How can we step our game up?

Hi, we are a small dev teams into a small business but we would like to step our game up. We are using devops obviously and we would like use it the best way we can to step our game. We use branches policies that force 2 senior to do code reviews with pull requests. We have development, staging, production environments. We recently added whitesource builds that look for vulnerabilities in our projects. Is there any tools like sonarqube that we could use in a small enterprise for free? What else could we use to set more validations or just set our game up to exploit devops better?

https://redd.it/g481tt
@r_devops

Docker Images : Reducing Image Size

When getting started with containers, it’s pretty easy to be shocked by the size of the images that we build. We’re going to review a number of techniques to reduce image size, without sacrificing developers’ and ops’ convenience. In this first part, we will talk about multi-stage builds, because that’s where anyone should start if they want to reduce the size of their images. We will also explain the differences between static and dynamic linking, as well as why we should care about that. This will be the occasion to introduce Alpine.

https://www.ardanlabs.com/blog/2020/02/docker-images-part1-reducing-image-size.html

https://redd.it/g46atx
@r_devops

Best bare metal provisioning tools for Dell servers?

I am in search of a tool to do bare metal discovery. Essentially I need an image I can network boot (PXE/Bios or UEFI) which can discover all components in the server (CPU/disks/memory/NIC models/etc), firmware versions, what switch ports everything is cabled up to via LLDP, and report all that back to some sort of inventory tool which has an API. These are all Dell servers with an enterprise iDRAC license but multi vendor support is a plus. Once I have all this data I'd like to build some automation so that I can say build a server with this profile and it will query the API for a server meeting those specs and then go and setup the bios options, RAID, configure the switch ports (in a port channel), add an entry for a PXE install (we currently use cobbler, but open to alternatives), then PXE boot to install the OS/desired config. That would almost certainly be Ansible based.

There are several open source bare metal provisioning tools out there but I've not had any experience with any of them except a little Foreman which seemed to be a huge effort to integrate with our existing puppet infrastructure and other existing tools. Can any of them do what I want, or a slightly modified work flow that can achieve the same end result? LLDP info is critical because we currently rely on recording that manually in our inventory tool when we rack new equipment (before the OS install, at which point it's automatically reported if the OS install supports that) and that manual recorded data is all too often wrong/missing and we have to look for it on the switch to figure out where things are actually cabled.

I've thought about just building a live image that can do what we want, we already have an inventory tool we can use to report to, but that might just be extra work on our part that can be avoided with an existing tool.

https://redd.it/g4bnex
@r_devops

Logging additional metadata

In February, before the lockdown, I presented my **Fast logs** talk at ConFoo. At the end, I had an interesting question I had to cut short because of the timing. This blog post aims to describe the relevant points of the talk, the question, as well as some possible answer.

https://blog.frankel.ch/logging-additional-metadata/

https://redd.it/g4aii5
@r_devops

Coding along to learn how to build APIs

Hey guys, do you have any tips for me for great courses that let you code along to build APIs or applications? I am trying to deepen my understanding in application programming design and am eager to learn more about working with API definitions, swagger and the likes. The problem is that the courses I find are either way too basic and teach school programming ( I do have okeyish programming skills ) or are handing out fully coded examples. I can read that code, but I am hoping for something more in between so I can get more hands on and solve the problems myself instead of reading just an example implementation. Any advice for application coding design is also appreciated.

Thanks in advance! Take care during the quarantine.

https://redd.it/g46uy1
@r_devops

What is the value of logging

Hi everyone,

This is probably a very amateur question, however, I’m just starting my own devOps journey and I’m curious as to why I hear about ‘logging’ so much and the benefits of it. Perhaps I’ve missed a post on this forum somewhere but I’d like to understand from some real world examples as to what value it adds to a business. Has it saved an organisation $X due to Y time it saves to find a problem-do these problems happen that often amongst networks, software etc.,? There’s also a tonne of logging providers out there that you pay to achieve a centralised logging system so there must be some figures out there that have shown benefits outweigh the costs.

Would love some help if possible, thanks all for any advice.

https://redd.it/g466bq
@r_devops

How to start ?

