DevOpsLinks

🚨 Quick note before we dive in — we realized we never shared with you a piece we wrote a couple of weeks back. It’s a deep dive into the hottest open source tools of 2025 — the projects that you are actually voting for with your clicks and engagement!

If you missed it, here’s your chance to catch up. It’s already been read by thousands, and it pulls directly from what you loved so far!

👉 Halfway Through 2025: These Are the Open Source Tools Everyone’s Talking About

If you find it useful, feel free to drop it on Reddit (click here), Hacker News (or here) and other channels — it helps more devs discover tools worth their time!

This week swings from brittle clouds to sturdier rails: an AWS account vanishes overnight, while GitHub + Lambda tighten the deploy loop, Terraform bakes in secrets, and MCP turns prompts into infra. From SSD‑first indexes to sub‑millisecond inference and a privacy‑respecting authenticator, it’s all about resilience you control—dive for the how and the why.
🧰 A practical guide on how to use the GitHub MCP server⚠️ AWS deleted my 10-year account and all data without warning🚀 AWS Lambda now supports GitHub Actions to simplify function deployment🏗️ Does platform engineering make sense for startups?⚡ Faster Index I/O with NVMe SSDs🤖 How Salesforce Delivers Reliable, Low-Latency AI Inference🔐 How to use Terraform to generate secrets☁️ Introducing AWS Cloud Control API MCP Server: Natural Language Infrastructure Management on AWS🔑 Proton launches free standalone cross-platform Authenticator app🧯 We built an MCP server so Claude can access your incidents

Smarter ops, sturdier stacks—now go build.

Have a great week!
FAUN.dev Team

Incident.io dropped an open source MCP server in Go that plugs Claude into their API using the Model Context Protocol. That means Claude can now ask questions, spin up incidents, and dig into timelines—just by talking.

The server translates Claude’s prompts into REST calls, turning AI babble into real workflows. Tight, secure, and built for structure.

Bigger shift: More teams are wiring LLMs straight into their ops stack, not with magic, but with clean protocol pipes.

AWS Lambda just got a smoother ride to prod. There’s now a native GitHub Actions integration—no more DIY scripts to ship your serverless.

On commit, the new action packages your code, wires up IAM via OIDC, and deploys using either .zip bundles or containers. All from a tidy, declarative GitHub workflow.

Bigger play: GitHub’s creeping further into CI/CD territory for serverless. Less glue code. Fewer moving parts. More “just push it.”

AWS dropped the Cloud Control API MCP Server, a mouthful of a name for a tool that makes 1,200+ AWS resources manageable through a standard CRUDL API—using natural language. Think: describe what you want, and tools like Amazon Q Developer turn it into actual infra code.

It doesn’t stop there. It validates against CloudFormation schemas. Prices it with the AWS Pricing API. Spits out IaC templates, too.

Big picture: Infra-as-texts isn’t a gimmick - it’s AWS leaning full tilt into LLM-native cloud workflows.

Proton just dropped Proton Authenticator, a free 2FA app that actually respects your privacy. It’s cross-platform, offline-friendly, and skips the usual junk—no ads, no trackers, no bait-and-lock-in.

It’s got end-to-end encryption, a biometric lock, and lets you export TOTP seeds like it’s your data (because it is). Bonus: encrypted sync across devices.

Terraform just leveled up secret handling in Azure Key Vault. It now supports automated secret generation with random_password, plus full lifecycle control—rotation, expiration, and storage—baked right into your IaC.

Secrets stay marked as sensitive. They're managed in one place. And thanks to Terraform policies, they expire and renew on your terms.

Bigger shift: Infra teams are ditching ad-hoc secret workflows. Rotation and expiry now live in the same repo as the rest of the plan. Less drift. Fewer leaks.

Cyber Threat Intelligence (CTI) isn't just logging data anymore. It's hunting patterns, decoding attacker playbooks, and calling shots before the breach hits. Fast, surgical defense—wired up with automation.

Today's detection stacks fuse behavioral signals, vuln scans, and live response playbooks to slam the door before exploits get cozy.

Salesforce’s AI Metadata Service (AIMS) just got a serious speed boost. They rolled out a multi-layer cache—L1 on the client, L2 on the server—and cut inference latency from 400ms to under 1ms. That’s over 98% faster.

