Container based SSH/VPN bastion backed by AWS IAM

A bastion comes in handy when one needs to have a presence inside the VPC for checking on internal-only services. While there are a number of solutions for this (IAM backed ssh) delivered as ec2 instances, we have a container-based infrastructure, so it didn't make sense to setup instances just to provide a bastion. I also don't like polling, and prefer the immediacy of denying access immediately after removing someone from the IAM group that controls access. Check it out and let me know what you think.

[https://github.com/cloudtruth/aws-bastion](https://github.com/cloudtruth/aws-bastion)

https://redd.it/dz2q2l
@r_devops

Gotta tell someone about my first real "devops" success

Today I had an epiphany, and haven't been able to work since.

I'll start by saying I have the freedom one does when working for a small company (<100). I'm new to DevOps - even now, its still just a bunch of tools that noone but I will use lol.

Today is also a good day because I pu the finishing touches on a CI pipeline, and connecting said pipe to my local Ansible-configured virtualbox environment. I'm going through working out the kinks in the aftermath of an Ansible deployment: Why won't Nginx let me connect from my laptop's web browser? Is this broken, or just slow? Do I REALLY have to go back an change the deployment scripts AGAIN?

The last one is when it hit, man. Our test/QA gals struggle with this one *constantly,* depending on the environment they're in. Every time the want to deploy, they have to mod the scripts half the time (thanks a lot, Bamboo). The epiphany was this:

`If devs used this CI pipeline, they would experience the same problems as test/QA`

Considering how the devs currently do things, I can't shake the feeling that this is a win. And there's more: My first problem is the exact same problem that's been on my plate for a week now! I can finally do my work now!!! This must be how the South Park gang felt after pwning the World of Warcraft guy.

Maybe for Christmas I'll get to tackle the second problem, the fun one! But hopefully, a dev will us our new CI and beat me to it.

:)

Thanks for letting me share!

https://redd.it/dz5gj9
@r_devops

Devops for Windows?

I accepted a DevOps position at a company which develops and hosts web applications for large companies. [ASP.NET](https://ASP.NET) , staunchly Windows shop, use of Linux for any purpose is mind-numbingly forbidden.

Powershell is becoming my best friend, but finding myself kneecapped by the inability to spin up a Linux server. Open source products, password management solutions, telemetry software, monitoring software, reporting software, automation platforms, all must be natively hosted on Windows. Naturally this eliminates about 80% of the tools available to do my job, **especially** the ones that won't cost 5-6 figures and a several month acquisition process. Anyone in a similar situation, have devops tools they use for Windows web shops, tips to handle?

https://redd.it/dz56ys
@r_devops

Help me understand Helm and Kubernetes Secrets

I'm going to be using Helm 3 (finally out) and Kuberentes Secrets. My plan was to have stuff like my DB connection string in Kubetnetes secrets then in my helm charts tell it which secret to use. I'm not sure this is the right or even supported way. I could not find much for resources on how I'd use helm with Kuberentes secrets.

&#x200B;

Can someone explain to me how this would work and how I could do it or maybe point me to a resource that explains it?

&#x200B;

EDIT\*\*

The idea is I accept ENV variables into my applications fro config, this needs to stay the same I just need to figure out how to do it with helmand Kubernetes secrets.

https://redd.it/dz8y3x
@r_devops

Installed Spinnaker with Helm now can't get ECR to work

I installed Spinnaker onto a kubernetes cluster created with kops (with ECR policy included). Now I use the below command to connect to where the halyard is installed, issue is I need to install the aws cli but it won't let me...

kubectl -n default exec -it spinnaker-spinnaker-halyard-0 bash

The only post I could find online about this issue was

[https://stackoverflow.com/questions/54804772/spinnaker-with-halyard-from-helm-chart-has-missing-aws-cli](https://stackoverflow.com/questions/54804772/spinnaker-with-halyard-from-helm-chart-has-missing-aws-cli)

It says a solution is pretty much it's not needed however I am then confused as to why my registry isn't showing up and I'm getting the below error/warning message. I know it says it was successful however it goesn't show up anywhere and if there was no password it won't work right?

spinnaker@spinnaker-spinnaker-halyard-0:/workdir$ hal config provider docker-registry account add my-ecr-registry --address $ADDRESS --username AWS --password-command "aws --region $REGION ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken' | base64 -d | sed 'hal config provider docker-registry account deletes/^AWS://'"
+ Get current deployment
Success
+ Add the my-ecr-registry account
Success
Problems in default.provider.dockerRegistry.my-ecr-registry:
- WARNING Password command returned non 0 return code,
stderr/stdout was:bash: aws: command not found
sed: -e expression #1, char 2: extra characters after command


- WARNING Resolved Password was empty, missing dependencies for
running password command?

- WARNING You have a supplied a username but no password.

- WARNING Your docker registry has no repositories specified, and
the registry's catalog is empty. Spinnaker will not be able to deploy any images
until some are pushed to this registry.
? Manually specify some repositories for this docker registry to
index.

