Ep 11 - Federal Control Planes: Cloud Defense, Quantum Readiness, and Agent Guardrails

In the News

DevOps Related News

• GitLab: GitLab 19.3 added natural-language Flow creation, bulk SAST false-positive detection and remediation, merge-train enforcement, and LDAP-managed Auditor roles for self-managed Enterprise Edition. Its Secrets Manager build-time integration is limited to a GitLab.com paid add-on, so disconnected deployments do not get that specific capability.
• GitHub: GitHub added path exceptions to repository push rules, improved CodeQL coverage for Actions workflows and modern JavaScript, and introduced credential revocation by token type. Together, the changes make repository policy more precise and give enterprise responders a narrower way to contain compromised credentials.
• Docker Desktop: Docker Desktop 4.88 updated containerd, runc, Docker Agent, and Model Runner, then fixed several startup, networking, and damaged-configuration failure modes. Version 4.88.1 followed on August 25 with a sign-in redirect fix.
• OpenTofu: OpenTofu 1.12.6 stopped OCI registry credentials from following HTTP redirects to a different origin and fixed crafted backend or registry responses that could drive high CPU or memory use during tofu init. A community migration checklist offers broader licensing and portability context, but the release notes remain the authority for current behavior.
• Keycloak: Keycloak 26.7.2 fixed fine-grained admin permission bypasses, disclosure of rotated client secrets, reset-flow and account-linking takeover paths, and a cleartext vault-password issue. The open-source server remains deployable on-premises for identity infrastructure that cannot depend on public SaaS.
• Harness: Harness launched AI agents for machine-speed vulnerability response, including SAST triage, fix generation and validation, pull-request creation, zero-day monitoring, and virtual patching; DevOps.com’s coverage adds workflow context. The announcement describes review-ready automation, but it does not establish FedRAMP or disconnected availability for these new capabilities.

Cyber Security

• Russian authentication-flow abuse: Google Threat Intelligence linked three suspected Russian espionage clusters to selective campaigns against government, defense, academic, and policy targets. The operators abused app passwords, OAuth and device-code flows, hospitality captive portals, and cloud infrastructure, sometimes adding infostealers or recording a target’s audio and video.
• Agentic source-code review: Mandiant detailed its Agentic Vulnerability Discovery Harness, a human-verified multi-agent review pipeline used after corporate repositories were stolen. In that incident it found more than 100 critical true positives in two days, showing how structured agent review can help defenders search exposed code before an adversary operationalizes it.
• NIST building-control guidance: NIST released a quick-start set of tips and tactics for building automation and control system security. The guidance connects building OT to the Cybersecurity Framework, RMF, SP 800-82, and sector resources as facilities systems become more exposed through corporate-network and cloud integration.
• NIST human-centered cybersecurity: NIST published a concept paper for human-centered cybersecurity guidance, treating people as defenders and system users rather than merely the weakest link. Feedback is due September 30, with the planned guidance intended to complement existing NIST publications with usable workflows, interfaces, and organizational practices.
• CISA logging architecture: CISA’s new Logging Reference Architecture shifts federal logging from raw retention toward continuous monitoring, threat hunting, incident response, and forensics. Agency implementation plans are due to OMB and CISA by November 18.

Compliance and Government

• Army cloud governance: The Army moved its Enterprise Cloud Management Activity under Army Cyber Command to combine cloud operations, zero-trust defense, continuous monitoring, landing zones, and cost visibility. The cArmy ecosystem spans AWS, Microsoft, and Google, making this an organizational control-plane change rather than a single-cloud move.
• Federal post-quantum execution: GSA and Treasury started concrete post-quantum initiatives, with GSA updating FICAM and testing quantum-resistant physical-access technology while Treasury formed a Quantum-Readiness Task Force. The work begins turning federal migration deadlines into identity, access, and cryptographic inventory tasks.
• Federal software supply-chain metrics: The White House federal CIO office is reviewing government-wide cyber supply-chain reporting and expects new maturity metrics in the near term. The review emphasizes shared adversary risk, deeper supplier visibility, and pre-award checks against NIST supply-chain practices.
• CMMC and CUI scope: Industry feedback to the Pentagon’s CMMC Reform Task Force says inconsistent CUI marking is inflating assessment boundaries, cost, and confusion. The reporting lands while third-party assessment requirements are paused, keeping accurate CUI identification at the center of the program review.
• Intelligence-community agent governance: DIA, NGA, and the FBI are building infrastructure and guardrails for cooperating AI agents. ChatDIA is being reworked as a front end for MCP and agents on JWICS, while agencies are defining task-level access, anomaly monitoring, performance measurement, and when a human must remain in control.

