Terraform + Ansible/Chef/Puppet/Saltstack

So I am alone in deciding and implementing our IaC techstack and my company.

Terraform is what I've used for about a year, but now I need to figure out what Configuration tool that meshes best with Terraform.

Do you guys have any experience with any of them? Got any cool links for best practices?

Cheers!

https://redd.it/evag2b
@r_devops

How to remove brackets and apostrophes in ansible?

the second one i have use join but when i add the excel i get pound sign. I just the output to be /root, /home/mydocument, \]

\[ ' /root, '/home/my document/,....\]

\- name: mount

debug:

msg:

\- "{{ ansible\_mounts | json\_query('\[\*\].mount') | regex\_replace(u', '') }}"

\- "{{ ansible\_mounts | json\_query('\[\*\].size\_total') | join(',') }}"

https://redd.it/evb3r0
@r_devops

Backup and Quick Deploy Solution

What are the best options for creating a ready-to-go copy of a VM with an associated volume that I can deploy within an hour and avoid burning up costs while we are not using the applications deployed on it?

I currently have required uptime in order to run Tanium and other security scans on a daily basis. However, these applications are no longer being used and will not be needed for several months, so I'd like to potentially remove them from our AWS account apart from a backup in order to not incur costs and avoid a lack of vulnerability scans due to the VM being shut-off.

**My potential solution:**

1. Create an AMI from the VM
2. Create a final copy of the Volume attached to it
3. Shut Down and Destroy VM (Will this remove the AMI?)

https://redd.it/evavyg
@r_devops

Azure DevOps as a SaaS product?

I was about to embark on the creation of a highly specialized SaaS product of my own that would offer a lot of the functionality offered by Azure DevOps (which I just started using at work). Question: Can Azure DevOps be used as a "framework" on which to build a custom SaaS product? One critical thing I would have to be able to do is add a LOT of additional data elements that are specific to my application. OR - should I be looking at something like Dynamics365 or PowerApps?

https://redd.it/ev5v7u
@r_devops

AWS Cognito

Hey guys, I have a weird question.

I started as devOps some months ago. The company I'm working atm uses aws for basically everything. I don't have the experience to firmly suggest other technologies (yet), and I'm happy to start learning from any point.

Now, my issue. We have been requested to implement a VPN for the workers for security reasons. The idea is simlpe: You're not connected to the VPN, you can't access \[X\] (A certain tool, the database, gitlab...).
My seniors are suggesting Cognito, and normally I learn and then argue, but Cognito seems like... For something else. It seems like a tool for developers to verify the users of their app, not a tool for companies to secure their inside tools and resources.


Is Cognito a valid substitute for a VPN? At the moment we just temporarily whitelist whatever IP each worker has at home (Or wherever they're working at)

https://redd.it/ev4x1f
@r_devops

Jenkins vs Gitlab?

Hey, folks. I’m kind of confused between the platform that need to be used on my personal existing project for CICD. If you guys are using any one of these, please comment down below why you chose to work on that.

https://redd.it/ev70os
@r_devops

Metaphore for CI/CD pipelines (or: how do you explain what you do at a birthday)

Hi all,

Are you ever at a birthday and unable to explain in simple words what you do for a living? How do you explain it in simple words? I think it would be really cool to use a metaphore, so that I can compare it to something all people know and understand, but I cant come up with a good example.

Do you all have any good ones?

https://redd.it/ev52qs
@r_devops

Single-node easy container deployment

I'm looking for some projects which make app deployment/upgrades easier. I'd like to be able to deploy a container with an app easily and seamlessly without dealing with common issues like swapping endpoints in the proxy, process management, rollback, etc. Basically looking for a self hosted single-node premade manager. Let's say, heroku for containers.

This is of course doable by hand, but... I'm getting tired. We're enough years into this stuff that I expect some common templates to exist.

From open source offerings, as far as I can tell only dokku fits this description. But maybe I'm missing something? I want this to be pretty lightweight, so no unnecessary things like etcd or clustering which drops rancher/k8s/container Linux. I want some existing deployment and proxy handling which drops silverblue/atomic.

https://redd.it/ev4cth
@r_devops

Hackathon - still a thing this year?

Hi! I am a tech recruiter and our company would like to hold tech events this year. We have done Hackathon last year but with a low turn-out, I am not sure if this will be supported by the business again. Will appreciate if you guys can confirm, or suggest any other events. TIA.

https://redd.it/ev2pj5
@r_devops

Private Subnet in Azure

I am new to Microsoft Azure, As in AWS, We can create Public Subnet and Private Subnet with Internet Gateway and NAT Gateway.
Can we Create Public Subnet and Private Subnet in Azure as well?
If we can, then how? Its urgent guys

https://redd.it/evn0f2
@r_devops

Insight About starting into a New Environment

Hello there !

