DevSecOps: From Theory to Practice

DevSecOps is a strategy that extends DevOps efficiencies to software security.

But when you sit down and actually start implementing DevSecOps, things can get trickier. There is no switch that you can flip to achieve DevSecOps. Nor is there a specific tool you can acquire, or even a particular process to follow.

Instead, implementing DevSecOps requires you to perform a broad evaluation of your existing IT resources and DevOps processes, then build a holistic strategy that integrates stronger security into all of them.

[Full Article](https://resources.whitesourcesoftware.com/blog-whitesource/devsecops)

https://redd.it/e7tk4o
@r_devops

How to do centralized logging and DevOps that scales

Hi there.

At my company we are buying an elasticsearch cluster service which is surrounded by a Kafka-queue, i.e. you're only able to deliver log events to the queue and not directly to elasticsearch.

We are using Filebeats to collect logs from our applications on virtual servers and OpenShift. These filebeats then ship log events to a central Logstash instance which parses the events and ships them to the Kafka queue.

However, the logs collected from each application (or team) of course need different parsing in Logstash - this parsing should be configured by the team who owns the application. This means that many teams are contributing to the Logstash configuration, which I think is not ideal: Logstash is now a single point of failure in the way that one team can screw up things for the rest. At the same time, I want to set the developers free and let them handle their configurations themselves.

My thoughts right now are, that the teams should have their own dedicated Logstash instance.

How have you guys handled log collection from numerous different applications?

https://redd.it/e5xw7r
@r_devops

Capital One DevOps Glider Computer Screening

Hey Everyone, did anybody give CapitalOne Screening test on the Computer? If so what was your experience?

https://redd.it/e5mhde
@r_devops

I, too, want to teach someone DevOps principles and tools

Inspired by the wonderful /u/very_veritas, I too want to offer DevOps teaching in very much a similar style.

I'll follow his idea as far as **format**:

* general questions and answers will be open nearly full time. How quickly I'm able to respond depends on my situation. Others are of course welcome to chime in.
* I intend to run a biweekly workshop. Weekly would be nice, but I can't handle the workload. Topic to be decided by the community. I'll either hold it myself, or find someone who can do it in my stead.
* I also intend to have 2 hours of office hours every week, for those who would like more immediate conversation with me. This will be via Zoom
* I'll run a weekly video roundtable. I'll be present, but as a moderator. This roundtable is for conversation among yourselves, to foster community and reinforce learning together.
* I'll watch over this community strictly. I want it to be a positive, welcoming place for learning. There will be no tolerance for talking down to others, or any kind of asshattery. I I've gone through the training of having two toddlers -- believe me, you have nothing on them.

​**What's in it for you**, dear reader:

* access to a community
* accountability -- your friends will help you stay on track
* learning from experts -- but you get to have a say in the curriculum

**What's in it for me**:

Reasonable question. So here's the full disclosure.

* I'm a professional DevOps trainer/coach/consultant. Being exposed to your questions will help me serve my clients better
* I get to try new ideas and approaches
* honestly, I just like watching people grow -- I hope I get to watch a bunch of people grow a bunch! That would make me really happy
* no beating around the bush: If this initiative would lead to new contracts for me, that would be fabulous -- but that's not the goal here; it would just be a nice bonus

Same as with /u/very_veritas: this is not a training course or a bootcamp.

**Who is /u/InternetOfStuff ?**

* DevOps practitioner for about a decade (since before I knew the term)
* experienced trainer
* thanks to my trainings, lots of insight into what's happening in the (European) industry
* keenly aware of the cultural side of DevOps

**How do I get in?**

Reply to this post, and I'll reach out to you. We'll have a quick conversation to see if our goals and interests align, and if so, you'll be invited to a Slack.

https://redd.it/e5e5b7
@r_devops

IT Monitoring Market Research Resource

Hey guys,

After [posting](https://www.reddit.com/r/devops/comments/e6yu7h/how_to_group_it_monitoring_tools_by_market/) here about segmenting the market of IT monitoring tools, I put together a [Notion Page](https://www.notion.so/odyslamtzidis/IT-Monitoring-Domain-Expertise-Market-Research-bc7e351784a5401f8d4ae08436789db2?showMoveTo=true&saveParent=true) where I tried to aggregate and curate all the information I have found through research (Various Internet sources, Reddit)

Feel free to comment, give feedback and/or enrich it.

P.S It's the first time I have been using Reddit for real and I have fallen in love with the communities and it's potential as a platform. Thanks for everything :)

https://redd.it/e7vv8j
@r_devops

[Culture] Let's make some change!

We're currently going through an agile transformation and we spent the second half of this year looking at DevOps and what it means to our company and how we're going to prepare a roadmap for that journey within the overall transformation.

How many folks out there have worked on the culture part of DevOps and having to change their organization in that way? Would love to hear some stories.

https://redd.it/e7vhty
@r_devops

Proxmox best practices?

