How much does it cost to run the web application called Omegle?

I believe it shouldn't cost much because everything is P2P?

https://redd.it/m4ed9h
@r_devops

Can't run my Django app on port 80 on GCE

Hello guys,

I'm far from being a DevOps but having issues running my Django on Google Compute Engine

I have created both http-server and https-server firewall rules.

The app is deployed on Google's Artifact Registry

I can SSH into it but cannot view it in the browser.

I learned VM-level firewall could be intervening but have no idea how to by-pass it even after running the commands from this guide: https://cloud.google.com/container-optimized-os/docs/how-to/firewall

Here's my response from docker ps: https://ibb.co/DGrXBPD

I'd appreciate your help

https://redd.it/m5llxa
@r_devops

What is remote working like in your field? Is it possible to be a "tech nomad" of sorts?

Is the nomad life impossible for you guys since you might be needed more urgently than say a software dev? And therefore have to be in the same timezone as your employer?

https://redd.it/m5m6yr
@r_devops

For those using distributed tracing in production, I want to hear from you

I'm a maintainer in an open-source project in the distributed tracing area (Jaeger) and would like to hear from actual users of tracing tools:

\- Why are you using distributed tracing in the first place? I know quite a few reasons to use it, but I wonder what makes YOU use it. I know I'll learn a new and surprising use case after this experiment :-)

\- How does your solution look like? Which libraries are you using for instrumentation? Which components are in your backend? How are you using the tracing data?

\- Which benefits were you able to obtain so far?

\- What are you currently missing? Knowledge? Internal buy-in? Tooling?

https://redd.it/m5giof
@r_devops

DevOps and NoCode/LowCode

I've seen over the last year a lot of hype building up on no-code and low-code (mostly on things not related to DevOps).

I was curious about the community's take on this topic so... do you think no-code solutions can be applied to DevOps? What do you think would benefit from no-code?

https://redd.it/m5nbcs
@r_devops

Could AWS EC2 instances ping Client VPN on the same VPC?



I have a scenario where I have multiple Raspberry Pis connected to the Client VPN Endpoint and an EC2 instance on the same VPC. I want to SSH into those Raspberry Pis by using the IP addresses that the VPN provided.

I have a VPC with one subnet where I have one EC2 instance and a Client VPN endpoint on the same VPC. The Client VPN could ping the EC2 instance but the EC2 instance could not ping the Client VPN? Could AWS EC2 instances ping Client VPN on the same VPC? If so, how could I achieve this?

https://redd.it/m5jsju
@r_devops

How long does it take to set up docker containers usually? (ballpark figure/approximate range)

We're working on an app that allows to set up dev environments within docker containers in less than 10 minutes and we'd like to compare with the manual setup process/alternative solutions.

How long does it usually take you to setup a project before you get started on a project if you're starting from scratch?

https://redd.it/m5qcj4
@r_devops

Good tools/examples for creating runbooks?

I have a need for maintaining Ops documentation in project repositories along with diagrams and stuff.

I'm thinking about using diagrams for diagramming over visio/lucid and looking for any tools out there. I want to avoid putting the documentation into a wiki as it stagnates.

Anyone seen any good tools for this?

https://redd.it/m5tqye
@r_devops

Suggestions on where to find or hire DevOps on demand ?

What is a good place or platform to find DevOps on demand, per day , hour or projects ? What would you recommend ?

https://redd.it/m5pd68
@r_devops

How do you integrate DevOps best practices in your modern applications?

In this blog I do an overview of modern application development practices. One of the practices I include is DevOps and the role they play in building more robust modern applications. I would appreciate your feedback. https://www.reddit.com/user/Ricardo1021/draft/95edb93a-85ac-11eb-ad89-2e4c22d149bd

https://redd.it/m5osc4
@r_devops

Unable to active the https UI on Vault

I try to run Vault with a CRC OpenShift 4.7 and helm3 but I've some problems when I try to enable the UI in https.

