Traffic shadowing - tools and advice

Hey, need to reproduce my production API inputs to a staging/dev server and ensure our next version can successfully process this real-world input. What tools did you use for that? any other advice and lessons you learned during this journey?

https://redd.it/eydm1z
@r_devops

Using output from a Terraform var in same module

Im using a Terraform [main.tf](https://main.tf) file and creating an AWS instance and attaching a VPC, EIP, gateway etc, and also configuring an RDS instance.

​

output "rds\_endpoint" {

value = "${aws\_db\_instance.default.address}"

​

terraform output gives the DNS name

and nslookup provides the IP address.

export db\_host = 192.x.x.x (ip address of RDS instance)

I'm trying to pass this variable as an environment variable using local-exec but its not possible as it says output is not defined. If I create another terraform module such as [database.tf](https://database.tf), can I then pass on the output to my [main.tf](https://main.tf) file? Not quite sure how this works..

Basically I want to SSH into a machine and pass this env variable to a Python script so its know the IP to access.

​

\# MySQL configurations

app.config\['MYSQL\_DATABASE\_USER'\] =$user

app.config\['MYSQL\_DATABASE\_PASSWORD'\] = $pass

app.config\['MYSQL\_DATABASE\_DB'\] = $db\_name

app.config\['MYSQL\_DATABASE\_HOST'\] = $db\_host

https://redd.it/eyh9l3
@r_devops

Teams of DevOps teams

Hi,

Apologies if this is slightly off topic (and rambling).. I'm asking for advice/insights on dealing with changes that DevOps enables in an organisation, rather than DevOps practices/tooling itself.

For context: the adoption of DevOps culture at the company I work for has allowed us to move towards "service teams" - basically autonomous DevOps teams that run a range of services e.g. customer-facing web apps, but also a lot of internally focused services - k8s platform, internal monitoring, security logging, development tooling etc. Each team runs many services, but each service is run by only a single team. Generally this model has has worked well for us so far.

Currently, we're at about 12 teams geographically distributed (and growing). Our primary tools for communication *between* teams are a Wiki, MS Teams (🤮but moving towards slack) and email.

Our problem is we're struggling with, what I think is essentially the N(N-1)/2 communication problem.

As we scale the number of teams, things are starting to get a bit more chatoic/brittle, and signal/noise ratio is getting worse. As an example, a customer recently suffered an outage because one team hadn't seen an important announcement, dropped into in a particular slack channel, by another team.

I'm curious if anybody else works in an organisation where this is a problem and whether they have insights, products or strategies they adopted to solve/mitigate it.

One avenue we are looking at is the "Team API" concept discussed in [team topologies book](https://teamtopologies.com/book), which looks really interesting. The Team API, from what I understand, is basically a agreed framework that standardises how teams interact within an organisation. It wouldn't necessarily solve the N/(N-1)/2 problem, but formalising and standardising might hopefully might make the problem slightly more manageable.

Jeff Bezos' "API mandate" is probably an extreme example of a Team API, but I've not seen any concrete examples of "Team APIs" being applied in much much smaller organisations.

Anyway, I'd be curious to hear from anybody else suffering the problem, or others with insights into how they've scaled DevOps teams.

Thanks!

https://redd.it/eyehxy
@r_devops

MS Teams down after they forgot to renew cert

[https://www.theverge.com/2020/2/3/21120248/microsoft-teams-down-outage-certificate-issue-status](https://www.theverge.com/2020/2/3/21120248/microsoft-teams-down-outage-certificate-issue-status)

https://redd.it/eycibi
@r_devops

Help deciding cloud architecture for IOT product

Hi!

I am working with an IOT startup who are currently working to create a proper backend for their product.

Basically we have a monitoring system which generates a packet, and we want to send this to the cloud and store it in a time series database. Next we run some algorithms that we have written based on the received data and generate insights which we send back to an android application.

As we don't have any proper backend yet, we are flexible with the suggestions for architecture but we have to look at the costing. I don't have much experience developing for any cloud architecture but I'm ready to learn. Could you please suggest what architecture would work best for the above mentioned scenario?

Thanks!

https://redd.it/eybp9n
@r_devops

Gitlab-CI cache options

Hi guys!

I’m really new gitlab user but last week i got a project to optimize our gitlab-ci with cache. I read the docs but i don’t understand tottaly how is it work.
In my project need to cache composer and npm packages, but i also want to understand how is it work.

Thanks any help!

https://redd.it/eye000
@r_devops

AWS ECS Fargate Metrics

Need Some help regarding AWS ECS Fargate. I have an ECS Cluster running with some tasks inside it.

I want to collect task-level metrics from it and use them for visualization. Data-dog ECS agent does the same kind of work, but its paid. I need a free solution for this.

It could be something like custom-beat that'll export Fargate metrics to Elasticsearch.

https://redd.it/eyb9gw
@r_devops

What makes a DevOps standup/scrum etc successful ?


I work on a small team at a \~100 person tech company.

