In this Ship It Conversations episode, I talk with Erik Osterman of Cloud Posse about Terraform modules, infrastructure as code frameworks, internal developer platforms, and why AI makes conventions more valuable, not less.

Erik is the founder and CEO of Cloud Posse, which has published more than 180 open source Terraform modules, and he hosts Cloud Posse's weekly DevOps Office Hours.

We start with what AI has done to open source infrastructure projects, then get into what makes a good Terraform module: consistent naming, a consistent interface, not so small that it wraps a single resource, and not so large that it has a hundred inputs nobody can test.

We also talk about CloudFormation, Pulumi, and why HCL's constraints helped build the module ecosystem. Erik explains where Crossplane fits, and why accounts, IAM, networking, DNS and certificates all come before the cluster.

A big part of the conversation is frameworks. Erik argues that nobody actually runs "vanilla Terraform," because Terraform alone doesn't handle state layout, promotion, authentication, tool installation or repository structure. Every team ends up building its own framework, usually undocumented. We talk about Terragrunt, Atmos, naming conventions, brownfield adoption, and breaking a monolithic root module into services.

Near the end, we get into AI and self-service. Erik's team now generates most of its infrastructure work with AI, and it works because the conventions, agent skills, MCPs and pipelines are already in place. Self-service doesn't have to mean another no-code platform.

The big takeaway: AI can generate infrastructure code faster than ever, but without conventions it is generating into chaos.

Highlights

• What makes a good Terraform module

• Root modules vs. child modules

• CloudFormation, Terraform, Pulumi, and why constraints helped HCL win

• Where Crossplane fits, and what has to exist before the cluster

• Why internal developer platforms like Backstage come after zero-to-one

• Why infrastructure as code needs frameworks, not just modules

• Agent skills, MCPs, and self-service without a no-code platform

Links

Cloud Posse: https://cloudposse.com

Atmos: https://atmos.tools

Cloud Posse on GitHub: https://github.com/cloudposse

DevOps Office Hours: https://tsn.io/2gq7v

Erik Osterman on LinkedIn: https://www.linkedin.com/in/osterman

More episodes and show notes: https://tsn.io/NqkdP

On Call Brief: https://tsn.io/Gpz2d

LMGT Awards: https://lmgt.org

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W41/?utm_source=substack&utm_medium=email&utm_campaign=2026-W41

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

The bigger theme this week is control. Developer tools are production infrastructure. AI agents need real execution boundaries, not just instructions. Faster startup through snapshots means understanding exactly what state is being restored. And moving a managed database onto your own infrastructure gives you portability, but also gives you the pager.

In the lightning round: Citrix has a NetScaler SAML vulnerability under active exploitation. Cloudflare is working toward becoming a publicly trusted certificate authority. And attackers are actively scanning for Rejetto HFS servers vulnerable to a flaw that can lead to account takeover and remote code execution.

And the human closer comes from Lorin Hochstein and a recent Google Cloud networking incident. One part of the outage involved someone correctly following an incorrect procedure, while another involved someone incorrectly following a correct one. Training matters, but systems also need guardrails that keep normal human mistakes from turning into large outages. If your system only works when nobody makes a mistake, the system is the problem.

Links

Atlassian CVE-2026-21589

https://tsn.io/ZlqKv

GitHub Copilot Local Sandboxing

https://tsn.io/rQngM

AWS Lambda SnapStart for Container Images

https://tsn.io/uXqkK

Google Spanner Omni GA

https://tsn.io/GoZZ5

Citrix NetScaler CVE-2026-88779

https://tsn.io/yN5a9

Cloudflare Certificate Authority

https://tsn.io/egMN5

Rejetto HFS CVE-2026-61500

https://tsn.io/oQrkU

Google Cloud Networking Incident

https://www.tellerstech.com/go/s-dc989ad2/

There Was a Light That Never Went Out

https://www.tellerstech.com/go/s-cb0bc459/

This Week’s On Call Brief

https://tsn.io/8yaIY

Ship It Weekly

https://tsn.io/NqkdP

On Call Brief

https://tsn.io/Gpz2d

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W40/?utm_source=substack&utm_medium=email&utm_campaign=2026-W40

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

The bigger theme this week is how the systems around our infrastructure are changing. Managed cloud services still have lifecycles that eventually become migration work. Kubernetes authorization can depend on what controllers do with the resources users are allowed to manipulate. Applications acting as clients still process untrusted data. And infrastructure tooling is starting to treat AI agents as first-class users rather than humans who happen to automate commands.

