Security advantages of a pull-based CD pipeline

I feel pull-based CD pipelines are under-appreciated and have a lot to offer on the security front.

I wrote a blog post detailing the risks associated with your traditional CI/CD tools and how adopting GitOps practices for Kubernetes (for example, with flux) increases your security posture, removing some attacks paths that threat actors may wish to abuse.

I then argue that this idea needs to be taken a bit a further and extended to the rest of the pipeline.

Would love to get your feedback on these ideas and discuss it here:

https://medium.com/@alexkaskasoli/pull-based-cd-pipelines-for-security-4e044b403f56

https://redd.it/ekuvlm
@r_devops

What are your 2020 projects?

New year, new work. We all have to keep busy to improve the production environment. So what projects do you have lined up or would like to attempt? We're looking at getting more into terraform and serverless on our end. Maybe look at new APMs.

https://redd.it/elcg4w
@r_devops

Looking for an actual comparison between configuration management tools

I am setting up myself a homab, and I want to centralize the configuration of my VMs (tens, not thousands) . There are countless articles of chef vs puppet vs ansible vs salt, but what I'm really looking for is a side-by-side comparison of the of the syntax of these tools.

For example, Im looking for a resource which shows the same configuration files for each of these tools so I can compare what Ill actually be writing.

I'm mainly looking at salt and ansible right now since I like the idea of running agentless. But, in regards to ansible I'm concerned that the configuration is strictly in yaml while salt allows templating through jinja. Is this something I should be worried about or is ansible considered powerful enough that it wouldn't matter?

I know this question gets asked all the time, but I was hoping to get a little more insight on side-by-side comparisons between the actual configuration of these tools as opposed to a list of pros and cons or a table comparing agentless / configuration language / etc

https://redd.it/elc289
@r_devops

Developers: How did DevOps change your working routines?

Hello Fellow Redditors and Developers,

I would like to collect and discuss the impacts of DevOps on your working routines. Any experiences, either bad or good, failure or success, are welcome! Especially I\`m interested in pitfalls, which you encountered and how you would bypass them in retroperspective. E.g. What advice would you give fresh DevOps-Engineers focusing on development?

Some question do get us going:

How did continous feedback improve your software?

What delusions did you have and how did they stand "the test of time"?

Do you think more about Operations? If yes, what aspects?

What anti-pattern did you encounter?

Im thankful for any comment. Let's have fruitful discussion!

Greetings,

\- Martin

https://redd.it/elfjo6
@r_devops

Home project ideas please!

Hello everyone!

Not sure if this is the right sub for my question but here I go. I'll finish my CCNA next week and now I'm looking for projects to work home in my free time. While learning networking, I figured out that I loved the ideas behind DevOps, programming, automation and so on. There's many tools or concepts I saw online but I don't know where to start (Dockers, Kubernetes, Ansible, Chef, Puppet, AWS, etc, etc) My first objective is to learn Python, I have basic knowledge with Linux and scripting.

So yeah I need some ideas for things I could try and mess with as I'm not sure how are all these tools related together. I saw a post the other day very similar to this one and a guy responded with a lot of details about what the other person should do and try to learn these concepts but I can't find it anymore. I think it was in a Linux community but anyways.

Thank you!!

https://redd.it/eld6fr
@r_devops

What to do about vault pki ca expiring

When my vault ca gets close to expiring, it says it can't issue certificates past its own expiration. What's the industry-standard method of getting around this problem?

https://redd.it/elhtwj
@r_devops

Started with 20, grew to around 100 Server & APM Solutions

Back in September 2014, I wrote about an article that touched on the subject of server performance monitoring. After which, a reader asked me via LinkedIn: “I am using New Relic to monitor my cloud servers but need an alternative. Any suggestions?”

So I wanted to share and expand on my answer to that question by creating a quick/go-to list of all the server monitoring and APM solutions out there, as well as get some feedback on tools being used. I haven’t tested all of these services listed. But have used more than one third of them. Some, such as SolarWinds, Nagios and New Relic I have been using for over a decade.

Any feedback on whats missing and/or what should be removed from this 5 year old list is very welcomed.

