What exactly is a DevOps Architect?

As a DevOps Architect, I get a lot of questions about what that means and how do you become an "architect" vs. a DevOps Engineer, so I did a quick write-up to try to explain some of those differences. Let me know what you think! Does your organization have a DevOps Architect? Who plays that role if you don't have one?
[https://medium.com/@tjblogumas/what-exactly-is-a-devops-architect-a27e5a5c728b](https://medium.com/@tjblogumas/what-exactly-is-a-devops-architect-a27e5a5c728b)

https://redd.it/g1b75x
@r_devops

DIY Single Sign-on for SSH

[https://smallstep.com/blog/diy-single-sign-on-for-ssh/](https://smallstep.com/blog/diy-single-sign-on-for-ssh/)

This is a follow up to [a blog post from late last year about SSH certificates](https://smallstep.com/blog/use-ssh-certificates/) (that post is #15 for the year on r/devops; [discussion here](https://www.reddit.com/r/devops/comments/d3b7n1/if_youre_not_using_ssh_certificates_youre_doing/)).

By using OAuth OIDC to authenticate to your SSH certificate authority, you can use certificates to implement "single sign-on for SSH". That means:

* No more SSH public key management; SSH access is provisioned and deprovisioned when users are added / removed on G Suite (or whatever other OAuth OIDC identity provider you use).
* SSH credentials are ephemeral, rotated frequently, and never hit disk. It's much harder for an attacker to jump from a popped endpoint into your production environment via SSH.
* SSH trust on first use warnings and host key verification failures go away. You can safely rekey hosts and reuse hostnames.

Last time we posted here all of the pieces weren't in place to make this easy. We just pushed a new open source release, and now they are. This post explains how to use them. It uses the open source [step](https://smallstep.com/cli/) and [step-ca](https://smallstep.com/certificates/) toolchain, which have been upgraded since last time to address some of the issues that you guys raised. We also released a hosted product today where we run the CA for you, but this post is all about how to do it yourself with open source.

https://redd.it/g1aks9
@r_devops

Looking to do an informational interview with somebody in DevOps

Hello, I am an undergrad going through a career building program with my university, and one of the things we are required to do is perform an informational interview with someone in our field of interest, which for me is DevOps. I originally had someone local lined up but the insanity of this virus put that on hold. If anyone would be interested in helping me with this, it should be a fairly short interview (maybe 20 mins or so) which we can do over phone or a voice/video chat service of your choice. It will mostly be basic questions about your job duties and how you worked up to that position.

Leave a comment or PM me if you are interested, it would be a great help to me.

EDIT: I have received a couple responses, thank you!

https://redd.it/g1di7k
@r_devops

Ask /r/devops: What would you like to see in a weekly DevOps newsletter?

Hey all.

I've been trying to work out what the best content would be for a weekly newsletters about DevOps, CloudOps, Automation and the tools that we use day-to-day. I was wondering what it is you would want to see?

So far I'm thinking:

* Tips/tricks on the tools I use
* Commentary on ideas and thoughts shared by others in the community
* Answering a common question I see
* Providing links to use resources
* Taking in questions from the community and providing an answer to them in the newsletter

What are your thoughts? If you were to get a weekly newsletter about DevOps, CloudOps, Automation, tools, etc, what would you want to see? What would keep you reading? :-)

https://redd.it/g1dxns
@r_devops

Does anyone automate the generation of visio/architecture diagrams?

What tool do you use?

https://redd.it/g1j2m6
@r_devops

GitHub actions vs Gitlab CI

I’m currently using GitLab and I like the CI experience. However with GitHub’s new announcement, they’re becoming more and more of a viable competitor to GitLab.

Has anyone had experience with GitHub actions and how they compare with GitLab’s CI?

If GitHub’s CI offering is a viable option I would switch in a heartbeat since GitLab’s UI is pretty unintuitive at times. GitHub’s code review commenting and many other UI features are just much easier to use overall.

https://redd.it/g1i9mc
@r_devops

Working style for Devops

In your work, do you find yourself the only person on a project or are you usually paired up with someone on the job?

https://redd.it/g1hqyt
@r_devops

Why is inter-service TLS desirable?

I have a production load at the moment without TLS enabled between services nor between services an externally listening ingress. TLS terminates at the ingress from the client. Internal services have no public IP address. I am the only one with direct access to the cluster.

If it's a single cloud environment that can only be accessed locally does it matter? What are the risks / attack vectors? Or where can I learn more about it? Tell me why I'm an idiot.

https://redd.it/g1h41y
@r_devops

What would you invest in learning, Openshift, Splunk , Infoblox?

I've doing K8S tools for the last 3 years and I am not sure which of those 3 ( openshift, splunk or infoblox) would add more value to my Skillset. At this point I don't want invest more effort in learning or mastering K8S and just want to jump into something else.