In the lightning round: another Kubernetes vulnerability affecting Windows nodes can expose NetNTLMv2 credentials through NTLM coercion. GitHub now supports custom runners for Dependabot version and security updates. And external systems like a CMDB or internal developer portal can push repository properties into GitHub while remaining the source of truth.

And the human closer comes from Lorin Hochstein and SRE Weekly. Some availability risks are probably never going away. Resources are finite, networks fail, security controls can affect availability, and production systems have to change. Preventing individual failures still matters, but incident response is part of reliability engineering too. Sometimes improving reliability means getting better at handling the failures you cannot eliminate.

Links

Amazon DevOps Guru End of Support - https://tsn.io/GQHN8

Kubernetes CVE-2026-2270: Cross-Namespace Pod Creation - https://tsn.io/BsNs8

Undici CVE-2026-85024: WebSocket Denial of Service - https://tsn.io/LncLd

Cloudflare: Introducing the cf CLI - https://tsn.io/Wk3ma

Cloudflare Forge - https://tsn.io/bAPJu

Lightning Round

Kubernetes CVE-2026-76654: Windows NTLM Coercion - https://tsn.io/36Kc3

GitHub: Custom Runners for Dependabot - https://tsn.io/tYl9K

GitHub: External Custom Properties - https://www.tellerstech.com/go/s-1fd1396d/

Human Closer

Omnipresent Availability Risks in Cloud Software - https://www.tellerstech.com/go/s-076db9dd/

Our Links

This Week’s On Call Brief - https://tsn.io/fKB9V

Ship It Weekly - https://tsn.io/NqkdP

On Call Brief - https://tsn.io/Gpz2d

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W39/?utm_source=substack&utm_medium=email&utm_campaign=2026-W39

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

The bigger theme this week is what happens after trust has been established. Elastic Beanstalk Cluster Mode puts more infrastructure behind a managed abstraction, but shared infrastructure still means understanding isolation and blast radius. CrowdSec shows how an initial compromise can become a credential problem long after the malicious code is gone. Next.js shows how something as ordinary as generating a social preview image can expose a server-side execution path. And EvilTokens shows how attackers can use valid access to move faster once inside an account.

In the lightning round: F5 has a critical BIG-IP APM vulnerability under active exploitation. GitHub Enterprise Cloud can now export an inventory of credentials with enterprise access, including PATs, SSH keys, OAuth tokens, and GitHub App credentials. Zyxel patched a vulnerability affecting GS1900 switches. And Veeam Agent for Microsoft Windows has a privilege-escalation vulnerability that can lead to SYSTEM access.

And the human closer comes back to CrowdSec. Removing the malicious package, patching the server, or reimaging the workstation does not necessarily end the incident. If an attacker already stole an OAuth token, cloud credential, SSH key, session, or registry credential, that access can survive long after the original compromise is gone. Containment means understanding not only how the attacker got in, but what they took with them

Links

AWS Elastic Beanstalk Cluster Mode

https://tsn.io/1xaV7

CrowdSec Supply-Chain Attack Analysis

https://tsn.io/7yq2f

Next.js ImageResponse Security Advisory

https://tsn.io/8JvHp

Microsoft: Disrupting EvilTokens

https://tsn.io/DtbC9

Microsoft: EvilTokens and Device-Code Phishing

https://tsn.io/ZzwtD

F5 BIG-IP APM CVE-2026-94127

https://tsn.io/sFuKW

GitHub Enterprise Credential Inventory

https://tsn.io/7bpMn

Zyxel GS1900 Security Advisory

https://www.tellerstech.com/go/s-b2595852/

Veeam Agent for Microsoft Windows Vulnerability

https://www.tellerstech.com/go/s-166d3119/

This Week’s On Call Brief

https://tsn.io/Nnd8g

Ship It Weekly

https://tsn.io/NqkdP

On Call Brief

https://tsn.io/Gpz2d

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W38/?utm_source=substack&utm_medium=email&utm_campaign=2026-W38

