# 379: Oracle and Google Cloud Finally Agreed to play with each other Database Toys
Duration: 67 minutes
Speakers: A, B, C, D, E
Date: 2026-11-12

## Transcript

[00:07] A: Welcome to The Cloud Pod, where the forecast is always cloudy. We talk weekly about all things AWS, GCP, and Azure. We are your hosts, Justin, Jonathan, Ryan, and Matt.

[00:18] B: Episode 379, recorded for the week of November 3rd, 2026. Oracle and Google Cloud finally agree to play with each other's database toys. I might have changed that on the fly 'cause I thought it worked better.

[00:32] C: Yeah, sounds fine.

[00:33] B: How are you doing this week, Ryan? I'm doing okay.

[00:36] C: It's, uh, you know, another busy week, which they all seem to be busy these days. So time changes, you know, ruin my life as usual. And, uh, but otherwise, time—

[00:46] B: whoever invented time change did not have kids. That is all I have to say on that topic.

[00:53] C: Wasn't it Benjamin Franklin? Did he have kids?

[00:55] B: I don't know. It might've been, I don't know. He did not deal with kids. How about that? No.

[00:59] C: Yeah, he was definitely older, right? Yeah.

[01:03] B: It's just not fun. Um, but I think you're the only one of us not traveling. We've lost Justin this week to some work event and I'm recording from a hotel in DC, so we're doing great.

[01:16] C: Yeah. Busy, busy, busy.

[01:19] B: Well, Vault gave us some updates with a little bit of extra research too from us. Follow-up on show 372. Are Microsoft patches recently found from internal or external researchers? Which is also interesting that this came out of, what was it? There was over 1,000 updates, 1,000 patches in this last one.

[01:45] C: Yeah, and they broke, it was a record at the time that we talked about it, and now it's even more of a, they broke that record again, I believe, the last month.

[01:53] B: Yeah, I think this month was the most they ever had. I think last month was the most. So they're trending in the right direction. Anyway, what the item was that we followed up on was more specifically whether or not the CVEs are found internally or externally. As everyone knows, there's been a massive recent surge in vulnerabilities. On episode 372, we talked about it and, you know, kind of were just discussing at a high level where we thought they were coming from, probably some mix of AI and whatnot. Microsoft actually released a little bit of information on this, which I'm still a little bit shocked by, which it was, it's kind of, it's both. So we were correct. Microsoft has confirmed that it's a mixture of both internal AI-assisted discovery and external researchers. Obviously they're using AI too. And Microsoft has started sharing details about these things versus before they just be quiet about how they found it. Most recently, Microsoft credits a new multimodal model, AI-driven scanning harness, M-DASH, with finding 16 vulnerabilities in one month, including 4 criticals before any human could find it. Some of these vulnerabilities are now being directly attributed with external researchers and if you dig in deep, sometimes you can kind of see what the external AI tools too, they found them with.

[03:12] C: I think it's pretty funny that they, they announced that they're giving a lot of credit to the M-Harness, 'cause all I hear is that they used, uh, Mythos to find these things. And so they had to have a harness that wasn't all OpenAI, you know, they had to branch out and make it multi, multi-model. So that's pretty funny. I don't know if that's true, but I feel like it's true.

[03:36] B: This seems valid enough. I mean,

[03:38] C: I mean, you have to build a harness around the scanning anyway with these models, right? 'Cause it's a model by itself doesn't really do anything until you sort of give it an ecosystem to run in. And so, hmm. I

[03:49] B: assume they're starting to build more specific tools, you know, that the AI models will use versus just, you know, reading the code or going to, you know, going to you know, attack the Windows operating system, you know, here's more things that can directly execute things. So you use these tools and then, you know, have them see what happens out of there.

[04:09] C: Yeah, no, it's definitely, I mean, I know with access to Mythos, it's its own harness that's, you know, even though you're interacting with it through the like desktop app, it's like its own sort of screen and own little section. And I'm sure on the backend it's very different.

[04:23] B: It's all GPU somewhere.

[04:25] C: Yeah. I haven't played around with the other executions to know if like, you know, if, uh, what is it? The, there's the Carbon one from Gemini and then I forget the, the one they, that OpenAI released, but they've, they've all got their like super vulnerability finding models now.

[04:44] B: Yeah. I think, uh, Astro, is that what OpenAI exposed?

[04:49] C: Yeah. Or it might be like a flavor of Astro.

[04:51] B: Astro. Sorry.

[04:52] C: Yeah.

[04:53] B: Yeah. Okay. Close enough.

[04:55] C: Yeah. All right. Let's move on to some general news. So China's been snooping around some undersea cables in the Pacific that raise big risks for big tech. A new US-China Commission report, which sounds like that's a co— but I don't know if it is, uh, ranks the Trans-Pacific subsea cables by sabotage risk, and Google and Meta-owned routes are near the top of that list. Which matters for anyone that's on the cloud backbone, which is everybody that needs connectivity to the Pacific. Uh, the report produced by the China Strategic Risk Institute for the US-China Economic and Security Review Commission includes an interactive vulnerability index that ranks trans-Pacific cables by gray zone sabotage risk. The risk factors that they, they used include seabed depth, nearby shipping traffic, cable ownership, proximity to China's exclusive economic zone, and broader territorial claims. Most cable damage still comes from accidents like trawling nets and dragged anchors, but analysts are paying closer attention to suspicious incidents, including Chinese commercial ships that were under investigation for cable cuts in the European and Asian waters, and Chinese research vessels spending an unusual time surveying cable routes.

[06:10] B: I mean, didn't this also happen in, uh, with Russia, I think, like between Finland and everyone? Where they were dragging— there was theories that they were— that Russia tankers were dragging their anchors to pull up and rip the undersea cable. So I think it's just, it's an unprotected asset that essentially is out there now. And, you know, if you can tap these lines, you know, there was the— I don't know, what is it like? There's a story in the '60s where the US used to like tap a Russian I guess Soviet Union, uh, Defense Department line. And they would go like monthly and go gather the tapes and decrypt, you know, because it was all unencrypted traffic because nobody thought you could tap these things. So like, it's just another security vector. It's another attack vector to everything nowadays, which is why you should always encrypt everywhere.

[07:02] C: And it's crazy. Like, how do you protect against that? Right. This undersea cable. Is, you know, like there's just too many miles. It's a vast area of coverage that you'd have to patrol. Like, I don't know how they would do it. Like, and it's kind of nuts.

