Upcoming Project - Is Kubernetes the right choice?

I am currently tasked with building some automation around enduser's requesting the provisioning of a long-lived Amazon Linux/Windows Servers in our AWS environment.

These servers will host a wide range of services for customers e.g. file storage, database server, etc. This service is primarily a "We give you the Infrastructure. You do what you want with it".

Would it beneficial to develop the infrastructure around Linux/Windows containers in a Kubernetes cluster via AWS EKS?

Or would it make more sense to spin up long lived EC2 instances and manage them that way?

Thanks!

https://redd.it/efdf0w
@r_devops

Remote Devops/Cloud Engineer Job Possible?

Its been around One year since I have been introduced you cloud(Google cloud platform) since then I have been building my skills at up till now i Knows quiet few things about GCP and Aws other that this I also knows Docker,Linux,And kubernetes planning to take certification of Google cloud Associate Cloud engineer Next month.
My question is,
Is it possible if I have mastered this tools and script in languages I'll land a remote job if I'm fresher and not live in US?

please comment (Thanks)

https://redd.it/ef8ssk
@r_devops

Alerting when a GCP instance fails

This article shows a way to turn Stackdriver logs into mobile notifications (with a non-Google notification tool). Particularly useful when dealing with VM being restarted, and also potentially useful for any other kind of logs-to-notification.

https://medium.com/@cmaster11/alerting-when-a-gcp-instance-fails-c6cc3d60ff7

https://redd.it/egnp01
@r_devops

IAM Role for CloudFormation

I have a requirement to create an IAM Role for CloudFormation. I found a great document in AWS showing the IAM policy needed: [https://aws.amazon.com/blogs/devops/aws-cloudformation-security-best-practices](https://aws.amazon.com/blogs/devops/aws-cloudformation-security-best-practices/) What would be best practice for configuring the IAM role that it should be attached to though?

https://redd.it/eglk5b
@r_devops

Is there a "friendlier" tool to replace saltstack in our infra? (details inside)

Our infra is a combination of cloud servers plus multiple servers at our clients office's that we manage.

Therefore we need to manage both our cloud + "bare metal".

Because of this combination and my past exp, I went forth with SaltStack.

We prepare the client machines in house and then they become salt-minions and managed using salt.

Our cloud is setup as well using saltstack.

\---

The problem?

\- It doesnt feel 2020 (almost), although saltstack does what I need it feels there is room for improvement

\- learning curve. We are hiring and the problem is that we either need to look for hires with existing knowledge of salt or wait for them to catch up.

\- Shouldnt there be a more "user" friendly tool out there?

\- the client machine's run containers only - but we dont have the ability to "see" those machines as simple containers that we deploy to, they are still servers that SaltStack manages.

​

Let me know what you think.

https://redd.it/egq946
@r_devops

Phoenix project: this book still worth buying?

This is a quick question, I'm planning to purchase some books and I was considering this one, it still worth it?

https://redd.it/eggwyg
@r_devops

Could someone please share your insights/thoughts on my IT certification roadmap for 2020-2021?

Hi all,

I have created a roadmap for certifications to make in the 2020-2021 years. Please check the roadmap here: [https://imgur.com/rty1SwS](https://imgur.com/rty1SwS). The **red-color highlighted are the exams I am planning to appear for** and blue color highlighted are the ones I would do side learning but will not take the final exam.

Why do I keep the blue color highlighted ones if not take the exam? because I want to gain knowledge by preparing for free practice tests and going through the exam syllabus hot topics.

**A little bit about myself:** I used to be a Software Developer for the past 5 years. Mostly doing JavaScript, so limited knowledge on computer networking, hardware, and infrastructure side. I must also mention that I have intermediate Linux knowledge as a home Desktop user (not Linux server experience). I recently transitioned to the DevOps Engineer role in my organization. It is an enterprise company with many job opportunities, so I took my chance to upskill and try something I have not been doing. As DevOps Engineer, we work a lot on AWS, Linux, sophisticated server tech, VMWare, etc, etc.

