What tools are needed for building/deploying servers using configuration files?

So here's what I'd like to setup. I can make an image or images using Packer tool. I can use Terraform to deploy an ec2 instance using the ami id or some tags. However, that's somewhat manual.

What I'd like to achieve is that I'd like my developers to be able to specify a json or yaml file in a git repo that they will be creating. For example, a developer would like to setup an Apache server. Let's assume I've already created an apache image called **apache-img** using packer. So the developer that needs to deploy an apache will create a configuration file that contains a property name say **base-image** pointed to **apache-img** string. I'm aware that I will have to parse his repo using server side git hooks(I can do this part). What I'm missing are the tools that will be able to build a new instance using the specified base-image and also the tool for deploying the instance to different environments.

If you have a link or links I can read, that would be great!

Or how did you implement yours? How does your developers deploy servers/instances of a specific application type like Apache, Java, etc?

https://redd.it/dw5q7e
@r_devops

Using environmental variables from host to a Docker image

Hi I have a Docker container running inside CircleCI and trying to pass in local environmental variables from the host to the Docker container.

and in the localhost I have declared these vars

export gituser= myuser

export gitpass = password

​

docker build --build-arg gituser=${gituser} --build-arg gitpass=${gitpass} -t nodejs .

FROM node:9

RUN apt-get install git

RUN git clone [https://$gituser:$[email protected]/$gituser/m](https://$gituser:$[email protected]/$gituser/deploy-happi-hello-world.git)y\_app.git

​

However, the syntax is not correct as it returns the error:

\---> 08a8c8089ab1Step 2/4 : RUN git clone [https://${gituser}:${gitpass}@github.com/lexarflash8g/deploy-happi-hello-world.git](https://$%7Bgituser%7D:$%7Bgitpass%[email protected]/lexarflash8g/deploy-happi-hello-world.git) \---> Running in 2ff3bbd16d88Cloning into 'my\_app'...remote: Repository not found.fatal: Authentication failed for '[https://:@github.com/$gituser/my\_app.git](https://:@github.com/$gituser/my_app.git)

​

I guess the right env vars arent getting passed how do i resolve this?

https://redd.it/dvytl0
@r_devops

Trying to move a server from being setup with ansible over to docker, need some advice.

Right now I have an SFTP server running as a google vm. Every once in a while I need to add a new user to this server, and I decided I should probably look into ansible to create new users and for recovery purposes. So I set up an ansible script, but this is the only thing that uses ansible in our whole system and there are a couple things that I couldn't get ansible to work with so it never really took off. Fast forward to now, I just want to make this a docker container I can build and deploy. My main problem is that I've never created a docker container to do more than run an application. For this to work I would have to create a user for each person who needs access, create the sftp directory for each client, and modify configs to contain entries for each client. Ansible was really great for that, you can have template configs that generate entries for each user and easily loop. How do I accomplish this with docker?

1.) How do I do a config template? Like \`sshd\_conf\` how do I enter an SFTP user entry for each person?2.) How do I create a user list, and loop through a bunch of commands for them (create each user in the list for example) instead of just executing an explicit RUN command for each user?

https://redd.it/dvzam7
@r_devops

Need guidance about what to study in 2019 - 2020

Hello guys,

First of all excuse me if this post shouldn't be here. I'm a junior sysadmin currently studying Higher Diploma on Administration and Networks but I really feel that I need to complement it with some extra studies at the same time. I already seen some interesting certifications (VMware, LPIC..) and I'd like to know what you think I'd need to focus on.

I really like the idea of turning to devops but I feel I still need a lot of knowledge so, I'd like to know what to study first. I've got knowledge about Linux but still need to study advanced Linux but with some LPIC preparation courses should be fine.

If you need some further information about me to advise me better just tell me.

Thank you all.

https://redd.it/dw0ebg
@r_devops

How can I use Terraform modules without commiting to my directory structure?

Hey all - so curious your thoughts on this situation. We are using Terraform to configure all of our AWS infrastructure which is fantastic, and we are also using modules to keep everything organized in subdirectories that own specific parts of the infrastructure.

So far it's been great, with this one hangup:
If I try to restructure any of the modules to a better format, Terraform will subsequently try to destroy all resources in the pre-defined module, and then try to recreate all of those same resources in the post-module.

