DevOps trying to learn gotchas for running an express.js application
https://www.reddit.com/r/webdev/comments/e2n1xv/devops_trying_to_learn_gotchas_for_running_an/

https://redd.it/e2n21y
@r_devops

Storing pipeline data

TLDR need somewhere to store pipeline inputs and outputs.

I've been asked to capture metrics so we can trace improvements in efficiencies of our devs. Something to the effect of number of pipeline builds to get to release, commit frequency, hotfixes required after releases. While a chunk of it is available via APIs I would like to record it as the pipeline is run as much of the data will be there. Where would a good place to store this? I was hoping to put it in jira but it's not overly friendly for complex data (or at least json). The data must be queryable. I was thinking maybe yaml in jira issue comments ? Basically I want to avoid running up a db. We use jenkins, it doesn't seem to have a good store for this data (For querying later on). Any thoughts or suggestions? Thanks in advance.

https://redd.it/e2n01o
@r_devops

Azure DevOps Release Pipeline Error (App Services)

Hi all - I have a DevOps Release pipeline to deploy a solution. The solution contains:

\- .Net Core API app service

\- .Net Framework web app service

\- 2 .Net Core Azure Function apps

​

The release pipeline does this:

\- Stops the various app services via four 'Azure App Service Manage / Stop App Service' tasks.

\- Deploy the code to the various app services using four 'Azure App Service Deploy' tasks.

\- Starts the various app services via four 'Azure App Service Manage / Start App Service' tasks.

​

I have two environments right now: Dev and QA, each with their own set of app services.

Over the last couple of weeks, I've been getting an intermittent error across these tasks; it doesn't always happen at the same task.

The error is:

Error: FailedToGetResourceID Microsoft.Web/Sites <app service name> getaddrinfo ENOTFOUND management.azure.com [management.azure.com:443](https://management.azure.com:443)

Today, though, it happens almost ever time I try to deploy to either environment. Does anyone have any idea what this might be, and how I can resolve it?

&#x200B;

Thanks in advance.

https://redd.it/e2r5zx
@r_devops

Shutting Spinnaker down at night?

I'm looking to set a spinnaker VM up on EC2 and am wondering if it is possible to shut it down at night without any issues? Know some software has issues with VM restarts and didn't know if spinnaker is one

https://redd.it/e2qeii
@r_devops

Demo project for k8s configuration

GoogleCloud hipster shop demo is pretty good for microservices, but is poor when it comes to kubernetes configuration variaty. Any other demo projects available that focuses on k8s configuration?

https://redd.it/e1ugc0
@r_devops

Git showing more files as changed/Modified than I have touched

In Git - In my new branch - Git shows more files as changed/modified than i have made , because of this extra files my Pull Request is getting failed

https://redd.it/e1u67c
@r_devops

What's new in Istio 1.4?

[Read the full blog](https://www.stackrox.com/post/2019/11/whats-new-in-istio-1.4/?utm_source=reddit&utm_medium=social&utm_campaign=istio-1.4)

tl;dr

* Continued work on performance improvements with alpha support for Mixer-less telemetry
* A complete update to service authorization system with the new AuthorizationPolicy
* Support for Istio installation, control plane configuration, and upgrades in the istioctl
command
* More troubleshooting support in istioctl
* Proxy sidecar stability and feature improvements

https://redd.it/e1jarc
@r_devops

management of installed software, it's versions, and available (security) updates

I am looking for a general term / solution to get an overview of an IT landscape not limited to servers, but everything that might be installed somewhere. it's available versions, updates, (classification if security yes/no), end of support / life for that software and probably lots more info on that software. Usually you'd be able to get this by looking at the local package manager, but if managing clients with all sorts of OS there's not one package manager but multiple. same goes for the extend to software packages within a development cycle (some node.js library that has been installed, some php dependency etc.)

I wonder if there's a tool to that I can browse for a term like "apache 2.2" -> see it's marked for old version / reached EOL. or query for "apache 2.4" see everyting still fine. some software packages might come with a LTS version, so a targeted EOL being sometime in x years (usually OS systems have that).

