Inspec vs Twistlock

I was going through various compliance check tools, inspec was the most popular choice out there. But we do use twistlock in our team for vulnerability scanning and I see a compliance check there too.

Is there much difference between inspec and twistlock compliance checks other than former being opensource where we write compliance checks as controls and latter is a paid one already with all compliance checks present ,we just have to run it against the hosts we want to be tested.

https://redd.it/esflfz
@r_devops

PSA: Accidentally get a big charge in your Azure deve account? Microsoft may waive it if you ask!

I recently left some resources I was testing running in my personal Azure dev subscription.

Racked up about $100 in charges before I remembered and removed the resources.

I contacted Azure support and asked if they could waive the charges since I left them running accidentally. They agreed immediately.

So don't hesitate to contact them if you have some big charges! Probably worth a shot with AWS or GCP but haven't tried personally.

https://redd.it/eseyly
@r_devops

Moving from network engineering position to DevOps / software positions

​

Hi,

I'm a 23 years old network engineer with 4.5 years of experience at enterprises, I have the following knowledge:

\- Cisco networking - routers and switches also all the protocols.

\- Python scripting and network automation

\- Linux system administration

(not system admin experience but from network engineering perspective).

\- AWS fundamental knowledge

\- Check Point firewalls

\- Virtualization - VMware

​

These are my certs that I currently hold:

\- CCNP R&S

\- CCNA Security

\- AWS Cloud Practitioner

\- LPI Linux Essentials

​

I currently want to pursue a career in devops/SRE/software development and I'm not sure what is the best path for me.

I think about starting to pursue a CS degree because I didn't go to college yet, but I got another feeling of doing AWS Solution Architect associate cert and Linux cert and go more to the "devops/SRE route"

(also learrning docker + ansible + jenkins afterwards).

​

I'm not sure if my best way is to pursue a CS degree or get certs for a better position (Devops/Software)

​

Also I'm kind of wondering how to advance my skills in order to become devops engineer / SRE.

If someone can structure for me a learning path in terms of subjects, I can learn and also do labs and test for myself.

Also what are like the best tools for devops? I heard that AWS + Linux + Ansible + Docker + Kubernetes and Jenkins/TravisCI are the most common.

Thanks,

https://redd.it/eshvke
@r_devops

Alternatives to Redgate for SQL Database Automation

we've been using redgate software to automate our sql build and deployment practices for a few years now; however, they changed their license model a couple of years ago and its incredibly expensive now on a per-user basis.

The redgate tooling works very well for us combining sql source control with the DLM automation tools, the flexibility the filter files and comparison options provide is pretty important as we have close to 100 different databases, many of which have some specific deployment requirements to ignore particular objects. The comparison reports it generates are critical as well to provide visibility into changes being made. These are all features that fall into the 'must have' category for us. The other nice thing about redgate is that it actually generates all the code when commits are made so we have consistent SQL code across all our databases.

​

Would love to hear any suggestions you have on alternative tooling or approaches to full automation around the management of SQL Database schema and data.

https://redd.it/eskesa
@r_devops

How to use OperatorSDK and service meshes together?

Here is a quickie one:
How to use concept of an operator and service mesh in Kubernetes based, microservice/event driven infrastructure?
How to make most of both patterns? Are there any patterns/tutorial you can recommend?
Cheers!

https://redd.it/esjp76
@r_devops

Migrating to Helm 3

Hi all,

I've recently finished migrating our environments over to Helm 3 (goodbye and good riddance Tiller!). I've written some blog posts that documented some of the pitfalls I encountered when updating our scripts for Helm 3, as a lot of the flags for Helm have changed, and some don't even exist anymore.

There's also a great blog post by the Helm developers that explains the migration process from a high level. One thing that was missing is what to do if you find yourself wanting to roll back to Helm 2. How do you delete releases once they're migrated to Helm 3? Conveniently enough, release data is stored in k8s secrets now, so it's pretty easy to do.

