[Looking for Recomendation] Orchestrated Toolchains and automation

Hi all!

I was wondering what is the normal/standar for toolchain orchestration and automatic tasks.

the kind of Alarms -> Open Tickets -> Remediation -> Close ticket or escalate in case it doesn't do anything. and such...

I'm starting with learning the Flow Designer of xMatters. We are sending data from Dynatrace and CA UIM and testing creating a ticket in BMC Helix and executing remediations in our environment with CA RA and such.

Does anyone have something similar? What was the approach?

Thanks for any insight / examples or alternatives!

https://redd.it/ewffmw
@r_devops

PaaS to SaaS?

Quick question from a noob:

So until last week we had a elastic cluster with two nodes. From what I know, We had multiple VMs in azure (2 for data nodes, 2 for client nodes, 3 for master nodes).

Now my devOps head creates a cluster and applies a YAML with elastic configurations (elastic docker image). There is an ingress reverse proxy for this k8 cluster (not relevant here)

​

Can someone help me understand in easy terms what exactly happened? Did we just move from PaaS and SaaS? How did containerization work in this case.

​

I am sorry, this is very basic question, but I am trying to understand what exactly happened. I know just very basics about k8 and containers. Thanks

https://redd.it/ewfyb1
@r_devops

Help with understanding infrastructure changes

Quick question from a noob:

So until last week we had a elastic cluster with two nodes. From what I know, We had multiple VMs in azure (2 for data nodes, 2 for client nodes, 3 for master nodes).

Now my devOps head creates a cluster and applies a YAML with elastic configurations (elastic docker image). There is an ingress reverse proxy for this k8 cluster (not relevant here)

​

Can someone help me understand in easy terms what exactly happened? Did we just move from PaaS and SaaS? How did containerization work in this case.

​

I am sorry, this is very basic question, but I am trying to understand what exactly happened. I know just very basics about k8 and containers. Thanks

https://redd.it/ewh035
@r_devops

What level of CVE severity do you reject builds?

I’m a fairly junior DevOps at a very small company, and just added container scanning to our CICD pipeline. Ideally I’d like to make sure all of our images are perfectly clean with no vulnerabilities but it doesn’t seem feasible (at least right now).

Currently I set our tool to reject builds that have HIGH or CRITICAL level CVEs. Was hoping to get more input from the rest of you! Thanks!!!

https://redd.it/ewfl67
@r_devops

Can't convert to gigabytes from ansible?

"{{ ansible\_mounts | json\_query('\[\*\].size\_total') | join(' ,') }}"

i tried to add int filter but it gives me 0. I need to read it as human\_readable. The number is on bytes but i need to conveert to gb. I even tried to divide by 1000 but i am errors. Can you help what i need to do ? i tried so many things to work but it won't work.

https://redd.it/ewc22m
@r_devops

Best tool(s) for creating a consistent build environment across entire dev team

Apologize if this is the wrong place to ask, but I figured you guys could point me in the right direction. If I'm being honest, I'm a C developer who is incredibly unfamiliar with modern tools to help with development workflow.


I'm currently working on a project that has a handful of prerequisite programs that need to be installed (e.g. a specific version of cmake, a specific version of gcc, etc.). We've had a lot of problems onboarding people, because we essentially ask them to go through a checkbox of things that they have to download before our project can build/run on their machine. And, because people are imperfect, a lot of people end up downloading the wrong versions or forgetting a prerequisite.


To further complicate things, we have developers using Windows, MacOS, and Linux.


I'm looking for a tool where I can throw all of these prerequisites and have it _just work_. Docker seems to be kind of what I need, but getting it set up for Windows has been a huge pain so far, so I'm hoping there might be better options out there.
Thanks all!

https://redd.it/ewg8s9
@r_devops

What is the latest and proper way to create Kubernetes cluster on AWS?

In GCP it's very easy to deploy Kubernetes cluster and apps. Share your thoughts on AWS.

https://redd.it/ew13vo
@r_devops

Building k8 cluster on teams latop

Based on this article: [https://levelup.gitconnected.com/how-to-deal-with-computing-resource-cost-for-kubernetes-based-development-f723aef01660](https://levelup.gitconnected.com/how-to-deal-with-computing-resource-cost-for-kubernetes-based-development-f723aef01660)

​

Keeping multiple pre-prod clusters up can be very costly for a smaller companies. But most of the time peoples laptops are under utilised. If we can build a K8 master/worker node on teams laptop, We might be able to save some cost.

​

Not sure how much this is feasible or if someone already tried this

https://redd.it/ewp7c9
@r_devops

Tool to run Envoy as an edge proxy for Consul Connect services.

I've created an xDS server for Envoy that lets Envoy route traffic to consul connect enabled services. It has been a royal pain in the backend to find a reverse proxy that can discover services from consul catalog and route traffic to them, and configuring nginx and haproxy using consul-template turned out to be too brittle and finicky.

