DevOps on Cliff Hults

Designing an Automated Artifact Factory: A Case Study in Turning Pipeline Pain Into a Platform Boundary

Sun, 20 Sep 2026 00:00:00 +0000

Every team wiring the same three security checks into its own pipeline isn’t really a security problem. It’s a platform problem wearing a security costume.

This is the story of how we traced that pattern back to a structural issue, and the design we landed on to fix it: an automated artifact factory that turns signing, vulnerability scanning, and antivirus scanning from something every team bolts onto their own pipeline into something the platform just does for them.

When Your Security Tool Goes Down: Surviving an SCA Tool Outage

Sun, 12 Apr 2026 00:00:00 +0000

Security tooling exists to protect your organization. But what happens when the security tool itself becomes the outage?

That’s the situation we found ourselves in when an SCA tool experienced a service disruption that lasted approximately five hours. For us, it wasn’t a degraded experience; it was a complete development freeze.

Prompt Engineering Isn't Magic — Here's How I Did It in Production

Sat, 11 Apr 2026 00:00:00 +0000

Most prompt engineering content is written by people who have never shipped AI into a real system. This post is different.

I’m a Staff DevOps Engineer. I’ve spent time integrating AWS Bedrock into actual production workflows inside a FedRAMP High environment, not demos, not notebooks, not prototypes. Real systems with real constraints and real failure modes.

Here’s what I learned.

Supply Chain Attacks Start in Your Build Cache

Sat, 11 Apr 2026 00:00:00 +0000

On March 25, 2025, a malicious version of the axios npm package (version 1.14.1) was published to the npm registry. It contained a bundled dependency called plain-crypto-js@4.2.0, which was later confirmed to be malicious. The package was identified and removed from the npm registry within roughly three hours.

For most organizations, three hours sounds manageable. For us, it wasn’t that simple.

Building Images for GCP

Sun, 20 Oct 2019 04:00:00 +0000

In my last post, I opened with the fact that my company has decided to dive into the world of GCP to get ahead of most of the market in our space. With a few of us being tasked for this initive, I decided to take it upon myself to look into Packer. The goal would be to roll our homebrewed software/OS image into an automated build process to make images in GCP (or AWS, vSphere, etc.).

Vault Journey

Wed, 11 Sep 2019 04:00:00 +0000

Being a good SysAdmin requires some sense of laziness. In the spirit of that approach, I’ve spent some time looking into Hashicorp’s Terraform and Red Hat’s Ansible tools in my organization’s route to Google Cloud Platform. I wanted a method to create reproducible Compute Engine VMs that would allow us to easily create multiple hosts with minor changes quickly and easily.

I decided that with the use of Terraform, Vault (also from Hashicorp) would allow me to templatize the configs, as well as, create secrets/passwords that would be randomized, able to be called at will, and even automatically rolled with a configured frequency.