How long does it take to set up docker containers usually? (ballpark figure/approximate range)

We're working on an app that allows to set up dev environments within docker containers in less than 10 minutes and we'd like to compare with the manual setup process/alternative solutions.

How long does it usually take you to setup a project before you get started on a project if you're starting from scratch?

https://redd.it/m5qcj4
@r_devops

Good tools/examples for creating runbooks?

I have a need for maintaining Ops documentation in project repositories along with diagrams and stuff.

I'm thinking about using diagrams for diagramming over visio/lucid and looking for any tools out there. I want to avoid putting the documentation into a wiki as it stagnates.

Anyone seen any good tools for this?

https://redd.it/m5tqye
@r_devops

Suggestions on where to find or hire DevOps on demand ?

What is a good place or platform to find DevOps on demand, per day , hour or projects ? What would you recommend ?

https://redd.it/m5pd68
@r_devops

How do you integrate DevOps best practices in your modern applications?

In this blog I do an overview of modern application development practices. One of the practices I include is DevOps and the role they play in building more robust modern applications. I would appreciate your feedback. https://www.reddit.com/user/Ricardo1021/draft/95edb93a-85ac-11eb-ad89-2e4c22d149bd

https://redd.it/m5osc4
@r_devops

Unable to active the https UI on Vault

I try to run Vault with a CRC OpenShift 4.7 and helm3 but I've some problems when I try to enable the UI in https.

Add hashicorp repo :

```
helm repo add hashicorp https://helm.releases.hashicorp.com
```
Install the latest version of vault :


```

[[tim@localhost config]]$ helm install vault hashicorp/vault \
> --namespace vault-project \
> --set "global.openshift=true" \
> --set "server.dev.enabled=true"
```

Then I run `oc get pods`

```
[tim@localhost config]$ oc get pods
NAME READY STATUS RESTARTS AGE
vault-project-0 0/1 Running 0 48m
vault-project-agent-injector-8568dbf75d-4gjnw 1/1 Running 0 6h9m
```

I run an interactive shell session with the vault-0 pod :
```
oc rsh vault-project-0
```

Then I initialize Vault :

```
/ $ vault operator init --tls-skip-verify -key-shares=1 -key-threshold=1
Unseal Key 1: iE1iU5bnEsRPSkx0Jd5LWx2NMy2YH6C8bG9+Zo6/VOs=

Initial Root Token: s.xVb0DvIMQRYam7oS2C0ZsHBC

Vault initialized with 1 key shares and a key threshold of 1. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 1 of these keys to unseal it
before it can start servicing requests.

Vault does not store the generated master key. Without at least 1 key to
reconstruct the master key, Vault will remain permanently sealed!
It is possible to generate new unseal keys, provided you have a quorum of
existing unseal keys shares. See "vault operator rekey" for more information.
```

Export the token :

```
export VAULT_TOKEN=s.xVb0DvIMQRYam7oS2C0ZsHBC
```

Unseal Vault :

```
/ $ vault operator unseal --tls-skip-verify iE1iU5bnEsRPSkx0Jd5LWx2NMy2YH6C8bG9+Zo6/VOs=

Key Value
--- -----

Seal Type shamir
Initialized true
Sealed false
Total Shares 1
Threshold 1
Version 1.6.2
Storage Type file
Cluster Name vault-cluster-21448fb0
Cluster ID e4d4649f-2187-4682-fbcb-4fc175d20a6b
HA Enabled false
```

I check the pods :

```
[tim@localhost config]$ oc get pods
NAME READY STATUS RESTARTS AGE
vault-project-0 1/1 Running 0 35m
vault-project-agent-injector-8568dbf75d-4gjnw 1/1 Running 0 35m
```

 
I'm able to get the UI without **https** :

In the OpenShift console, I switch to the **Administrator** mode and this is what I've done :
- Networking part
- Routes > Create routes
- Name : vault-route
- Hostname : 192.168.130.11
- Path :
- Service : vault
- Target Port : 8200 -> 8200 (TCP)

Now, if I check the URL : https://192.168.130.11/ui :


The UI is available.


