Question about the new AWS RDS CA

When updating the database to use the new CA, you get this popup:

"Before scheduling the CA certificate rotation, update client applications that connect to your database to use the new CA certificate. Not doing this will cause an interruption of connectivity between your applications and your database."

Does anyone know if this is required? We didn't have to import the CA originally, so why would we have to now? If it's a matter of the new root CA not being part of the trust chain of older distros, does anyone know if Ubuntu 18.04 has the new CA in its ca-certificates package yet?

Thanks!

https://redd.it/ep4hyj
@r_devops

Devops Career Ladder

Hey y'all, a, hopefully, quick question for everyone. I've seen a bunch of "how to get into devops" type posts here but was wondering about the career ladder for Devops positions. I'm new to the Devops side of things (less than 1 year, though 1 year of dev experience). What does the typical ladder look like? Is it just as simple as Devops engineer I, II, III and then into management?

Thanks :)

https://redd.it/ep7qde
@r_devops

I'm looking for suggestions on the best way to keep a collection of mission-critical services running, healthy, and up-to-date.

Our needs are relatively modest, so we rolled our own solution, but even so, the development effort involved is perhaps more than we would like if there are utilities that will do most of the work for us.

At the moment, we are running our services--which are available via known, unchanging URLs--on a few bare metal Linux boxes that have lots of ram (because the services require lots of ram). We have a Python script to deploy the latest versions of the software (and the data that the software serves) to the Linux boxes. There's also a Python script to restart services with zero downtime by bringing up a new version of a service on a different port number, reconfiguring nginx to point to the new port number, and then shutting down the old version of the service.

What the scripts do is controlled by a config file.

Unfortunately, doing all this right is more complicated than it might sound, and consequently, the scripts are somewhat complicated.

So I did some brief reading up on Kubernetes and it sounds pretty good for this kind of thing. Only I don't know if would be good for our relatively modest needs. Would it simplify our lives or make them more complicated? I can't tell.

If we used Kubernetes, I suppose it would be more easy for us to move these services to the cloud should we want to, but considering how much ram we need (i.e. several terabytes), the cost of running these services 24x7 in the cloud might be prohibitive. Also, the increased latency might not be a good thing for us.

So, maybe we could just use Kubernetes on our bare metal Linux boxes. Is that easy or hard to do? Would it be a good idea or a bad idea?

Is there something for this kind of thing that would be better than Kubernetes? E.g., Ancible? Puppet? Chef? Nomad? I tried to briefly read up on these tools, but everything I've seen is written in impenetrable vague marketese. The web page for Nomad seems the most comprehensible, but I'm still completely unclear after rifling through their web pages on whether it would make for more or less work for us.

TLDR: We have a bunch of services that we want to keep alive and up-to-date with near-zero-downtime. We currently achieve this with some non-trivial home-grown scripts on bare metal. Could we do this better or smarter? I.e., with fewer man hours devoted to enhancing and maintaining our infrastructure.

https://redd.it/epaksc
@r_devops

Deploying datadog using helm | Help

I am trying to deploy datadog using the helm chart onto a Kubernetes cluster created by Kops, it has 3 masters, then two instance groups. One of those instance groups needs to be monitored and the other should have no monitoring.

​

If I am understanding the docs right I need to add labels?

​

Another question about datadog, in the helm chart is there a param I can set to be able to see if pods are pending or crash backed off? I looked over it a few times and didn't see anything about it though it seems like something that should be supported.

https://redd.it/epbygq
@r_devops

Vulnerability scanner orchestration

I want to share my first opensource project I have published https://github.com/Mixeway/MixewayHub project is designed for IT security teams which use number of vulnerability scanners but have problem with fitting them into CICD. Mixeway integrate with Nessus, nexpose, acunetix, openvas, fortify, dependency check and more. It can configure and run scans given in universal format of REST API call and in the end provide complex result set.

I am no pro dev so code quality is rather poor but I am actively doing some refactor to make it better. Any feedback would be very appreciated.

https://redd.it/ep3exb
@r_devops

How are you setting up your configuration repo? What can I do to get the most value from a new setup, specifically for ansible configuration management?