Anyway, hopefully these are of use to some of you.
[Breaking Changes in Helm 3 (and How to Fix Them)](https://itnext.io/breaking-changes-in-helm-3-and-how-to-fix-them-39fea23e06ff?source=friends_link&sk=c1514964ac1db15574384b234a0c5bdf)
[Migrating to Helm 3: What You Need to Know](https://itnext.io/additional-tips-for-migrating-to-helm-3-304c9d50f1b4?source=friends_link&sk=2aed5a6f6e754369d3887493ed202d8c)

https://redd.it/esj90t
@r_devops

Kubernetes pulling wrong image

I have an issue where kubernetes is pulling the wrong image from ECR. Issue pretty much is serviceA:tagX has Image ID of ABC then serviceB:tagY has an Image ID of ABC as well so Kubernetes is deploying the serviceA image for serviceB. I'm using helm charts and right now am deploying manually (for now) via setting the tag as a values.yaml param. What can I do to prevent this issue from coming up again?

https://redd.it/esmnof
@r_devops

Managing GitHub using Terraform

Has anyone added teams as collaborators in GitHub repos? What's the best way to do it?? Any help will be appreciated 🙏

https://redd.it/esm3rz
@r_devops

Puppet tutorial/book recommendation

Hey guys,

So I just got an offer letter today for DevOps position (yay!) and the team uses Puppet for their configuration management. I am trying to prepare myself for the role as much as I can before the start date and wondering if anybody can share resources for learning Puppet.

I have been using Linux Academy to learn RHEL/Git/Ansible and I liked them all so far but I do not like their Puppet tutorials.

I would really appreciate your input!

https://redd.it/esib8z
@r_devops

Checking what an upgrade will break?

Hi, I'm looking to upgrade some software at my current job, but I want to do it with minimal breakage.
In this case, it's Jenkins, and it's a big jump forward(our version is 2.2xx.3, newest appears to be 2.7.x).
Is there an aggregator of change-logs that will tell me what this will break? I don't want to go in blindly since that would be a huge pain in the ass.

https://redd.it/escj7w
@r_devops

Does anyone know a way to pass a file to a remote instance using ssh forwarding?

I'm using Terraform to instantiate and instance and It always generates a new instance with a new hostname. I wanted to pass a DNS value from a file using SSH forwarding to automate this process. does anyone have an idea? I'm thinking something like this.

cat efs_dns.txt | ssh -A ec2-user@$$(terraform output bastion-public_ip) ssh master.openshift.local

https://redd.it/esgmr2
@r_devops

Here’s an idea: a 3D VR world of your Kubernetes cluster

Pods, containers, services, deployment, logs and live traffic visualized in a 3D space that anyone can move around in. Useful for debugging.

What do you think of this idea?

https://redd.it/esd6rb
@r_devops

Has anyone passed the Cloud Foundry Certified Developer Exam?

Any suggestion on study path? It is an affordable exam?

What should I study most and which platform could I use for make practice?

https://redd.it/esbzhi
@r_devops

jenkins approval workflow

I want to set up an approval workflow where a user can approve (or disapprove) a pipeline step. How does one go about setting this up? Ideally, I would like to get the user from ActiveDirectory.

https://redd.it/esb75v
@r_devops

Looking for social media recommendations: who should I follow on Twitter for the best kubernetes/backend-related posts?



https://redd.it/es9aqa
@r_devops

Prometheus Operator Federation Questions



EKS Clusters running in different aws accounts. Goal is to monitor different clusters at one place

Found Prometheus Federation is a good fit for the design and scaling

[https://prometheus.io/docs/prometheus/latest/federation/](https://prometheus.io/docs/prometheus/latest/federation/)

[https://www.robustperception.io/federation-what-is-it-good-for](https://www.robustperception.io/federation-what-is-it-good-for)

Master : I have a dedicated EKS for monitoring system where prometheus operator helm chart is running with prometheus and Grafana exposed behind load balancer service

Master prometheus server is designed to scrape other slave prometheus servers with the /federate endpoint and plot the Grafana dashboards for different clusters

One Grafana Endpoint to monitor everything

Slave Account 1:

Running prometheus operator helm charts in the other slave accounts where all the alerting is done through the alert manager in the slave account 1

Prometheus - Default scraping from prometheus operator + additionalscrapeconfig for istio services

Alertmanager - alerts related to slave cluster 1 integrated with Victorops

Slave Account 2:

Running prometheus operator helm charts in the other slave accounts where all the alerting is done through the alert manager in the slave account 2