**How is it so far**? I see that I lack Networking knowledge and server-level knowledge. I feel like some colleagues are speaking in Chinese because I can't follow the jargon they use at DevOps work.

**How can you help**? The roadmap posted is something I came upon my own after lurking on this subreddit. I am assuming some of the certifications I want to appear (marked in red) are duplicate or do not fit well with others. For example, I am not sure if RHCSA makes much sense because I run Linux at home and on top, I want to do VCP-DCV. And, I need your help to point out which ones.

**About certifications**: My company is supposed to sponsor for the exams but it depends on how much I can convince my supervisor, but the plan is to do the red ones in 2 years time frame. So, I am hoping it to be doable.

**What is my end goal?** I want to be a professional AWS solutions architect. I thought doing the red highlighted certifications will complement the AWS cert learning.

https://redd.it/egghk5
@r_devops

SPA application deploying independently of backend. Woke up a lot of missunderstanding on my side. Need bunch of opinions.

I'll try to explain clear. But might update the question if it is needed.

I work as a sysadmin/devops guy, freely I can say Junior role.

Our work is outsourced projects and we do not get to build a "product", these are usual jobs in my part of the world, Eastern Europe. Basically some guy that gets the customers and big part of the cake in US sends us some money and our comrade boss gives us paycheck. That said, projects are between 2 - 6 months and mostly are handed of to US client after that, either he spent money on an idea and sell it or just does not care any more.

Having that in mind, we got rather small project as a demo to our new client which will bring us more work afterwards. My though was to try something "new", at least new to us. Since it would be SPA app with additional native mobile work, I thought it would be a good idea to split frontend from backend completely.

My pros were in general that we can have independent deploys and faster deploys. And the project is small enough to test how it will go.

Some things were already known to us, like CORS issues. So that was not a "CON" side. I guess CORS is not an issue.

Me as a devops guy setup simple CI/CD and had all working fine. Frontend was loading from a main domain **OUR-FRONTEND.COM** and backend was **API.OUR-FRONTEND.COM**.

That was all good, but main developer now wanted to try another "new" thing and that is **httpOnly** cookies with same domain. That said my suggestion simply won't work. We reverted back.

**Question:** How can be achieved that frontend can still be developed, deployed and hosted independently of backend this way?

https://redd.it/egi63r
@r_devops

can i use line command in each task ansible?

I have 5 tasks in yaml file including lineinfile task. In line in file task, the line command prints the data in a file. I want to know how to use line command in each task under msg command instead of creating line in file in a separate task.

https://redd.it/egg6oj
@r_devops

What is the best way to answer "Describe your background question" for a DevOps position?

I come from a Senior Linux System Engineer background and would like to transition to a DevOps role. I am having a hard time getting an in-person interview after the initial one-hour phone screen? I do have significant cloud knowledge, I worked 3 years at an IaaS company like Digital Ocean, and have used Python, Bash, CI/CD Pipeline tools, Ansible, Puppet, and Docker, as well as provide T2/T3 support to clients via a ticketing system. What am I doing wrong?

https://redd.it/egsogy
@r_devops

Should I be looking for non-junior roles now?

Hey all!

Currently I graduated a year and a half ago and was very fortunate enough to jump straight into a Junior DevOps role and I've been there since. However, the company I currently work for is moving to another city (In May), and I'm adamant on staying where I am for various other reasons. Now when I'm applying for new roles in May, I would have accumulated just shy of 2 years experience as a DevOps Engineer.

Is it naive/complacent of me to stop looking and applying at Junior roles and apply for normal DevOps engineer positions? Or should I strictly be applying to junior position until a certain point etc.

The only reason I ask is that I want to be sure going through the whole, learning everything from scratch and being taught everything from ground up again (like my current did for me) is the best thing to do in my position.

NB: I know judging experience by years working is not an accurate indication of how good someone is, but the question is just for some general advice for those of you who have been in the industry far longer than I have.