Here is [Flightpath](https://docs.flightpath.xyz/), it can discover services and routing information from consul catalog like Fabio or Traefik but it also registers itself as a connect native service and shares its leaf certificates with Envoy so that Envoy can communicate with upstream services via sidecar proxy.

It is a work in progress and I have a couple of features planned already but please feel free to try it out and give me your feedback.

[https://docs.flightpath.xyz/](https://docs.flightpath.xyz/)

https://redd.it/ewqgen
@r_devops

CAdvisor vs Experimental Docker Daemon Metrics for Prometheus?

I am wondering which one should I use for Grafana dashboard?

I am open for other solutions, but self hosted since I have small amount of servers to handle and free resources for logging.

https://redd.it/ewpphm
@r_devops

Wrote a small article about experiments with Pulumi

Spent a few days with Pulumi and created a small infrastructure stack. Here are [a few thoughts ](https://grem1.in/post/pulumi/) about it

https://redd.it/ewtc3g
@r_devops

How do you handle co-authoring of code? Check-in/check-out, or Live Share, or similar?

Hey all,

​

Just wondering what you do within your team on the operations side when it comes to co-authoring scripts, modules, and settings files. I've looked into VSCode Live Share paired with Github Desktop, I think it could be powerful but so far haven't had success installing the extension. Are there other options? Do you prefer to check things in and out instead?

https://redd.it/ewsynp
@r_devops

How do you guys build AWS AMI?

We use Packer and Jenkins to bake application AMIs. For testing we use ciscat and rspec. I was wondering what other tools are used on enterprise level for building and testing AMIs?

https://redd.it/ewtlwh
@r_devops

DevOps & DevSecOps certifications

Going to first say that peoples views differ greatly on the validity and value of certification. I understand that and am looking for certification guidance. I have the opportunity to get certification that I know will give me benefits within my organization

I'm looking for DevOps and ideally DevSecOps certification. I see a number from devopsinstitute.com but don't have any opinion or information of colleagues on the organization. I also found devops-certification.org which looks like a certificate factory.

Looking for advice in this area, thanks!

Edit: additional though, perhaps a dedicated security qualification would be more specialised and better recognized, something like CISSP

https://redd.it/ewt7lm
@r_devops

Get kubectl access to your private cluster from anywhere

Get kubectl access to your private cluster from anywhere

This tutorial shows you how to punch out your private [Kubernetes API server](https://kubernetes.io/docs/concepts/overview/components/) to the Internet, so that you can manage your cluster from anywhere, just like you would with a cloud offering. You can also use it to punch out from one VPC to another, if the hosting VPC doesn't allow inbound connections. You can also use the networking tools here to punch out a Raspberry Pi and other TCP traffic to other networks.

Does this sound useful for your DevOps tool-belt?

[https://blog.alexellis.io/get-private-kubectl-access-anywhere/](https://blog.alexellis.io/get-private-kubectl-access-anywhere/)

https://redd.it/ews2c8
@r_devops

Terraforming with Serverless

Full walkthrough

https://medium.com/@romain.kelifa/mate-terraform-and-serverless-d8d326d83cd2

https://redd.it/ewmj59
@r_devops

How many of us have cost saving in this year's or quarter's target?

I have been working to save costs for other companies that are using AWS and other cloud services. For the sake of simplicity, just referring to AWS for now.

Here's are the things I do and help other companies automate for cost-saving:

* Find and shutdown unused AWS resources
* Use the appropriate storage classes for different storage services
* Monitor, track, analyze, and act on services usage
* Identify previous generation resources - Upgrading to new ones helps in saving costs since they are provided at a lower cost.

What else do everyone is looking forward to doing to save cost?

I am the founder of TotalCloud. You can find us on Product Hunt if you search for TotalCloud or AWS.

https://redd.it/ewkgjs
@r_devops

Looking for Open Source Firewall

Hi, I'm in the process of setting up my "private cloud", which really is just a Dell R620 in a colo.

I run ProxMox with OpenShift on top with everything getting provisioned with ansible. My current problem is that all the the established OS firewalls (pfSense, OPNsense, etc.) have no way to automate their installation. I've found some long as fuck packer setups but they're dependant on storage speed so not ideal.

I also thought about using plain OpenBSD with pf. Anyway what are your thoughts and suggestions?

https://redd.it/ewligg
@r_devops

Secrets as a code with Mozilla SOPS and AWS KMS

[Medium post about secret as a code](https://link.medium.com/RocC5bGVI3)

In the article above I show how you can leverage Mozilla sops and aws and to keep your secrets around in a secure manner. Enjoy.

https://redd.it/ex5jmx
@r_devops

How do you set up transactional analytics in a microservices set up?

Hey there,

I am looking at setting up a customer facing analytics reporting service that would just be simple queries of stuff we have in our databases. - the issue is we use a microservices setup where each service has it's own db and no other services are allowed to access another's db.

How have folks done this in the past? I know I could invest in some etl tooling and use some common database for reporting but we want to know the lightest weight solution so we can validate this with customers.

Any thoughts?

https://redd.it/ex5jlm
@r_devops