 

In order to enable the https, I've followed the step here :

https://www.vaultproject.io/docs/platform/k8s/helm/examples/standalone-tls

But I've change the **K8S** commands for the **OpenShift** commands


```
# SERVICE is the name of the Vault service in Kubernetes.
# It does not have to match the actual running service, though it may help for consistency.
SERVICE=vault-server-tls

# NAMESPACE where the Vault service is running.
NAMESPACE=vault-project

# SECRET_NAME to create in the Kubernetes secrets store.
SECRET_NAME=vault-server-tls

# TMPDIR is a temporary working directory.
TMPDIR=/**tmp**
```

Then :

```
openssl genrsa -out ${TMPDIR}/vault.key 2048
```

Then create the **csr.conf** file :
```
[tim@localhost tmp]$ cat csr.conf
[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = vault-project
DNS.2 = vault-project.vault-project
DNS.3 = *apps-crc.testing
DNS.4 = *api.crc.testing
IP.1 = 127.0.0.1
```

Create the **CSR** :
```
openssl

req -new -key': openssl req -new -key ${TMPDIR}/vault.key -subj "/CN=${SERVICE}.${NAMESPACE}.apps-crc.testing" -out ${TMPDIR}/server.csr -config ${TMPDIR}/csr.conf
```

Create the file ** **csr.yaml** :
```
$ export CSR_NAME=vault-csr
$ cat <<EOF >${TMPDIR}/csr.yaml
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
name: ${CSR_NAME}
spec:
groups:
- system:authenticated
request: $(cat ${TMPDIR}/server.csr | base64 | tr -d '\n')
usages:
- digital signature
- key encipherment
- server auth
EOF
```

Send the CSR to OpenShfit :
```
oc create -f ${TMPDIR}/csr.yaml
```

Approve CSR :
```
oc adm certificate approve ${CSR_NAME}
```

Retrieve the certificate :
```
serverCert=$(oc get csr ${CSR_NAME} -o jsonpath='{.status.certificate}')
```

Write the certificate out to a file :
```
echo "${serverCert}" | openssl base64 -d -A -out ${TMPDIR}/vault.crt
```
Retrieve Openshift CA :
```
oc config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}' | base64 -d > ${TMPDIR}/vault.ca
```

Store the key, cert, and OpenShift CA into Kubernetes secrets :
```
oc create secret generic ${SECRET_NAME} \
--namespace ${NAMESPACE} \
--from-file=vault.key=/home/vault/certs/vault.key \
--from-file=vault.crt=/home/vault/certs//vault.crt \
--from-file=vault.ca=/home/vault/certs/vault.ca
```

The command `oc get secret | grep vault ` :
```
NAME TYPE DATA AGE
vault-server-tls Opaque 3 4h15m
```
Edit my vault-config with the `oc edit cm vault-config` command:
```
# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
extraconfig-from-values.hcl: |-
disable_mlock = true
ui = true

listener "tcp" {
tls_cert_file = "/vault/certs/vault.crt"
tls_key_file = "/vault/certs/vault.key"
tls_client_ca_file = "/vault/certs/vault.ca"
address = "[::]:8200"
cluster_address = "[::]:8201"
}
storage "file" {
path = "/vault/data"
}
kind: ConfigMap
metadata:
creationTimestamp: "2021-03-15T13:47:24Z"
name: vault-config
namespace: vault-project
resourceVersion: "396958"
selfLink: /api/v1/namespaces/vault-project/configmaps/vault-config
uid: 844603a1-b529-4e33-9d58-20525ea7bff
```

Edit the **VolumeMounst**, **volumes** and **ADDR** parts my statefulset :
```
volumeMounts:
- mountPath: /home/vault
name: home
- mountPath: /vault/certs
name: certs
```

```
volumes:
- configMap:
defaultMode: 420
name: vault-config
name: config
- emptyDir: {}
name: home
- name: certs
secret:
defaultMode: 420
secretName: vault-server-tls
```
```
name: VAULT_ADDR
value: https://127.0.0.1:8200
```

I delete my pods in order to take into account all my changes
```
oc delete pods vault-project-0
```

And...

```
tim@localhost config]$ oc get pods
NAME READY STATUS RESTARTS AGE
vault-project-0 0/1 Running 0 48m
vault-project-agent-injector-8568dbf75d-4gjnw 1/1 Running 0 6h9m
```

vault-project-0 is on 0/1 but running. If I describe the pods :
```
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning Unhealthy 1s (x6 over 26s) kubelet Readiness probe failed: Error checking seal status: Get "https://127.0.0.1:8200/v1/sys/seal-status": http: server gave HTTP response to HTTPS client
```

If think that I've missed something but I don't know what...

