Multiple CI/CD on a single server?

Let's assume I have a single server which is heavily overspecced and I have 150 developers with at least one or more projects on gitlab.

I know its probably a very bad idea to use that one single server to handle the CI/CD of all the existing projects, but just for argument sake, how good would it work and what would stop this attempt from being effective? Or in case I'm actually completely wrong about my assumption, why would it actually work out just fine?

https://redd.it/f6bq8v
@r_devops

Mobile CI/CD

Anyone have any experience on building a CI/CD pipeline for mobile apps and can maybe give me some tips/pointers/tutorials?

My team is looking to build/test/release both an iPhone and Android app. Android seems much more straight-forward; download SDK & dependencies, run tests, and upload to Play store (found a gradle plugin that does this). iPhone seems much more difficult since it seems like you need a MacOS machine to compile iPhone code and no major cloud provider offers Mac VMs.

Currently looking at Microsoft AppCenter, which is a bit frustrating since I would prefer to use Gitlab which is where all our other code & pipelines run.

https://redd.it/f5mikn
@r_devops

What will be faster? Setting up my own mail server or mail service like sendgrid?

Above those what will be faster in delivering mails

https://redd.it/f6dii6
@r_devops

Bolstering infrastructure and services

I'd like to start using some of Hashicorps stack like vault, nomad and consul but want to start with Consul. We have existing infrastructure that is in need of some system-level but also application level monitoring. Currently we have Zabbix set up for this, but I really don't like it.


So my initial plan is to deploy consul next to Zabbix and get a cluster running first without any services registered. According to documentation I can monitor the node health on a hardware level and see the telemetry of the entire infrastructure in a non-arcane interface.

From there I'll start start integrating vault into the whole thing and once done will give me a nice demo to convince some old farts that plain text passwords and constantly having to intervene because shit died for days without anyone noticing is in fact, not ok.

Any feedback/suggestions/criticism?

https://redd.it/f6d6oq
@r_devops

Which CI/CD for infrastructure as code

I need to automate infra as code pipelines. Most of it is in Terraform, some of it is in CF, and although I am trying to get everybody to use Terraform for portability we still have some CF users.

Here's the issue: the team is growing a little and I've heard about people getting their TF/CF code under CI/CD. What CI/CD should I use (and why)? For some reason I keep hearing gitlab CI, haven't found out why

https://redd.it/f67nr0
@r_devops

Prometheus alertmanager api issue

the object I send is

{
"matchers": {
"value": "alert_name",
"name": "name",
"isRegex": true,
"startsAt": "utctimehere",
"endsAt": "utctimehere",
"createdBy": "swtrz",
"comment": "Patching silence for machine x"
}
}


alertmanager returns

{"code":602,"message":"comment in body is required"}

Im pretty sure that last line *is* my comment, what did I mess up here?

https://redd.it/f6gb85
@r_devops

Exploring plain bastion hosts, AWS SSM, EC2 Instance Connect, and combining them all with Terraform.

Being newer to networking, I felt pretty lost with all the recent posts about bastion hosts, SSM, and EC2 Instance connect.


I decided I throw one more resource into the pile, with the goal to be different by:
- Having complete terraform examples of the best practices
- Using examples that are closer to production ready security standards than other posts
- Starting from the beginning, and showing how bastion host access has evolved over time to explain why the current best practices are why they are.
- Show how to tunnel database access locally, which requires an explanation of how `ssh`s `ProxyCommand` option works


[Here's the Codelab, enjoy!](https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index.html#0)

https://redd.it/f6gvjs
@r_devops

If you use statuscake, try this command line tool I've built

I've been using statuscake for a while for monitoring external websites and endpoints.

So I've decided to write a small command line tool that helps onboarding fast without using the UI.

