What would be the best way to improve this Gitlab CI/CD (Gitlab.com) pipeline's efficiency and consistency?

Can you explain the reason for why the "step_script" installs the dependencies and not use a prebuild images that has all the dependencies installed?
Solution
Based on the information you provided, Your test infrastucture rebuild even the test container from scratch.
You tests take a long time to be done as those lines indicate also a fresh composing of the docker container:

(1/11) Installing ca-certificates (20191127-r2)
(2/11) Installing nghttp2-libs (1.40.0-r1)
(3/11) Installing libcurl (7.67.0-r3)
(4/11) Installing expat (2.2.9-r1)
(5/11) Installing pcre2 (10.34-r1)
(6/11) Installing git (2.24.3-r0)
(7/11) Installing c-ares (1.15.0-r0)
(8/11) Installing libgcc (9.3.0-r0)
(9/11) Installing libstdc++ (9.3.0-r0)
(10/11) Installing nodejs (12.20.1-r0)
(11/11) Installing yarn (1.19.2-r0)

If you build a docker image with those thing preinstalled, your Tests will run much faster.
This Process creates clean environment where the only change to it will be the code that has changed!!
The new Docker image then need to be only pulled ones and can be reused.
Build/test infra
docker run -v "$(pwd)"/target:/app:ro -name BUILDID jdalrymple/docker-compose-with-node yarn test
run that for each of your tests.


Does terraform support blue green deployments and roll backs out of the box

It all depends on how you are deploying your code.

(First, IMHO, I don't think that Terraform is the right hammer for this operation. Terraform responsibility is to build the necessary infrastructure for your application, not to be the tool used for deploying it. But, as always, "the right/best one" will depend on lots of factors and, depending on the case/scale, it may be the "good enough" solution)

My suggestion would be, in summary:

Deploy your application in the "unused" environment
Test it
Change the domain name to point to it

Assuming you have 2 AutoScaling groups already configured. One called asg-blue and the other called asg-green. And that the current version resides on asg-blue and in terraform you have an aws_route53_record pointing to it. You would need to follow these steps, each one with a terraform apply before the next:

Deploy the newer version of your application on asg-green

I.e. update everything that is needed to deploy your application version. It may be the AMI you point on your Launch Configuration or any other way that you do exclusively using Terraform.

Test that everything is running as expected

Here you could use the domain-name provided for each ASG/ELB or one already configured on terraform

Update the domain name to pont to asg-green ASG/ELB on the aws_route53_record
Reduce the number of machines needed on asg-blue to don't use too many resources

Depending on your case you can configure for 0 machines

This way you can have your B/G deployment, but for every deployment you'd need at least two manual interventions in your terraform (the deployment of the new version and updating the domain name).

But with this strategy you should take a lot of care to not deploy on the current ASG being used.

Of course if your terraform/aws fu is good, instead of reusing ASGs, you could delete and create them as needed.

Hope that this help in having a "big picture" of the entire process. But I'd suggest that you research and start using tools more focused on deployment, like AWS CodeDeploy.


Digital Ocean vs AWS EC2 for Laravel based application

We faced exactly the same choices for our live service that deploys a laravel API and multiple react apps.

There is no generic correct answer to a question "what tool/provider is better?" as it depends on your circumstances. Cost is a particularly tricky question. Are we just talking about the cost of getting something live, or the cost of running an elastically scalable service, or the cost of running a highly available elastic service that spans data centre availability zones such that it isn't taken down by an outage in a single data centre zone?

Digital Ocean ("DO") is very highly promoted in the Laravel community so it was "the default" for the development team when I joined a startup about two months from go-live. When I asked "what about data centre availability zones" the answer at the time for Digital Ocean was that they didn't support it and we would have to set-up in two different DO data centres and work on our own mechanism (e.g. DNS) to switch between them if DO had a major outage in one place. Yet on AWS they have availability zones and also Elastic Load Balancer so its far easier to get a setup going that is "future ready" if you intend to be running a very successful large scale service a year after launch.

