OffNet Newsroom

Daily topic roundup

Automation / DevOps / IaC

Friday, October 16, 2026 · 8 stories, curated & summarized — click any story for the source.

Share this roundup on LinkedIn Full edition
InfoQ generaldevops

Chainguard Bets on Hardened MicroVMs for AI Coding Agents

Chainguard is releasing two beta tools designed to secure the lifecycle of code generated by AI agents and developers. Chainguard Workspaces offers remote development environments built on hardened microVMs to isolate execution. Complementing this, Chainguard Checks integrates continuous integration directly into the development loop to validate output immediately.

  • AI coding workflows now have dedicated isolation via hardened microVMs in Workspaces.
  • CI/CD shifts left with Checks, embedding validation directly into the dev loop.
  • Both tools target the growing risk of compromised code from AI generation.
  • Products are currently in beta, announced at the Assemble London event.
Read at source →
InfoQ generaldevops

Spring Security 7 merges Authorization Server, adds DPoP and Token Exchange

Spring Authorization Server is now integrated into Spring Security 7, requiring only a version bump for migration. The update introduces server-side support for DPoP and RFC 8693 Token Exchange to enable sender-constrained tokens. Developers must explicitly call .dPoP() in version 7.1 to enforce binding, otherwise it remains inactive by default.

  • Spring Authorization Server is now part of Spring Security 7 under the same Maven coordinates
  • Enable DPoP explicitly via .dPoP() in Spring Security 7.1 to enforce token binding
  • RFC 8693 Token Exchange is supported for service-to-service and agentic communication
  • Combined DPoP and Token Exchange provide narrowed, sender-constrained access tokens
Read at source →
AWS What's New awsdatabase

AWS GA: Lambda Durable Execution SDK for Go enables resilient workflows

AWS has generally available the Durable Execution SDK for Go, allowing developers to build long-running, resilient workflows directly in Go. The SDK automatically checkpoints progress and pauses execution for up to a year while waiting for external events, eliminating the need for custom tracking logic. This supports complex scenarios like infrastructure automation, deployment rollouts with approval gates, and AI pipelines requiring human review.

  • Native Go SDK for Lambda durable functions removes custom progress tracking overhead
  • Supports long-running workflows with automatic checkpointing and up to one year pause
  • Ideal for infrastructure automation, approval gates, and AI model pipelines
  • Extends Lambda's event-driven model with built-in resilience and state management
HOW IT WORKSLambda Durable Execution Flow1Start long-running workflow2Auto-checkpoint progress3Pause for external events4Resume when ready
Read at source →
AWS What's New awsdatabase

CloudWatch Pipelines Adds Conditional Routing and Chained Parsers

AWS has enhanced CloudWatch Pipelines with conditional log routing and chained parsers to improve telemetry processing. Users can now evaluate processed fields to send events to specific log groups based on criteria like severity or source. This allows for granular control over retention policies and access controls without managing underlying infrastructure.

  • Route logs to different groups based on evaluated fields like severity or source.
  • Apply chained parsers to handle nested log formats within a single pipeline.
  • Separate telemetry to enforce distinct retention and access policies per group.
  • Fully managed service handles ingestion, transformation, and routing automatically.
HOW IT WORKSCloudWatch Pipeline Steps1Ingest raw telemetry logs2Apply chained parsers3Evaluate conditional fields4Route to log groups
Read at source →
Planet PostgreSQL database

pgAdmin moves build farm from Jenkins to GitHub Actions

Dave Page details the migration of pgAdmin’s decade-long Jenkins build infrastructure to GitHub Actions. The legacy Jenkins setup handled packaging for all major platforms and release distribution but suffered from opaque configuration and single-point knowledge dependency. The new workflow aims to improve visibility and maintainability by leveraging GitHub Actions.

  • pgAdmin build pipeline migrates from Jenkins to GitHub Actions
  • Legacy Jenkins config was opaque and known only to Dave Page
  • New system improves visibility and reduces single-point dependency
  • Covers Debian, RHEL, Windows, macOS, Python wheels, and Helm charts
Read at source →
InfoQ generaldevops

Grafana Tempo 3.1 Introduces Query-Based Trace Redaction and Sampling-Aware Metrics

Grafana Labs released Tempo 3.1, the first minor update to the 3.0 architecture, introducing query-based trace redaction and sampling-aware metrics. Operators can now redact traces using TraceQL queries instead of managing static trace ID lists. The release also adds TLS and additional SASL mechanisms to the Kafka client and includes an experimental query-time hint to correct TraceQL metrics for sampled data.

  • Redact traces via TraceQL queries instead of maintaining static trace ID lists.
  • Kafka client now supports TLS and additional SASL mechanisms for better security.
  • Experimental hint corrects TraceQL metrics to account for sampled data accurately.
  • First minor release building on the stable 3.0 architecture foundation.
Read at source →
AWS What's New awsdatabase

AWS Resilience Hub integrates DevOps Agent for failure mode analysis

AWS Resilience Hub now leverages the AWS DevOps Agent to automate the review of failure mode assessments and resilience test results. When a resilience test is executed, the agent observes the process and returns a structured analysis of the outcome. This integration allows platform and SRE teams to efficiently identify findings and implement mitigations directly within the console.

  • Resilience tests now trigger automated DevOps Agent investigations for structured feedback.
  • Teams can review failure mode assessments and apply mitigations in one workflow.
  • Generative AI aids in analyzing dependency failures and testing outcomes.
  • Centralizes resilience posture reporting for organization-wide visibility.
HOW IT WORKSAutomated Resilience Analysis Workflow1Execute resilience test2DevOps Agent observes process3Generate structured analysis4Identify findings and mitigations5Apply fixes in console
Read at source →
AWS What's New awsdatabase

ARC Region switch adds SSM, Lambda payloads, quota checks, and health waits

Amazon Application Recovery Controller's Region switch now supports four new orchestration capabilities to improve multi-Region failover. Users can execute AWS Systems Manager Run Command on managed instances, pass payloads to custom Lambda actions, verify service quota parity, and wait for target group health before scaling compute. These features allow for more granular control and validation during regional impairment events.

  • Run Command execution block enables automated script execution on managed instances during failover.
  • Lambda custom actions now support input payloads for dynamic configuration during recovery.
  • Service quota parity checks ensure target region capacity matches source requirements.
  • Wait for target group health feature prevents premature scaling until instances are ready.
  • Plan evaluation validates command documents and IAM permissions before failover execution.
CHECKLISTWhat matters hereRun Command execution block enables automated script execution on…Lambda custom actions now support input payloads for dynamic…Service quota parity checks ensure target region capacity matches…Wait for target group health feature prevents premature scaling until…Plan evaluation validates command documents and IAM permissions…
Read at source →
↑