Episode 9: Secrets Management

"We accumulated too many rituals. When you want to ship something you need to build a fireplace, chant around it, dance, and maybe bring a shaman in."That's Pavlo from Platform Engineering Labs on episode 10 of DevOps Unpacked, and it landed harder than I expected.His point wasn't that the rituals are new. It's that they were always unnecessary — we just couldn't see it, because everything upstream was slow enough to hide them.Now code generation is nearly free, and every queue we built around it is suddenly visible: review, environments, approvals, compliance. The work didn't get faster. The waiting got obvious.We got into where that queue actually forms, why drift might be the wrong thing to be measuring, and what it takes to get out of your own way.Link in the comments.#DevOps #PlatformEngineering #AINotes on the format choicesHook sits in the first ~140 characters, before LinkedIn's "see more" cut on mobile. Both versions front-load the whole argument.Link in the first comment, as you asked. Worth knowing the picture is murkier than the folklore: LinkedIn has publicly said it doesn't penalise external links any more, but most creators still see better reach with link-in-comments. Treat it as a reasonable default, not a settled fact.Single line breaks between every idea. Dense paragraphs get scrolled past.Arrows rather than bullet characters — LinkedIn's editor mangles markdown lists.Three or four hashtags. More than five reads as spam and doesn't help reach.Upload E as the post image, since the 441% will be doing the stopping work in the feed too.One thing to sort before posting: I still don't have surnames for Pavlo or Zak, so tag them yourself. And the 441% figure should be attributed in your first comment — a number that big without a visible source invites the "citation?" reply, and on LinkedIn that reply is the top comment.need a spotify descriptionSpotify allows 4,000 characters and only the first two lines show in the preview, so the hook goes at the very top.AI didn't remove the bottleneck. It moved it downstream.Developers have never written code faster. Delivery has never been less stable. Both are true at once — and most of the industry is treating it as a temporary problem.In this episode I'm joined by Pavlo [surname] and Zak [surname], founders of Platform Engineering Labs, to work out where the queue actually went after AI arrived.We get into why throughput recovered but stability didn't, why AI tooling struggles with the bespoke operational frameworks every organisation quietly runs on, and why reviewing generated code line by line has stopped being a useful unit of trust. Pavlo makes the case that most engineers own far more code than they should. Zak makes the case that the technology to automate the entire path from idea to production already exists, and that the hold-up is organisational rather than technical.If you have ever had something working perfectly on localhost and then waited months for approval to deploy it, this one will land.Chapters00:00 The queue didn't disappear, it moved downstream00:27 Meet Pavlo and Zak, Platform Engineering Labs01:27 What is the real bottleneck in shipping software?03:46 The DORA numbers: adoption up, stability down06:36 Why AI tooling breaks on bespoke operational frameworks09:37 The dark factory: spec-driven development in practice11:22 "Most of the code I've written, I never wanted to own"13:32 Review as the constraint16:02 Reviewing intent instead of diffs19:34 The infrastructure ceiling: environments, approvals, compliance23:25 DevOps, SRE, platform engineering — and which one survives26:36 Does AI make infrastructure as code more important, or unread?29:12 SOC 2, ISO 27001, and why git became the review tool by accident30:49 Read-only by default, and why drift stops being a useful concept38:00 Why Pkl, and whether language choice still matters40:25 Predictions: where this lands in the next six months

Secrets management is one of the fastest ways to reduce breach risk in modern DevOps — and it’s still one of the easiest things to get wrong.In this episode, we break down what a “secret” actually is (API keys, tokens, certificates, encryption keys), why secrets leak (Git repos, CI/CD logs, long-lived access keys), and how to build a practical workflow that scales across teams.

Monitoring tells you something is broken. Observability helps you explain why it’s broken — fast enough to reduce incident impact and avoid wasting money on noisy telemetry.In this episode, Matt and Helen break down monitoring vs observability in practical terms, then go deep on the three pillars (logs, metrics, traces) and how they work together during real incidents. We also cover the part most teams ignore until finance gets involved: log ingestion cost, what to keep, what to drop, and how to keep signal high without the bill exploding.

Infrastructure as Code (IaC) sounds simple until you hit the real-world issues: state, drift, collaboration, and governance. In this episode, Matt and Helen break down Terraform from first principles — what it’s doing under the hood, where teams get burned, and how to run it safely at scale.You’ll learn:IaC (Infrastructure as Code): why defining infrastructure as version-controlled code improves repeatability, auditability, and change controlProvisioning vs configuration management: where Terraform fits and when Ansible is the better toolDeclarative workflows: what “desired state” means, and what actually happens during plan/applyModules + variables: how to standardise patterns without creating a brittle monolithTerraform state: why it exists, why it’s sensitive, and why mishandling it causes outagesDrift: how infrastructure diverges from code, how to detect it, and how to reduce itRemote state (S3) + Terraform Cloud/HCP: collaboration, locking, and governanceIaC scanning/guardrails: practical security/compliance checks before changes landCDK for Terraform (CDKTF) vs HCL: choosing abstraction without losing controlRUM pricing: what “resources under management” means in practiceIf you’re adopting Terraform (or cleaning up an existing estate), this is a direct, practical guide to avoiding the common failure modes.