I’m going to be assisting with a brand new setup of Ansible and want some ideas and experiences with creating a new repo structure for a CI/CD pipeline. I’ll need commits to automatically be picked up and deployed to as many as 3 or 4 environments in succession.

https://redd.it/ep93wg
@r_devops

What are some of the biggest struggles in managing your AWS environments?



https://redd.it/ep41ts
@r_devops

'Unknown error 524' on netconsole

Tried running netconsole, a Linux kernel module that sends kernel logs to a remote UDP server, and was surprised to find it wouldn’t work on my AWS EC2 instance. Received the following error.

modprobe: ERROR: could not insert
'netconsole'
: Unknown error 524

Here's a blog about how to solve it [https://www.granulate.io/a-case-of-a-broken-netconsole?id=0](https://www.granulate.io/a-case-of-a-broken-netconsole?id=0)

https://redd.it/ep30z6
@r_devops

Use cases of Python for devops role

Shout out to all Devops with Python experience.

Couple of questions:

1. Do you use Python often or is it not a necessity for devops role?
2. What are best the use-cases using python for devops from your experiences?

https://redd.it/ep0p1h
@r_devops

Elastic Stack Cluster - Secure and Configure

Hello, community.

I am sharing one video where I am explaining how you easily can create your own Elastic Stack (Elasticsearch + Kibana) cluster on 3 nodes.

For this purpose I am using 3 virtual machines(Nodes) based on VirtualBox hypervisor and preinstalled and configured Linux Ubuntu 18.04 on them, preinstalled Elasticsearch with preconfigured for the demo elsticsearch.yml file and Kibana preinstalled on the first node.

So what you will need to do to have a working Elastcserch cluster is to just download the virtual machines from the provided links in the video description and import them in your VirtualBox.

In the second part, I am explaining how you can secure your Elastic Stack cluster using the instructions in the description and how you can create restrictions for users and roles in Kibana.

Link for the video - [Elastic Stack Cluster - Configure and Secure](https://www.youtube.com/watch?v=i4T1PNQZsiY)

https://redd.it/eozyvd
@r_devops

YAML testing for Azure DevOps pipelines

Hi,

Anyone written any tests for something like a yaml pipeline?

Specifically Azure DevOps.

Cheers!

https://redd.it/eoz64m
@r_devops

Books to read for devops engineer

I am working as a devops engineer for last 4 years, with total 6 years of experiance in IT. At this point of my career I want to learn more about the IT. It is now manditory for a devops engineer to understand the application and help developers on designing them.
Like:
I am not faimilier with many terminologies used by the developers, QA etc..
I want to understand how a software is designed and how the testing is done etc.. entire flow till the application in production.

Any book/books that gives me more understanding on these topics.

Thanks in advance

https://redd.it/eoyqfi
@r_devops

Looking for Devops 101

My skill level is low. I am on a junior dev level.

vagrant, docker, kubernetes, CI/CD - I have read definitions, followed along the docs and ran "vagrant up" & [got docker to run](https://guide.freecodecamp.org/docker). But never did anything in a production environment and I am sure that I have not fully even understood the concepts. Basically just did "hello world".

I think the concept I have to pay attention is more about "containers". What is [kata](https://katacontainers.io/)?

So, how do I learn the basics to understand what is what and know if a devops guy is talking shit. Or if I am skilled enough, to actually get into devops. That is the aspiration.

All my skill are limited to the knowledge I manage to get from [AutomateTheBoringStuff](https://automatetheboringstuff.com/) & completed the "Responsive Web Design Certification" from [FreeCodeCamp](https://guide.freecodecamp.org/meta/free-code-camp-full-stack-development-certification/), working on completing the rest. So, something from my level.

https://redd.it/eoyp0p
@r_devops

How should I separate my Jenkins Projects(Jobs?) within a pipeline?

First I want to start off by saying I’m pretty new to Jenkins and am trying to set it up for my new team. We are just starting development so we don’t have a bunch of tests yet.

From my understanding a project, which I think is often referred to as a job, in Jenkins is used to run a specific test and compare the results to what is expected. If the test results match the expected results the project passes.

A pipeline is used to take multiple projects and run them one after another to essentially test a bunch of things without having to start each project individually.

How should I handle separating my projects within Jenkins so I don’t have to rewrite multiple lines in the test?

Currently I want to take a programming approach and think of projects kind of like C++ functions. If I’m going to be doing the same thing over and over again, like cloning the repo or building the project, it should be in its own project with the pipeline handling the variables that may be passed. Will this work?

When a new project is started within the same pipeline is the workspace the same as the project that ran before?

Here is my general idea of a pipeline and the projects within it.

Pipeline: Test Invalid User Input on Linux

Project: Clone repo from GitLab

Project: Compile source code on Linux Node

Project: Run User Input unit test script that calls all the tests specifically for user input

Does this seem like a reasonable separation of projects or is there a potential for flaws? I would have a similar pipeline for Windows.