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

The bigger theme this week is infrastructure that changes even when your code does not. GitHub is making CI execution permissions more explicit, Helm teams now have a defined migration deadline, and the ubuntu-latest transition is a good example of how a completely unchanged workflow can suddenly be running in a different environment. Pinning everything forever is not necessarily the answer. The important part is knowing which dependencies are allowed to move and testing those changes deliberately.

In the lightning round: GitHub Actions checks, workflow runs, and statuses will begin following your configured retention period on October 1. GitHub Advanced Security can now enforce configurations from the enterprise level. GitHub added API support for tracking when self-hosted Actions runner versions lose support. And AI Scan for pull requests can now be used without requiring CodeQL default setup.

And the human closer starts with a sentence almost every infrastructure engineer has heard during an incident: “But nothing changed.” Maybe nothing changed in the application, but the runner image changed, a dependency moved, a certificate expired, DNS changed, or an external service behaved differently. Latest tags, loose version constraints, external APIs, and even support windows are dependencies. The goal is not to freeze everything forever. It is to avoid accidental mutability, where something can change without the team realizing it was ever allowed to change.

Links

GitHub Actions Workflow Execution Protections

https://tsn.io/fbqif

Cisco Secure Email Gateway Security Advisory

https://tsn.io/jX2wk

Helm 3 End of Life

https://tsn.io/Ii7jb

Ubuntu 26.04 GitHub Actions Runners and ubuntu-latest Migration

https://tsn.io/7IJ9k

GitHub Actions Retention Changes

https://tsn.io/idFxy

GitHub Advanced Security Configuration Enforcement

https://tsn.io/8vRMx

GitHub Actions Self-Hosted Runner Lifecycle API

https://tsn.io/9UhY1

GitHub Code Scanning AI Scan

https://tsn.io/ULAVW

This Week’s On Call Brief

https://www.tellerstech.com/go/26w38/

Ship It Weekly

https://tsn.io/NqkdP

On Call Brief

https://tsn.io/Gpz2d

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W37/?utm_source=substack&utm_medium=email&utm_campaign=2026-W37

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

The bigger theme this week is catching problems before they turn into incidents. Amazon Linux 2027 gives teams time to test AMIs, bootstrap scripts, agents, Terraform, CloudFormation, and CI/CD before the next platform generation becomes production reality. GitHub’s new cache controls make workflow trust boundaries explicit instead of leaving them implied. And secret-scanning rulesets move credential detection directly into the merge path, where developers can actually act on it.

In the lightning round: Karmada graduates from the CNCF as multi-cluster and distributed AI scheduling grow, ShieldCrash research claims another Microsoft Defender patch bypass with SYSTEM-level access, CodeQL 2.27 adds native Linux ARM64 support, and Dependabot can now read private GitHub Packages without another personal access token.

And the human closer is about what happens when observability shares the same failure domain as the thing it is watching. A full disk is bad enough. It gets worse when logs stop writing, monitoring data disappears, and the tools used to diagnose the outage start failing too. The takeaway is not that every monitoring component needs total isolation. It is that you should know what can blind you, and make sure at least one useful signal survives the failures you care about most.

