Azure Active directory Integration with Hasicorp Vault

I am trying to setup Azure AD authentication for vault,
I refered so many document but still I can not figure it out.
Please help If some did this. Thanks in advance

https://redd.it/f5tu28
@r_devops

Blog Post: Running PowerShell Scripts in Azure DevOps Pipelines (1 of 2)

Hey guys, I just wrote a shiny new blog post you may enjoy.

Summary: Understand how PowerShell scripts work in Azure DevOps pipelines and learn how to run them in this informative tutorial.

https://adamtheautomator.com/azure-devops-pipelines-powershell/

https://redd.it/f5sloo
@r_devops

Securely Access AWS Services from Google Kubernetes Engine (GKE)

It is not a rare case when an application running on Google Kubernetes Engine (GKE) needs to access Amazon Web Services (AWS) APIs. Any application has needs. Maybe it needs to run an analytics query on Amazon Redshift, access data stored in Amazon S3 bucket, convert text to speech with Amazon Polly or use any other AWS service. This multi-cloud scenario is common nowadays, as companies are working with multiple cloud providers.

Cross-cloud access introduces a new challenge; how to manage cloud credentials, required to access from one cloud provider to services running in the other. The naive approach, distributing and saving cloud provider secrets is not the most secure approach; distributing long-term credentials to each service, that needs to access AWS services, is challenging to manage and a potential security risk.

In my [blog post](https://blog.doit-intl.com/securely-access-aws-from-gke-dba1c6dbccba), backed by open source project [doitintl/gtoken](https://github.com/doitintl/gtoken), I show how to securely access AWS services from Google Kubernetes Engine (GKE) without storing/sharing long-term AWS credentials.

https://redd.it/f5sdvk
@r_devops

Waiting times and context switches - how do you handle them?

If the developer user experience in a company is good, you can get to work, start working on your daily tasks, and enjoy a blissful flow state for hours while tackling useful tasks at your own pace. If the development environment is well-designed, the iteration times between making a change and getting feedback (through tests or on the screen) are very short and feel satisfying.

Now, compare this to the experience on the infra-side of things. Long waiting times are the norm. The usual workflow is to apply changes, do something else and check for the results every now and then.

More-or-less blocking workflows, big delays, the need to do busy waiting or frequent context switching seem to be widely accepted as a given.

How are you handling those rough, but only infrequently discussed daily obstacles to focused work?

* How do you handle regular waiting times and delays?
* How do you approach multi-tasking and forced context switches?
* Have you put special effort into taming your (AWS, Docker, k8s) workflows and have tips to share?

I'm looking forward to learn more and share fixes, or at least to join in on the venting.

https://redd.it/f5pjzr
@r_devops

How does a consumer receive a message from a message broker?

I have learned from *Data Intensive Applications* book that

> A widely used alternative is to send messages via a message broker (also known as a
message queue), which is essentially a kind of database that is optimized for handling
message streams [13]. It runs as a server, with producers and consumers connecting
to it as clients. Producers write messages to the broker, and consumers receive them
by reading them from the broker.

How do consumers receive messages by reading them from the broker? Does it work in the following steps?

- First, does the broker notify a consumer that there is a new message in the topic they have subscribed to?

- Does the consumer then request the broker for the new message?

- Does the broker then respond to the consumer with the new message?

- Does the consumer then send an acknowledge to the broker for having received the message?

Thanks.

https://redd.it/f5qg31
@r_devops

Announcing Bot Framework SDK for Go

Consequent to a great feedback to [BotKube](https://www.botkube.io/), an application for messengers like Slack and Mattermost to monitor and debug Kubernetes deployments, we have got interests from Microsoft Teams users for an integration. An integration, which would help them monitor their Kubernetes cluster from a Teams client. Since BotKube is architecturally designed to work independently of a messaging platform, it seemed a viable thing to integrate it with Teams.

Microsoft Teams uses the [Microsoft Bot Framework](https://dev.botframework.com/) to allow users to write bot applications. The Bot Framework is a set of tools, SDKs, templates and services to build conversational bot applications. The official SDKs are available for Python, C#.NET, Java and Javascript. Since BotKube is built in Go, there was a need of an interface to the Bot Framework services in Go, for a seamless integration of BotKube to Teams. This encouraged us to write a Go SDK that wraps the services of the Bot Framework.

Today, we are excited to announce the first release of the [Bot Framework SDK for Go](https://github.com/infracloudio/msbotbuilder-go); an SDK written in Go that enables users to build bot applications over the Bot Framework in Golang. The SDK enables application developers to build conversational bots for Microsoft Teams.