Full list: [100 Top Server & Application Performance Monitoring (APM) Solutions](https://haydenjames.io/20-top-server-monitoring-application-performance-monitoring-apm-solutions/)

https://redd.it/eldcsi
@r_devops

CI server good to try

[https://github.com/flowci](https://github.com/flowci) is a CI server I hope it can make CI/CD easier. It can be started from docker easily, supports configuration based on YAML, multiple agents, plugins and job statistic view to see the recent build trend. if there are bugs please help to submit issue, and any suggestions are welcomed and appreciated.

https://redd.it/el9yj0
@r_devops

How do you secure configuration files required by CI?

Environment variables are easy to handle. In development, load it from a .env file. In CI, pass it in as an environment variable.

But how do you secure configuration files?

eg. I use my CI to build Android APKs which will then upload it straight to the Google Play Store. I also checked in the .keystore file required to sign the APK. However I recently learnt that the encryption used for .keystore files can be brute forced, and therefore I should avoid checking it in.

________________

How then, should I secure my configuration files?

A) Pass in the file contents as an environment variable, then get CI to _cat_ it to a file. (not practical for large files, also not maintainable)

B) Encrypt the file using AES-256, then decrypt it again when CI runs. (works, but this relies on the belief that AES-256 is uncrackable)

C) Upload the file to some external service (eg. S3), then download the file when CI runs. (seems to be the more secure solution so far. Is there any service out there catered for this?)

https://redd.it/el9htu
@r_devops

Automated scaling, self-healing without Kubernetes

My only and limited exposure has been Kubernetes and i'm interested to learn more about how the rest of the industry that doesn't use k8s handles automated scaling and healing. What are the common strategies and tools? Any favorite resources you would like to share?

https://redd.it/ell03q
@r_devops

Need your precious help with docker volumes on premises!

Hello guys,

I wish you are fine and doing good. I work as devops junior. I have tried to find a solution for a urgent task at work, but am not clear for some points. Related to docker volumes for ELK. I need a solution, how to provide persistend data of logs in docker elk if container is off or server reboots. I have checked some solution, but i would prefer something with docker compose to set up the volume, dockerfile to run and copy path also any script in linux to call the path maybe... I would appreciate if you send me any useful link or any idea. Thanks alot!

https://redd.it/elljsf
@r_devops

Running Docker in EC2 backed by EBS volume for storing data coming from docker containers

How do I save data inside EBS from a node server running inside a docker container and also do the same with mongo server inside docker to store db inside EBS volume directly, if it's possible.

https://redd.it/eljjc8
@r_devops

(AzureDevops) How to view Artifact storage usage per project/feed?

afaik the only way view the storage usage of Azure Artifacts, is by going to Organisation - Settings - Billing. ([link](https://docs.microsoft.com/en-us/azure/devops/artifacts/start-using-azure-artifacts?toc=%2Fazure%2Fdevops%2Forganizations%2Ftoc.json&bc=%2Fazure%2Fdevops%2Forganizations%2Fbreadcrumb%2Ftoc.json&view=azure-devops#view-storage-used))

There you can see the total amount of GB's used.

Is there a way to drill down to a project level or per feed?

https://redd.it/elg0uz
@r_devops

How should you prepare for the coding portion of a devops interview at a FAANG or reputable tech company?

If the job requirements say “Ability to build tools with a general purpose programming language”, should you be preparing like you’re interviewing for a software engineer position and make sure you know all data structures and algorithms on leetcode?

https://redd.it/elg30p
@r_devops

Hey Guys , I need some serious help with Kubernetes and CI/CD.

Hello everyone, english is not my first language so if something is not clear enough just say in the comments.


Now for some Backgroud.

I'm 21, working for a consulting firm and completely lost and overworked. I'm all alone in the Cloud department ( We work exclusively with Google cloud) and I'm responsible for all external and internal projects. I'm looking for a new job but for now, I'm stuck here.


I'm automating what I can, when I can and this subreddit, along with many others, have been crucial to make my living hell of a life a little bit more bearable. But I'm still very unexperiencied with some core things like kubernetes and Ci/Cd.


That wouldn't be a problem normaly, very few (if any) of our projects involve Kubernetes and the like, but someone in the sales team scored a Fucking Kubernetes Workshop.


The Clients in question has been working with it for about a year and wants to know how to do a CD pipeline and Best practices related to monitoring, GCP in general and performance issues. That would be ok if I had time to prepare for it, but for some ungodly reason I have just this week, Starting the Workshop next Monday. I know the very basics of Kubernetes and CI/CD, nowhere near enough for this Workshop.


What should I focus on ? What places should I look for information?