Openshift . Pros - easier to learn given my k8s exp and the $ rate is above devops rates . Cons - I don't see many jobs requiring it.

Splunk . Pros - very valuable $$$$ niche skill . Cons - Takes a lot in time/$$$$ wise to learn it .

Infoblox - I had some experience in the past , and I've seen a couple of roles in the market paying above market rate for this skillset .

What do you think ?

https://redd.it/g1c91b
@r_devops

Infrastructure Automation with Terraform and Atlantis

If anyone out there is using Jenkins to automate Terraform , Atlantis is worth taking a look. I have been using Atlantis for quite sometime now and love it. Actively using to spin up production infrastructure. Here is my medium blog if anyone is interested
https://tech.boxed.com/infrastructure-automation-with-terraform-0-12-and-atlantis-1a5725ee247e

https://redd.it/g1ftgh
@r_devops

WTF is wrong with full remote positions?

I eventually found a local office job that is currently 100% remote due to COVID, I'll go back to office after all this and will be fine.

But I'd like to discuss weird remote job market I had recent experience with.

About half a year ago I decided that it's damn cool to have fully remote position, primarily because it's possible to live in a cheap place, commute to next room and work in pajamas. Then I started my search, and it was pretty bad.

First - amazingly few positions are posted. There are more offline positions here, in Greater Detroit (that is not Bay Area guys), than remote positions in whole US.

Second - terrible conversion rate. I was getting around 1 tech interview for every 5-10 applications for traditional jobs. For online it was like 1 tech interview for 30-50 applications. It's completely crazy.

I have 15+ years of experience in system admin, both win and linux, last 4 is in DevOps/Cloud - theoretically my skills are in demand, that's not the problem I guess.

What's your experience?

https://redd.it/g1i7lo
@r_devops

Reusing Serverless Environments in your CI Pipeline to Reduce Serverless Integration Test Runtime from 40 minutes to 7

Recently my team managed to reduce the time taken to run Integration Tests on our Serverless microservice via CI from 40 minutes to 7 minutes!

We used another Serverless microservice to manage the re use of Serverless envrionments and CircleCI’s parallelisation tools. Check out my article if you’re interested!

https://medium.com/serverless-transformation/reducing-your-serverless-integration-test-runtime-on-ci-from-40-minutes-to-7-a8982a47b655

https://redd.it/g19fdg
@r_devops

CICD Pipeline for multiple services on AWS ECS with ECS ComposeX

[x-post](https://www.reddit.com/r/aws/comments/g0kezz/cicd_pipeline_for_multiple_services_on_aws_ecs/) from r/aws.

My first blog post of what I hope to be a regular series of articles around DevOps work. Feel free to submit any ideas on the [GH repo for the blog](https://github.com/lambda-my-aws/blog.ecs-composex.lambda-my-aws.io) and report any issues with [ECS ComposeX](https://github.com/lambda-my-aws/ecs_composex) or submit PRs.

Thanks!

https://redd.it/g198h5
@r_devops

How do you become certified in DevOps?

I am seeing positions that include text like the following: "A solid understanding of tools such as Chef, Python, PowerShell, Docker, Puppet, AWS CloudFormation, AWS, Ansible, and Kubernetes."

Let's say you learn some (or all) of these technologies at home, taking advantage of this time during pandemic.

How would you prove to prospective employers that you are capable with these technologies? Would you list on your resume the Udemy courses taken or books read, etc?

https://redd.it/g1brbc
@r_devops

upgrading multiple repo's/Deploying multiple projects with a multi-repo Design?

Hey everyone,

currently just testing this because of curiosity.. switched from a single repository where all deployment files for each container/vm reside to a "per service" design. Reason for this is that i want to improve the automated deployment of new services, and i think that switching from a monorepo to multiple ones could help here.

Every repo now looks kinda like this (example from a webcrawler project):

├── crawler <- sourcecode
│   └── crawler.py
└── deployment <- deployment files
├── deploy-int.yml
├── deploy-prod.yml
├── inventory <- ansible inventory directory container variables for each host
│   ├── host_vars
│   │   ├── crawler.local
│   │   │   └── vars.yml
│   │   └── database.local
│   │   └── vars.yml
│   └── inventory <- inventory file
└── roles <- ansible roles, included as a submodule from another repo

I have to say that i like this design. I am creating new repos for services with cookiecutter, this made the deployment process a lot easier. Also, since every service has its own repo, its easy to find out how a certain service has been configured and deployed. Inside the deployment folder are all the files which are needed for ansible to spin up the needed containers/vms, and depending on which role i add to the deploy-xxx.yml files they are also provisioned like needed.

But i have one problem with this setup:
There are situations where i feel like a single repo with every service repo could be really handy.