[07:19] B: But yeah, satellite, I mean, you can't rely on the GPSs because ships turn them off. They end up with dark fleets, dark ships, whatever they're called. I've clearly done, dove into some random things at times, you know, and you sound like what you do, build a net around your cable. So like as you're dumping your cable on the sea floor, you build like an extra thing on top of it, which doesn't really work because they only bury them when they're close to shore. All right, on to AI is how ML makes money, or lack of money. OpenAI raises less than half of the $30 billion target in the latest round that they were striving for. OpenAI's latest round fell short, and the numbers behind it say a lot on where AI trade stands. As they are heading for a likely IPO. OpenAI secured roughly $11 billion of commitments against the $30 billion target at a $1.25 trillion valuation versus a $1.4 trillion it originally wanted. I'm just saying, once you hit a trillion, it doesn't really matter. But, you know, I guess you still have millions in there and billions. Investors' appetites are cooling amidst a broader tech sell-off tied to disappointment earnings from Google, Amazon, and Intel. Anthropic's Q1 to Q2 revenue more than doubled to $11.6 billion with a small operating profit versus OpenAI's roughly 18% growth to its $6.7 billion and deepening operation losses. Claude Code growth is cited as the main driver towards Anthropic continuing to lead the charge here. I mean, all this is going to be very interesting, like when they file their S-1, when they do their IPO. It's been rumored, I'd say, for a while now, but I think with Anthropic getting ready to do— to— for their IPO, I feel like OpenAI has to do it relatively soon after.

[09:15] C: Yeah, I'm sort of surprised that, you know, like, that it's this far off. Like, they've already adjusted it down from $1.4 trillion down to $30 billion, and then they were able to only raise $11 billion. So it's clearly that, you know, investors are a little bit, you know, more sheepish about that. And, you know, it is, it was on an unsustainable trajectory, so it makes sense that that concern's gonna happen. So this, is this the beginning of a bubble burst? I don't know. We'll see, I guess with Anthropic, which is expected next, right? We'll see what their numbers are.

[09:47] B: Yeah. I mean, I still like, which I didn't say before, you know, they're, they're still hoping to raise that $20 billion from family offices and high net worth individuals. And I wish I had billions of dollars to throw around, you know, at these companies. Like,

[10:01] C: yeah, I want to have enough money to be courted by OpenAI. Like, please, please take all of our stock and hopefully it goes up in value and then you're, you get even more trillions of dollars. Like,

[10:13] B: yeah, it's crazy.

[10:14] C: It is crazy. I mean, the fact that this says that Anthropic has a small operating margin, like where they're making profit, is crazy to me because I've never heard that anything AI makes a profit. So that's pretty cool.

[10:31] B: Yeah, I think they were decently breakeven, broke even, you know, in the S-1, but I didn't dive into it. It was one of those things that I just never went that deep because it's way too deep. Yeah. I did try to run it through Vault and I hit the limit just 'cause I was gonna, You know, when it came out, I was like, Bolt, here's the S1. Can you summarize it for us? And it's like, no, you're way over the character limit by like an order of magnitude.

[10:58] C: Yeah.

[10:58] B: So

[10:59] C: you can't afford this. Yeah.

[11:03] B: My favorite was, uh, a while ago, I haven't checked in a while, but Bedrock itself couldn't parse Amazon's AWS's own SOC because it hit the token limit of what you could do with the models at the time. So if they aren't SOC, you couldn't actually like send through AI and process.

[11:23] C: So, wow,

[11:24] B: fun fact. Yeah, turns out SOC reports should be long. Anthropic warns AI may soon begin recursive self-improvement. It's taking over. Anthropic is warning that AI may soon begin recursive self-improvement, and it's floating the idea of coordinating industry slowdown, which we've talked about before. For, which matters to anyone building frontier models on the cloud. Anthropic says Claude now writes more than 80% of its own code merged into its own system. I think it writes 80% of the world's code at this point, up from low single digits when it was first launched. Yes, because there was no platform to launch on. The company's June 4th post, "When AI Builds Itself," says recursive self-improvement is not inevitable but could arrive sooner than institutes are ready for it. Raising the risk that humans are losing control. Anthropic proposed a global coordination mechanism to slow down or temporarily pause frontier development, basing models on interim-range nuclear missile arms agreements. It also gave few specifics beyond the need for top labs to participate in a credible way. Skeptics doubt the feasibility of all this. The post also follows the withhold of the Prometheus model, which was deemed too good at finding software vulnerabilities, and a confidential IPO filing. I mean, there was another, I think it was a Planet Money or something that, some podcast I was listening to that talked about this, about having all the vendors have to come to agreements. And they were talking about something like biological, Gene something, and how the— that group of people had to come to the agreement and then give the controls to a third party to actually self-manage them. But I don't think you're gonna get Anthropic, OpenAI, you know, to say, guys, we're gonna stop development. Like, there's too much money at risk. Like, we just talked about, it's a $1.4— doesn't even matter, over $1 trillion valuation. Like, you had two of these companies that work $2 trillion more than most countries' GDP to stop developing and potentially lose the edge on each other? Like, I just don't see that happening is the problem.

[13:46] C: Ah, I think you get OpenAI, Anthropic, and Google to agree. What I think they can't do is get all of the China model providers, right? And other model providers globally to agree. And I think that's what you would have to do. Like, that's why they're comparing it to the nuclear missiles is it's It's more of a global concern because no one country wants to fall behind in their AI technology. And so it's kind of crazy that way, how quickly this become, became sort of this global phenomenon and this global risk, right? It's sort of crazy to think of.

[14:22] B: I mean, it's a global arms race.

[14:23] C: Anthropic saying, oh, we need a slowdown, but they're the ones that could just slow down, but they don't want to go down. They don't want to lose market share. So it's like, this is, it's a weird position.

[14:32] B: It's too much of a business risk is the problem too. Like if they lose and all of a sudden China comes out with a model that's good, you know, that's equivalent to whatever, you know, to Sana and it's half the price, people are gonna drop them and they can't afford that.

[14:50] C: I already know tons of people that use Deepseek because they don't want to pay the premium for Anthropic or OpenAI. So that's definitely a thing. They lose market share today because Deepseek is cheaper and all the open models.

[15:02] B: Most people don't need that.

[15:03] C: Yeah. Yeah.

[15:04] B: I mean, you really don't even need KIMI-3 for a lot of stuff too. Like you can get away with a lot of the lower models.

[15:10] C: Mm-hmm. Yeah. All right, well, let's move on to security. So in happier news, no, there's just kidding. There's no happier news in security.

[15:19] B: It's because you're so joyful, Ryan.

[15:21] C: Yes, exactly. There was a malicious version of Anthropic's Claude code identified in the Cursor Extension Marketplace. Kersher disclosed that a tampered copy of the Cloud Code extension was live in his VS Code extension marketplace for about 11 hours. And that extension tried to install an SSH backdoor on developer machines. It's a useful case study in IDE extension supply risk, which is, you know, something that I've been rabble-rousing internally at my day job, like this saying the sky is falling for a while. Uh, the malicious package was available for, for roughly, from roughly 2:30 in the morning to 1:35 Pacific. In the afternoon the next day, and it was not published by Anthropic. Kirscher says at most 5,000 users were affected and it will contact them directly. The extension collected hostname, username, OS, home directory, environment names, Git, emails, and public IP, and then tried to append an attacker SSH key labeled SVC Telemetry to authorized keys and enable the local SSH service. You know, it's a very limited blast radius, but still very serious. Enabling the SSH service needs admin rights. So on most hosts, that tunnel step would have failed, but still an explicit, you know, exploit of data and not a good thing. Cursor pulled the package, shut down and rebuilt the entire marketplace, rotated keys and audited all the other extensions and had the hosting provider take down the attacker server. Users should definitely check for the SP telemetry key, run the provided macOS or Windows remediation scripts and rotate credentials from any trusted system. You are concerned.