Add hashicorp repo :

```
helm repo add hashicorp https://helm.releases.hashicorp.com
```
Install the latest version of vault :


```

[[tim@localhost config]]$ helm install vault hashicorp/vault \
> --namespace vault-project \
> --set "global.openshift=true" \
> --set "server.dev.enabled=true"
```

Then I run `oc get pods`

```
[tim@localhost config]$ oc get pods
NAME READY STATUS RESTARTS AGE
vault-project-0 0/1 Running 0 48m
vault-project-agent-injector-8568dbf75d-4gjnw 1/1 Running 0 6h9m
```

I run an interactive shell session with the vault-0 pod :
```
oc rsh vault-project-0
```

Then I initialize Vault :

```
/ $ vault operator init --tls-skip-verify -key-shares=1 -key-threshold=1
Unseal Key 1: iE1iU5bnEsRPSkx0Jd5LWx2NMy2YH6C8bG9+Zo6/VOs=

Initial Root Token: s.xVb0DvIMQRYam7oS2C0ZsHBC

Vault initialized with 1 key shares and a key threshold of 1. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 1 of these keys to unseal it
before it can start servicing requests.

Vault does not store the generated master key. Without at least 1 key to
reconstruct the master key, Vault will remain permanently sealed!
It is possible to generate new unseal keys, provided you have a quorum of
existing unseal keys shares. See "vault operator rekey" for more information.
```

Export the token :

```
export VAULT_TOKEN=s.xVb0DvIMQRYam7oS2C0ZsHBC
```

Unseal Vault :

```
/ $ vault operator unseal --tls-skip-verify iE1iU5bnEsRPSkx0Jd5LWx2NMy2YH6C8bG9+Zo6/VOs=

Key Value
--- -----

Seal Type shamir
Initialized true
Sealed false
Total Shares 1
Threshold 1
Version 1.6.2
Storage Type file
Cluster Name vault-cluster-21448fb0
Cluster ID e4d4649f-2187-4682-fbcb-4fc175d20a6b
HA Enabled false
```

I check the pods :

```
[tim@localhost config]$ oc get pods
NAME READY STATUS RESTARTS AGE
vault-project-0 1/1 Running 0 35m
vault-project-agent-injector-8568dbf75d-4gjnw 1/1 Running 0 35m
```

 
I'm able to get the UI without **https** :

In the OpenShift console, I switch to the **Administrator** mode and this is what I've done :
- Networking part
- Routes > Create routes
- Name : vault-route
- Hostname : 192.168.130.11
- Path :
- Service : vault
- Target Port : 8200 -> 8200 (TCP)

Now, if I check the URL : https://192.168.130.11/ui :


The UI is available.


 

In order to enable the https, I've followed the step here :

https://www.vaultproject.io/docs/platform/k8s/helm/examples/standalone-tls

But I've change the **K8S** commands for the **OpenShift** commands


```
# SERVICE is the name of the Vault service in Kubernetes.
# It does not have to match the actual running service, though it may help for consistency.
SERVICE=vault-server-tls

# NAMESPACE where the Vault service is running.
NAMESPACE=vault-project

# SECRET_NAME to create in the Kubernetes secrets store.
SECRET_NAME=vault-server-tls

# TMPDIR is a temporary working directory.
TMPDIR=/**tmp**
```

Then :

```
openssl genrsa -out ${TMPDIR}/vault.key 2048
```

Then create the **csr.conf** file :
```
[tim@localhost tmp]$ cat csr.conf
[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = vault-project
DNS.2 = vault-project.vault-project
DNS.3 = *apps-crc.testing
DNS.4 = *api.crc.testing
IP.1 = 127.0.0.1
```

Create the **CSR** :
```
openssl

req -new -key': openssl req -new -key ${TMPDIR}/vault.key -subj "/CN=${SERVICE}.${NAMESPACE}.apps-crc.testing" -out ${TMPDIR}/server.csr -config ${TMPDIR}/csr.conf
```

Create the file ** **csr.yaml** :
```
$ export CSR_NAME=vault-csr
$ cat <<EOF >${TMPDIR}/csr.yaml
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
name: ${CSR_NAME}
spec:
groups:
- system:authenticated
request: $(cat ${TMPDIR}/server.csr | base64 | tr -d '\n')
usages:
- digital signature
- key encipherment
- server auth
EOF
```

Send the CSR to OpenShfit :
```
oc create -f ${TMPDIR}/csr.yaml
```

Approve CSR :
```
oc adm certificate approve ${CSR_NAME}
```

Retrieve the certificate :
```
serverCert=$(oc get csr ${CSR_NAME} -o jsonpath='{.status.certificate}')
```