Let me give you an example:
I created a module named "rds" for our rds database. Now we are spinning up a dynamo table along with some other data resources, and I'd like to instead have a module named "datastore" where all database elements are managed.

If I simply renamed the "rds" folder to "datastore" and switched the source where it's imported, Terraform will now try to completely delete and recreate the resources in that module because it sees them as being completely different, even though in reality all I did was a rename.

Is there anyway to refactor the modules/subdirectories without completely deleting all the infrastruture? Previously I've manually removed resources from the state and then re-imported them to the new module, but that is so tedious. Ideally, I could refactor the structure of our subdirectories/modules and not have to completely re-create all infrastructure in AWS.

Maybe I'm taking the wrong approach - let me know what you think! Would love a good solution to this.

https://redd.it/dvxv9o
@r_devops

The power of checklists

Thought you all might be interested in my post about the power of checklists: [https://www.transposit.com/blog/2019.11.08-the-power-of-checklists/](https://www.transposit.com/blog/2019.11.08-the-power-of-checklists/)

Would also be interested in hearing how checklists (runbooks, playbooks) work (or don't work) for you. In my mind there's a fundamental tension between automation (which is fast to execute and, within the bounds of bugs and flash memory failures, repeatable) and human centered playbooks (which are flexible and low investment).

https://redd.it/dwbelt
@r_devops

[Help] Planning to overcome ALB 100 rule hard limit with traefik in ecs cluster

Hi all, We are using aws ecs for hosting our saas application, since we use host-based header rule to map ecs containers with subdomains we are about to reach the hard limit of 100 rules in alb , other than adding an extra alb to the cluster we are planning to overcome this issue by using traefik as a reverse proxy.


Does anyone have experience with a similar setup (ecs + traefik) running in production?
Is there a better solution to this issue?

https://redd.it/dwdolz
@r_devops

gitlab ssh deploy keys at scale

Wondering what's the standard way to manage deploy keys for 1000 servers to clone private repos.

1) create a single key pair, register it manually and copy it on every server (pros: easy to setup, 1 key to manage. cons: sharing the same keys? I don't know if it matters)

2) create a key pair for each server and register them with gitlab API (pros: unique key for each server, but does it matter? cons: hard to setup, 1000 keys to manage)

https://redd.it/dwg4rr
@r_devops

Busting myths related to APM - adding monitoring will not make your app faster by itself

There are many myths to be busted when it comes to Application Performance Monitoring. One of such myths is the belief that adding APM or any other monitoring solution to your production tooling will make the application faster by itself.

It will not. It is equivalent to a belief that buying a sport watch will make you lose weight. Extending this analog – similar to a sport watch, APM is using sensors to capture data from the underlying system turning it into information.

The information exposed by the sport watch must be understood and used in order to gain anything. After all, if at the end of the day you are looking at the sport watch and see 3,000 steps done during the day, you are not becoming slimmer or more fit. But if you knew that 10,000 steps a day is a key to a healthy lifestyle and are motivated to follow this advice, you actually stand a chance. Just put on running shoes and go outside to take a \~45 minute walk, you have actually improved your life quality.

If we look at the example more closely then the key lies in understanding **when**, **how** and **why** to use the information provided. In the example above, it started by the person both **believing** in 10,000 steps being the key to a healthy life and **having the motivation** to chase the goal. After having those two key pillars in place, it all boils down to making sure the watch clocks in 10,000 steps per day.

The same applies to an APM. Buying any APM will not make the application faster or remove any of the availability issues. On the opposite, capturing this information tends to add some overhead (typically measured in low single digit increase in resource consumption).

The post continues in the [Plumbr APM blog](https://plumbr.io/uncategorized/apm-myths-busted-1-adding-monitoring-will-make-my-app-faster).

https://redd.it/dwaolh
@r_devops

What does Docker's demise say about open source as a business model?

All open source companies have looked to Red Hat for inspiration but the failure of Docker to make a business out of a revolutionary product has really gotten me asking the question, if this is all sustainable - Why cant someone like JFrog or Hashicorp run into the same issues? Would love to hear from you guys

https://redd.it/dw9yd6
@r_devops

Request For Advice: Environment For Scheduled Web template system

Hello there! I think I am looking for some sort of web template system environment that I can run at scheduled intervals. In other words, I am interested in using/creating a tool to schedule the automation of software that can output website files ( i.e. \`foo.html\`, \`bar.css\`, \`baz.js\`). In particular, I would like this resource to work such that it can address the following use case example:

\- Every X hours run the "main program".