What would be a good starting point, other than a custom spreadsheet, wikipedia, release notes of said software on their respecting websites and access to CVE database plus lots of manual work to put the info together?

edit1: someone put this together: [https://www.upcomingeol.com/](https://www.upcomingeol.com/) which can be treated as one data source

edit2: found [https://endoflife.software/](https://endoflife.software/)

https://redd.it/e1i1m0
@r_devops

Want to use google spread sheet to initialize my jenkins groovy script variable

hey, i am using java to access google spread sheet i am not able how can i use my java program in groovy Please help me out i am new to this

https://redd.it/e1e460
@r_devops

Advice for outsourcing devops work

Hi,

I work for a place that has a small dev team, about 12 devs. We have about 6 c#/angularjs/MySQL web projects we deploy. We use TFS and azure.

I have decent coding skills but I’m ready new and entry level when it comes to devops so I was hoping maybe someone could help with questions I had.

We are trying to outsource a few dev ops projects.

The first project is the automation of spinning up staging environments in azure right from specific git branches of our choosing.

It gets a little more complex because we have 1 visual studio solution that contains about 30 projects, of those 30 projects we have about 6 that are unique public/private facing systems we deploy so we would also like to choose which of those six we want to spin up staging env for.

It’s be awesome if our env could have custom sub domains for the sites too.

Another complexity is our DB is quite large and takes time to restore from the MySQL dump file, so optimizing this for the staging spin up would be necessary.

The reason we are trying to achieve this is because we want to make it easier for our testers to deploy environments they can build and run automated or manual tests, etc.

Anyways...

For our project, I’m having a really hard time figuring out what a realistic timeframe it would take to implement. I know there are tons of finer details needed, but what would you rough range estimate it would take to complete a project like the one I describe?

Also, does anyone have any sites they recommend to find contract devops guys?

https://redd.it/e1awup
@r_devops

The ConfigMap Pattern

[Config Maps](https://www.magalix.com/blog/the-configmap-pattern) and Secrets are storages to manage key-value pairs. Secrets are similar to [ConfigMaps](https://www.magalix.com/blog/the-configmap-pattern) but with the additional benefits of actual data encoding.

Here is This Week Article The ConfigMap Pattern.

your feedbacks are welcomed.

[https://www.magalix.com/blog/the-configmap-pattern](https://www.magalix.com/blog/the-configmap-pattern)

https://redd.it/e1fmpc
@r_devops

Setting up Gitlab CI runners on OpenStack

Hi there,

Question on some best practices: I need to set up some Gitlab CI runners for various projects in our org. Most runners need Docker, but I also need some for VMs (Virtualbox). Some require GPU, most won't.

So far I've set up one bare metal box that has GPUs with multiple runners using an Ansible script. I'd like to scale that up. We have a private OpenStack cloud I can use that includes flavors with GPUs. Some of our runners are a bit more needy with their hard drive space usage, so I probably need some simple flavors for most runners, some GPU flavors for the GPU runners, and some more complex runners with additional block storage for the HD-intensive runners (or just use more of them? Ideas?)

I was thinking about using Terraform and Ansible for this task. I think I can setup most of the runners as group runners, so I'll only need to account for a few different project registration tokens, but how do you guys keep that flexible? What if some other project needs a specific runner?

Any other pointers or ideas? Anything I'm missing? (Wouldn't surprise me).

Thanks!

Christoph

https://redd.it/e1b6n6
@r_devops

Best way or ways to give access to internal applications to employees?

I'm relatively new to setting up enterprise systems.

&#x200B;

Right now we have a kubernetes cluster created using kops, on top of it we have deployed some public production applications accessed through ELB and at the same time we have some internal applications for monitoring (Prometheus, Grafana...), in order to access these internal applications, I've set up an ingress to these services and can be access using a public domain (and of course you need a username and password to access).

&#x200B;

So far so good, the problem is, I don't like this approach of exposing services publicly accessible through a public domain for security reasons, I looked up for some approaches on how an enterprise usually secures their applications and came up with few approaches.

&#x200B;

\- Enable bastion box option using kops, give access to the employees to this box, teach them how to use ssh with port forwarding options and at the same time use kubectl in order to forward these services back to their local machines and access the software from there, the problem is, it's very complex, and I'll have to teach some employees how to use such tools which is time-consuming, plus I'm not always available so if they're stuck, they'll have to wait, plus I'll have to figure out how to connect this bastion box to an external authentication system we have, so I won't have to manually add and remove public keys. (plus I'm not sure if kops will configure a new VPC for bastion or not)

&#x200B;

\- Setup OpenVPN pod inside kubernetes, expose it through ingress, let other employees connect to it, and access applications using k8s services names, which means that the VPN network will be between the pods only, the problem here is that, there's no easy way to configure external authentication to OpenVPN in a pod, plus the cluster is still public, and if someone finds a vulnerability on kubernetes or publicly exposed internal systems (like Grafana) we're screwed.