[16:57] B: It's just another place now, you know, I feel like back in the day it was like, okay, you have to have rights to install it. Okay, now we have pack— now we have extensions in Chrome. Okay, we have to figure out how to manage those. Now you're like managing plugins to everything. Like, I don't envy security a lot of times, you know, because you don't want to slow people down, you know, playing with the latest and greatest things and, you know, helping build your company, but these supply chain attacks are coming every which direction. It's no longer, you know, just, oh, you know, it's whatever requires in, you know, PostgreSQL. It's now, okay, what, what are you doing within these tools? What other things are you adding in? All just more and more places to go. I mean, luckily this one wasn't, it was sophisticated, but not like the most sophisticated. But still just one more thing to deal with. So

[17:50] C: yeah,

[17:51] B: I play it out for you, Ryan.

[17:53] C: Yeah. I mean, it's tricky, right? Because it's like, we've, we have ways to detect what's installed on a system from an application point of view, but plugins used within that application are much harder. Right. And so it's, when it's known, like we know that there's a marketplace for VS Code plugins, like it's something that you can build in via your MDM policies or security tooling, like the ability to do that. But so many applications probably have marketplaces that we don't know about, and there's no way to really detect that from typical endpoint detection tools. And it's just like anything else, you know, plugins have versions, or are they updated? You know, that's, it's always a concern, and there's not really a secure trusted source, as we, as proven by this exploit. You know, this is directly from the Cursor marketplace. It's still got in there. And so it's, how do you, how do you maintain that? And so it's limit your blast radius and do your best, I think. Is the all you can do. All right. Cloudflare just launched ZeroWire, which is a public vulnerability intelligence feed on Cloudflare Radar aimed at helping security teams triage critical internet-facing CVEs faster. ZeroWire is a curated feed rather than the full CVE catalog, which focuses only on critical vulnerabilities in the internet-facing software, such as web apps, runtimes, and exposed services. It is free to use and does not require being a Cloudflare customer. Each briefing is structured like an index card with a plain language explanation, who should investigate, and the recommended actions. The framing separates the severity from the evidence of exploitation, and Cloudflare acts the network— Cloudflare adds network telemetry where it's relevant. Cloudflare is explicit that matched requests are not a count of compromised systems. Each briefing includes a pre-built prompt for AI agent to run a read-only assessment on deployed software. Fixes and exposure and the compensating controls. Copying their prompt does not scan or change anything. So teams will need to run the assessment in their own environment. Cloud Run states the WAF rules are the only compensating control and not a substitute for patching. And some issues fall outside the Traffic AIFIN spec. Pretty crazy, but they're offering it for free, which is nice.

[20:03] B: I like that they're just building more visibility into it. You know, they have such a broad spectrum, you know, viewpoint of the world. I mean, I would assume Cloudflare probably has 20, 30% of the traffic flow through them. It has to be up there in percentages, if not even higher. You know, so they have a large thing and being able to see the CVEs, you know, and share this information out is, I think, pretty useful. So I think it's nice, it's nice service they're adding, you know, and I think it's definitely useful in the world of, 1,000+ vulnerabilities getting released, you know, every month by every OS provider before you even have packages on top.

[20:46] C: Yeah. I mean, it's such a strange world right now. Like, it's difficult to manage all the different exploits and we're having to invent new ways, right? And so it's like, I do think that, you know, if you're Adding the context, the sort of metadata of the vulnerabilities by the severity, right? You're already sort of acknowledging that you can't address everything. And so I do think this will help a lot of teams, 'cause I think it's really, there's too much noise now in all the threat intel feeds and, you know, how do you know which ones are affecting you? And so this is, I think, one of the many tools that we're seeing now that has that sort of contextual awareness, like, you know, and it hopefully can tell you directly, like, if you are a CloudFront customer that you're affected. So

[21:33] B: I think a cloud journey we should probably have is how AI has affected different areas, because I think AI has affected everything dramatically. But I think security is a pretty big one too. You know, you've talked about parsing, you know, I think about saying it hasn't affected one area more than the other, but like security is a very interesting area. You're getting more vulnerabilities. So Sure, you can still patch servers, but is that going to be your best place to go? Do you need to move stuff more external, but you don't want to build a high-walled garden? Like, we haven't like seen kind of those nuances of like, how has it reframed how we do monthly sysadmin work? Does also affect it. So, I don't know, I don't want to put you on the spot, but like hearing, I guess, from you, from the security lens a little bit, of how it's affected vulnerability management, I think is a pretty interesting conversation that we should have at one point.

[22:31] C: Oh yeah, it's huge. I mean, we've talked about, you know, the vulnerabilities that are being discovered at Microsoft and hitting record numbers. We're seeing more and more exploits, like, you know, the PHP shell and other things that are coming up for, that are being discovered. And, you know, like there's all, uh, and AI being able to chain together, you know, sort of less severity vulnerabilities to put an exploit just is completely changed the attack landscape. You know, not to mention there's now the availability of, you know, the, the frontier models, the security-specific ones that have relaxed the security tools so that you can do security research on your own. Environments, but then also, you know, like I'm trying to build, you know, security services internally that have agentic workflows that are more user-facing in a sense. And so using agents to explain vulnerabilities and, and proactively do research for security reviews. And so it's, it's changed everywhere. And so it's, it's almost like where hasn't it changed the day job?

[23:38] B: Yeah. I mean, every, everything has changed, but I don't know. I was thinking it just might be an interesting arc if we ever want to do one. You know?

[23:47] C: Yeah. No, I could talk for hours on it. I don't think it would be interesting, but—

[23:50] B: I

[23:50] C: don't think

[23:51] B: I'm going to say 10 minutes. I have to hear you talk for an hour a week. I'm good.

[23:57] C: Yeah, exactly. It's enough.

[24:02] B: Onto the world of cloud tools where Terraform has released a self-service for developer and a developer portal. HashiCorp has put Terraform developer portal into public preview, a native self-service layer in the HCP Terraform that lets developers consume approved infrastructure without needing to know about the underlying modules. I feel like we tried this years ago. Terraform, sorry, Platform Teams exposed the existing Terraform modules as a curated template. For examples, create an application service with defined inputs. Developers pick a template, fill it in, and Terraform handles the rest for you. Magic. Provisioning infrastructure could represent as an application which could also be extended to add-ons such as a Postgres database. Terraform Actions cover approved approval and operational workflows beyond the initial provisioning. It targets the tension between developers, ease of use, and platform teams trying to control everything. Developers always want a simpler way to do stuff, and platform teams need to handle governance. I feel like we've tried this before. I feel like HashiCorp had that with their modules that there were, was built into GCP. I think this is just more self-service than it was ever before, and they're really trying to push it to the other.

