Treat servers like cattle, not pets

Can someone help me explain what exactly this means in DevOps?

https://redd.it/ffp9lx
@r_devops

Which OS for Kubernetes in 2020?

We are evaluating at the moment which Operating System we should use for new Kubernetes Clusters. After the changes in the CoreOS environment we are not sure if we should move on with this OS..

For us it would be important that the Distro is maintained for long time or has the ability like CoreOS to be updated seamless. Also should the Distro be complete Open Source..

As alternatives we have so far allocated the following:

\- [Clear Linux](https://clearlinux.org/)

\- [Talos](https://www.talos-systems.com/)

\- Debian

What's your opinion? Which OS for Kubernetes are you using and what do you think where the journey will go in the next years?

https://redd.it/fgghrj
@r_devops

Two Important AWS Security Rules to Remember

So there are a ton of rules, gotchas, principles, and catch-22's when it comes to cloud security on AWS. At times it's like trying to keep bugs out of a 100 room building where doors and windows HAVE to be open for people to move about. Well, here's a post about two important AWS security rules to remember. No, these aren't the only two to know, but yes, they'll clarify your role in cloud security and help you to understand how to think about it.

[Two Important AWS Security Rules to Remember](https://start.jcolemorrison.com/two-important-aws-security-rules-to-remember/)

https://redd.it/fghcz3
@r_devops

Software chain of custody and compliance

What tools, systems, or practices do your teams use to automate the software chain of custody that can satisfy HIPAA and CJIS compliance? What kind of constraints exist in your build and release processes to ensure segregation of responsibilities?

https://redd.it/fgl976
@r_devops

Does anyone know the difference between these two AWS roles?

AWSCodeDeployRole


AmazonEC2RoleforAWSCodeDeploy


The former is in the AWS guide to creating a service role for EC2 CodeDeploy. The description of the latter says, "This role is needed by the CodeDeploy agent on EC2 instances." Does this have to do with resource-based vs identity-based?


Thanks for any help

https://redd.it/fgkkmz
@r_devops

Cheapest GPU hosting server

I'm looking for the cheapest gpu server

with gtx graphic card like gtx 750

and windows server 2019

​

Appreciate any help !

https://redd.it/fgmjg6
@r_devops

AWS Cloud practiced essentials

Has anyone used the free course on amazon? Is that enough to pass it?

https://redd.it/fgkgjx
@r_devops

Security & Policy Configurations for Infrastructure as Code

Set your YouTube reminder for Sunday, March 15th, 2020 at 1 PM EST!

[https://youtu.be/KOTXCIN0yE0](https://youtu.be/KOTXCIN0yE0)

Join us as Hashicorp's Rosemary Wang deep dives into some techniques for proactively checking the security and policy of our infrastructure as code, using examples featuring Open Policy Agent and Terraform.

Meetup RSVP: [https://www.meetup.com/OWASP-DevSlop-Project/events/268639871/](https://www.meetup.com/OWASP-DevSlop-Project/events/268639871/)

https://redd.it/fgojfc
@r_devops

Opensource InfluxDB for production

For an upcoming project, I will need a time-series database, and for now, I'm considering either InfluxDB or Prometheus (any other recommendation is welcome).

Reading through Influx's docs, I don't understand one thing: is there anyone really using InfluxDB Opensource in production? What's your use case? Because the lack of clustering, and therefore, lack of high availability and performance looks to me a big deal not to choose Influx.

https://redd.it/fgcgjd
@r_devops

What are some of the DevOps related subreddits you follow?

Hi all. New to DevOps. Was wondering what are some DevOps related subreddits that we can follow to be aware of the trends and also learn it.

https://redd.it/fga6or
@r_devops

Terraform best practices

Sooo we have this terraform repo that includes a bunch of things
- network configurations
- cloud rdbms setup
- ec2 instance stuff
- monitoring alerts (datadog)

So I think this has become a monolith of kinds, because everytime we need to do a provider upgrade or TF upgrade, it takes ages.