I will be starting a new job as a DevOps Engineer in a month (Pretty exited/scared !).

This will be my first "real" DevOps experience. I am living in France , and studied IT for 3 year , with an "Internship" system , I studied 20% of the time , and was working in a company the other 80%.

So this will not be my first working experience , nor my first DevOps related Job.

But I will work in a relatively young Company and I will be the only DevOps.

As said before the company is very young (created about 6 month ago I think) , and my job will be to setup the baseline of the future architecture , everything need to be done , they currently have a test environment on a handful of EC2 , but nothing more and everything need to be set ( the Architecture , CI/CD,Monitoring, ect...)

So I am here to get insight of real SRE/DevOps engineer (whatever you are called in your company !) , that went down the same path (or not , I am eager to learn , and any insight is good to have !)

What are for you , the bid DO's and DON'T while thinking and building a new architecture from scratch ? Or what are for you, the best practices ? Do you have any resources (Book , article , or else) that you consider usefull in this situation ?

https://redd.it/evohki
@r_devops

How to automate Github releases with drone

I recently switched to automatic Github releases and wanted to share the journey.

Hope it helps :)

[https://blog.nicco.io/2020/01/29/automate-github-releases-with-drone/](https://blog.nicco.io/2020/01/29/automate-github-releases-with-drone/)

https://redd.it/evnhay
@r_devops

JMX APM solutions recommendations?

Hi. Can you show me some free or paid solutions to collect application metrics from jmx or javaagent? We are currently running on NewRelic, but it\`s pricey. We run our apps within tomcat and spring on VMs in GCE. We have plans to migrate all the stuff to GKE, so it would be great if the metrics system supports this. Moreover, we are switching our logs to Stackdriver, so it would be nice if the APM supports this.

Right now I\`m looking at Apache Skywalking, BindPlane(supports Stackdriver), Elastic APM, DataDog.

https://redd.it/evlptj
@r_devops

Improving Packer builds - or use something else

I'm a former Linux-sysadmin transitioning to Cloud-DevOps in my current role of the last 12 months. 20 or so developers in the company with limited DevOps experience/mindset between us all. Core product is a niche java application.

Main CI/CD is jenkins in AWS using EC2s for testing along with a couple of legacy onprem servers.

We fundamentally use Packer to (manually) build Centos and windows 2008/2012 AMIs for the development teams. The linux AMIs are configured via Packer-Puppet provisioner (changing to Ansible w/local-exec soon). The Windows AMIs are configured in Packer via PS + scripts. A huge number of dependencies (testing frameworks, applications etc) are baked into the AMIs, so the AMIs can get quite big (50+ GB). The AMIs are plugged into AWS jenkins-EC2 and all our testing is done from there. When it works, it seems to work well enough.

Because the AMIs are so big, manually troubleshooting packer-build issues with them is tedious and time-consuming and taking up an obscene amount of time. I try things like testing with virtualbox-iso first, or RDP’ing into the currently running packer-build to see what’s going on and so on - but again it is a very manual process.

Specific problems are:

1. Packer is used manually - it needs to be run manually from the command line whenever the AMI’s need updating. We do have a Jenkins-script that can invoke the packer build, but it has to be manually triggered.
2. Windows AMIs seem a nightmare to debug issues with.
3. It seems to be extremely tedious to debug even simple issues with Packer.
4. The Packer - AMI build process is not part of any CI/CD - it’s all done manually.


Specific Questions I have are:

1. What alternatives exist to build AMIs?
2. Should we be in the ‘Packer Build AMI’ mindset at all? Could/Should we be using CodeDeploy/Other tech ?
3. How do others handle big AMI builds ?
4. Can we split the Packer-build into more manageable, discrete building blocks ? Has anyone done this with Jenkins-Pipelines ?
5. What tools/tech is available to automate and test Packer-builds ? I know of serverspec, but it seems to be more for the ‘test the configuration of the AMI itself’ rather than ‘build and test the Packer-AMI building process’ ?

We are basically at the limit of what we can achieve manually. There’s no room for any further manual builds or AMIs or so on. We need to drastically automate Packer, or consider an entirely different way for this process.

https://redd.it/evkzm0
@r_devops

Development environment workflow suggestion/recommendation

hey folks.

I was looking for some suggestions for a development workflow that I have been exploring for some time now.