In the end we went live on openshift.com which is a shared kubernetes service running on AWS. So our live DNS points at the Elastic Load Balancer of a shared Kubernetes cluster were we rent space for our containers. The cluster we are on has containers by other companies and runs across many AWS EC2 virtual machines. Yet they are not dedicated to us so we only pay a small fraction of the costs. Yet if any one virtual machines crashes where our containers are running openshift kubernetes automatically starts a replacement container on another virtual machine. So we have automated high availability and crash recovery but only pay-as-we-go for the memory and CPU we currently use. We can scale up more containers anytime we want by using changing the replica count. Openshift has internal load balancing so that a single internal service IP with an internal DNS name automatically points at however many containers we want to run of a particular type. That solves discovery between our services. If you deploy a redis instance from the built-in catalog it is instantly available on a private IP with a DNS entry only viable in your project. That sort of ”discovery” feature is really important when you are running microservices at scale.

With our setup, we get a great low-cost price for a very professional, elastic, highly scalable, fully automated infrastructure-as-code setup, that has all the advantages of AWS ELB, and all the advanced features of kubernetes for microservices.

Edit: I wrote a tutorial for my experiences running laravel backend with a reactjs frontend on openshif.com that is over at https://gist.github.com/simbo1905/d27ba7218a2fd71fcb4f0fcede82fd6d


Ansible playbook fails with: no test named 'success'

You use pretty old ansible, maybe worth to try a new one. Although tests "succeeded" and "success" should be in 2.2 too.

But main problem I think it's failed_when: no in your task. It makes test when: aptitude_installed is success completely useless, it will be always true because failed_when: no marks all tasks as successful.

If you don't want to stop on task, but still to have an idea how it went, you should use ignore_errors: true, not failed_when: no. With ignore_errors: true you can both continue your playbook and inspect a real tasks results.


You can dockerize/containerize pretty much anything fairly easily.  You basically just have to add a Dockerfile that:

Inherits from some base image;  this provides the basic OS features and whatever else you need.  E.g. a Java app may inherit from alpine-jdk-8 (a slim linux type image) that comes pre-bundled with the Java Development Kit.
Copies in your code and any dependencies.
Sets any variables you require.
Exposes any ports your app needs (e.g. ports 80/443 for serving a web page).
Mounts any volumes to save permanent data.  Generally anything in a container is ephemeral;  it will be gone when the container dies.  So, if you want to save/export results permanently you can mount a volume for, say, your local computer's file system, or for an amazon s3 bucket, or whatever.
Specifies how to start the app (the entry point).

Here's an example for arbitrary python scripts; but it's the same deal for any other language/tool:

https://runnable.com/docker/python/dockerize-your-python-application

If you're taking an existing executable which may  be your case, you just do the same thing but instead of loading in your code, you load in the binary and set that as your entry point.

The container lives until the entry point program ends.  So, some containers can be short lived - like just executing a CURL or something.  Some are permanent until they  die/are killed (e.g. a web service).

Again, to save state/results, unless you're writing them to a database or some other external system, you will want to mount a volume.

You build your Dockerfile into an image with a docker build command; then it will show up in your local docker image registry (docker image ls -a).  After that, you can run it with a standard docker run command (where you will likely want to expose any ports/etc that are needed).  I assume you're good with this one since you already run existing images in docker.

Generally you will need to store your image in a registry so you can use it on/from other systems.  But if running it locally is all you need you're done now :).

You can store your own containers in DockerHub or in Amazon AWS ECR or in any other number of options if you require a registry.


Why shouldn't I try to hire a 'DevOps Engineer'?

