🔥 Top Story
How CloudFormation Express mode accelerates your development cycle
AWS introduced 'Express mode' for CloudFormation, which skips waiting for resource stabilization. Traditionally CloudFormation reports CREATE_COMPLETE only when resources can actually serve traffic; Express mode marks stack operations complete as soon as configuration is applied. Resource dependencies and the way resources are created, updated, and deleted remain unchanged. AWS cites CloudFront distributions dropping from 5-10 minutes to sub-minute confirmation, and the mode is enabled via --deployment-config '{"mode": "EXPRESS"}' in the CLI, cdk deploy --express, or sam deploy --express. Rollback is disabled by default, so a failed stack stays in place for immediate fix-and-retry. AWS recommends it for development iteration and AI-agent deploy-observe-adjust loops, while noting the default mode remains the right choice for production deployments.
💡 Why it matters: This cuts the dev-environment IaC feedback loop from minutes to seconds, making it worth enabling selectively on development stacks — just remember rollback is off by default, which your pipeline policy should account for.
🔗 Read more · AWS DevOps
Kubernetes & Cloud Native
Diagnose Kubernetes Control Plane Performance Issues with AWS DevOps Agent
AWS Containers
AWS published an advanced (level 300) tutorial demonstrating how AWS DevOps Agent diagnoses EKS API server performance degradation. The scenario deploys a misbehaving controller at 50 replicas generating roughly 1,600-2,000 requests per second across LIST/GET/WATCH/MUTATE calls, degrading kubectl latency from ~100ms to over 1.5 seconds and triggering 429 throttling. Because client-go retries 429s transparently, they never appear in the offending workload's logs — only in EKS audit logs — while healthy system controllers like Karpenter get throttled alongside, reproducing the 'APF (API Priority and Fairness) transparency problem.' The agent correlated CloudWatch metrics, EKS audit logs, CloudTrail events, pod logs, and cluster state to conclude in about 7 minutes that the 'controller' deployment was generating ~66,000 API requests per minute, over 99% of API server traffic, saturating the workload-low priority level. A hands-on repo (aws-samples/sample-troubleshooting-eks-with-devops-agent) accompanies the post, and AWS DevOps Agent is currently in preview.
💡 Control-plane 429/APF issues are notoriously hard to diagnose because the offending workload's logs show nothing — an agent that does the audit-log correlation for you can meaningfully cut EKS operational MTTR.
(re)introducing kpt: Your toolchain for infrastructure automation
CNCF
On the CNCF blog, Ericsson's Ciaran Johnston reintroduced kpt, recently fully onboarded as a CNCF Sandbox project. kpt is a package-centric toolchain that treats bundles of Kubernetes Resource Model (KRM) files as packages and runs validator/mutator functions in pipelines to validate and transform configuration. Unlike Kustomize, which renders base-plus-patch overlays at apply time, kpt uses an in-place update paradigm — the final configuration that will hit the cluster can be reviewed and approved as-is before applying, the 'WYSIWYG' approach. Its 'Configuration as Data' philosophy separates pure KRM data (packages) from the business logic that transforms it (KRM functions), improving auditability and composability, and it coexists with ArgoCD, Flux, Helm, and Porch. Its most complex adopter is Nephio, the telecom automation project defining RAN and core network deployments on Kubernetes. The roadmap includes pipeline execution performance improvements, a major documentation overhaul, secrets/multi-cluster/Helm support, and API stabilization toward a v1 release.
💡 If your platform team is frustrated by Kustomize's 'you only see the final config after applying' problem, kpt's review-the-rendered-config approach is worth evaluating for GitOps audit and approval flows.
Cloud Updates
Meet Brain: The AI system behind Azure reliability
Azure
Microsoft published the first installment of a multi-part series introducing 'Brain,' the AIOps system at the core of Azure reliability operations. Brain operates as an intelligence layer on top of Azure Resource Graph (ARG); together they form a 'digital twin' of Azure service health. At the scale of hundreds of services, 80+ regions, and 500+ data centers, it ingests standardized SLIs, team-registered domain-specific monitors, and third-party signals, returning four standard outputs — health state, severity, impact, and reasoning — for every evaluated entity, from services and regions down to individual customer resources. Brain already powers production workflows: blast-radius-based outage declaration, customer notifications, incident routing, and deployment gates that halt harmful rollouts. Over the past year a substantial majority of Brain-integrated outages were auto-communicated to customers, with determinations made in seconds rather than minutes. The core thesis: a health intelligence system like this digital twin is a prerequisite for agentic AI operations, not a byproduct.
💡 The sequencing lesson — build a trustworthy health-determination foundation (a unified view of topology, dependencies, and runtime state) before layering on AIOps agents — applies just as much to non-hyperscaler observability roadmaps.