For example, how would i deploy a whole "site" with this design? Lets say everything burns down and a new host system is already set up but no containers/vms have been deployed yet. What i want is to push a single big red button which says "DEPLOY IT ALL!" and every service gets deployed. With a monorepo, this is an easy task because all the inventory files are in the same directory. But how do i get those when each service has its own repo? Also, how do i keep them in sync?
Not saying that a whole infrastructure burns down regularly, but i want a solution for this just in case..
I think what i need is a master repo which includes all the service repos, but not sure how i should keep it up to date. Maybe a webhook inside the deployment process of new services could do the trick?

Has someone here been in a similar situation? Or can someone think of an better solution to this? Drone is being used as a ci/cd system, maybe a site deployment can be triggered from there somehow?

Any help and hints appreciated, thanks in advance! :)
Also, sorry for any wording or grammatical errors.

https://redd.it/g1572m
@r_devops

Export amazon image into IBM cloud

Hello,

I've a VM running in AWS and want to move it to IBM Cloud. Is this supported yet? I would like to use the Amazon AMI to bring a new VM in IBM Cloud. TIA

https://redd.it/g188j1
@r_devops

Grafana - aggregating traffic graphs

Hi,

I've got some Juniper routers doing streaming telemetry into Grafana (using OpenNTI), and have currently got traffic graphs in bps per interface.

I'd like to create a single aggregate traffic graph, showing the combined inbound/outbound values of say three interfaces.

Does anybody know how to do this?

https://redd.it/g149wf
@r_devops

Telegraf/Prometheus/Grafana snmp monitoring

Hi,

I'm trying to do some SNMP monitoring for some a Cisco ASA device, I've figured out the SNMP part with Telegraf, but the next part is putting this into Prometheus, and then Grafana.

The SNMP data is being polled using an `snmp.table`, as there are multiple values in a list format.

Here is my telegraf.conf:

[agent]
hostname = "myhostname"

[global_tags]
[[inputs.snmp]]
agents = ["mydevice:161"]
version = 2
community = "mycommunitystring"
name = "snmp"
name_suffix = "_parsed"
[[inputs.snmp.field]]
name = "ike_tunnels"
oid = "iso.3.6.1.4.1.9.9.171.1.2.1.1.0"
[[inputs.snmp.field]]
name = "ipsec_tunnels"
oid = "iso.3.6.1.4.1.9.9.171.1.3.1.1.0"
[[inputs.snmp.field]]
name = "hostname"
oid = "iso.3.6.1.2.1.1.5.0"
is_tag = true
[[inputs.snmp.table]]
inherit_tags = ["hostname"]
name = "snmp"
[[inputs.snmp.table.field]]
name = "vpn_peer_ip"
oid = "iso.3.6.1.4.1.9.9.171.1.2.2.1.7"
conversion = "ipaddr"

[[outputs.prometheus_client]]
listen = myprometheusserver:9222"
metric_version = 2

This will output to this:

2020-04-14T08:43:23Z I! Starting Telegraf 1.14.0
> snmp_parsed,agent_host=mydevicehostname,host=myhostname,hostname=ciscodevicename ike_tunnels=43i,ipsec_tunnels=49i 1586853803000000000
> snmp_parsed,agent_host=mydevicehostname,host=myhostname,hostname=ciscodevicename vpn_peer_ip="1.1.1.1" 1586853803000000000
> snmp_parsed,agent_host=mydevicehostname,host=myhostname,hostname=ciscodevicename vpn_peer_ip="2.2.2.2" 1586853803000000000
> snmp_parsed,agent_host=mydevicehostname,host=myhostname,hostname=ciscodevicename vpn_peer_ip="3.3.3.3" 1586853803000000000

Prometheus will pick up the first data which includes `ike_tunnels` and `ipsec_tunnels` but it will skip the table data, which is a list of `vpn_peer_ip`, and I think that is because it is in the list format. See screenshot:

[Prometheus output screenshot](https://pasteboard.co/J3KhaqQ.png)

Meaning in grafana, I can query `snmp_parsed_ike_tunnels` and also `snmp_parsed_ipssec_tunnels` so why is it that I cannot capture the snmp table, assuming this would be `snmp_parsed_vpn_peer_ip`?

Now, I am not sure if my telegraf.conf is invalid/incorrect for what I want it to do, or does Prometheus not support this? I've spent quite a few days on this already, and I feel like I've run out of ideas, so looking for some help/direction.

Thanks.

https://redd.it/g123fn
@r_devops

Three-tier architecture: Log management

Hello,

I'm trying to understand log management tools. Can someone just explain how these stacks are built? Frontend is easy, but what about the database, the shiptool and the processing? What does Graylog do? What is the difference between EFK and ELK (okay, Logstash and Fluentd, but Logstash is again an independent log management solution).

I am happy about your answers :)

https://redd.it/g10mew
@r_devops

Pipeline and architecture drawing tools

What tool do you use to draw and graph your automation pipelines and architectures?

https://redd.it/g1y4gb
@r_devops