TL;DR: You should never try to hire a DevOps Team

There are essentially three most common roles to hire for:

DevOps Architect / Evangelist
DevOps Engineer
CI/CD Engineer

These roles are distinct from your 6 essential software development roles that traditionally compose the software engineering organization:

Product Management
Software Development
Tools Development
Security and Compliance
Quality and Testing
System Operations (SRE)

Lets go through the three roles one by one and see how they fit

DevOps Architect or Evangelist

Why: If you are lost, slow, broken and don't know what to do.
When: At the start of the process in planing stages.
What: Management level role to guide all managers and leads in the entire Software Engineering org. This person will plan the entire transformation of your engineering organization to a highly functioning state.
Who: Consulting member well versed in theory, management practices, culture topics and operations who reports directly to VP of Software Engineering.

In some cases and for smaller and mid-sized companies you might start the process instead with hiring a consulting organization, like DORA.

DevOps Engineer

Why:

To bridge the gaps between teams if they are organized along the functional roles mentioned above to ensure cross functional level cooperation.
To embed with product oriented teams, which have each of the 6 traditional roles included in the team, to help bridge the knowledge gaps and to help with implementation and adoption of the novel practices and tools.

When: Once you've laid out your plans and the organizational transformation starts and the entire management team is on board.
What: Enable cross function cooperation, ensure that team boundaries are broken down, that local optimizations inside teams are not creating a barrier to high throughput of work throughout the value chains all the way from customer wishes to customer deliveries.
Who: Experienced engineer with skills both in software development and system operations. He should be skilled in the best practices, process and culture changes related to DevOps transformation.

CI/CD Engineer

Why: To help implement CI/CD pipelines, integrate your tool chain, bring in the tools that will enable better working of the company.
When: During the transition in larger organization, while the above roles have been already filled.
What: Engineer, which is essentially part of the tools team that will be able to setup CI/CD pipelines and start integrating internal systems in a way that will remove friction from the throughput of work.
Who: Engineer experienced with Tools, Integration process, Release Management and DevOps practices. Someone who understands they are replacing human gating in release process by Automation.


Nginx ingress controller redirects the url to /login

It just works

Your configuration is correct.

Provided YAML file generates nginx config like this:

...
server {
 listen       80;
 server_name  example.com;
 ...
 location ~* "^/service/test" {
   root    /var/www/example.com/htdocs;
 }
}

Testing this config via this cool tester shows that location filter works:

http://example.com/service/test1 -> Location: ^/service/test
http://example.com/service/test -> Location: ^/service/test
http://example.com/login -> Errors: No locations matched

For more details, see this explanation of Ingress Path Matching and examples from NGINX Docs:

  Examples show how to use advanced NGINX features in Ingress resources with annotations.
  Examples of Custom Resources show how to use VirtualServer and VirtualServerResources for a few use cases.

Check your app

Check your app, maybe it forward non-authorized requests to /login url.
You may use curl -v or wget, e.g:

curl -v -L http://example.com/service/test1 | egrep "^> (Host:|GET)"

wget  http://example.com/service/test1 2>&1 | grep Location

Howto debug nginx ingress

There is an Nginx debug mode for debugging nginx locations and redirects.
To enable it, use --v=5 in kubectl edit deploy.

See: k8s debug logging:

  Using the flag --v=XX it is possible to increase the level of logging. This is performed by editing the deployment.

$ kubectl get deploy -n <namespace-of-ingress-controller>
NAME                       DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
default-http-backend       1         1         1            1           35m
nginx-ingress-controller   1         1         1            1           35m

$ kubectl edit deploy -n <namespace-of-ingress-controller> nginx-ingress-controller
# Add --v=X to "- args", where X is an integer

    --v=2 shows details using diff about the changes in the configuration in nginx
    --v=3 shows details about the service, Ingress rule, endpoint changes and it dumps the nginx configuration in JSON format
    --v=5 configures NGINX in debug mode


How to decide between Rolling Releases versus LTS Releases?

I don't think there's a good answer that applies to all software packages or situations.

Rolling releases are more risky as there is no predictability around when things will change. You may have installed the thing last night and already there's an update to deal with. But what does that update do? Is there enough information to know if you want it? Sometimes, but it depends entirely on the developer/company releasing the package.

