Creating a CLI in Python vs Go

Hi all, I need to build a CLI and expect this to be used significantly throughout my company. I'm an experience python dev and absolutely love the language. At the same time, I do understand that the python package management is a nightmare.

For my CLI, I would like to:

* Install on mac through brew (and whatever the equivalent is on windows/linux)
* Should not need a venv
* Should not be affected by other software running on the users system

Personally, I've always built my python applications in isolation using a venv but since this new CLI would be used by 1000+ users, I'm second guessing if python is the right language for this.

I don't know Go (yet) but have been eager to get my hands dirty and this seems like a good place to start - at the same time writing a large tool in a new language is a recipe for disaster.

Could someone provide their experience with large CLI tools written in Python? As far as I can tell awscli and azure cli are also written in Python so maybe i'm just overthinking this and should stick to what I know.

Thoughts?

https://redd.it/dq6kiy
@r_devops

How to do ssh forwarding in compass(mongodb) client.

Folks, I need some help/advice on who to connect document db via Compass client. using ssh forwarding.

My scenario is I have an ec2-A(public) instance which uses ec2-B(private)instance to connect to MongoDB. I know how to do it on Windows via putty but how to do it on a **Mac**??

Using this to connect jump server

ssh -i ~/B.pem -o "ProxyCommand ssh -W %h:%p -i ~/A.pem [email protected]" [email protected]

and then mongo connection command.

`mongo --ssl --host <mongodb_endpoint>:27017 --sslCAFile rds-combined-ca-bundle.pem --username usernam --password password`

&#x200B;

I read this link: [https://docs.mongodb.com/compass/master/connect/](https://docs.mongodb.com/compass/master/connect/)

but it was not helpfull.

https://redd.it/dq6ay0
@r_devops

Nameing conventions to seperate tools QA and production and application environment

Our company is developing a CI/CD solution. We are having trouble differentiating between our tools environments from our application environments to management. I am having a lot of trouble coming up with a naming scheme that clearly separates them without needing a few sentences to explain.

So, we Have our Git Repo on-prem, Build Server (CI), Deploy Server/tool(CD). All of those tools have a QA environment, QA meaning we test patches and new configurations there before we push to the production ones that are in active use.

&#x200B;

We also have a normal setup of Acceptance, Staging, and Production application development environments.

The issue is everyone associates QA with the application staging environment.

&#x200B;

So my question is, what would be a clear way to separate these two different ideas?

&#x200B;

Thanks

https://redd.it/dq3kue
@r_devops

Advice needed on an open-source cloud devops tool.

Hey,

I am currently planning to develop a Cloud DevOps open-source tool. But I am not sure whether it is gonna be helpful and how helpful it is. So want to hear from tech pros first.

Here is a short description of the tool idea.

&#x200B;

>*A Cloud DevOps Orchestration tool that enables you to build and manage Cloud DevOps solutions, including infra templates, code pipeline YAML, SRE tasks and etc, in a single package stored in Git. The tool could connect with required DevOps tools to provision resources and run the tasks.*
>
>*For example, you could put CloudFormation templates in the package, and write some Ops Tasks to do some operational work on the resources provisioned by CFN. With the tool, it calls AWS-CFN to start provision and runs the tasks on your command.*
>
> *The tool tries to automate Cloud DevOps itself. It simplifies the toolchain integration, provides a way to organize your DevOps work, automates the provisioning and runs the Ops tasks in a consistent and centralized way.*

My description may not be quite clear. Please let me know if I need to clarify.

Just want to know:

1. Is it helpful?
2. If NO, a little on why and any improvement room?
3. If YES, how do you plan to use it?

Your feedback and advice are much appreciated. Any random thoughts may help here.

&#x200B;

Thanks a lot!

https://redd.it/dqmw13
@r_devops

CI/CD for containers? Kubernetes/version control?

What is the typical process behind deploying containers, and also deploying containers in kubernetes, including how the source code is managed, source code/container security, etc?

https://redd.it/dqnzbe
@r_devops

I inherited management of a junior/entry level DevOps engineer, how to train them?

