Tutorial: Deploy a Kubernetes Cluster with Service Mesh on DigitalOcean Using K3s

I threw together a tutorial on how to deploy a Kubernetes cluster with a service mesh on DigitalOcean. It uses the [k3s](https://k3s.io/) Kubernetes distribution and [Rio](https://rio.io/). The cluster will be a single master, so no HA unfortunately. In the future I'll write a tutorial on how to deploy a k3s HA cluster as well, and how to deploy persistent storage.

I hope someone will find it useful or educational. :)

https://lunar.computer/posts/k3s-service-mesh-digitalocean/

https://redd.it/dsyfcz
@r_devops

Why choose Terraform over Chef, Puppet, Ansible, SaltStack and CloudFormation?

Hi all,

I have this post on [why choose Terraform](https://selleo.com/blog/why-choose-terraform-over-chef-puppet-ansible-saltstack-and-cloudformation) vs \*insert another solution from the title\* and I would really appreciate any comments / thoughts / experiences / possible improvements to it.

Which one, in your opinion, is the biggest Terraform competitor and why? Currently researching this as well.

Thanks in advance!

https://redd.it/dswxc0
@r_devops

Cloudformation not assigning ingress to security group

I have a ALB that I am trying to assign a security group and ingress to. I want 443/HTTPS open only. Currently it creates the SG and assigns it to the ALB but no luck on the ingress. I've tried the below as well as the ingress as it's own resource.

​

ALBSG:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: "Security Group for ALB"
SecurityGroupIngress:
IpProtocol: tcp
FromPort: 443
ToPort: 443
VpcId: <VPC ID>

https://redd.it/dsz52x
@r_devops

S3 error when creating MongoDB stack via quick start
https://www.reddit.com/r/aws/comments/dsr3x5/s3_error_when_creating_mongodb_stack_via_quick/

https://redd.it/dt4ang
@r_devops

What am I missing in my Devops interviews?

Hey all, not sure if this kinda post is allowed, if not please delete.

I am currently a devops engineer and have been for the last 3 years. I started going on interviews again and have been rejected for a couple jobs I feel I had a great opportunity to get. I know this is kinda an open ended question, but what do you all feel are key points to hit on in a devops interview other then Docker/containerization, Kubernetes, AWS (I am certifited), CI/CD, scripting with bash/python etc., etc? Just want to see if there something else I maybe should add to my resume to make myself look stronger or for those answering who are Devops leads, what are things your are looking for?

Thanks for the help!

https://redd.it/dt6oe3
@r_devops

SSL Cert Rotation with Runbook

[https://patrick.ble.si/ssl-cert-rotation-with-runbook](https://patrick.ble.si/ssl-cert-rotation-with-runbook)

&#x200B;

How do you manage SSL certificates? Do you have an automated process? A vendor solution?

https://redd.it/dt1weq
@r_devops

Unable to start openvpn server after install
https://www.reddit.com/r/OpenVPN/comments/dt4uaq/unable_to_start_openvpn_server_after_install/

https://redd.it/dt4y6g
@r_devops

Terraform for provisioning bare metals?

Just read a comment about people using Terraform on bare metals. I thought Terraform was for provisioning on aws and other cloud providers. I know you can write your own custom provider, but I don't see what you would do with Terraform on bare metals.

If you personally use Terraform on bare metal, what are your use cases?

https://redd.it/dtabmo
@r_devops

Kubernetes Multi-Operator Stacks and Advanced Pod Scheduling

Here are some thoughts on how to think about Pod scheduling while developing Kubernetes Operators for multi-Operator environments.

[https://medium.com/@cloudark/kubernetes-multi-operator-stacks-and-advanced-pod-scheduling-c3131dde3755](https://medium.com/@cloudark/kubernetes-multi-operator-stacks-and-advanced-pod-scheduling-c3131dde3755)

Are you using Kubernetes Operators? Have you faced above issues? Would be curious to understand your use-cases in the comments.

https://redd.it/dt21hz
@r_devops

Heroku CI vs GitHub Actions
https://www.reddit.com/r/github/comments/dtbh6t/heroku_ci_vs_github_actions/

https://redd.it/dtblkd
@r_devops

distroless Docker Images - thoughts?

I'm talking about the [distroless](https://github.com/GoogleContainerTools/distroless) project from GoogleContainerTools.

The images are build through [bazel](https://bazel.build/),first time I heard about this build tool but I'd like to get some feedback from people that have actually tried it.

After successfully building the image, you'll end up with *your application* and its *runtime dependencies* (no shell, no package manager, nada).

