New release: CloudFormation CLI (open source) and support for third-party resource providers

This has been rumored to be coming for a while. But AWS has finally pulled the trigger. A new native open source CLI for CloudFormation and support for native third-party resource providers (not custom resources). Also, there's a CloudFormation registry out of the box now for future third-party providers to be hosted.


https://aws.amazon.com/blogs/aws/cloudformation-update-cli-third-party-resource-support-registry/

https://redd.it/dywrqe
@r_devops

Organizing Hashicorp Vault secrets?

Are there any best practices to organizing Vault secrets? Right now it seems like it’s the Wild West with secrets in different places.

I have AWS secrets here, client secrets there and I’m just a bit overwhelmed.

Any helps would be much appreciated!

https://redd.it/dyv3xd
@r_devops

Untested changes merged to our develop branch end up in production. What should we do?

We work by having a develop branch and a master branch. The develop branch can be deployed to a dev or test environment. The master branch can be deployed to QA and production. When we start work on a feature, we create a feature branch based on the develop branch, and then merge back into develop, when we want to start sending the feature through our TEST environment(where it gets verified by the business supposedly - rarely ever happens). In QA Operations are meant to verify that the deploy went okay.

Today we experienced that some old untested changes merged to the develop branch were automatically deployed as another team had merged their changes into the develop branch and merged it into master and deployed to production. We want to avoid this from happening.

My thoughts on this are the following:

\- We could drop the idea of having a develop branch and maybe ensure that we can spin up the test and QA environments. I'm not sure why it matters to have both a DEV, TEST and QA environment. When I ask I get some very vague answers. Instead when we're done with our work we merge directly to master.

\- To assume master is okay, we set up good automated test coverage.

\- We split up services into microservices, so we don't run into the issue of multiple teams working on the same service all the time. Many of our services could easily be split up.

\- We add feature toggling for new features, so they by default are disabled when deployed.

Myself and the company I work for are very far from working in accordance with all the DevOps guidelines, but I'm trying to push the ones that seem to solve our problems. I'm not too sure about our branching strategy as above though. Thoughts? I'm thinking in must be a very common problem that's been solved a million times.

https://redd.it/dys8rj
@r_devops

Chef inSpec use case

I do all of my deployment using Ansible. That being said, what would be the purpose and use case to add inSpec to my workflow?

https://redd.it/dyqqli
@r_devops

Terraform increase tag number on an auto-scaling group

I'm trying to figure out a way of increasing a number at the end of the name tag value for EC2 instances that get brought up by the ASG.

resource "aws_autoscaling_group" "asg-web-1" {
name = "asg-web-1"
launch_configuration = "${aws_launch_configuration.web-launch-config.name}"
min_size = 1
max_size = 3
vpc_zone_identifier = ["${aws_subnet.private-subnet-1.id}"]
target_group_arns = ["${aws_alb_target_group.web-alb-target-group.id}"]
health_check_grace_period = 60
health_check_type = "EC2"

tags = [
{
key = "name"
value = "b-t-web-"
propagate_at_launch = true
},
{
key = "role"
value = "b-t-web"
propagate_at_launch = true
}
]

lifecycle {
create_before_destroy = true
}
}

So for the value for the name tag of b-t-web-, I would like to add 1 to the end and count up from there for each instance that gets added. Does anyone have any recommendations on how to do this? I believe you'd normally use count.index + 1 but I'm not using the count object because its not included in the resource.

https://redd.it/dz1gfp
@r_devops

Monitoring row count on Oracle DB

We currently use a Nagios plugin to execute some SQL against an Oracle database that returns a row count. It alerts If the row count is outside of some threshold. It works fine, just getting tired of creating checks for users that are able to write SQL, but we don’t trust creating Nagios checks.

I’m wondering if some frontend exists where users can input their SQL and have a check created?

Or Is there another solution not as cumbersome as Nagios that we could transition these users towards?

https://redd.it/dynvq9
@r_devops

Can it be true????

I've been searching for a solution for managing multiple K8 clusters, I even tried creating my own but it proved to be futile & I didn't have enough time so I threw it in the bin. This sounds too good to be true. Has anybody used this? Does it actually work? Anybody at Kubecon that can verify any of this for me? I'd be soooooo grateful and will give you karma

[https://thenewstack.io/portshift-attempts-more-granular-security-for-what-istio-service-meshes-lack/](https://thenewstack.io/portshift-attempts-more-granular-security-for-what-istio-service-meshes-lack/)

https://redd.it/dz3on3
@r_devops

Container based SSH/VPN bastion backed by AWS IAM

A bastion comes in handy when one needs to have a presence inside the VPC for checking on internal-only services. While there are a number of solutions for this (IAM backed ssh) delivered as ec2 instances, we have a container-based infrastructure, so it didn't make sense to setup instances just to provide a bastion. I also don't like polling, and prefer the immediacy of denying access immediately after removing someone from the IAM group that controls access. Check it out and let me know what you think.

