Distributing Secrets for PowerShell Scripts with Ansible

Hi guys,

I did a little project over the weekend:

I wanted to distribute secrets for Windows users to use in scripts, using the Windows builtin local vault.

link: [https://dev.to/mieel/how-to-distribute-secrets-for-powershell-scripts-using-ansible-3mne](https://dev.to/mieel/how-to-distribute-secrets-for-powershell-scripts-using-ansible-3mne)

**tl'dr**: I'm using the [Microsoft SecrectsManagement](https://devblogs.microsoft.com/powershell/secrets-management-development-release/) Module to populate the users local vault, and using Ansible to automate this for multiple machines/users.

I declare the user/secrets mappings in an ansible-encrypted file, and run a playbook to deploy them in my environment. When the play has finished, users can use `Get-Secret` to retrieve the secret.

Any feedback would be much appreciated! Thanks.

https://redd.it/g2wmuc
@r_devops

Jenkins-X vs Drone.io for a small team of developers

I'm a developer. My team is looking for a new CI/CD tool (we were using a commercial tool but we got the go from our IT department to try an open source alternative).

We are not very mature in DevOps and GitOps practices (except basic knowledge), so we are afraid to be overwhelmed with an opinionated solution like Jenkins-X. On the other hand, its capabilities are very appealing (like automatic previews on pull-requests).

Or we can choice [Drone.io](https://Drone.io) which looks similar (cloud native) but offers less features (but I might be wrong).

I don't want to launch a solution war in this post. I just want to know both pro and cons solely based on your experiences. We know nothing can be better than trying and finding our match by ourselves, but having real world feedbacks will surely help getting a mature decision and adjusts our expectations.

Thanks.

https://redd.it/g3bdc5
@r_devops

Pain point in implementing git flow

I'm trying to implement a git flow-like process for our company. Currently our process is a simple two branch model with a develop branch and a master branch. Weekly, we merge develop into master and stage master, test it and patch/re-stage as needed, then merge master back into develop with the patches and deploy master to prod.

This winds up polluting the master branch with all of the unnecessary commits and patches in develop. Furthermore, it makes rollbacks hard because a "stable release" is only defined as whatever commit the HEAD of the master branch is at when it's deemed ready. We tag it, but that's all.

I'd prefer to stage and test a release/qa branch, which is then tested and only merged into master for releases. I also like the git flow concept of every commit on master being a release or hotfix and guaranteed clean working code, but I'm having trouble implementing this in practice.

In my test framework I have three branches: `develop`, `qa`, and `master`.

Each week we cutoff by making the develop and qa branch the same:

git checkout qa
git reset --hard develop

The qa branch is tested and patched, as needed. When it's ready, I want to then merge qa into master a a *single commit* representing that stable release, then merge master back into develop. However I haven't figured out how to do this elegantly.

git-flow recommends using a --no-ff merge to force creation of a merge commit, and then tagging HEAD:

git checkout master
git merge --no-ff qa
git tag v1.2

However, this has the undesirable effect of migrating all dirty commits from develop into master. I have experimented with a way to get a single commit on master representing the whole release:

git checkout master
git merge develop --no-ff -m "Release 1.2"
git reset --hard HEAD~1
git cherry-pick -m 1 HEAD@{1}
git tag v1.2

This gets me pretty close to what I want, but it makes it so that when I then merge down master back into develop, I get both my release commit AND a merge commit. I can't merge `--ff-only` because I have a different set of commits on master and develop. And it makes diffs in github hard to read because they use three dot diffs instead of two.

It's possible I'm thinking about this all wrong, and would love some feedback. My ideal solution would let me have the master branch composed entirely of clean composite commits, each representing a release or hotfix. In addition, I'd also like to avoid adding unnecessary commits to develop, and wind up having a `Release 1.2` and `Merge branch 'master' into development` commits side by side for each release, summarized in the title: I want to merge dev -> master as a single commit, then merge --ff-only when I merge qa back into dev.

https://redd.it/g3ayi1
@r_devops

Run Command doesn't recognize AWS EC2 instance - help

*Crossposted in* r/aws *but autoremoved...*

Hey guys, got a little problem I can't figure out. Following a course yesterday on AWS, I managed to create a VPC, subnets, NAT gateways and a load balancer. I also created 2 EC2 instances in two availability zones and pointed them as a target for the Load Balancer. Then I did "Run Command" from Systems Manager to install a basic Apache webserver and it all worked well, I was able to hit both instances through the load balancer. Problem is:

Today I deleted everything and recreated it to just learn it really well. Everything seems fine but the instance(s) don't show up in the Run Command. I created the proper SSM role (with AmazonEC2RoleforSSM & AmazonSSMFullAccess) and attached it to the instance. But when I go into Run Command, the instance just doesn't show up! Why? I've been trying to figure this out for an hour...

I am in the same region (N. Virginia) on both the EC2 page and the Systems Manager page. I tried deattaching security groups or just having ingress and egress wide open for the instances and load balancer + NAT gateways but still nothing. What am I missing? Why is it not showing up?