Prometheus - Default scraping from prometheus operator ‘

Alertmanager - alerts related to slave cluster 2 integrated with Victorops

Now we have another use case to monitor the bunch of bare metal servers, aws ec2 instances and monitor different endpoints

Monitor Bare Metal, EC2 Instance - Installed NodeExporter for disk metrics and can able to scrape the metrics directly from master prometheus server

Endpoint Monitoring(Public & Private) - Installed blackbox exporter on the master eks cluster and probing different endpoints

Here are my questions

​

1. Is it a good practice to enable alertmanager on the master prometheus and do the alerting only for the last usecase(bare metal, aws ec2 instance, endpoint monitoring)
2. From the below article, I see alertmanager should be on the slave prometheus(reliability purpose), If so do we need to install prometheus on each bare metal again?
3. Can we use any existing loadbalancer for exposing prometheus, because in helm chart if we expose the service.type=loadbalancer it used to create new one(internet facing/internal)

https://redd.it/es4q2r
@r_devops

Why does vendor lock-in seem like an especially bad thing in tech?

Not sure if this is the best place to discuss this, but I thought I'd post it anyway.

Every discussion on cloud seems to lead to some talk about lock-in. Now, I understand the risk of lock-in. But vendor lock-in is not a problem that's unique to cloud. Most enterprises are "locked-in" to Microsoft office and windows. A good proportion of people are "locked-in" to the Apple ecosystem.

In fact vendor lock-in is a business risk in other industries too. Southwest only uses Boeing 737's. There's a risk that Boeing could decide to be nasty and raise prices in future. Sure, Southwest could buy Airbus planes (but it would create massive problems for them), and then Boeing's reputation would take a hit. Similarly, if AWS raises prices, it would take some effort to move elsewhere, but their reputation would also suffer.

So I guess my question is, why is vendor lock-in the scary bogeyman it is in cloud? I personally see it as a business risk, but not a avoid-at-all-costs thing.

https://redd.it/esvga0
@r_devops

How to find passwords in source code?

Hi everyone, I’m new to software development and have been tasked with finding any exposed credentials or keys in plaintext in our source code repos. Looking for any suggestions on how to go about doing this. I’ve tried searching “password” and “pwd” but I’m not turning up much. Any advice appreciated. Thanks

edit: I don’t have direct access to the repo aside from read-only as I work in internal compliance and not the dev team.

https://redd.it/esvb0p
@r_devops

Intro to Pulumi for Python

Hey y'all


As a Terraform veteren I am really liking Pulumi, I tired out the CDK and didn't love it especially with the synthesization to CloudFormation. Does anyone have any experience running Pulumi outside of just small dev projects I would love to hear thoughts as I go deeper into it!

For those that have not used it yet, I have been creating some Devops videos to share with some co workers and also for myself to learn some new technologies. This Pulumi video is the tutorial I wanted when I was starting with Pulumi so maybe it can be helpful to someone out there. [https://www.youtube.com/watch?v=60LYNRnmM5M](https://www.youtube.com/watch?v=60LYNRnmM5M)


*PS. I am learning that coding while talking is hard*

https://redd.it/eswe3d
@r_devops

Microsoft Customer support data breach

Seems like a misconfiguration lead to the exposure of personal data of customers that had contacted Microsoft customer support. Wooopsie

"Our investigation has determined that a change made to the database’s [network security group](https://docs.microsoft.com/en-us/azure/virtual-network/security-overview) on December 5, 2019 contained misconfigured [security rules](https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#security-rules) that enabled exposure of the data. Upon notification of the issue, engineers remediated the configuration on December 31, 2019 to restrict the database and prevent unauthorized access. This issue was specific to an internal database used for support case analytics and does not represent an exposure of our commercial cloud services.

As part of Microsoft’s standard operating procedures, data stored in the support case analytics database is redacted using automated tools to remove personal information. Our investigation confirmed that the vast majority of records were cleared of personal information in accordance with our standard practices. In some scenarios, the data may have remained unredacted if it met specific conditions"

[https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/](https://msrc-blog.microsoft.com/2020/01/22/access-misconfiguration-for-customer-support-database/)

https://redd.it/estu79
@r_devops