Could someone share articles around terraform best practices? At what point do we start decomposing things down to separate repos ?

https://redd.it/fg8h1a
@r_devops

Build stage in Gitlab Runner

I have a project that I am building and then deploying:

image: docker:latest

before_script:
- echo "(!) Starting process"

after_script:
- echo "(!) Successfully ran process"

build_stage:
stage: build
script:
- rm -rf ~/.m2/repository/me/pabloestrada/
- sh lib/credentials/prod_build-persian.sh
- sh lib/guice-quartz/prod_build-persian.sh
- sh lib/persian-jobs/prod_build-persian.sh
- sh persian-services/exercise-tracker/prod_build-persian.sh
- mvn clean package -f service
- mvn clean package -f scheduler
- sudo npm install --prefix ui/
- sudo npm run build --prefix ui/

deploy_stage:
stage: deploy
script:
- rm -rf ~/.m2/repository/me/pabloestrada/
- sh lib/credentials/prod_build-persian.sh
- sh lib/guice-quartz/prod_build-persian.sh
- sh lib/persian-jobs/prod_build-persian.sh
- sh persian-services/exercise-tracker/prod_build-persian.sh
- mvn clean package -f service
- mvn clean package -f scheduler
- sudo npm install --prefix ui/
- sudo npm run build --prefix ui/
- docker-compose up

So, for deployment, I need to build and then spin up a container. I am essentially doing the same thing in the build stage, but without deployment. Is there a better way to do this? Am I using the build stage correctly?

https://redd.it/fgro12
@r_devops

How do apps get their secret ids using Vault approle?

With an devops (admin) role, I can generate the secret id for a role. I am able to embed the role id in the app's executable, but how can I pass it the secret id?

https://redd.it/fgqhvj
@r_devops

Prometheus vs. CloudWatch for Cloud Native Applications

Many companies are moving to Kubernetes as the platform of choice for running software workloads. When an organization earlier using VMs in AWS decides to move to Kubernetes (Either EKS or self-managed in AWS), one of the questions that come up is should one continue to use CloudWatch or switch to some other tool like Prometheus? While it is not an exactly apple to apple comparison, there are reasons to explore this and choose tooling that is built for the future. This post will try to explore various aspects and pros and cons of both options individually and as a combination.

## Why?

Prometheus and CloudWatch are very different in the problem they solve and a 1-1 comparison seems unfair but as you start moving to cloud-native stack, Prometheus starts popping up in conversations and for many right reasons. For example, currently, CloudWatch does not support Kubernetes metrics ([Issue link here](https://github.com/aws/containers-roadmap/issues/38)). As one of the workarounds, you can use [CloudWatch exporter](https://github.com/prometheus/cloudwatch_exporter) and export metrics from CloudWatch to a Prometheus instance. You can also host a Prometheus instance in the cluster and then metrics are exported to CloudWatch using the CloudWatch [adapter](https://github.com/cloudposse/prometheus-to-cloudwatch). Before we start comparing the two technologies, let’s do a quick high-level overview of both.

[Read the full post here..](https://www.infracloud.io/prometheus-vs-cloudwatch/)

https://redd.it/fgt2i8
@r_devops

Hope do you SSH at scale?

How do you SSH at scale?

I’m curious to know what solutions you all use for achieving scalable, easy to use, auditable SSH access in a hybrid multi-cloud environment?

A commercial jump gate solution we’ve been using for years (I’m new and on the security team. I’ve inherited the solution which is woefully out of date) isn’t really working well for us. Support sucks, it’s clunky and doesn’t provide the level of auditability I’d like.

I’d like a solution that makes our devops, db, qa, dev etc. teams happy and win points with them while still achieving robust access control and logging. I’m finding it difficult to find a good competitor to our current solution. A major strong point for them is a fully featured non-web based shell. I don’t see your engineers being okay with a web based shell.

I’ve been looking at SSH CA but it looks like a significant effort to architect and implement with our current resources.

Anyways, I’m interested to hear what you’re doing...

