DevOps'ish 324: Kubernetes v1.37 lands, most leaked AWS keys still work, and more

Every AI tool tells you what you spent. This one tells you what it built. (SPONSOR)

89% of enterprises have adopted AI tools. Only 23% can measure the return. Tempo’s Workforce Intelligence is an Atlassian Marketplace app that closes that gap: it pulls session cost from Claude Code, Codex, and Copilot and attaches it to the Jira issue the code landed on, then rolls it up to the epic and the initiative. Nothing to install on anyone’s laptop, no new platform to log into, no change to how your engineers work — just a real answer the next time someone asks what the AI budget actually delivered.

Kubernetes v1.37: Garhwal (12 minute read)

Named for a Himalayan region in India, and the theme is layered contributions, which is a polite way of saying almost nothing in here was built by one person in one cycle. Sixty-seven enhancements: 16 to Stable, 23 to Beta, 27 landing in Alpha. The bits worth reading twice are resilient watchcache initialization, pod certificates and cluster trust bundles finally giving you a sane story for workload identity, and the Metrics API going stable after living in the “it’s fine, everyone uses it” gray zone for years. Read the whole thing before you plan your upgrade, not after.

Kubernetes v1.37: Declarative Validation Drives Record-Breaking API Reviews (5 minute read)

A contributor-side story that deserves more attention than it will get. The API review group handled 118 PRs this cycle, a record, and did not fall over. Declarative validation went GA in v1.36 and expanded in v1.37, so instead of reviewing bespoke validation code by hand, reviewers read tags on type definitions. Add linting guardrails and a pre-review process on top, and you get the thing every project claims to want: a bottleneck that scales because the work itself got smaller, not because you threw more humans at it.

768 Leaked Corporate AWS Keys Held Full Admin Rights (9 minute read)

Truffle Security re-verified 10,616 AWS keys that leaked publicly between August 2022 and August 2026. Eighty-eight percent still authenticate. Seven hundred sixty-eight of the live ones hand over full control of a company AWS account. The median compromised key had gone roughly five years without rotation, and 90% of the exposed accounts had no budget alert configured, meaning nobody would notice until the bill arrived. Rotation is the boring control everyone agrees with and nobody schedules. Go look at your oldest access key today.

Linus Torvalds Endures A Debug Session From Hell, “Enormously Helped” By AI (4 minute read)

Torvalds does not usually author Intel Xe graphics driver patches himself, which is what makes this one interesting. Twenty-four debug patches and 18 kernel boots to isolate a one line fix, and he credits AI with enormously helping, while also noting it several times stated flat out that the thing was impossible and then kept adding debug code anyway. That is a fair description of the current state of the tooling: not right, but tireless, and tireless turns out to be worth something at boot number 14.

Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it (18 minute read)

Five months, four models, and a running tab, all to stop a Fire HD from killing its own kiosk mode. Claude hit its safeguards, so the author moved through Kimi K3, GLM-5.2, and GLM-5.3 until one of them found an unpatched GPU path (CVE-2022-38181), got root, and removed the Amazon packages responsible. The best line in the piece is the author correcting their own scope: the goal was never root, it was to stop Amazon from killing the kiosk. Read it for the debugging narrative and for a very honest picture of where model safeguards land when the work is legitimate and looks exactly like the work that is not.

Anthropic’s best AI model struggles to attract users as cheaper tools thrive (2 minute read)

Simon Willison on an FT piece about where the money actually goes. Anthropic’s annualized revenue hit $65 billion in July, up from $47 billion in May, with OpenAI past $40 billion. The useful pointer is the Ramp AI Index, which tracks model spend across roughly 70,000 companies and shows Opus 4.8 taking 28% of Anthropic spend in July 2026. Frontier model releases get the headlines; the previous generation gets the invoices.

How to evaluate LLMs before production (9 minute read)

GitHub’s team on what they learned putting LLMs behind secret scanning, which is a nicely unforgiving problem because both false positives and false negatives cost somebody a bad day. The advice is refreshingly operational: decide the product question before you pick a metric, treat evaluation as an integration test you run continuously rather than a gate you pass once, keep offline conditions close to production or your numbers are fiction, and use targeted error analysis to find repeat failure patterns instead of staring at an aggregate score. Nothing here is exotic. Most teams still skip it.

You should never be angry at work (8 minute read)

Sean Goedecke’s argument is that anger at work usually comes from caring, and caring does not save you from the consequences. “An angry colleague immediately becomes a new problem to be managed, not a professional helping you manage problems.” Once you are the problem, you stop being in the room where the decisions happen, which is precisely the room you were angry about not influencing. You do not have to agree with the absolutism to recognize the mechanism, and if you have watched a good engineer talk themselves out of relevance, you have seen it work exactly this way.

You need to find product-market fit again (sorry) (6 minute read)

Cleo Lant at PostHog on disrupting yourself before somebody does it for you, using PostHog Desktop as the case study. Nine practices, and the ones with teeth are isolating a small team from the mothership, treating the effort as a seed bet rather than a business unit with a roadmap and a headcount plan, and weighting what users actually do over what your own org says in review. Applies to platform teams too. The internal product with guaranteed users is the one most likely to quietly stop fitting.

Apple unveils M6, M5 Ultra chips and updates its desktop Macs (5 minute read)

Six Colors on the M6 and M5 Ultra, plus refreshed Mac mini and Mac Studio, pre-orders open and shipping September 22. New core layouts and more on-device AI capability, and prices up noticeably across the line. If you buy build machines by the rack, price the memory configurations carefully before you commit, because that is where the increase lands hardest.

databasus/databasus - Apache-2.0 - PostgreSQL backup tool with point in time recovery and restore verification. Self-hosted, backs up to S3, Google Drive, FTP, and others, notifies through Slack, Discord, and Telegram, and targets low RPO and RTO. Restore verification is the part most backup tooling leaves as an exercise for the reader. Written in Go, with MySQL, MariaDB, and MongoDB support alongside Postgres.

PicoMQ/picomq - Apache-2.0 - Durable, real time streams over HTTP built on S3-compatible object storage. Written in Rust, split into an s3stream engine and a host that carries the metadata plane, server, and protocol frontends, including a Kafka frontend and a pico CLI. Runs single node against SQLite and local object storage for a quick look, and auth is off by default so remote binds require you to say so explicitly.

Want to reach 6,800+ developers, SREs, & DevOps leaders every week?

DevOps'ish delivers a 46% open rate and 10% click rate — well above industry averages — to a global audience of practitioners, VCs, and C-suite decision-makers. Your brand gets exclusive placement (one sponsor per issue, zero competition) in a text-based newsletter that bypasses ad blockers entirely. Get in front of the people who build and run the internet!