Links

Amazon Linux 2027 Public Preview

https://tsn.io/NHlEa

Amazon Linux 2027 Overview and Preview Details

https://tsn.io/izDYx

Amazon Linux 2027 Known Issues and Preview Limitations

https://tsn.io/tdugd

GitHub Actions Cache Permissions with cache-mode

https://tsn.io/8p94n

Block Pull Requests with Exposed Secrets from Merging

https://tsn.io/BspA2

N-able N-central 2026.3 Hotfix 4

https://tsn.io/xredG

Huntress: N-able N-central Vulnerability and Active Exploitation

https://tsn.io/QjNd5

Karmada Graduates from the CNCF

https://tsn.io/lcJGh

Microsoft Defender ShieldCrash Zero-Day Research

https://tsn.io/YfsJ6

CodeQL 2.27 Adds Linux ARM64 Support

https://tsn.io/lxfnF

Automatic Dependabot Access to GitHub-Hosted Registries

https://tsn.io/pSilA

Ship It Weekly

https://www.tellerstech.com/go/siw/

On Call Brief

https://www.tellerstech.com/go/ocb/

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W36/?utm_source=substack&utm_medium=email&utm_campaign=2026-W36

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

The bigger theme this week is failure modes hiding inside infrastructure we already trust. A dead network path can look like a slow application. A repository migration involves far more than copying Git history. A self-hosted runner can quietly become unsupported while it continues looking healthy. And giving a developer access to the Docker socket may sound like convenience until you remember that the Docker group is effectively a root-level privilege.

In the lightning round: Lambda gets full IAM resource-based policies, AWS warns that circular PostgreSQL role memberships can stall major RDS and Aurora upgrades, a researcher releases the FalconFlank CrowdStrike privilege-escalation PoC while CrowdStrike investigates, and SonicWall patches two SMA1000 zero-days after confirming active exploitation.

Links

AWS Gateway Load Balancer TCP Reset

https://www.tellerstech.com/go/s-d7e609ab/

Azure DevOps Enterprise Live Migrations Public Preview

https://www.tellerstech.com/go/s-ea05aff9/

GitHub Actions Self-Hosted Runner Minimum Version Enforcement

https://www.tellerstech.com/go/s-6e8540c4/

Omarchy: Any User Process Can Escalate to Root

https://www.tellerstech.com/go/s-d22971c3/

AWS Lambda Full IAM Resource-Based Policies

https://www.tellerstech.com/go/s-ff2a04b5/

Fix Circular Role Dependencies Before Upgrading RDS and Aurora PostgreSQL

https://www.tellerstech.com/go/s-e4578f52/

FalconFlank CrowdStrike Privilege Escalation PoC

https://www.tellerstech.com/go/s-8c21b00b/

SonicWall SMA1000 Zero-Day Advisory

https://www.tellerstech.com/go/s-559ffc8b/

Remote Incident Reviews: Async First, Live Later?

https://www.tellerstech.com/go/s-68ca9f5e/

This Week’s On Call Brief

https://tsn.io/L95NS

Ship It Weekly

https://www.tellerstech.com/go/siw/

On Call Brief

https://www.tellerstech.com/go/ocb/

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W35/?utm_source=substack&utm_medium=email&utm_campaign=2026-W35

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

The bigger theme this week is assumptions. A few wasted bytes do not matter until you have 250 billion cache entries. A Region having three Availability Zones feels permanent until AWS adds a fourth. And centralized DNS governance works fine until every application team needs a networking ticket just to make a private zone resolvable.

In the lightning round: new research looks at manipulating DRAM controller translation registers and the assumptions that creates for memory isolation, AKS eBPF Host Routing reaches general availability, CloudFront Functions can now put custom context directly into access logs, and Go 1.27 lands generic methods along with runtime, tooling, and standard-library improvements.

And the human closer looks at an easy Kubernetes mistake: running kubectl against the wrong cluster. Because the active context belongs to the kubeconfig rather than a terminal tab, changing it in one shell can silently affect another. It is a good reminder that some friction is worth keeping around production, and that the safest guardrails live somewhere stronger than operator memory.