If you have any resources I should look into for Jenkins please share them!

https://redd.it/epkjal
@r_devops

To what extent are devs responsible for security in the container build pipeline?

I am a user researcher and not a developer so please forgive me if I am using the wrong terminology but I am trying to understand how security works at the start of the container pipeline (the build pipeline). I know that developers run all kinds of tests on their container images but what sort of security tests are done at this point? Would they actually somehow test against the runtime security policy set by the security/vulnerability team at this stage (possible the Kubernetes admission controller policy?)? And how would that work actually? Do they have audit/view access to the security tool being used to create the policy? Who is actually responsible for the security at this point in the pipeline?

I know that there is a trend to shift security left and I have read a lot of articles about that but I am just trying to understand from a practical point of view how it actually happens since there are different roles and different teams at play here (and presumably politics as well).

Any insight on this would be very appreciated. Thanks! :)

https://redd.it/epqbmt
@r_devops

OneDev - An open source super-easy all-in-one DevOps platform

We are proud to release OneDev. It is an open source all-in-one DevOps platform, featuring git repository management with language aware code search, issue management with custom states and tickets, and a docker first Kubernetes native build/CI engine.

It is an alternative to GitLab, but is much easier to use and maintain, with lots of unique features. Checkout the product and documentation here:

[https://github.com/theonedev/onedev](https://github.com/theonedev/onedev)

https://redd.it/epsowh
@r_devops

when working in a new environment in DevOps, how long does it generally takes to acclimate yourself to all of its tools, processes and cultural work practices - especially when you’re new to dev ops?



https://redd.it/epsbzu
@r_devops

From Windows Admin to Devops

I've spent most of my career working and supporting Windows Servers, workstations, and infrastructure but as the years have passed the demand for this type of Admin has decreased significantly, as would be expected. I find myself much more interested in devops, particularly Linux and AWS solutions. I have a degree in computer science from the 1990s and most of a masters in Bio systems engineering, where I was focused mostly on sensors and controls and automation and did some significant coding. Unfortunately my academic experience has not translated into real world experience. My last position was a Powershell script developer in a contract position where I wrote scripts to automate security and patching processes in SCCM.

I am currently unemployed and have spent my days becoming more familiar with Linux, AWS, and bash/python scripting. I'm working on certifications but without real world experience I'm just not sure what I can do to prove to employers (and myself) that I know what I'm doing enough to be hired.


Any suggestions on what I should focus on and where to get training? I'm currently working through some courses on cloudguru and udemy but could really use some advice and direction in what is essential. The number of skills and technologies I see when looking at devops positions is a bit overwhelming.

https://redd.it/epn9m6
@r_devops

Should I move from CircleCI to GitHub Actions?

Hi DevOps community.

I was pretty hyped for the launch of GitHub Actions. I've been using CircleCI for the past 3 years, and with the recent pricing changes, I was hoping that GitHub (& Microsoft) would be my new go-to for SaaS CI/CD. I hoped they would "break the game" with an aggressive pricing and lots of features.

To be honest, I found it a bit "meh" when I tested it at first during the Beta. There was no cache between pipeline jobs, the UX wasn't good, the runners were really slow...

GitHub updated quite a lot during the Beta and since the launch (now there is caching, there are self-hosted runners...), but I don't find it mature enough for a production-ready CI/CD pipeline provider.

My colleague and I tested GitHub Actions against CircleCI and GitLab (here are our results [https://blog.theodo.com/2019/12/github-actions-on-the-test-rig/](https://blog.theodo.com/2019/12/github-actions-on-the-test-rig/) ).



Have you tried GitHub Actions, and did you choose to use it on your projects ? Have I missed something game-breaking that would change my mind ?

Thanks :)

https://redd.it/eplrcf
@r_devops

2019 My year in review: inlets & inlets-operator for Kubernetes

I started a new OSS project over the holidays last year, it was a side-project and not meant to be anything big. I wanted to create a simple solution using Golang and websockets so that we could receive webhooks through HTTP. The reason this works through private networks is that the client speaks first, and then establishes the persistent connection.

And for the well meaning, without time to browse the README:

\> Developers wishing to use inlets within a corporate network are advised to seek approval from their administrators or management before using the tool. By downloading, using, or distributing inlets, you agree to the [LICENSE](https://github.com/inlets/inlets/blob/master/LICENSE) terms & conditions. No warranty or liability is provided.

[https://blog.alexellis.io/2019-my-year-in-review-inlets/](https://blog.alexellis.io/2019-my-year-in-review-inlets/)

https://redd.it/epluhm
@r_devops