How are you managing credentials in Jenkins?

Use case: We use Jenkins to run operational scripts and some CI pipelines along with the credentials plugin to store service account passwords and ssh keys for authentication to APIs and servers.


Current Implementation: Currently we are managing credentials via the Jenkins Puppet module paired with encrypted hiera, so we are able to use IaC for secrets without exposing them.


Problem: The main issue we are facing is that the Jenkins Puppet module doesnt support updating credentials. I.e. when a service account password is changed in AD, we have to update the puppet code, and then manually delete the credential object in the Jenkins UI and then puppet will add the updated password back to Jenkins. Obviously, this is a pain in the ass to manage.


Potential Solutions?: Use an external secrets repo like Vault or Conjure, automate the deletion of the credential needing an update, rewrite jenkins module.

https://redd.it/kf6q5u
@r_devops

What cloud storage provider to choose?

We are searching for a cloud service. We need to store our data and documents somewhere. At first, we were thinking of a NAS server, but it's too pricy and too complicated and we don't need that. I got a suggestion to try a cloud service.

What do you recommend and why? The most important thing for us is to share our files very easily because several people work on one document. The best way would be to have a folder on a desktop shared between several PCs. Does the cloud have this functionality?

https://redd.it/kf6pf2
@r_devops

CLI for different tools

Not that long ago I found a CLI that was something like an alias for many different systems/tools. I wanted to test it, but I lost the name. Are you familiar with such tool? It worked something like this:

this-tool-name build # builds docker from local Dockerfile
this-tool-name something-else # performs an action using aws-cli
this-tool-name extra-action # runs ansible-playbook

https://redd.it/kfibzk
@r_devops

DevOps Engineer Career Progression (DevOps Engineer to DevOps Lead)k8s to azure service fabric

Hey! 👋

I am currently working as a DevOps Engineer in a fortune 100 company. My work mostly involves around k8s, creating clusters (Vanilla K8s on various providers like azure / VMware/ Nutanix, etc), writing tools in go/python, etc. My team is fairly big and I learned a lot about k8s in the last 2 years in this.

To get a pay hike, I decided to move on to a new opportunity and got offered a role as a DevOps lead in a small (20ish) people company. When I say lead, I am 1st DevOps engineer being hired as they want to scale their product in the coming years.

What would you advise for someone novice to azure service fabric?

Are there any books/courses I should be looking into?

I am well versed in Python, have significant experience in C/C++, and learning GO (Mainly writing controllers/operators). Is C# is must learn to work with Azure Service Fabric?

What development machine (Windows / Mac / Linux) I should opt for? (I am currently using Mac and very comfortable on it but have used windows a lot as well so don't really mind.)

Note: I am from the EU

https://redd.it/kf41jp
@r_devops

Websocket Monitoring - Need Advice

What are the best way to do monitoring for websocket connections?
for example we would want to measure:

* length of time the websocket sessions are open
* the amount of time it takes from getting a websocket request until the response is sent back
* amount of times websocket connections closed unexpectedly

we would like to measure these as server-side metrics only without the external network effects.
which tools would you use for this use case?

thanks in advanced!

https://redd.it/kevtem
@r_devops

A Micro Continuous Delivery software

Is there's any micro CD system. I want software that will watch GitHub for pushes and pull the changes to my VPS then I will execute some commands, nothing fancy!

https://redd.it/kfkkz0
@r_devops

GitHub will stop allowing basic auth for git operations

How do you guys plan to mitigate this in your pipelines? Some plugins we use require us to use basic auth to work with git.

Edit: never mind read the actual blog post. Make sure you use PAT’s

https://www.theregister.com/2020/12/17/githubbanspasswords/

https://redd.it/kfl5f2
@r_devops

Its that time of the year again :) What have you automated lately ?

I know this been asked couple of time but however I am sure there are new things you guys have automated ? :D

https://redd.it/keuhpi
@r_devops

DevOps beginning help

Hello r/devops community

I have been a on-premise sysadmin for over 4 years, recently I got AWS CCP and Security+ certified and would like to begin my journey on devops, where would I start learning things like chef, puppet, ansible, jenkins and Teraform?

https://redd.it/kfntah
@r_devops

Pipelines: A Free DevOps/SRE Bootcamp

Hey all! This is my quarterly announcement for a completely free DevOps/SRE bootcamp I run that is beginning January 4th of 2020.

What is it?

Pipelines: A Journey into Software Delivery, automation and Infrastructure

Pipelines is a technical training series designed to expose you to concepts in DevOps and Site Reliability Engineering. Throughout the Journey, it will help you understand how you can help organizations deliver software faster and more efficiently, as well as how you can ensure millions of people can access these digital products reliably.

When and Where is it?

Mondays and Wednesdays at 7pm ET from January 4 2021 - February 24 2021 on Twitch!

channel: https://twitch.tv/mastermndio

Who is it for?