Links

Cloudflare: How We Saved 100 Terabytes of Memory by Optimizing 1.1.1.1’s DNS Cache https://blog.cloudflare.com/dns-cache-memory-optimization-1111/

OVHcloud Raises Prices as AI Memory Demand Reprices Non-AI Infrastructure https://tsn.io/tnaYj

AWS Adds a Fourth Availability Zone to Europe (London) https://tsn.io/YfGxa

Shared DNS Views with Amazon Route 53 Global Resolver https://tsn.io/WEyig

DRAM Controller Register Manipulation Breaks CPU Memory Isolation https://tsn.io/QKr1x

AKS eBPF Host Routing https://tsn.io/T3PMh

CloudFront Functions Unified Logging https://tsn.io/nTXLn

Go 1.27 https://tsn.io/vfXIT

kubectl Ran on the Wrong Cluster? Fix Your Context Switching https://tsn.io/6LxfG

This Week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W35/

Ship It Weekly https://shipitweekly.fm/

On Call Brief https://oncallbrief.com/

In this Ship It Conversations episode, I talk with Justin Garrison of Sidero Labs about Kubernetes, platform engineering, bare metal, AI, golden paths, and why knowing what to say no to may be one of the most important skills a platform team can develop.

Justin is Field CTO at Sidero Labs, the company behind Talos Linux, and co-host of Fork Around and Find Out.

We start with the evolution of Kubernetes and how managed services like EKS and GKE made Kubernetes easier to consume while also pulling teams deeper into proprietary cloud ecosystems. Justin explains why on-prem and bare metal are getting renewed attention, especially as teams look at cloud costs, data sovereignty, and the operational overhead that comes with constantly optimizing cloud environments.

We also get into where Kubernetes helps and where it becomes self-inflicted pain. Justin talks about abstraction, cognitive load, and why teams tend to use familiar tools for problems they were never really designed to solve.

A big part of the conversation is platform engineering and golden paths. Justin argues that every organization needs its own path, but platforms become dangerous when they try to centralize everything. He shares why one of the best decisions his team made at Disney Plus was simply saying no to stateful workloads.

We also talk about what really belongs in a platform: security controls, logging, monitoring, software supply chain visibility, and cost management. Justin explains why centralization can help in those areas, but can become a bottleneck when applied too broadly.

Near the end, we get into AI, security, tooling dependency, and engineering culture. Justin makes the point that people have always formed strong attachments to tools, and AI is another version of that. The challenge is knowing where AI actually helps versus where it becomes another dependency teams stop questioning.

The big takeaway: good platform engineering is not about supporting everything. It is about understanding what should be standardized, what should stay flexible, and what your team should explicitly refuse to own.

Highlights

• Why Kubernetes has become increasingly productized

• Why some teams are moving back toward on-prem and bare metal

• Where cloud cost optimization starts to become its own operational burden

• Why Kubernetes helps with abstraction and cognitive load

• Why familiar tools often get used for the wrong workloads

• What golden paths actually represent inside an organization

• Why platform teams need to know what to say no to

• What should and should not be centralized

• How AI changes engineering workflows without changing the need for judgment

• Why finding work you actually enjoy matters for avoiding burnout

Links

Sidero Labs: https://www.siderolabs.com

Talos Linux: https://www.talos.dev

Justin Garrison: https://justingarrison.com

Fork Around and Find Out: https://www.forkaroundandfindout.com

More episodes and show notes: https://shipitweekly.fm

On Call Brief: https://oncallbrief.com

LMGT Awards: https://lmgt.org

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W34/?utm_source=substack&utm_medium=email&utm_campaign=2026-W34

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

The bigger theme this week is dependencies and boundaries we tend to ignore until something breaks. GitHub is no longer just where the code lives. Agentic browsers are no longer just displaying webpages. Certificate renewal is not something you want depending on someone checking an inbox. And CI pipelines have become software systems of their own.

