Is DevOps the answer to how to accomplish drastic & progressive changes in the workplace? I think so

I have always practiced a lot of the principles of what DevOps is founded on before I knew what DevOps was.

I started as a field tech, helpdesk, systems admin/engineer, then moved into a DevOps "swat team" role to help lead the charge with the culture shift. I've always focused on automation, visualized work, metrics-based decision making, monitoring, collaboration, the concept of feedback loops to help adjust and adapt to changing goals, priorities and objectives.

In hindsight, I can see many "I told you so" moments in my career. I've been a firm advocate for distributed workforce/WFH culture and enablement for many reasons. Now that it's critical to our economy and business operations, the "butts in seats = productivity" crowd seem to have evaporated into thin air. Pets vs cattle, "don't restore from backup, redeploy from source", immutable and distributed infrastructure, fault tolerance & high availability are all topics people are talking about again.

Be sure to take the opportunity with your peers and leadership to advocate for real, actual change to prevent this from happening again. Offer to help coordinate a retrospective to evaluate how problems/issues could have been prevented and find paths forward to implement your ideas (with some way to measure your success with quantifiable metrics/KPIs, of course).

Personally, I'm in the middle of a job hunt and have been steadfast on the WFH aspect. The hiring manager is ok with it, but the company culture would need to change so they're saying it is something that I’d need to help everyone work towards. With the recent events, I’m planning on being very firm on "no, I’m going to WFH now, and everyone else can catch up. I can help them if you want, but I’m not willing to give that up right now, it's too important to me".

My point is this: we're all valuable to the markets and industries we work in. We can be picky and push about the things we want, it's up to them to come to us. DevOps and Agile are 90% a culture shift, and that's what is truly needed to solve real, actual, hard problems that we're facing. We are uniquely capable of helping drive that change and steer its direction along the way. We're experts at adapting, learning, and surviving in chaotic & tumultuous environments.

https://redd.it/fk6zt3
@r_devops

NAGIOS and InsightVM with AWS EC2 best practices

Developer here that recently inherited some AWS infrastructure. Had a question on NAGIOS and InsightVM and best practices when used with EC2.

We have a vendor running vulnerability and NAGIOS scans from external servers against some of our EC2 instances. The security group for the EC2s is wide-open (all TCP port access) for these external servers.

​

This smells fishy to me ... someone can compromise those external servers and gain access. What are best practices? Run the scans from a private NAGIOS server inside our VPC?

​

Thanks for any advice!

https://redd.it/fk5bre
@r_devops

Autoscaling with Haproxy

[https://medium.com/devops-enthusiast/aws-autoscaling-for-haproxy-6aa35b44ebf7](https://medium.com/devops-enthusiast/aws-autoscaling-for-haproxy-6aa35b44ebf7)

Article on setting up AWS autoscaling with Haproxy as Load Balancer. Clap if you find it useful. Feedback is welcomed and appreciated.

https://redd.it/fk5h7s
@r_devops

Is inspec a good tool for testing file changes in Ubuntu systems

We are currently evaluating inspec to test our ubuntu systems. One of the our usecase is to test if contents of any of the configuration files have changed from the last time checked. In inspec I found the sha256sum which evaluates the checksum value of the file against what I manually calculate and store. But this seems to be a lot of effort to do as we have multiple environments with many config files ,to calculate the checksum of all files and store in one place is tideous.

Is there any other way in inspec that I can test this scenario ? Or should I look for another tool for this ?

https://redd.it/fk7j3v
@r_devops

Devops from scratch

Hi guys my organisation is moving to devops setup,I will be implementing this.i need help how can I acheive this .
I have worked in CICD and have decent knowledge about devops.

Git /Jenkins/sonarqube/junit these tools would be used .

how can I aquire configuration knowledge .

How to plan for this .

How can I practice or get help when I'm stuck.

How to make sure I don't break something in produc

https://redd.it/fk4bet
@r_devops

How to Answer "Containers" vs. "VM" Interview Question?

I've been asked this question several times during a job interview, and every time I'm left unsure on how to answer the question.

I've been also asked how does a VM work and also failed to give a proper answer.

