Security

Second post in the Azure Platform Engineering series. In Part 1, we built the provisioning layer of the Internal Developer Platform: Dev Center, Azure Deployment Environments, Bicep templates, and shared AKS runtime patterns. That is necessary, but it is not sufficient. An Internal Developer Platform becomes trustworthy when it enforces standards without turning into a bureaucratic cage. That is where governance, observability, and security enter the picture. The platform must make the right path easy, the risky path difficult, and the unsupported path visible. ...

Eighth post in the series. In the previous one, we learned that a green dashboard doesn’t guarantee a healthy model. Now: the threats your WAF won’t catch. tl;dr Most AI security failures happen at identity, data access, and prompt boundaries, not at the firewall. Use managed identity, RBAC, Key Vault, private connectivity, and content filtering together. The chatbot that knew too much Your organization deploys an internal chatbot with Azure OpenAI, connected to a knowledge base of policies, documentation, and FAQs. The rollout goes smoothly, adoption takes off, and leadership is already planning a customer-facing version. ...

Just sharing an awesome learning resource I found recently. It will introduce you to the application development cycle leveraging OpenShift’s tooling & features with a special focus on securing your environment using Advanced Cluster Security for Kubernetes (ACS). You will get a brief introduction in several OpenShift features like OpenShift Pipelines, OpenShift GitOps, and OpenShift DevSpaces. Check out at https://devsecops-workshop.github.io/

UBI stands for Universal Base Image. It’s a type of container-based image that Red Hat has created and maintains. UBI images are derived from Red Hat Enterprise Linux (RHEL) and are designed to be a foundation for building containerized applications. Here’s why UBI is significant and why you might consider to use it: Compatibility with RHEL: UBI is based on RHEL, which means it inherits the reliability, security, and performance of RHEL. This compatibility is crucial for organizations that already rely on RHEL for their enterprise applications. Open and Freely Distributable: Unlike RHEL, which requires a subscription, UBI can be used freely. This means you can build your container images on UBI and redistribute them without worrying about RHEL licensing, while still benefiting from the stability and security of a RHEL base. Security and Compliance: UBI images benefit from Red Hat’s commitment to security and compliance. They receive regular updates and patches, which is essential for maintaining security in containerized environments. Broad Ecosystem and Support: Since UBI is based on RHEL, it has broad support from software vendors and the open-source community. This extensive ecosystem ensures compatibility with a wide range of applications and tools. Ease of Certification: For software vendors, using UBI can simplify the process of certifying their applications for RHEL, as UBI containers can be run on both RHEL and non-RHEL hosts. Container Portability: Containers built on UBI can run anywhere that supports container workloads, including Red Hat OpenShift, Kubernetes, and even non-Red Hat platforms. This portability is crucial for organizations adopting a hybrid or multi-cloud strategy. Consistency Across Environments: UBI helps maintain consistency across development, testing, and production environments, reducing the “it works on my machine” problem. Support for Different Architectures: UBI images are available for multiple architectures, including x86_64, s390x, and others, which is important for organizations with diverse infrastructure needs. In summary, UBI combines the reliability and security of RHEL with the flexibility and freedom of a container-based image that can be freely shared and redistributed. It’s an excellent choice for organizations looking to build containerized applications that are secure, compliant, and compatible with a wide range of environments and platforms. See more here