Google’s Continued Disruption of Malicious Residential Proxy Networks
Google Cloud
Google, in coordination with the FBI, Lumen, and other partners, announced disruption actions against NetNut (also known as Popa), a major residential proxy network — a follow-up to January's takedown of the IPIDEA network. Actions include disabling Google accounts and services used for malware command-and-control, sharing technical intelligence on the NetNut SDK and backend infrastructure with platform operators and law enforcement, and having Play Protect automatically warn about, disable, and block installation of apps containing the SDK. Google Threat Intelligence Group (GTIG) estimates NetNut spans at least 2 million devices worldwide and says the action shrank the operator's available device pool by millions. In a single week of June 2026, GTIG observed 316 distinct threat clusters — including cybercrime and espionage groups — using suspected NetNut exit nodes to access victim environments and mask the origin of password-spray attacks. NetNut grew its botnet by embedding SDKs in consumer devices like smart TVs and streaming boxes, and Google assesses with high confidence that several well-known residential proxy brands are actually white-labels of NetNut's botnet. Post-IPIDEA observations showed degraded operators simply buying rival capacity and becoming resellers, leading Google to conclude that sustained disruption requires hitting interconnected providers simultaneously.
💡 These proxy networks are exactly why password-spray and credential-stuffing traffic looks like ordinary residential IPs — reinforcing that IP-reputation blocking alone is insufficient and behavior-based detection must run alongside it.
Introducing Red Hat OpenShift Service Mesh 3.4
Red Hat
Red Hat announced the general availability of OpenShift Service Mesh 3.4, based on Istio 1.30 and Kiali 2.27 — a two-minor-version Istio jump from 3.3. Ambient (sidecar-less) mode matures significantly: workloads in ambient and sidecar modes can now officially coexist in the same mesh, with supported gradual and reversible sidecar-to-ambient migration. ztunnel gains CRL (certificate revocation list) support for validating and rejecting revoked certificates when using external CAs, alongside native nftables support ahead of RHEL 10 and new network policy options for istiod, istio-cni, and ztunnel. Kubernetes Gateway API 1.5 is fully supported including TLSRoute termination and mixed mode; SPIRE-based zero-trust workload identity integration is promoted to tech preview, and a new TrafficExtension API (with Lua support) aiming to replace WasmPlugin arrives in tech preview. Kiali ships a redesigned overview page built for multi-cluster environments with hundreds of namespaces, plus tech-preview AI assistance integrating with OpenShift Lightspeed via an MCP server. Notably, Service Mesh 2.6 reached end of life on June 30, 2026, making migration planning urgent.
💡 With 2.6 already past EOL, migrating to 3.x is now urgent for OpenShift mesh users — and with sidecar-to-ambient migration officially supported, this is the right moment to evaluate cutting sidecar resource overhead.
DevOps & Infrastructure
The $1.3 million theft that exposed AI’s blind spot
The New Stack
Two stolen trailers carrying roughly $1.3 million in data center equipment and copper wiring were recovered at a truck yard in Elk Grove Township outside Chicago. One held about $300,000 of copper wire stolen in Alabama and destined for data center construction; the other carried about $1 million in data center infrastructure gear stolen in Jacksonville, Florida. Verisk CargoNet reports North American cargo theft losses surged about 60% in 2025 to nearly $725 million while incident counts stayed flat — a sign thieves are selecting higher-value loads. Metal theft rose 77%, driven largely by copper demand, and organized crews are shifting toward RAM modules, storage drives, and enterprise hardware. DHS estimates cargo theft costs up to $35 billion annually. The article argues that because GPU clusters are tightly coupled systems — servers, switches, optics, power distribution, and cooling must be installed together — the theft or delay of one component category cascades into full deployment delays.
💡 A signal that AI infrastructure security now extends beyond firewalls and IAM into physical logistics — hardware supply chain risk deserves its own line item when planning data center build-out schedules.
Microsoft just admitted its biggest AI mistake — and spent $2.5 billion fixing it
The New Stack
Microsoft launched 'Microsoft Frontier Company,' a new operating entity seeded with $2.5 billion to help enterprise customers adopt AI across multiple models rather than standardizing on one. Early customers include Unilever and Novo Nordisk; clients integrate AI tools from Microsoft and outside providers with their internal data and retain ownership of the results. Microsoft Commercial Business CEO Judson Althoff told Reuters the company 'made a mistake by binding' the original Copilot to OpenAI models only. The article frames this as the end of the single-model era: route million-token contracts to Gemini, cheap ticket summarization to GPT mini or Claude Haiku, and regulated on-prem workloads to open-weight models like Llama or Mistral. Routing and orchestration tooling — LiteLLM, Portkey, LangChain/LangGraph, MCP — plus single-API multi-model services such as Bedrock, Azure AI Foundry, and Vertex AI underpin the shift. The conclusion: as model performance converges, the orchestration layer is becoming the new moat, and enterprises are treating models as swappable components rather than platforms.
