Ansible & Terrform or just Ansible

Hay all

I am looking at building my first Infrastructure by code in AWS.

But been looking at ansible and it can create, ec2 instances and such like Terrform.

So should I just use Ansible or both.

Advise welcome

https://redd.it/dwdpmo
@r_devops

Ansible: list all playbooks played on node

I would like to start using ansible on our on-premise servers. Like database migration tools I think it would be usefull to see which playbooks were executed on certain node. I haven't been able to find it, is there any tool for this?

https://redd.it/dvxq6s
@r_devops

Looking for security scan aggregation.

I have a bunch of security scanning tools (SonarQube, Fortify, etc) and I want to aggregate the reports to single location. I'd like to organize it by repo / git sha. Anyone have recommendations? I'd prefer to not write my own. Thanks!

https://redd.it/dvwgx9
@r_devops

Docker Hub - Matrix Builds and Tagging using Build Args

Hey, I recently wrote a blog post describing how to do matrix style builds on Docker Hub using build arguments

---

So what's the point? If Docker Hub works fine for most people, what's an actual use case for these Advanced Options?

Lets say you have developed a tool, and you would like to distribute it as a Docker image. The first problem is that you'd
like to provide Docker images based on a handful of different OS's. `ubuntu`, `centos6`, `centos7` and `alpine`
Simple enough, just write a handful of Dockerfiles, and use the `FROM` instruction.
But lets say that you also need to provide multiple versions of your tool, and each of those must also be distributed as a
Docker Image based on different OS's.

Now the number of Dockerfiles you need to maintain has increased significantly. If you're familiar with Jenkins, this would
be perfect for a "Matrix Project".

Here's what our Docker naming scheme might look like:

| | ubuntu | centos6 | centos7 | alpine |
|------|-----------|------------|------------|-----------|
| v1.x | v1-ubuntu | v1-centos6 | v1-centos7 | v1-alpine |
| v2.x | v2-ubuntu | v2-centos6 | v2-centos7 | v2-alpine |
| v3.x | v3-ubuntu | v3-centos6 | v3-centos7 | v3-alpine |

As our software grows, you could image other axises being added: architectures, software runtimes, etc.


---
The full instructions (and an example code repository) lives here:

https://blog.thesparktree.com/docker-hub-matrix-builds

https://redd.it/dvvw8o
@r_devops

Troubleshooting web apps issues: 6 recent cases from our SREs

Being an SRE/DevOps engineer, sometimes you are surprised to discover what has to be done to succeed in troubleshooting another issue of your app's operation.

[Here](https://medium.com/flant-com/6-sre-troubleshooting-cases-faf72ed36d6b?source=friends_link&sk=a72ed571f28327138c76edbbf5aab168) are examples of what we have had to overcome recently, involving Golang, Sentry, RabbitMQ, NGINX, PostgreSQL and others. Each case includes a brief description of the problem itself and our way to find/apply a solution.

https://redd.it/dwo1uw
@r_devops

What’s wrong with Pipeline as Code or why I don’t like Gitlab

I concluded some my recent thoughts regarding GitLab CI/CD with this [post](https://medium.com/@raxwunter/whats-wrong-with-pipeline-as-code-or-why-i-don-t-like-gitlab-ca70c39eb52b)

https://redd.it/dwwlf9
@r_devops

Secrets, k8s and rotation. Are there any tools for this?

So we’ve got Openshift running most of our services.

Now I want to start automatically provisioning secrets to the respective namespaces/projects.

Openshift already has a decent UI/cli for doing this, but I want a seperate system that can do two things:

1. Generate new credentials for any internal dependency (DB for instance)
2. Update the credentials in OpenShift

My idea is to have two active credentials, at 00:00 I’ll enable credentials v1 in Openshift, and create new credentials v2. At 12:00 I’ll enable credentials v2 in Openshift and generate new credentials v1. Ad infinitum.


So in case of credentials leaking they’ll be automatically rotated pretty quickly. It should also let me rotate on demand.


Are there any already created tools for this?

https://redd.it/dwmi0q
@r_devops

What do you use as a secondary device for your work?

