Github, Vault, JWT and OIDC setup

Hi
I'm trying to setup a Github Action to get a secret from Vault using JWT/OIDC. I understand the basic concepts of JWT and OIDC, but I'm not clear on how to implement it in my setup.
I have Github Enterprise running inside my network alongside an OS version of Vault.
I've created the JWT role, secret and policy on Vault, but when I try to test the setup it says OIDC login is not configured for the role.

curl --request POST --data @payload.json https://my-internal-vault-server:8200/v1/auth/jwt/oidc/authurl
{"errors":["OIDC login is not configured for this mount"]}

Contents of payload.json

{
"role": "github-jenkins",
"redirecturi": "https://my-internal-vault-server:8200/ui/vault/auth/jwt/oidc/callback"
}

My real confusion is where should the OIDC authorization be taking place? My Github server, Vault or something else?
Or is it just a case of configuring the Vault role to specifically trust the JWT from the Github Action?

https://redd.it/zkt3sx
@r_devops

A single person answered 76k questions about SQL on StackOverflow. Averaging 22.8 answers per day, every day, for the past 8.6 years

https://stackoverflow.com/nocaptcha?s=b5164ff9-20c1-417b-b1cc-2d6faea5f42e

https://redd.it/zku6x5
@r_devops

Container image size; how big is too big?

When you're picking a base image for your container, how much does size figure into your decision?

If I'll be deploying every couple of days, does it matter if I pick the 30MB Alpine image or the 160MB Debian image?

It would be easier to use the Debian image.

https://redd.it/zkwhwf
@r_devops

AWS Lambda tracing with OpenTelemetry and OpenSearch

Here's a pretty detailed tutorial about setting up tracing for Lambdas https://tracetest.io/blog/observability-trace-based-testing-aws-serverless-opensearch-tracetest.

It uses OpenSearch as a trace data store and Tracetest for running e2e tests.

OpenTelemetry recently released https://github.com/open-telemetry/opentelemetry-lambda, but they also have this in the official docs https://opentelemetry.io/docs/instrumentation/js/serverless/. What do you consider to be the better option?

https://redd.it/zl0wqk
@r_devops

Hi r/DevOps! Chris from New Relic here with Umber Singh, VP of Deal Strategy & Monetization, and members of the technical team from New Relic. Ask us anything about K8s, network monitoring, logging, or anything on your minds. AMA!

Hiya, r/DevOps! I'm Chris, developer community manager here at New Relic. I'm here with my pals, u/NewRelicUmber, u/NewRelicMarc, u/NewRelicBrad, u/NewRelicLeon, and u/NewRelicNic, to tackle questions from the community about a handful of topics we know to be important to developers such as yourselves. Ask us anything about Kubernetes, network monitoring, or logging, or really, anything on your mind about New Relic. We're here from 10AM - 12PM PST tomorrow, 14 December, to field your questions, so in the meantime, fire away and we'll see you then!

For those who don't know us, New Relic is where dev, ops, security and business teams solve software performance problems with data. New Relic offers best-in-class tools to tackle your full-stack observability, monitoring, and log management needs. Check us out and get started for free today over at newrelic.com.

AMA!

Proof: https://imgur.com/a/FLMl5yv

(this post approved by the mods of r/DevOps)

https://redd.it/zl2c4e
@r_devops

Windows Based Environments and Single Source of Truth

I'm interviewing for a company who wants someone to come in and help implement good DevOps principals for their Windows Based Environment.
How would one keep a single source of truth in a Windows based environment with AD and version control? Is this even possible?
What does DevOps look like for those that are within these type of companies?

https://redd.it/zl6gj1
@r_devops

Should my CI/CD tool match my cloud provider?

I like using Azure DevOps but our web application is planned to be hosted on GCP. Is there a big difference between using Azure DevOps or Google Cloud Build on GCP? (Other than the normal difference between the two)

I'm mainly trying to understand the benefits of matching a CI/CD pipeline with its native cloud provider in this case.

https://redd.it/zl69wv
@r_devops

Can someone please help me trigger the Azure pipeline on PR acceptance or branch deletion?

I want to trigger an Azure pipeline on feature branches on PR acceptance, branch deletion, or merge (but the pipeline must run on the source branch). I need to do this because I want the predefined variables of the feature branch for the pipeline. For instance, $(Build.SourceBranchName). The Pipeline can run at any stage after all the changes in PR have been approved but the pipeline has to run on the feature branch and not on the target branch. Also, if there is any other way to access the feature branch's predefined vars in pipelines of other branches, please let me know. Thank you!

https://redd.it/zkw8go
@r_devops

aws presigned urls for multitenancy?

I want to have an app where multiple users upload files to a single S3 bucket, process the files and then place them to another S3 bucket where they can download the results.

I know how to do it for a single user but don't know how to convert it to be multitenant. Can I use presigned urls for upload and download so that I can skip the architecture changes?