💡 When even a hyperscaler calls single-model lock-in a mistake, hardcoding your application to one LLM API is a liability — put a gateway/routing abstraction in your architecture to keep model-swapping cheap.
“AI contributions are demoralizing”: Godot bans coding agents to save its mentoring model
The New Stack
Godot, the open-source game engine, is rewriting its contribution policy to bar most AI-generated code from its repositories. The decision came after months of internal discussion at the nonprofit Godot Foundation, prompted by an unmanageable PR backlog swollen with AI-written submissions. The Foundation called AI contributions 'demoralizing,' arguing that review feedback doesn't change what a model does next and that heavy AI users can't be trusted to understand their own code well enough to act on feedback. The deeper rationale goes beyond code quality: protecting the mentoring pipeline in which PR review trains future maintainers. Low-risk uses — code completion, regex, find-and-replace — remain allowed with disclosure, and new contributors (three or fewer merged PRs) need explicit pre-approval before large changes. Zig adopted a similar zero-tolerance policy in April, and Ghostty and curl have also restricted contribution paths, making this a broadening open-source trend.
💡 As AI-generated contributions grow, the review-cost-to-mentoring-value ratio collapses — teams contributing upstream should now check each project's AI policy and align their internal practices accordingly.
How GitHub used secret scanning to reach inbox zero
GitHub
GitHub's security team shared how it took 20,000+ secret scanning alerts across 15,000+ of its own repositories down to zero in nine months. Analysis showed just five repositories accounted for roughly 18,000 alerts, almost all inactive secrets — test fixtures, deactivated credentials, fake secrets — a natural consequence of GitHub building secret scanning itself. Using bulk-closure criteria ('dedicated test repo + no active history + matches known test patterns'), the team closed those in days, leaving 2,000+ alerts needing real attention; about 90% of the initial count was not valid. To stop new inflow, secret scanning and push protection were enforced as organization-level settings across every enterprise and org, with no team-level opt-out. The team built its own validity checking — which didn't exist natively at the time and has since become a built-in product feature. Routing alerts into an internal vulnerability management platform, auto-assigning them to owning teams, and tracking progress on leadership dashboards rounded out the workflow.
💡 Evidence that the tens of thousands of alerts you face right after enabling secret scanning are mostly inactive — validity-based bulk triage plus mandatory push protection is the practical formula for clearing the backlog.
Could vs. Should: The First Year Managing an SRE Team
Honeycomb
Honeycomb engineering manager Reid Savage reflects on his first year leading the company's SRE team. His central frame: SRE and management share the same trap — there's far more you could do than you should do, and telling them apart is the hard part. He names three mistakes: running meetings so thoroughly prepared that participation dropped, sitting on feedback for team members far too long, and stepping entirely out of technical decisions despite 8+ years of hands-on experience — which let some projects hit foreseeable obstacles. His corrections include working backward from each meeting's goal to the lightest possible process, making 'give me constructive feedback' a standing 1:1 agenda item, and explicitly declaring his level of involvement in technical decisions (decide, recommend, advise, or stay silent). For new managers he recommends building high-trust relationships, relentlessly seeking feedback, asking your boss, their boss, and a team member what your role and your team's job actually are, and asking far more questions than you give orders. A follow-up post will cover year two, including a staff engineer's sudden departure and a sharp strategic pivot to AI.
💡 The most useful takeaway is a practical frame for the classic senior-IC-turned-manager trap — neither dominating nor abandoning technical decisions, but explicitly declaring your level of involvement each time.
AI로 웹 엔지니어 없이 LINE 앱 안에서 그룹 영상 통화 서비스 만들기
LINE
Two people from the LINE Planet team — PM Deokbeom Jung and Android engineer Daekyung Kang — built a group video call service running inside the LINE app without any web engineers, and wrote it up as a reproducible tutorial. The architecture has five components: a LINE Official Account as the entry point, LIFF (in-app webview plus login/profile handoff), a React + Vite web app, an app server issuing LINE Planet access tokens (deployable serverlessly on Firebase Cloud Functions), and LINE Planet, the WebRTC-based real-time communication infrastructure — only the web app and app server need to be built. On media handling, the post shows how reusing a single PlanetKit MediaStreamManager instance from preview through group call avoids repeated camera/mic permission prompts. Front/rear camera switching works around the SDK's lack of facingMode support by matching device labels via enumerateDevices(). The join flow runs LIFF user info → app server token issuance → joinConference, with a dynamic participant grid, resolution tiers (hd/vga/qvga), and friend invitations via liff.shareTargetPicker. A live-broadcast scenario supports 500 concurrent participants by default, up to 10,000.
💡 A case study showing that delegating auth and media infrastructure to platform SDKs lets two non-web engineers ship a video call service — a good argument for considering platform-delegation architectures before hiring full-stack specialists for internal tools and PoCs.
This digest was collected from RSS feeds and summarized by AI (Claude). See the original links for full details.