So, another manager in my company was building an ops team, but then left the company and that team was folded into my DevOps/SRE/platform team.

We've always had high-level hiring standards (apart from me, lol), so everybody on my team is a heavy hitter. This one guy coming from the ops team, had just transitioned to that area from doing Windows desktop support. He's a smart guy, hardworking, really eager to learn... but he knows nothing about the tools or technology we use. I've gotten where I am because people gave me chances, so I want to give him the same.

However, I've never really trained/mentored anybody that junior before. I'm thinking that he needs to focus on fundamentals:

* Linux OS concepts
* TCP/IP networking stack
* Bash scripting
* Python programming
* Git

He's eager to get stuck in to working with AWS and k8s, but I think it's more important to understand the basics before getting too deep into the specifics of a cloud provider.

Does anybody have any advice on how to help train somebody in DevOps? Are there any areas that it seems I might be missing out on?

https://redd.it/dqmmza
@r_devops

Why is MTTR (mean time to restore) rather than availability considered a key metric?

This is something that's confused me about the [four key metrics](https://www.thoughtworks.com/radar/techniques/four-key-metrics) promoted by Forsgren, Humble and Kim in the Accelerate book and reports.

If it only takes ten minutes to restore service that sounds pretty good, but it wouldn't be great if it breaks every twenty minutes.

I get that MTTR is probably a better metric than meant time between failures, (MTBF), but I would expect dividing one by the other would give availability, which would seem like an even more important thing to optimise.

https://redd.it/dqnqxy
@r_devops

Vettery? Hired? Worthwhile (as candidate) or not?

Earlier this year I accepted a position with a new organisation. Whilst some things are very good, some things are not, and I am looking to move. I am wondering if it is worthwhile to sign up with Vettery or Hired.

For context I have almost 500 connections on LinkedIn and several people contact me there each business day with possible positions (although I am not saying that all these positions are attractive or that I would be suitable for all of them). I also attend various meetups and expect to be speaking at two in the next quarter plus a paid conference next year (if I can get a worthwhile project between now and then to speak about!).

The reasons that I am considering Hired/Vettery are that:

* Most of my contacts via LinkedIn are from third party recruiters, where there is always a lot of additional effort required on my part compared to, and the 'yield' is much less than, in-house recruitment teams.
* A more senior person I worked with previously found a position where I was then working via Hired and seemed to think well of them.

Whilst I do try to screen recruiters, it is still tiresome going over the same questions over and over again. Unless you are a hot pick for a specific position that that specific recruiter is trying to fill right now, then no, they aren't interested and on the tiny number of occasions when they come back with something else down the line all context has been lost (and invariably changed). Trying to get feedback from a recruiter is nearly impossible- they either aren't interested or they just want to know what would persuade you to take a position, or they have no info.

The obvious alternative would be for me to either wait for the right opportunity to pop-up on LinkedIn, or to apply for advertised positions myself. Sadly I have had a poor enough experience with recruitment processes on many occasions that I am loath to do the latter. I also feel that it puts me at a disadvantage.

I am wondering if anyone here can speak from personal experience of being a candidate with either Vettery or Hired as to whether or not they are worthwhile in my sort of situation. I am a mid/senior DevOps/Cloud/Microservices etc type engineer.

https://redd.it/dqnmwm
@r_devops

So excited! Just got an offer for a devops position yesterday!

I've worked in the past few years in software engineering roles and in IT operations roles, and had decided at some point I would want to get into devops.

Two weeks ago, I got pinged about a role for a devops engineer position involving building CI/CD pipelines for serverless microservices. Not something I've had the opportunity to do yet, but I know the concepts and general workflows, so I decide to respond.

Had a pretty good phone interview directly with the hiring manager last Friday. We talk about my experience, he tells me more about the role, and it seems pretty sweet. I get a follow up Monday saying "hey we want to bring you on-site to talk to you more, more details to come."