Some things to consider before going with a rolling release package:

Who are the primary users of the package, and in what environment?
What is your tolerance for risk?
What is your process for performing upgrades?

LTS releases are intended to be used for longer periods of time and often have published lifetimes that enable you to plan and test migrations to the next LTS release well before updates to the package/system end.

My recommendation is that servers (with the exception of sandbox/R&D machines) should use LTS releases. On desktop machines it depends on the end user and what that individual wants.

In fact, I would go so far as to say unless there are specific and very good reasons to go with a rolling release, always use LTS releases.

Note:

When dealing with higher-ups, appealing to their desire not to spend money is always a good tactic. Rolling releases are more expensive in the long run when you consider the amount of time spent by employees testing, installing, dealing with bugs from new versions, etc. While you'll have to do some of this with LTS releases, their longevity means it's significantly less.


How to evangelize DevOps and tools in a low acceptance environment?

This is not docker-specific, but this general rule for evangelism applies: different audiences require different evidence.  In general, software developers (and managers from a development background) want to see it in action, so POC's with measurable outcomes are preferred.  Other disciplines and executive stakeholders may be OK with case studies and presentations before giving the greenlight; your goal is to identify which audience you're talking to, and begin to build a comprehensive argument.

Start small; find one key stakeholder, and present your case using the evidence that best suits them.  Be patient; change in mature organizations is usually slow, so getting a small project up and running is a major accomplishment.


How to manage 10+ team environments with Helm and Kubernetes?

My 2 cents.  We have similar requirement like you do.  We end up having multiple values files in the form of values-<namespace>.yaml and it should come with the defaults set to values.yaml

We also have some shell scripts to deploy to the namespace.  Something like this deploy.sh --namespace app.

It is not without its problem, the number of files are steadily growing.  But so far we are ok with it.


Kubernetes - How to show all service accounts

The command you listed will show you your resources.

Instead try: kubectl get serviceAccounts


Continuous Deployment best practices for managing application configuration

[Copying answer over from duplicate post]

If you start a container with an environment variable, that variable is part of the container definition. As a pro, when the server is rebooted, the same variable will be there when the container restarts. But as a con, anyone with access to the docker API can view that secret in clear text, and some apps log their environment when debugging.

With swarm mode (Kubernetes has their own similar solution), you can define your secret on the manager and it will be given to nodes running the container on a need to know basis. The secret is accessible inside the container as a file, but that file is only stored in memory on the worker node, and you can use an entrypoint script in your container to load that into the environment if that's how the application expects it. The swarm mode secrets and configs have the advantage of being portable as the container is rescheduled on other nodes in the event of a worker crash. Migrating from a docker-compose install to a single node swarm cluster and deploying a stack is a very simple task.

There are also external solutions for storing configs and secrets in key/value stores like CoreOS's etcd and Hashicorp's Vault. Both Swarm Mode and Kubernetes use a key/value store for their own settings, giving you an idea of how the community sees it as a best practice. The downside is you often want to configure the application to read and write configuration from one of these key/value stores directly. If you use something like swarm mode secrets and configs, these will be stored in docker's internal key/value database, so you get a similar solution with little effort on your part.


What is the AWS user permission that allows attaching and detaching IAM Roles to instances?

From Granting a User Permissions to Pass a Role to an AWS Service:

  To pass a role (and its permissions) to an AWS service, a user must
  have permissions to pass the role to the service. This helps
  administrators ensure that only approved users can configure a service
  with a role that grants permissions. To allow a user to pass a role to
  an AWS service, you must grant the PassRole permission to the user's
  IAM user, role, or group.

  When a user passes a role ARN as a parameter to any API that uses the
  role to assign permissions to the service, the service checks whether
  that user has the iam:PassRole permission. To limit the user to
  passing only approved roles, you can filter the iam:PassRole
  permission with the Resources element of the IAM policy statement.

Is this what you're looking for?