Problems in halconfig:
- WARNING There is a newer version of Halyard available (1.28.0),
please update when possible
? Run 'sudo apt-get update && sudo apt-get install
spinnaker-halyard -y' to upgrade

+ Successfully added account my-ecr-registry for provider
dockerRegistry.

https://redd.it/dzbgpt
@r_devops

I bought c5.xlarge reserved instances but my reservation coverage report in cost explorer seems to map them to c5.large

My company has some c5.large and c5.xlarge instances. We bought c5.xlarge reserved instances expecting them to cover our c5.xlarge on demand instances.

What happened instead though is according to the reservation coverage report in cost explorer, all of our c5.large instances are now covered by these c5.xlarge reserved instances, and only 2 of our c5.xlarge instances are covered.

It seems as though for some reason that, although we bought xlarge, amazon gave priority to our large instances for coverage. This doesn't seem right or fair to me.

All of our instances are in US-East, so it's not a region problem.

https://redd.it/dz6lxt
@r_devops

Docker best practice when deploying php app?

Hi, this is my first post, and I wanted to hear opinions how do you deploy PHP or JS applications within Docker? Our dev teams mainly use Simphony for back end , and JS based frameworks for frontend, so would multi-stage build be good approach.
For example, app gets compiled in first step, then \`COPY\`-ed into the actual production image which is slimmed, and shipped with only binaries required to run app (compiling stuff is 'left' at first step).


2nd approach I am thinking of is using CI for building app, then deployed as docker container?

Or, there are some more preferable options?

https://redd.it/dyyzp8
@r_devops

bpf filter

Was wondering if it possible to do until in BPF ([https://en.wikipedia.org/wiki/Berkeley\_Packet\_Filter](https://en.wikipedia.org/wiki/Berkeley_Packet_Filter)). Say I have a message that begins with ASCII "ABC" and ends with "XYZ" but it spans multiple packets. I couldn't figure out with BPF if I can follow or do until.

https://redd.it/dz0wzu
@r_devops

Fugue Developer is now free - cloud security and visualization for engineers

I'm a co-founder of Fugue, and today we announced Fugue Developer, a free forever tier for individual engineers to build and maintain secure cloud infrastructure in highly dynamic and regulated cloud environments. It provides tools to visualize cloud infrastructure environments, detect resource misconfiguration and policy violations, report on compliance, and understand infrastructure change. Fugue supports AWS and Azure.

[https://www.fugue.co/blog/fugue-developer-free-cloud-security-and-visualization-for-engineers](https://www.fugue.co/blog/fugue-developer-free-cloud-security-and-visualization-for-engineers)

https://redd.it/dzj632
@r_devops

Will continuous security actually save time?

[https://www.portshift.io/you-need-to-shift-left-for-app-security/](https://www.portshift.io/you-need-to-shift-left-for-app-security/)
Came across this recently. It's an interesting read and I'm considering switching but before I commit I'm wondering if anyone has implemented this software & if it saved time? I'm looking to switch because my current software has been having glitches & I don't want to make the same mistake again.

https://redd.it/dz0q0n
@r_devops

Deploying a Web App to Run Locally on Client Machines

Hi everyone,

I am currently building a Web App with a Django backend and a Vue.js frontend, which is planned to be deployed locally to the machines of my clients.

My question is the following: how do I deploy this to another persons computer in the least complicated way possible for them? Is there an easy way to achieve this that does not require substantial technical know-how on the users side to get the app up and running? I have considered deploying the app as a docker image, as this would ensure that the client would not suffer from dependency issues and offer a relatively smooth way to deploy, but in my case it isn't ideal since my end users are not going to be technically-minded. Furthermore, I am wary of the security and IP issues that deploying the application via the Docker route may entail (since anyone would have root access to the container, and therefore my source code).

I also understand that there are GUI frameworks I could use in this situation, such as Electron for JavaScript or any of the many Python libraries, but neither of these fits my requirements fully, since I would prefer to write Python on the back-end of the application (taking Electron out of the running) and I am not impressed by the aesthetic quality of what I have seen from Python GUI frameworks (taking Tkinter etc. out of the running).

As such, I would like to explore whether or not there is a simple way of starting my Web App locally on my clients machine in a way that would involve as little hassle as possible. I could personally do the implementation on-site, and smooth out any initial issues that may arise, but the approach should ideally be robust to extended usage and straightforward for individuals without extensive technical knowledge.

Thanks in advance!

https://redd.it/dz0ke2
@r_devops

How do you integrate DevOps best practices with no time?

Within the past year, I was hired on as a cloud engineer by a small company who is 100% in the cloud using some pretty exciting AWS/GCP services. I quickly came to realize that they're 100% cloud running legacy IaaS applications... Though they are actively working to decouple these monolith applications its really taken up all of my time supporting and just simply maintaining basic functionality of these systems and the peta-bytes of data to go with it.

