I’m currently trying to learn the basics of DevOps, things like Docker, AWS, GCP, CI/CD, Kubernetes, etc.

Docker and the local tools are easy enough to practice, but when it comes to cloud platforms like AWS and GCP, a credit card is often required to create an account or access certain services.

I currently don’t have a credit card, so I’m wondering: What’s the best way to learn AWS/GCP without one? Would appreciate any recommendations from people who learned cloud without having a credit card. 🙌

I have been aggressively migrating from AWS permanent credentials to OIDC in GitHub Actions, mainly for deploying to ECS.

I know GitHub Actions were supporting OIDC for a while now. But the pressure on compliance is the reason for this migration.

If you are new to OpenID Connect (OIDC), it allows GitHub runners to mint short-lived (15–60 min) STS tokens on-the-fly with zero stored secrets.

Here’s a quick breakdown of how it works, the Terraform/OpenTofu setup, and the subtle gotchas that I faced.

1. How It Works Under the Hood

1. When your workflow job starts with id-token: write, GitHub's OIDC service generates a cryptographically signed JSON Web Token (JWT).
2. The aws-actions/configure-aws-credentials action sends this JWT to AWS STS via sts:AssumeRoleWithWebIdentity.
3. AWS validates GitHub's signature, checks your IAM Role's Trust Policy (to ensure the token came from your exact repo and branch), and returns temporary STS credentials.

2. The Infrastructure Setup (Terraform / OpenTofu)

You only need two AWS resources: an OIDC Provider and an IAM Role with a Trust Policy.

hcl # 1. The GitHub OIDC Identity Provider resource "aws_iam_openid_connect_provider" "github" { url = "https://token.actions.githubusercontent.com" client_id_list = ["sts.amazonaws.com"] thumbprint_list = [ "6938fd4d98bab03faadb97b34396831e3780aea1", "1c58a3a8518e8759bf075b76b750d4f2df264fcd" ] } # 2. IAM Role with Scoped Trust Policy resource "aws_iam_role" "github_deploy_role" { name = "github-actions-deploy-role" assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [{ Effect = "Allow" Principal = { Federated = aws_iam_openid_connect_provider.github.arn } Action = "sts:AssumeRoleWithWebIdentity" Condition = { StringEquals = { "token.actions.githubusercontent.com:aud" = "sts.amazonaws.com" } StringLike = { # Restrict exclusively to your repository & branch/tags "token.actions.githubusercontent.com:sub" = "repo:your-username/your-repo:*" } } }] }) }

3. The GitHub Actions Workflow

In your .github/workflows/deploy.yml

name: Deploy to AWS on: push: branches: [ main ] jobs: deploy: runs-on: ubuntu-latest permissions: id-token: write # CRITICAL: required to request the OIDC JWT contents: read steps: - name: Checkout code uses: actions/checkout@v4 - name: Configure AWS Credentials via OIDC uses: aws-actions/configure-aws-credentials@v4 with: role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy-role aws-region: us-east-1 - name: Verify Authentication run: aws sts get-caller-identity 

Three real-world gotchas that will save you hours

If you get Error: Could not assume role with OIDC: Not authorized to perform sts:AssumeRoleWithWebIdentity, check these 3 things:

1. Case Sensitivity in the sub claim: AWS IAM condition strings are case-sensitive. If your GitHub repo or username uses mixed casing (e.g. MyOrg/Repo), make sure your IAM sub condition matches the exact casing GitHub sends in the token. Using wildcard matching (repo:MyOrg/Repo:*) helps avoid exact ref string mismatch issues.
2. Job-Level vs. Workflow-Level Permissions: Always set permissions: id-token: write on the specific job, not just globally at the top of the YAML file. Some runner configs don't inherit top-level permissions to nested jobs.
3. CA Thumbprints: Don't dynamically query GitHub's leaf certificate for thumbprints in Terraform—they change frequently with CDN updates. Use GitHub's official intermediate root CA thumbprints:
   • 6938fd4d98bab03faadb97b34396831e3780aea1
   • 1c58a3a8518e8759bf075b76b750d4f2df264fcd

Summary

• No stored secrets in GitHub settings.
• No key rotation schedules to manage.
• Granular security. You can restrict deployment roles to specific branches or environments.