\- When the main program runs, it can grab a top and bottom partial from some arbitrary \`./partials\` directory to create an output file (i.e. \`output.html\`).

\- Then, the program will use (preferably custom randomized) logic to pick up a set of \`foo.html\`, \`bar.css\`, \`baz.js\` components (where, for example, the content of \`foo.html\` is \`<p>Lorem ipsum...</p>\` and content of \`foo\_2.html\` is \`<div>Zoinks!</div>\`, etc.) from some arbitrary \`./cmps\` directory and insert them in between the partials and output this integrated content onto a file.

I am pretty sure that there has got to be some setup already ideal for this sort of task, but I am not quite sure what might be an effective and simple approach to accomplish this. Off the top of my head, module bundling, templating and streaming build system techs like Gulp, Pug, Mustache, Twig, Webpack, etc. in combination with some basic Crontab schedule seem like a plausible approach. But I thought I would check if anyone here has any specific recommendations on how to setup a dev environment for this sort of odd project idea. Any pointers would be much appreciated.

Cheers! - Arty

https://redd.it/dwimlq
@r_devops

Please advise

Guys, i have an offer from a college to pursue post graduation programme in AI and ML. Will it be wise to switch from DevOps to Data Science?

https://redd.it/dwba9c
@r_devops

[Questions] Early stages workflow for DevOps

Hi all. I'm new with DevOps and I have a few questions. I'm an electronic engineer, so please bare with me.

I've already made a plan and workflow on how to learn and I think I got the overview. Though, there are some questions that I have and I would be grateful if someone could give some insight.

#### Baremetal setup

Most of the documents I've read so far, they start with the assumption that there's already a cloud service or local baremetal server that works. Therefore, devops seems to start with the assumption that the relying base infrastructure on which you work is already there. So,

1. What about also automating the setup of the real baremetal HW?
2. What tools are used in there?
3. I guess there is an unattended install with a gold image using PXE? Is that right?
4. And then? Probably using an ansible remote script to setup the baremetal server to be used in the cluster?
5. To fully automate this procedure though, you also need to setup the network and assign static IPs to the new connected MACs, which is always a manual step you can't avoid. Right?
6. What is the most simple architecture to achieve that?

Regarding (6), my guess is that:

* You need first to setup your network infrastructure to assign static IP to a new MAC. This step is manual.
* Connect the server on power and network (manual)
* First boot, enter into BIOS and setup (e.g. enable PXE and other custom configurations) (manual)
* Boot the server and select the image from the PXE boot menu (manual)
* OS installation and configuration should be automated from now on (drink coffee)

I guess to achieve the last step you need to have a custom service in you image that somehow connects to a static IP and requests for configuration. Then the server will use ansible-or-whatever to setup the server.

Is this how it works? Is there a better/faster way?

#### Packer

I was reading about packer and first I though that is some kind of holy grail that you create a configuration template and then re-use to spin off images in whatever target environment (cloud, baremetal). After reading a bit more, I'm start thinking that this is not what you actually get and it kinda makes sense.

For example, I want to have docker, a qemu and a virtualbox image for aarch64 targets. From what I see so far, you need 3 different configuration files for each target platform. You can't reuse templates. So you have to do this for each target platform you want to target.

It seems like that the real benefit of packer is to be able to have a bash script like this:
```sh
packer build ${IMAGE}-${MACHINE}-${TARGET}.json
```
Therefore, if you have, let's say a few configurations like those in your git repo:
* ubuntu_16.04-x86_64-AWS.json
* ubuntu_16.04-x86_64-docker.json
* ubuntu_16.04-aarch64-QEMU.json
* ...

Then you need to implement all these and use a script like the above to deploy them? Right?
Therefore, you need also to maintain all those separately?
This is the reason why it's good to use always something like ansible? So, instead of having to maintain a lot of details to the template configurations, you move that to a post-processing stage, which probably will be the same for all instances?

I've only being that far, but I'm a bit blocked by those missing pieces.

Excuse the length and thanks in advance for any reply.

https://redd.it/dw701g
@r_devops

Tool to generate IaC (terraform config, docker-compose file, ...) from architecture description?