[25:25] C: I don't see any difference from like it's other than a wrapper, right? We called this a service catalog back in the, the Cloud Custodian days, right? It's, it's exactly just templates. Like I want to deploy a web service or I want to deploy a simple Kubernetes service and someone is putting that together and, and providing an easy button. And so there's a bunch of self-service tools, you know, Backstage is the first one that comes to mind. People use that a lot and, you know, there's been a lot of custom development. And so I just feel And I, I hate service catalogs. I think they're useless.

[25:57] B: Doesn't Justin really like them?

[25:59] C: No, he hates them too. Like, 'cause they're—

[26:01] B: Who is it that liked them?

[26:03] C: You have to support them. And so they turn into—

[26:05] B: I know.

[26:05] C: Each template is its own little thing that you have to support. And then of course, without fail, oh, I, I want this template, but it needs to do this one other thing. Right? And it's like, if the minute you put that out there, like then you've got, you know, all of the security issues, all the permissions and all of the operability. That needs to go into that, you know, the non-paved road just for that one little thing. And it's, it ends up with sprawl way too often. And it's just, I don't know, I just don't think it's the right use case, but people keep trying it 'cause developers still want easy buttons, which makes sense 'cause they're getting more and more responsibilities. But

[26:45] B: yeah, I mean, I, I like the general concept, but it's the management, it's the maintain, you know, it's no different than— it becomes no different than any software. You know, it's okay, you're on version 1, we are now version 6, because God forbid you update it. How do we have an upgrade path? How do we handle this? You know, if you're at a massive company, then yeah, it makes sense. But most medium enterprises and lower don't really need, you know, here's your EKS cluster, you know, here's your, you know, ECS, whatever. Like, it's just, it gives a lot of I like the idea. The execution isn't always there.

[27:23] C: Yeah. Uh, yeah. Uh, if, if the business wasn't always overriding it, like they always say, it's the governance for the platform team to, to be able to control what gets deployed and how, and it's, but it's just not true, right? But when it gets escalated, it's like, oh, it's, it's everything. But then you had to jump and do this special case. Like it just feels like there's not enough.

[27:44] B: Don't hit that close to home, Ryan.

[27:46] C: Too close. Yeah, yeah, yeah, yeah. Exactly.

[27:50] B: All right. Strengthening security for Agentic AI with new Vault, Verify, Boundary, and Secure Hub capabilities. IBM and HashiCorp, which is HashiCorp, rolled out Agentic AI security updates across Vault, Boundary, Verify, and the new Secure Hub. Hub aimed at treating AI agents as first-class identities in a hybrid cloud environment. IBM Agent Identity is now GA and registers AI agents as first-class identity, which means that they can have ownership, delegate authority, task scope authorization, and there's audit trails, which makes everything better, using Vault to protect agent credentials. Vault 2.2 adds vTPM support on the Linux VMs, so on-prem workloads authenticate with cryptographic proof instead of bootstrap secrets, addressing the secret zero problem. It also extends the governance to AI and non-human identities and adds PKI automation, public certificate management, and is post-quantum readiness. Vault and Security Hub are in preview, sorry, Secure Hub are in preview. Arc is the new Vault architecture with a new resource IAM model, scoped ephemeral authorization, and agent identity governance. Secure Hub, one of these times we're going to get secure versus security hub, gives centralized visibility, reporting, and governance across distributed Vault Enterprise and Arc environments. Boundary Added 1.1 adds App tokens, which lets administrators issue scoped, time-limited tokens for CI/CD and automated integration in place. Boundary also introduced an MCP. Welcome to the club, which is in preview. So not quite there yet. You're still in line. Admins can manage and troubleshoot clusters in natural language because who doesn't like to do that with clients such as Claude, Codex, and Cursor? Anything really that can handle an MCP.

[29:57] C: Yeah, I, I mean, this is, uh, agent execution and AI is changing the way we're having to do identity. I think, you know, for a long time, most of our use cases are, we've been able to get away with, you know, acting on behalf of, right? And so when I go to my Claude code and I say, go update this Jira, it looks like I updated the Jira. But now we're on the verge of, of those executions going to other environments running on their own, on their, because you configured them on a schedule. And you know, it's only a matter of time before there's, you know, like I'm sure there's, there's use cases within small companies, but it, where it becomes like just commonplace that, you know, have your agent talk to my agent. Right. And that's how you just handle business. And How do you manage the identity and permissions for all the apps and downstream services that that's gonna need? And you know, the traditional tooling just doesn't support that. You know, it's really highlighting some flaws we already had in user management and permissions, right? We're sort of getting there with, you know, things like OAuth, you know, short-lived tokens and token exchange with OIDC. But yeah, just in time permissions and, you know, over-provisioned R-based or role-based access roles are a problem. And it just continues and it gets exacerbated with the number of agents and executions that you can do. So this is cool. I want to play around with this. It's probably, it looks like it's built into their enterprise, which means it's Vault Enterprise, which is the most expensive thing on the planet. So I won't be able to afford it. But I do think that this is, you know, something that could make, this type of platform is gonna be very crucial to businesses. I like it.

[31:44] B: Yeah, I mean, they've added a ton of features and I feel like we've talked about a few times on the show, identity's hard. Like, it always was hard. SAML was hard, you know, but now you have thousands and millions of short-lived, you know, agents running and identity's going to do things and it's they should only be scoped to whatever this person or that has access to. And so you don't leak information. It's not an easy problem to solve. And does it surprise me it's taking a little while to solve it? You know, but it's gonna take a while to solve and test and iterate over it and have everyone tell you that you're doing it wrong at least 3 times straight.

[32:22] C: Well, and then there's no right way, right? There's like, no one's really figured out how to do IAM centrally that works across everything. There's definitely pros and cons. Like you just going into like the, the permission schemes for individual clouds, right? Like,

[32:37] B: yeah,

[32:37] C: yeah. It's, they're very different just going between AWS and Google Cloud. Like they're completely reversed, you know? Yeah. AWS is, you know, the role and the principal that gets access to all the things. And then Google is almost the opposite, which is the resource and who gets access to it. And it's just like trying to evaluate that just can break your head.

[32:55] B: It does on a daily basis. On things that will break your pocketbook, IBM Cloud Security Manager Vault Dedicated, HashiCorp's Vault Enterprise managed by IBM. Ways to burn money that aren't by Oracle. IBM just announced a managed dedicated version of HashiCorp Vault Enterprise on IBM's cloud for the 5 customers. And note, IBM's Cloud Security Manager Vault Dedicated runs on Vault enterprise on a single tenant, which also operates within the IBM Cloud that IBM operates for you. It's positioned here as a replacement so that teams don't have to run their own. I like what they did here, just very expensive, I'm sure. And I didn't even want to look at pricing. I feel like I can't afford it just by saying all the words enterprise in there.

