What is the best approach to serve high bandwidth traffic with AWS NAT Gateway

I want design AWS architecture like this, but not sure how to handle high bandwidth (>100GB) traffic.

A kubernetes cluster with lots of microservices , both frontend and backend. An LB in front of the worker nodes. K8s replica can scale high bandwidth traffic.

My question is where should I create the Kubernetes cluster? I know there is no bandwidth constraints in Public subnet, but AWS NAT Gateway has bandwidth constraints. What is the approach by big companies to serve high bandwidth through NAT Gateway. Or should I put my K8s cluster in public subnet itself.?

Any help is appreciated .Thanks

https://redd.it/eaacua
@r_devops

Does AWS come with a load balancer or do I have to build one myself?

I was wondering whether if AWS comes with a load balancer. If not, I was thinking about using NGINX but also I would like your opinions on which do you think is cheaper and easier to set up an maintain?. Opinions are welcomed.

https://redd.it/eaelgv
@r_devops

[blog] Shadow requesting for great good

[https://medium.com/carwow-product-engineering/shadow-requesting-for-great-good-92cde331363a](https://medium.com/carwow-product-engineering/shadow-requesting-for-great-good-92cde331363a)

https://redd.it/ebdaky
@r_devops

How to use multiple Docker containers to set up Jenkins agent in Jenkins pipeline?

The following snippet is an example provided by Cypress, a Javascript testing framework that I'm using. Here is the [link](https://github.com/cypress-io/cypress-example-kitchensink/blob/master/Jenkinsfile) to the Github page.

pipeline {
agent {
// this image provides everything needed to run Cypress
docker {
image 'cypress/base:10'
}
}

stages {
// first stage installs node dependencies and Cypress binary
stage('build') {
steps {
// there a few default environment variables on Jenkins
// on local Jenkins machine (assuming port 8080) see
// https://localhost:8080/pipeline-syntax/globals#env
echo "Running build ${env.BUILD_ID} on ${env.JENKINS_URL}"
sh 'npm ci'
sh 'npm run cy:verify'
}
}

stage('start local server') {
steps {
// start local server in the background
// we will shut it down in "post" command block
sh 'nohup npm run start:ci &'
}
}

// this stage runs end-to-end tests, and each agent uses the workspace
// from the previous stage
stage('cypress parallel tests') {
environment {
// we will be recording test results and video on Cypress dashboard
// to record we need to set an environment variable
// we can load the record key variable from credentials store
// see https://jenkins.io/doc/book/using/using-credentials/
CYPRESS_RECORD_KEY = credentials('cypress-example-kitchensink-record-key')
// because parallel steps share the workspace they might race to delete
// screenshots and videos folders. Tell Cypress not to delete these folders
CYPRESS_trashAssetsBeforeRuns = 'false'
}

// https://jenkins.io/doc/book/pipeline/syntax/#parallel
parallel {
// start several test jobs in parallel, and they all
// will use Cypress Dashboard to load balance any found spec files
stage('tester A') {
steps {
echo "Running build ${env.BUILD_ID}"
sh "npm run e2e:record:parallel"
}
}

// second tester runs the same command
stage('tester B') {
steps {
echo "Running build ${env.BUILD_ID}"
sh "npm run e2e:record:parallel"
}
}
}

}
}

post {
// shutdown the server running in the background
always {
echo 'Stopping local server'
sh 'pkill -f http-server'
}
}
}

My goal is to have a Jenkinsfile that is very similar to the above because I want to have parallel Cypress testing as shown in the above snippet. In the example above, the Jenkins agent is simply the official Cypress Docker image `cypress/base:10`.

agent {
// this image provides everything needed to run Cypress
docker {
image 'cypress/base:10'
}
}

However, for me to run all my tests with my own database, I need to spin up two separate Docker containers. One container contains the front-end portion of my web app and the other container contains the back-end portion of my web app.

Below is the Dockerfile for my front-end container, which is located in `my-app/docker/combined/Dockerfile`.

FROM cypress/included:3.4.1

WORKDIR /usr/src/app

COPY package*.json ./

RUN npm install

COPY . .

EXPOSE 5000

RUN npm install -g history-server nodemon

RUN npm run build-test

EXPOSE 8080

Below is the Dockerfile for my back-end container, which is located in `my-app/docker/db/Dockerfile`. All it is doing is copying some local data into the Docker container and then initialising my MongoDB dat

abase with this data.