<https://github.com/omerh/statuscakectl>

configure the username and token as env vars (as the readme explain) and run:

```bash
./statuscakectl create uptime --domain https://www.domain.com --checkrate 30 --type HTTP
```

https://redd.it/f6g6at
@r_devops

Git Binary files

Hi are upgrading to azure devops server soon from TFS 2017. Once completed we will start to use GIT as the repo. One issue we are having is go to handle binary files. How do you all handle binary files?

https://redd.it/f6ha59
@r_devops

Help on CI/CD Build before Test and why

To give you more context:

I'm a "DevOps" engineer and I'm doing my best to migrate old Jenkins to gitlab ci/cd as it meets the company needs

And since we want to use Dockers I'm being involved on the new projects to start having the best practices and train the developers on how to docker, docker-compose etc

With this I started to show to developers how gitlab pipelines work and the best practices to follow (run tests - build image - push to registry - update Dev server)

Here's now my struggle, since it's only python webapps, they found (I know this) that building the image - send to resgitry and then run the unit tests inside the container WORKS (no shit) and they changed all the pipelines to: Build the container - publish the container - run the test command inside that container - change the tag to latest if the test pass (why)

It's been 2 weeks trying to explain why it's a bad practice and I just can't find the best material/explanation why it's wrong ( plus English is not my first language)

Can someone eli5 why this is a bad practice so I can present a better ' I know it works but it's wrong?'

https://redd.it/f6gwxb
@r_devops

Talk on distributed systems (Part 2)

I recently put up the first part of this talk and got a lot of support from this community. Thanks for all your support. (Prev post link: [https://www.reddit.com/r/devops/comments/f4s9l2/a\_talk\_on\_distributed\_systems\_in\_college/?utm\_source=share&utm\_medium=web2x](https://www.reddit.com/r/devops/comments/f4s9l2/a_talk_on_distributed_systems_in_college/?utm_source=share&utm_medium=web2x))

Here is the link to part 2: [https://youtu.be/T5T0DIaWdxQ](https://youtu.be/T5T0DIaWdxQ)

Hope you all enjoy watching it!

https://redd.it/f6aqft
@r_devops

Will I get in any trouble if I do a proposal internal to the team as an open source project? (detail in post)

The story is that

I made a proposal for a new feature of our product, but for the following reasons it did not get approved from the managers and we decided not to support it

1. It is several steps ahead of our current product in terms of technology. The feature does not support any deprecated use cases of our product and it is meant to incorporate with several new features down the road map
2. Current product already supports similar feature that is not as powerful. It provides a sub set of capability of my feature
3. Current product implementation is not elastic enough and will require re-writing or adding some services to support my feature

However it turns out as a bad proposal to the team. I genuinely feel the idea is great and I don't want it to sink. So I spent my long weekend working on it, detailing the specs and implement basic mechanics. The specs for a full deploy that supports simple protocols does not seem hard to implement. But there are some catches...

* My deployment architecture is based on the concept of our team's product
* The idea has been disclosed internally with the team
* I am copying code from stack overflow pages that I referenced when writing some other code in work, making something that looks similar to my code at work

The product of our team is technically open sourced, I can find source codes and documents of released versions and all references of my implementation can be derived from published codes/documents of our team.

That is, if I start a brand new github account and deny I own it. It will seem like a random person digging through the product docs and coincidentally came up with an idea I had. This is an option but I will prefer to leave the open source project on my Linkedin page thus it should be the last resort.

Any suggestion on this?

Top priority should be publish the feature with basic standard protocol supports and walk away without getting any trouble. Second will be keeping credits on my Linkedin page

&#x200B;

Edit: Our codes are published externally under BSD-3 license. But I'll like to do MIT

&#x200B;

Edit:

What I mean by "made a proposal" was showing documents I wrote at home with some drawing on whiteboard. Everything hosted on GitHub and not downloaded to my company laptop and I can guarantee all commit time stamps up there are not my work time

https://redd.it/f6f9w7
@r_devops

Which 'traditional/mainstream' certs do you recommend (NOT DevOps/cloud based)? For work permit purposes

Hear me out where I'm coming from. Overseas immigration authorities when looking at eligibility for work visa first look at things like degrees incl. post-grad.

Then they look at professional qualifications by respected trade bodies.