[33:47] C: Yeah. What I find, I mean, I get that they're, you know, this is this isn't on the HashiCorp platform, isn't there already dedicated Vault, man, like that's managed for this? And I wonder if this is replacing it or if it's just in, is it just available on, you know, IBM environment, IBM cloud?

[34:04] B: I think this is their IBM cloud version of it.

[34:07] C: Okay. So like instead of having Secrets Manager in Google or AWS, this is, this is their managed service for secrets inside their cloud. Okay. That makes some sense.

[34:17] B: It's really just them fully consuming HashiCorp into the big blue way of IBM.

[34:23] C: Yeah. Good luck with that.

[34:26] B: Yeah.

[34:27] C: All right, let's move on to AWS. First up, Amazon RDS for Oracle and SQL Server now supports storage auto scaling on additional storage volumes. Previously, auto scaling only covered the primary volume, so teams had to manually size each additional volume up to 3 for a total of 256 terabytes. And now you can set a maximum level, limit per additional volume, and then RDS will scale it up automatically with no downtime. This addresses the classic trade-off to under-provision and then risk application downtime or to over-provision and pay for that unused capacity. This works on both new and existing database instances, sweet, and can be enabled through console CLI or the API. And so retrofitting into the existing fleet should be low friction. There's no additional charge for the auto-scaling feature itself, and you just pay for the storage provisioned. It's available in all commercial AWS regions and GCP. Cool little announcement.

[35:24] B: It's a great quality of life for a feature I didn't know that existed because I don't run Oracle or Microsoft SQL as much as I humanly can in life. I know that you could have additional volumes. I thought that was kind of cool. So, you know, it's a great way to scale without potentially having to scale your CPU and memory, you know, the more expensive part. So if you have 3 volumes for a total of 256 terabytes, I don't even want to do the math of what that's costing you in EBS costs. Like, that's just a lot.

[35:53] C: And it's probably all PiOps, right? Because it's database, it has to be Pi/3.

[35:57] B: Yeah, even if you do GP3, that's going to be bad. I guess maybe if you did, did Redis ever? Yeah, Redis did support Magnet. Magnetic. They definitely did HDDs. I have a story one day for another day about a customer running that and couldn't figure out why their database performance was so bad.

[36:19] C: Sounds like it might age all of us too, so I don't know. For sure. That's an off-air thing.

[36:22] B: Yeah. Yeah. They don't get to see us, but I'll have a lot of hair at the top anymore. So, you know, different problems for different days.

[36:33] C: All right, AWS just made your existing Step Functions workflows callable by AI agents through the Bedrock Agent Core Gateway. This gives agents a deterministic way to run business processes. Agents can now invoke standard and express Step Functions via the gateway over the MCP. The agent chooses when to run a workflow and what inputs to pass to the Step Functions, and then Step Functions will execute it in the order as defined in the state machine. This is a common concern with agentic AI, that you can get non-deterministic behavior, and pushing multi-step processes like refund eligibility checks, manager approval, and crediting into a workflow means every run follows the same policy in the same order regardless of how the model reasons. Agents now can look up workflow runs, so operations agent could tell an on-call engineer which order runs failed overnight and which ones need to different step, and this shortens the path from alert to fix. It reuses the existing investments. Step Functions already orchestrates 220+ AWS services, so teams can expose current workflows and agents without rebuilding them.

[37:37] B: I think this is great. I think that if you're using an agent as a, you just say workflow engine, like, I don't agree with that in, into that level of extent. Like, if you needed an agent and AI is inherently non-deterministic. So to me, you probably weren't using the right tool at the right place if you were upset that you were getting different answers every time with AI. Like, just try to sort out, like, you put enough constraints in, you could do enough prompt engineering and get it to be, but AI is inherently non-deterministic.

[38:12] C: Yeah. And so that's fine, but it's like, yeah, you still want to use automated AI reasoning and, and processes and It's the same problem we have with humans, right? So it's like instead of allowing, you know, the human operators access to the database and all the things they would need to, like in this example, you know, refund, you know, run all the checks for, you know, see if a purchase is eligible for a refund. Like there's, you build that into like a control plan for the app so that you can get that deterministic behavior. Same thing with, you know, chat, chatbots that are now controlling, you know, the, the customer support experience. You wanna have a way, you know, to have that happen the same time every single time. And there's only so much standardization you can get with skills and tools. And so I like this sort of model where you have, you know, very prescriptive sort of processes built out of, you know, built somewhere else that the AI agents now interact with.

[39:06] B: Yeah. And I think probably if you've listened to this show, you know that we all like Step Functions for a lot of things. So it is a great, you know, next step in add-on to it. So while I am annoyed about people doing things wrong, that's just who you're listening to on as a host at this point.

[39:26] C: Amazon ECS Auto Mode now supports Kubernetes Gateway API. Auto Mode now speaks Gateway API, so Kubernetes teams get the ingress successor without having to run their own controller. EKS Auto Mode now supports the Gateway and HTTP route resources and automatically provisions and manages the underlying AWS Load Balancer infrastructure with no separate controller or install or really configuration. The supported capabilities include HTTP and gRPC routing, weighted traffic splitting, header-based routing, and cross-namespace routing for multi-team clusters. And of course you get automatic TLS certificate discovery through the AWS Certificate Manager, all included. The existing ingress resources keep working along the Gateway API resources so teams can migrate incrementally rather than doing a huge cutover. Gateway API is the portable vendor-neutral standard for Kubernetes traffic management, and it helps reduce lock-in for multi-cloud shops. Canary and blue-green patterns via weighted splitting patterns become declarative Kubernetes config instead of custom tooling, which is great. There's no extra charge for Gateway API support itself, and it is included with EKS Automode.

[40:36] B: It's a great quality of life improvement. It's like, um, is it ECS Express or whatever it was that you think they, they're starting to package everything together, which is nice and hopefully make Kubernetes a little bit easier. Just, yeah.

[40:50] C: I mean, you know, it's the same underlying, you know, pattern as that because it talks about the, you know, the IAM certificate manner and the, the application, uh, Load Balancer just being sort of automatically handled. So they've, it's just custom code on top of that, that now talks in that specific. Kubernetes flavor, which is, but I think that's great. You know, like these, I will say that the ingress controller is one of my favorite features now that I have to use Kubernetes 'cause they make me. And you know, Google or Microsoft Terraform.

[41:20] B: Google or my day job.

[41:21] C: Oh, day job. Yeah. And only 'cause the day job does, is hosted on Google. Like I would never do it. Like, I don't know, maybe EKS is, EKS is good now, but, uh, never running my own Kubernetes. I'll tell you that much.

[41:37] B: I don't blame you. I've done pieces of it before and I just feel like it, it's, I always say Kubernetes is its own cloud. Like it's as complicated, it could do everything and it's a pro and a con. And I just don't feel that most people need all that power.

[41:58] C: No. And I, you know, it's a hot take, but I also think that, you know, Kubernetes operators to sort of manage other cloud resources is where you really lose me. And so it's like, no, no, no, no, no. Just separate your concerns.

