Help: How do I rotate secrets autonomously?

Example:

Secret is a GCP Service Account Key stored in a k8s secret and loaded into a Rails app that needs to be rebooted to load the secret therefore the original service account cannot be destroyed until successful reboot

https://redd.it/fteb2p
@r_devops

Am I doing this right? Laravel Project + Gitlab CI/CD + Docker Build

I have a laravel project that I'm trying to docker'ize. I have Gitlab CI/cd setup and I'm building a docker image containing the application, compiling my code (npm run build), pushing to my docker registry and then running docker pull on my production servers. Am I going about this right? I've looked through Kubernetes, but it seems a bit complex for use.

https://redd.it/ftd5tf
@r_devops

When can i say a code is expensive?

Technical debt is real when architecting infrastructure.

As a DevOps engineer and software architect, when do you say a code is expensive, can reddit give scenarios of expensive code and what makes code to be expensive.

https://redd.it/fte3sy
@r_devops

Magical Circuits: Opensource DevOps for game industry projects

Some days ago i published an article on [Gamasutra](https://www.gamasutra.com/blogs/JoseMoreira/20200327/360277/Optimising_UE4_Project_Builds_With_Cloud_Native_Infrastructure_And_Containers.php) and last night [on my own website](https://zemanel.eu/posts/2020/03/side-b-soft-launching-magical-circuits/), publicly announcing [Magical Circuits](https://magicalcircuits.com).

Basically been researching into cloud-native tech and architectures for Unreal Engine projects (and related workloads). Currently just setting stuff up, chatting with people from the industry, planning and gaining momentum. There's a good chance this announcement is going to be published through the CNCF newsletter soon ¯\_(ツ)_/¯.

I hope to, over the course of this and next year, publish some tools and content. For example, I have been outlining the topics for a book, as i mention in the article on my website.

I've also setup a [Patreon account](https://www.patreon.com/MagicalCircuits) to support the project and myself (things a bit rough on the jobs side also because of the cov-19). Working on additional Tiers as things develop. Please subscribe and share!

Feel free to reach out with any feedback! I've also setup a [Twitter account](https://twitter.com/MagicalCircuits) and a [Discord server](https://discord.gg/HAhBmB). Activity is low at the moment. Thanks!

https://redd.it/ft861l
@r_devops

Install a centralised Vault server that can be accessed by developer locally, CI/CD, and inside the Kubernetes cluster

I recently tried installing Vault Integrated Storage to achieve Hashicorp’s recommended HA architecture. That means I have 4 Vault servers installed separately in AWS and 1 server is appointed to be the leader. This is my desired setup so that my organisation can access it for their local development, feed CI/CD, and also use it in production environment. It works fine when just testing the features.

But it did not work when I tried adding Vault injector and use the external Vault server that I setup above. Part of Vault + Kubernetes setup is to install the vault servers inside the K8s cluster but it is not really recommended due to the nature of Kubernetes.

I want to have a Vault cluster with HA architecture that is outside Kubernetes and be able to accessed by anyone and also the pods.

Who has a similar setup that works?

Thanks!

PS: I have already followed the guides by Hashicorp. Especially installing using Consul or Raft.

https://redd.it/ft7eey
@r_devops

LAMP server deployment

Using ansible, how could I split that on 1 vm it could run and configure Apache and on the other vm setup and configure mysql or mariadb . Any links or documentation would be very appriciated.

Sorry for the noob question, recently started taking interest into DevOps.

Have a good day

https://redd.it/ft3gep
@r_devops

Learning Kubernetes

I have been using Docker with my previous company and the tech stack of my next job requires me to know Kubernetes. Are there any good resources/tutorials to learn Kubernetes from scratch?

https://redd.it/ft3ctf
@r_devops

On furlough for 3 months, What should I learn.

Hello all, I have been placed on furlough along with a lot of others in my business, from the UK. What are some things that I could learn in that time? In my day-to-day working with AWS e.g. Cloudformation, API Gateway, and so on.


So I decided at this time I'm going to treat Monday to Friday as normal work time,


I've decided on the following so far


\- Docker

\- Getting better at Python
\- Working towards AWS Dev Ops Pro


Got any suggestions for personal development so I can come back to the business stronger,


Thanks in advance.

https://redd.it/ft35tt
@r_devops

Advice on Transition To DevOps

Hi,

I have been working as a QA/Test Manager for nearly twenty years. For the past 4 months, I have worked as a tribe test engineer which has given some good exposure to DevOps and now I am planning to do a career change into a DevOps Engineer.