Wednesday I get an email from them. They want to do a 3 hour interview. With a full itinerary. With multiple directors, multiple senior staff, a VP, and they want me to start by giving a presentation about how I would migrate a monolithic on-prem application to serverless microservices with minimal downtime and high resiliency, with full CI/CD pipelines. Queue me freaking out a little.

That night I sketch up some notes and diagrams on my Surface and share with a friend who has some knowledge on devops to make sure it looks okay. He gives me a thumbs up, so I wait for the interview.

I don't sleep at all the night before, so I play video games to take my mind off things. When it is time to get ready, I get showered and changed, and then go get an energy drink to perk myself up.

I get to the interview, and I give my presentation, scribbling all over their whiteboard. For the most part, they like it, but they have several questions about it. I can answer some of them, but some I can't and I tell them as much.

The rest of the interview goes well enough, with them asking my background, education and all that. I explained that my degree program was horrible and I pretend it doesn't exist, and that everything I have done career-wise is 100% self-taught or learned on the job, and they asked how I would approach various problems. They also ask me about containers, OOP, unit testing, infrastructure as code and several other things.

I really got put through the meat grinder and was left feeling pretty uneasy about it all when I left. I knew I gave it the best I could, but was still worried. Around 3:30 though, I got a call that they wanted to extend an offer. They told me my skill set specifically within cloud technologies was a little light, but I know enough about everything else and I know the high level concepts well enough that they want to bring me on anyway.

I'm so excited! It went better than expected!

https://redd.it/dqjf5n
@r_devops

Deploy Prometheus exporter together with Grafana dashboard and Prom alerts

Hi I need advice from gurus :)

Currently we need to have like a package for monitoring. It means that once we install for example Kafka exporter, also should be installed Grafana dashboards and Prom alerts which are related to that exporter.

If it’s exporters which were developed by me - I can put dashboard and alerts inside of the exporter. But if it’s official exporter - it’s problematic to do.

So, please share how do you install exporters with dashboard and alerts and how do you change thresholds dynamically (if you have multiple clusters with the same exporters but thresholds should be different)

Thank you for your answer

https://redd.it/dqjkpm
@r_devops

CI pipelines and README.md updates

What are you all using to update your README.md documentation? It would be nice not to have to manually update badges and Docker tags in examples on each version bump.

https://redd.it/dqfg9b
@r_devops

Ideal Automated IIS Deployments

Suppose that a single machine hosts numerous (25+) IIS Websites, App Pools, virtual directories, and Web Applications.

From a clean slate (i.e., only the Default Site and Application pool are created), what is the ideal way to automate the deployment of the above components?

Should the Default site just be disabled, or deleted? Do we create all App Pools first, and then the Web Sites and other components? How about the point at which the source code is extracted into the relevant folders? How about additional third party applications (e.g., nServiceBus), or registry modifications?

Any ideas are appreciated!

https://redd.it/dqe631
@r_devops

Where to place database?

For a green field shoe string budget project I need a Mongo database. Curent plan is to be using Kubernetes via KOPS on aws. I have a mix of containers that will be in the Kubernetes cluster as well as some Lambda functions that need access to that same database instance/cluster.

&#x200B;

My requirements are easy to back up, low cost, okay performance - ideally same as the Mongo Atlas sandbox performance.

&#x200B;

What path/where to put my DB, do you think I should go for this? I'm open to any options within reason

https://redd.it/dqdiq0
@r_devops

Tutorial: Deploy GitLab CE on Docker Swarm

I wrote a tutorial on how to deploy GitLab CE on Docker Swarm. It builds on [an earlier tutorial](https://lunar.computer/posts/docker-swarm-digitalocean/) I wrote about creating a Docker Swarm cluster on DigitalOcean. This tutorial isn't DigitalOcean specific, though, it just requires a Docker Swarm cluster with Traefik deployed on it.

Hopefully someone will find it useful. :)

Docker Swarm lives!

https://lunar.computer/posts/gitlab-docker-swarm/

https://redd.it/dr213z
@r_devops

Repository organization? Separate small dedicated apis vs one large one? Plz halp!