[42:16] B: I've had that argument for years with a few of my good friends and people I trust a lot. And they love Kubernetes and I just don't get it. So.

[42:30] C: Amazon RDS now supports per-snapshot billing. So now you can see the cost of individual snapshots instead of just a lump sum per database instance, which should make backup and spend much easier to track. Previously, the snapshots changes were aggregated at the database instance level and the Cost of Usage Report and in Cost Explorer. Each snapshot, now each snapshot's cost is visible individually, and so you can find that one snapshot or that one backup process that's costing all the money. Cost allocation tags on snapshots are the mechanism for attributing costs, and teams will need to activate and apply the tags to snapshots to get charged back or show back by team. And this is enabled by default in our RDS snapshots with no additional charge, so there's nothing to opt in or deploy.

[43:14] B: This is really nice as somebody that's had to dig through bills too many times and you just see this RDS and you're like, well, what's costing us in RDS? Do we have a big change rate? Why is this so large? You know, et cetera, et cetera. And you just don't have that. And being able to get down to that per snapshot, you know, is that granularity weirdly is really useful when you need it. And when you don't need it, you just don't care. But when you do need it, It will make your life better. So if you haven't run into this pain, you never will now. Thank you, AWS. Yeah. Into the world of GCP we go. What really VMware and a little bit of Oracle. So just to really confuse everyone, VMware solution on Google Cloud now. Google Cloud just announced a new way to burn money. A self-managed VMware option gives customer full admin control of VMware Cloud Foundation on dedicated bare metal, which matters for anyone who's planning a data center exit with a VMware migration. And please never stay on that unless if you don't care about money. This is a second deployment model alongside the current offering of Google Cloud VMware Engine. Customers running VCF 9.x themselves on a dedicated Z3 bare metal, keep control of maintenance windows, third-party monitoring tools, and existing operational playbooks.

[44:42] C: So the way I read this is that your stodgy old neckbeards that are in control of your VMware cloud that is hosted in your data center, they want all the control, and so they're just moving it to Google Cloud because the, the business is making them go to cloud. And so now they're taking all the same problems of VMware and just moving it to some other hosting provider where there's just an additional layer of complexity on top of those problems. So yeah, great idea.

[45:06] B: And additional costs.

[45:07] C: Run cloud on cloud. Yeah.

[45:09] B: I mean, the only way this does make sense, and I've seen people do it, is you're like, well, we have to get out of our data center. We didn't plan very well, or, you know, and we have to get out. Great. Now let's lift and shift essentially. And it's easy. You just spin— I mean, it has some advantages. The original VMware solution, Hey, I need extra capacity. Let me just burst over to AWS and burst back. That was kind of a cool concept, you know, if you were stuck in your data center and that, like, those types of things make sense. If you're using it for like a weirdly bursty workload, but you don't know cloud, or you're using it to migrate, oh my God, I have to get out. Let me just move over and then transform after. But it's going to cost you.

[45:55] C: Yeah,

[45:55] B: a lot.

[45:56] C: I mean, this is gonna be expensive too, and it's no different than running hyperconverged infrastructure in, in some colo somewhere. And so like, I don't understand why they're doing this. I mean, clearly someone wants it and they think they can sell it, but they

[46:08] B: know they

[46:08] C: can sell it. Yeah. It's, I mean, it's nutso to me that anyone would do this. I do get like having to burst into VMware Cloud or DR for VMware. I do. But the, the existing Google service, you know, I thought was filling that gap. I'm not a VMware user, so maybe it had like weird limitations on it where you couldn't tweak it. But the, the amount of hardware-specific, uh, specifics in this announcement just make me think that there's too much, too much infrastructure maintenance going on here if you're going to use a cloud service. Like, you choose one.

[46:42] B: Well, how do you feel about running Oracle AI Database on top of Google Cloud.

[46:49] C: Well, it sounds fantastic. Tell me more.

[46:52] B: Only if you want to burn your wallet up. Google Cloud and Oracle use Oracle AI World. Do they just throw AI at everything, Oracle? Sorry,

[47:01] C: I think everyone throws AI in everything.

[47:03] B: I know, but I feel like Oracle, like, they renamed their database to Oracle AI Database. Announces their new batch integrations tying Oracle AI Database at Google Cloud to BigQuery, Gemini, and Agentic AI workflows. So to round this up, everything has AI in it and Oracle all at once. More ways to spend money. Remote GCP servers with, with IAM governance execute SQL Data API is now GA, letting AI agents run SQL queries against Oracle database using Secret Managers for credentials and Google Cloud IAM access.

[47:39] D: What could go wrong?

[47:40] B: Yeah. No big deal, especially with custom NL2 SQL middle layers. Gemini connectors for Oracle AI databases in preview enables natural language queries against your Oracle data inside the Gemini app grounded via Knowledge Catalog integration, also in preview. So expect some issues as you go do this and expect that. They did pre-release at least 135 pre-built skills, which is pretty nice. Overall, there's integrations in several platforms. Bidirectional Iceberg access lets Oracle Autonomous AI Database, I don't know what the difference is and I don't want to know, and Google Borderless Lakehouse read and write shared Iceberg tables in Cloud Storage without ETLs. I appreciate anything that doesn't have to do an ETL. OCI GoldenGate CDC streams from Oracle redo logs into BigQuery with sub-second freshness. And BigQuery's query foundation in preview using external query to run Oracle SQL from BigQuery with zero copy, which suits for ad hoc joins and fraud checks.

[48:53] C: Some of these are nutso to me. Yeah, the fact that in BigQuery you can run external queries with query federation against other data sources and other database tech, like, whoa, like, is that— I can see how I would abuse this, but I don't know that it's a great idea. I already have a hard time managing sort of the compute costs of BigQuery, 'cause it's, you know, like your data structure can get large very quick and large queries can get very expensive in BigQuery. And I love BigQuery, But I don't know.

[49:27] B: I know Microsoft had like an external table or something feature where like query out to like a different location to get that, then use that, which is I assume what this is.

[49:38] C: Yeah, I think that's exactly, I mean, that's what it sounds like.

[49:40] B: I've never

[49:41] C: used it, but

[49:42] B: it's just things that sh— there's a reason for it. I just think there's better ways to do it. If you're hitting this limitation, it's time to reevaluate how you got there. And you've probably in a good way hit a new scale that now is time to re-architect.

[49:57] C: Yeah, it seems to break my model for like where the API contract and service-to-service, you know, and the limit the blast radius. Like the minute you're doing queries against someone else's data, you got a problem in my opinion.

[50:08] B: Yeah.

[50:09] C: 'Cause now they can't change their schema, they can't optimize for performance without coordinating everything through. And so it's like you can't do versioning with queries. And you would need to in order to make it work in my model. But I do like, you know, some of these, like I, I do like the, the fact that they're in the Gemini app, they're grounded via the knowledge catalog, like automatically so that it's, 'cause that's the type of feature where you, you can give your AI agent access but safely so it doesn't, you know, give you access to all the rows and tables and all the databases ever. You know, like if there's financial data, you can, you can scope it down to only what the agent is allowed to see and what the user is allowed to see that's executing the agent. So that's pretty cool. I like that.