Please give me some advice on how I should go about learning to become a DevOps Engineer and how long it would take to be job/interview ready.

Many Thanks

https://redd.it/ft34lm
@r_devops

Resource accountability?

How do you handle resource accountability in your organization? I'm working in a small company as the sole DevOps engineer. I'm struggling with handling accountability for SaaS instances we deploy for clients. While the operational cost is low it's often forgotten when the client leaves, as communication doesn't flow in our direction for those events. Some of our business is also very seasonal or engagement based, so we might want to keep the product deployed for that client perpetually. This is also hard to manage.

In short, how do you keep track of the life expectancy of instances requested?

https://redd.it/ftoasx
@r_devops

Terraform and inital app code base

Good Afternoon,


I've built up quite a nice packer + terraform POC to deploy infrastructure on AWS. It's working very nicely and I'm happy with it and the tool. I'm wondering what others do to deploy their initial application code base onto the terraform infrastructure?


Packer seemed like a good idea, however my application requires an EFS mount and connectivity to an RDS therefore I can't see this working quite right.


Any suggestions would be greatly appreciated as usual.

https://redd.it/fto9al
@r_devops

What's the toughest problem that you'RE Still trying to sovle with kubernetes?

Hi All, I was wondering with what hard problems we are still struggling in day to day activities.

In my experience kubernetes & container technology has come pretty far in last couple of years. Installation can be done in few click on major cloud providers & management has become much more easy as well.

https://redd.it/ftjs7r
@r_devops

Setting Open VPN client in debian-9

I want to set up a VPN client similar to [L2TP VPN - Windows 10 configuration][1].

I have installed `openvpn` using

`sudo apt-get install openvpn`

`/etc/openvpn/client.conf` looks like :

```
client
dev tun
port 1194
proto udp

remote 123.456.789.10 1194
nobind
```
and client configurations taken from [OpenVPN Debian VPN][2].

`sudo openvpn --config /etc/openvpn/client.conf`

> Options error: You must define CA file (--ca) or CA path (--capath)
Use --help for more information.

[Here describes][3] how to do this, but client configuration file was not listed there.

**I can not take any key or certificate file from my server**. I just want to create simple client just as its in Windows-10.

[1]: https://support.untangle.com/hc/en-us/articles/231971387-L2TP-VPN-Windows-10-configuration
[2]: https://wiki.debian.org/OpenVPN
[3]: https://superuser.com/questions/1183305/how-to-install-openvpn-client-in-debian

https://superuser.com/questions/1537806/setting-open-vpn-client-in-debian-9

https://redd.it/fsys6m
@r_devops

Continuous Delivery Stats

Just showcasing that the good fight we are all fighting, the firm I work at typically interviews folks on Continuous Delivery maturity. We took 12 months of our findings into book form.

For example, Canary Deployments are hard, 4% of folks we talked to deploy using a canary.

Book:

[https://harness.io/continuous-delivery-insights-2020-ebook/](https://harness.io/continuous-delivery-insights-2020-ebook/)

Always curious about what challenges folks are facing around Continuous Delivery? Think that CD is a compact disc? Me too \[ironically my car has not had a CD slot since 2010..\]. I would love to hear!

\-ravilach

https://redd.it/ftptnh
@r_devops

Capturing dynamic infrastructure in a Infrastructure as code world

I'm looking for someone to help me connect some dots conceptually.

I understand the basics of IOC, but some situations it disconnects for me.

For example, in my application, when I create a user, I want to create a pubsub topic for that user, so that if I need to send a notification to that user, I can publish to their topic and leave the part of the system subscribed to that to deliver the message.

Likewise, if a 'team' is created in my application, I create a topic for that team, which fans out to the members of the team.

All of these things are dynamically created. How would I capture that into IAC? Or is it simply that this describes something that wouldn't be IAC?

Thanks for reading!

https://redd.it/ftqnml
@r_devops

what do you use python for in the devops space?

Looking for ideas to create some new tools for devops using python. Any ideas would be very appreciated. Looking to solve new problems but also interested in what has already been solved using python.

https://redd.it/ftr5mx
@r_devops

Custom Openshift PAAS Alternative with Kubernetes

Hi, first of all, sorry for my poor english, i'm french. I don't know if i got the good approach to do something.

I work for a company which purprose an web application for banking operation.

We host our application and we have multiple separated instance with different version and different parameter of it. It's hosted with the "old way" : A web server + A BDD on baremetal or on virtual machine . No docker or Kubernetes yet.

