DevSecOps(DevOps Security)- What is your best practice to embed Security into DevOps

In recent years, many software firms are turning towards the use of DevOps Services to build their applications. DevOps has been providing a much faster time for the marketing of the software. It provides a platform for deploying applications in the cloud environment i.e., Cloud DevOps.

There are many companies that provide Cloud DevOps Security consultation. So the vulnerabilities that lie within the software are exposed, which initiates the necessity of a security strategy to be implemented for the application development right from its early stages, and not just at the end to prevent & overcome any of the unanticipated problems.

Now, with the use of DevOps for software development, novel strategies need to be in place to embed security aspects in the development to ensure that the software is not vulnerable to the various attacks by hackers or malicious users. So, the answer that software developers are looking for is DevSecOps.

Here are key best practices for organizations "[Incorporating The 10 Best Security Practices Of The Industry](https://addwebsolution.com/blog/devsecops-incorporating-ten-best-security-practices-industry)".

As a business organization, what is your security practice and what is your take on the DevSecOps?

let's be aware of the change that is taking place in the world of Cloud.

Share your thoughts and insight into the topic.

https://redd.it/fjksqe
@r_devops

Courses for Machine Leaning Devops

Hello,
I want to start learning ML so i can create ML applications to help me and our team with:
- analyzing logs
- prediction maybe of cpu and memory usage
- prediction of next outages

What courses do you recommend that will help me in the future ?

https://redd.it/fji9ab
@r_devops

GKE with nginx ingress vs LB (with SSL)

Hey, we're on GKE and I'm tasked to add SSL routes which probably demands using a certificate. Ideally I would prefer that anything will happen on GCP side so their LB will take care for that, that's less point of failures for me, but most of the articles I find on this matter show how to configure this using nginx ingress. What are your thoughts on this matter?

https://redd.it/fjh03o
@r_devops

What skills are needed to get into a devops role?

Im taking the time to lean new skills and hopefully get into some cloud architecht/sys ops role. Im currently a controls engineer doing robotic programming. Im in the process of getting my AWS solutions architect associate cert and will take the AWS SA Pro following this. I also plan on learning Chef, Docker, and Kubernetes. Is there anything else I should learn or learn instead of these? Any courses that you recommend for learning these (Acloud Guru, Udemy, books)?

https://redd.it/fkowjc
@r_devops

How's everyone doing working from home that normally isn't remote?

My company closed it's doors due to the current pandemic about a week ago. While I've work from home before on several things into evenings or when a kiddo is sick, I've never had to for an extended period of time. Especially with two eight year olds stuck with me, in a small apartment, all day and night as a single parent. It seems my company thinks it's business as usual for everyone.

Is anyone else experiencing this? How are you managing to start productive?

https://redd.it/fkpt4t
@r_devops

You can get my DevOps books free the rest of this month

To help anyone who might find themselves in a situation where they're looking to find a new position either now or in the coming months, I've decided to make both of my DevOps books (Ansible for DevOps and Ansible for Kubernetes) available free for the rest of this month.

If you've ever been interested in Ansible and/or Kubernetes, hopefully this gives you the motivation to finally start learning them. If you can pay something for them, great, but feel no obligation!

See details here: [You can get my DevOps books free the rest of this month](https://www.jeffgeerling.com/blog/2020/you-can-get-my-devops-books-free-rest-month)

https://redd.it/fjdw7g
@r_devops

What is DevSecOps and how to adopt this approach?

To adopt a DevSecOps approach, you will need to focus on 3 axes: people, process and technologies. You will need Security Champions who shift habits. You will also need to modify your existing processes. And finally, you will need to add new tools to your automated pipeline. I have written an article on the [implementation of DevSecOps in companies](https://www.padok.fr/en/blog/devsecops-security). Check it out and let me know if you encountered any other issues.

https://redd.it/fkrfbi
@r_devops

s3 disk usage

Hi, just wanted to ask, if it's normal that i can't see total disk usage of a bucket. We have 100GB quota and when I run 'du' command, it shows little less than 14GB on the bucket.

They replied that we have occupied the whole 100GB and they say something about versioning, which we clearly don't use.

The provider has ceph as backend. I'm using s3cmd utility.

Thanks for help.

https://redd.it/fkrcm2
@r_devops

DevOps defined

This is a marketing piece that points to a lot of HashiCorp products, but I thought the overall look at the different parts of the DevOps pipeline and the explanation of what actually is DevOps was helpful:

[https://www.hashicorp.com/devops-defined](https://www.hashicorp.com/devops-defined)

https://redd.it/fkqrte
@r_devops

How to deploy a Nodejs express server to some port on nginx?