[50:53] B: Well, Ryan, since you are not sure how you're going to manage your SQL schemas with your external one, Cloud SQL has caught up to AWS RDS, releasing blue-green deployments for Cloud SQL. See how I tied all that in there?

[51:07] C: That worked out. Very nice segue, yeah.

[51:08] B: Yeah, I know. That took a little while. As you were talking, I was like, how do I do this one? This is why we should not be left alone. We, we, we are extroverted and we are talking about how good we're doing. It's really obvious.

[51:21] C: And it's late, so we're getting loopy. This is bad.

[51:24] B: Yeah, it's fine. Well, you're out at the West Coast. Like, I gotta do this at, what is it, 10 o'clock at night? You're doing this at 7. Come on. Google brings blue-green deployments to Cloud SQL for MySQL in preview, aimed to turn major version upgrades for my weekend project into to low downtime operations. PostgreSQL creates a green clone of your production blue database, upgrades it to the target version, for example, 8.0 to 8.4, keeping it in sync with continuous replication. Switchover is available to the CLI. During switchover, blue is briefly set to read-only, final replication occurs, and green is promoted. Enterprise Plus customers should see sub-second downtime. While other editions will likely see longer, though they didn't tell you how long, so I'm sorry. The existing IP addresses, instance name, backup transfers to primary, and so on, such as connection strings, should all remain the same. No more random, you know, application changes and things along those lines. You can see real traffic and queries against the green, validate performance before the cutover, and delete the deployment without touching the production if an issue does occur. So I've used this on AWS's feature and it's great. Encryption key, changing like encryption key, like KMS keys is a great way before this type of feature you had to like launch a replica, cut over from one to the other, do that whole dance. But the blue-green, like you can do upgrades like this, you can do anything else. You are paying on AWS, I assume, and Google to like double spend. So if you have a large instance, that adds up, but it's a great way to go play and get things to make sure that they're working before you go cut over to

[53:10] C: them. Yeah, I like how much the like ancillary setup is included. Like it, you know, it maintains the IP address, the instance name, all of the backups you have configured, transfer to the primary just automatically as part of the service. Like those little things that, you know, can be little gotchas for operating the same service. And so like, I don't, I never really had too much of a problem with that when using AWS, but you know, like these are just nice things to have. And you know, databases are one of those areas where like, you know, DBAs don't have the, a lot of the automation operational sort of, you know, patterns built into their software and their pro, their processes. And so like, I, you know, it's another thing, like we were just talking about VMware, Kubernetes, like I would never manage those on my own. I feel the same way with, you know, any kind of database engines. Like I'm going to use a managed service because of optimizations like this. You know, now I don't have to have like, you know, these schema mappings and diffs and everything that for changes, and I can just roll back and automatically, and that's hard to do when you're managing your own servers.

[54:14] B: And they nicely added some additional features too, where you can now leverage DMS to shrink your Cloud SQL on on SQL Server databases. Google has published a how-to guide showing how to leverage Data Migration Service to reduce your Cloud SQL storage disk with minimal downtime because when Ryan was writing his query on loop, he forgot that he was writing it every time to the SQL table.

[54:39] C: It's never happened, quite yet.

[54:41] B: Never happened, no. The SQL disk grows and eventually if you do an archive approach, you always end up with extra storage. Which means you're paying for capacity you're not using, which is anti-cloud. So the built-in feature lets you shrink, does require downtime proportional to the total disk size, meaning a multi-terabyte disk can— used to be able to take you time. DMS approach instead provisions a new instance with a smaller disk, replicates the data over, and then from there you can do a brief cutover. It's a nice feature if you've done things like this and accidentally massively either overprovisioned or, you know, archived a ton of data. You know, this is one, it's only for MySQL though, so.

[55:27] C: Yeah, well, I mean, it is, yeah, but it's a lot of the auto scaling at the storage level only works one way, right? It doesn't necessarily go remove that space. And so if your patterns change or you, you know, you have FinOps practices and you auto scaled and you maintained uptime for your customers, but then now it's, you have to figure out what changes you do to, to scale it back down, it can be really difficult, right? Without having to just deploy a whole new database. And so this is a pretty cool exercise on how to do it sort of in place using a managed service. I like the DMS service, I've used it a few times for replication. I haven't used it to shrink Cloud SQL, but that's a pretty smart, it's a pretty smart use case to sort of use that built-in management and replication to, you know, make changes to your running, running production cluster. So that's cool.

[56:23] B: Google Cloud spend caps are now generally available. Google Cloud spend caps on budgets are now generally available, giving your team a way to stop runaway costs without deleting resources, which is a pain when your production— Perfect. Go down and your podcast blows up. Spend caps halt your pay-to-go and cut coverage once the budget hits threshold rather than deleting resources. They trigger within minutes of using live estimates, which is actually pretty nice because before you would never see that. Provisioned throughput is never halted. It continuously serves traffic. It's a new API, a part, a part of the existing Cloud Budgets API that lets teams programmatically apply, lift, and delete. So when production goes down because you've these limits in place, you can just make an API call to get rid of that and you've made Project Show work again.

[57:15] C: Yeah, I think it's funny that they specifically mentioned that the caps for AI services trigger within minutes. 'Cause you know what happened, you know, to cause this feature. It's someone did a chatbot that went outta control and spent all their monies And there was no way other than there was existing forecasting and budgets in GCP projects, but there was no, you had to have some sort of mechanism on your own to go, you know, my favorite is remove the cost center from a project cuz that sort of halts it cold. But it's a rough edge for sure.

[57:54] B: I assume Google's like AWS and Azure where you your bill really isn't accurate to 48 hours later. So if I make a change on Monday, I really have to wait till Wednesday to look at the bill to see how the effect was, or really Thursday to see how the bill was all day Tuesday.

[58:12] C: So I'm pretty sure it's the same. What's great is that I've sort of moved away from managing the cloud stuff. So cloud spend is, I've just become one of the abusers of cloud spend, which is great. So I don't actually know, 'cause I don't look.

[58:25] B: This is why we don't let you have nice things in security.