The company has given us (DevOps) the directive to automate and improve upon the infrastructure, allowing us to find and use solutions regardless of the cost. If you had the ability to create the budget but little to no time to implement the automation, how would you go about it? Would you hire consulting to setup the basic infrastructure or hire a lower level guy to take the "mundane" tasks away to give yourself time to implement?

https://redd.it/dzlqxk
@r_devops

GitLab-ci alternative on github

I am planing to move project I have on GitLab where I have CI configured with agent installed on one of my workers to GitHub. According to https://github.com/marketplace/category/continuous-integration there are number of integration with various with CI tools, could anyone give me a hint what is the easiest method to do so?

https://redd.it/dzmcz1
@r_devops

Custom Autoscaling in Kubernetes
https://www.reddit.com/r/kubernetes/comments/dzmswt/custom_autoscaling_in_kubernetes/

https://redd.it/dzohj7
@r_devops

Hashicorp Vault Policy Management

Hey all,

Quick background, my team is currently working on getting Vault up and running so that it can be used by the other teams where I work. There are going to be dozens of different teams and different applications that will be requiring access to Vault and each having its own use case.

Based off the research I have already done, ideally the policies would be tested through a jenkins pipeline before being applied to a cluster and there would need to be some form of approval process around these policies to insure that teams don't use things don't need. Using namespaces is going to be huge because of keeping everything separate from each other.

So, my question is, does anyone have any recommendations for best practices to follow when managing the inevitable mountain of policies that are going to be necessary for running this? Also, are there any lessons that you learned when you started using Vault? Or any thing else that you think would be useful.

Thank you.

https://redd.it/dzkggz
@r_devops

Container orchestration for single host production setups

I mostly deal with single host deployments, because high availability isn't a requirement, but I find the advantages that containers and orchestration tools provide pretty useful for developing and deploying applications. At the moment I'm using Docker Swarm mode to manage the handful of containers on each host, and this works fine. The main reason I'm using Swarm with a single host is the ability to run multiple replicas of my app containers so I can deploy updates with healthchecks and without downtime. I'm of course aware of Kubernetes, but find it far too complex and overkill for a single node setup. I'm still considering using k8s or k3s with Rancher, but since it's highly discouraged for production, I'm kind of wary.

Since Docker, the company, is going through all these changes and the future of Swarm is bleak, I was wondering if there are any other container orchestration solutions which have the following features:

* Simple configuration and setup like Docker Compose/Swarm
* Production-ready on single hosts
* Has some type of bridge networking to connect services easily
* Rolling updates without downtime
* Can rollback containers if needed
* Is actively developed and isn't about to be deprecated

https://redd.it/dzh94w
@r_devops

Support Guy - Zero programming

Hello everyone,

I'm trying very hard to learn programming as I'm getting insults in my workplace. My juniors are good in programming and they talk technically on programs and stuff .I'm stuck there . I work 10 to 12 hours on office mundane work , assign tasks , follow up and report to leader ship etc.. I'm not that great leader too . In the process of leading a team with 8 years support experience.

I feel very bad for my career decisions. I would like to somehow learn python programming alone to the expert level from zero .

After coming from office , I will have to attend calls from onsite folks and update the updates as well and my energy goes down .

Apart from programming, what is the best roadmap for hot skills in the market,

1.Cloud Aws
2.Cloud GCP
3.Devops
4.Docker
5.Kubernets .

Can someone please take a time to respond.. thanks all.

https://redd.it/dzgt2d
@r_devops

Untrusted CI: Using Nix to get automatic trusted caching of untrusted builds

Learn how Nix's new post-build hooks feature can automatically sign and upload artifacts to a binary cache in a trusted way.

[https://www.tweag.io/posts/2019-11-21-untrusted-ci.html](https://www.tweag.io/posts/2019-11-21-untrusted-ci.html)

https://redd.it/dzsg57
@r_devops

Blog post: Deploying your First Container with Docker for Windows

Hey guys, Devin Rich just wrote a shiny new blog post you may enjoy on the ATA blog. It's targeted to beginners to Docker that want to get started on Windows.

He worked hard on this one (and I edited it). I think it turned out great because it covers all of the absolute basics someone may need to get started learning Docker on Windows.

I'm curious, for all of you Docker pros, what are some of the most common gotchas you ran into when starting out with Docker? I'd love to make this post better.

https://adamtheautomator.com/docker-for-windows/?utm_source=redditdocker&utm_medium=social&utm_campaign=newblogpostnotifications

https://redd.it/dzr7b5
@r_devops

CI/CD solutions for Kubernetes

I have a Jenkins server that does what I need for various jobs and what not, it produces some docker images as one of the many types of jobs it does. I wanted to have Spinnaker be the CD portion of my CI/CD but I can not for the life of me get it to work at all. Mix between Kops, github for helm charts, and ECR being royal pains which have been a show stopper so far.

&#x200B;

What other options are good for working with Kubernetes that are not Spinnaker and work well with Jenkins (on an EC2 instance)?

https://redd.it/dzs0p8
@r_devops