As we have many instance with different version, different parameter, we had to maintain some "replica" of each instance for the hotline service which permit them to reproduce some bugs whenever a customer call. For now, we want to change this.

We want something which permits the hotline operator to ask with a web form, an instance of the application with their own parameter and **the version to follow** (for example when a tag is updated, their instance is update). After filled all those information, they receive an url which permit them to access to the instance.

To do it, i first dockerize the app, place all the app parameter as environment variable, then i try openshift 3.11 which have a kind of webform that fill a template file according to the filled parameter. This template file have a Deployment, A service and a route (kind of ingress). Openshift can also "follow" a tag and trigger an rollout on deployment when there is a new tag.

I manage to make it work but after facing many problem (prometheus, nfs subpath volume claim bug etc ) due to the old version of kubernetes included in Openshift 3.11, and after seen the painful process to upgrade to Openshift 4, I decided to switch directly to Kubernetes and write custom script and use CI/CD tools.

I installed kubernetes successfully on baremetal.

I made an little flask application, which permit user to fill an yaml template. This template contains Deployment, A service and an Ingress. Then i apply this yaml to the cluster and reply back with the url.

This feature work.

For the "version to follow" feature. I just looked some tutorial about Jenkins (first time doing Jenkins) .

It's seems that the approach is the following :

Scan the git repository, whenever a specific branch is updated, clone it, Build it, Publish it on the registry, then recreate a specific deployment on the Kubernetes cluster.

But, i want this approach

Scan the git repository, whenever a specific branch is updated, clone it, Build it, publish it on the registry, then patch and rollout many deployment with the same label or with the same image version on the Kubernetes cluster.

As i cannot find any documentation with this approach, i want to know if i have the good approach. Can someone help me please ?

PS : We host everything :

GIT server : Gitea

Docker registry : Private hosted one

https://redd.it/ftrc2n
@r_devops

Searching for a Book of Bamboo server/system(?)

My Boyfriend started to work in IT and looks for a book of the bamboo server. we just only found the pdf version (for free, we know, but we want a real book).. Do anyone have a result? maybe a book with this and some other topics?

https://redd.it/ftstw4
@r_devops

How to host your helm repository on GitHub

Hi everyone, over the past couple of weeks I've been working on [a Helm chart](https://github.com/renovatebot/helm-charts) for [Renovate](https://github.com/renovatebot/renovate), an open source project I'm involved in. Previously, I'd have just hosted this chart in the [helm/charts](https://github.com/helm/charts) repository, but now that's deprecated it wasn't clear where the best place to host helm charts were.

I'd seen some discussions about using GitHub Pages to host on [Helm Hub](https://hub.helm.sh/), and some tools like [Chart Testing](https://github.com/helm/chart-testing) or [helm-docs](https://github.com/norwoodj/helm-docs) to ensure high quality charts and documentation. I hadn't seen anything tying it all together in a complete package, so that's exactly what I tried to do.

Check out [How to host your Helm chart repository on GitHub](https://jamiemagee.co.uk/blog/how-to-host-your-helm-chart-repository-on-github/). It walks you through how to setup GitHub Pages and GitHub Actions build and host your helm repository, using best practices.

I'd love to hear how everyone else is doing this as well. And, of course, if you've got any feedback for me too!

https://redd.it/ftrf9y
@r_devops

Kubernetes cluster down on AWS?

Built a cluster on AWS Cloud9 using EKS but the cluster is down even the master node showing not ready..dont know whats going on since i looked at EKS and check on the nodes. All the nodes even say "Not Ready" even master, it was working previously but think have might done something to break it.

​

"AccessDeniedYour worker nodes do not have access to the cluster.

eksctl-eksworkshop-eksctl-nodegro-NodeInstanceRole-1BJZZG66QZ0KN"

​

I troubleshooted using this guide [https://aws.amazon.com/premiumsupport/knowledge-center/eks-worker-nodes-cluster/](https://aws.amazon.com/premiumsupport/knowledge-center/eks-worker-nodes-cluster/) but problem still persists.

https://redd.it/fty2gc
@r_devops

Your Worklife balanace? On call nights and weekends?

Curious about transiting into devOps. I find the tools, tech, and the mindset interesting but concerned about the work/life balance.

Would you guys mind sharing your perspective on this? Is it the typical 40 hours/week? How often are you on-call, every night or weekends?

https://redd.it/ftu35m
@r_devops