Are you already using OIDC for your pipelines, or are you still relying on IAM users? Curious how folks here handle multi-account / cross-account OIDC setups.

Hi everyone,

I’m looking for a good-quality laptop backpack mainly for work, commuting, customer visits, and occasional business travel.

I’d like something practical and durable, but still professional-looking rather than a hiking or tactical backpack.

My main priorities are:

- good protection for the laptop, preferably a separate padded laptop compartment

- comfortable shoulder straps and back panel

- good internal organization for charger, cables, mouse, headphones, documents, etc.

- quick-access pocket for keys / phone / wallet

- space for a water bottle

- durable materials and good-quality zippers

- some water resistance would be a plus

- preferably a luggage pass-through for attaching it to a suitcase

- professional / minimalist design

- preferably something that will last for many years

It will mainly be used for everyday work, but occasionally I’d also like to use it for 1–2 day business trips.

I’m based in Europe, so I’m mainly interested in brands/models that are easily available in the EU without expensive international shipping, customs, or import fees.

I’m not necessarily looking for the cheapest option — I’d rather pay more for something comfortable, well designed, and durable.

What backpacks are you actually using and would recommend?

I’m especially interested in long-term experience: how long have you owned it, what do you like about it, and what annoys you?

Thanks!

I signed up for blacksmith about a week in I’ve got a $7 bill already. I’m also getting you’ve hit 80% of your free mins and you should add a payment method.

I’m seriously confused after being extremely impressed by how fast their runners are. Now I’m wondering what the heck is going on.

I tried to reach out to them but need a payment method to contact billing and no reply on the support@ email.

I’m happy to pay as the service is good but really surprised how they work/do business. I feel I could easily be in for future bull shocks.

Has this happened to anyone else.

Looks like I’m not the only one hit by this - https://forestwalk.ai/blog/surprise-blacksmith-costs/

We all know that large organizations tend to have a lot of meetings, bureaucratic processes and are in general slow moving. That was true for a long time and I experienced that myself, having worked in multiple different companies from startups, scaleups and large corperations.

However since everyone now adopts AI and implementation speed is undeniable multiples faster. I mean it's not just implementation, but also a good part of DevOps. But the rest of the organization moves in the same speed as before. Even if the company uses AI in the other departments (my company does basically throw AI at everything, I guess you know what I mean), they still can't competet with the productivity change in software development.

The blockers are now decisions, requirements and communication. That's not completly new, but now its >95% of the time. I implement features in hours that would have taken days before (I am not a pure DevOps Engineer). And it's not the review process itself that blocks us (We use AI in reviews as well, because otherwise it would be impossible), it's the normal company processes and pace.

Don't get me wrong here, I kind of enjoy it a bit, because I can use a lot of time for learning, building stuff that I think is worth improving, but I think we have a general problem here that is basically systematic to every large organization. And I see that so called "AI native organizations" (what ever that means), will probably overtake tech companies in the long term.

I have a really good comparsion, because I am working with a startup as a side gig and my main job is in a mid-sized tech company. In the Startup we (2 devs) built a product that would have taken several months by a 5-person team in the past and the reason is mostly: decisions and communication.

Do you see that in your company?

My conclusion is that we need to make engineers owners of the feature/product + infra, otherwise we won't see much productivity gains and this means also that management layers need to be cut, because they are the bottleneck currently. The idea of centralized DevOps will is going to die I guess.

I recently came across a post on Reddit from someone looking to connect with other DevOps professionals. I reached out, and we ended up moving the conversation to Discord.

It's been pretty nice having a place where we can talk about things we're working on, exchange ideas, troubleshoot things, and share what we've learned.

But the conversations haven't really stayed limited to DevOps - which is actually what I've enjoyed most.

We sometimes end up talking about things like:

• How DevOps/tech work differs between countries
• Differences in workplace and engineering culture
• How people got into the industry and how their careers have developed
• Tools, practices, and technologies people are using
• Interesting things we're currently learning or building
• And occasionally just completely random stuff 😄

I'd like to meet more people from different parts of the world and have more of these conversations.