Write the certificate out to a file :
```
echo "${serverCert}" | openssl base64 -d -A -out ${TMPDIR}/vault.crt
```
Retrieve Openshift CA :
```
oc config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}' | base64 -d > ${TMPDIR}/vault.ca
```

Store the key, cert, and OpenShift CA into Kubernetes secrets :
```
oc create secret generic ${SECRET_NAME} \
--namespace ${NAMESPACE} \
--from-file=vault.key=/home/vault/certs/vault.key \
--from-file=vault.crt=/home/vault/certs//vault.crt \
--from-file=vault.ca=/home/vault/certs/vault.ca
```

The command `oc get secret | grep vault ` :
```
NAME TYPE DATA AGE
vault-server-tls Opaque 3 4h15m
```
Edit my vault-config with the `oc edit cm vault-config` command:
```
# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
extraconfig-from-values.hcl: |-
disable_mlock = true
ui = true

listener "tcp" {
tls_cert_file = "/vault/certs/vault.crt"
tls_key_file = "/vault/certs/vault.key"
tls_client_ca_file = "/vault/certs/vault.ca"
address = "[::]:8200"
cluster_address = "[::]:8201"
}
storage "file" {
path = "/vault/data"
}
kind: ConfigMap
metadata:
creationTimestamp: "2021-03-15T13:47:24Z"
name: vault-config
namespace: vault-project
resourceVersion: "396958"
selfLink: /api/v1/namespaces/vault-project/configmaps/vault-config
uid: 844603a1-b529-4e33-9d58-20525ea7bff
```

Edit the **VolumeMounst**, **volumes** and **ADDR** parts my statefulset :
```
volumeMounts:
- mountPath: /home/vault
name: home
- mountPath: /vault/certs
name: certs
```

```
volumes:
- configMap:
defaultMode: 420
name: vault-config
name: config
- emptyDir: {}
name: home
- name: certs
secret:
defaultMode: 420
secretName: vault-server-tls
```
```
name: VAULT_ADDR
value: https://127.0.0.1:8200
```

I delete my pods in order to take into account all my changes
```
oc delete pods vault-project-0
```

And...

```
tim@localhost config]$ oc get pods
NAME READY STATUS RESTARTS AGE
vault-project-0 0/1 Running 0 48m
vault-project-agent-injector-8568dbf75d-4gjnw 1/1 Running 0 6h9m
```

vault-project-0 is on 0/1 but running. If I describe the pods :
```
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning Unhealthy 1s (x6 over 26s) kubelet Readiness probe failed: Error checking seal status: Get "https://127.0.0.1:8200/v1/sys/seal-status": http: server gave HTTP response to HTTPS client
```

If think that I've missed something but I don't know what...

Someone to tell me how to enable https for the vault UI with openshift

?

https://redd.it/m5nfmd
@r_devops

Stop re-writing pipelines! Why GitHub Actions drive the future of CI/CD

The Pipeline-as-Code pattern is implemented by most CI/CD platforms today. So what could be the next evolutionary step? Based on GitHub Actions, the article outlines why open-source Pipeline-as-Code Building Blocks will take your pipelines to the next level.

Read more...

https://redd.it/m5n6it
@r_devops

Terraform or Pulumi or Crossplane or ... ?

Which IaC tool you prefer and why?

From my perspective, it's either Terraform (we know it works) or Crossplane (it's changing the game).

\>>> https://youtu.be/RaoKcJGchKM

https://redd.it/m6cnqm
@r_devops

Komodor a troubleshooting K8s-native platform, is now open beta!

Hey all,

After months of work, and input from the community, we have officially launched the first K8s-native platform dedicated to making troubleshooting for dev+ops teams much more efficient, and we are ready to open our beta program to everyone!

We would like to work with users at companies who have K8s-based environments and are facing challenges with identifying the root cause for any given incident. Our platform is built to show how recent changes (code, config, deploys, etc) affect your overall system - for example recent deploys or config changes. We provide a clear correlation and understanding of changes’ ripple effect. Our users can see all alerts and changes upon a timeline and add related services, so they can quickly identify what may have triggered an alert. We welcome any and all volunteers and are happy to send a thank you and an awesome swag pack to anyone willing to beta test our platform and provide us with product feedback. If you are interested in getting involved, you can reach out HERE, and read more HERE.

https://redd.it/m6cm6p
@r_devops

What’s with the coding tests at tech companies?