We have a small team and I'm in charge of moving our apps to containers using docker.

Currently we have several different apps, each with it's own repository. An app's repo consists of a web client and an api. Each repo has a folder for the client project and a folder for the api project. We are using hapi to write the apis.

Is this a good strategy? Using docker-compose and docker swarm we can easily deploy the apps, but different apps are on different versions of hapi; some outdated and will need refactoring. Our newer apps are on the latest versions.

Would it be a good idea to have one large api split into plugins for each app? An app's repo would contain only the web client. The large standalone api would have it's own repo and be deployed on it's own server. This way the hapi code could be kept on a consistent version between apps.

What are the upsides and downsides to each strategy, and are there other better ways I haven't considered?

Any help would be appreciated! Thanks!

https://redd.it/dr2xsk
@r_devops

logstash service not starting

I am using Amazon Linux 2 ( Amazon Linux AMI release 2018.03) I installed Logstash in it.

>wget https://artifacts.elastic.co/downloads/logstash/logstash-7.4.0.rpm
>yum install logstash-7.4.0.rpm

But I am unable to start logstash service.

Here are some attempts to start the service.....all failed.

>$sudo service start logstash
start: unrecognized service"

>$sudo service logstash start
logstash: unrecognized service

>$initctl start logstash
initctl: Rejected send message, 1 matched rules; type="method_call", sender=":1.2" (uid=500 pid=3521 comm="initctl start logstash ") interface="com.ubuntu.Upstart0_6.Job" member="Start" error name="(unset)" requested_reply="0" destination="com.ubuntu.Upstart" (uid=0 pid=1 comm="/sbin/init ")

As you see I have tried to start logstash service all possible ways but failed .

Is there a way I can start logstash service in Amazon Linux 2?

https://redd.it/dr2bka
@r_devops

How to specify specific subnet in Terraform when using for each

I am trying to create an ec2 instance that will hold my Jenkins server. I want this to be in a private subnet which I created using a for each loop. Below is my subnet for each loop and my ec2 instance resource. I have also included the error message. Idea is I want it in the first private subnet.

&#x200B;

**ec2 instance**

resource "aws_instance" "jenkins" {
ami = "${var.ubuntuAMI}"
instance_type = "t3.micro"
availability_zone = "us-east-1a"
key_name = "me"
monitoring = true
vpc_security_group_ids = [aws_security_group.ssh_access.id]
disable_api_termination = true
subnet_id = "${aws_subnet.private[each.key]}"

tags = {
Name = "Jenkins"
}
}

&#x200B;

&#x200B;

**subnet resource**

&#x200B;

resource "aws_subnet" "private" {
for_each = var.subnet_numbers_private

vpc_id = aws_vpc.Main_VPC.id
availability_zone = each.key
cidr_block = cidrsubnet(aws_vpc.Main_VPC.cidr_block, 8, each.value)
tags = {
Name = "Private-${each.key}"
}
}

&#x200B;

**variable used by the subnet loop**

&#x200B;

variable "subnet_numbers_private" {
description = "Map for private subnets"
default = {
"us-east-1a" = 1
"us-east-1b" = 2
"us-east-1c" = 3
}
}

&#x200B;

**error message seen when doing a** `terraform plan`

The "each" object can be used only in "resource" blocks, and only when the
"for_each" argument is set.

https://redd.it/dr7b69
@r_devops

Are you familier with a tool which scan your cloud (AWS specifically) and notify on resources you can remove/smaller usage?

We are using ec2 instances (Standalone, part of ECS, DB) and we think how to optimize it. What tools map the usage, add automatically more logs, and analyze monthly results. Possible resources usage: increase, reduce, remove...
If you guys have experience with a tool that reduces cost with easy onboarding please write it.
Found these tools meanwhile:

1. Spotinst - Automated Cloud Optimization
2. NewRelic.
3. ParkMyCloud.
4. Cloudability
5. Mist

https://redd.it/dqznq8
@r_devops

Identity, Authorization & Authentication: Ory, Gluu, Vault?

Hello /r/devops!