Hey all, I recently got a position as an Infrastructure Engineer at a hosting company and wanted to get some good jumping off points for getting up to speed ASAP.

I mostly have a Systems Administration background and am fairly experienced with linux.

The company is looking at automating their Proxmox clusters to deploy various webservers (mostly nginx and wordpress) and have version controlled configuration management. I know that we'll be using ansible and git for automating configuration but I'm not super familiar with automating deployments.

So far I've found that packer and terraform both support proxmox but I'm trying to find out best practices and plan for the future so that I'm not stuck changing to a completely different workflow after I get everything implemented.

Can anyone recommend a good blog or course I can go through to get up to speed with these? Other advice is also appreciated as well as recommending any other tools I should look into.

https://redd.it/e7y4g8
@r_devops

Using cheap/simple flash drives in RAID for local dev storage of K8s/Docker

Hey all. I am reminded of a video I saw a few years ago where a guy used a USB hub and multiple USB flash drives, windows software RAID, etc. Not that it makes a lot of sense to do this.. but I thought also to a video/article I found more recently where they used a few raspberry pis as K3s "nodes" and was curious if the combo of a few RaspPis + a cheap USB hub along with some cheap 64GB or so flash drives, would make for a neat little project where by you configure the main K3s (or K8s) to use the USB flash drives (in raid) as a storage pool of some sort. Then, you can fire up some microservices that have their own DBs, where the DB instances utilize this storage pool for their storage space.

Is this possible.. and would it be totally stupid to even try? I am not entirely sure if you set up a single "blob" of storage like this that is then shared/distributed to separate microservice DB instances or not.

https://redd.it/e7xljj
@r_devops

Is Prometheus useful if you're already using DataDog/Scalyr/Loggly?

Started playing with Prometheus recently and so far I have yet to find anything it does that I can't do with the third-party log/metrics service we're already using at my company.

Obviously Prometheus is free, and it's self-hosted. I understand its appeal in those areas. But if I'm at a company that's willing to pay for a hosted service and that doesn't mind shipping logs and metrics to that service, will Prometheus still add something valuable I should be aware of?

https://redd.it/e80ga1
@r_devops

Bachelor project. Need help choosing topic

Hey y'all. I need your help figuring out my bachelor project.
As a student of computer science, I am allowed to choose between writing a thesis or programming something.

I definitely want to program something. No doubt there. Yet, I don't know what to do.
My current interests in the world of Dev are the following: Devops, Data science/analytics, cybersecurity.
I would like to create something, that doesn't necessarily have to be used in the real world, but with which I could use to apply (increase my chances of being accepted) and put on my cv/portfolio.

So far I've had these ideas:
Create an AI that has an answer to everyday legal questions and other areas like brand,...

I'd really appreciate any input, thanks in advance.

https://redd.it/e5f1sd
@r_devops

Is anyone in their current situation of good fortune COMPLETELY on luck? What's your story?

Title says it all.

So you lucky SOBs, what opportunities fell completely in your lap through no doing of your own?

https://redd.it/e82yqs
@r_devops

CI / CD Novice Question

I'm trying to create CI/CD pipeline with Terraform. Currently, I'm able to integrate Terraform with BitBucket / Atlantis in a simple EC2 setup.

Is it possible to have a pipeline where:

1. Do staging (Beta, Prod) with specifications in each stage (like the way Terraform does)?
2. Developer will select if it's Spring Boot project or a node project; and the build system will take care of appropriate compiler/builder. This way, a developer can avoid tinkering with systems like Jenkins etc.

Kindly help me with what stacks are available (preferably free) to achieve this? I hope I'm not asking something too abstract/naive.

https://redd.it/e81g9a
@r_devops

Where should I go?

I work as a "web engineer" for a major player in restaurant and live entertainment worldwide, earning 52k a year before taxes. My boss is a great person I had a friendship with prior to being hired as a contractor.



I came into the job with experience in web design, html, css, familiarity with php and basic backend stuff like DNS records, cPanel, MySQL management, and copywriting. For the last 1.5 years I've been the go-to person for WordPress edits for our custom themes, while doing copywriting and writing SOP details for whatever is going on while sending out interior blogs to the higher ups. Kind of a jack of all trades and a master of none.



Lately my job has thrown me into doing more DevOps stuff since about July of this year, and I've really come to enjoy it, despite a few months ago being ready to throw in the towel. I've learned a great deal from my direct higher up, from things like setting up a CD/CI pipeline, AWS management, Git, Ruby, and a few other things I've come to love.



However, I don't know if this job will last. I'm learning at a steady pace but in the grand scheme of things, I'm totally useless to the business and they don't need me. And if it falls through, I don't feel like I have enough to bring to the table to get hired anywhere. Since there's already a DevOps guy, I'm wondering what direction I can take to stay relevant to the business and stay with them. The guy who hired me wants to keep me on, but his colleagues have expressed that they don't know what I provide as a resource so they don't know if I'm worth keeping on for 2020.



