched | Generally Available: Managed Instance on Azure App Service . Managed Instance is now available, allowing migration of web applications to Azure App Service with minimal configuration. * In preview | Public Preview: Ipv6 support in Azure Firewall . Azure Firewall now supports IPv6 in public preview, enabling dual-stack mode for both IPv4 and IPv6 traffic. * In preview | Public Preview: Zone redundancy for Azure SQL Managed Instance Next-gen General Purpose . Enhanced resilience is available via public preview zone redundancy for Azure SQL Managed Instance Next-gen General Purpose. * Launched | Generally Available: Dragon Copilot Physician Apps and Agents on Microsoft Marketplace . Dragon Copilot Physician Apps and Agents are now available for discovery and purchase through Microsoft Marketplace. * In preview | Public Preview: Azure Linux on WSL . Azure Linux on WSL is now available in Public Preview, allowing teams to use a consistent Linux foundation across development, testing, and production. submitted by /u/groovy-sky to r/AZURE [link] [comments]

Had one of those fun discoveries recently: a nightly backup cron had been failing (or not running) for a stretch, and nobody knew. Host was fine, uptime checks were green, no ticket, nothing. Found it only when we actually needed a restore. Curious how other people handle the "job went quiet" case — not "the server is down", but "the scheduled thing didn't check in". What are you using in practice? - Healthchecks / Cronitor / Dead Man's Snitch / something else SaaS? - Self-hosted (Uptime Kuma push monitors, Prometheus + blackbox/heartbeat, custom scripts)? - Just mail on failure from the job itself (`MAILTO`, wrapper scripts, etc.)? - Or do you mostly not bother unless it's a critical path? Also interested in what actually matters day to day: - Grace periods vs exact schedules - Success-only heartbeat vs explicit fail signal - Email only vs Slack/Teams/PagerDuty - How many jobs you bother monitoring vs "we'll notice eventually" Not looking for a product pitch — just war stories and what you'd recommend to a small team that doesn't want another heavy observability stack for a handful of crons. submitted by /u/georgi_tsenov to r/sysadmin [link] [comments]

[ Removed by Reddit on account of violating the content policy . ] submitted by /u/astrodevops to r/FinOps [link] [comments]

I was wondering how many of you are still using legacy client/server apps, and come across challenges when it comes to remote/hybrid workers. We use an application that is rather old school. No web based access, full desktop client and server. It does not work well under any latency, so VPN's and anything similar are unworkable. The other challenge is that the application is heavily tied into MS Word, Outlook, etc. The application uses COM addins for Outlook to generate and send emails and allow interaction with the product. Similar happens with MS word. We've tried publishing the application as a "remote app" on platforms like Citrix, but the issue again is the required integrations with Outlook, Word, downloading of files like PDF's and other documents that are stored within the app. It essentially integrates heavily with other apps. So at the moment, we're using a full desktop experience for users over Citrix. I find this to be rather frustrating. Providing end users with new laptops with reasonable spec, for them to work remotely and use it like a thin client so they can connect to a Citrix desktop. It confuses users, it isn't particularly user friendly, and it just feels like a waste of local resources. Does anyone work in similar situations? Are there any solutions that could help with this? Or are we destined to forever use a full remote desktop solution to support our core, oldschool, clunky-ass product? submitted by /u/Thick-Incident-4178 to r/sysadmin [link] [comments]

So got an odd pickle I'm trying to solve. We have 5 Samsung A11+ devices. These devices need to allow any user to be able to use essentially the following Web browser, camera and probably the ability to browse photos when uploading them. Preferably that when the user closes the web browser it doesn't have any information like their password or session. Most of the apps they'd use would be through a portal where they'd log into for access. But I need to lock it down somehow, without using an MDM solution or spending a dime. So even using intune is out of the question. Really I just need to prevent users from using other apps or installing any apps. Preferably only changing to the android owner account when I need to make changes. I was going to set up a restricted user but for some reason following Samsung's instructions are either old or I guess unavailable in my region for some reason. Still slowly updating one of the devices to see if this actually changes. Guest mode seems useless since it's a fresh instance each time it's opened. EDIT: I might be able to use something that can link to a google account as well for this, but probably not able to link it to a business per-say submitted by /u/waddlesticks to r/sysadmin [link] [comments]

Our reserved instances are up for renewal in about 8 weeks and the easy path is to just renew the same mix we had last year. Before I push back I want to actually have data behind it. What should I be pulling before that conversation? Usage trends over the last 12 months obviously but what else tends to get missed when teams auto-renew RIs without reviewing them first? submitted by /u/isaywhatisee [link] [comments]

I've been doing a lot of vibe coding with Claude Code and Codex, and one thing keeps happening I ask for one small change, then later realize Al changed my code in places I never expected. By the time I notice, I can't remember exactly what changed or when. Is anyone using something besides Git to track Al changes or keep an Al coding activity log, or is this just one of those vibe coding problems we all live with? submitted by /u/pacifio [link] [comments]

Trying to streamline Defender onboarding. About to enable this toggle in Intune. What's the real impact, risk, and any visible changes for end users after it applies? submitted by /u/aPieceOfMindShit [link] [comments]

Hi everyone, I'm a Network & Security Engineer with ~7 years of experience working with Fortinet (FortiGate, FortiAnalyzer, FortiAuthenticator), Cisco, VPNs, HA, Linux, VMware, Hyper-V, and enterprise infrastructure. I want to specialize in AI applied to Cybersecurity (SOC, network security, automation, LLMs, AI agents, etc.), not become a data scientist. If you were in my position today: What learning roadmap would you follow? Which platforms are actually worth paying for (Coursera, TryHackMe, HTB, SANS, Microsoft Learn, etc.)? What's a reasonable monthly learning budget? Which certifications provide the best ROI? What projects would make my resume stand out? I'd love to hear what worked for you and what you'd avoid. submitted by /u/CartoonistAdvanced52 [link] [comments]

Hello, I’m trying to understand whether I should classify myself as a trader under the EU Digital Services Act, and I would really appreciate input from developers who have dealt with this. I’ve received conflicting answers from AI tools, so I’m not confident relying on those alone. Apple requires developers to choose one of the following: “I’m a trader under the DSA” “I’m not a trader under the DSA or I don’t plan to distribute in the EU” I haven’t published any apps yet, but I’m preparing to release my first independently developed apps on the App Store and Google Play. App development is currently a hobby alongside my main job, and I’m not operating through a registered company. The apps will be free to download but include ads. One app will also offer a paid option to remove ads, and I may add in-app purchases in the future. I’ve noticed that some similar apps with ads and in-app purchases are published by developers who don’t appear to be marked as traders, though I understand that may not reflect their actual status. Given this, would you consider someone in my situation to be a trader under the DSA, or could it reasonably be treated as non-trader activity since it’s currently a hobby? I also have a few related questions: Does the same approach apply when selecting trader status on Google Play? What typically happens if you declare yourself a non-trader but the platform later disagrees? Are you usually allowed to update your status, or could your account be affected? Is it true that apps from non-trader accounts may be removed in the EU if the classification is later found to be incorrect? Is trader status set per app or per developer account on Apple and Google? I understand this isn’t legal advice. I’m mainly interested in how other independent developers have interpreted and handled this in practice. Thank you very much for your help. submitted by /u/Wsson_ [link] [comments]