FROM mongo:3.6.14-xenial

COPY ./dump/ /tmp/dump/

COPY mongo_restore.sh /docker-entrypoint-initdb.d/

RUN chmod 777 /docker-entrypoint-initdb.d/mongo_restore.sh

Usually, I would use `docker-compose` and the following `docker-compose.yml` file to spin up these two containers. As you can see, the front-end container called "combined" is dependent on the back-end container called "db".

version: '3'
services:
db:
build:
context: .
dockerfile: ./docker/db/Dockerfile
container_name: b-db
restart: unless-stopped
volumes:
- dbdata:/data/db
ports:
- "27017:27017"
networks:
- app-network

combined:
build:
context: .
dockerfile: ./docker/combined/Dockerfile
container_name: b-combined
restart: unless-stopped
env_file: .env
ports:
- "5000:5000"
- "8080:8080"
networks:
- app-network
depends_on:
- db

Below is the docker-compose command I would use.

docker-compose up --build

**I would like my Jenkins agent to be the** `combined` **container; however, I need the** `combined` **container to connect to my** `db` **container, which needs to be spun up. My question is, how do I achieve this in Jenkins pipelines? I've read** [this documentation](https://jenkins.io/doc/book/pipeline/syntax/)**; however, it doesn't mention anything about using multiple Dockerfiles to create a Jenkins agent. Is something like this possible and could someone please show me what my Jenkinsfile should look like in order to achieve my goal?**

https://redd.it/ebeu8d
@r_devops

Question about restricting access to GCP by IP and how that works with API's

Hi All,

I'm a sysadmin / IT Manager so this is a bit out of my depth. Please feel free to lynch me and chuck me out if I've inadvertently got the wrong group.

Basically, in my last job, we had a full tech team including CTO, HoE, etc so I never had to get involved over and above making sure they had a computer and an internet connection. They built an app hosted in AWS with a backend database for adding users that could only be accessed via the main office IP address for obvious security reasons. It was all self contained. Brilliant.

In my new job, they are just starting to build and app for generating reports from social media specific to their requirements. Locally this has all been fine, now they want to push it to GCP, again fine.... But as there is no real tech team here, just a singular front and back ender learning as they go, they are now asking for my advice around security.

My assumption is they should lock it down the same way, however if they do that will it stop the api's from the various social channels talking to the service? Or if the call is made from inside does it pass it through OK...

No idea, sorry guys, but your advice is greatly appreciated in advance

(even typing this makes me feel dumb)

https://redd.it/ebg4xw
@r_devops

Lifecycle management: versioning and vulnerability tracking of your tools, applications, containers and more

Every project has tools, applications, Docker containers and more that are used. All of these need to be regularly updated for feature completeness or security and compliance reasons. Some teams use paid systems to track this information but more than often this is checked manually now and then and in the worst-case versions are checked barely. The reason why this is such a tedious task is that most of the time manual labor is required.

To help with this I have created an open-source project that can track automatically current versions that are being used in your project. But it can also tell you if there are new versions and if your containers are vulnerable. If you are interested please have a look at [https://github.com/arminc/k8s-platform-lcm](https://github.com/arminc/k8s-platform-lcm)

I hope this tool can save you time and give you faster insights in what needs to be updated.

https://redd.it/ebjp6d
@r_devops

Using Node.js to Write Safer Bash Scripts

Hey everybody,

This is an article I've written about how and why we're wrapping our Bash CI/CD scripts with a more modern language. In our case, since the entire company programs in JS, we use Node.JS. You could just as well use Python or Java if so inclined.

https://medium.com/getvim/using-node-js-to-write-safer-bash-scripts-ad6a523a5324

https://redd.it/ebcjyn
@r_devops

Microsegmentation --> 0 trust

Interesting (albeit loaded) read.

I never thought of microsegmentation and 0 trust to go hand in hand, but it seems if leveraged correctly they can. The article says doing so may have some technical challenges, curious as to what they are.

https://redd.it/ebfnxn
@r_devops

Big Data learning curve too big? New Job

Background: I'm a Linux/Unix admin with over 5 years of experience. Been stuying a lot about DevOps metodology and its tools, such as: Docker, Kubernetes, Ansible, etc.

I've been offered a job opportunity that involves managing Cassandra, Spark and Kafka(Big Data I believe).

I don't have much knowledge about these tools(And thats what I told the company). However, they seem to really like my profile and told me that if I promise to take some courses, I'm pretty much in. I'll be studying while on the job.

I really think this could be a good opportunity to learn more about DevOps and getting some experience.

​

Do you think the learning curve is too big? This is not an entry level job. The position is ITops Architect. If no, where should I start stuying, Cassandra, Spark or Kafka. Or the three of them at the same time.

https://redd.it/eblyfk
@r_devops

OSS Scanning for Conda and RStudio/Cran

Anyone working with data scientist out there and have a need to scan R and Cran packages? As well as Conda?

I’ve been looking into Tidelift and Blackduck. Both do 75% of what we are looking for but the lack of Cran package scanning is apparent in all OSS scanning utilities.

Anyone else have any insight?

https://redd.it/eblpaq
@r_devops

Where in process to perform static analysis?