So I'm curious - should I move into a DevSecOps learning path, or just hold on as long as I can as a sponge and hope I can be the DevOps person somewhere else? The company had expressed they wanted me to be a front end engineer because I'm a bit of a creative artist, but I've fallen in love with DevOps stuff. If I follow DevSecOps, will I still be relevant to stay with this company?

https://redd.it/e81ang
@r_devops

Azure App Insights vs Sumo Logic

Hey reddit,

Can you please help me to decide (and to sell this decision to management) between those 2 products?

Previously I worked with AWS and really enjoyed sumo logic as a logging platform. Now a new gig is a Azure house, but for new application we can choose what we will use. Naturally, App Insights is a very strong candidate now...

​

What will be your preference and why?

https://redd.it/e824ka
@r_devops

what directory services do you use, and why?

AD? OpenLDAP? Okta? Nothing? Homemade database? NIS?

https://redd.it/e7ytfn
@r_devops

Issues with devops transition

I currently work as a Systems Administrator. The company that I work at is years behind the technology curve. Outside of my job, however, I have made a point to be active in open source software development projects as well as learning and applying devops methodologies and tools to the personal projects that I have been working on. My professional network is impressed with the kinds of things that I understand and am able to do. Thus I feel that I have a good breadth of knowledge in understanding both systems and development work, and I also have a good depth of knowledge in the specific technologies that I work with.

I am currently looking for a devops position, and in recently months, I have landed interviews with three different fortune 500 companies. In each instance, I had planned to talk about my personal endeavors and portfolio, however, none of the interviewers had much interest in hearing about this, they just wanted me to talk about my professional experience, which is obviously unimpressive in a context of current devops practices.

Obviously, it was a bit of a disappointing experience for me. The things I work on and technologies I use in my current job are completely out of my control, and I have even made several failed attempts at suggesting improved processes and practices. I am at a bit of a loss now as to how to proceed. I can't speak to having tried to change anything in my job because those attempts have failed (and I never really had that power to implement change in the first place). I can't speak to my personal projects and endeavors because it seems that in a professional contexts, people are less interested in that than what I'm doing in my job. Is there something that I should be doing differently? Am I missing something here?

https://redd.it/e826gh
@r_devops

Tool for repository/code quality

Hello guys, my boss is like a drug addict looking for metrics of how many times a line has been changed (aka churn), merge requests lead time, commit frequency and some others.

He is asking for a tool that can show numbers and charts about this metrics.

This week i will try to do some tests using the trial of the code climate, codacity and others.

Today the repository is hosted at gitlab but in the future will be moved to azure devops.

Have you guys worked with one of this tools? Have some tips? Know any tool free that can give him this kind of numbers?


Thanks

https://redd.it/e825zr
@r_devops

SaltStack worth Jenkins

Does anyone use salt with Jenkins I'll like to be able to run our salt states from within Jenkins. Currently my salt master has a Jenkins slave installed but I'm unable to run salt in a non root after reading salt doc to chown -r user /etc/salt and other folders within your Linux environment I'm still unable to run salt from Jenkins as a non root, is it even possible to sudo su from a step?

https://redd.it/e81vqk
@r_devops

Books to learn Kubernetes theory

Hi,

​

I'm a French beginner system administrator in a company working with devops culture.

In a project I'm currently working on (6 microservices running on Docker called by Knime) I was asked to search about API Gateway vs Service Mesh. To my understanding Service Mesh seems to need a kubernetes cluster, which we don't have right now, but will move to this kind of architecture at the start of next year.

For now, I setup Kong as an API Gateway which works well, but I need to work on Kubernetes as I don't know anything about it.

I'm a little bit lost with the amount of information currently available online, as it seems for a valid Kubernetes cluster there is a lot of moving parts needed (dns, ingress, service mesh, etc.) and everytime I check a new concept I'm getting lost in a documentation that assumes that I know the theory behind Kubernetes.

​

Is there a good book that goes in-depth in the Kubernetes configuration ?

For example, Hashicorp Consul's documentation talks about "deployments" with "selector", "template" and "metadata", and I really don't know which configuration key is needed or important, etc.

I have a server at home in which I can, and will, setup a cluster, however I don't like following a tutorial without understanding what I'm doing.

https://redd.it/e8atqt
@r_devops

ELI5 What is the point of VMware on AWS?

Hi there. I've been using VMware for a long time and got into the public cloud and AWS in the past year and a half. Recently I saw that VMware offers the ability to setup a full managed VMware ecosystem on AWS.

My question is, what are possible use cases for it, aside from migrating existing VMware setups? Why would I want to deploy VMware vms and basically have another layer to my infrastructure when I can deploy them "locally" on AWS and get the same flexibility and much more?

I apologize if it sounds like I disrespect VMware, quite the opposite. I just can't think of any use case for running VMware on the public cloud, and wondered what might be actual use cases for it.

https://redd.it/e8anaw
@r_devops