How Devs Can Improve Open Source Security in the Enterprise

https://devops.com/how-devs-can-improve-open-source-security-in-the-enterprise/

https://redd.it/zfxpqe
@r_devops

One branch for development and one for production vs a single branch that deploys only tags to production. Which do you prefer and why?

Personally, the second option seems simpler to me, but it gives me the feeling that it is the least used.

Vercel has a tutorial on that setup here: https://vercel.com/guides/can-you-deploy-based-on-tags-releases-on-vercel

What do you think?

https://redd.it/zg0bob
@r_devops

Java code is 1.8 supported, SonarQube version supports Java 11, the build fails in Jenkins

Hi, folks!

I have 2 separate servers on Linux for Jenkins and Sonarqube. The code is written in Java 1.8 and can be compiled using Jenkins. Everything works fine.

It fails at the SonarQube step because our SonarQube uses Java 11, and it fails with this error.

ERROR: Error during SonarScanner execution java.lang.UnsupportedClassVersionError: org/sonar/batch/bootstrapper/EnvironmentInformation has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0

How can I fix this?

https://redd.it/zg63ec
@r_devops

Securing Open Source Components in a World of Mixed Committer Motivations

A recent article I read emphasized how open-source software is the foundation of our current society. As a result, it is up to developers to ensure that they are consuming and distributing the most up-to-date and secure code available.


Most open-source contributors with write access to a project's repository will continue to work on bug fixes and code improvements in the interest of the greater open-source community. However, due to their complexity, many open-source projects are vulnerable to sophisticated and coordinated attacks that have the potential to cause widespread and catastrophic harm.
Because the next potential attack is just around the corner, every developer and organization must step up their game and be ready to move rapidly on vulnerability identification and remediation. When information is gathered and shared, it has the potential to make everyone safer.


Please let me know if you have any suggestions and if this topic would benefit your organization.
https://devops.com/securing-open-source-components-in-a-world-of-mixed-committer-motivations/

https://redd.it/zfxm1t
@r_devops

Sonarqube upgrade from 8.9.8 to 9.3

Hi All,

We are planning for sonarqube upgrade from 8.9.8 to 9.3 , can someone please share some docs/steps to achieve this , I have heard after upgrade to 8.9.8 the team did faced many issue , eg -maven goal, pom.xml ,code coverage etc .

https://redd.it/zfzg0g
@r_devops

Using 2 NPM registries

I am trying to use 2 NPM registries. One of them is a private registry which holds our code and the second one is the global one.

No issues using one of them separately but when I am trying to use both of them always one of them breaks. Stuck on this issue for 2 days already.

P.S. everything running on linux

https://redd.it/zetsbu
@r_devops

How to deal with poking coworkers ?

Hello everyone,
I am a DevOps Engineer with 3 years experience. I am an introvert kind of person.
I joined this company (a startup) 2 months back. I have been able to solve a few problems here, thereby saving time and automating work flows.
However, my coworkers and manager seem to poke me saying that I need to open up more .
They crack jokes among themselves about something I am unaware of and roam around laughing and interacting with other folks.
I am majorly focused on my work, which also involves reading documentation and doing POCs.
(POC = Proof of Concept)

I was working on a POC and it somehow failed. Today my manager said that your POC effort has failed. Don't you feel ashamed? I replied "No, I don't". This is despite the fact that I had informed him beforehand that we should be ready for worst case scenario. To that, he replied that they will take care of it



How should I deal with this?
PS : I am thinking if I am at the wrong place or is there something I need to change in myself.
Please suggest.
Thanks

https://redd.it/zeeamt
@r_devops

I asked ChatGPT how to get into DevOps. I am officially worried for my job.

>To get into DevOps, first and foremost, you must change your entire wardrobe to consist solely of plaid shirts and skinny jeans. Then, you must spend countless hours on Reddit and Stack Overflow pretending to know what you're talking about. Once you have sufficiently convinced everyone that you are an expert, you can then start spouting off buzzwords like "continuous integration" and "infrastructure as code" to impress potential employers.

> Next, it's important to invest in some flashy tools and technologies that you have no practical experience with, but can talk about at length in an interview. Bonus points if you have a complicated setup at home that you can use to demonstrate your "skills" in a real-world scenario.

> Finally, don't forget to throw in a few buzzwords about "agile" and "lean" methodologies, and always be sure to mention how passionate you are about automation. Congratulations, you are now ready to enter the exciting world of DevOps! Good luck!

https://redd.it/zgjnj1
@r_devops

I am being tasked to ... ( high level advice needed)

I being tasked to help formulate the strategy to transform my app deployment team from app deployment into a devops department.
We handle the code signing and deployments to the internal and external app stores currently.

Is there any good resources to learn about how to pitch devops as a solution and build a team from scratch?
We have amazing documentation and development standards and I really want to make sure I am applying effort where it is needed.
We are 100% on prem and will most likely not be taking on cloud work.
We currently use jenkens/docker to manage our workflows and Pipelines.

https://redd.it/zgg860
@r_devops

Should I Ask Hiring Manager What to Study?

So I landed a entry-levelish DevOps position with a start date in about 1.5 months.

Should I ask my hiring manager, who will also be my boss, if there is anything I should be studying for a smoother onboarding process?

I have some serious imposter syndrome for this role and I don't want to look completely out of my depth when I start.

https://redd.it/zgnkfl
@r_devops

Become a Readiness Probes Expert in 5 Minutes Video

Do you want to know how to make your system more reliable on Kubernetes using Readiness Probes?