Hey /r/devops, I am in the process of implementing SonarQube in our environment to do some automated quality checking on our projects. Our release process consists of using 3 git branches, one for raw development, one for preparation of release candidates, and then a release-only branch. Would you recommend having the quality scans run for every development build? Or would it be better to scan release candidates and do remediation as part of the release process? I'm as much interested in specific advice as I am in generating discussion in this thread!

https://redd.it/ebley4
@r_devops

Short summaries of main concepts of DevOps

Tomorrow is my first interview on a DevOps position. Maybe exist short summaries and concepts of devops, CI/CD, and so on, to read, and reprat main ideas and main moments? Or frequent questions on interviews?

https://redd.it/ebhxr5
@r_devops

Reducing risk by deploying clusters with different configurations

Hey all,

We are currently engaged in an effort to increase the reliability and resiliency of our kubernetes clusters. We currently ensure high availability by deploying 2 identical EKS clusters in 2 separete AWS regions (both configured for multi-AZ), backing them up using Velero and monitoring them extensively with Prometheus and other similar tools.

We are currently toying around with the idea of deploying one of the clusters with a different configuration to ensure a bug in either configuration doesn't bring down our entire production environment. The first idea that popped up is using kops for one cluster and EKS for another.

The pros of this approach as we see it is reducing the blast radius of any bug that might hit either configuration, retaining full control on the cluster we manage and keeping the current body of knowledge we've accumulated running our own clusters up to date (as we've been managing our own clusters for 2 years before moving to EKS a few months ago)
The cons are the increased effort required to maintain 2 sets of clusters, being limited only to the features available for both configuration sets and lack of proficiency in either configuration.

My question is - have any of you encountered use-cases of companies deploying multiple sets of infrastructure in order to reduce risk?

P.S I'm well aware of companies choosing to deploy multi cloud workloads, but I was under the impression that even when choosing such an approach the goal is to try and abstract these changes as much as possible to try and minimize the price of these multiple configurations, or choose specific solutions that are only available on certain clouds.

https://redd.it/ebj1ym
@r_devops

What do you think of Kubernete's documentation?

I find it a PITA. Even AWS documents is better than this one. Maybe that's just me though.

https://redd.it/ebhiqf
@r_devops

Can I build a Jenkins Multi-branch project in scripted pipeline?

So, far I have not found any example of a Multi-branch project written in scripted pipeline and I wonder if it is supported.

Why am I asking this?
I'm trying setup a production Jenkins environment where Jenkins master runs the both CI and CD on a remote docker host, in docker container, and there seems to be no support for that in declarative pipeline.

https://redd.it/ebdk0s
@r_devops

Concourse CI Multi-branch Pipelines

Is it possible to support multi-branch builds/testing in Concourse CI? I don't mind auto-creating new pipelines and grouping them, but I do need to figure out how to support testing, building and deploying dynamically against different branches from a git repository.

Currently, what's the best way to go about this? Or is this fundamentally opposed to Concourse CI's philosophy that it isn't possible? I've also read that spatial resources are in the roadmap - do I just need to wait on those?

https://redd.it/ebqul3
@r_devops

Azure Devops pipeline - queue jobs?

Hi,

I have some pipelines as code in Azure Devops - how do I allow an invocation of the pipeline per commit to a branch, but to queue that invocation until a previous run on different branch is finished? `batch : true` seems to only work within a given branch, allowing runs to cancel so the new changes can be used - I need it to queue per branch.

Cheers!

https://redd.it/ebsorv
@r_devops

Feeling mentally drained after work and Lack of motivation to go workout

As Developers sometimes fitness feels not very congruent with our lifestyle, work. I have recently decided to help developers with their fitness and start my consulting company and I'd like to learn more about their problems. One of the issues that people report me again and again is the lack of motivation. They tell me that this is due to being sedentary and working long hours (sometimes coupled with commute.) Looking at the screen for hours definitely effects mental energy and it is often common for me to find myself feeling drained, without energy to workout or to cook healthy etc.

What do you guys think about this issue, are you facing the same challenge when it comes to fitness that is lack of motivation ? Knowing that you should do something about it but lacking motivation. Or do you have some other issues you are dealing with, please go ahead and share, I'd like your feedback.

PS: I said developers because I'm a developer myself and I can relate to them better as I have the same lifestyle but any other profession is welcome to contribute. Thank you for reading/replying!

https://redd.it/ebrpi1
@r_devops

A question on the container image lifecycle

I've had this question on my mind for a while. We currently build (and re-build) container images from the same source in each of our different environments. Feature and Dev build all the time when a target branch is updated, Testing gets built when we have a targeted release, then staging gets built when testing passes, then prod gets built when staging passes. Each image is tagged `X.Y-env`

The images from Testing up to Prod are essentially identical since they're built from the same source. I've wondered if this was massively wasteful since we could just push a new tag on the same image/digest as the environments pass.

On the other hand, it's a security concern that passing an image that a tester had their hands on to production effectively elevates that tester's access to production. In our case, we have to be in compliance with several security standards since we have some public sector clients.

What's the "best practice" way to handle images per environment? Is there any way to reconcile this inefficiency with a security-conscience approach?

https://redd.it/ebqu7q
@r_devops

Bitbucket --> Jenkins trigger – Infrastructure As Code

IAC – Infrastructure As Code.

I'd like to create Bitbucket hooks to trigger Jenkins jobs. But all the ones I've seen can only be created through the UI.

Does this exist? If not, would anyone be interested in developing such a thing?

https://redd.it/ebno75
@r_devops