How janky are Expect Scripts when they start to interact with CI/CD pipe-lines?

I'm thinking primarily of Jenkins and Bamboo.

Anything you know about this in a sort of high level way, or by way of recommendations, would be much appreciated.

I'm currently building a set of automated-testing scripts from scratch, and I've found Expect scripts to be helpful, but these scripts have not yet interacted with Jenkins or Bamboo.

https://redd.it/f41tjy
@r_devops

Elastic Beanstalk like deployments for DigitalOcean

Still in development but I would welcome any comments.

I like the simplicity of Elastic Beanstalk and wanted to recreate this environment on Digitalocean.

[https://www.npmjs.com/package/@mitjafelicijan/unfold](https://www.npmjs.com/package/@mitjafelicijan/unfold)

https://redd.it/f3xumi
@r_devops

PSA: phpList Authentication Bypass exploit in v3.5.0 due to type juggling with '==' auth condition (CVE-2020-8547). Here's a guide to securing phpList in Cent7

Elier this week, it was announced that phpList had a critical security vulnerability permitting an attacker to bypass authentication and login as an administrator using an incorrect & carefully-crafted password in some cases. This bug is a result of the fact that \[a\] PHP is a loosely typed language and \[b\] the phpList team was using the '==' operator to test for equality of the user's hashed password against the DB. This security pitfall has been known in PHP since at least 2010 (a decade ago!), but I'm sure the same mistake will be made again..

[https://tech.michaelaltfield.net/2020/02/14/phplist-hardening-security/](https://tech.michaelaltfield.net/2020/02/14/phplist-hardening-security/)

https://redd.it/f3xrw1
@r_devops

DevOps Bookmarks Back at another Domain [devopsbookmarks.org]

Hello all,

I noticed recently that the [devopsbookmarks.com](https://devopsbookmarks.com) site has been down, which was a really cool site! I took it upon myself to fork the repo and create [devopsbookmarks.org](https://devopsbookmarks.org). All credit goes to the people who've contributed to the [devopsbookmarks.com](https://devopsbookmarks.com) repository. I decided to revive this project and take it over. The .org site has a totally different repository and contributions are welcome! To contribute, the links are on the site.

https://redd.it/f465wp
@r_devops

Terraform Noob

Hey DevOps people,

I'm trying to save some cloud budget and therefore I've decided to use terraform as the main tool for my project.

So the basic idea of the project is to not let servers running all the time, but only during working hours when they are needed. I am very new to Terraform so I'm using this as an opportunity to learn it as well.

​

Right now I have a [main.tf](https://main.tf) file with around \~20 resources for servers, each of them should create a snapshot by the end of the day and delete the server, in the morning I want to create these 20 servers based on the snapshots that are saved. Right now my snapshots are saved in the same file as the servers, so running the \`terraform destroy\` command deletes the snapshots too, how would I go about this, I also want to only have the latest snapshot saved the older snapshots should get deleted as well.

If someone can just point me up a blueprint of the workflow in terraform I'd really appreciate it.

https://redd.it/f3w6nq
@r_devops

Moving from on-premise to AWS Aurora Serverless

Hi devops,

We are currently maintaining a MySQL database on bare metal, which handles all of our production load. It has served us well, but in the past months, it has started to become too small for our load during peak times. We have a very inconsistent load on our production, where during the days it is very low, but peaks during evenings and weekends. While idle, we have somewhere around 100k hits/hr, while during peak it could go as high as 5M/hr or sometimes even 15M/hr. These spikes happens about every second to every third day, so not so frequently.

I have looked into different options on how to tackle this issue, and to find a long term solution that would suit our needs and take the issue off of our hands. Naturally, since we are in the AWS echo system with a lot of our services, we looked into what they could offer and found out about Aurora Serverless. It has got some limitations when it comes to functionality, but it all seems fine to us and should not bother us in any way as of how we are using MySQL right now.

Searching for experience on maintaining production workload on Aurora Serverless is quite small, at least according to my Google-fu. Most users seem to use it for test environments and staging since it is able to scale down to 0 ECU's, and therefore keeping the cost down.

Our main take is that it would suit our needs based on the spiky loads, and therefore not having to set up an instance able to handle those large loads while staying idle most of the time, at least if it works as good as AWS states that it does, and thereby keep the costs down.

Does anyone have actual experience with Aurora Serverless in production environments? Are there better solutions for scaling things like this, when it comes to AWS and MySQL?

https://redd.it/f3tj8o
@r_devops

Which Programming Language should I Use to Create a Project Tracker?

Hi,

I am looking at phasing out the use of EXCEL in my company, but I also think this would be a good project to begin to learn a new programming language, before I pick a language I thought I would ask for advice. Below are the main features I need from this application.