Readiness Probes is a key component for reliability, monitoring and Observability.

Check my 5 minutes video on Readiness Probes.


https://youtu.be/JznIp6rM6zk

https://redd.it/zgpw5j
@r_devops

Oracle free tier instance

If you don't know what to do with the Oracle cloud free tier instance here's an idea: https://github.com/notdodo/pulumi-k8s-oracle
It's my first pulumi project so any suggestion or advice would be greatly appreciated

https://redd.it/zgr15q
@r_devops

Any tool to monitor "what's going on within the company?"

I'm working in a mid-size enterprise, \~150 "software engineers" (developers, DevOps, dba, etc. etc.) and \~20 teams; our infrastructure is on-premise and cloud.


Sometimes a team get an alert because of a problem that this actually related to a change done by another team, eg: the infra team upgrades a Kubernetes cluster, and the metric agent running in the cluster but managed by another team fail to retrieve the metrics for the service "alice", the missing metrics trigger an alarm for the team owning the service "alice"


Is there a "tool" that lists what's happening/happened in the company in terms of deployments, upgrades...actually "anything" (could be a change in certificates) ?

https://redd.it/zgufi7
@r_devops

Manage Multiple Kubernetes Clusters with ArgoCD

How to manage multiple Kubernetes clusters with Argo CD following the GitOps approach. We will also use vcluster for running multiple virtual clusters and Kyverno: https://piotrminkowski.com/2022/12/09/manage-multiple-kubernetes-clusters-with-argocd/

https://redd.it/zgvejc
@r_devops

Should I attempt this take home assignment or not worth spending an afternoon?

I applied for Devops engineer position and received an email with this assignment to be completed before the interview. Though I can do this in an afternoon, I am just thinking if this is worth it as I have not spoken to anyone in the company yet. What do you guys think?
Is this reasonable to ask candidate to complete all this in a screening round?

## Guidelines - Build a Web App in Azure with status page

1. Use IaC (prefered Terraform) to create the Azure components and database.
2. Deploy this application to the Azure infrastructure that you prefer (can be on Azure VMSS, AKS, Azure App Service, …).
3. Feel free to choose the Database setup that you feel comfortable to work with.
4. You can think about all possible solutions that support the scalability, resiliency and security of the system.
5. Configuration file(s) that define your resouces and network.
6. Two additional infrastructure configurations (in seperate commits) that add scalability and security
7. Add basic logging/monitoring capabilities (in a seperate commit)
8. Apply CI/CD solution (Prefered - Azure DevOps) to support your approach.
9. Basic Documentation (README.md) and architecture diagram
10. Commit often, we like to see small commits that build up to the end result of your test, instead of one final commit with all the code.
11. Do a pull request from the dev
branch to the master
branch.
12. In your pull request, make sure to write about your approach and ideally document your architected solution.
13. Reply to the email thread you are having with our Talent Acquisition department and inform them you have raised a PR so that we can start reviewing your code.
14. One or more of our engineers will then perform a review of the solution and, in eventual later steps of the interview process, there will be a deep dive on the code and the architected solution. This interaction with your peers should provide a better understanding of what working together might look like.

### Bonus Points

If you can provision Self Host agents and benefit of private networking.
If you can document all aspects of your code, in the README and within the code itself.
If you can make this run all in one playbook.
Directory/file structure and the naming convention is a plus

https://redd.it/zgzwhy
@r_devops

Monitor object created in cloud bucket in datadog?

currently trying to set up GCP integration with datadog and then may have to monitor logs to see if a bucket following a naming convention is created daily and alert if not. Would also like to set alert limits for sizes

What is an easy and cheap way to do this? just via parsin logs?

https://redd.it/zgypva
@r_devops

DevOps and DeskSide Support

I’ve been in a DevOps role for over 6 months now and I love it! Recently, my manager approached me saying that I’ll be included in the company’s new DeskSide Support Team to assist on various Tier 2 hardware/software support issues.In the job offer/contract I signed, there is no mention of any desk-side support related responsibilities. Since when a DevOps does desk-side support? Aren’t these two different roles ?!

EDIT: for clarity, the new responsibilities were somewhat imposed to me. No in-writing notifications or any formalities were done… just a casual video conference call to which I never gave my consent to take these responsibilities.

https://redd.it/zh715w
@r_devops

How often do you investigate infra "issues" that are actually developer errors?

Is it common to get asked by other teams to troubleshoot an issue that ends being their own typo or failure to read/comprehend documentation?

How many times do you get asked for xyz when it's already documented?

https://redd.it/zh6xhd
@r_devops

trying to run a simple python script from github in aws ec2

im new to aws but successfully cloned a github repo and installed python onto my ec2 instance.

I made a weatherbot i am trying to deploy that texts me the weather. it has some dependencies. i tried to set up docker but that got complicated. I don't know how to connect through ssh.

I am getting an initialize main error, but the only script I have has the right code init main code and then simply prints "hello world"

has anyone dealt with this error? is there an easier way to deploy a python script with some dependencies that through cloning a github?

https://redd.it/zhez7d
@r_devops

Terraform Deployment testing

What are the best practices in testing terraform code deployments?

Examples: terraform plan, apply, destroy?

I need to check all of them are working properly. And then the services that are created from those are working properly!

https://redd.it/zhgzm5
@r_devops