2 "Sr. SRE" (including myself), a DBA, a buildmaster, and a newly promoted "Manager, DevOps" who is reasonably technical but was previously in a Sr. customer success type role sortof like a sales engineer but who was on our team. There is a totally separate small team that handles "Production Operations" and I have significant overlap with them in terms of responsibilities, often more than my own team, The only difference being I generally work on stuff before it is deployed vs after, in theory at least.

​

We've been having a monday morning standup call/meeting since I started over a year ago and frankly I feel like it's lacking and unfruitful. Nobody really comes prepared, we just rattle off what we are planning to work on that week, I sometimes references my jira queue etc, but there is little coherence to the whole thing and no followup on it, the next monday just rolls around and we do the same thing.

​

I've talked to some other companies that do standups daily or 4x/week. It seems like we should have a list of items prepared and then review our progress as a team at the end of the week or something.

​

So what makes a successful scrum, what should a lead of a small team like this be doing to ensure productivity and success?

https://redd.it/eyb76i
@r_devops

Junior IT here, trying to utilize Ansible for the first time, looking for advice of whether my first project is over my head

Hello eveyone,

**Background story - not mandatory**

So I've been working as a Junior sysadmin for almost 3 years now. I started off as help desk in my company but as time passed, I learned a bunch of things and really got into automating stuff with PS and Python.

I recently started watching some YouTube videos about Ansible and would like to learn it. I don't have much experience with those sort of things so I wanted to get some advice from this sub on whether my first project is too big for me, or if it's actually doable.

I'm part of an IT team. The guy who is in charge of our virtualization environment is pretty old fashioned and he likes to do things manually. We have an environment of over 1600 VMs and each week we deploy more. Even though he told me he wouldn't use it, I wrote a PoSH GUI script that clones a bunch of VMs at once. He'd get tickets asking for 20 new machines and would just clone them manually, so I helped out and he does use it nowadays.

--

**End of story - The thing I need help with**

I want to help on another matter and that's VM deployment customization. Our senior sysadmins usually deploys a bunch of CentOS/RH VMs and he configures each of them manually for stuff like how many disks the machine will have, size, partition type, file system type, etc.

Is there a way for me to create a script or a play book that will do those sort of things for me? For example, our CentOS template has 2 disks in it, both LVM and with a fixed size. If I deploy that template and edit it before I click "finish", the cloning will fail, so I just deploy it, then edit the disks, format it, etc.

Ideally, if it's doable using Ansible and if I understand playbooks correctly, then I would write a file in which I specify:

* Number of VMs
* OS
* Partition size
* FS type
* Since we're using LVM - PV, VG and LV names and paths.
* And other VMWare stuff like Datastore, hosts, folders, etc, which seems pretty straight forward.

I'd like to know if this project is beginner friendly, assuming I know my way around VMs and some basic scripting.

If it is, I'm not sure where to begin, what I need or what tutorial to follow first, so any tips would be great :)

Thanks!

https://redd.it/ey6wcc
@r_devops

Demo of multistage and canary CI/CD and cloud automation for microservices with GCP, Kubernetes, Terraform, GCB and ArgoCD/Rollouts

Just did a pretty complete and fully-featured end-to-end [automation demo](https://github.com/ilya-lesikov/gke-demo) on GKE. I think this might be helpful for both beginners and people with some experience.

What's in it?

* Multistage deployments (staging, prod)
* Canary deployments
* Horizontal pod/instance autoscaling
* Rollbacks, self-healing
* Distributed tracing, monitoring, logging, profiling, debugging

I used GCP, GKE/Kubernetes/Kustomize, Terraform/Terragrunt, GCB, ArgoCD, Argo Rollouts, Stackdriver, [hipstershop microservices](https://github.com/GoogleCloudPlatform/microservices-demo/tree/master/src). Setup/deployment is heavily automated so it will be easy for you to deploy it on GCP with Free Trial yourself.

The demo is here: [https://github.com/ilya-lesikov/gke-demo](https://github.com/ilya-lesikov/gke-demo)

https://redd.it/ey965p
@r_devops

DevOps knowledgebase/wiki

Thought this might be of interest to folks here:

[https://devops.yoga/](https://devops.yoga/)

(I'm not affiliated with this project, just saw it and thought it was cool.)

https://redd.it/ey8wm6
@r_devops

Deploying Windows 10 images

I was wondering what the best way to create custom windows 10 images for client would be? The idea is we create a customized image and then deploy them to client machines. The trick is, we have a bunch of different clients and the images all need to be tweaked for the different deployments.

Is there a easy way to accomplish this?

https://redd.it/ey8uze
@r_devops

Docker/Kubernetes

Hello Guys/Girls. I am starting startup with small team. We are building complex web application. I don't have big experience with deployment, I thought I could learn docker/kubernetes to use on current project. I need suggestions where to start, what ressources can I use etc.

https://redd.it/ey8t22
@r_devops

Similarity of Staging and Production Environment

Hi all,

I'm reading about the Staging Environment and some things are not clear to me. If it's supposed to be similar to the Production Environment, then:

1. Is the same amount of machines (VPS) used as in the Production Environment?

2. Is it usually placed in some subdomain? If so, how is its access normally limited? Through firewall?

3. Assuming Let's Encrypt Certificate is used for the Production Environment. What kind of Certificate is usually used for the Staging Environment? Same Certificate in the same domain? Separate Certificate in another domain or maybe a self-signed certificate?

https://redd.it/ey8a11
@r_devops

Which status page do you use? Anyone use cachet.io?