[https://github.com/cloudtruth/aws-bastion](https://github.com/cloudtruth/aws-bastion)

https://redd.it/dz2q2l
@r_devops

Gotta tell someone about my first real "devops" success

Today I had an epiphany, and haven't been able to work since.

I'll start by saying I have the freedom one does when working for a small company (<100). I'm new to DevOps - even now, its still just a bunch of tools that noone but I will use lol.

Today is also a good day because I pu the finishing touches on a CI pipeline, and connecting said pipe to my local Ansible-configured virtualbox environment. I'm going through working out the kinks in the aftermath of an Ansible deployment: Why won't Nginx let me connect from my laptop's web browser? Is this broken, or just slow? Do I REALLY have to go back an change the deployment scripts AGAIN?

The last one is when it hit, man. Our test/QA gals struggle with this one *constantly,* depending on the environment they're in. Every time the want to deploy, they have to mod the scripts half the time (thanks a lot, Bamboo). The epiphany was this:

`If devs used this CI pipeline, they would experience the same problems as test/QA`

Considering how the devs currently do things, I can't shake the feeling that this is a win. And there's more: My first problem is the exact same problem that's been on my plate for a week now! I can finally do my work now!!! This must be how the South Park gang felt after pwning the World of Warcraft guy.

Maybe for Christmas I'll get to tackle the second problem, the fun one! But hopefully, a dev will us our new CI and beat me to it.

:)

Thanks for letting me share!

https://redd.it/dz5gj9
@r_devops

Devops for Windows?

I accepted a DevOps position at a company which develops and hosts web applications for large companies. [ASP.NET](https://ASP.NET) , staunchly Windows shop, use of Linux for any purpose is mind-numbingly forbidden.

Powershell is becoming my best friend, but finding myself kneecapped by the inability to spin up a Linux server. Open source products, password management solutions, telemetry software, monitoring software, reporting software, automation platforms, all must be natively hosted on Windows. Naturally this eliminates about 80% of the tools available to do my job, **especially** the ones that won't cost 5-6 figures and a several month acquisition process. Anyone in a similar situation, have devops tools they use for Windows web shops, tips to handle?

https://redd.it/dz56ys
@r_devops

Help me understand Helm and Kubernetes Secrets

I'm going to be using Helm 3 (finally out) and Kuberentes Secrets. My plan was to have stuff like my DB connection string in Kubetnetes secrets then in my helm charts tell it which secret to use. I'm not sure this is the right or even supported way. I could not find much for resources on how I'd use helm with Kuberentes secrets.

&#x200B;

Can someone explain to me how this would work and how I could do it or maybe point me to a resource that explains it?

&#x200B;

EDIT\*\*

The idea is I accept ENV variables into my applications fro config, this needs to stay the same I just need to figure out how to do it with helmand Kubernetes secrets.

https://redd.it/dz8y3x
@r_devops

Installed Spinnaker with Helm now can't get ECR to work

I installed Spinnaker onto a kubernetes cluster created with kops (with ECR policy included). Now I use the below command to connect to where the halyard is installed, issue is I need to install the aws cli but it won't let me...

kubectl -n default exec -it spinnaker-spinnaker-halyard-0 bash

The only post I could find online about this issue was

[https://stackoverflow.com/questions/54804772/spinnaker-with-halyard-from-helm-chart-has-missing-aws-cli](https://stackoverflow.com/questions/54804772/spinnaker-with-halyard-from-helm-chart-has-missing-aws-cli)

It says a solution is pretty much it's not needed however I am then confused as to why my registry isn't showing up and I'm getting the below error/warning message. I know it says it was successful however it goesn't show up anywhere and if there was no password it won't work right?

spinnaker@spinnaker-spinnaker-halyard-0:/workdir$ hal config provider docker-registry account add my-ecr-registry --address $ADDRESS --username AWS --password-command "aws --region $REGION ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken' | base64 -d | sed 'hal config provider docker-registry account deletes/^AWS://'"
+ Get current deployment
Success
+ Add the my-ecr-registry account
Success
Problems in default.provider.dockerRegistry.my-ecr-registry:
- WARNING Password command returned non 0 return code,
stderr/stdout was:bash: aws: command not found
sed: -e expression #1, char 2: extra characters after command


- WARNING Resolved Password was empty, missing dependencies for
running password command?

- WARNING You have a supplied a username but no password.

- WARNING Your docker registry has no repositories specified, and
the registry's catalog is empty. Spinnaker will not be able to deploy any images
until some are pushed to this registry.
? Manually specify some repositories for this docker registry to
index.

Problems in halconfig:
- WARNING There is a newer version of Halyard available (1.28.0),
please update when possible
? Run 'sudo apt-get update && sudo apt-get install
spinnaker-halyard -y' to upgrade

+ Successfully added account my-ecr-registry for provider
dockerRegistry.

https://redd.it/dzbgpt
@r_devops

I bought c5.xlarge reserved instances but my reservation coverage report in cost explorer seems to map them to c5.large

My company has some c5.large and c5.xlarge instances. We bought c5.xlarge reserved instances expecting them to cover our c5.xlarge on demand instances.