An example from the above-metioned page:

  Example 1

  Imagine that you want to grant a user the ability to pass any of an
  approved set of roles to the Amazon EC2 service upon launching an
  instance. You need three elements:

  An IAM permissions policy attached to the role that determines what the role can do. Scope permissions to only the actions that the role
  needs to perform, and to only the resources that the role needs for
  those actions. You can use AWS managed or customer-created IAM
  permissions policy.

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Action": [ "A list of the permissions the role is allowed to use" ],
        "Resource": [ "A list of the resources the role is allowed to access" ]
    }
}

  A trust policy for the role that allows the service to assume the role. For example, you could attach the following trust policy to the
  role with the UpdateAssumeRolePolicy action. This trust policy allows
  Amazon EC2 to use the role and the permissions attached to the role.

{
    "Version": "2012-10-17",
    "Statement": {
        "Sid": "TrustPolicyStatementThatAllowsEC2ServiceToAssumeTheAttachedRole",
        "Effect": "Allow",
        "Principal": { "Service": "ec2.amazonaws.com" },
       "Action": "sts:AssumeRole"
    }
}

  An IAM permissions policy attached to the IAM user that allows the user to pass only those policies that are approved. iam:PassRole
  usually is accompanied by iam:GetRole so that the user can get the
  details of the role to be passed. In this example, the user can pass
  only roles that exist in the specified account with names that begin
  with EC2-roles-for-XYZ-:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "iam:GetRole",
            "iam:PassRole"
        ],
        "Resource": "arn:aws:iam::<account-id>:role/EC2-roles-for-XYZ-*"
    }]
}

  Now the user can start an Amazon EC2 instance with an assigned role.
  Applications running on the instance can access temporary credentials
  for the role through the instance profile metadata. The permission
  policies attached to the role determine what the instance can do.

The procedure(s) to attach a policy to a user/role (inlining it might work as well) are described in Attaching and Detaching IAM Policies:

  To attach a managed policy (console)

  Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
  In the navigation pane, choose Policies.
  In the list of policies, select the check box next to the name of the policy to attach. You can use the Filter menu and the search
  box to filter the list of policies.
  Choose Policy actions, and then choose Attach.
  Select one or more identities to attach the policy to. You can use the Filter menu and the search box to filter the list of principal
  entities. After selecting the identities, choose Attach policy.

...

  To embed an inline policy for a user or role (console)

  Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
  In the navigation pane, choose Users or Roles.
  In the list, choose the name of the user or role to embed a policy in.
  Choose the Permissions tab.
  Scroll to the bottom of the page and choose Add inline policy.

  Note

  You cannot embed an inline policy in a service-linked role in IAM. Because the linked service defines whether you can modify the
  permissions of the role, you might be able to add additional policies
  from the service console, API, or AWS CLI. To view the service-linked
  role documentation for a service, see AWS Services That Work with
  IAM and choose Yes in the Service-Linked Role column for
  your service.
  Choose from the following methods to view the steps required to create your policy:

  Import an Existing Managed Policy – You can import a managed policy within your account and then edit the policy to customize it to
  your specific requirements. A managed policy can be an AWS managed
  policy or a customer managed policy that you created previously.
  Create a Policy with the Visual Editor – You can construct a new policy from scratch in the visual editor. If you use the visual
  editor, you do not have to understand JSON syntax.
  Create a Policy on the JSON Tab – In the JSON tab, you can use JSON syntax to create a policy. You can type a new JSON policy document or paste an example policy.

  After you create an inline policy, it is automatically embedded in your user or role.


How to automate the key exchange in WireGuard when you deploy a cluster of machines?

(Disclaimer: As the question has not received an answer yet, I came to the conclusion that there is currently no out-of-the-box solution. Thus, I'm sharing what I ended up doing, and hope it will help others. Still, I would be interested to learn of a better solution if there is one.)