I am facing uncertainty in my current job. I have worked on different technologies but dont have complete understanding. Here is the list of topics which I want to learn/cover but I am not sure in which order I should start.

1. Terraform
2. GCP(currently working on AWS but want switch on GCP)
3. Python (I have done few system side scripting)
4. Kubernates( I have configured production level cluster in EKS.)
5. Linux ( want to lean more about system calls and other core stuff).

https://redd.it/g46u12
@r_devops

Slack chatbot needed?

I am looking for the chatbot on Slack that helps me team automate the repeating tasks:
• Call CircleCI API to build jobs
• Ask CTO permissions to deploy on production
Thanks for your reading.

https://redd.it/g475ax
@r_devops

Redis diskless replication: What, how, why and the caveats

[deepsource.io/blog/redis-diskless-replication/](https://deepsource.io/blog/redis-diskless-replication/)

This excerpt aims to address the working and potential of diskless replication in production environments.

https://redd.it/g43u44
@r_devops

Learning DevOps on the cloud

Brief context. Stuck overseas for work with very limited resources in terms of a physical computer. Dell laptop running WSL2. Dual boot with Ubuntu had far too many issues. Should have a fair amount of time to work on DevOps skills as well as some more DB and software engineering tasks.

Any thoughts over which platform like Digital Ocean, AWS, Linode would be the most cost effective and allow me to workon things like:

Ansible, Graffana, Terraform, Docker, Git (for ansible I'm assuming I need to spin up various servers/droplets, etc to make any realistic workflow. )

And from the coding side I'd like to work more on reddis, mongo, OpenCV/Tensorflow.

Thanks for any assistance.

https://redd.it/g43i1x
@r_devops

linuxacademy hands on labs experience not great so far

I have completed 2 labs so far, one is AWS S3 introduction, and another lab on Linux task where I have to set up auto email notification via ssh login. During both labs, I found there are sections of guide where it is out of date with how the programs functions, or lack instructions. On both occasions I had to figure out the general direction of what the guide ask me to do, then figure out the new way to do it. The video included in the hands on lab is also laughingly out of date, as the current AWS web UI look nothing like it anymore.

Great if this is by design to train people to find the right answers, not so great as a step by step hands on follow exercise. I think the site need to keep their hands on labs updated.

https://redd.it/g3xtx7
@r_devops

Kubernetes RBAC Demystified

Want to share a really cool capability added to Kubevious. Makes consuming Kubernetes RBAC (Role, ClusterRole, Binding, ClusterBinding) so much easier by just seeing what permissions are set on the application level without the need of querying bunch of objects and tracing labels.

Also, with a single glance can identify if there is some workload within the namespace that has access to API resources beyond the namespace.

[https://youtu.be/0Gd6VRTigoE](https://youtu.be/0Gd6VRTigoE)

https://redd.it/g3zzxs
@r_devops

Docker-compose in production: Viable?

Hello,

We have made a transition from vagrant to docker-compose for our local development, and we are quite happy with the result. We have 10 dockerized services, communicating neatly and working perfectly locally, all behind a Traefik router.

Now, we would like to move from our current bare-metal deployment and use our containers in our staging/production servers as well.
We are not interested in service replication just yet, we just want a solution that can be deployed easily and that mirrors our local experience. It seems that docker-compose can effectively be used in production as well, but is there any downside to it? Should we use Docker Swarm with a single machine instead? Use K8s?
We use DigitalOcean as a cloud provider.

Thank you.

https://redd.it/g3w69h
@r_devops

Vault on AWS - A Terraform Project for Secrets Management Anywhere

Hey r/rdevops,

I put together a Terraform project that automates a secure deployment of HashiCorp's Vault on AWS. After deploying this project you'll get a URL that you can then start managing secrets with through the Vault CLI or HTTP API. There's a lot of configurable options in the project that will let you scope the URL to specific IP ranges or even just keep it completely private and only available to other AWS VPCs.

[Vault on AWS Github Repo](https://github.com/jcolemorrison/vault-on-aws)

https://redd.it/g3t3c8
@r_devops

How do you handle concurrent changes in your IaC repo that target different environments?