In this episode we unpack what containers actually are (and why “done properly” they’re small, portable, and predictable), why container images reduce the classic “works on my machine” failure mode, and a question that matters once you’re operating at scale: is Kubernetes really the orchestrator — or is it being orchestrated by everything around it?We cover:Containers vs VMs (what you’re really shipping)Images, immutability, and repeatable deploymentsHow “same artefact everywhere” changes DevOps workflowsThe Kubernetes orchestration debate (and what it implies for platform teams)

In this episode of DevOps Unpacked, Matt sits down with Christina (VP of Strategic Initiatives at Cortex, former founding engineer) to unpack what an Internal Developer Platform (IDP) actually is — and why CIOs/CTOs are using IDPs, service catalogues, and guardrails to improve delivery speed without increasing reliability and compliance risk.You’ll learn how high-performing teams turn platform engineering into an executive lever:Service catalogues as an ownership and accountability system (not “another tool”)Golden paths (“paved roads”) to standardise delivery and reduce cognitive loadGuardrails that enable autonomy while controlling operational and security riskThe metrics that matter: DORA, MTTR, and SLOs (and how to use them for decision-making)What changes when AI starts writing code: hallucinations, policy, and practical AI coding guardrailsCI/CD + observability as the backbone for safe, repeatable delivery and faster recoveryIf you’re leading a platform/modernisation programme this year, this episode helps you separate signal from hype — and gives you the questions to ask your teams and vendors.

If you’re putting LLMs anywhere near production ops, you need guardrails. In this episode of DevOps Unpacked we break down how AI fails in real systems (hallucinations, prompt injection, and data leakage) and what to do about it.We cover practical defences: treating prompts and retrieved text as untrusted input, using RAG safely (scoping and access control), least-privilege tool access for agents, keeping secrets out of prompts, and adding auditability + evals so your controls don’t rot over time.

AI can write code. That doesn’t mean it can run production.In Episode 3, we break down what AI actually changes in DevOps and software engineering — and what stays stubbornly human: requirements, judgement, risk, guardrails, and the messy reality of pipelines and production systems.We cover:Why “AI will replace engineers” is the wrong questionWhere AI genuinely saves time in day-to-day DevOps workWhy requirements and review matter more (not less) with AICI/CD, evidence, and the controls AI can’t shortcutThe junior vs senior impact: how teams and careers shiftChapters:00:00 AI won’t kill software engineering03:30 AI as a force multiplier07:00 Tools vs real understanding10:30 Requirements still matter14:00 Pipelines and real-world constraints18:00 Frameworks and guardrails22:30 Safe AI in production27:30 Where AI actually saves time32:30 AI in daily workflows37:00 Skills that matter more with AI41:30 Junior vs senior impact46:00 Long-term team impact50:30 Engineers aren’t going anywhereIf you work in DevOps, Platform Engineering, SRE, or you’re building software that has to pass audits and survive incidents — this one’s for you.

In this episode of DevOps Unpacked, we tackle the crucial differences between CI CD, continuous integration, and continuous delivery. 🤔 Join us as we explore how tools like Jenkins and GitHub Actions enhance the CI CD pipeline, ensuring smooth deployments. Don't miss out on this essential guide to mastering devops concepts! 🚀

The conversation delves into the essence of DevOps as a culture and the role of a DevOps engineer within that culture. It explores the origins, evolution, and practical implications of DevOps, addressing misconceptions and variations in DevOps engineer roles. The discussion also covers CI/CD, GitHub Actions, Jenkins, testing, and the expanding scope of DevOps to include various disciplines. Additionally, it provides insights into the path to becoming a DevOps engineer and the skills and traits required for success in this role.TakeawaysDevOps is a cultureDevOps engineer is a role within the DevOps cultureChapters00:00 Introduction to DevOps and Misconceptions06:34 The Problems DevOps Seeks to Solve12:38 DevOps as a Culture and Its Practical Implications21:19 Understanding GitHub Actions and Jenkins in DevOps31:19 Evolution of Testing in DevOps36:36 Expanding Scope of DevOps: Incorporating Various Disciplines44:04 Skills and Traits of a Good DevOps Engineer