Resources/practice for learning OS concepts?

I found out about [roadmap.sh/devops](https://roadmap.sh/devops), and I'm curious about the OS concept section. How much would we have to get into the various concepts? I'd imagine that I could get a handle through some Wikipedia reading and Google, but I'm curious if there's a way to put them into practice from being at this early point in the roadmap. Would the practice come as I get more advanced, and the reading be enough at this point, or not?

Your responses would be greatly appreciated; thanks.

https://redd.it/e14lmp
@r_devops

How I manage my blog

Hello everyone, I just wrote a post about how I've deployed it and use Github Actions to publish new stuff. It's nothing sophisticated but I wanted to share it, in case anyone will ever find it useful :)

Here is the link: [https://samirettali.com/posts/hosting/](https://samirettali.com/posts/hosting/)

https://redd.it/e14ygg
@r_devops

LogStash and AWS ElasticSearch connectivity issue

AWS ElasticSearch endpoint don't have 9200 port. But When I start Logstash , it is adding 9200 in the ES host end point.

This is causing connectivity failure.

Please see the screenshot Link.

How do I fix the issue?

https://i.imgur.com/w07X0HN.png

https://redd.it/e1cf9i
@r_devops

Avoiding users manually connecting/linking individual services you provide to an SSO/Identity provider?

Like how creating an account with Google gives you implicit access to all their existing services, but in this case, you host some third-party(ones you don't develop in-house) services such as a wiki or forum software, but keep that same seamless login experience?

Provided the third-party service supports external auth(eg OpenID Connect, Google/Facebook or self-hosted provider like Keycloak), can you have your own centralized auth.mydomain.com, and not have a new user visit each hosted service being prompted to select/consent an SSO provider?

I understand that once each service has been connected to an SSO provider for the user, they would from then on have the seamless SSO experience, but it'd be nice to take away that initial sign-up friction/fatigue experience so that it appears to be a first-party cohesive experience through all the services available to the user.

I'm having difficulty with what the terminology for this flow is, or if it's actually possible for services that offer generic OIDC or LDAP support. Grafana has this [Auth Proxy](https://grafana.com/docs/auth/auth-proxy/), but this kind of thing seems uncommon, and the term "Auth Proxy" can [mean different things](https://github.com/discourse/discourse-auth-proxy).

https://redd.it/e1dsyn
@r_devops

running logstash as service

I run logstash this way :
>/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/logstash.conf --debug

But If I run as a service like this :
>initctl start logstash

do I still need to pass config file path here or config file path will be picked up by service automatically ?

https://redd.it/e1fzu7
@r_devops

Code Management

Let me preface this by saying i'm not a developer, and never have been or will be, sure i script but nothing more complex than that.

Issue i have with our setup at work, is the development team use local disk to store code, and only checkin code when it's complete and ready to deploy. Personally i thought you checkin at regular intervals, then trigger a build when you're ready to deploy but admit i don't get the whole pipeline thing of code deployment.

Can anyone advise if i'm way off beam expecting regular checkins to a TFS or similar code management server?, seems that way if you lose a piece of hardware via clumsyness or hardware failure, you don't lose all your work, or is this the wrong way to look at this?

Problem is we in infrastructure are having to figure out a way to make sure they don't lose code if there is a hardware failure, and it also hampers our desire to move to VDI type solutions for developers as they would be non or semi persistent desktops only.

Not wanting to bash the dev team, just can't understand why a checkin triggers a build, can you not use tags or something similar to checkin partially completed code?

TIA

https://redd.it/e1goyi
@r_devops

Let a 1,000 flowers bloom. Then rip 999 of them out by the roots.

Thought this article (from 2015) about engineering effectiveness and scale was worth reading: [https://www.gigamonkeys.com/flowers/](https://www.gigamonkeys.com/flowers/)

In particular I liked the equations for thinking about this problem, even if the author acknowledges he's just spitballing for the key values.

https://redd.it/e1ifo9
@r_devops

Full Infrastructure as Code with Terraform, Ansible and Docker Swarm

It's been 2 years that my team use Docker Swarm in production and for development. Throughout these years, I used Ansible and bash scripts to automate development environment creation and production provisioning and deployment.
I am really sad about the recent Docker news which is a synonym of death for Swarm :( I think it's a really good choice for small deployments and thanks to its shallow learning curve, I think it's a better candidate to spread the DevOps mindset in a team.

Anyway, I wanted to open-source our setup because it's a good DevOps and Infrastructure as Code example, and I hope it will be useful or inspiring for some teams.

[https://github.com/Thomvaill/tads-boilerplate](https://github.com/Thomvaill/tads-boilerplate)

It's my first open-source project, so your feedback will be really appreciated!!

https://redd.it/e1frg5
@r_devops

Project Layout: Import existing AWS infra into terraform project.

This is one of those questions that i'm sure will bring some highly different, for good reasons, thorough, though not incorrect responses and that is what I'm looking for.