IT certs like Microsoft, CompTiA even Cisco come even further down the list. Maybe because of lack of awareness or some other reason. I think most countries don't even give a single point for them. In fact, many countries look for "graduate" or "specialist" work. Because you can do DevOps or IT infrastructure without a degree, it's hard convincing them otherwise without some highly respected professional qualification. Salary aside, we may be considered to be "low skilled workers"!

If you wanted to future proof your career with respect to working overseas, what kind of qualification would you study on the side? I'm talking about something that takes years to achieve, not a cert you can cram in a week and pass multiple choice.

I don't think CISSP as I'm not committed to infosec. I'm thinking maybe something like PMP which is complementary and useful, especially the older I get and possibly less technical might become especially if moving into leadership.

What are you studying for on the side?

https://redd.it/f695gx
@r_devops

One pipeline to rule them all. Why?

I heard multiple companies, in recent months, say they are working on a single pipeline (or pipeline as a service) for the entire organization. My question is why is this a thing? Is this some “best practice” people are following?

Today I heard his company is asking him to fill out a 27 question spreadsheet and they will deliver him “the perfect pipeline”. This sounds like an anti pattern to me.

https://redd.it/f665pb
@r_devops

Best way to configure default settings for kubelet v1.17.1 (using Clearlinux) ?

I need to change default kubelet cgroup driver from "cgroupfs" to "systemd" (and maybe later some do further tweaking on kubelet config).

I am not sure how to do this properly with kubelet (I am using Clearlinux), some hints/links/example config file for kubelet would be nice.

https://redd.it/f65wb3
@r_devops

What Is DevOps? What is the work of DevOps Engineer?



https://redd.it/f5q16m
@r_devops

What's the use of codebuild being used with ECR?

I'm possibly going to have a junior Devops position soon and was trying to get a grasp of all these technologies. For the mostpart things have been making sense, yet I don't understand why codebuild would be used with ECS. Since you're using container images isn't it already built?

Is the whole point just to run tests on the applications?

https://redd.it/f6kjf2
@r_devops

CI/CD optimization

Hi

We are using circleci. For each check ins, it ends up with 2 test runs. One for CI and the other for CD.

This makes sense since there could have multiple PR going in at the same time.

However, for case where there is no new change, can the test run for CD be saved if it's exactly the same run as the one done for CI?

Thanks

https://redd.it/f6k7pk
@r_devops

Kubernetes Container Config

New to Kubernetes and am struggling with the best way to deploy a third party application that already has a docker image setup. The issue I am having is setting the configuration files (there are several in different subfolders) in the docker container. Locally I ran docker compose and mounted my local disk as the configuration.


I have been looking at ConfigMaps and that seems to be a bit clunky to map anything other than a series of files. Is this the typical way people are doing this and I just live with it or is there something easier?


(Running minikube locally while I learn but this will end up in Azure eventually)

https://redd.it/f6jtnp
@r_devops

Swapping homepage URL without disturbing URL paths and subdomains

Introduction:

* I have multiple Ruby on Rails applications served with Docker nginx in the same container.
* I have a domain name **website-example.com** from GoDaddy.
* On visiting **website-example.com**, we get to the landing page.
* API is exposed from the **website-example.com/getList** URL path.
* There are subdomains like **subdomain.website-example.com**

Problem Statement:

* I am building a new React application with NodeJS, but I want **website-example.com** to point to the new app.
* I want the exposed APIs to remain accessible via **website-example.com/getList**
* I want the subdomains to remain accessible like **subdomain.website-example.com**

How would I do this?

https://redd.it/f6j6c9
@r_devops

Monitoring your AWS Network Infrastructure

Monitoring your public cloud network is an unsolved problem, such as on AWS. It is far from complete, with many loose and fragmented solutions at best. For instance, filtering workloads with high inbound traffic, with specific sessions across VPC, Classifying short-lived bursts, long-lived sessions, etc. We have put together a short questionnaire looking for some feedback on possible offerings in this space.

https://forms.gle/9BH7s8sqhfDmsj117

Audience: 1) Anyone using public clouds such as AWS, GCP 2) SREs, IT solutions provider, security professionals welcome.

https://redd.it/f5k37w
@r_devops