But it’s not just about speed anymore. L2 keeps responses flowing even when the backend tanks, bumping availability to 65% during failures. Services like Agentforce stay up, even if they’re limping a bit.

System shift: What started as a performance tweak is now core to how Salesforce keeps its AI standing tall under pressure.

Platform engineering isn't just for the big dogs anymore. Startups are picking it up as a strategic edge, building tight, high-leverage tooling from day one.

Think: templated CI/CD pipelines, plug-and-play infra modules, zero-handoff onboarding. Done right, these early bets smooth the path and keep dev velocity high.

Bigger shift: Startups are shipping their internal platforms like real products. Dev experience isn’t an afterthought—it’s part of the value prop.

Running the Model Context Protocol (MCP) server locally works, but managing Docker, rotating access tokens, and pulling updates is a hassle. GitHub’s managed MCP endpoint eliminates these infrastructure headaches, letting users focus on shipping code.

In a 201-level tutorial, users can learn to upgrade from the local MCP setup to GitHub’s managed endpoint. This transition provides OAuth authentication, automatic updates, and access to toolsets that enhance AI workflows.

A search service (Marginalia Search) gutted its old index internals and dropped memory-mapped B-trees. In their place: a deterministic, block-aligned skip list tuned for direct reads on NVMe SSDs.

It runs on 128KB block sizes, uses custom buffer pools, and leans hard on io_uring for async position lookups. The payoff? Noticeably faster reads and cleaner latency across the board.

Why it matters: More systems are ditching mmap and building SSD-first, hardware-aware data structures. Marginalia just joined the modern camp.

A new TCO calculator breaks down what it really costs to run Kubernetes—DIY CNCF stacks, COSS platforms, and Portainer Business Edition. It crunches infra, labor, and software spend, then maps out staffing needs. It shows exactly where Portainer cuts Kubernetes bloat: it may be biased but it's worth trying!

Why it matters: Kubernetes isn’t hard because it’s complex. It’s hard because it’s expensive to run and staff. Tools that simplify ops and shrink headcount? Game-changers.

AWS permanently nuked a 10-year customer account—data, backups, everything—after a payment verification failed. That alone broke their own 90-day retention policy. It gets messier.

Looks like an internal script meant to run as a “dry run” went full send in production. Blame a Java CLI parsing edge case for turning a harmless test into actual deletion.

The kicker? The customer had done everything right: multi-region backups, redundancy, the works. None of it mattered. AWS’s internal misstep and a black-box support process left them with zero recovery options.

System shift: Cloud resilience isn’t just about redundant disks. It’s about factoring in your provider as a failure point too.

Ivory is designed to simplify and visualise work with Postgres clusters. It provides patroni management ui and postgres query builder.

Collection of Docker images with headless VNC environments

The glamourous AI coding agent for your favourite terminal

CR(D) Wizard is a web based dashboard designed to provide a clear and intuitive interface for visualizing and exploring Kubernetes Custom Resource Definitions (CRDs) and their corresponding Custom Resources (CRs). It helps developers and cluster administrators quickly understand the state of their custom controllers and the resources they manage.

Did you know that in Azure AKS, nodes using the Standard Load Balancer for egress are limited to 1,024 SNAT ports per node per frontend IP by default, regardless of the Linux ephemeral port range? Under high outbound traffic—or when a single busy pod aggressively opens connections—this limit can be reached quickly, causing intermittent SYN timeouts that look like upstream failures. Organizations often bypass this constraint by switching to a NAT Gateway, which provides ~64 thousand SNAT ports per public IP and scales with added IPs. If you must stay on the Load Balancer, you can spread traffic across multiple outbound IPs or increase allocatedOutboundPorts, but doing so reduces how many nodes a single frontend can support.

"DevOps accelerates change; SRE rations failure. A 99.9% SLO is a budget, not a promise—spend it on controlled outages or waste it on surprise ones. In the cloud, the money works the same way."

— SenseiOne

This Week’s Human is Andrew M., a Senior Linux System Administrator at Schnuck Markets who keeps large retail Linux fleets steady across on‑prem and AWS. At Panera Bread, he drove a FreeIPA migration, stood up centralized logging with Graylog, monitoring with Prometheus/Grafana, Jenkins with LDAP, and Ansible AWX—alongside VPN/VPC builds, legacy server retirements, and clear docs in Confluence.