My daily driver is a high end MacBook Pro (like most of us here).

I'm looking to get a secondary device. I've narrowed it down to three that are roughly the same price but I'm curious about people's thoughts and there may be other ideas.

A good SSH experience and web browsing experience are paramount.

iPad Pro and smart keyboard - this is probably the most thin and light of the 3 options I'm looking at and has the best battery life. The big downside is I can't do any local dev on it and will have to SSH into something.

Pixelbook Go - I'm stuck only using google's browser. However I can do a ton of linux native stuff and run docker containers locally and run the linux version of visual studio code locally.

Dell XPS 13 - I'd have to go with the base model to keep the price low but considering I'm just SSHing and using a browser and other tools this could work. It would be Windows...which would give more flexibility in what apps I can run. WSL on Windows has interesting implications and the new Windows Terminal also looks good. This would be the most expensive option of the three.

Any thoughts on this?

https://redd.it/dwz747
@r_devops

Dev Ops Engineer Technical Interview Advice

Hi! I am requesting advice for a devops technical interview. If anyone would be willing to share their tips and tricks on the best ways to prepare, or any book or website recommendations, it would be extremely helpful. Below is a description of the technical interview that I was sent from a company's recruiting department:

​

"Topics you should be prepared to discuss technically in depth are: Kubernetes experience and knowledge, Docker, Cloud experience, troubleshooting, debugging, Linux administration and terraforms."

https://redd.it/dvz3qb
@r_devops

Please recommend me a good Firewall workflow. (General and Kubernetes)
https://www.reddit.com/r/linuxadmin/comments/dvdq7y/please_recommend_me_a_good_firewall_workflow/

https://redd.it/dvs8fg
@r_devops

CI/CD for small personal project

I have small mobile application with no unit tests currently written. They are OTW but im trying to better understand what exactly CI/CD would do for me, specifically GitHub Actions as this is free for me. I want to publish this app and do everything the way a legit shop would. Is there any purpose to CI/CD for a small app with only 1 developer working on it? It's my understanding that CI, if I had tests, would allow me to run all those test every time I push a commit. Is there anything else that would benefit a lone developer?

Thanks

https://redd.it/dwyv1n
@r_devops

Security Q: If a Hacker successfully gains SSH access to a Docker container, can they figure out that they're in a container?

For a small side-project, I've been thinking about setting up a couple of honey pots to monitor and collect data on, mostly to show how common and frequent pen attempts are (mostly thinking a wordpress site, the classic).

And I got to thinking--if a bad actor SSH's successfully into a Docker container exposed to to the internet, how might they determine that they're on a container and not on the ~~root~~ underlying host?

It's kind of fun/novel to get approach infrastructure from this perspective.


\*Edited word for clarity

https://redd.it/dwwstc
@r_devops

Automatic Jenkins Job Creation

Hey guys!


We started using Jenkins as a cron management tool to run our scripts that run on a daily basis. The job creation parameters of each of these scripts are exactly the same, aside from the name of the script.

For example, the only thing that changes in the build configuration in jenkins for these script jobs, are the docker run command that just changes the name of the script.

I can see how we can automate this process for creating a new job. Instead of going to Jenkins, adding a new item, and copy and pasting all the configs, I'm sure there is a way to automate this. I'm just not exactly sure how to go about it.

I should clarify that this consists of 2 jobs basically:

Job 1: rebuilds the docker image everytime a push is made into master.

Job 2 - 40 : each of these jobs are the script that needs to run daily. All the job parameters are the same except for the docker run command. The docker run command uses the image that is built from job1.

Here is what I'm thinking how this could work:
We could develop a script using Jenkin's API that takes in the script name as a parameter, and creates the job using jenkin's restful api. We can have this script in master, and somehow execute this script automatically, by providing the newest entry into the repo as a parameter.

Would this be at all possible?

https://redd.it/dwybbm
@r_devops

Container platform for the Enterprise

Yesterday I published the first part of my book which is currently free on [https://leanpub.com/cpe](https://leanpub.com/cpe)

The title of the book is "Container platform for the Enterprise". The idea behind the book is to give insights in how to create a container platform the DevOps way but also to support the DevOps way of working in an organization.

