what directory services do you use, and why?

AD? OpenLDAP? Okta? Nothing? Homemade database? NIS?

https://redd.it/e7ytfn
@r_devops

Issues with devops transition

I currently work as a Systems Administrator. The company that I work at is years behind the technology curve. Outside of my job, however, I have made a point to be active in open source software development projects as well as learning and applying devops methodologies and tools to the personal projects that I have been working on. My professional network is impressed with the kinds of things that I understand and am able to do. Thus I feel that I have a good breadth of knowledge in understanding both systems and development work, and I also have a good depth of knowledge in the specific technologies that I work with.

I am currently looking for a devops position, and in recently months, I have landed interviews with three different fortune 500 companies. In each instance, I had planned to talk about my personal endeavors and portfolio, however, none of the interviewers had much interest in hearing about this, they just wanted me to talk about my professional experience, which is obviously unimpressive in a context of current devops practices.

Obviously, it was a bit of a disappointing experience for me. The things I work on and technologies I use in my current job are completely out of my control, and I have even made several failed attempts at suggesting improved processes and practices. I am at a bit of a loss now as to how to proceed. I can't speak to having tried to change anything in my job because those attempts have failed (and I never really had that power to implement change in the first place). I can't speak to my personal projects and endeavors because it seems that in a professional contexts, people are less interested in that than what I'm doing in my job. Is there something that I should be doing differently? Am I missing something here?

https://redd.it/e826gh
@r_devops

Tool for repository/code quality

Hello guys, my boss is like a drug addict looking for metrics of how many times a line has been changed (aka churn), merge requests lead time, commit frequency and some others.

He is asking for a tool that can show numbers and charts about this metrics.

This week i will try to do some tests using the trial of the code climate, codacity and others.

Today the repository is hosted at gitlab but in the future will be moved to azure devops.

Have you guys worked with one of this tools? Have some tips? Know any tool free that can give him this kind of numbers?


Thanks

https://redd.it/e825zr
@r_devops

SaltStack worth Jenkins

Does anyone use salt with Jenkins I'll like to be able to run our salt states from within Jenkins. Currently my salt master has a Jenkins slave installed but I'm unable to run salt in a non root after reading salt doc to chown -r user /etc/salt and other folders within your Linux environment I'm still unable to run salt from Jenkins as a non root, is it even possible to sudo su from a step?

https://redd.it/e81vqk
@r_devops

Books to learn Kubernetes theory

Hi,

​

I'm a French beginner system administrator in a company working with devops culture.

In a project I'm currently working on (6 microservices running on Docker called by Knime) I was asked to search about API Gateway vs Service Mesh. To my understanding Service Mesh seems to need a kubernetes cluster, which we don't have right now, but will move to this kind of architecture at the start of next year.

For now, I setup Kong as an API Gateway which works well, but I need to work on Kubernetes as I don't know anything about it.

I'm a little bit lost with the amount of information currently available online, as it seems for a valid Kubernetes cluster there is a lot of moving parts needed (dns, ingress, service mesh, etc.) and everytime I check a new concept I'm getting lost in a documentation that assumes that I know the theory behind Kubernetes.

​

Is there a good book that goes in-depth in the Kubernetes configuration ?

For example, Hashicorp Consul's documentation talks about "deployments" with "selector", "template" and "metadata", and I really don't know which configuration key is needed or important, etc.

I have a server at home in which I can, and will, setup a cluster, however I don't like following a tutorial without understanding what I'm doing.

https://redd.it/e8atqt
@r_devops

ELI5 What is the point of VMware on AWS?

Hi there. I've been using VMware for a long time and got into the public cloud and AWS in the past year and a half. Recently I saw that VMware offers the ability to setup a full managed VMware ecosystem on AWS.

My question is, what are possible use cases for it, aside from migrating existing VMware setups? Why would I want to deploy VMware vms and basically have another layer to my infrastructure when I can deploy them "locally" on AWS and get the same flexibility and much more?

I apologize if it sounds like I disrespect VMware, quite the opposite. I just can't think of any use case for running VMware on the public cloud, and wondered what might be actual use cases for it.

https://redd.it/e8anaw
@r_devops

AWS SA Associate -vs- Professional difficulty

Basically what the title says. For anyone who has taken both, how much more complex is the professional certification in comparison to the associate one?

Given they are both multiple choice, I’m wondering if the difference is that significant.

https://redd.it/e8awpv
@r_devops

Vault Auth methods for Users

Hi folks,

Curious to hear how y'all have provided access to users for vault. We currently don't actively use any of the given UI methods as a company so are looking at implementing a wrapper script around the AWS or Alicloud auth methods for access via CLI since we already have and use these accounts and don't want to manage another set of credentials.

Wondering if anyone else has done the same? Had some trouble with Alicloud, doesn't look like vault has the means to process the credentials if they are user based rather than server based. AWS looks to have better functionality but before I dive in thought I'd see if anyone else had done the same.

https://redd.it/e8b16f
@r_devops

What is LDAP and Why I should use it in my auth system?