I have an existing AWS account with a production, staging, and demo VPCs. I had built all of these servers in scala using the aws-jdk, now i'd like to move to terraform. There are only about 40 ec2 instances across all vpcs. My question is how do you prefer to layout a project like this. There are actually two more vpc's for failover but trying to keep this question simple. I used [terraforming](https://github.com/dtan4/terraforming) to export all aws resources. I was thinking about this sort of structure ([https://aws.amazon.com/blogs/apn/terraform-beyond-the-basics-with-aws/](https://aws.amazon.com/blogs/apn/terraform-beyond-the-basics-with-aws/)) but with vpc based data at a level higher.

I've read quite a bit about terraform, see its elegance, tested a few simple build outs, but migration i would like to get this right the first (or 4th) time. If anyone has any good reading that you may like and/or an ideal/preferred structure, to get me rolling, i would greatly appreciate it.

The software/network installs are all managed via saltstack. With native apps running and some in docker, but don't think that should matter for this.

Thanks in advance!

https://redd.it/e1nr6a
@r_devops

Shall I create elastic search index with timestamp ?

How do you specify elasticsearch index name ?

I am adding timestamp in index name in logstash.conf . Is this correct index naming convention ?

output {
hosts => [https://localhost:9200]
index => "application-logs-%{+YYYY.MM.dd}"
}

I am adding {+YYYY.MM.dd} in index name.

Is it correct way of writing index name ?

https://redd.it/e1kcal
@r_devops

How does nginx authentication work?

I have Nginx + Kerberos authentication working well. When a user hits the endpoint I can determine remote\_user

proxy\_set\_header REMOTE\_USER $remote\_user;

​

But, I am not sure how to setup authentication in my app.

​

Say, I have allowed users as ("Bob","Tom","Bryan"). How can I check in nginx if $remote\_user is in that set?

Is that how it works?

https://redd.it/e1r0r1
@r_devops

The Why-What-How of AWS EC2 Instance Metadata Service update adding defence in depth

About the recently released update to IMDS and how to enable it - [https://blog.appsecco.com/getting-started-with-version-2-of-aws-ec2-instance-metadata-service-imdsv2-2ad03a1f3650](https://blog.appsecco.com/getting-started-with-version-2-of-aws-ec2-instance-metadata-service-imdsv2-2ad03a1f3650)

https://redd.it/e1rx8t
@r_devops

Additional Classes running automatically in Git PR

Hello ! When I made a Pull Request in Git , some of Additional classes are running automatically which are not part of commit - And Pull Request is getting failed

https://redd.it/e1swzl
@r_devops

Docker Swarm vs. k8s-SingleHost Implementations - is this something worthwile?

Since docker swarm seems to be getting smaller/on the down/used less, i wanted to know, what you think as single host replacement is worthy for production.
Is minikube or microk8s or k3s a viable alternative if i have only ONE host and want to manage that instead of docker swarm?

https://redd.it/e1v8jr
@r_devops

Storage options for a kubernetes home server
https://www.reddit.com/r/homelab/comments/e1pi8h/storage_options_for_a_kubernetes_home_server/

https://redd.it/e1uud7
@r_devops

Managing Resources of multiple team on aws via Terraform

Hey Guys,

Wanted to know if anyone has implemented a gitops like workflow for terraform with aws provider.

What I want to achieve is:

1. Each team has access to a single gitrepo which has common modules and
then team specific folders with team specific modules.
2. Person from team A is supposed to make changes only to his project specific folder and
then create a PR
3. Jenkins will run terraform plan check for error and mark the PR successful.
4. Finally sumone needs to approve the merge request and jenkins will run terraform apply
and create resources on aws.

Not able to figure out how to go abt the hierarchy within the gitrepo.

PS: using opensource version of terraform and jenkins.

https://redd.it/e1yncs
@r_devops

UDemy Recommendations that are on sale/

Any recommendations for UDemy courses that are on sale now?

https://redd.it/e1n5zi
@r_devops

Best practices for sharing helm value files

Hi all,

Let me start by saying that I am probably missing something obvious.

I've been playing with helm for 9 months or so and I've built out a helm chart for my companies application. What I am struggling with is enabling the team to collaborate on making changes to deployments for updating image versions and such. We deploy this chart to many environments. Many per cluster, and on multiple clusters. Where I struggle is that we have secrets in the value files and commiting secrets into Git repo's is a no no. I've considered putting the original value files in something like vault, or maybe in a secret in the namespace of the deployment. I've even looked into encrypting and then commiting to Git, but it feels overly complicated. What are other teams doing?

I'll be honest, I haven't done much testing of upgrades to understand the process better, partially just too busy and partially because I've been assuming I need the full original value file to avoid wiping out the original secrets that get deployed.

Thanks in advance for your feedback.

https://redd.it/e1l426
@r_devops

HPE SSD's just die after 32,768 hours of operation

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00092491en_us

https://redd.it/e20edo
@r_devops

What is the CI/CD tool at Tesla/SpaceX?

I vaguely remember that GitLab had Tesla listed as one of their customers a few months ago but it's not there anymore. In general I'd like to know what CI/CD tools are being used in a place where there are a lot of embedded devices/development.

https://redd.it/e20c9p
@r_devops