You don't need to be a DevOps expert or have 10+ years of experience. If you work somewhere around DevOps, SRE, cloud, infrastructure, platform engineering, sysadmin, or software engineering - or you're simply learning in that direction - feel free to reach out.

We're currently a small group, and we'd like to keep it that way rather than turn it into a huge server full of people who never talk.

If you'd be interested in chatting and getting to know some other people in the space, leave a comment or send me a DM. Happy to connect.

So i'm a senior software engineer with almost 9 years of experience, mostly backend stuff, a lot of AWS, serverless, Node.js and JavaScript in general. Lately i've been watching how fast everyone is adopting AI and honestly it's making me less interested in this field, or at least less sure about where it's going, and i don't want to just sit around waiting to see if i end up on a layoff list.

What i really want is a backup plan, something i can lean on if things go sideways, and DevOps or platform engineering feels like a natural step since i already live in AWS and deal with infra day to day, but i don't really know what the day to day is like or how it compares to backend work.

For those of you who moved into DevOps from backend, what did the transition look like, what did you have to learn that you didn't expect, and what would you focus on now so i'm not the one who gets cut? Any honest takes appreciated.

I work in a small team that deploys some internal products. No big user pool or database for me! We build small web apps that automate inner processes, and some scripts and jobs. Most of it runs on k8s, the apps and the jobs. We mostly run everyting on Azure. And everyting is managed by code, obviously, so we've build GitHub actions pipeline that live with the code to deploy our infra via bicep and the code via a test-build-deploy-promote pipeline, started on push.

But I've seen some platforms that propose full CI/CD as a services, and it feels like managing the pipeline yourself these days is a bad thing. To me, deploying a solution, especially in the containerization era, is simple; Run the tests, build the image, deploy the workload. Add some customization related to the app if needed (specific parameters, logging or testing jobs, etc). But is managing this code yourself a bad practice? I have to say, it does make for a lot of duplicate code in a lot of repos. The pipelines are very similar.

Should we always aim to use a standardized CI/CD platform? What tools do you use for CI/CD? How different do you handle it from a small project to a more important service?

For those who are actively employed in DevOps roles in the USA, how are you finding the current state of DevOps employment in the USA?

Do you feel your jobs are stable?

Do you believe DevOps employment in the USA is steady, growing or shrinking?

Do you believe that AI is eliminating hiring of entry/junior DevOps engineers?

I ask because I am currently out of the software technology work force and pondering trying to re-enter in a DevOps role.

Hello! As the title says, I'm a QA engineer and I'm trying to transition to a new position. Right now, I don't know whether to pick Data Engineering or DevOps. Regarding my skills, in my free time I'm learning Linux, Python (along with some MySQL), CI/CD, Docker, Kubernetes, and currently playing around with Azure. I'm asking because both seem interesting, but I don't know which one to choose to learn further.

Edit: also learnt some openshift and helm chart, because it was requested at my job

Every time this comes up the answer is "run it in a sandbox." Which, sure. But the stuff I actually want an agent for lives in staging and prod. Sandboxing it kind of just means it can't do the thing I wanted it to do in the first place.

So right now my entire safety net is me reading the command before I hit approve, and I'm not going to pretend I'm still reading those properly by the tenth one.

Is anyone running something that's actually built for this? As in it sees a dangerous command and kills it on its own, instead of me being the last line of defense. Or is everyone just living with it, because from the outside that's kind of what it looks like.

Been in IT for about 2 years. Have Compia Trifecta, CCNA, jamf pro. After the CCNA been stuck not knowing what to do. Been studying the MD-102 Endpoint cert for about a month but it’s so boring and I don’t think I want to become an endpoint/Intune admin. Prob will drop it.

My thought process is to create a very basic full stack web app (don’t know any frontend and only had a month studying python) -> then host it on my proxmox using terraform and docker as a learning tool for devops

Is this fine? Any suggestion? Creating the web app will take a while 1000%, and devops don’t need frontend knowledge, but there’s an itch in my brain to learn it though.