For my work, I tend to setup a lot of different environments for a number of things to test. Specifically, things like:


* load balancing
* reverse proxy
* CDN testing methodolgies
* web server
* app server (nodeJS, python primarily)

Depending on what I am working on, I could spin up as few as 1 VM, to as many as 6-8, depending on what is needed. Ideally, these environments would be things that I could put together, destroy and share with other team members as needed. Also, the need to deploy this to a infrastructure (cloud, vsphere) is also another important aspect I need to take a look at.

I have been exploring using hashicorps tool suite. Specifically, testing and using:

* packer
* vagrant
* terraform
* consul
* vault

I have started to build packer images that work with several providers. Works great and gives me flexibility. It gets me what I need going, then I use ansible to come in and do additional configuration as needed.
My initial workflow was something like: packer -> ansible -> terraform

I still need to spin up VM's to test obviously, so this is where I started to explore vagrant.

What i wanted to ask the folks here is maybe for some suggestions/recommendations or things to consider for a optimal workflow.

I am just trying to visualize and put together the entire workflow. I just started to test vagrant, but trying to see how that would fit in correctly.

On a side note, I do use docker quite a bit, but think I could extend and make my environment better with some suggestions.

Hoping that makes sense.

Much appreciated my friends!

​

Cheers,

TCG

https://redd.it/evtoic
@r_devops

Whats new or viable in Configuration Management outside Puppet, Chef, Ansible or SaltStack?

Is anybody working on configuration management systems outside of the old quadfecta? Is anybody trying anything new? OpsMop shut down because of lack of interest, but whats new, exciting or even viable outside of the typical four?

https://redd.it/evucfw
@r_devops

Is there a good tool that scans you datacenter to catalog where PII information is stored?

Is there any product that scans your datacenter and tries to catalog all places where PII is stored? Things like a list of databases/tables, pipelines with messages containing PII, logs, server filesystems, etc. We are happy to give the tool read only credentials/user permission to each db/server/cloud service in order to create this sort of list.

Is there a tool/product that exists for this type of job? I am not looking for PII scanning of user facing tools but specifically for all things created by the engineering organization. Thanks.

https://redd.it/evtfi3
@r_devops

How I Organize Terraform Modules: OFF the Beaten Path

I wrote up my somewhat non-standard approach to organizing terraform modules, on my company's blog


[https://blog.smartlogic.io/how-i-organize-terraform-modules-off-the-beaten-path](https://blog.smartlogic.io/how-i-organize-terraform-modules-off-the-beaten-path)

​

I've found this approach really useful for managing the complexity of large and \~living (in the sense of frequently changing code) modules. And mostly, coworkers seemed to have liked it too. As I mention in passing in the post, I mostly use this approach for larger helm charts as well.

But I'm curious what y'all think of it? Anybody else go about it this way? Are there downsides I am overlooking?


Anybody else do something that is neither like what I describe as standard herein nor like my approach?


Thanks :-)

https://redd.it/evsf3q
@r_devops

Jenkins in Kubernetes - Running Docker Builds?

Hello all --

We are moving to Jenkins in K8s wherein different teams can 'own' their own instance of Jenkins and configure builds as they please. I've created some basic agent pods that allow teams to do the basics, but I'm struggling to figure out how we can perform docker tasks easily.

It seems our only options are to run dind (which appears to require root?) or run a container with docker client and mount the running docker socket from the K8s worker node (also requires root). Our cluster has a pretty strict security policy which disables containers from running as root.

Does anyone have any workarounds for this? Really trying to avoid static VMs for agents.

Thanks!

https://redd.it/evylfn
@r_devops

Need user control with AWS EC2 instances?

Here's a guide on doing it with jumpcloud:

[https://medium.com/teamzerolabs/secure-and-manage-ssh-access-with-ldap-sssd-and-jumpcloud-5dd7156a337](https://medium.com/teamzerolabs/secure-and-manage-ssh-access-with-ldap-sssd-and-jumpcloud-5dd7156a337)

We have been deploying this pattern with several clients and it definitely is better than adding everyone's pub keys to ec2s by hand.

This will also cover making ami images to make sure they self-enroll with jumpcloud ldap as well

https://redd.it/evvsck
@r_devops

Redirect a URL but only if coming from specific origin

Running Jenkins behind NGINX. Trying to come up with a way to redirect to Blue Ocean UI (`/blue`) when hitting the main page, but still allow access to the classic interface when specifically requested.
Right now I have something like
```
location = / { return 302 $request_uri/blue; }
```

But I want to only do that if the request doesn't from `/blue.*`.
Maybe some kind of conditional on the value of `Referer`?

Thanks for any help.

https://redd.it/evr9vg
@r_devops