​

1. It must be a desktop application.
2. It must have a login for all users, ideally which can be linked to their Office365 accounts.
3. It must given the option to open a specific project from a list of project(s) a user has access to.
4. It must allow the user to list all programs for the specific project.
5. If must allow the user to add program attributes like program author, modified date, comment.
6. It must allow multiple users to update the project areas via a "shared" feature and not a "check-in - check-out" method.
7. It would be nice to have a feature which allowed a user to export the data from the application into EXCEL.

If you want more details let me know.

TL;DR - i want to create an application to replace a shared EXCEL file but not sure what programming language to use.

Thanks
Craig

https://redd.it/f47nnl
@r_devops

Can someone help me solve this task.

Task: need to dockerize Jenkins
Need dockerized Jenkins to use docker containers to run jobs.
CANT have docker-indocker. Must spawn sibling docker containers how to write dockerfile.

https://redd.it/f3nm36
@r_devops

How to build a catalog of multiple services

Hi

We have got around 80 micro-services in our product. We make quarterly release of our product. In order to identify which version of service is going on which release, we maintain a manifest file in every release. Our manifest files are growing dramatically and we don't like it. Is there a better way to maintain this catalog? Have you used any tool which helps you maintaining this application catalog?

https://redd.it/f35ymf
@r_devops

Tasks for a struggling junior DevOps?

Due to some organisational shuffling, my team absorbed a smaller team of operations engineers. Our setup is now that we're the sole operations/DevOps/SRE squad of eight people, for an engineering org of about a hundred, in a fast growing startup of 200 or so.

I'm not an experienced manager, but I joined the company early and was one of the people who initially laid down our DevOps tooling and culture, so was lucky enough to be in the right place at the right time when the company was large enough to need a DevOps lead.

Of the team that was folded into my team, one of the guys is very junior, with no prior experience in systems adminstration, scripting, programming, computer science, cloud infrastructure, etc. He has a background in desktop IT support, and moved to Linux/cloud operations for a team that was intended to do relatively traditional manual IT work. Unfortunately, the manager who pushed for the creation of that team left just after this guy passed probation, and there wasn't anybody to continue to run it, so the headcount was moved to me.

My team focuses on IaC, automation, and building an internal PaaS. I've been trying to give him the benefit of the doubt for months, but he's just not picking up this role at all. He needs his hand held through essentially any scripting task, is unwilling or unable to take feedback from code review, struggles with basic source control, and asks very basic questions incessantly without doing even cursory research. After six months, progress has been slow to nonexistent.

Things he has been able to handle: manning an internal service desk for basic operations that we have not yet automated (mostly user management on legacy systems that aren't yet integrated with our SSO). That's pretty much it, and any ticket that gets raised that requires insight into how the platform works has to be raised to a more senior team mate.

I'm trying to figure out what other tasks he could be assigned that would add value, but not require him to be babysat by a senior engineer whose time could be spent implementing features or fixing bugs. Me and most of my team came to DevOps from more the Dev side of the industry, so maybe there are things I'm missing about how Ops people are usually trained up?

Does anybody have any suggestions of what else I could get this guy to do to that creates value and that could encourage him to learn and grow into the role?

https://redd.it/f34whp
@r_devops

Deploying your front end websites to s3 with cloudfront for fun and profit

[https://ilhicas.com/2020/02/15/Serving-Javascript-S3.html](https://ilhicas.com/2020/02/15/Serving-Javascript-S3.html)

https://redd.it/f4fa9p
@r_devops

Looking for a simple monitor tool

I need a very basic monitor tool for my python server, It needs to support multiple servers, logs, notifications, and server CPU usage, ETC.

Remote actions on the server would be nice (Optional).

All the tools I found are either too complex / complicated or extremely expensive.

Thank you.

https://redd.it/f4fdlk
@r_devops

Need some advice solving this project.

Problem Statement:

We need to allow only Authorize people to access our Application


Features to be implemented:

       - create a Rest endpoint to validate user

       - if user not exist then return response to signup

       - try allowing maximum attempt for login as 3

       - if it exceed maximum limit of attempt then block that user for 5 minutes


Acceptance Criteria:

1. Pass User information for login in header with encrypt format

2. Provide SSO features

3. User authentication should be done with database

4. Handle proper exception

5. Make hour API completely decoupled

What can be the easy steps and which program (Python, groovy,html) and application(tomcat, httpd) can be used.

https://redd.it/f4fzwm
@r_devops

What’s the point of kubernetes secrets?

Kubernetes Secrets are just a base64 encoding of some text. If intercepted, it’s easily decoded. Why not encrypt secrets and then just use a ConfigMap? The code running in the container would have to know how to decrypt the secret.

I’d like to hear a little more about good security practices regarding secrets in kubernetes.

https://redd.it/f4eoli
@r_devops

What are the next DevOps moves for an e-commerce?