[Read the full blog here](https://www.infracloud.io/microsoft-bot-framwework-sdk-for-go/)

https://redd.it/f5pjb1
@r_devops

clientSet for in-cluster and out cluster

This is little old, but I wanted to share this. A `go module` for eliminating the kubernetes client initialization in cloud native app development. Give it a try and let me know your thoughts


[clientSet for in-cluster and out cluster](https://medium.com/swlh/clientset-module-for-in-cluster-and-out-cluster-3f0d80af79ed)

https://redd.it/f5mw3n
@r_devops

Multiple CI/CD on a single server?

Let's assume I have a single server which is heavily overspecced and I have 150 developers with at least one or more projects on gitlab.

I know its probably a very bad idea to use that one single server to handle the CI/CD of all the existing projects, but just for argument sake, how good would it work and what would stop this attempt from being effective? Or in case I'm actually completely wrong about my assumption, why would it actually work out just fine?

https://redd.it/f6bq8v
@r_devops

Mobile CI/CD

Anyone have any experience on building a CI/CD pipeline for mobile apps and can maybe give me some tips/pointers/tutorials?

My team is looking to build/test/release both an iPhone and Android app. Android seems much more straight-forward; download SDK & dependencies, run tests, and upload to Play store (found a gradle plugin that does this). iPhone seems much more difficult since it seems like you need a MacOS machine to compile iPhone code and no major cloud provider offers Mac VMs.

Currently looking at Microsoft AppCenter, which is a bit frustrating since I would prefer to use Gitlab which is where all our other code & pipelines run.

https://redd.it/f5mikn
@r_devops

What will be faster? Setting up my own mail server or mail service like sendgrid?

Above those what will be faster in delivering mails

https://redd.it/f6dii6
@r_devops

Bolstering infrastructure and services

I'd like to start using some of Hashicorps stack like vault, nomad and consul but want to start with Consul. We have existing infrastructure that is in need of some system-level but also application level monitoring. Currently we have Zabbix set up for this, but I really don't like it.


So my initial plan is to deploy consul next to Zabbix and get a cluster running first without any services registered. According to documentation I can monitor the node health on a hardware level and see the telemetry of the entire infrastructure in a non-arcane interface.

From there I'll start start integrating vault into the whole thing and once done will give me a nice demo to convince some old farts that plain text passwords and constantly having to intervene because shit died for days without anyone noticing is in fact, not ok.

Any feedback/suggestions/criticism?

https://redd.it/f6d6oq
@r_devops

Which CI/CD for infrastructure as code

I need to automate infra as code pipelines. Most of it is in Terraform, some of it is in CF, and although I am trying to get everybody to use Terraform for portability we still have some CF users.

Here's the issue: the team is growing a little and I've heard about people getting their TF/CF code under CI/CD. What CI/CD should I use (and why)? For some reason I keep hearing gitlab CI, haven't found out why

https://redd.it/f67nr0
@r_devops

Prometheus alertmanager api issue

the object I send is

{
"matchers": {
"value": "alert_name",
"name": "name",
"isRegex": true,
"startsAt": "utctimehere",
"endsAt": "utctimehere",
"createdBy": "swtrz",
"comment": "Patching silence for machine x"
}
}


alertmanager returns

{"code":602,"message":"comment in body is required"}

Im pretty sure that last line *is* my comment, what did I mess up here?

https://redd.it/f6gb85
@r_devops

Exploring plain bastion hosts, AWS SSM, EC2 Instance Connect, and combining them all with Terraform.

Being newer to networking, I felt pretty lost with all the recent posts about bastion hosts, SSM, and EC2 Instance connect.


I decided I throw one more resource into the pile, with the goal to be different by:
- Having complete terraform examples of the best practices
- Using examples that are closer to production ready security standards than other posts
- Starting from the beginning, and showing how bastion host access has evolved over time to explain why the current best practices are why they are.
- Show how to tunnel database access locally, which requires an explanation of how `ssh`s `ProxyCommand` option works


[Here's the Codelab, enjoy!](https://codelabs.transcend.io/codelabs/aws-ssh-ssm-rds/index.html#0)

https://redd.it/f6gvjs
@r_devops

If you use statuscake, try this command line tool I've built

I've been using statuscake for a while for monitoring external websites and endpoints.

So I've decided to write a small command line tool that helps onboarding fast without using the UI.