Hi folks!

I've tried to set up IdP(Keycloak) and read a lot of materials about it. In every second article or docs, I've met the term **LDAP**. I don't understand how usually it uses in the auth flow. Is this some standard for security access to directories? And how it related to the web auth?

https://redd.it/e89spr
@r_devops

Jenkins inconsistency (files change every time)

I am new to Jenkins and still trying to understand how it actually works.

What I am trying to do is pretty simple. I trigger the build whenever I push it to my Github repo.

Then, I try to \`ssh\` into a server.

My pipeline looks like this:


pipeline {
agent any
stages {
stage('SSH into the server') {
steps {
withCredentials([sshUserPrivateKey(
credentialsId: '<id>',
keyFileVariable: 'KEY_FILE')]) {
sh '''
cd ~/.ssh
ls
cat ${KEY_FILE} > ./deployer_key.key
eval $(ssh-agent -s)
chmod 600 ./deployer_key.key
ssh-add ./deployer_key.key
ssh root@<my-server> ps -a
ssh-agent -k
'''
}
}
}
}
}

It's literally a simple \`ssh\` task

However, I am getting inconsistent results.

When I check the log,

&#x200B;

**Failed Case**

Masking supported pattern matches of $KEY_FILE
[Pipeline] {
[Pipeline] sh
+ cd /bms/home/pdsint/.ssh
+ ls
authorized_keys
known_hosts
known_hosts.old
+ cat ****
++ ssh-agent -s
+ eval 'SSH_AUTH_SOCK=/tmp/ssh-hb6yX48CJPQA/agent.51702;' export 'SSH_AUTH_SOCK;' 'SSH_AGENT_PID=51703;' export 'SSH_AGENT_PID;' echo Agent pid '51703;'
++ SSH_AUTH_SOCK=/tmp/ssh-hb6yX48CJPQA/agent.51702
++ export SSH_AUTH_SOCK
++ SSH_AGENT_PID=51703
++ export SSH_AGENT_PID
++ echo Agent pid 51703
Agent pid 51703
+ chmod 600 ./deployer_key.key
+ ssh-add ./deployer_key.key
Identity added: ./deployer_key.key (./deployer_key.key)
+ ssh root@<my-server> docker ps -a
Host key verification failed.

When I \`ls\` inside the \`.ssh\` directory, it has those files.

In the success case,

&#x200B;

**Success Case**

+ cd /bms/home/pdsint/.ssh
+ ls
authorized_keys
authorized_keys.bak <----------
known_hosts
known_hosts.old
+ cat ****
++ ssh-agent -s
+ eval 'SSH_AUTH_SOCK=/tmp/ssh-yDNVe51565/agent.51565;' export 'SSH_AUTH_SOCK;' 'SSH_AGENT_PID=51566;' export 'SSH_AGENT_PID;' echo Agent pid '51566;'
++ SSH_AUTH_SOCK=/tmp/ssh-yDNVe51565/agent.51565
++ export SSH_AUTH_SOCK
++ SSH_AGENT_PID=51566
++ export SSH_AGENT_PID
++ echo Agent pid 51566
Agent pid 51566
+ chmod 600 ./deployer_key.key
+ ssh-add ./deployer_key.key
Identity added: ./deployer_key.key (./deployer_key.key)
+ ssh root@<my-server> docker ps -a
Warning: Permanently added '<my-server>' (RSA) to the list of known hosts.

It has the \`authorized\_keys.bak\` file.

I don't really think that file makes the difference, but all success logs have that file while all failure logs do not. Also, I really don't get why each build has different files in it. Aren't they supposed to be independent of each other? Isn't that the point of Jenkins (trying to build/test/deploy in a new environment)?

Any help would be appreciated. Thanks.

https://redd.it/e8f45q
@r_devops

How does Spotify get millions of songs and info about those songs from record labels into their storage system???

As a bit of a test I am trying to create a beta version of a music streaming app but then the question it hit me, how did Spotify upload millions of information about the songs (Like Artists and Song names) into their database along with the songs files themselves???

https://redd.it/e8gks7
@r_devops

Do we have to stop docker-compose every time we update the docker images that we are using?

I am trying to use a script to automate pulling docker images from my docker hub and then use \`docker-compose up\` to put my server up (I don't need to \`docker-compose build\` again since I'm using images).

One thing that I wasn't able to find the answer online is, do I have to stop docker-compose every time whenever I re-up the server with the updated images with new tags?

What I do right now is:

services:
frontend:
container_name: frontend
image: "dockerhub_url/...:tag"
ports:
- "80:80"

in my docker-compose.yml but when I change the tag to the recent one, not sure if I have to stop the docker-compose then put it up again.

Thanks in advance!

https://redd.it/e8i4qn
@r_devops

Does having a CDN such as AWS built with my website/App makes Music or video streaming faster and more reactive?

