What's the best and easiest to use GUI-based CI tool? No Jenkins suggestions, please.

I have used Azure Pipelines in my previous job, and I quite liked it. I'm not a fan of the YAML syntax and struggle to follow what is going on in those files, so a GUI friendly system liked Azure Pipelines is awesome. So, I'm looking for something more or less similar. I'm a Linux + opensource guy, that's why even though I like Azure Pipelines, I prefer to avoid Microsoft products. What other tool could meet my requirements?

https://redd.it/zkn8f0
@r_devops

NAT Gateway or IAM Security Policy for PCI compliance?

Guys, the PCI-DSS consultation team is asking for setting up NAT Gateway but I realized security rules are doing the almost same job for isolating resources as well as load balancer, can anyone suggest if IAM security rules are enough to comply with PCI requirements?

https://redd.it/zkomuw
@r_devops

For those familiar with Terraform CDK: tfcdk vpc module is empty? Yet other modules like "Instance" is not.

Greetings! I am trying to import an existing VPC in order to deploy an EC2 instance using Terraform CDK for Python.

https://constructs.dev/packages/@cdktf/provider-aws/v/9.0.15/api/DataAwsVpc?lang=python&submodule=vpc

​

\^ Using the above reference I want to

from cdktfcdktfprovideraws import vpc

so I can use function:

vpc.DataAwsVpc

However I get an error saying it cannot be found.

I'm using the following cdktf version:

​

>cdktf --version
0.14.3

It seems like most of the functions and classes are missing:

dir(cdktfcdktfprovideraws.vpc)
'Vpc', 'VpcConfig', '__all__', '__cached__', '__doc__', '__file__', '__loader__', '__name__', '__package__', '__path__', '__spec__', '_private'

Yes when I try another common module like the EC2 module its there:

dir(cdktfcdktfprovideraws.instance)
['Instance', 'InstanceCapacityReservationSpecification', 'InstanceCapacityReservationSpecificationCapacityReservationTarget', 'InstanceCapacityReservationSpecificationCapacityReservationTargetOutputReference', 'InstanceCapacityReservationSpecificationOutputReference', 'InstanceConfig', 'InstanceCreditSpecification', 'InstanceCreditSpecificationOutputReference', 'InstanceEbsBlockDevice', 'InstanceEbsBlockDeviceList', 'InstanceEbsBlockDeviceOutputReference', 'InstanceEnclaveOptions', 'InstanceEnclaveOptionsOutputReference', 'InstanceEphemeralBlockDevice', 'InstanceEphemeralBlockDeviceList', 'InstanceEphemeralBlockDeviceOutputReference', 'InstanceLaunchTemplate', 'InstanceLaunchTemplateOutputReference', 'InstanceMaintenanceOptions', 'InstanceMaintenanceOptionsOutputReference', 'InstanceMetadataOptions', 'InstanceMetadataOptionsOutputReference', 'InstanceNetworkInterface', 'InstanceNetworkInterfaceList', 'InstanceNetworkInterfaceOutputReference', 'InstancePrivateDnsNameOptions', 'InstancePrivateDnsNameOptionsOutputReference', 'InstanceRootBlockDevice', 'InstanceRootBlockDeviceOutputReference', 'InstanceTimeouts', 'InstanceTimeoutsOutputReference', 'all', 'cached', 'doc', 'file', 'loader', 'name', 'package', 'path', 'spec', 'private']

Can anyone tell me the issue? :)

https://redd.it/zkp2zo
@r_devops

Really struggling with building a docker container inside of gitlab-ci self-hosted docker-executor

Hi all,

I'm currently struggling with fixing the following pipeline job. I need to build a docker image inside of a self-hosted docker-executor. It's basically docker-inside-docker, but for some reason I just can't seem to get it working. I've gone through the documentation and everything and still can't seem to fix this error:

gitlab-ci.yml

stages:
- dev-docker-build

image: ruby:2.7

workflow:
rules:
- if: $CI_MERGE_REQUEST_ID
when: never
- when: always

job-dev-docker-build:
stage: dev-docker-build
resource_group: dev
environment:
name: DEV
script:
- apt update && apt upgrade -y
- apt install docker ca-certificates curl gnupg lsb-release git -y
- apt install docker-compose -y
- usermod -aG docker $(whoami)
- service docker start
- service docker status
- chown $(whoami):docker $(which docker)
- docker-compose build .
- docker-compose images

The error I get is:

< lots of installing nonsense >
$ usermod -aG docker $(whoami)
$ service docker start
Starting Docker: docker.
$ service docker status
Docker is running.
$ chown $(whoami):docker $(which docker)
$ docker-compose --version
docker-compose version 1.25.0, build unknown
$ docker-compose build .
Couldn't connect to Docker daemon at http+docker://localhost - is it running?
If it's at a non-standard location, specify the URL with the DOCKER_HOST environment variable.