A colleague of mine asked me a question the other day for which I didn't have a good answer, and I'm wondering how you all handle similar situations.

We're using Terraform to do some deployments, and we've got currently got things set up for 2 environments, staging and prod. If you start making some configuration changes to test in staging, but then need to make a hotfix for prod (without also merging in those changes for staging), how do you handle this case? To be clear, we're talking about small changes here, like configuration tweaks; for bigger changes, we spin up separate, temporary testing environments.

I know that, ideally, you want to have all environments use a single branch, and use variables to customize the deployment for each environment. But if you need to keep `master` clean for potential hotfixes, how would you push changes to staging? In practical use, do you have a branch or subfolder for each environment?

I suppose we could use a feature flags approach and have a bunch of ternaries in the actual resources, but I feel like that would muck things up quickly.

The same question applies to modules that your root Terraform is using. If your module needs to publish a new hotfix version for prod, but you want to test some changes in the module for staging, what do you do? If you create a feature branch in the module for the staging changes, you then run into the problem in your root repo that you can't use a single branch / folder again, since you'd have differing sources for the module between prod and staging.

https://redd.it/g3xbe2
@r_devops

How to sync app store/play store updates with server deploys that contain a backward-incompatible change?

Hello, I suppose this is the right subreddit to ask this question?

---

I maintain an app that runs on both ios and android and communicates to a server.

---

I am using automated CI/CD deploys, for both the server and ios/android apps.

The server deploys are instant (after docker build) because I own and control my VPS.

However, the app stores generally take a few days to publish the app.

Especially in apple's case, we routinely encounter speed bumps.

---

So how do I make sure that the server doesn't get deployed before the app is available to the public, especially when I have made a backward-incompatible change to the API?

https://redd.it/g3uxzt
@r_devops

Examples how to use Pulumi fo AWS

I am interested in using Pulumi (Python interface) but can't find good docs how to use it . E.g. how to create network (VPC, subnets, NAT gateways etc.) in AWS with it?

Could somebody share some usable docs? Any AWS related and Python Pulumi.

Posted on Pulumi site looks pretty basic and all of them uses default VPC.

https://redd.it/g3uopo
@r_devops

This Week in DevOps: AWS EFS supports ECS Fargate

Does anybody know if EFS works with EKS Fargate also? This seems to be a container level mount so it seems like it should but EKS is not mentioned in the announcement.

[https://thisweekindevops.com/2020/04/17/weekly-roundup-april-17th-2020/](https://thisweekindevops.com/2020/04/17/weekly-roundup-april-17th-2020/)

https://redd.it/g3qvvg
@r_devops

Stuck with no way back

Hello everyone, trying to create multi LAMP stack with vagrant and basically , I am stuck and nothing is working :D Any tutorials you could suggest for the multi machine ansible setup?

​

Project here:

It's messy because my brain is fried [https://github.com/RausisM/tryingtosurvive](https://github.com/RausisM/tryingtosurvive)

https://redd.it/g4spjm
@r_devops

Cisco Prime, pythons Nornir, or Ansible for network config mgmt

Hi guys, I am a network engineer who has been using python libraries for simple network config changes or show commands. The libraries I have used in production are netmiko and paramiko both with multi-threading when I need to run a script on multiple devices faster.

I have used ansible In a virtual environment but not production. I’m not to strong in Linux at the moment so I use ansible in a virtual Ubuntu environment so I don’t break my production.

I am currently learning Nornir and liking it more than ansible.

My job wants me to automate network configs back ups/ schedule them. They don’t want to buy solarwinds NCM and want me to try using our current Cisco Prime software. I don’t really like it and prefer NCM. Is it worth using Cisco Prime and learning it. Because I would rather go the either the Ansible or Nornir route and I feels it has more flexibility and it’s open source.

I plan to make a web api flask or dgango so that others in my Dept can use the python scripts without having to know the backend.

What do you guys think? Learn Prime and do the config mgmt/scheduling with it or continue with the python based scripting. Also which is more recommended right now Nornir or ansible. I am biased on which one so would like opinions from those that have been down this road already.

https://redd.it/g4vnz4
@r_devops