I'm researching about the three topics in the title in order to come up with a self-hosted solution for my situation. I'm creating a service that's going to be used by multiples users within a hiring party, and multiple services used by that same party.

**The main idea and necessity is to have a Single-Sign-On system**. That itself isn't something concrete, because you can do it in different ways, so I'm still reading about everything that I can.

I came across multiples options, but I'm considering Gluu, Ory & Keycloak.

- Ory doesn't come with an identity management server but it appears to function without it? What am I missing? What can I use it in the void?

- Gluu looks very complete but I don't see many people talking about it? What's the deal?

- Vault is something that looks very powerful, they appear to have identity but I don't think they do what I need from them?

- Keycloak looks hard to setup and customize, but might do the job?

Have you ever gone through something similar? I appreciate any bit of knowledge that I can get!

*sorry if that's the wrong sub, I couldn't find a better one!*

*edit: Just to make it clearer, I need to have a central identity server for all future services and I will need to have "scopes" inside those, that's the authorization part, right?*

https://redd.it/dpt1og
@r_devops

Fun with Oracle

Not sure if this is right place to post this. I somehow think marking this NSFW could be a good idea :P

I maintain an old, large, monolithic application running on Oracle written entirely in PL/SQL. There are almost no tests, almost no documentation except code comments and most of design details is lost. There is no reliable testing environment, because configuration is very complex and undocumented, and because of some unfortunate design decisions it is hard to replicate the same results. In effect, unrestricted development in production by non-IT people was a norm. This was improved recently, because I (the only IT guy who seems to care) introduced (in fact enforced) merge request workflow, so at least there is somewhat reliable versioning and some review.

Looks like a horror story and some of you probably would like to run away screaming, but I decided to take this challenge, mostly because there was rising awareness that current situation is not right (this alone is a huge success).

So this is how it looked three months ago: I had Oracle with about 4TB of data in a single schema and about 100 fairly complex ETL processes loading about 2k tables implemented in 2.5M+ LOC of PL/SQL. Code itself is pretty simple, what is hard are dependencies (sometimes circular) between steps in ETLs.

I had some rough idea how to untangle this mess, but my first approach mostly failed. I have started with most obvious solution: testing environment as a copy from production and simple CI pipeline (in Gitlab) to test merge requests. This technically speaking works, but surprisingly slowed down whole process of _development_, because due to licensing and lack of resources I was able to run just one database instance and it was down too often. So currently testing env is just copy of production refreshed every night. No CI, just shared sandbox for everyone ¯\\_(ツ)_/¯

My second approach was to create separate instances of application, just by building it in different schemas. This worked well for me, because I could at least check if all my scripts work, but was pretty useless for other people, because building and loading data took even more time than before. This was a some success, because I learned much more about internal dependencies, so I now have some idea how to make this application more modular, so I could build smaller chunks.

Now, I think I gained some knowledge, but also noticed that others (remember, non-IT people) lost motivation. I realized that from their perspective things are _worse_, because _development_ slowed, is harder for them and all my ideas looks like failures or even _unnecessary_ burden.

I think I need to actually achieve something _fast_. My next step is to cut smallest, but still relevant, chunk of functionality and turn it into separate module/schema. First, to prove this can be done and there is hope. Second, to actually build actual CI pipeline and maybe even test and document something. My idea here is to wrap existing SQL and DDL scripts in Python, turn some of them into templates and then into `fabric` tasks, and then package them and put into local pypi (package repository), so I could build and configure new environments by pulling packages from repository. Basically, I want to turn my scripts into _application_ that builds environment with given configuration. And it does that fast. Other reasons behind this packaging are:
- a plan to move ETL processes to some python tool like airflow or mara
- I could use python testing tools (`tox`, `pytest` and maybe `utPLSQL`) to actually implement some tests
- I could use python docstrings to store some documentation and then use Sphinx to build some docs
- I could store configuration data in them (tables contents, as csv or json)

Does this makes any sense? Does anyone here at least _tried_ anything like this before?

https://redd.it/drafka
@r_devops