Is that a recommended solution that is secure?

https://redd.it/zlen3p
@r_devops

Why is DevOps just Ops in 90% of posts here and job openings?

I get it there are two sides and often DevOps are there to deploy stuff but it feels way too one sided what am I missing?

https://redd.it/zlhoyq
@r_devops

New Devops Role

Hello Everyone,can anyone please guide me with the resources required for Devops Engineer role as I am switching into this role but not sure about the resources and courses to learn,also which websites we can refer to for entire Devops Engineer course for free

https://redd.it/zlhmpu
@r_devops

Msp devops shared tools

Hi. In the devops world where a company has multiple products how are the support tools managed ( monitoring, logging, etc)? In theory each team is managing its own stack but sounds unreasonably unproductive to have the same tools deployed over and over again...

https://redd.it/zllhw9
@r_devops

Why using Kaniko for building images when there's more privileged containers in play?

## Context
I've been hearing/studying a lot about Kaniko, but I'm not sure if it makes sense in every scenario.

Most people tend to highlight the security reasons for why running Kaniko is important when needing to use dind (docker in docker).

There are several privileged solutions, for example:

Gitlab-ci with Docker based runners (bind mounted to it's host sock), Portainer etc.

Yes, using Kaniko for building would decrease risks, but only if privileged containers are completely cut from the pipeline.

So, I wonder how you guys evaluate when to use it, and when it does not make sense at all.

## Sources
- https://github.com/GoogleContainerTools/kaniko

- https://docs.gitlab.com/ee/ci/docker/using\_kaniko.html

- https://www.youtube.com/watch?v=d96ybcELpFs

- https://gitlab.com/guided-explorations/containers/kaniko-docker-build

https://redd.it/zlmci2
@r_devops

Do you like being a devops engineer?

I am a devops engineer for the last 7 years now, and I feel like we have to keep learning new tools constantly to keep ourselves updated. This becomes a bit challenging at times.

https://redd.it/zln5r7
@r_devops

Sealed Secrets on Kubernetes with ArgoCD and Terraform

learn how to manage secrets securely on Kubernetes in the GitOps approach using Sealed Secrets, ArgoCD, and Terraform: https://piotrminkowski.com/2022/12/14/sealed-secrets-on-kubernetes-with-argocd-and-terraform/

https://redd.it/zln8co
@r_devops

hey guys I'm newbie to DevOps any advice

Hi there I'm new to this and trying to build my career around DevOps hopefully i can make it work any advice would be appreciated thanks in advance

https://redd.it/zlpink
@r_devops

Does every commit needs build and deployment -Continuous Integration ?

Hello, could you please clarify my doubts about the CI process when developing large-scale projects?

1. How does a developer test the functionality of their code after committing to a different branch?
2. Does each commit trigger an individual build, and does each build need to be deployed to test the functionality in the Dev environment? For example, I worked on minor functionality and committed my branch, and the CI tool triggered a build, ran unit tests, and generated a build file.
3. Where does this build go, does it go in an artficatory tool like Jfrog, and so on? Can I test its functionality before submitting a merge request?

​

Note :I m noob support engineer and sorry if this is such a silly question to ask

https://redd.it/zlq9go
@r_devops

Rotating secrets for on-prem infrastructure?

I was reading this article and it got me thinking. I feel like many are lazy when it comes to on-prem because it's not the cloud.

https://redd.it/zlrgcw
@r_devops

Free tool that let’s you query GPT3-based k8s expert

Hello everyone!

Together with few colleagues we built a tool that lets you discover kubectl commands using natural language. We know that Google and StackOverflow are great resources, but we've often found it difficult to express the right questions, especially when just starting out with k8s. Or you have to dig through endless answers to find the one you want. That's why we decided to use the power of generative AI (GPT3 and ChatGPT) to create PromptOps - so you can quickly find the kubectl commands you need.

Features:
✅ Ask Kubernetes questions in natural language, with support for conversations
✅ Each of the commands in the answers is validated
✅ You can share the conversation or just bookmark it for your own reference
✅ Completely free and no sign ups required!

👉 promptops.com

We are still in early development, we have a ton of ideas, but we wanted to hear from the experts. What do you think of the approach? Are the supporting explanations helpful? Let us know your thoughts!


Thank you

https://redd.it/zlxb9n
@r_devops

Best tools/resources for improving “developer experience.” Need to submit my 2023 asks next week.

Accepted a DevOps job earlier this year only to have a new director of engineering come on and want to restructure the team.

The good news is that the director of engineering really likes me and wants me to be in charge of the org’s developer experience.

From research and his expectations, it seems like the main idea behind developer experience is to improve the process around developers, so they can focus on coding. Which I think I might actually like a lot.

There’s some team-culture things I’ve read about that sound really interesting, but am looking for any tips on tools, conferences or workshops I can submit resource asks for that you would endorse.

Would appreciate any insights you may have as well as costs.

https://redd.it/zm0col
@r_devops