Is there a tool that can generate configuration files (like `terraform` configs for prod and `docker-compose.yml` for local) from an architecture description (json/yml/...)?

A simple example would be a service that connects to a Postgres DB. Giving an architecture description like this (using docker-compose v2 syntax but could be any kind of architecture description):

version: '2'
services:
db:
image: postgres:10.1
ports:
- "5432:5432"
srv1:
ports:
- "3000:3000"
links:
- db:db

the tool would interpret the description and then generate local/dev configuration (like a `docker-compose.yml`) but also a production (`terraform` or similar) config.

The purpose of this would be to have a single description that can be used for generating multiple different implementations (local dev, production, ...).

Anyone know a tool like this?

https://redd.it/dwhg3k
@r_devops

Caught this talk from Toyota about their CICD at DevOps Enterprise Summit

I caught this talk at DOES'19 in Vegas a couple weeks back and thought it was super insightful - really like the move toward Scrumban and their big push to Shift Left. I'm just starting to dive deep into this stuff and it was really interesting to see how they put their pipeline together.

[https://www.youtube.com/watch?v=xgtuvXQ1wiA](https://www.youtube.com/watch?v=xgtuvXQ1wiA)

There's a XebiaLabs pitch at the beginning - Toyota talk starts at 4:15.

https://redd.it/dwd426
@r_devops

Ansible & Terrform or just Ansible

Hay all

I am looking at building my first Infrastructure by code in AWS.

But been looking at ansible and it can create, ec2 instances and such like Terrform.

So should I just use Ansible or both.

Advise welcome

https://redd.it/dwdpmo
@r_devops

Ansible: list all playbooks played on node

I would like to start using ansible on our on-premise servers. Like database migration tools I think it would be usefull to see which playbooks were executed on certain node. I haven't been able to find it, is there any tool for this?

https://redd.it/dvxq6s
@r_devops

Looking for security scan aggregation.

I have a bunch of security scanning tools (SonarQube, Fortify, etc) and I want to aggregate the reports to single location. I'd like to organize it by repo / git sha. Anyone have recommendations? I'd prefer to not write my own. Thanks!

https://redd.it/dvwgx9
@r_devops

Docker Hub - Matrix Builds and Tagging using Build Args

Hey, I recently wrote a blog post describing how to do matrix style builds on Docker Hub using build arguments

---

So what's the point? If Docker Hub works fine for most people, what's an actual use case for these Advanced Options?

Lets say you have developed a tool, and you would like to distribute it as a Docker image. The first problem is that you'd
like to provide Docker images based on a handful of different OS's. `ubuntu`, `centos6`, `centos7` and `alpine`
Simple enough, just write a handful of Dockerfiles, and use the `FROM` instruction.
But lets say that you also need to provide multiple versions of your tool, and each of those must also be distributed as a
Docker Image based on different OS's.

Now the number of Dockerfiles you need to maintain has increased significantly. If you're familiar with Jenkins, this would
be perfect for a "Matrix Project".

Here's what our Docker naming scheme might look like:

| | ubuntu | centos6 | centos7 | alpine |
|------|-----------|------------|------------|-----------|
| v1.x | v1-ubuntu | v1-centos6 | v1-centos7 | v1-alpine |
| v2.x | v2-ubuntu | v2-centos6 | v2-centos7 | v2-alpine |
| v3.x | v3-ubuntu | v3-centos6 | v3-centos7 | v3-alpine |

As our software grows, you could image other axises being added: architectures, software runtimes, etc.


---
The full instructions (and an example code repository) lives here:

https://blog.thesparktree.com/docker-hub-matrix-builds

https://redd.it/dvvw8o
@r_devops

Troubleshooting web apps issues: 6 recent cases from our SREs

Being an SRE/DevOps engineer, sometimes you are surprised to discover what has to be done to succeed in troubleshooting another issue of your app's operation.

[Here](https://medium.com/flant-com/6-sre-troubleshooting-cases-faf72ed36d6b?source=friends_link&sk=a72ed571f28327138c76edbbf5aab168) are examples of what we have had to overcome recently, involving Golang, Sentry, RabbitMQ, NGINX, PostgreSQL and others. Each case includes a brief description of the problem itself and our way to find/apply a solution.

https://redd.it/dwo1uw
@r_devops