[58:28] C: Exactly. All right, let's move on to Azure. All right, Microsoft has unlocked the potential of truly multimodal agentic work by open sourcing the model, the agent harness that powers GitHub Copilot, Copilot Studio, and VS Code. So now you can use the agent harness through Microsoft Foundry, which matters if you don't wanna maintain your own orchestration layer for agents. The Copilot Harness is the orchestration level around the model. So it's where all the instructions, context, execution environment controls live. And this was originally built by GitHub Actions and now standardized across Microsoft's Copilot products. It is now available as a fully managed option in Microsoft Foundry. It supports 20+ Frontier models, bring your own key, and routing of tasks to the appropriate model. Now, instead of, you know, having to keep up building your, you know, agent SDK apps and all these things that you can evaluate new models and swap models without changing the harness or the rest of the application stack. They did communicate that the runtime was ported to Rust. And so Microsoft says it reduced session overhead and time to first token. It supports all the open standards, including NCP, agent skills, and agent plugins. And Microsoft runs the agent loop in sandbox with the governance built in. This is also a downloadable SDK, or you can have it cloud-hosted in Azure. This is a pretty awesome feature if you're building AI applications where you want to have multiple agent executions. It was kind of a rude awakening once trying to build sort of a— build into an application agentic function. And so like, Everyone knows how to make a chatbot and an agent, like, respond to that chatbot. The minute you have, like, a multi-agent orchestration where you've got agents, even if it's started from that chatbot, and then it's coordinating multi— multiple agent executions, like, having to execute that and build that environment is very hard. And there's a lot of rough edges around it. And so I— this is an easy button that I'll probably use because I like this hardness. I use it. When coding, and you can use any model with it. So it's pretty cool.

[60:41] B: Yeah, I had to learn. I mean, we talked a little bit in the pre-read and you just explained it now too. Like, I get the concepts of Harness, but I'm one of those people that has to be hands-on and go play with it and figure out like, if I swap the Harness from A to B, what are the benefits? How do I tweak it? I conceptually understand it, but until I really start to use it, it's it's gonna be a little bit harder for me to comprehend. I mean, it's great that they're open sourcing this tool that's so widely used, you know, that, so I appreciate that.

[61:15] C: Yeah. I mean, it's, it is, it is one of those things that I didn't really understand it until I got hands-on either, or I'm like, oh, how do I do this? Like, how do I, how do I call a model? Right? Like, oh, I can send a prompt via API, but that's not what I want. Right? Like I want to, I want to have tools and skills and customization and instructions. How do I do that? You know, and you realize, oh, there's a, I have to have this and I have to have this and I have to have this. And there's some managed platforms like, and you know, there's the agent in Amazon Bedrock and there's Vertex AI in Google that sort of, you know, allows you to create a lot of that. But if you're trying to roll your own or if you want specific customizations that's outside of those platforms, you, You haven't really had an option. And now we're seeing more and more that a lot of that customization is happening at the harness level. And so it's like you're taking the power that's built into these frontier models and the reasoning that they can do it, but then kind of structuring around it and you're getting, that's where you can get your more deterministic outcome with using AI is by, you know, a lot of control and knobs at the harness level.

[62:21] B: Got it. When I'm more awake, huh? And I have a real use case for this. I will dig into it more.

[62:28] D: Yeah.

[62:29] C: All right, now in public preview, JWT validation for Application Gateways for containers. Azure Application Gateway now supports JWT validation in public preview. And that matters for anyone who has multiple services running containers and you have to have an auth model built into every single one. Individually. Now they can all centralize that and the Azure Application Gateway will do the, the JWT validation and all of it is configured through the auth policy custom resources. So teams can enforce token signature, issuer, lifetime, and audience checks directly at the ingress layer instead of at each application individually. Signing keys are retrieved from a trusted HTTPS endpoint, typically a JWKS URI. And for It fits with all of your normal identity providers, Entra ID, Okta, and anyone who's OIDC compliant. Moving this authentication to the gateway reduces the duplicated validation code across services and gives platform teams a single throat choke, I mean, a single place to define native managed API authentication.

[63:33] B: This is one of those really good quality of life things, not having to do this yourself and just being able to tell Azure to do it on the Application Gateway. I say that not vomiting a little bit, you know, it's a very nice thing for them to do and to have that, be able to handle that at scale as long as it scales is gonna be great.

[63:53] C: Yeah. I don't know of a version of this in GCP and I don't like, and I have this use case, so it's like, I would love if I could define all of my like Cloud Run functions or, or, or Kubernetes services and have like a sort of a centralized auth. Like you can kind of do it in Apigee, like the API gateway product, but I like this a lot. Seems much simpler, low overhead. Yeah. Azure Storage Actions adds automatic task updates, execution controls, and most importantly, case-sensitive matching.

[64:27] B: That's it. That's the only reason we have it.

[64:28] C: That's the only thing we want.

[64:29] B: Case sensitivity.

[64:30] C: Come on.

[64:31] B: Thank you, Microsoft, for adding that.

[64:33] C: Woo! Yeah. So now you can control when your execution tasks run by, you know, changing the case. I'm very confused on what this, the case-sensitive matching is now doing. I guess it's a conditional, right? So fire event when blah, and now

[64:48] B: when this occurs. Yeah.

[64:51] C: And so like, if it's an uppercase versus lowercase, Mattel's, I guess, with the matching. That's funny.

[65:00] B: Yeah.

[65:00] C: I mean, If you have this use case.

[65:04] B: It's just Azure is not case sensitive in a lot of ways and it, you get really weird issues because of that. You know, so it's just funny that they, they're having to add this and then it's a press release about it.

[65:18] D: Mm-hmm.

[65:18] B: You know, we have it now be case sensitive. So, you know, that's all it is. It's just,

[65:23] C: yeah. I mean, it sounds like they need the, the automatic test updates and, and more control over that when that executes. And then this is sort of the, the thrown in.

[65:32] B: You know, it is, but

[65:33] C: quality of

[65:33] B: life improvement itself isn't interesting.

[65:35] C: We just had to make fun of it. Yeah.

[65:37] B: Yeah. That's what we do here on the, on the podcast. Yeah.

[65:43] C: And we did it. We made it all the way through the, the week.

[65:46] B: I know we, I will say we cut a few Oracle stories, but they weren't that interesting cuz it's Oracle.

[65:51] C: We have to cut, yeah, we curate a lot of the stories from our feed. Yeah. Not all of 'em are interesting and some of 'em we just don't know anything about.

[66:00] B: So there is that too, right? The two of us have survived again, just saying, 3 weeks without Justin and we're still going strong.

[66:11] C: Pretty crazy.

[66:11] B: Show has not imploded. So

[66:13] C: we've actually recorded, which is more than, you know, you can say when, when me and Jonathan were having to do it back in the day, like we would just fail. We would've failed if left up to us. Jonathan doesn't even show up anymore at all. So, you know, He's out there. See if he's listening. I doubt

[66:29] B: it. Yeah. I think Justin does listen though, so you know.

[66:33] C: He does, yeah.

[66:34] B: He'll randomly give us snarky comments, you know, when we make fun of him, so it's all good. Justin, we look forward to you hopefully being back next week and telling us how we survived or did not survive this week in the pod. Yes.

[66:47] C: Yeah. All right, thank you. Bye everybody.

[66:49] B: Bye everyone.

[66:50] E: Another week of cloud news wrapped up. Vault will collect the news. Justin will get the notes. Jonathan will write some code. Ryan will watch the perimeter. And Matt will reluctantly watch Azure. Till next week for AI, Amazon, Google Cloud, and Azure. And hey, maybe even Oracle, who knows? Check out thecloudpod.net for our newsletter. Join our Slack. Message us on socials or leave a review.