Someone to tell me how to enable https for the vault UI with openshift

?

https://redd.it/m5nfmd
@r_devops

Stop re-writing pipelines! Why GitHub Actions drive the future of CI/CD

The Pipeline-as-Code pattern is implemented by most CI/CD platforms today. So what could be the next evolutionary step? Based on GitHub Actions, the article outlines why open-source Pipeline-as-Code Building Blocks will take your pipelines to the next level.

Read more...

https://redd.it/m5n6it
@r_devops

Terraform or Pulumi or Crossplane or ... ?

Which IaC tool you prefer and why?

From my perspective, it's either Terraform (we know it works) or Crossplane (it's changing the game).

\>>> https://youtu.be/RaoKcJGchKM

https://redd.it/m6cnqm
@r_devops

Komodor a troubleshooting K8s-native platform, is now open beta!

Hey all,

After months of work, and input from the community, we have officially launched the first K8s-native platform dedicated to making troubleshooting for dev+ops teams much more efficient, and we are ready to open our beta program to everyone!

We would like to work with users at companies who have K8s-based environments and are facing challenges with identifying the root cause for any given incident. Our platform is built to show how recent changes (code, config, deploys, etc) affect your overall system - for example recent deploys or config changes. We provide a clear correlation and understanding of changes’ ripple effect. Our users can see all alerts and changes upon a timeline and add related services, so they can quickly identify what may have triggered an alert. We welcome any and all volunteers and are happy to send a thank you and an awesome swag pack to anyone willing to beta test our platform and provide us with product feedback. If you are interested in getting involved, you can reach out HERE, and read more HERE.

https://redd.it/m6cm6p
@r_devops

What’s with the coding tests at tech companies?

So burned out interviewing and on the last round for the on-site I keep getting BS coding questions in (INSERT LANGUAGE). Literally I’m doing a bunch of hackerrank/leetcode/codesignal exercises which have nothing related to the job.

Full of algorithms, binary trees, concurrency, advanced fizz buzz like the coin toss and other exercises...

The description mentioned “scripting or coding experience” along with a huge list of tooling, networking and Kubernetes experience when they really meant that they wanted a software engineer that knows how to build shit.

TLDR:
Based on all the interviews I’ve been, all you gotta do to land a job at FAANG or unicorn tech companies is to do exercises at those coding platforms. You don’t need any experience

Am I the only one who find them annoying?

https://redd.it/m6amyf
@r_devops

Anyone come across Opsera?

Has anyone come across Opsera or have any thoughts regarding the tool? They seem to be building a bent your own tools version of GitLab, looks fascinating to but curious if others thoughts?

www.opsera.io

https://redd.it/m6l3we
@r_devops

What is a good way to keep multiple directories' contents synced with releases from a GitHub repo?

I work for a company that maintains lots of custom WordPress plugins and themes for our network of myriad WordPress sites. The GitHub repo managers have it set up so that webhooks are added to the repos and push releases out the main server hosting the files any time a new released is published (at least I'm pretty sure that is what's going on).

However, I run a few webservers that also use these plugins, and anytime a new release is published, I either manually update it via SSH or SFTP. Since I manage lots of WordPress sites (I've opted for multiple single-site instances, rather than a multisite install) and there are lots of plugins to keep up-to -date, this gets old fast.

I started writing a WordPress plugin that allows me to point installed plugins and themes to their GitHub URLs and make it so that I'm able to visually see when updates are available in the WordPress UI and make updates that way, and so far this approach is promising.