How would you answer these questions?

https://redd.it/fk0jev
@r_devops

Terraform & Gitlab-CI



Hi,

We are trying to integrate terraform with gitlab-ci but are running into an issue when pipelines are run. The runner is using the shell executor Basically the pipeline will do a validate, plan and then apply once merged to master, however our plan always fails with:

`Error: No valid credential sources found for AWS Provider.Please see https://terraform.io/docs/providers/aws/index.html for more information onproviding credentials for the AWS Provideron main.tf line 1, in provider "aws":1: provider "aws" {`

`ERROR: Job failed: exit status`

The runner and gitlab are self hosted in AWS and there is a IAM instance profile attached to the EC2 instance which allows resources to be built so there is no need to have access keys. So there isn't a .aws/credentials file. When a plan is run from the cli using the gitlab-runner user it works no problem it only fails when its run as part of the pipeline, also aws commands work from the cli but not in the pipeline.

I have spun a runner up in my own AWS account using the same code, IAM instance role permissions etc and registered it against my own gitlab account and the pipelines run fine. Again there are no credentials stored on the server and its using the exact same gitlab-ci.yml file, there is no role\_arn in the provider block in the TF code. It just has the below:

`provider "aws" {`

`region = "eu-central-1"`

`}`

I have enabled debugging and can see the below

`Ignoring AWS metadata API endpoint at default location as it doesn't return any instance-id`

I can run a terraform plan from the CLI and it assumes the role fine.

`AWS EC2 instance detected via default metadata API endpoint, EC2RoleProvider added to the auth chain`

`plugin.terraform-provider-aws_v2.53.0_x4: 2020/03/17 08:01:15 [INFO] AWS Auth provider used: "EC2RoleProvider"`

`plugin.terraform-provider-aws_v2.53.0_x4: 2020/03/17 08:01:15 [INFO] Attempting to AssumeRole arn:aws:iam::00000000000:role/gitlab_runner_role (SessionName: "SESSION_NAME", ExternalId: "EXTERNAL_ID", Policy: "")`

Any help would be appreciated, i'm at a lose.

https://redd.it/fk24w7
@r_devops

What does an ideal team look like?

I was reflecting on some of the companies and their organization structure (whether companies I worked for or from what friends described) and realized I worked in different structures and was curious what you thought was the best one.


I've worked at a company with the traditional dev and ops silos. This obviously was pretty rough.


I've also worked at a company where they had developers on different projects (some might be on multiple) while the ops (made up of devops, sres, and infrastructure engineers) as a service oriented model. This model was 'OK' depending who serviced the Jira task or Service Desk ticket.


My favorite structure was where there was multiple disciplines on the same team responsible for a service. This was where there was one architect, a few software engineers, and a couple site reliability engineers.


As the last one seems to make sense (i.e. accountability), it made me reflect if we had a "healthy" balance between software engineers and site reliability engineers and if this was the norm. This company had their infrastructure in the cloud, which I believe made it easier as the other experience I had was primarily on premise (hence the need for system administrators + network administrators). I'm also curious if any on premise company had something similar to the cloud company I've worked for in the past (SWE + SREs on a single team, thus making the SREs need that networking + system administrator knowledge such as virtualization).

https://redd.it/fjx2e4
@r_devops

How are teams adjusting priorities b/c of COVID-19

My startup, like many others, are now thinking, "how do we survive the next 12 months?" We were planning on building new products but are now thinking of re-architecting our backend for two reasons:

1. get rid of some tech debt we've built up b/c of fast growth
2. save costs

We're on AWS but heavily considering GCP because of their K8 expertise and cost efficiencies.

How are others thinking about priorities given the new COVID-19 world?

https://redd.it/fjve21
@r_devops

(Probably) irrational fear of code theft when hosted in the cloud

Anyone suffer from the (probably stupid) idea that if you host a private repo on some company's server--or use some other company's deployment service--that either one of those companies will steal all your code and ruin you?

It's also not like this code is the Google search algorithm or anything but wondering if I am alone in this. I'll even go so far as to split my repositories so they live on two different hosts with the thought that, "at least all my intellectual property is split up on servers belonging to two different companies so they no one entity can see everything."

I guess it makes me feel better to know I am diversifying but it's also annoying/adds complexity when you have to remember how the GUI of two different hosts/services work when you need to setup or check on things.

It's a tug-of-war between consolidation and simplification and the nagging thought that I ought not put all my eggs in one basket.

https://redd.it/fjr50w
@r_devops

Maniac: Stop wasting time writing docs

Hey everyone!
I'm launching this tool soon and would love some feedback!

[https://trymaniac.com](https://trymaniac.com/)

The idea is to allow developers to run their documentation based on their code. This means:

* Autocomplete suggestions based on the codebase and previous docs
* Code tracking that warns you when documentation looks stale
* Autoupdating where docs will update based on the changed code

Is this something you'd use?

https://redd.it/fkh43i
@r_devops

Spotify Open-Sources Backstage Developer Portal

(disclaimer, I'm an employee(SRE), work with the project but not ON the project).