Thanks Everyone.

https://redd.it/elfodi
@r_devops

CI/CD strategies in Cloud

Hello All,

I would like to know the best possible to way to achieve in Deployments for Multiple AWS Environments across multiple VPCs and accounts.

Our SCM, Bamboo, Nexus, Nexus-docker, SonarQube resides in **Account - A** which we use only for building binaries and Docker Images, unit tests and Code Coverage scans, and then we have GoCD running in AWS EKS in **AWS Account B** in Deployment VPC while applications run in EKS cluster in Applications VPC, GoCD Agents use A service account that EKS-CLuster Policy so it can deploy into APP Cluster.

We have Four Environments across 3 AWS Accounts

Account B - Dev

Account C- QA and Staging

Account D - Prod

for each account Account we have two VPCs as explained above, The Deployment happens through GoCD which is in Deployment VPC in same account and uses Source Code repos and Docker Images from Account - A.

We do HELM for MicroServices, So I would like to know the best possible way to deal with Continous Deployment considering STG and Prod deployment should trigger only through a Change Request.

We were thinking to follow Branching model for each environment and merge code through pull request but somehow we feel this isn't the best solution hence I would like to if anyone in this community had a situation like this and what is your strategy.

​

P.S I'm not a fan of GoCD due to the limitations it has, but I have no choice

​

\-Cheers

https://redd.it/el66b4
@r_devops

What metrics can we use to drive the things we believe in?

Check out this talk from GOTO Copenhagen 2019 by Roy Osherove, author of "The Art Of Unit Testing" and "Elastic Leadership.Growing self-organizing teams". You can find the link to the talk, along with the full talk abstract pasted below:

[https://youtu.be/goihWvyqRow?list=PLEx5khR4g7PLHBVGOjNbevChU9DOL3Axj](https://youtu.be/goihWvyqRow?list=PLEx5khR4g7PLHBVGOjNbevChU9DOL3Axj)

They say that "you get what you measure", and we've all seen it happen. "We need to get the coverage up!" followed by people frantically writing tests that might not actually test anything. Coverage is up. Quality? Not so much. So what metrics can we use to drive the things we believe in? In this session Roy Osherove covers recommended and un-recommended metrics and how each one could drive our team towards a bleaker, or brighter future.

**What will the audience learn from this talk?**

* Leading vs lagging indicators and their value
* What metrics can hurt your agility
* What metrics push towards agility
* Influence forces and why people behave in specific ways (and how metrics play a role)

https://redd.it/elqkkg
@r_devops

Should I stick with VMs or switch to containers?

Hello everyone,

I have an application that utilizes Nginx, PHP, Gunicorn, Python, Flask, Redis, etc. All of these technologies make up the "application" that I serve to each of my customer.

So what I do now is spin up a VM and run a script to configure everything. I've heard of Docker but only seriously took a look at it today and while reading a post on r/docker it was mentioned that docker containers should be used for process isolation rather than packaging entire application stacks together.

Is there any benefit to someone like me breaking up my app stack (I've no idea how or even where to begin) to run it in containers?

Thank you for your valuable inputs.

https://redd.it/elvp5j
@r_devops

My attempt on explaining Inter Process Communication

[https://youtu.be/VCG-5ZrFBAs](https://youtu.be/VCG-5ZrFBAs)

Feel free to give in your inputs/feedback and I can work on them.

Thanks for the support!

https://redd.it/eluvy9
@r_devops

dpkg to apt?

We have a 6 week dev cycle and one of our microservices is released via dpkg. Our testbed is a closed loop network without internet access. Using apt to install the .deb package has gotten me into a lot of trouble last time I tried to use it.

1) just using dpkg -i packagename.deb . Ss there any apt equivalent of that that can be run without a local repo or internet access?

2) does this merit trying to run a local repo? I think ansible support for the apt module would be appealing. But again, it's infrequent in the dev cycle.

https://redd.it/els4fd
@r_devops

How to Trigger Jenkins job on Bitbucket Pull Request

Hi guys! Looking to gain some insight on what I am missing. I’m trying to setup a Jenkins job that triggers when a pull request is done in Bitbucket.

I’m very new to Jenkins, so please go easy on me. Here is a detailed description of what I have done so far: https://stackoverflow.com/questions/59653369/trigger-jenkins-job-from-bitbucket-on-pull-request

Also, thanks in advance for helping / guiding / offering advice & suggestions!

https://redd.it/elyquu
@r_devops