[edit] forgive the weird title- I did not proof read before posting.

https://redd.it/fg88j0
@r_devops

AWS CodePipeline and Github question

Hi Guys, I have a question, perhaps someone knows the right answer. We have provided 3rd party access to AWS and it is granted. However, every time we want to add source c change with GitHub AWS fails with 404 error trying to add web hook. I believe it maybe something to do with permissions, but can't understand what. The GitHub team is set to have maintain access. If I login and delete the source and re-add web hooks installed fine, but no other team member can do it. Has anyone knows how to fix it? Thanks.

https://redd.it/fgua92
@r_devops

How much to charge

I do web and app dev. Occasionally I get asked to set up servers and other devops. Some of these things I have scripts for and if I charge for time I feel I'm getting shortchanged. For example lately I've been asked to set up a system with nginx as load balancer and multiple server instances. Can anyone help me with pricing?

https://redd.it/fg7s6a
@r_devops

How do you manage dockerized nginx configs created by automated web proxies like jwilder/nginx-proxy or maybe traefik?

Hello.

I am wondering if I may doing some of the things wrong.

I have been using both solution (jwilder/nginx-proxy and traefik v1), but once there came problems with http responses like 413 (basically the default request size is limited to 2MB - far to small) or some CORS policies, then I have to fix this by putting some modifications in nginx conf files.

As we know logging in to the server, installing nano / vim and manually editing the conf files are a no-no way in dockerized environment since this will not persist after container shutdown, scale, restart, or whatever any other reason.

Its funny how some basic automation that things like traefik provides are initially great, but later seems to be like "oh well f\*\*\*ed now..."

I think that there will be answers like Consul (which I am not familiar with) or something. My alternative is to do some fancy magic with Jenkins, but I don't feel it as "the right way"

https://redd.it/fgvk1e
@r_devops

How to use Terraform to schedule daily backups of your Google SQL database

At work, I had to schedule daily backups of a Google SQL database into a Google Storage bucket with Terraform, I figured that writing an article about it could maybe help other developers!

[Here is the link to the article](https://medium.com/inato/how-to-use-terraform-to-schedule-backups-for-your-google-cloud-sql-database-8688da8180e1)

I’ll be glad to have your feedbacks on it! :)

https://redd.it/fgw3s3
@r_devops

AWS ECR, ECS based deployment: nginx: [emerg] host not found in upstream “app:9000” in /etc/nginx/conf.d/default.conf:2

I am struggling to **configure** AWS **ECS Task definition** to run simple PHP-FPM & Nginx based containers.

My "app" container is running at app:9000
port and Nginx is in 80
port. Nginx is forwarding the request to app container through a fastcgi\_pass app-upstream;

All of these are running perfectly in local. The same configuration is running perfectly in DigitalOcean Docker Instance but fails in AWS ECS.

I am guessing some task-definition configuration issue, but I can't find it.

**Error Logs:**

I am getting this log from **Nginx container**

nginx: [emerg] host not found in upstream "app:9000" in /etc/nginx/conf.d/default.conf:2

Image: [https://i.stack.imgur.com/EhXmc.png](https://i.stack.imgur.com/EhXmc.png)

and this log from **App** ***(PHP-FPM)*** **container**

[10-Mar-2020 02:39:37] NOTICE: fpm is running, pid 1
[10-Mar-2020 02:39:37] NOTICE: ready to handle connections
[10-Mar-2020 02:39:38] NOTICE: Finishing ...
[10-Mar-2020 02:39:38] NOTICE: exiting, bye-bye!

Image: [https://i.stack.imgur.com/2VWIV.png](https://i.stack.imgur.com/2VWIV.png)

**ECS**

I've created a simple cluster with T2 Small instance, which is running perfectly.

**Dockerfile**

In this Github Repo, I've added the Dockerfile
for App, Nginx image, docker-compose.yml
file and task-defination.json
file for reference if there is any mistake in docker files.

**Source code in Github** repo: [https://github.com/arifulhb/docker-ecr-sample](https://github.com/arifulhb/docker-ecr-sample)

Expecting someone can help me out to fix this.

TIA

*Ariful*

https://redd.it/fg7jlm
@r_devops