This is officially my first post on a reddit sub, i tend to just be reading a lot from here, but getting to the issue, recently i got a new role as DevOps Engineer mid level, chill job, making a new architecture to migrate one heavy ETL app, just one month in, not much meetings, no manager pursuing me every day, a really chill job (OBS: 8yoe on IT ~2-3yoe in Sysadmin/DevOps)

My biggest worry is on how i work, months from now i was an Tech Lead on a AI first company, so i got pretty used to use AI for a lot (ngl it facilitates it, really). Today i use it to make Pipelines templates, bicep templates and even troubleshoot some stuff regarding infrastructure.

The problem is, im using it too much and i dont know if this is a standard nowadays (i mean, it accelerate things BY A LOT if you know how to properly use it) or if im just being a dumbass that is outsourcing my own work just to not touch code.

How is it going for you guys? Maybe i should stop a bit and do something 100% by hand, intentionally delay stuff so i can get work on my own... Really confuse if this is acting correctly and i'm just with impostor syndrome (again).

If you have a small managed K8s cluster with a single node pool and you would like to change the SKU of the VMs in that node pool, make sure to double check how your Terraform provider handles this change

Maybe on AWS or Azure or whatever, this is a graceful operation where the new nodes are provisioned first and the old ones are drained before being deleted

On OVH however it will destroy the existing nodepool first then provision the new one, and during this process your cluster will have zero nodes and whatever was running on it will be down

Thankfully this wasn't a production cluster. At the end of the day I'm just a dev who takes care of devops because nobody else will. In hindsight I feel like I should have seen this coming, but I guess most things work automagically nowadays and it can be a surprise when something does not

here is the context: Mid size (1000 users) company that has been trying to do in-house software dev (outsourced to south east Asia) with poor results.

Company IT side is fairly mature, heavily virtualized, hybrid on prem/cloud, but a bit weak on the Azure side. Existing sysadmins are pretty solid.

The dev is, well a shitshow. We are presented with projects with no infrastructure requirements, the devs dont really seem to know what they need. Currently they are doing everything in Blazor after we begged them to move to cloud. Last few attempts to develop mobile apps has been an abysmal failure. Im dumbfounded by what I see (and I've never coded). Coding is all shoved into a single .dll, no comments, devs dont seem to know that we need to use HTTPS, dont understand key vaults (we caught them passing passwords in clear text). we had to fight with them to implement change control, and they dont seem to understand our efforts to move ahead with pipelining.

My question for you is, do I need a devops admin? Can a more senior devops admin also be involved in reviewing code? infrastructure planning?

not sure how to move forward

I'm curious if other DevOps/platform/SRE teams are running into the same thing my team is.

We're a fairly large environment, mostly EKS, and essentially 100% IaC/Terraform. We also support multiple companies/business units, so while I'd argue our infrastructure is fairly well organized, there's inherently a lot of it and a lot of architecture and context to understand.

Over the last year, our devs have sped up dramatically with AI. The company has leaned heavily into AI-assisted development, reduced developer headcount, and is now pushing toward developers being more "full stack with AI," including having them contribute more of their own infrastructure changes.

In theory, I'm completely in favor of that. I've always wanted developers to be able to own more of the infrastructure surrounding their applications.

In practice, though, it has been kind of a disaster.

We're getting flooded with infrastructure PRs largely written by Claude/other AI tools from developers who don't really understand the infrastructure they're modifying. The Terraform might look plausible, but once you understand the larger system there are frequently significant problems with it.

So instead of reducing the workload on DevOps, it feels like AI has massively increased it.

A huge percentage of our time is now spent reviewing AI-generated Terraform, finding problems, explaining why something won't work, explaining how AWS/EKS/networking/IAM/CI/CD/etc. fit together in our environment, and then going through another iteration of an AI-generated PR.

There's an interesting asymmetry I've noticed too. Our DevOps team is mostly made up of former software developers who moved toward infrastructure, automation, and pipelines. Most of us can jump into application code and be productive pretty quickly, especially with AI helping us. Like,...I feel like (and have some evidence to support) that our small DevOps team could largely take over all of the dev's tasks, but they are falling on their faces trying to deal with ours.

AI seems extremely good at helping someone who understands software write more software. It seems much less capable of allowing someone without infrastructure experience to suddenly understand a large production environment.

The complaint we're increasingly hearing is basically: "We can't successfully do full-stack development with AI because the infrastructure is too complicated."