​

Thanks!

https://redd.it/egtumq
@r_devops

Cors issue

I have run into a cors issue that doesn't seem to want to work, I have a Vue.js application which connections to the backend (node.js), front end is \`app.example.com\` and the backend is \`api.example.com\`

The backend has cors enabled on the api gateway which works fine in testing locally which leads my to believe it's an issue with the kubernetes deployment or maybe aws setup.

I am using Kubernetes with the nginx ingress controller to host the api with the front end on s3 as a static site. I have this anotation added to my ingress controller though I added it after creation.

nginx.ingress.kubernetes.io/cors-allow-origin: "https://app.example.com"

​

My ingress controller is an AWS ELB which is created by my ingress resource.

​

Anyone have a suggestion on what I can try? I've done a good bit of google time and came up short past enable cors on the backend (did before issue), enable cors on the bucket (not sure it's needed since I have no issue connecting to the front end just sending to the backend) as well as adding that anotation to the ingress controller and applying that

https://redd.it/egur1f
@r_devops

Thinking of starting a new project - Cloudformation Governance

Hi,

Thinking of starting a new project to plug into a CI pipeline for CloudFormation. Thinking of putting together functionality to parse an incoming cloudformation script to enfore governance rules i.e [0.0.0.0/0](https://0.0.0.0/0) ingress, port 21, tags missing etc. Closest anology (and inspiration) is Sentinel Framework from Hashicorp.

First off, useful?

Second, trading off simplicity of implementation and use vs. flexibility - go for a command line utility with pre-defined rules (but designed in a way to make it \*relatively\* easy to add rules) vs something more like Sentinel where it is all written as psuedocode?

Tom

https://redd.it/egtai9
@r_devops

Making my own PaaS (some thoughts and questions)

First of all, hello and happy holidays.

I'm not much of a system admin or a devops, I'm a developer who knows a little about how devops stuff works. Because I did deploy a lot of projects I've done. Thanks to my friend who runs a PaaS startup and thanks to docker! But I was thinking about starting a PaaS startup myself. I thought I pay much less (compared to the time I had to rent a VPS and probably hire an admin to deploy the damn thing) and I earned much more (less deployment time and money meant more projects of course) and that's too freaking economic.

So, I did a little search and found Dokku. It seems this piece of software is very minimal. I am looking for something similar, but with a proper accounting system or something, then I can give people services they need, just like my friend.

Is there anything available?

P.S : I'm not asking him for the tool, because I did it once. They developed the tool themselves and they don't share the codes.

https://redd.it/ege12s
@r_devops

Critique my Terraform setup for a single tenant application.

We run a single tenant application in AWS, where for each client we sign on, they get there own set of infrastructure.

On the AWS side, i'm planning on using an organization & having an account for each client.

Each clients infrastructure should be nearly identical, minus configuration differences, like auto scaling group size for example.

What i'm planning on doing, is

- having a set of versioned, generic modules for each piece of the infrastructure, ie database, backend app, networking, security groups
- having a set of live, environment modules that use these generic modules to create a set of infrastructure & set specific configuration.

Specifically for production, i need to have a set of infrastructure per client. So to avoid code duplication & ease updating the modules, i am going to create a base production module, that imports all of the generic modules. Then a module for each client that uses this base production module & configures the remote backend, sets all of the specific variables & so forth. The idea is this should solve the issue of having to update a ton of client production modules when changing infrastructure.

Thoughts? Does anyone see any possible issues with this?

https://redd.it/egdcwm
@r_devops

AWS autoscaling help.

If I have a server running heavy application server like WEBSPHERE APPLICATION SERVER or WEBLOGIC server will AWS be able to create new instance and distribute the load to newly launched server? Installation of light weight applications like Jboss or tomcat is easy but not WAS etc. that’s my dilemma. Thank you.

https://redd.it/egb5ln
@r_devops

Trouble recording videos

We have cameras which stream video. And for every user session, we record the video.
I have a video streaming service (using node-media-server), onto which the camera streams the video all the time. And there is another recording service. Whenever a user performs an auth operation (logs in), I spawn a process from the recording service, and create a write stream. When the user logs out, I kill the spawned process in which recording was happening , and I upload the video to google storage bucket.