What happened instead though is according to the reservation coverage report in cost explorer, all of our c5.large instances are now covered by these c5.xlarge reserved instances, and only 2 of our c5.xlarge instances are covered.

It seems as though for some reason that, although we bought xlarge, amazon gave priority to our large instances for coverage. This doesn't seem right or fair to me.

All of our instances are in US-East, so it's not a region problem.

https://redd.it/dz6lxt
@r_devops

Docker best practice when deploying php app?

Hi, this is my first post, and I wanted to hear opinions how do you deploy PHP or JS applications within Docker? Our dev teams mainly use Simphony for back end , and JS based frameworks for frontend, so would multi-stage build be good approach.
For example, app gets compiled in first step, then \`COPY\`-ed into the actual production image which is slimmed, and shipped with only binaries required to run app (compiling stuff is 'left' at first step).


2nd approach I am thinking of is using CI for building app, then deployed as docker container?

Or, there are some more preferable options?

https://redd.it/dyyzp8
@r_devops

bpf filter

Was wondering if it possible to do until in BPF ([https://en.wikipedia.org/wiki/Berkeley\_Packet\_Filter](https://en.wikipedia.org/wiki/Berkeley_Packet_Filter)). Say I have a message that begins with ASCII "ABC" and ends with "XYZ" but it spans multiple packets. I couldn't figure out with BPF if I can follow or do until.

https://redd.it/dz0wzu
@r_devops

Fugue Developer is now free - cloud security and visualization for engineers

I'm a co-founder of Fugue, and today we announced Fugue Developer, a free forever tier for individual engineers to build and maintain secure cloud infrastructure in highly dynamic and regulated cloud environments. It provides tools to visualize cloud infrastructure environments, detect resource misconfiguration and policy violations, report on compliance, and understand infrastructure change. Fugue supports AWS and Azure.

[https://www.fugue.co/blog/fugue-developer-free-cloud-security-and-visualization-for-engineers](https://www.fugue.co/blog/fugue-developer-free-cloud-security-and-visualization-for-engineers)

https://redd.it/dzj632
@r_devops

Will continuous security actually save time?

[https://www.portshift.io/you-need-to-shift-left-for-app-security/](https://www.portshift.io/you-need-to-shift-left-for-app-security/)
Came across this recently. It's an interesting read and I'm considering switching but before I commit I'm wondering if anyone has implemented this software & if it saved time? I'm looking to switch because my current software has been having glitches & I don't want to make the same mistake again.

https://redd.it/dz0q0n
@r_devops

Deploying a Web App to Run Locally on Client Machines

Hi everyone,

I am currently building a Web App with a Django backend and a Vue.js frontend, which is planned to be deployed locally to the machines of my clients.

My question is the following: how do I deploy this to another persons computer in the least complicated way possible for them? Is there an easy way to achieve this that does not require substantial technical know-how on the users side to get the app up and running? I have considered deploying the app as a docker image, as this would ensure that the client would not suffer from dependency issues and offer a relatively smooth way to deploy, but in my case it isn't ideal since my end users are not going to be technically-minded. Furthermore, I am wary of the security and IP issues that deploying the application via the Docker route may entail (since anyone would have root access to the container, and therefore my source code).

I also understand that there are GUI frameworks I could use in this situation, such as Electron for JavaScript or any of the many Python libraries, but neither of these fits my requirements fully, since I would prefer to write Python on the back-end of the application (taking Electron out of the running) and I am not impressed by the aesthetic quality of what I have seen from Python GUI frameworks (taking Tkinter etc. out of the running).

As such, I would like to explore whether or not there is a simple way of starting my Web App locally on my clients machine in a way that would involve as little hassle as possible. I could personally do the implementation on-site, and smooth out any initial issues that may arise, but the approach should ideally be robust to extended usage and straightforward for individuals without extensive technical knowledge.

Thanks in advance!

https://redd.it/dz0ke2
@r_devops

How do you integrate DevOps best practices with no time?

Within the past year, I was hired on as a cloud engineer by a small company who is 100% in the cloud using some pretty exciting AWS/GCP services. I quickly came to realize that they're 100% cloud running legacy IaaS applications... Though they are actively working to decouple these monolith applications its really taken up all of my time supporting and just simply maintaining basic functionality of these systems and the peta-bytes of data to go with it.

The company has given us (DevOps) the directive to automate and improve upon the infrastructure, allowing us to find and use solutions regardless of the cost. If you had the ability to create the budget but little to no time to implement the automation, how would you go about it? Would you hire consulting to setup the basic infrastructure or hire a lower level guy to take the "mundane" tasks away to give yourself time to implement?

https://redd.it/dzlqxk
@r_devops

GitLab-ci alternative on github

I am planing to move project I have on GitLab where I have CI configured with agent installed on one of my workers to GitHub. According to https://github.com/marketplace/category/continuous-integration there are number of integration with various with CI tools, could anyone give me a hint what is the easiest method to do so?

https://redd.it/dzmcz1
@r_devops