And maybe they're right, but before AI, I would have said that this company is the most organized and best architected I've ever been at. I mean....100% IaC has never been something I've experienced, and it's very rare that we hit a use case brought up by one of the several companies where we don't already have a set of generalized modules that can't support it.

Our environment is complex, but a lot of that complexity isn't accidental. We have a large organization, multiple companies we deploy for, Kubernetes, networking, security requirements, IAM, CI/CD, observability, etc. You can't abstract away the fact that these things exist. And we're already 100% Terraform/IaC, which I would have thought would make this considerably easier for AI to reason about than an environment full of manually configured infrastructure.

The strangest part is the staffing effect.

AI allowed the organization to reduce software engineering headcount because individual developers became more productive. But now those remaining developers can generate changes so quickly that our DevOps team is completely overwhelmed trying to support and review them.

It genuinely feels like we could double the size of the DevOps team right now and still have plenty of work. We are working on an AI assistant that can help the devs deploy to our environment more effectively, but we're having a hard time finding time to work on it because we're constantly helping the devs.

I'm starting to wonder whether this is going to be a broader consequence of AI-assisted development: AI increases the rate at which software can be produced much faster than it increases the rate at which infrastructure/platform teams can safely absorb changes.

For those of you working in DevOps/platform/SRE at companies heavily adopting AI:

Are you seeing this too?

And if you are, how are you handling it?

Have you increased platform/DevOps staffing? Built better abstractions or internal developer platforms? Given developers more direct infrastructure ownership? Put stricter boundaries around what application teams can modify? Found ways of giving AI enough context about your infrastructure that it actually produces good changes?

Or has AI actually reduced your infrastructure workload, and we're doing something wrong?

I genuinely think DevOps or platform engineering is the area of software I enjoy the most.

I like CI/CD, Terraform, cloud infrastructure, debugging weird deployment problems, trying to understand why systems fail, automating repetitive things, and generally having ownership instead of just implementing another CRUD endpoint.

I’m currently a working student in an SRE/platform team in a big company in Germany. I’ve already worked on things like services from Cloud Build, GitHub Actions, Terraform, Cloud Run, deployment alerts, state migrations and fixing random infrastructure problems that come up along the way.

And the funny thing is that the more I learn, the more I like it.

But looking for a junior position is becoming pretty frustrating:

A lot of “Junior DevOps” jobs seem to expect Kubernetes production experience, several cloud providers, Terraform, Ansible, networking, Linux, CI/CD, monitoring, security and somehow 2–3 years of professional experience with all of them.

Then there are actual entry level positions, but many of them seem to basically be IT support with “cloud” or “DevOps” in the title.

I know I still have a huge amount to learn. I don’t expect someone to give me a production Kubernetes cluster on day one and say good luck. I actually want to be around experienced engineers, get challenged, make mistakes and slowly become someone who can be trusted with serious systems.

My goal isn’t to job hop every six months either. I would genuinely like to find a team where I can stay for several years and become really good at this.

But sometimes I wonder how exactly companies expect junior DevOps engineers to become experienced DevOps engineers if almost everyone wants the experience before giving you the opportunity to get it.

For people who are already working in DevOps/SRE/platform engineering: how did you actually get your first proper role?

Did you already know most of the stack, or did somebody simply take a chance on you and let you learn?

Edit: I worded the sysadmin part badly. I don’t think sysadmin work is beneath me at all. I just want to move toward automation, infrastructure and software rather than mostly ticket-based support.

Edit 2: I respect that some of you suggest starting in help desk or sysadmin. But my long term goal is to move into an SRE role, ideally something closer to how Google approaches SRE. I read the SRE book and really liked the idea of treating operations as a software engineering problem, with automation, reliability, monitoring and reducing repetitive manual work. That is the direction I want to build toward.

were on 50+ microservices on gcp, still doing our own deploy tooling. keep hearing gitops is the way and honestly cant tell if thats real or just the current hype cycle.

not looking for a sales pitch, more curious what broke for you after the demo phase. drift detection, secrets, rollback under load, whatever. did it actually reduce incidents or just move the pain somewhere else

what would you tell yourself before adopting it