My problem is with videos of 0 bytes. It seems be happening thrice out of 50 times, on average.

The problem starts when the pod restarts. I just have a single pod. ( which is enough for my cpu and memory requirements. I just have 20 cameras currently from which I stream) . Also, there's this constraint, that if I were to have 2 pods one on VM1, and the other on VM2, then I would need to know which VM (or pod) the process will be allocated. I think in the very near future, I will have to increase the number of pods, and I'll face this problem very soon.


Whenever the pod restarts ( due to reasons that are still unknown to me. I have checked the containers audit logs to find out why my pod restarts, but that didnt help me much, also the resources I have requested are sufficient for my load) and if there are any processes in which recording is actively happening, they will be lost. And my recordings fail. I believe this is the reason why I see those 0 bytes videos.


How do I ensure that if at all the pod restarts, the active processes should not immediately be killed. Or maybe, if there's a way to delay the pod restart until the current recording finishes ( i highly doubt if this is possible tho).

https://redd.it/ega99j
@r_devops

What's your DevOps elevator pitch to non-tech family and friends this holiday season?

Title. Family Christmas party tonight so I have to be prepared.

https://redd.it/ef8g5m
@r_devops

Hosting Wordpress On Azure (Step by Step Tutorial)

In this [tutorial](https://youtu.be/api6HM4kpWc) we will deploy a WordPress blog on to an Azure App Service for Linux. Though there are many ways to deploy WordPress on Azure like deploying bitnami WordPress and WordPress for azure, we will go on traditional web deployment approach to have full control over the app resources on Azure.

Steps:
1 Create App Service (Linux) 00:19
2 Create MySQL Database Server 03:14
3 Access Secure Shell (SSH) 07:30
4 Deploy WordPress 09:20
cd /home/site/wwwroot
wget -c https://WordPress.org/latest.tar.gz
tar -xzvf latest.tar.gz
mv WordPress/* /home/site/wwwroot/
rm -rf WordPress
rm -rf latest.tar.gz
5 Connect Azure MySQL Database from MySQL WorkBench 10:15
6 Create a Database for WordPress Application 13:02
7 Configure WordPress Installation 13:42
8 Scale Up/Down App Service Plan 18:47
9 Configure SSL for WordPress on Azure (Important Step) 19:53
9.1 Enable HTTPS only Protocol On
App Service -⫸ Settings -⫸ TLS/SSL Settings -⫸ Under Protocol Settings -⫸ Switch HTTPS only flag 'On'
9.2 Install Really Simple SSL Plugin for WordPress
In WordPress admin dashboard, go to add plugins and install Really Simple SSL plugin
In Really Simple SSL Configuration click on Go ahead, activate SSL
In settings Enable WordPress 301 redirection to SSL

https://redd.it/ef62m2
@r_devops

Handling canary environment in k8s

Hey all,
How do you handle a canary environments in k8s?
I tried nginx-ingress(which I already use it) with it's canary option but I couldn't configure sticky session as well, I saw many issues on this.
So, how you do it?
I'm looking for a solution that will not require any code manipulation if that's possible.
I saw Istio but this is such a large solution for my simple problem.

https://redd.it/ef5a44
@r_devops

Devops Career suggestion needed !

Hello everyone
I want build my career in devops and currently a job based on Linux and monitoring is offered to me so should i go for it for the sake of experience so that i will no longer be a fresher
Because earlier i have applied for multiple devops position and got rejected because i had no experience in the field
( I'm RHCSA,RHCE, OPENSHIFT, ANSIBEL certified )
Or
Should i wait for right opportunity ?

https://redd.it/ef4sff
@r_devops