<https://github.com/omerh/statuscakectl>

configure the username and token as env vars (as the readme explain) and run:

```bash
./statuscakectl create uptime --domain https://www.domain.com --checkrate 30 --type HTTP
```

https://redd.it/f6g6at
@r_devops

Git Binary files

Hi are upgrading to azure devops server soon from TFS 2017. Once completed we will start to use GIT as the repo. One issue we are having is go to handle binary files. How do you all handle binary files?

https://redd.it/f6ha59
@r_devops

Help on CI/CD Build before Test and why

To give you more context:

I'm a "DevOps" engineer and I'm doing my best to migrate old Jenkins to gitlab ci/cd as it meets the company needs

And since we want to use Dockers I'm being involved on the new projects to start having the best practices and train the developers on how to docker, docker-compose etc

With this I started to show to developers how gitlab pipelines work and the best practices to follow (run tests - build image - push to registry - update Dev server)

Here's now my struggle, since it's only python webapps, they found (I know this) that building the image - send to resgitry and then run the unit tests inside the container WORKS (no shit) and they changed all the pipelines to: Build the container - publish the container - run the test command inside that container - change the tag to latest if the test pass (why)

It's been 2 weeks trying to explain why it's a bad practice and I just can't find the best material/explanation why it's wrong ( plus English is not my first language)

Can someone eli5 why this is a bad practice so I can present a better ' I know it works but it's wrong?'

https://redd.it/f6gwxb
@r_devops

Talk on distributed systems (Part 2)

I recently put up the first part of this talk and got a lot of support from this community. Thanks for all your support. (Prev post link: [https://www.reddit.com/r/devops/comments/f4s9l2/a\_talk\_on\_distributed\_systems\_in\_college/?utm\_source=share&utm\_medium=web2x](https://www.reddit.com/r/devops/comments/f4s9l2/a_talk_on_distributed_systems_in_college/?utm_source=share&utm_medium=web2x))

Here is the link to part 2: [https://youtu.be/T5T0DIaWdxQ](https://youtu.be/T5T0DIaWdxQ)

Hope you all enjoy watching it!

https://redd.it/f6aqft
@r_devops

Will I get in any trouble if I do a proposal internal to the team as an open source project? (detail in post)

The story is that

I made a proposal for a new feature of our product, but for the following reasons it did not get approved from the managers and we decided not to support it

1. It is several steps ahead of our current product in terms of technology. The feature does not support any deprecated use cases of our product and it is meant to incorporate with several new features down the road map
2. Current product already supports similar feature that is not as powerful. It provides a sub set of capability of my feature
3. Current product implementation is not elastic enough and will require re-writing or adding some services to support my feature

However it turns out as a bad proposal to the team. I genuinely feel the idea is great and I don't want it to sink. So I spent my long weekend working on it, detailing the specs and implement basic mechanics. The specs for a full deploy that supports simple protocols does not seem hard to implement. But there are some catches...

* My deployment architecture is based on the concept of our team's product
* The idea has been disclosed internally with the team
* I am copying code from stack overflow pages that I referenced when writing some other code in work, making something that looks similar to my code at work

The product of our team is technically open sourced, I can find source codes and documents of released versions and all references of my implementation can be derived from published codes/documents of our team.

That is, if I start a brand new github account and deny I own it. It will seem like a random person digging through the product docs and coincidentally came up with an idea I had. This is an option but I will prefer to leave the open source project on my Linkedin page thus it should be the last resort.

Any suggestion on this?

Top priority should be publish the feature with basic standard protocol supports and walk away without getting any trouble. Second will be keeping credits on my Linkedin page

&#x200B;

Edit: Our codes are published externally under BSD-3 license. But I'll like to do MIT

&#x200B;

Edit:

What I mean by "made a proposal" was showing documents I wrote at home with some drawing on whiteboard. Everything hosted on GitHub and not downloaded to my company laptop and I can guarantee all commit time stamps up there are not my work time

https://redd.it/f6f9w7
@r_devops

Which 'traditional/mainstream' certs do you recommend (NOT DevOps/cloud based)? For work permit purposes

Hear me out where I'm coming from. Overseas immigration authorities when looking at eligibility for work visa first look at things like degrees incl. post-grad.

Then they look at professional qualifications by respected trade bodies.

IT certs like Microsoft, CompTiA even Cisco come even further down the list. Maybe because of lack of awareness or some other reason. I think most countries don't even give a single point for them. In fact, many countries look for "graduate" or "specialist" work. Because you can do DevOps or IT infrastructure without a degree, it's hard convincing them otherwise without some highly respected professional qualification. Salary aside, we may be considered to be "low skilled workers"!

If you wanted to future proof your career with respect to working overseas, what kind of qualification would you study on the side? I'm talking about something that takes years to achieve, not a cert you can cram in a week and pass multiple choice.

I don't think CISSP as I'm not committed to infosec. I'm thinking maybe something like PMP which is complementary and useful, especially the older I get and possibly less technical might become especially if moving into leadership.

What are you studying for on the side?

https://redd.it/f695gx
@r_devops