Hey folks, which status page do you use integrated with Pagerduty/Grafana/Prometheus, etc.? Things like statuspage.io, status.io, and has anyone integrated the open source cachet.io with PagerDuty?

Obviously not interested in things folks have for manually updating status :P

https://redd.it/ey54mu
@r_devops

29% of highest security integration orgs endure friction when collaborating

A watermark of traditional security activities within organizations is the high tension between security teams, the operations or IT, and the core R&D engineering. When all of these teams are siloed with their activities and overall goals unaligned, they create tension and friction that manifests in mis-executive security activities.

However, when security practices are integrated throughout the SDLC, then the overall confidence level of security practices levels up for the entire organization. Furthermore, the Puppet report shows that, when security activities take place very early in the SDLC, they are more impactful.

From the Puppet & Snyk DevSecOps Insights study at [https://snyk.io/blog/29-percent-of-highest-security-integration-orgs-endure-friction-when-collaborating/](https://snyk.io/blog/29-percent-of-highest-security-integration-orgs-endure-friction-when-collaborating/)

https://redd.it/eyrzpz
@r_devops

GUI Alternative to Chef

Hi

The automation engine I am working on can be used as an alternative to Chef to some extent. I am reaching out to see if you guys could provide some advice and viewpoint.

[https://staging-totalcloud.webflow.io/alternative-to-chef-totalcloud](https://staging-totalcloud.webflow.io/alternative-to-chef-totalcloud)

TIA

https://redd.it/ey6ocy
@r_devops

Terraform vs Roll-Your-Own Cloud Infrastructure Code

Just curious if anyone has actually run through the pros and cons of using Terraform to manage cloud infrastructure, vs writing your own using the provided APIs of whatever cloud providers you use. Assume we've all read [Terraform's own opinion](https://www.terraform.io/intro/vs/boto.html) and have a general understanding of [NotInventedHere Syndrome](https://en.wikipedia.org/wiki/Reinventing_the_wheel). How does Terraform beat writing your own Infrastructure-As-Code using the APIs directly, in specific cases?

It seems to me that Terrform looks solid and well-designed, but still doesn't quite align with what I'd envision to be an ideal declarative infrastructure specification. There's the added complexity of a generic "resource" abstraction, which all the syntax is designed around. But you still need to know (a) the provider-specific cloud resources you want to provision as well as (b) how to declare those resources in Terraform. As with most HashiCorp tools, it looks robust with a solid user experience, with features like `terraform plan`. But I still wonder if it's really worth it.

If I am going to have to think about the resource details anyway, I might as well spend the time to learn use the API, without the need to filter it through Terraform's abstraction layer first. That way, I know I'll be able to implement anything I want and won't ever be limited by 3rd party design decisions. I can design my own infrastructure specification format and base it on what I actually need, rather than be tied to a general language that has to be suitable for everyone. It might not be as robust and generally applicable as Terraform but that won't matter if it covers everything I need it to cover.

What are *good* reasons not to do this?

https://redd.it/eywqi8
@r_devops

How to stop Terraform from running all resources at the same time?

Hey all, I am new to Terraform and I am trying to write out some terraform files, and I am running into an issue. Some of my resources depend on "previous" modules to finish running and I am hitting a snag. I would like to run each resource in succession rather than simultaneously. Is there a way to do this?

Some things I tried:

Splitting them up into modules

Splitting them up into separate files and manually calling them when the resource is finished spinning up (best thing that worked so far but cumbersome)

Putting timeouts in place as a wait (this just ran the timeouts at the same time as well).

https://redd.it/eyt4xs
@r_devops

Monitoring solutions for remote research data acquisition systems

I work in academic research and operate a few remote research data acquisition systems (CentOS). I need to be notified when there is a failure in the data acquisition hardware or software, as well as things like failing hard drives or UPS battery. Thus far I've tried to make-do with emailing myself via a dedicated GMail address and try to set up stuff to send me emails if something goes wrong. The problem is that I end up spamming myself(e.g. if a data acquisition program runs once every two minutes but there's a hardware failure I get 720 emails/day over the weekend with the same error message!), especially if it's something that I can't really fix \*right now\*. Also I wish I could somehow aggregate stuff that's the same type of message from the same system, possibly silence certain errors, etc.

I'm sure there are products out there that can help with this kind of thing, but I don't really know what direction to go in at the moment. We could probably spend a little on a 3rd party service if it was worth it, and/or I could possibly convince our university IT to get us to self-host something.

Any advice? TIA.

https://redd.it/eyx71j
@r_devops