[https://github.com/spotify/backstage](https://github.com/spotify/backstage)

https://redd.it/fjnhhf
@r_devops

I can't access my private instance port 80 using my private ip passed to nginx.

error_log /var/log/nginx/error.log;
events {}
http {
server {
listen 443 ssl;
server_name 161.2.60.96;
ssl_certificate /etc/nginx/ssl/cert.crt;
ssl_certificate_key /etc/nginx/ssl/private.key;
location / {
proxy_pass "ip-10-0-159-78.us-gov-west-1.compute.internal:8443/";
}
}
}

Am I not allowed to use a Reverse Proxy to access a private subnet web server?

https://redd.it/fjuddr
@r_devops

Question for r/devops

Would people be interested in contributing articles/tutorials/war stories for a bi-weekly or a monthly newsletter? There seems to be a lot of knowledge here that could be better shared as a newsletter instead of scattered questions and answers.

https://redd.it/fjtqu0
@r_devops

I started working as web systems engineer at top financial firm in US. I want to navigate towards Devops engineer role with AWS cloud later down the road. My current job uses only on-prem and I work on production environment. Is it hard to learn AWS later since I work on only on-prem cloud?



https://redd.it/fkk156
@r_devops

Do not log

> Almost every week I accidentally get into this logging argument. Here’s the problem: people tend to log different things and call it a best-practice. And I am not sure why. When I start discussing this with other people I always end up repeating the exact same ideas over and over again.

> So. Today I want to criticize the whole logging culture and provide a bunch of alternatives.

Link: https://sobolevn.me/2020/03/do-not-log

https://redd.it/fjn28r
@r_devops

Publishing Application Metrics to Azure Monitor Using Micrometer

Observability is the activities that involve measuring, collecting, and analyzing various diagnostics signals from a system. These signals may include metrics, traces, logs, events, profiles and more.

Especially in a DevOps culture, where automation is key in order to stay productive, observability plays an important role.

Micrometer provides a simple facade for the JVM for a number of popular monitoring systems to collect application specific metrics. Currently, it supports the following monitoring systems: Azure Monitor, Netflix Atlas, CloudWatch, Datadog, Dynatrace, New Relic, Prometheus, And many other providers.

In this article, we'll introduce the basic usage of Micrometer with Azure and its integration with Spring boot 2.

[https://dev.to/silviobuss/publishing-application-metrics-to-azure-monitor-using-micrometer-plk](https://dev.to/silviobuss/publishing-application-metrics-to-azure-monitor-using-micrometer-plk)

https://redd.it/fjo3n9
@r_devops

not able to list the s3 policy

`import boto3`

`from botocore.exceptions import ClientError`

`import json`

`import os`

`ACL_RD_WARNING = "The S3 bucket ACL allows public read access."`

`PLCY_RD_WARNING = "The S3 bucket policy allows public read access."`

`ACL_WRT_WARNING = "The S3 bucket ACL allows public write access."`

`PLCY_WRT_WARNING = "The S3 bucket policy allows public write access."`

`RD_COMBO_WARNING = ACL_RD_WARNING + PLCY_RD_WARNING`

`WRT_COMBO_WARNING = ACL_WRT_WARNING + PLCY_WRT_WARNING`

`def policyNotifier(bucketName, s3client):`

`try:`

`bucketPolicy = s3client.get_bucket_policy(Bucket = bucketName)`

`# notify that the bucket policy may need to be reviewed due to security concerns`

`sns = boto3.client('sns')`

`subject = "Potential compliance violation in " + bucketName + " bucket policy"`

`"Potential bucket policy compliance violation. Please review: " + json.dumps(bucketPolicy['Policy']),`

`# send SNS message with warning and bucket policy`

`response = sns.publish(`

`TopicArn = os.environ['TOPIC_ARN'],`

`Subject = subject,`

`Message = message`

`)`

`except ClientError as e:`

`# error caught due to no bucket policy`

`print("No bucket policy found; no alert sent.")`

`def lambda_handler(event, context):`

`# instantiate Amazon S3 client`

`s3 = boto3.client('s3')`

`resource = list(event['detail']['requestParameters']['evaluations'])[0]`

`bucketName = resource['complianceResourceId']`

`complianceFailure = event['detail']['requestParameters']['evaluations'][0]['annotation']`

`if(complianceFailure == ACL_RD_WARNING or complianceFailure == ACL_WRT_WARNING):`

`s3.put_bucket_acl(Bucket = bucketName, ACL = 'private')`

`elif(complianceFailure == PLCY_RD_WARNING or complianceFailure == PLCY_WRT_WARNING):`

`policyNotifier(bucketName, s3)`

`elif(complianceFailure == RD_COMBO_WARNING or complianceFailure == WRT_COMBO_WARNING):`

`s3.put_bucket_acl(Bucket = bucketName, ACL = 'private')`

`policyNotifier(bucketName, s3)`

`return 0 # done`

​

When i test the lambda function getting below error.