WireGuard can be used, but each of the n-to-m connections will need its own keys. Managing that by hand becomes tedious if the number of machines increases. Therefore, it is advisable to automated it:

Generate all keys in advance
Distribute the keys to the machine using Ansible (e.g. by generating systemd services wg0.network and wg0.netdev)

Note that step 1 assumes that the maximum number of machines is known in advance. If you cannot provide an upper bound, this approach will not work. Instead you will need to implement a dynamic key generation and exchange protocol.
If you end up using fewer machines then the configure upper bound, it will still work. Distributing the keys means that WireGuard will allow connections from different machines, but does not require that all peers are always available.

Scaling: In my setup, the upper bound was in the order of 100. That works without problems, but I did not test how it scales if you need to go higher (e.g. to the order of 1000 or 10,000).
What if there is no upper bound? -- That is a more difficult problem, and I don't know how to solve it best. As said, you would need to generate key dynamically and exchange them. I was considering opening SSH and using it to exchange on-the-fly generated WireGuard keys.
Note that with SSH, you can reuse the same key on different machines. That eliminates the need to exchange dynamically generated keys. But be aware that reusing the same key for all machines is a trade-off between convenience and security. If one machine gets compromised, the attacker will gain access to all other machines, too.
Maybe there is some solution that is more elegant and more secure. Perhaps directly using Wireguard is not a good idea if you need to support an arbitrary number of dynamic hosts. It is easy to introduce subtle security issues when implementing your own key exchange protocol.


Disable a Jenkins pipeline on failure? Issue with a central deployment job

There is a "Jenkins Disable Job" plugin, which you can use in your pipeline to disable the job on failure.

You will be able to use this plugin for single failure or to disable after multiple failures.

https://wiki.jenkins-ci.org/display/JENKINS/Disable+Failed+Job+Plugin


Central repository hosting various binaries/applications for different platforms/architectures

Your scenario is a perfect use case for a binary repository manager. A BRM's primary feature is to act as a central storage system for your binaries, but there are many other features including:

Versioning
Tagging
Permission management
Logging/auditing

Using a BRM is more lightweight than a typical source code repository system such as Git or SVN. Those systems will have much more metadata than is necessary for binary files

I have personally used Artifactory by JFrog, but I have also heard many good things about Nexus.


jenkins fatal: ambiguous argument, unknown revision or path not in the working tree

From the git documentation around the command git rev-list:

git rev-list A...B

Try your command syntax like the above (i.e. origin/master...origin/${currentBranch})


One could replace

rewrite /(.*) /ipns/QmdpoFuwY/$1 break;

with

rewrite ^(.*[^/]) /ipns/QmdpoFuwY/$1 break;

and try again.

The issue was solved by inspecting the logs. If for example one navigated to /foo/ instead of /foo/ the log indicated:

2017/10/15 14:51:28 [error] 7#7: *1 "/etc/nginx/html/index.html/foo.html" is not found (20: Not a directory)

It turned out that the regex did not match /foo/. One could also enable the rewrite logging to facilitate debugging:

rewrite_log on;


How to manage images versions via docker-compose with Ansible

The best way is of course (like Zeitounator comments) to use a inventory var. Either you use the version number in the docker-compose task as a variable or you create a Jinja2 template docker-compose.yml.j2 and use the variable there. That's what I do.

Example:

all:
  hosts:
    host1.prod:
      image: "xyz/12"
    host2.dev:
      image: "xyz/latest"

And the docker-compose.yml.j2 contains the variable:

version: '2.1'

services:
  myservice:
    image: "{{ image }}"
    ...


How can I get the first part of the API Deployment URL from inside cloud formation template?

Did you try the variable ServerlessRestApi? It works for us like this:

Outputs:
    EncryptURL:
      Description: "Encrypt endpoint URL for Stage environment"
      Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/Stage/encrypt"


Docker Hub automated builds and Travis CI

If you're married to Docker Hub, you could use a webhook to notify Travis of the need to start it's job.

However, I solve this problem using Quay.io - it has the robot account (you refer to "service account") you need. It also has a richer set of notifications.