This is the "Apprentice" level of the course, so it is designed for those new to the discipline who want to be exposed to and get hands on with the many topics needed to be an effective practitioner of DevOps/Site Reliability principles. There will be "Journeyman" and "Master" levels of the Pipelines course that follow this course for anyone who is looking for a deeper dive into these disciplines.

How Much is it?

It is 100% free to participate is ALL parts of the bootcamp. Due to popular requests, we have implemented a pay what you want model if you'd like to support, but there is ABSOLUTELY NO OBLIGATION. Our goal is simply to expand access to digital engineering skills.

More Info and Registration

You can find complete information about all bootcamps at https://academy.mastermnd.io

Click Here For Curriculum

Click Here for direct Registration

​

P.S. Recording will go up on YouTube 24 hours after they have aired, due to Twitch ToS, but in order to keep the channel clean and organized for upcoming content, The recording will be private, and the link will be accessible from Google Classroom.

​

If you have any questions, ask away here or shoot me an email at [email protected]. Thanks and I look forward to learning with you!

https://redd.it/kfpffg
@r_devops

help with deployment on Iot devices. is ansible pull right for me?

Hello, this is all fairly new for me so I hope you are able to guide me in the right direction.

I have the following challenge: I have multiple raspberry pi which are running some python scripts and are sending sensor data to GCP. Right now, the main issues I need to solve are for monitorization (considering zabbix) and scalability of this operation (considering ansible).

Right now it's all very manual, preparing an SD card with some automation scripts on first deployment. But any changes need to be done manually through ssh. Now that the main work the rpis perform is relatively stable, I am looking to automate the process.

The main constraint I have is that the rpis will be in various locations and due to how it's set up, I cannot depend on the IP address to "push" stuff to them. I need the rpis to initiate the conversation so to speak.

So I have been looking into ansible for executing commands on the rpis, and I have it set up in a few in "pull" mode, such that they run a cron job checking a Git repository and execute a few simple plays from local.yml if it detects any changes.

What I need is the following:

-I want to be able to execute commands to specific devices. So far I have seen ansible using inventory files, but these are using IP address. Is there a different way to control what devices execute which plays? Right now they all execute local.yml in the same way.

-Set up the git repository to private, while still allowing the rpis to get whatever is in there to execute the commands. As I understand it, it is possible, though I am not sure what will change.

Idk if this is the right way of doing it, so I hope someone can guide me in the right path. Basically I am interested in being able to setup and configure the rpis automatically and ideally personalize them. For example, they are all getting the same initial setup and python scripts, but they have some variables in the scripts which depend on the particular location, so I'd like to customize these somehow.

Am I going about this the right way?

https://redd.it/kfiosw
@r_devops

Is this what DevOps is like?

I've been working as a SRE for the past year, straight out of college. Atm I'm getting bored with my job, and I'm starting to feel a little frustrated. I'm working in a small team, providing support for a single Bus. Unit, inside a larger organization that has a main SRE team that provides support for the hole company. Atm, my team's only purpose is to remove all of the burden out of developers in our BU, so that they can focus on developing, meaning that we spent most of our time taking care of their dependencies. My team is not really providing any new solutions for anything, we are simply following the rest of the company's aproach to everything, and we don't really have a chance to speak up with our own opinions.
Since this is my first job in IT, and I don't really have a wide view of how things happen in other companies, I would just like you to tell me:

I spend my days requesting tickets to other teams, changing env. variables, updating pipelines, bootstraping new RDSs, applying terraform to create new rabbitmq queues, etc. I'm I at a dead-end job? Should I try to find a new place to work?

https://redd.it/kfl6wq
@r_devops

What are the Kubernetes Interview Questions for 2020

Companies use Kubernetes because:

It helps in breaking down the containers into smaller modules to ensure more granular management.
Has quite an improved infrastructure than other DevOps tools.
It makes it seamless to deploy software upgrades frequently.
Has the foundation for the cloud-native apps.

This category lists the questions that are asked related to the general working of Kubernetes during the interviews.

1. The classic question --- What do you know about Kubernetes?
2. How do you think Kubernetes is related to Docker?
3. What difference do you find between Docker Swarm and Kubernetes?
4. What do you understand by container orchestration?
5. What difference do you find between deploying applications on the host and containers?
6. What are clusters in Kubernetes?
7. What do you know about Heapster?
8. What is Google Container Engine?
9. What is Kubectl?
10. What is Minikube?
11. What is Kubelet?
12.  How Kubernetes simplifies the containerized Deployment?
13. What is the use of nodes in Kubernetes?
14. What are the two prime components of Kubernetes architecture?

https://redd.it/kfhmtn
@r_devops

Salary negotiation help

Hi all,

This is a throw away account because I think a few people I work with currently know my Reddit.

I was recently head hunted for a job and have no idea how much salary I can ask for. My only friends in the field are at my current work place so I don't know if I can ask them about this.

It's a start up so presumably I can ask for shares? I have no idea how much is appropriate and as for salary, well my current rate is around £55k but comes with a huge amount of employee benefits as well as job security that this new place probably can't offer.