Thank you for the help

p.s. I'm thinking it could be my subnets and my routing tables are not set up correctly, but I actually didn't delete them from yesterday so it should be the same. maybe I didn't configure the new NAT gateways properly?

edit: the instance image is the default AWS Linux one that has the AWS tools already installed by default. t2.micro, same as yesterday. I click on "Choose instances manually" in the Run Command console, and I get the "You do not have any registered managed instances in this region" error message. Tried both root account and IAM admin user.

https://redd.it/g39neh
@r_devops

Seeking Recommendations for a Knowledge/Training/Documentation Platform

Hey guys, I'm looking for recommendations for a solid platform that can deliver the following capabilities. I'm offering to paypal beer money and buy a 6-pack for whoever suggests the platform that seems like the best lead. Hit me with what you got!

**Capabilities Needed:**

* Store user-facing documentation for each department in the org as a sort of high-level organization directory for each team, tool, IT process. The goal is to build a an org directory and landing page with introductory materials for each team's tools, processes, interfaces, and common customer-facing informtion and links.

* Provide some light e-learning style training materials for each IT platform and tool in the org - stuff like videos, KB's, and tutorials. I would ideally like to organize these materials into courses/categories.

* It must be easy for each team to administer their own content

* Bonus Points if the platform can support doing qual-cards/skill matrixes/track internal certification.

Explanation: Our IT organization is huge and there is virtually no onboading orientation for new IT employees/contractors. It takes about 2 years for a new hire to get their bearings enough to navigate the system effectively, and each person must individually build their own list of processes, documentation, links, and resources.

Our goal is to centralize all of this information in a way that is easy to consume. The platform would support a new "new hire orientation" process designed to expose them to the key teams, systems, and processes they will need as IT staff. This system will also need to support light training/qualification courses where teams can build out week-long training sessions on specific tooling, such that people who need access can get their access provisioned, understand the major components and processes, gain exposure to best practices and common tasks, and generally gain a high-level understanding of the sprawling IT organizations and teams at play.

Willing to look at SaaS, open source, or commercial products (with a preference for Open Source) - from SharePoint to Confluence. What can you recommend for this purpose?

https://redd.it/g3duqa
@r_devops

Post deployment ECS API validation testing

Been working on expanding our post deployment tests for an ECS hosted REST API. Currently the suite has some basic smoke test calls the all the endpoints. I wanted to expand into more validating the, I guess you could say "ops" perspective, as the endpoints already have an extensive functional test suite which is ran prior to deploying. I'm thinking about doing some boto3 calls to check that the task/service is running etc. What type of stuff can/should I test for here to validate it's good?

https://redd.it/g3dnzr
@r_devops

Does Solr or ElasticSearch work better with search terms from a HSQLDB or MySQL database?

I am new to Solr. I just know it takes json queries. I wish to know as much as possible.

​

Also if my hypothetical task is to search multiple queries into one unstructured lengthy text to see which queries get a hit, which search would be best?

https://redd.it/g3hd5j
@r_devops

COVID-19 IMPACT ON devops ENGINEERING

Hi! I am interested in speaking with dev-ops engineers whose work has been impacted by COVID-19 for an article. Can be on or off the record, anonymous is totally fine as long as I can confirm any details. Please feel free to reply here or PM me if you're interested in speaking with me! Any insights are extremely helpful.

https://redd.it/g39u98
@r_devops

Is Jenkins the best on prem build tool?

For a variety of reasons, we're forced to use only on prem build tools. And while there's tons of hosted options out there, there seems be very little competition otherwise.

We did look into team city, but got a bit of sticker shock. We don't mind paying for tools, but holy shit.

https://redd.it/g3gibh
@r_devops

Linux vs aws, azure

My job is kinda forcing me towards the middleware red hat amq route. I don’t know jack about it so I’m thinking of signing up to Linux academy. On there I see courses for aws, azure. I don’t get it what does Linux have to do with azure. Doesn’t Microsoft have its own os? I can understand why aws would run on Linux I suppose.

Second question are the terms middleware, devops cloud. Are middleware and devops considered cloud tech? Thanks

https://redd.it/g3f7n3
@r_devops

Has anyone setup Jaeger with AWS Elasticsearch

I'm trying to setup Jaeger with AWS ES, but I get the following error from the jaeger collector

```
"failed to create primary Elasticsearch client: health check timeout: no Elasticsearch node available"
```


```
{"level":"fatal","ts":1587117078.5171704,"caller":"command-line-arguments/main.go:70","msg":"Failed to init storage factory","error":"failed to create primary Elasticsearch client: health check timeout: no Elasticsearch node available","stacktrace":"main.main.func1\\n\\tcommand-line-arguments/main.go:70\\[ngithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra.(\*Command](https://ngithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra.(*Command)).execute\\n\\[tgithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra/command.go:698\\ngithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra.(\*Command](https://tgithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra/command.go:698\ngithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra.(*Command)).ExecuteC\\n\\[tgithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra/command.go:783\\ngithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra.(\*Command](https://tgithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra/command.go:783\ngithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra.(*Command)).Execute\\n\\[tgithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra/command.go:736\\nmain.main\\n\\tcommand-line-arguments/main.go:117\\nruntime.main\\n\\truntime/proc.go:203](https://tgithub.com/jaegertracing/jaeger/vendor/github.com/spf13/cobra/command.go:736\nmain.main\n\tcommand-line-arguments/main.go:117\nruntime.main\n\truntime/proc.go:203)"}
```

I am using the official Jaeger chart.