You could maintain your current workflow using webhooks to

create the repository on Quay or Docker Hub, have the image built on git events.
Create a webhook in the repository to send data to your Travis job when builds succeed

Or, you could build your images in the Travis job.

Push the initial image to a repository on Quay
Add a robot account to your repository in Quay
Add the necessary secrets to your Travis build (token and robot user name)
Configure Travis to build the image, run whatever tests you need and then push on green.
Add an after_success task to redeploy your app in k8s after the push.


How to manage Free and Open Source Software dependencies?

Any organization that needs the level of control you've specified is essentially forced into the preapproval process ("walled garden"). It's a pain for developers, but it's a necessary process to keep the company safe. I've even heard of companies with programs that scan all their workstations regularly to find and remove unapproved software.

It's worth noting that there are a few ways to implement it. As you note, you can use an internal mirror. Another popular option is to vendorize dependencies into your application's repo.

Security is one of the main issues with a frozen version approach, as you've taken on responsibility for maintenance. This generally means having someone whose responsibility it is to follow the release discussions of every package you've frozen. It also requires allotting continuous time for updating dependencies, because otherwise it's very easy to get caught with a security vulnerability that's only been fixed in a version that's incompatible with your app.

In general, I find that companies often underestimate how much additional work they're taking on with this change, and strict compliance is actually much more costly than occasionally ending up with licensing or "disappearing dependency" problems.


Are there examples of other production grade container runtimes?

Are there other implementations

Yes. The Container Runtime group of the Cloud-Native Computing Foundation has a list of runtimes:

They include:

Containerd
CRI-IO
Firecracker
gVisor
Kata Containers
LXD
Nabla Containers
Pouch
runc
Singularity
SmartOS
Unik

Do they have different approaches

While they cannot all be compared with each other directly, they all offer a way to provide a container runtime. In some cases, this runtime leverages the kernel, in others, they are in userspace. While some are explicitly proprietary, others are explicitly Open. Some are supported by large corporations (Google, IBM, Amazon, Alibaba), others by foundations or open source communities.

All of these are used in production, but perhaps vary in their popularity.


How do I run ansible on one host at a time and break on a failure

Your playbook will stop when a failure occurs and you're using serial: 1 according to the documentation.

  By default, Ansible will continue executing actions as long as there are hosts in the group that have not yet failed.

That said there seems to be some confusion in the community over the default behavior, and it seems to have changed--or been buggy--somewhere between 1.8 and 2.1.

So, if serial: 1 doesn't suffice, use this additional setting:

max_failure_percentage: 0

  In some situations, such as with the rolling updates described above, it may be desirable to abort the play when a certain threshold of failures have been reached. To achieve this, as of version 1.3 you can set a maximum failure percentage...

==

As for retrying your playbook, you should be seeing a failure message like this:

to retry, use: --limit @/home/user/site.retry

Use that --limit flag and on your next execution of ansible-playbook and it will continue from where it failed.

Retry files will be created unless you've set retry_files_enabled = False in your configuration.

Alternatively, --start-at-task may also work.

Sources:

https://github.com/ansible/ansible/issues/1663

https://github.com/ansible/ansible/issues/16241

http://docs.ansible.com/ansible/playbooks_delegation.html#rolling-update-batch-size

http://docs.ansible.com/ansible/playbooks_delegation.html#maximum-failure-percentage

http://docs.ansible.com/ansible/intro_configuration.html#retry-files-enabled

http://docs.ansible.com/ansible/playbooks_startnstep.html#start-at-task


You should look into affinity and anti-affinity as that allows you to control what pods go on which node. You can have it so that with anti-affinity there is only 1 pod of each deployment on a node. This is a bit overkill and wouldn't work for you exactly though IIRC you can have multiple pods on a node just with a limit.
https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/


The syntax failures are caused by the presence of the {{...}} expression blocks (normally used for filling the template output with the corresponding content) inside the {%...%} statement blocks.