What should my initial asks be? What would you kind folk do in this scenario?

https://redd.it/kfhfu4
@r_devops

Hello team need some suggestions regarding hashicorp vault.

Actually currently I have deployed vault with storage backend as file type and with internal ip address with http access.

Now I am looking to change my internal ip to publicip.

Is it need to stop my cureent vault and start again with config file or if we edit the config file and start it will work.

Do I need to put with https access for pulic ip vault server.

Please gave some suggestions which will help me in this.

Thanks in advance.

https://redd.it/kfgmxv
@r_devops

Do DevOps/SRE jobs always have an on call component?

I've been a network guy for a long time, and have always wound up in large shops where development, engineering, architecture, and ops were pretty well siloed, and barring an absolute catastrophic nightmare meltdown which legitimately required all hands on deck, ops was always 24x7 and handled the off-hours stuff.

I'm looking at my first job at one of the bigs where they have a DevOps/SRE leadership-type role that I'd be good for. I'm sick to death of the intrusion that an on call rotation can have on your life. I've been called out of birthdays, holidays, dates, and family stuff, often for unnecessary bullshit because "oh, I can't ping, so it must be the network". And I can't have a couple drinks or be more than $SLA minutes from my house, and have to sleep with my phone by my head, which is a huge imposition on my personal life. So as much as it may limit my career arc, a job with an on call rotation is pretty close to a hard No for me.

Are there DevOps/SRE-style jobs out there which involve working on production systems and which don't have an on call component? I know I can ask the potential employer, and I absolutely will, but I'd like to get a sense of what exists in the industry at large. Have I just been lucky to have avoided the pager rotation up until now?

Maybe I haven't been properly exposed to DevOps, but it really does smell like it's a way to force people already working 60 hours a week to allow work to preempt what's left of their personal life under the guise of "those who build it must own it". I mean, I get it, ivory tower assholes are no good for anybody, but...how does this culture allow for any balance in life?

https://redd.it/kfxwyc
@r_devops

Hands-on GitOps with OneDev and Kubernetes

GitOps is a DevOps approach to maintain Kubernetes-based infrastructure as code in git, and operate it with git tools such as push, revert, pull request.

OneDev (https://github.com/theonedev/onedev) is an open source git repository server, with built-in CI/CD integration.

This tutorial explains how to set up OneDev to do GitOps in Kubernetes.

https://robinshen.medium.com/hands-on-gitops-with-onedev-f05bd278f07c

https://redd.it/kfyq0t
@r_devops

How to develop software for DevOps without access to applications/app servers?

Hi all,

After working in tech on the product side for 8+ years I think I've identified a couple of opportunities to serve the devops function through a SaaS offering. However I am a bit unsure of where to start building given this project is outside of my wheelhouse and company.

The general concept involves being able to take log files automatically off of app servers(via HTTPS or some other interface), apply some proprietary ETL rules and store the output into a bucket somewhere based on customer's stacks(S3, etc) with various APIs to leverage this observability data.

My (potentially dumb) question: how can I build or prototype this type of software without access to an environment or application that generates log files for me to pull from? My development background is more to java but that was years ago - what kind of stack or languages should I be looking at? Would love any kind of guidance, feel free to PM.

https://redd.it/kg14ci
@r_devops

Will working on an old technology stack affect my career ?

Hello everyone, I hope you are all well!

I've always wanted to work as DevOps engineer/architect because it's such an exciting job that requires personal accomplishment on a daily basis.

From 2017 to 2020, I worked in a company while doing my software engineering degree and most of the time I did project management and technical architecture.

In September, I started applying for jobs, unfortunately for the DevOps jobs I applied for, I often lacked experience (which is true) or the work was underpaid.

I think that COVID-19 had a negative impact on companies and they are careful when they recruit young profiles (I am 23 yo).

I recently started my new job (two weeks ago) as a junior technical and software architect at the Ministry of Finance and I wondered if this was the best path for me?

The technology stack is old and it's a process-oriented organization, which makes change difficult.

I have a lot to learn there! but I think I could learn more/faster elsewhere!

Also will working on an old technology stack affect my career?

https://redd.it/kfqxa3
@r_devops

Supertokens - an open source alternative to Auth0, Firebase Auth, and AWS Cognito

I thought the r/devops subreddit might be interested in this project I just found!

https://github.com/supertokens/supertokens-core

If you like this, I do a weekly roundup of open source projects that includes an interview with one of the devs you can subscribe to.

https://redd.it/kfutz3
@r_devops

Solarwinds' Loggly and Papertrail Default to Sending Unencrypted Logs

Solarwinds owns two of the top-tier logging companies and has been embroiled in a security scandal recently. Each of them (Loggly and Papertrail) has default Syslog instructions that lead to unencrypted log sending.

https://www.wrble.com/blog/solarwinds-default-logs-unencrypted/

Logs very often contain sensitive data, are you sure they're encrypted?

https://redd.it/kfs7po
@r_devops