March 2025 Summaries

On March 14, 2025, a critical supply chain attack targeted the popular GitHub Action tj-actions/changed-files, which is used by over 23,000 repositories, leading to the exposure of CI/CD pipeline secrets in logs. The attackers exploited a compromised GitHub personal access token to inject malicious code into the repository, which resulted in sensitive credentials being printed in public logs, putting public repositories at high risk. The incident, identified by StepSecurity’s Harden-Runner tool, prompted an immediate response from GitHub, including the temporary removal and restoration of the affected repository. The attack underscored the vulnerabilities in GitHub Actions security and highlighted the need for robust security measures such as pinning actions to commit hashes and using read-only secrets in workflows. Organizations were advised to audit logs, rotate secrets, and restrict permissions to mitigate potential risks. Coralogix's team found no compromise in their customer environments but recommended that customers perform their own validations to ensure security.

Coralogix has launched its new AI Center, marking a significant milestone as the first "Cross-Stack Observability Platform" that provides real-time insights into AI applications worldwide. This platform offers comprehensive observability across application, security, and AI technology stacks, enabling businesses to monitor, troubleshoot, and secure their AI initiatives effectively. The AI Center includes features such as an AI Evaluation Engine, AI Security Posture Management (AI-SPM), complete user journey and cost tracking, and performance metrics to ensure high-quality AI environments. This launch follows Coralogix's acquisition of Aporia, which accelerated its development of advanced AI solutions, and aims to bridge the gap from pilot to production for AI teams by providing a centralized management tool for AI performance, quality, and security.

In Istio environments, tracing issues often arise due to the lack of context propagation, leading to fragmented and incomplete traces. This problem typically occurs because services fail to forward tracing headers, causing each service to generate new traces instead of contributing to a single, unified trace. The traditional solution involves manually adding header propagation to every service, which is not scalable for large, microservice-based architectures. To address this, OpenTelemetry offers a zero-code instrumentation method that seamlessly integrates with Istio to automatically inject tracing libraries and ensure proper context propagation without modifying application code. By deploying an OpenTelemetry Collector instance and configuring the Instrumentation Custom Resource, traces become fully connected, providing comprehensive end-to-end visibility across services. This approach not only simplifies the process by eliminating the need for code changes but also enhances debugging capabilities and scalability, allowing teams to maintain observability across extensive service networks effortlessly.

OpenTelemetry (OTel) is designed as an open, flexible, and vendor-neutral observability framework, but Grafana Alloy, despite claiming compatibility with OTel, is critiqued for being a vendor-specific fork that encourages users to stay within Grafana's ecosystem. This vendor lock-in could lead to wasted time, painful migrations, and reduced flexibility due to its reliance on Grafana's tools for storage, processing, and visualization, such as Loki, Mimir, Prometheus, and Pyroscope. Grafana Alloy modifies standard OTel syntax, which complicates integration with other vendors and makes future migrations challenging by introducing proprietary configurations and processing defaults. While Grafana Alloy might function as a collector, its default settings and structure favor Grafana's stack, potentially limiting the flexibility that a pure OpenTelemetry implementation offers. For true OpenTelemetry support, solutions like Coralogix allow users to build observability stacks without vendor bias, ensuring long-term flexibility and control over data pipelines.