Links

GitHub Hit by Widespread Outage https://devops.com/github-hit-by-widespread-outage-halting-work-for-global-developers/

Zenity Labs: PleaseFix in Agentic Browsers https://zenity.io/company-overview/newsroom/company-news/zenity-labs-exposes-the-full-scope-of-pleasefix

AWS Certificate Manager Ending Email Validation https://aws.amazon.com/blogs/security/aws-certificate-manager-will-discontinue-email-validation-to-prove-domain-validation-for-certificates/

Certificate Expiry Is Still Taking Down Major Platforms https://tokentimer.ch/blog/tls-certificate-expiry-outages

Cloudflare Turns CI Pipelines into TypeScript Workflows https://www.infoq.com/news/2026/08/cloudflare-ci-code-workflows/

Dynatrace Acquires Arize https://devops.com/dynatrace-acquires-arize-as-ai-agents-deepen-the-observability-challenge/

AWS Open-Sources Dogwood https://www.infoq.com/news/2026/08/aws-dogwood-agent-policy/

Pulumi v3.258.0 https://github.com/pulumi/pulumi/releases/tag/v3.258.0

AWS Key Breach and Data-Transfer Signal https://assets.theregister.com/2026/08/13/20267/

Mario Saved the EU but Broke My System https://www.uptimelabs.io/articles/hamed-2012-outage-reflections

This week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W34/

Ship It Weekly https://shipitweekly.fm/

This week’s On Call Brief is live — a curated read for SRE, DevOps, and platform engineers on call.

Read the full issue (searchable, with topic links):

https://www.tellerstech.com/on-call-brief-news/2026-W33/?utm_source=substack&utm_medium=email&utm_campaign=2026-W33

Want the brief in your inbox every Sunday? Subscribe for the full email edition (not this Substack note):

https://oncallbrief.com

— Teller’s Tech

In this Ship It Conversations episode, I talk with Ned Bellavance of Ned in the Cloud about DevOps beyond the buzzwords, platform engineering, infrastructure as code, AI, and why fundamentals still matter even as the tools change.

Ned is the founder of Ned in the Cloud and host of the Day 2 DevOps podcast, with more than 20 years in IT across systems administration, cloud, architecture, automation, and technical education.

We start with a problem a lot of teams run into: adopting the ceremonies of DevOps without actually adopting the principles. Standups, sprints, pipelines, and tooling can make an organization look mature, but the real goal is better communication, faster feedback loops, and delivery tied to actual outcomes.

We also talk about how teams decide what to prioritize next. Security, reliability, performance, FinOps, and platform work can all matter, but chasing whatever is newest does not help if the basics are still broken.

A big part of the conversation is where infrastructure as code goes from here. We get into Terraform's state and scaling model, API rate limits, the Terraform/OpenTofu split, Terragrunt, and newer approaches like Swamp from System Initiative. AI is making infrastructure code cheaper to produce, but understanding the architecture behind that code is becoming more valuable.

That leads into learning and career development. We talk about why networking, Linux, databases, security, cloud architecture, and troubleshooting still matter, even if an LLM writes most of the syntax. Build things, get them wrong in controlled environments, troubleshoot them, and learn what is happening underneath the abstraction.

The big takeaway: tools will keep changing. Judgment, architecture, troubleshooting, and understanding the systems underneath them are much harder to automate away.

Highlights

• Why DevOps ceremony is not the same as DevOps principles

• How teams should decide what platform work actually matters

• Why basic security hygiene still matters

• Where Terraform's current state model starts to hit limits

• Terraform, OpenTofu, Terragrunt, and the future of infrastructure as code

• How AI changes the value of writing infrastructure code

• Why architecture and troubleshooting skills become more important

• Why breaking things in controlled environments is one of the best ways to learn

Links

Ned in the Cloud: https://nedinthecloud.com

Day 2 DevOps: https://day2devops.com

Ned in the Cloud on YouTube: https://www.youtube.com/c/NedintheCloud/

Ned Bellavance on LinkedIn: https://www.linkedin.com/in/ned-bellavance/

Swamp: https://swamp.club

Terraform: https://developer.hashicorp.com/terraform

OpenTofu: https://opentofu.org

More episodes and show notes: https://shipitweekly.fm

On Call Brief: https://oncallbrief.com