We have our MVP ready. And basically all we have is Gitlab CI/CD tool on our server. I'm considering tools like Sentry to track errors on clients' machine, I'm also considering simple monitoring tools to at least gives us an alert when servers go down. I've found Prometheus suitable for monitoring purposes (suggest a better alternative in case you know one).

So what's the next step? If we have a long-term (say 2 years) plan to build a better and more reliable service, what DevOps actions and tools we need to gradually adopt, what's the DevOps roadmap for businesses?

https://redd.it/f4j30n
@r_devops

How to manage CICD between Isolated Environments?

Hi Team,

I’m interested to hear your thoughts on the following use case:

PROD environment is completely isolated in DataCenter 1 in different region

DEV/TEST/Stage environment is in DataCenter 2 in another region.


Apparently we will require two separate CICD tools. What do you think of possible challenges? How to sync application configs?

https://redd.it/f4do0i
@r_devops

Travis for tests that rely on a proprietary server running?

I have written a python application which wraps a legacy, proprietary C API. I want to open source my application on Github and integrate it with Travis, in order to display a build failing/pass icon on Github.

All of the tests, however, rely on the proprietary server application being up and running, as well as the header/shared objects to compile the application. "unit tests" for this particular app wouldn't be useful - the only useful tests are those that actually connect to the server. I do not want to have Travis attempt to install this proprietary server so that it can run the tests. I'm pretty sure that I would not be allowed to do this and that it would take too many resource for the Travis instance.

Instead of having Travis even install the app or run any of the tests, my idea is to manually run the tests and commit the results of the tests into the repo, and then have Travis run a script that checks if the results of the test make sense relative to the code in the repo (for example, if the tests say foo.bar has 100 lines, but the actual code for foo.bar has 125 lines, then the committed tests are invalid and the build should fail). Additionally it should check the code coverage indicated by the results and fail if the level is too small.

I think I could write something myself to do this, but I'm hoping that something similar to this exists.

Does this idea make any sense? Is there a better approach to integrating with Travis when tests rely on a server?

---

My big concern is that when I leave my current company, I will want to make a former coworker the administrator. I just want to semi-ensure that the new owners are running the tests if they decide to create a new release on Pypi. If it was just me, I wouldn't even bother with Travis since I know I would run the tests beforehand.

https://redd.it/f4e9pn
@r_devops

Convince me to move from kops to Terraform/Ansible or whatever else there is.

In the beginning, after learning about kubernetes, I thought it would be a better fit for our startup when we were starting out, I looked up into how to spin up a kubernetes cluster on AWS (we had credits at the time) and there I found out about kops, which lets me configure the cluster, which kubernetes version image, etc... and it would spin up one that is ready to use.


Reading from various subreddits, there is this idea that keeps popping up that one must learn Terraform and Ansible, I've tried to read about Ansible and still have no idea how this could be useful in my case, and Terraform seems to be like an abstraction layer where I can define the cloud infrastructure there instead of relying on kops, but in the end they seem to achieve the same goal.

What I'm saying is, I keep feeling pressured that I should move on to use these tools instead of relying on kops, and I can't convince myself to do that.



So... Change my mind.

​

(Note: I know that some people might say well if kops is enough for you then I shouldn't worry about it, I understand that, but I would like to learn more about scenarios where one relied on kops all the time until they hit a roadblock, or something like that...)

https://redd.it/f4dfmt
@r_devops

Ansible Tower vs Jenkins

I am very new to the topic and I'm struggling to understand whether Tower and Jenkins are interchangeable. I am trying to choose among the two solutions.

I understand Jenkins is a CI server, with some CD functionalities, reachable mainly thanks to plugins. It can also use Ansible for CD.

Can Tower be used also for CI? If so why should someone use Jenkins (except for it being open-source)?

https://redd.it/f4bo5h
@r_devops

How to create a Bind in Docker with 2 different zones for 3 DNS clients in the same server?


I need to create a Bind in Docker with **2 different zones** for **3 DNS clients** from the same server where:
- **1 client has access to one zone** and **the other 2 access to the other zone**


I need to use Bind and Docker for this.

https://redd.it/f4bi5x
@r_devops

A few questions about CI pipelines

I've been using an azure-pipelines.yml file for defining my project's pipeline and have a few questions:

1. I see I can define the branches that trigger the pipeline in the file itself. I'm confused how this works. What is stopping someone from adding `my-awesome-untested-branch` as a trigger and configuring it to push to production, then pushing to that branch?

2. Is there a consensus on whether YAML definitions are better or worse than Azure's UI/Classic pipeline configuration?

3. If I'm doing unit and integration testing in my pipeline and then building a Docker image only after those tests pass, should I have a custom Dockerfile that is only for building via CI since I've already built the project?

https://redd.it/f48uv1
@r_devops