However, this solution is locked in to WordPress, and I'm hoping for a more reusable solution involving the command line and a cron job, and/or a way for me to run a command that checks if any new releases have been made and update the local directories that hold those themes and plugins.

I feel like this is a common-enough use case that there ought to be a standardized solution out there, but every time I Google it, it points me in the direction of setting up webhooks via GitHub repositories, which I don't want to do because A. I don't have the privileges to modify these repos' settings (though I suppose I could just fork them) and B. I wouldn't want to have to make modifications to the webhooks any time my webserver is migrated (for instance, I'm currently in the process getting ready to migrate everything to AWS). So rather than having the repo pointed to my server(s) via webhooks, I'd rather have the servers listening for new GitHub releases via cron, if that makes sense.

The OS I'm dealing with right now is RHEL 7, though I will be either updating to RHEL 8 or migrating to Ubuntu in the near future.

Let me know if there's a better community to ask this question, if I'm using any terminology wrong, or if I am thinking about this the wrong way.

https://redd.it/m6cuwo
@r_devops

What are the pros and cons of using a cloud provider's products such as database and mq instead of managing them yourself as containers?

I am pretty new to DevOps, and I am building my first end-to-end project with Kubernetes. Like a lot of people, I started with minikube, where I set up Pods like MongoDB, Kafka, Flink streaming service etc.

But once I move things to the cloud, I notice almost all cloud providers have those services as their products e.g. BigTable, FireStore, Aurora, DynamoDB, some kind of MQ and so on.

The advantages are pretty straightforward to me: I don't have to set those up myself, I don't have to worry too much about scaling etc.

And I see one downside: maybe it will be hard to migrate to another cloud provider? I am not sure.

So, could you please tell me why I should/shouldn't use those products instead of spinning up containers myself?

https://redd.it/m691q4
@r_devops

Issues with Istio Ingress and SFTP

Hey Folks,

We have a vendor integration that requires an SFTP server to receive files from a company. We have a working sftp server and I can get it working through a Loadballancer type service in k8s but I think that's a little overkill and I'd like to use my Istio ingress controller if possible.

Has anyone been able to get ssh traffic through to a pod through an Istio ingress controller or have any other suggestions?

https://redd.it/m6im6q
@r_devops

How do you verify good/bad deploys?

Sometimes I'm not sure anyone cares, and if this is a "death by a thousand paper cuts" problem. How do y'all check if app deploys were good or bad? Do you just get told by someone who noticed XYZ is not working anymore? Test failures? And does it feel important to address, like the problem is getting worse, or is it just c'est la vie?

Sometimes I also hear of successes with advanced uses of canary deployments and/or feature flagging, so I'm curious to know if others have had successes with this or anything else.

https://redd.it/m6bv5o
@r_devops

Is there 1 monitoring tool to rule them all?

Situation: At my company there are many tools that monitor hardware (network,storage,compute) and applications\
Background: Throughout my I.T. career i can definitely see that some tools have unique use cases\
Assessment: I could combine all of these tools into a website to centralise, but is that the best solution?\
Recommendation: Is it possible that there is 1 tool that monitors them all?
Open for discussion\

Currently using:
- Mutiny ( a bit outdated with Devops world)
- ELK stack + Grafana ( seems to be DevOps based)
- PRTG (only for network)

Considering Prometheus

What tools have you had experience with and what have you found actual helpful?

https://redd.it/m67d9a
@r_devops

Help me nail the finalizing technical interview

In 2 days I have the final technical interview for DevOps Engineer (AWS focused stack) role with one of my favorite companies. I successfully passed the technical assignments. The next interview will cover topics such as; my approach to work (decisional process, teamwork, agile etc); my previous experience (tasks, responsibilities, work with Cloud, containers, IaC, CICD or security), a hypothetical situation and how would I approach it in the given conditions.

These topics are so familiar to me but I think because I want to work with this company so much that I'm stressing out a bit.

I'm here to take your advices and recommendations.

https://redd.it/m6erz2
@r_devops

Transitioning from SysAdmin to DevOps?

Any DevOps engineers out there who transitioned from SysAdmin? If so, how did you do it? What skills did you need to learn?