The first part of the book focuses on the organization, decisions that need to made and the team setup. The rest of the book will be more focused on setting up the platform and what it takes to do it. The book is not a hands-on guide but it tries to give you insights into the problems, options and why you can or should choose certain directions.

https://redd.it/dx4g8t
@r_devops

Hello guys, really need your help here. :(
https://www.reddit.com/r/docker/comments/dwy2sq/frontend_application_cant_resolve_service_name_of/

https://redd.it/dwyt7u
@r_devops

Two separate repos (not dependent on one another) in same k8s node

Newbie question that seems exactly what k8s does, but just wanting to confirm.

Two separate repos with different concerns and in the same k8s node. Each repo would run as separate deployments in the node.

Pipelines can be setup for each repo, for the same node, where pushes/passing tests to that repo only updates that deployment in the node, correct?

There is no need to do some Git magic (subtree or submodule) to consolidate these into a single repo and then deploy from there?

Each repo can be worked on individually, pushed, triggering pipeline, tests pass, and it updates just that deployment in the node?

https://redd.it/dwx0so
@r_devops

Authenticate Jenkins to access Google Drive/Sheets

Hi there,

I'm trying to automate the process of downloading a Google Sheets file as an excel and uploading it to an s3 bucket. I have an endpoint that downloads the file as excel, but when Jenkins does a GET request to it it gets blocked by the Google login prompt.

I can't seem to find a good way to authenticate/allow Jenkins to programmatically hit that endpoint. Does anyone have any documentation or ideas on how I should be doing it? I've googled to no avail and can't imagine I'm the first person to do this. Any help would be awesome

https://redd.it/dx87ea
@r_devops

Centralized Unit Test Validation for Multiple Git(*) Repositories

Hey guys,

I have a project which I don't know how to even get started with. I will appreciate your help and ideas.

The project requires complex automation of git repository workflow (github, gitlab, etc - at this point git source vendor doesn't matter). Here is the scenario:

1. I have 20 people who will provide authentication to their git platform account and will fork my private repository.
2. Then, when they update and push code to their fork, I want to have a cloud/self-hosted devops project, which will pull their code and validate it with unit tests (challenge #1).
3. The output status of the pipeline (passed or failed) will be sent to my server to track their fork build status (challenge #2).

Are the above steps possible with any technologies out there? If not, I am open to alternative solutions, but the basic requirement is:

* people will have only read-access to my code, but i will need to programmatically validate the build output of their code with unit tests.

I've been thinking about this requirement for a long time, but couldn't come up with any solution. Maybe there is something fundamentally wrong with this requirement? Maybe i shouldn't be using Git, but a centralized version control?

Thanks a lot for the help.

https://redd.it/dx7ukp
@r_devops

Who has the best chance to become a "platform" for DevOps?

Everyone from GitLab, JFrog to CloudBees seems to be intent on making a broader platform and not stay a tool or a point solution in the whole tool chain.

I think GitLab has the been the most vocal about this, but i feel jFrog's central role as source of truth of artifacts could be very helpful in trying to expand into DevSecOps and distribution.

Who do you think has the best chance?

https://redd.it/dxaa11
@r_devops

It's a secret!

So I'm currently doing my research on handling secrets through the tech stack, with the focus currently on the build \\ deploy pipelines. This is for a hybrid cloud project which can be summed up as K8's on AWS + a few extras bits, trying to avoid vendor specific tooling however.

In real terms, we're probably going to go down the route of Hashicorp Vault. However when I submit my research, I want it to have good, concrete reasons for it other than "It's what everyone else is doing"

The thing is, I can't seem to find any real comparisons. I'm focusing my research on Vault, Keywhiz and Torus. I know Vault has a comparison with Keywhiz on their website, but that's about it.

Does anyone know of any articles or podcasts that actually go over the differences in an easy to understand fashion.

https://redd.it/dvrx79
@r_devops