How can I figure out what's wrong here? I've tried using the "already has docker installed" build, but same issue.

https://redd.it/zknv49
@r_devops

pgadmin with okta or paid equivalent

Just curious if anyone here has set up pgadmin with Okta authentication for databases running in RDS, bonus if you've done this with RDS not exposed to the internet. Basically, I'd like to keep my databases in private subnets in a VPC, run pgadmin such that authentication can be handled with Okta (or something similar). I'd like to also restrict the db access to read only.

I would also be open to paying for the above, for a service that makes all of it easy to manage.

https://redd.it/zkqyeh
@r_devops

Presigned URL for multiple files

Im basically creating a presigned URL so internal team as well as third party developers can have access to see the generated test results in a more visual HTML report. The problem im having is because i want to generate a presigned URL for HTML , it will not work properly since I would need to presign the other files needed to process the HTML. Is there a way to do this. Im using AWS S3 if that helps

https://redd.it/zkqysa
@r_devops

Github, Vault, JWT and OIDC setup

Hi
I'm trying to setup a Github Action to get a secret from Vault using JWT/OIDC. I understand the basic concepts of JWT and OIDC, but I'm not clear on how to implement it in my setup.
I have Github Enterprise running inside my network alongside an OS version of Vault.
I've created the JWT role, secret and policy on Vault, but when I try to test the setup it says OIDC login is not configured for the role.

curl --request POST --data @payload.json https://my-internal-vault-server:8200/v1/auth/jwt/oidc/authurl
{"errors":["OIDC login is not configured for this mount"]}

Contents of payload.json

{
"role": "github-jenkins",
"redirecturi": "https://my-internal-vault-server:8200/ui/vault/auth/jwt/oidc/callback"
}

My real confusion is where should the OIDC authorization be taking place? My Github server, Vault or something else?
Or is it just a case of configuring the Vault role to specifically trust the JWT from the Github Action?

https://redd.it/zkt3sx
@r_devops

A single person answered 76k questions about SQL on StackOverflow. Averaging 22.8 answers per day, every day, for the past 8.6 years

https://stackoverflow.com/nocaptcha?s=b5164ff9-20c1-417b-b1cc-2d6faea5f42e

https://redd.it/zku6x5
@r_devops

Container image size; how big is too big?

When you're picking a base image for your container, how much does size figure into your decision?

If I'll be deploying every couple of days, does it matter if I pick the 30MB Alpine image or the 160MB Debian image?

It would be easier to use the Debian image.

https://redd.it/zkwhwf
@r_devops

AWS Lambda tracing with OpenTelemetry and OpenSearch

Here's a pretty detailed tutorial about setting up tracing for Lambdas https://tracetest.io/blog/observability-trace-based-testing-aws-serverless-opensearch-tracetest.

It uses OpenSearch as a trace data store and Tracetest for running e2e tests.

OpenTelemetry recently released https://github.com/open-telemetry/opentelemetry-lambda, but they also have this in the official docs https://opentelemetry.io/docs/instrumentation/js/serverless/. What do you consider to be the better option?

https://redd.it/zl0wqk
@r_devops

Hi r/DevOps! Chris from New Relic here with Umber Singh, VP of Deal Strategy & Monetization, and members of the technical team from New Relic. Ask us anything about K8s, network monitoring, logging, or anything on your minds. AMA!

Hiya, r/DevOps! I'm Chris, developer community manager here at New Relic. I'm here with my pals, u/NewRelicUmber, u/NewRelicMarc, u/NewRelicBrad, u/NewRelicLeon, and u/NewRelicNic, to tackle questions from the community about a handful of topics we know to be important to developers such as yourselves. Ask us anything about Kubernetes, network monitoring, or logging, or really, anything on your mind about New Relic. We're here from 10AM - 12PM PST tomorrow, 14 December, to field your questions, so in the meantime, fire away and we'll see you then!