---

📰 Industry News

• DARPA ERIS: DARPA’s ERIS marketplace now gives companies a rolling video-based path to present early-stage technologies for technical review. DARPA says 76% of awardable organizations are new to the agency and 48% are new to the War Department, with other .mil organizations able to make awards from the same marketplace.
• SOCOM SOF RACER: Special Operations Command’s SOF RACER consortium replaces long proposals with short solution briefs and a standing competition model aimed at nontraditional vendors. GovSignals supplies the AI-first platform, BMNT supports the consortium, and participating companies pay no membership or award fee.
• NRO supply-chain illumination: The National Reconnaissance Office is pressing primes to identify risk several supplier tiers down and is using business-intelligence contracts to examine subcontractor plans before awards. Its focus includes foreign vendors and single points of failure that may be invisible to the government customer.
• GSA OneGov: GSA reported that OneGov savings reached roughly $1.62 billion, including about $1.4 billion through time-limited AI discounts. Some vendors are extending offers or preparing new ones as agencies and NASA also examine where AI can safely support contracting work.
• Carahsoft DevSecOps conference: Government Technology Insider’s conference recap summarizes discussions among federal CIOs, CISOs, military leaders, GSA, contractors, and platform vendors. The industry-hosted event emphasized continuous ATO, software-factory security, identity, and supply-chain controls, so it is useful market context rather than an independent government directive.

---

🌐 Community News

• Red Hat Kubernetes MCP server: Cloud Native Now reports that Red Hat is building an open-source, Go-based MCP server that talks directly to Kubernetes and OpenShift APIs. It can run locally or in-cluster and supports Kubernetes RBAC, read-only credentials, and a non-destructive mode, which makes it plausible for controlled on-premises evaluation even though full cluster control is the default.
• Kasm Technologies and Everfox: Intelligence Community News reports a strategic partnership that combines Kasm Workspaces’ containerized, ephemeral desktops with Everfox Trusted Thin Client for policy-controlled access across classification levels from one device. The on-premises approach integrates with existing hypervisors, cloud environments, and identity providers, then wipes sessions at termination so classified data does not persist locally.

---

⚙️ Fun Tools and Reads

• Radar: This Apache 2.0 Kubernetes interface combines topology, events, Helm, GitOps state, image internals, audit checks, and an MCP surface in one self-hostable binary. Explore Radar
• Platform Engineering 2.0: This read explains how internal developer platforms can evolve for autonomous agents through composable APIs, non-human identities, scoped permissions, audit trails, budget controls, and bounded autonomy. Read “Evolution, Not Reset”
• AI-agent reliability: This read argues that green infrastructure dashboards are insufficient when an agent can return the wrong answer or take the wrong action without throwing an error. It separates system, behavioral, and business reliability and points to OpenTelemetry’s emerging GenAI conventions as a shared foundation. Read “Your AI Agent Is Up. That Doesn’t Mean It Is Working”
• Kubernetes 1.37: The Garhwal release delivers 67 enhancements, including stable pod certificates, ClusterTrustBundles, KYAML output, resilient watch-cache initialization, and the metrics.k8s.io API. Read the Kubernetes 1.37 release overview
• Nvidia and Hugging Face: Reuters relayed an unconfirmed report that Nvidia was in talks to acquire Hugging Face at a valuation above $13 billion, a potential shift in who controls a major hub for open AI models and datasets. Read the Reuters report