It's my first experience, so bear with me :)

I have a cloud server (like DigitalOcean droplets) I deployed a React project by creating a directory `/var/www/example.com` and putting the build files there then I went to `/etc/nginx/sites-available/default` and changed root document specified in the root directive to `/var/www/example.com`, now when I go to my server ip, I see my react project.

Now let's imagine I want to deploy a Nodejs app too. how can I deploy it on some arbitrary port (like 4000) so when I enter `server-ip:4000` I can access my express app.

https://redd.it/fkq980
@r_devops

Monitoring Gitlab-ci pipelines

I've been trying to find a way to monitor gitlab-ci pipelines to get useful information (commits, runs...) i tried "gitlab-ci-pipelines-exporter" but it's not able to fetch the project from gitlab, i tried making the project public but the problem won't go away, the logs indicate that it's unauthorized, any help would be appreciated .

https://redd.it/fkp2cy
@r_devops

Gitlab CI/CD option to skip Auto-Pipeline

Hello, there.

I’m using gitlab for my CI/CD task. But whenever I’m pushing something to the repo, gitlab is starting the pipeline. To avoid this, I know one method to add ‘ci skip’ in git push command. But without explicitly mentioning this, can we avoid auto pipelining in Gitlab?

https://redd.it/fkmj73
@r_devops

Tips for a software developer new to implementing CI/CD?

This is gonna be a little long, I hope you can read til the end.

I'm a software developer. We have been building MEAN stack apps, and until recently, everyone in our team was fine with the deployment process — using bash scripts. But during a meeting, someone asked if there was a way to have some sort of a blueprint or template for setting up a server (which is basically manually installing a myriad of dependencies on the server and configurations — someone wrote a bash script for this after the meeting) and making the deployment process easier/faster (not having to ssh into the server to run the script for deployment on our own machine — what are the cons?).

I have had some experience with Docker, but only because I had to use it for my local environment for coding — I have never built anything from scratch before, nothing extensive.

We don't have a dedicated DevOps team yet, and the project we are working on isn't a full-scale app with many complex processes, it's relatively small. But since we had a bit of downtime, we decided to start looking into Docker and CI/CD to help streamline the processes for the meantime, no strings attached.

I was able to package a very simple Angular/Node.js app using Docker, and deploy it to a server using a GitLab runner. Now they have decided that it would be a good thing for the team to learn how to streamline the current processes we have using these new technologies.

I definitely have always been a coder, but now there is an opportunity to build a new skill or two, but I am a total noob. I am definitely eager to learn, but I am kinda lost and feel overwhelmed, as I have no plans in becoming a master at this, but just wanna have enough knowledge I guess so we can streamline our processes, from reducing the effort for setting up a server to deployment.

Like, what if we won't have to manually install or write a bash script to install all those dependencies every time, we can just simply prepare more readable Dockerfiles and just run containers? And have one-click deployments? Can I actually sort of put limitations on this? Like, I don't have to learn or dive deep into x y z for what I'm trying to do? What if..... should we just stick to bash scripts?

I tend to develop FOMO when learning a new technology :( I always feel like I have to learn everything about it in order to be knowledgeable or productive with it, so I try to learn everything I can, but I know that isn't practical. But for this one, how do I put limitations?

Also if you have any other insights, like if you think Docker is worth it or not in this case, etc, they'll be appreciated.

https://redd.it/fkh1z7
@r_devops

New to DevOps and have a question regarding a CI/CD cycle...

Hi everyone,

So, currently I'm a Sys Engineer on a local IT/Ops team. Over the past two years I've been working pretty heavily with PowerShell and fell in love with it! I tired to automate everything under the sun and succeeded most of the time while of course failing hard and learning from it. Fast forward to about 6 months ago, I really wanted to improve our small team and start building around the idea of automation and infra as code. So, I built out a Jenkins instance and took some scripts I had built for automating email notifications to users when their password expiration was coming up, cleaning up AD stale objects, WSUS updates and cleanup, etc. and started hosting them there and running on schedules. I then realized that keeping scripts on my local dev machine wasn't the best so I learned Git and started storing the scripts there and polling my Git repo in Jenkins instance. I've recently been building out a Chef server / workstation and working to integrate config management! Super happy with everything, except...

As embarrassing as this sounds, I would really like to start using Jenkins not just for one off freestyle projects but really use pipelines in a true CI/CD fashion, but I am having no luck figuring out a scenario in which I would use it? I know that probably sounds so dumb. I can totally understand how our Platform team in work uses it since they have a pipeline that goes from creating a build to testing to deploy, and that makes sense. But I'm trying to figure out how I could benefit from a CI pipeline with what I'm doing say building Shell scripts for various production reasons... I thought maybe a pipeline with say a Pester script and if that passes run a Git add/commit and push to repo? Again, maybe this is a silly question but I just for the life of me can't think of a way to use CI to make what I'm doing in Dev more streamlined or if that's simply not how this works. Thanks everyone!

https://redd.it/fkz7nn
@r_devops

Glueing tools together

Wanted to find out a bit more about what you guys use day to day in terms of your tooling.

