Any idea about the Cloud/DevOps market in China?

For the most years, we know the only leading name, 'Alibaba' when it comes to China's cloud market. But do you have any idea how it exactly is doing DevOps in China? Who are the players, and are Chinese organizations use Docker and Kubernetes, or they have something else that is employed to do the same job?

https://redd.it/dst1ba
@r_devops

What are you doing for load balancing Hashicorp Vault (HA cluster, open source license)?

I've been running a Hashicorp Vault 0.10.x HA cluster in AWS with an ALB in front of it for a couple of years. It works fine but I've decided to set up a new cluster using a new version of Vault, and start migrating to it.

The new cluster would replace Consul with DynamoDB for storage, which will simplify setup significantly. I'm also adding TLS termination at the node level so data is encrypted at rest and in transit.

At this point I'm wondering what to do for load balancing. I know Vault elects a cluster leader, and requests that you send to non-leader nodes are forwarded to the leader. I know this works fine with an ALB but am not sure if I need the ALB.

The individual nodes will have static IPs so I could do "load balancing" by adding the static IPs to a DNS "A" record and access Vault through that record.

I can also keep using an AWS load balancer, though since I'll be terminating TLS at the nodes, I could switch to NLB instead of ALB.

The latter option is what seems to be Hashicorp's recommendation in their [reference architecture docs](https://learn.hashicorp.com/vault/operations/ops-reference-architecture#load-balancing) (it doesn't mention AWS NLB specifically, just an "external load balancer", but the HAProxy example is similar to (if simpler than) the way NLB works.

Do you have something of the sort running and how did you architect it?

Bonus question: do you have any thoughts about using DynamoDB as the storage backend? I'm also open to MySQL or Postgres. Basically just want to get away from Consul.

https://redd.it/dsk736
@r_devops

What business outcomes have you made possible recently?

There's a lot of focus on the tools we use day-to-day, and technical details around that.

Let's ignore that part, and talk about the positive change, we as a profession make possible in the world. What outcomes has your work made possible that you're proud of? What was the impact on the business and the people involved (aka stakeholders)?

Don't mention the "how" in the top comment, only the results achieved and the why you are proud to have contributed to them. Looking forward to reading your stories!

https://redd.it/dsdjqt
@r_devops

Monitoring wall reccomendations

We have 6 monitors on our monitoring wall all of which have chrome open and revolve through tabs for New Relic and some for Grafana. How do others automate the opening of these?

Currently were using Windows for the PC powering the wall & Nircmd to open chrome and the tabs on the correct screen. but I'd prefer a GUI solution or something easier to manage.

https://redd.it/dsh4zv
@r_devops

Tutorial: Deploy a Kubernetes Cluster with Service Mesh on DigitalOcean Using K3s

I threw together a tutorial on how to deploy a Kubernetes cluster with a service mesh on DigitalOcean. It uses the [k3s](https://k3s.io/) Kubernetes distribution and [Rio](https://rio.io/). The cluster will be a single master, so no HA unfortunately. In the future I'll write a tutorial on how to deploy a k3s HA cluster as well, and how to deploy persistent storage.

I hope someone will find it useful or educational. :)

https://lunar.computer/posts/k3s-service-mesh-digitalocean/

https://redd.it/dsyfcz
@r_devops

Why choose Terraform over Chef, Puppet, Ansible, SaltStack and CloudFormation?

Hi all,

I have this post on [why choose Terraform](https://selleo.com/blog/why-choose-terraform-over-chef-puppet-ansible-saltstack-and-cloudformation) vs \*insert another solution from the title\* and I would really appreciate any comments / thoughts / experiences / possible improvements to it.

Which one, in your opinion, is the biggest Terraform competitor and why? Currently researching this as well.

Thanks in advance!

https://redd.it/dswxc0
@r_devops

Cloudformation not assigning ingress to security group

I have a ALB that I am trying to assign a security group and ingress to. I want 443/HTTPS open only. Currently it creates the SG and assigns it to the ALB but no luck on the ingress. I've tried the below as well as the ingress as it's own resource.

​

ALBSG:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: "Security Group for ALB"
SecurityGroupIngress:
IpProtocol: tcp
FromPort: 443
ToPort: 443
VpcId: <VPC ID>

https://redd.it/dsz52x
@r_devops

S3 error when creating MongoDB stack via quick start
https://www.reddit.com/r/aws/comments/dsr3x5/s3_error_when_creating_mongodb_stack_via_quick/

https://redd.it/dt4ang
@r_devops

What am I missing in my Devops interviews?

Hey all, not sure if this kinda post is allowed, if not please delete.

I am currently a devops engineer and have been for the last 3 years. I started going on interviews again and have been rejected for a couple jobs I feel I had a great opportunity to get. I know this is kinda an open ended question, but what do you all feel are key points to hit on in a devops interview other then Docker/containerization, Kubernetes, AWS (I am certifited), CI/CD, scripting with bash/python etc., etc? Just want to see if there something else I maybe should add to my resume to make myself look stronger or for those answering who are Devops leads, what are things your are looking for?