So I am currently working on a beta music and music video streaming app using the flutter framework but I realized that each time I try to skip to a next song, it takes some time to load before the next song plays. In order to solve this issue do you think that a CDN server will be able to help so that as soon as I skip to the other song it will play instantly or a bit faster?

https://redd.it/e8jauf
@r_devops

Intern looking for some test proxy server advice

Hey guys, first timer here so correct me if I am doing anything wrong.

I am currently an intern at a Software company and they have recently asked me to take on a new project. I need to build a test proxy server that will run against one of our micro services. I am currently in the Crawl segment of my research and just hoping to get some advice or some interesting reading/viewing material that could help me get a better understanding to what I am trying to accomplish. Everything helps and I greatly appreciate any help y'all are willing to offer.

https://redd.it/e8eqm1
@r_devops

[AWS] sending a notification from account X to an SNS topic in account Y.

Hey. I'm trying to send a notification to an SNS topic that is in a different account and region than the one I'm sending it from, but when it comes time to choose the topic, it can't seem to access the topic that exists in the other account. Can anyone share some links to help me out with relevant reading?

&#x200B;

If I put in the ARN in "send notification to..." when creating an alarm, it tells me:

"This IAM user does not have permission to access the SNS topics and subscriptions for this account."

&#x200B;

Thanks!

https://redd.it/e8ci16
@r_devops

No More Youtube Ads + More with Clutch Chrome Extension

[https://chrome.google.com/webstore/detail/smuuvr/emfncmdgioneiofbidgfafcekldnfbld?hl=en-US](https://chrome.google.com/webstore/detail/smuuvr/emfncmdgioneiofbidgfafcekldnfbld?hl=en-US)

https://redd.it/e8mrre
@r_devops

What if we deploy on Friday?

Monday or Friday, how does it matter?

If the team is terrified to deploy on Fridays, that just seems like the team is not yet ready and is not confident enough with its DevOps capabilities. It means the firm's DevOps initiatives are not matured enough.

DevOps is (it's a culture, I know) about failing fast and learning fast, so you get the first-mover advantage, just like the initial companies who dared and used Docker and Kubernetes in production are the ones that are reaping enormous benefits today. Isn't it?

But my question is, how does it matter whether it is a Monday, Tuesday or Friday to deploy?

I think that the Deployment distribution graph is an interesting way of measuring your level of DevOps maturity. If you aren't on this level yet, try to get there.

BTW, you don't say you are doing DevOps just because you are using Jenkins. It is about consistency and matured CI, CD pipelines in place. A complete culture setup for dev and ops with a great collaboration mindset.

Note: CD has two different meanings, continuous delivery and continuous deployment.

Correct me if I am wrong:)

https://redd.it/e8m0wn
@r_devops

A tool prompts me for a token as input. Can I make Ansible automatically give the prompt the required input?

In the playbook i execute a tool...the tool says "enter token to use" I usually just paste the token in manually. Can I make ansible do this for me? To my knowledge I don't think I can feed the tool a text file as input.

https://redd.it/e8jve3
@r_devops

Windows deployment & IAC

Hello everyone,

In my current company, we deploy baremetal servers and VMs (immutable), all in on-premise and on Windows.

We used WDS/MDT/GPO for OS deployment & configuration.

And difficult to have a full overview of the configuration, as it's done with few software..

So since few weeks, I checked what will be the best way to move to IaC.

First we have Jenkins/Gitlab servers in production (Just in case...).

My goal is:

\- Store all the OS configuration/Postinstall scripts in Gitlab.

\- During OS deployment, load all the configuration from Gitlab (Pull).

\- Stop with the multitude of Windows WIM files.

\- Be able to launch unit tests from Jenkins (based on what we do during post installation)

\- Use the same WIM file to deploy VM & Bare metal servers.

\- Stop with PXE (iPXE, UEFI http boot, ...), too slow and not secure.

\- On-click deployment: Technician select the OS & project to deploy (IIS server, ...)

Problem:

I read tons of documentations, reddit posts, etc...

But difficult to find the best way to do what I want.

DSC seems to be a good product (embedded), but end of life if I have understood.

Ansible only support push mode.

[Glazier](https://github.com/google/glazier) another candidate, boot on a WinPE and deploy server from a source control, but not a lot of docs found.

[Setupcomplete.cmd](https://technet.microsoft.com/en-us/windows/dn898472(v=vs.60)): I can maybe load a PS script that will download configuration scripts from Gitlab and run it.

Other: Packer from Hashicorp, BoxStarter, ...

On your side, what do you use to provision Windows on On-premise server (VM & Bare-metal) ?

Thanks for your feedback :)

https://redd.it/e8fmrw
@r_devops

AWS security, compliance + efficiency



Trend Micro recently acquired the ability to scan, report on, and auto correct (if so desired) cloud accounts against both the “Amazon Well Architected Framework” and “NIST 800-53”. In just a few clicks, you can have complete visibility across your cloud workloads and we can help you stay compliant in an ongoing manual and/or automated fashion.

**A demo of our new cloud configuration solution, Cloud Conformity, takes under 30 minutes. Anyone interested in a call next week?**

https://redd.it/e8fagx
@r_devops