They have some [examples](https://github.com/GoogleContainerTools/distroless/tree/master/examples) there for dotnet, go, java, nodejs etc.

https://redd.it/dtd2mu
@r_devops

Obfuscation of Javascript

Hi everyone, I made a script ( only for JavaScript obfuscation) which obfuscates your JavaScript code i.e removes the original code and replaces it with the obfuscated code. P.S - You need to have npm package JavaScript obfuscator installed. https://github.com/Shrinidhikulkarni7/Obfuscation

I also wrote blog on the same - “Obfuscation of the code” by Shrinidhi Kulkarni https://medium.com/@davidcesc/obfuscation-of-the-code-8086c9c8b34a

Please feel free to give feedback. I started doing devops work in January and willing to learn more and more as I love it.

Thanks to this subreddit :)

https://redd.it/dtevs8
@r_devops

From Dev to DevOps what about networking ?

I started as java/jee developer two yars now i switched to DevOps,i've been handling at first jenkins pipeline git flow bitbucket jira administration and docker and too many times i've been stuck with network issues or misunderstanding of some network concepts . Now im just wondering should i go back to network courses to fully understand it or just concenrate on networking parts of DevOps tools ?

https://redd.it/dtj9ap
@r_devops

Wanted: Version Control System with Encrypted Central Repository and Individual File Check-out.

The company I work for produces a large number of commercial apps available through the Apple Store, and that involves managing a large number of certificates, with fairly long lifetimes (between one month and one year) from Apple both for sales (the app must be signed to be sold, after all) and for push notifications. We'd like to further secure our build pipeline, and one of the requests is for a VCS that has an encrypted central repository and individual file check-out.

We're not sure how to achieve this. Thus far, the best we've got is to keep the certificates on an in-house resource with encrypted drives, and have one GIT repo per certificate, and to lock access on a per-repo basis only to the teams that need to build their particular app. That feels kludgey and unreliable.

How do you manage third-party app certificates in a way that's both secure and (relatively) convenient to a diverse number of development teams?

https://redd.it/dtiqsz
@r_devops

How to sclae OsX builds?

Hi all! I'm almost 1.5yrs into my position as a DevOps engineer at a large company. I was lucky enough to get this gig straight out of college. I know I'm not anywhere near close to knowing all I need to know in this discipline but I'm learning more every day.

Currently, we have an application that we build on macOS, Windows, and Linux. For Macs, we currently have a bunch of minis sitting in a data center and our Jenkins master will target an available mini to run a build on (a very simplified explanation but that's pretty much the gist). My issue is, I don't think this method is scalable. We have more and more developers coming on every year so we have to buy more minis to keep up with the demand. We've thought about using Macstadium but from testing, we've seen our build times almost triple. I've been trying to do research into finding a scalable solution, preferbly with cloud tools, but I'm coming up empty.

Any ideas or advice would be greatly appreciated!!

https://redd.it/dtkfbp
@r_devops

How would you bundle many applications within kubernetes. Service mesh?

I'm just wondering if it's a good idea to manage a high number of applications running on their own scaling up and down and each of them connecting to each other all on plain kubernetes. Or maybe using a service mesh would be a better fit?

https://redd.it/dtjztd
@r_devops

Budgeting question for devops leaders

How do you go about forecasting budget for your cloud spend and what metrics are you using to make those estimates?

Are you 100% usage driven? How to you estimate and account for new features in a coming year that aren't yet planned? Having the moment to moment flexibility is nice, but finance folks still want annual budgets and want teams to stick to those budgets. Obviously if there is a good reason (business growth) the finance teams are happy, they just want to understand the why when it comes to overages, but things get complicated when you're in the millions of dollars in spend across hundreds of deployable assets spread across dozens of teams with no concept of 'chargebacks' in place to hold any team accountable.

https://redd.it/dtm5z6
@r_devops

Employer changed Stock options vesting policy

My offer letter said my 5k stocks would start vesting after 6 months, then every 6 months after that. I worked at the company for 10 months and didn't like it, so I started looking for another job and got one.

When I talked to the COO about it, he said they changed to policy to start vesting after one year. Then basically said there's nothing I can do about it.

So, is there something I can do about it?

https://redd.it/dtmsc9
@r_devops

Sources for a really deep dive into containers?

I’m looking for some reading material that shows exactly how containers work, in depth. Not a how to, but a pretty low level explanation. Can someone recommend me something?

https://redd.it/dti2lo
@r_devops

Ansible's log_plays callback plugin doesn't log the TASK banner, possible to get that functionality?

Ansible's log_plays callback plugin does exactly what we're looking for, logging of all the play results per hostname into its own separate file. However, the output cuts off the "TASK [Here is the name of the task]******************" portion for each task. Has anyone encountered this and changed the plugin to achieve this, or know of a plugin and/or configuration that achieves that per hostname logging but would give us the TASK banner portion?

https://redd.it/dtfz6r
@r_devops

Containerization Security Challenges

what are the container security risks that is commonly faced and any recommendation for precautions?

https://redd.it/dtfc7n
@r_devops