Terraform - Create DNS record for provisioned VMs

Hello all.

I've started to test Terraform IaC and automation and would like to provision a couple of VMs on our OpenNebula cluster, and then use IP addresses of those provisioned VMs as inputs for PowerDNS provider to create records.

Currently, I'm stuck in creating multiple records (looping through provisioned VMs and getting hostname+ip). IP reservations are handled in OpenNebula, so all info about records should be in `opennebula_virtual_machine.test-cluster.*`

A bit of code:

resource "opennebula_virtual_machine" "test-cluster" {
count = 2
name = "vm-${count.index + 1}.int.domain.tld"
....
}

And the idea is to use something like this "pseudocode":

resource "powerdns_record" "add_records" {
for vm in opennebula_virtual_machine.test-cluster {
name = "vm.name"
records = "vm.ip"
zone = "int.domain.tld"
ttl = 300
type = "A"
}
}

I can't get the loop syntax right, so any help would be very appreciated!

https://redd.it/fgymov
@r_devops

Path to non-technical position

I'm pretty bored and unhappy with being an infrastructure/devops/SRE/what-have-you. I've actually wanted to do something else for a while but the money and lifestyle have kept me put. However I'm realizing it's time to take action.

Not really interested in management, it seems like a nightmare to be honest. I have looked at tech consulting and sales engineering as two options. Seems like they are more people-facing, and still have a lot of the problem-solving that drew me to tech in the first place. Also they have similar income/status to being an engineer.

Anyone make the jump? Got any tips? Any other careers that might be interesting to someone who wants to be done with technical work but still in tech?

https://redd.it/fh0c1a
@r_devops

Can any NGINX people tell me what's wrong with my simple conf? (paste below)

error_log /var/log/nginx/error.log;

events {}
http {
server {
listen 443 ssl;
ssl_certificate /etc/nginx/ssl/cert.crt;
ssl_certificate_key /etc/nginx/ssl/private.key;
location / {
proxy_pass https://15.201.115.134.xip.io:8443/;
proxy_read_timeout 3600;
}
}

So I made a simple config for Nginx to proxy me to the endpoint. I can get there going directly to it but when I do it with NGINX it gives me a 504 Gateway Timeout. Now...if I change the port from 8443 to 80 or 443 it takes me to "Application not available." So I know its getting there but its not getting to 8443. Am I missing something simple? (URL obfuscated obviously)

Thanks for the help. :)

https://redd.it/fh3987
@r_devops

Repository for delivering to customers

Hi Devops!

We are currently using Nexus3 for on-prem docker repository and setup proxy-cache instances of Nexus3 when we want to create a new K8s environment either on a demo server or a remote QA environment etc.

What is currently the best approach to release builds to both internal and external customers so they can refresh their on-prem environments ?

We are researching **on prem** solutions that our pipeline can push to , specify which user has access to which artifact (kind of like licensing) and serve both internal and external customers.

Any best practices / known solutions that you could suggest for handling these deliveries?

Thanks

https://redd.it/fh43x6
@r_devops

Docker Needs to be Started Manually

I am painfully new to Docker and recently just setup an instance to use for Redis. I found out fairly quickly that it seems it has to started manually after a server reboot.

Would I use Kubernetes to resolve this? How do I automate this?

https://redd.it/fh5is9
@r_devops

Implement a release process for managing and controlling software application releases

Software Development process is not complete and mature without a well-defined release process for the software applications. Every software application needs to be delivered or deployed at some point in time and for agile projects, this is happening more often. Therefore, there is a need to maintain software quality across the application releases to avoid deploying untested or malicious code to production environments.

Defining a release process for software applications helps in ensuring that software releases maintain a constant release quality. In addition, software changes and new features are traceable or can be correlated to specific releases easily. As a result, changelogs and release notes are easier for a generation.