Background: Currently a SysAdmin for a medium sized finance company. Primarily Windows but with some basic experience in Linux as well. In terms of programming languages and automation, I'm only basic at PowerShell right now and I have some experience in Docker. Keen to learn more of what is currently in demand on the market.

https://redd.it/m633js
@r_devops

Looking for a low-RAM, but high-storage/high-bandwidth server. And, something that is affordable...since my site will be predominantly supported by ads. Does such a thing exist?

Hi

&#x200B;

So I am currently developing a site and have been browsing around for various VPS solutions, though didn't really find anything that matched what I was looking for...I naively then looked at AWS and others, with the logic that since they are massive companies, operating at massive scale, they would be able to provide cheaper rates...only to find that even for a TB of data, they will charge you $92 (realistically, it doesn't seem even Netflix would be able to operate at that cost, even getting $20 per subscription per month...but for a small site which would run and ads and perhaps 0.001% of users who will buy a cheap ($1-$4) membership, the costs would utterly dwarf any revenue you made

&#x200B;

So does anyone know a service which provides affordable bandwidth & storage space? Let's say I need:

&#x200B;

\- 10TB of storage

&#x200B;

\- 100Mb/s guarenteed/unmetered connection

&#x200B;

Now, admittedly, these wouldn't be figures I'd be hitting on day 1, but I of course want to be prepared...within a year, it's possible these numbers would be required - possibly even more.

&#x200B;

For reference, currently the best offer I have found is https://contabo.com/en/vps/ which offer 8GB RAM, a 200GB SSD and (supposedly) a guarenteed 100Mbp/s outbound traffic speed. This is for $6.99 per month. It's possible my calculations are wrong, but if not, according to the AWS calculator, a constant stream of 100Mbp/s for a 1 month period (25TB) would cost a whopping $2830.

&#x200B;

The main problem with this Contabo offer, however, is that additional space can't be added to their VPS servers - that's only 2000 users uploading 100MB and that 200GB is all used up.

&#x200B;

The other day, for example, I bought these 2 USBs - they were 1TB for $4.5. (10TB of USB storage for $45) - now, I assume, at least, it wouldn't be possibly to host a site with a large number of downloads on USBs like this, but looking at high-end dedicated servers with these sort of specs, it wouldn't be uncommon for sites to be charging anywhere from $200-$1000 per month. Many of these come with anywhere from between 64GB-320GB of RAM. As far as I know, I would only require a small amount of RAM (8-16GB) - just testing, I can load up a dummy DB of 10 million documents and perform 20 simultaneous requests (querying, updating, inserting, deleting) with an average response time of only 225ms. This is running on Ubuntu in a VirtualBox on my desktop, which I only allocated 8GB of RAM - the database even on a scale that would be unlikely to achieve after 10 years of operation for such a site.

&#x200B;

Anyway, I feel like I am getting a bit incoherent, so the main questions I have are:

&#x200B;

1) do you know any cheap services which provide high storage/bandwidth, while low RAM (in order to save cost...there's no point having 60x the RAM for what I need, just to get a plan which will have the corresponding amount of storage/bandwidth)

&#x200B;

2) what would a ballpark kind of price be for these kinds of specs (say 10TB storage, 100 mbp/s bandwidth) - since, realistically, I imagine 99.9% of users won't pay to remove ads...and at least in my experience before, I have often got horrific (like 0.005$ cpm rates) - rates that unfortunately would be dwarfed by the cost of the server prices I've been seeing online

&#x200B;

3) in theory, would it be possible to create some octopus-style monstrosity, with 20 1TB USBs sticks all plugging into some kind of central device in order to host the files? USB 3 has a max transfer speed of 5Gb/s...realistically, when I transfer files, I seem to get something much slower...like 10Mb/s or so for large single files...and into the 100Kb/s range when transferring lots of small files. Despite the 5Gb/s max performance, would it be possible to have a setup like this...or would have multiple users (let's say

10) requesting files stored on a particular USB simultaneously be effectively unusable?

&#x200B;

Thanks in advance for any answers or pointers in the right direction

https://redd.it/m69y48
@r_devops