Thanks for the help!

https://redd.it/dt6oe3
@r_devops

SSL Cert Rotation with Runbook

[https://patrick.ble.si/ssl-cert-rotation-with-runbook](https://patrick.ble.si/ssl-cert-rotation-with-runbook)

&#x200B;

How do you manage SSL certificates? Do you have an automated process? A vendor solution?

https://redd.it/dt1weq
@r_devops

Unable to start openvpn server after install
https://www.reddit.com/r/OpenVPN/comments/dt4uaq/unable_to_start_openvpn_server_after_install/

https://redd.it/dt4y6g
@r_devops

Terraform for provisioning bare metals?

Just read a comment about people using Terraform on bare metals. I thought Terraform was for provisioning on aws and other cloud providers. I know you can write your own custom provider, but I don't see what you would do with Terraform on bare metals.

If you personally use Terraform on bare metal, what are your use cases?

https://redd.it/dtabmo
@r_devops

Kubernetes Multi-Operator Stacks and Advanced Pod Scheduling

Here are some thoughts on how to think about Pod scheduling while developing Kubernetes Operators for multi-Operator environments.

[https://medium.com/@cloudark/kubernetes-multi-operator-stacks-and-advanced-pod-scheduling-c3131dde3755](https://medium.com/@cloudark/kubernetes-multi-operator-stacks-and-advanced-pod-scheduling-c3131dde3755)

Are you using Kubernetes Operators? Have you faced above issues? Would be curious to understand your use-cases in the comments.

https://redd.it/dt21hz
@r_devops

Heroku CI vs GitHub Actions
https://www.reddit.com/r/github/comments/dtbh6t/heroku_ci_vs_github_actions/

https://redd.it/dtblkd
@r_devops

distroless Docker Images - thoughts?

I'm talking about the [distroless](https://github.com/GoogleContainerTools/distroless) project from GoogleContainerTools.

The images are build through [bazel](https://bazel.build/),first time I heard about this build tool but I'd like to get some feedback from people that have actually tried it.

After successfully building the image, you'll end up with *your application* and its *runtime dependencies* (no shell, no package manager, nada).

They have some [examples](https://github.com/GoogleContainerTools/distroless/tree/master/examples) there for dotnet, go, java, nodejs etc.

https://redd.it/dtd2mu
@r_devops

Obfuscation of Javascript

Hi everyone, I made a script ( only for JavaScript obfuscation) which obfuscates your JavaScript code i.e removes the original code and replaces it with the obfuscated code. P.S - You need to have npm package JavaScript obfuscator installed. https://github.com/Shrinidhikulkarni7/Obfuscation

I also wrote blog on the same - “Obfuscation of the code” by Shrinidhi Kulkarni https://medium.com/@davidcesc/obfuscation-of-the-code-8086c9c8b34a

Please feel free to give feedback. I started doing devops work in January and willing to learn more and more as I love it.

Thanks to this subreddit :)

https://redd.it/dtevs8
@r_devops

From Dev to DevOps what about networking ?

I started as java/jee developer two yars now i switched to DevOps,i've been handling at first jenkins pipeline git flow bitbucket jira administration and docker and too many times i've been stuck with network issues or misunderstanding of some network concepts . Now im just wondering should i go back to network courses to fully understand it or just concenrate on networking parts of DevOps tools ?

https://redd.it/dtj9ap
@r_devops

Wanted: Version Control System with Encrypted Central Repository and Individual File Check-out.

The company I work for produces a large number of commercial apps available through the Apple Store, and that involves managing a large number of certificates, with fairly long lifetimes (between one month and one year) from Apple both for sales (the app must be signed to be sold, after all) and for push notifications. We'd like to further secure our build pipeline, and one of the requests is for a VCS that has an encrypted central repository and individual file check-out.

We're not sure how to achieve this. Thus far, the best we've got is to keep the certificates on an in-house resource with encrypted drives, and have one GIT repo per certificate, and to lock access on a per-repo basis only to the teams that need to build their particular app. That feels kludgey and unreliable.

How do you manage third-party app certificates in a way that's both secure and (relatively) convenient to a diverse number of development teams?

https://redd.it/dtiqsz
@r_devops

How to sclae OsX builds?

Hi all! I'm almost 1.5yrs into my position as a DevOps engineer at a large company. I was lucky enough to get this gig straight out of college. I know I'm not anywhere near close to knowing all I need to know in this discipline but I'm learning more every day.

Currently, we have an application that we build on macOS, Windows, and Linux. For Macs, we currently have a bunch of minis sitting in a data center and our Jenkins master will target an available mini to run a build on (a very simplified explanation but that's pretty much the gist). My issue is, I don't think this method is scalable. We have more and more developers coming on every year so we have to buy more minis to keep up with the demand. We've thought about using Macstadium but from testing, we've seen our build times almost triple. I've been trying to do research into finding a scalable solution, preferbly with cloud tools, but I'm coming up empty.

Any ideas or advice would be greatly appreciated!!

https://redd.it/dtkfbp
@r_devops