​

[more info](https://medium.com/@wshihadeh/tips-for-implementing-a-software-release-process-8551db21fe85)

https://redd.it/fgul1t
@r_devops

Can I use a reverse Proxy (Like NGINX) in a public subnet to access a web server over port 80 in a private subnet? (I can't use an ELB for this use case)



https://redd.it/fh6mrs
@r_devops

Terraform concept needs to be explained

Hi guys, I've just started learning terraform and was messing around trying to create auto scaling group . I've come across a 'Lifecycle_hook' concept but didn't get it. Looking into the docs didn't help much. Could u explain what it does and how is it used? Thanks a lot

https://redd.it/fgt6ls
@r_devops

Seen this blog 'How to setup Role-based access to Kubernetes Cluster '?

If you are working on Kubernetes for some time you may have faced a scenario where you have to give some users limited access to your Kubernetes cluster. For example, you may want a user, say Alice from development, to have access only to some resources that are in the development namespace and nothing else. To achieve this type of role-based access, we use the concept of Authentication and Authorization in Kubernetes.

Broadly, there are three kinds of users that need access to a Kubernetes cluster:

#### 1. Developers/Admins:

Users that are responsible to do administrative or developmental tasks on the cluster. This includes operations like upgrading the cluster or creating the resources/workloads on the cluster.

#### 2. End Users:

Users that access the applications deployed on our Kubernetes cluster. Access restrictions for these users are managed by the applications themselves. For example, a web application running on Kubernetes cluster, will have its own security mechanism in place, to prevent unauthorized access.

#### 3. Applications/Bots:

There is a possibility that other applications need access to the Kubernetes cluster, typically to talk to resources or workloads inside the cluster. Kubernetes facilitates this by using [Service Accounts](https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/), which is a topic for another post. Here, we are going to focus on Role-Based Access Control (RBAC).

So the category of users that can be managed with RBAC is developers/admins. In a nutshell, when using RBAC, you would create users and assign them roles. Each role is mapped with certain authorizations, thus restricting each user to a set of actions defined by the roles they are assigned to. As of now, Kubernetes doesn’t have any mechanism to create or manage users inside the cluster. They need to be created and managed externally. Now let’s see Kubernetes RBAC in action.

What we will do here is create a user that will be allowed to do some tasks or access only some resources from a namespace. This user should not be able to perform any other tasks or access to any other resources.

[Read the full post here](https://www.infracloud.io/role-based-access-kubernetes/)

https://redd.it/fgu7xg
@r_devops

How to install eclipse che on kubernetes cluster that i have set with kubeadm ?

I followed too many guides but most of them use minikube which will create a single noded cluster but the one i have is installed on 3 VMs using kubeadm, is there any method to install eclipse che

https://redd.it/fgtt6y
@r_devops

Opinion of HR only interviews

I'm curious what peoples opinions are on being interviewed purely by HR?

I've got through to the final stage of an interview process, after going through technical screening, take home assignment and general conversation with the tech team.

I'm now being asked to have an interview with HR to look at my 'cultural fit' within the company.

My previous experience with this has always been negative. I generally feel a HR team can't accurately gage if you are suitable for a role, that decision should be made within the team you are joining, not by the HR team. Worse still they are likely to ask generic questions about performance which I never feel are relevant.

https://redd.it/fhgxyw
@r_devops

Using Litmus Chaos Engine on Kubernetes with Autonomous Monitoring for Verification

This [Github repository](https://github.com/zebrium/zebrium-kubernetes-demo) installs a demo app environment with multiple services on a Kubernetes cluster and runs a series of chaos experiments on the cluster. It then uses Autonomous Monitoring to automatically detect the issues caused by the chaos experiments. It's pretty cool!

https://redd.it/fhihxl
@r_devops

Kubernetes Cluster API updated to v1alpha3 and now supports launching clusters on 7 platforms

Cluster API allows you to bootstrap and manage clusters from Kubernetes itself. It can be seen as an operator for Kubernetes clusters.