Following is a curl response from the ES cluster,

```
root@ubuntu-84697fcc95-bvg7t:/# curl -X GET https://xxxxxxx.es.amazonaws.com:443/_nodes/http?pretty
{
"_nodes" : {
"total" : 2,
"successful" : 2,
"failed" : 0
},
"cluster_name" : "xxxxx",
"nodes" : {
"9HtXgDe-SBqYLEkFtx4vrA" : {
"name" : "9HtXgDe",
"version" : "6.2.3",
"build_hash" : "c59ff00",
"roles" : [ "master", "data", "ingest" ]
},
"u3xYMULYR0ObHsuUOKKdXQ" : {
"name" : "u3xYMUL",
"version" : "6.2.3",
"build_hash" : "c59ff00",
"roles" : [ "master", "data", "ingest" ]
}
}
}
```

https://redd.it/g2z19z
@r_devops

Docker project idea suggestions for newbie

Hey there I am new to DevOps, I am learning docker right now, I was given a task to use docker and solve any common problem that a developer or any person faces in daily life, I am out of ideas, would anyone of you suggest something😅,
Currently I have basic knowledge about docker containers, volumes, network, patting(port address translation), docker compose, and other basic stuff, I have to build something using these concepts.

https://redd.it/g2vb68
@r_devops

Does it pay off to host apaches behinx nginx proxy instead of proxying nginx behind nginx?

For me as a more dev guy its all about commonly used .htaccess by third party modules

I feel like in most cases its about the .ht files.

While I understand the idea behind nginx not having equivalent of .ht files, the usual developer in most cases wants that possibility (ie. SEO reasons) and if he hears something like "nginx-first app" then i suppose he will be like "un oh we don't do that here"

https://redd.it/g2zfl9
@r_devops

Make APIs simple again!

Hi everyone!

My name is Johnny, my team and I developed a platform to simplify all the steps for developers to deploy, scale and consume APIs.

What are the biggest challenges you guys face in this whole process? And if you want to make money with your cloud function, how you do it?

Thanks, stay safe.

https://redd.it/g2rrm7
@r_devops

Provisioning a highly available load balancer in Hetzner Cloud with Ansible, haproxy and keepalived

Hi! For anyone interested, German provider Hetzner has published an article of mine in their tutorials library on provisioning HA LBs with Ansible. Some bits are specific to Hetzner Cloud ma can be easily adapted to other providers who have APIs to manage floating IPs for the failover. Here's the link, hope it's useful.

https://community.hetzner.com/tutorials/howto-highly-available-load-balancer-hetzner-cloud-ansible

https://redd.it/g2iek3
@r_devops

Testing & validating AMIs

I'm building AMIs with Packer right now, and I'm interested in writing tests to validate my images and make assertions about their state, to basically automatically verify that all the dependencies I need are properly installed.

I could just write a shell script to do this, but I'd like to avoid reinventing the wheel if possible. Are there any tools/frameworks that can do something like this?

https://redd.it/g2mhoo
@r_devops

Where can I go constructively volunteer my free time and continue learning while unemployed?

I recently got terminated from a position and, due to the pandemic, worried it might be a little while before I can land the next position. Anyone know of good volunteer opportunities with non-profits out there where I can go volunteer my time and continue working on DevOps projects? Just want to make sure I'm not staying idle and find a way to continue contributing.

https://redd.it/g2hswf
@r_devops

Does anyone here have a side devops gig?

What sites/resources do you guys use to pick up short term contracting jobs in devops field. I live in Alaska, so most of my options are most likely remote jobs anyway.

Apologies in advance if this isn't the right sub for this.

https://redd.it/g2m2mr
@r_devops

SSD OR HDD

Hey folks, I'm trying to run a multithreaded python application on EC2 instance, which type of ebs storage should I use? The machine is basically for migration so lot of memory, network and disk resources will be utilised. The data could be anywhere around 50 TB, do you also think if amazon efs would be useful, I'm a newbie in AWS...

Thanks!!

https://redd.it/g2i0pw
@r_devops

how to land job in devops?

Good day guys, I've been a developer for quite sometime. I'm interested in the role of devops and started learning courses online. I have successfully deployed on GKE witn Ingress, Helm, Ngix, Docker.

I'd like to know where or how can I find this role. Just a bit background of myself. I've been doing freelance for the past 2 years of my dev career but I wasn't able to get into a team where this techs and methodology is used. Majority of the project I encounter were for individual web app and hybrid apps.

Thank you in advance.

https://redd.it/g3owqs
@r_devops