​

`Response:`

`{`

`"errorMessage": "'detail'",`

`"errorType": "KeyError",`

`"stackTrace": [`

`[`

`"/var/task/index.py",`

`30,`

`"lambda_handler",`

`"resource = list(event['detail']['requestParameters']['evaluations'])[0]"`

`]`

`]`

`}`

​

`Request ID:`

`"6d5e20e3-652a-4476-9ddb-2c3a396bbc07"`

​

`Function Logs:`

`START RequestId: 6d5e20e3-652a-4476-9ddb-2c3a396bbc07 Version: $LATEST`

`'detail': KeyError`

`Traceback (most recent call last):`

`File "/var/task/index.py", line 30, in lambda_handler`

`resource = list(event['detail']['requestParameters']['evaluations'])[0]`

`KeyError: 'detail'`

​

`END RequestId: 6d5e20e3-652a-4476-9ddb-2c3a396bbc07`

`REPORT RequestId: 6d5e20e3-652a-4476-9ddb-2c3a396bbc07 Duration: 1484.41 ms Billed Duration: 1500 ms Memory Size: 128 MB Max Memory Used: 73 MB Init Duration: 161.87 ms`

​

Can i anyone help me.

Copied the code from

[https://aws.amazon.com/blogs/security/how-to-use-aws-config-to-monitor-for-and-respond-to-amazon-s3-buckets-allowing-public-access/](https://aws.amazon.com/blogs/security/how-to-use-aws-config-to-monitor-for-and-respond-to-amazon-s3-buckets-allowing-public-access/)

​

Thanks.

https://redd.it/fkm5kz
@r_devops

Moving from ProGet to Artifactory or Nexus?

How easy is it to maintain and support Nexus or Artifactory?

I'm looking into getting a different package repository because of new demands from vendors and developers. Our current package repository, ProGet, has a few limitation when it comes to Maven feeds and according to a vendor it's not really suited for docker containers.

So now I'm currently (trying to) setting up Artifactory with ldap integration and multiple local file storages. I've setup multiple applications before, where some tweaking is required, however Artifactory is a different level. This application is both very demanding and vexing, not to mention the learning curve .. there is no curve .. just a wall of ambigious documentation. The documentation is not really clear from my point of view.

There are a myriad of config files on the server which needs to be tweaked. Some settings are in the GUI, but it's really just config files directly stored on the server instead of the database (facinating really ...). What worries me, is how Artifactory will be like to maintain; Are upgrades a nightmare or something that is easy to handle?

In comparison:

TeamCity - config ldap, sql and a few other things and you are pretty much set. The upgrades are done in the web interface.

Bitbucket - lots of settings are set in the web gui, upgrades requires an executable installer

ProGet - inedo hub upgrades for you

https://redd.it/fjldvf
@r_devops

DevSecOps(DevOps Security)- What is your best practice to embed Security into DevOps

In recent years, many software firms are turning towards the use of DevOps Services to build their applications. DevOps has been providing a much faster time for the marketing of the software. It provides a platform for deploying applications in the cloud environment i.e., Cloud DevOps.

There are many companies that provide Cloud DevOps Security consultation. So the vulnerabilities that lie within the software are exposed, which initiates the necessity of a security strategy to be implemented for the application development right from its early stages, and not just at the end to prevent & overcome any of the unanticipated problems.

Now, with the use of DevOps for software development, novel strategies need to be in place to embed security aspects in the development to ensure that the software is not vulnerable to the various attacks by hackers or malicious users. So, the answer that software developers are looking for is DevSecOps.

Here are key best practices for organizations "[Incorporating The 10 Best Security Practices Of The Industry](https://addwebsolution.com/blog/devsecops-incorporating-ten-best-security-practices-industry)".

As a business organization, what is your security practice and what is your take on the DevSecOps?

let's be aware of the change that is taking place in the world of Cloud.

Share your thoughts and insight into the topic.

https://redd.it/fjksqe
@r_devops