The quickstart has been updated for v1alpha3
https://cluster-api.sigs.k8s.io/user/quick-start.html

Cloud platforms
* AWS
* Azure
* GCP

On-prem
* vSphere
* OpenStack
* Bare-metal (metal3 via openstack ironic)

dev
* docker (think KIND - kubernetes inside docker style)

https://redd.it/fhkl0o
@r_devops

Twelve Dot One Factor Apps (Blog Post)

I have been following the Twelve-Factor App methodology for a considerable amount of years. I mean, just like the Pirate Code, I see them more as guidelines than rules. There Is a factor I’d like to challenge. Can tell you how and why in this blog post I have written just for you ;)

[Twelve Dot One Factor Apps](https://zemanel.eu/posts/2020/03/twelve-dot-one-factor-apps/)

https://redd.it/fhk4xz
@r_devops

How to add external cluster to spinnaker

I have two Kubernetes clusters, I have Spinnaker deployed to dev and want to be able to run pipelines on prod. I can't seem to figure out how to add another cluster, I see something in the helm chart values file about adding a secret but not exactly sure what it fully means and google has been less than helpful today.

​

How can I add an external kubernetes cluster to my Spinnaker setup which was installed via helm - no text editor in the halyard container to create files with

https://redd.it/fhklcs
@r_devops

Back-end engineer wanting to change to full time DevOPS engineer, need some advice.

Title says that all, I've been doing back-end engineering for two years. After some serious thinking. I've decided to dig to DevOPS but I have no Idea from where should i start. I have been using docker for a while, as well as cloud, so I am not a total beginner. I want to get sufficient knowledge to get a job. Even as a Junior DevOPS engineer would be great

so if you could give me some video courses/books/resources I would be very grateful.

Much appreciated

https://redd.it/fho8t9
@r_devops

Are there any Legitimate DevOps bootcamps?

Edit: I should have added, I am seeking in person bootcamps.

https://redd.it/fhtqxl
@r_devops

Advice needed on monitoring solution

Hi,

I am asking you for advice regarding monitoring solution that will fit our set of constraints. Our team doesn’t have a lot of Ops experience, and we have to choose monitoring software based on our limited experience and knowledge. That’s why I am asking you for help.

The problem:

We will have to monitor a couple of VMs (about 20, owned by us), and a couple of servers not owned by us (no cloud). What we would need to monitor (at least for now):

1. **VMs** (owned by us): disk, cpu, ram usage, server availability
2. **VMs** (owned by us): hdd mounts (our infra is quite bad, and our hdds keep unmounting) - from monitoring system we would like to know when hdds were unmounted to know where the processes have been interrupted
3. **VMs** (not owned by us): disk, cpu, ram usage + obtaining info from custom software by running shell commands and reading info from stdout.
Main problem I have here is that those servers are not owned by our team. We can ssh to them, run shell commands, but for 99% we won’t be able to install any agent on them. Unfortunately we have to monitor those servers because we are running some intensive computations on them.

4. **sFTP** (not owned by us): availability and disk usage
5. Last but no least we will have to monitor few web-services that are running in docker containers

I think that for our needs it would make sense to use metric based monitoring (but I might be wrong here).
For now our infrastructure is very static (VM IPs don’t change), however from time to time we have to migrate to new VMs. In the future we will move to OpenStack to have more flexibility (no cloud allowed for now). We're also aiming to have most of our infrastructure as a code, so it would be nice if the configuration of proposed solution supported that.

What are your suggestions for monitoring solution here (especially for point 3)?

https://redd.it/fhqsr0
@r_devops

For Fun: How many of you think your infra is bad if you're not getting alerts (devops recursion)

Instead of accepting the fact that you've done a good job and are looking for more options to ensure your confidence, as its important to be on top of it. devops recursion.

https://redd.it/fhtncl
@r_devops

North American company - weird D-Day plan?

I work for a company that is mainly a North American company. As a developer I work remote a lot.. like I never see my desk. Well I had a call and I was put in a rotation to be on site in my local office once a week during this crisis. I’m not in a hard hitting zone yet but we are gaining numbers fast. But I am just wondering if anyone else is getting this. I think it is more “if IT can do it so can you” type of thing.

https://redd.it/fhtg4g
@r_devops