So burned out interviewing and on the last round for the on-site I keep getting BS coding questions in (INSERT LANGUAGE). Literally I’m doing a bunch of hackerrank/leetcode/codesignal exercises which have nothing related to the job.

Full of algorithms, binary trees, concurrency, advanced fizz buzz like the coin toss and other exercises...

The description mentioned “scripting or coding experience” along with a huge list of tooling, networking and Kubernetes experience when they really meant that they wanted a software engineer that knows how to build shit.

TLDR:
Based on all the interviews I’ve been, all you gotta do to land a job at FAANG or unicorn tech companies is to do exercises at those coding platforms. You don’t need any experience

Am I the only one who find them annoying?

https://redd.it/m6amyf
@r_devops

Anyone come across Opsera?

Has anyone come across Opsera or have any thoughts regarding the tool? They seem to be building a bent your own tools version of GitLab, looks fascinating to but curious if others thoughts?

www.opsera.io

https://redd.it/m6l3we
@r_devops

What is a good way to keep multiple directories' contents synced with releases from a GitHub repo?

I work for a company that maintains lots of custom WordPress plugins and themes for our network of myriad WordPress sites. The GitHub repo managers have it set up so that webhooks are added to the repos and push releases out the main server hosting the files any time a new released is published (at least I'm pretty sure that is what's going on).

However, I run a few webservers that also use these plugins, and anytime a new release is published, I either manually update it via SSH or SFTP. Since I manage lots of WordPress sites (I've opted for multiple single-site instances, rather than a multisite install) and there are lots of plugins to keep up-to -date, this gets old fast.

I started writing a WordPress plugin that allows me to point installed plugins and themes to their GitHub URLs and make it so that I'm able to visually see when updates are available in the WordPress UI and make updates that way, and so far this approach is promising.

However, this solution is locked in to WordPress, and I'm hoping for a more reusable solution involving the command line and a cron job, and/or a way for me to run a command that checks if any new releases have been made and update the local directories that hold those themes and plugins.

I feel like this is a common-enough use case that there ought to be a standardized solution out there, but every time I Google it, it points me in the direction of setting up webhooks via GitHub repositories, which I don't want to do because A. I don't have the privileges to modify these repos' settings (though I suppose I could just fork them) and B. I wouldn't want to have to make modifications to the webhooks any time my webserver is migrated (for instance, I'm currently in the process getting ready to migrate everything to AWS). So rather than having the repo pointed to my server(s) via webhooks, I'd rather have the servers listening for new GitHub releases via cron, if that makes sense.

The OS I'm dealing with right now is RHEL 7, though I will be either updating to RHEL 8 or migrating to Ubuntu in the near future.

Let me know if there's a better community to ask this question, if I'm using any terminology wrong, or if I am thinking about this the wrong way.

https://redd.it/m6cuwo
@r_devops

What are the pros and cons of using a cloud provider's products such as database and mq instead of managing them yourself as containers?

I am pretty new to DevOps, and I am building my first end-to-end project with Kubernetes. Like a lot of people, I started with minikube, where I set up Pods like MongoDB, Kafka, Flink streaming service etc.

But once I move things to the cloud, I notice almost all cloud providers have those services as their products e.g. BigTable, FireStore, Aurora, DynamoDB, some kind of MQ and so on.

The advantages are pretty straightforward to me: I don't have to set those up myself, I don't have to worry too much about scaling etc.

And I see one downside: maybe it will be hard to migrate to another cloud provider? I am not sure.

So, could you please tell me why I should/shouldn't use those products instead of spinning up containers myself?

https://redd.it/m691q4
@r_devops

Issues with Istio Ingress and SFTP

Hey Folks,

We have a vendor integration that requires an SFTP server to receive files from a company. We have a working sftp server and I can get it working through a Loadballancer type service in k8s but I think that's a little overkill and I'd like to use my Istio ingress controller if possible.

Has anyone been able to get ssh traffic through to a pod through an Istio ingress controller or have any other suggestions?

https://redd.it/m6im6q
@r_devops