At my work we rely heavily on EC2 with Nginx on the edge, then ALBs to EC2. This pattern is mostly for our legacy apps.

Then we have a whole bunch of microservices built with API gateway and lambda (with Dynamodb, SNS/SQS, RDS etc)

And recently we’ve moved some legacy over to ECS again fronted by ALBs (and same nginx on the edge)

All of this infrastructure is managed with a single php tool which is a wrapper around cloudformation, chef and packer.

We have a separation of:
- environment (dev, test, live)
- project (services, magento, core)
- repository (web, cron, servicename)

And we have a git repository in the following format: “environment-project-repository” (e.g. live-magento-cron) , yes we run magento!

Inside this repository is everything needed to create this environment, cloudformation, chef etc.

This setup seems to work for us quite well, really interested to see how others have solved the IaC problem.

https://redd.it/fkz1gy
@r_devops

Trying to locate a website for tools

There was a site that was similar to the XebiaLabs periodic table. I have been reviewing my old bookmarks and trying to Google it . Would appreciate any assistance.

Thanks

https://redd.it/fl190j
@r_devops

OpenShift is simply VMware for containers

Our company is looking to write new applications and deploy them to the cloud (Azure in our case). We have two camps, one for OpenShift the other for using PaaS offerings in Azure. We have a history of challenges in relation to managing the lifecycle of our OS, middleware and application (we are behind, a long way behind in some cases).
I see running OpenShift in the cloud (with no direction to deploy on-premises), as simply another abstraction layer on top of an abstraction layer, it has some great capabilities, I am just struggling differentiating from where we are now with where we will be in 5 years, ie the same place with more technical debt.
Help me change my mind..

https://redd.it/fl258j
@r_devops

Newrelic.com exploiting covid to sell their product, and it’s in poor taste.

“We know that keeping your business running smoothly is top of mind during this time of uncertainty with the spread of COVID-19.

It's more important (now, more than ever) to keep your underlying applications and Infrastructure reliable and to maintain a quality experience for your customers.”

I mean, WTF. Maybe I’m being too sensitive but this is bad taste.

https://redd.it/fkdczq
@r_devops

Any good reference material for learning to make helm charts?

My company is finally considering a move to container based infrastructure instead of the VMs. My first task is to containerize our apps most have official containers but I’m looking for a way to automate deployment. I tried using terraform and that worked in my rancher lab but not on our production rancher cluster since the generic kubernetes provider has no concept of a project and tries to create everything in the default project which I currently have no access to. My thought was to try helm instead. I’m open to other suggestions if anyone has a better idea.

Also how would one mount dynamic content to a config map at runtime? An example is logstash I want each of my pods to have a different configuration. I know I can do this all manually and it works fine but I’d like a way to automate the process. ATM the configurations are generated using ansible which for a logstash vm would copy everything over through a template. I’ve modified the logstash play to generate a directory with the config files.

Still new to the K8s game. I’m fine with standard container concepts but having a hard time figuring out how to apply the same knowledge to the kubernetes way of doing things.

https://redd.it/fl3ff6
@r_devops

Automated dependency updates without having Github

I am hosting all my code on Github and make use of the features dependabot offers (https://dependabot.com/), but in the past months I kept thinking about the same questions:

* What about people using Gitlab/Bitbucket or self-hosting their code (e.g. for compliance reasons). How do they do automated dependency updates?

* And I have had the cases where I wanted to have an automated pull-request, and thus an automated build, whenever e.g. a new node.js version is published to have always up-to-date applications/docker images and so on. What I did in that case, was to simply do a daily/weekly travis run where I would pull the newest node 12.x version and build everything. This works, but is not really elegant. Especially for softwares that gets many releases or rarely any.

What is your take on those two questions? How do you solve those problems?

The reason I am asking is because I am currently building a website to solve that problem for myself and wanted to see whether other people also might be interested in that solution (or maybe there is already an existing solution which I just don't know of)? The basic idea is that I notify developers over a channel (webhook?) whenever a software they uses get an update. I now got some time on my hands, so why not use it productively :D

https://redd.it/fkcr71
@r_devops

How hard will it be to crack Devops engineer job at Google products for example consider YouTube in this case. For a Devops job with 3 years experience requirement.



https://redd.it/fl4nwv
@r_devops