&#x200B;

\- Configure the VPC that contains kubernetes cluster private, create a public one, create an ec2 instance on it, connect the public VPC to the private VPC, install OpenVPN inside the public ec2 instance where employees connect to it, then use kubectl to port-forward applications and access them, I'm not sure if this is even a good idea because it still has some level of complexity.

&#x200B;

What I'm looking for is a way where employees can access private internal applications, with as little headache as possible, I know that VPN is usually the go-to option here, but since we're using kubernetes for almost everything, this becomes a lot more complicated.

&#x200B;

I've heard about "zero trust", I tried to look this up and got confused, it's like ditch the VPN, make everything public, but add a proxy/gate to everything and verify every single request, and setup roles properly.

&#x200B;

To be completely honest I am lost over here, I not sure where to look anymore.

&#x200B;

Should I invest more time understanding zero trust? Should I just go the bastion box route and teach everyone how to use some tools like ssh and kubectl?

&#x200B;

What do you think is the best approach for such environment?

https://redd.it/e13w3m
@r_devops

To all those supporting e-commerce this week..

I wish you all good luck. May the scaling and load balancers be every in your favor.

https://redd.it/e30t3b
@r_devops

2019 DevOps Black Friday Deals

I was looking for a topic similar to [last year's](https://www.reddit.com/r/devops/comments/9zn95z/2018_devops_black_friday_deals/), but could't find any. Some of those deals might show up again; if you have anything of interest that is confirmed, feel free to post in the comments.

I'll start with:

[Bitdefender](https://www.bitdefender.com/media/html/consumer/new/Black-Friday-2019-opt), 60% off

[Linux Academy](https://linuxacademy.com), 299USD from 499USD

https://redd.it/e34dx3
@r_devops

Salary Range for DevOps in Austin?

Looking to switch from IT to DevOps in Austin, TX. What salary should be expected for a DevOps engineer with 0-2 years experience?

https://redd.it/e33ls9
@r_devops

Deploying an ECS service/task inside a natted subnet

I have an application which is running on EC2 instances right now inside a subnet which is attached to a nat gateway. I'd like to replace the EC2 instances with an ECS cluster/service. What gotchas am I likely to run into? Is there anything specific that I should be doing to make things easier or more secure?

https://redd.it/e32r9f
@r_devops

I think ill be resigning.. but.. i also dont want to.. (also request for resignation letter examples)
https://www.reddit.com/r/sysadmin/comments/e3cjag/i_think_ill_be_resigning_but_i_also_dont_want_to/

https://redd.it/e3d28s
@r_devops

Best Practices For Deployment on Test and Prod Environments.

So Im part of a startup (i am new to dev ops) and we are now trying to figure out the best practices for how we can deploy a CI/CD pipeline for both our test and prod envs. Test prod will be triggered automatically but Prod needs manual trigger.

Anyway, we have a local server which we have a docker swarm running with DAGs(this is used for our Prod Env). We push to bitbucket which triggers a Docker build job and publishes the Docker Image to aws ECR. Now, we have to always manually pull the image on our server then run the env, is there any way to automate this?

second thing, what is the best way to have a Test and Prod Env on the same machine. (we cannot shift to cloud due to security issues with data). Basically what I picture is having 2 docker swarms (1 test, 1 prod) that run side by side (each with their own set of containers). When we push to bitbucket, it runs the pipeline and creates a docker image on ECR which gets automatically pulled and run on our Test docker swarm. When we are happy, we manually trigger another pipeline to pull to our Production Docker Swarm.

Any other way, What do you guys think?

https://redd.it/e3d3ia
@r_devops

Oauth2 with spinnaker

Hi guys,

I'm trying to install spinnaker and i got it to run but I just cant work this oauth2 thing.

Somehow when the browser sends a OPTIONS http request to the gate (spinnaker) at /auth endpoint, it returns a 302 response.


Apparently this is an illegal behaviour and hence everything stops. Can anyone offer advice on how I can approach this?

https://redd.it/e3cnyt
@r_devops