For those who don't know us, New Relic is where dev, ops, security and business teams solve software performance problems with data. New Relic offers best-in-class tools to tackle your full-stack observability, monitoring, and log management needs. Check us out and get started for free today over at newrelic.com.

AMA!

Proof: https://imgur.com/a/FLMl5yv

(this post approved by the mods of r/DevOps)

https://redd.it/zl2c4e
@r_devops

Windows Based Environments and Single Source of Truth

I'm interviewing for a company who wants someone to come in and help implement good DevOps principals for their Windows Based Environment.
How would one keep a single source of truth in a Windows based environment with AD and version control? Is this even possible?
What does DevOps look like for those that are within these type of companies?

https://redd.it/zl6gj1
@r_devops

Should my CI/CD tool match my cloud provider?

I like using Azure DevOps but our web application is planned to be hosted on GCP. Is there a big difference between using Azure DevOps or Google Cloud Build on GCP? (Other than the normal difference between the two)

I'm mainly trying to understand the benefits of matching a CI/CD pipeline with its native cloud provider in this case.

https://redd.it/zl69wv
@r_devops

Can someone please help me trigger the Azure pipeline on PR acceptance or branch deletion?

I want to trigger an Azure pipeline on feature branches on PR acceptance, branch deletion, or merge (but the pipeline must run on the source branch). I need to do this because I want the predefined variables of the feature branch for the pipeline. For instance, $(Build.SourceBranchName). The Pipeline can run at any stage after all the changes in PR have been approved but the pipeline has to run on the feature branch and not on the target branch. Also, if there is any other way to access the feature branch's predefined vars in pipelines of other branches, please let me know. Thank you!

https://redd.it/zkw8go
@r_devops

aws presigned urls for multitenancy?

I want to have an app where multiple users upload files to a single S3 bucket, process the files and then place them to another S3 bucket where they can download the results.

I know how to do it for a single user but don't know how to convert it to be multitenant. Can I use presigned urls for upload and download so that I can skip the architecture changes?

Is that a recommended solution that is secure?

https://redd.it/zlen3p
@r_devops

Why is DevOps just Ops in 90% of posts here and job openings?

I get it there are two sides and often DevOps are there to deploy stuff but it feels way too one sided what am I missing?

https://redd.it/zlhoyq
@r_devops

New Devops Role

Hello Everyone,can anyone please guide me with the resources required for Devops Engineer role as I am switching into this role but not sure about the resources and courses to learn,also which websites we can refer to for entire Devops Engineer course for free

https://redd.it/zlhmpu
@r_devops

Msp devops shared tools

Hi. In the devops world where a company has multiple products how are the support tools managed ( monitoring, logging, etc)? In theory each team is managing its own stack but sounds unreasonably unproductive to have the same tools deployed over and over again...

https://redd.it/zllhw9
@r_devops

Why using Kaniko for building images when there's more privileged containers in play?

## Context
I've been hearing/studying a lot about Kaniko, but I'm not sure if it makes sense in every scenario.

Most people tend to highlight the security reasons for why running Kaniko is important when needing to use dind (docker in docker).

There are several privileged solutions, for example:

Gitlab-ci with Docker based runners (bind mounted to it's host sock), Portainer etc.

Yes, using Kaniko for building would decrease risks, but only if privileged containers are completely cut from the pipeline.

So, I wonder how you guys evaluate when to use it, and when it does not make sense at all.

## Sources
- https://github.com/GoogleContainerTools/kaniko

- https://docs.gitlab.com/ee/ci/docker/using\_kaniko.html

- https://www.youtube.com/watch?v=d96ybcELpFs

- https://gitlab.com/guided-explorations/containers/kaniko-docker-build

https://redd.it/zlmci2
@r_devops

Do you like being a devops engineer?

I am a devops engineer for the last 7 years now, and I feel like we have to keep learning new tools constantly to keep ourselves updated. This becomes a bit challenging at times.

https://redd.it/zln5r7
@r_devops

Sealed Secrets on Kubernetes with ArgoCD and Terraform

learn how to manage secrets securely on Kubernetes in the GitOps approach using Sealed Secrets, ArgoCD, and Terraform: https://piotrminkowski.com/2022/12/14/sealed-secrets-on-kubernetes-with-argocd-and-terraform/

https://redd.it/zln8co
@r_devops