I only used standalone jinja2 templates, so I'm not 100% certain if this applies to Ansible jinja templates as well, but I suspect so. In the Jinja2 {%...%} statement blocks variables are referenced directly (and variable assignments are done in {% set ...%} statements), so what you're after may be along these lines:

{% set docker_compose_mq = <string-passed from Jenkins> %}
{% set docker_compose_profiles = "string" %}

{% if risk_docker_compose_mq == "string" %}
  {% set risk_docker_compose_profiles = "string1" %}
{% endif %}


Is there an idiomatic way to create reusable Packer templates?

So far, I've taken to defining the default builders and provisioners we use, with user variables interpolated in where required, eg:

 "type": "amazon-ebs",
 "instance_type": "t2.micro",
 "ami_name": "{{ user `ami-name` }}

I've got files called eg. packer-builders.json and packer-provisioners.json, and then all the separate Packer templates in their own directories.

I've then written a quick Bash script that takes the name of the template one wants to build, finds all the packer-*.json files, and uses jq --slurp to merge them in (eg. jq --slurp '.[0] * .[1] * .[2]' $LIST_OF_FILES) with the supplied template at the end. It saves the output and sends that along to packer build.

As a bonus, I'm also using jsmin before hitting jq so that I can include comments in any of the JSON files.

It works well, but I'm not a massive fan of it because it's custom and it adds an additional barrier for entry for others coming across it (much more to consider than just packer build something.json!

So I'm really keen for additional answers here if there's a better way to do this.


Triggering a SNS notification when an object is accessed (downloaded) in AWS S3

As you point out, AWS S3 currently does not have an event type for GET calls.

To do something similar to what you are trying to do, I had to do the following:

Create an application/lamdba that's only purpose was to retrieve items from the S3 Bucket.  This application was given exclusive privileges to the S3 bucket.
The application keeps a counter of the number of times that S3 resource has been accessed.
The application returns the 403 or whatever you want if you exceed the download limit.

Basically create a "middleware" that's sole purpose is to go from your website/application to S3 and track the number of requests.

While the above solution meets your requirements, it is vulnerable to common attacks such as DDoS or people spoofing their IP.  If you take this approach consider additional security measures (e.g. only authenticated users can invoke the application's GET call to S3).


Dockerfile parse error line 5: unknown instruction: -ESSENTIAL

I assume you have a copy-paste issue. The right package name is build-essential. And if you want to split a RUN statement over several lines, you will have to use backslash for line continuation.

All that leading to something along the lines of:

RUN apt-get update -yqq; apt-get -yqq install ruby ruby-dev \
          build-essential redis-tools

As a personal suggestion, when you have several commands to run, it is usually better to join them using && rather than ; since you want the build to fail if either command is failing.

RUN apt-get update -yqq && apt-get -yqq install ruby ruby-dev \
          build-essential redis-tools


Unable to run `conda activate` from Jenkins pipeline

What we do is download and install miniconda in the first step in our (declarative) pipeline and create the environment(s) from a yaml file.

sh '''#!/usr/bin/env bash
wget https://repo.continuum.io/miniconda/Miniconda3-latest-Linux-x86_64.sh -nv -O miniconda.sh
bash miniconda.sh -b -p $WORKSPACE/miniconda
conda config --set always_yes yes --set changeps1 no
conda update -q conda

conda env create -f envs/ansible-env.yaml
'''

In each step we start the conda environment like so:

sh '''#!/usr/bin/env bash
source $WORKSPACE/miniconda/etc/profile.d/conda.sh
conda activate miniconda/envs/ansible-env/

# do stuff
'''


Deploying a set of cloud instances based on a list of parameter differences

This is why configuration management software exists.
Example for Ansible and AWS:

- name: Create a sandbox instance
  hosts: localhost
  gather_facts: False
  vars:
    timezones_path: /some/path/timezones.list
    key_name: my_keypair
    instance_type: m1.small
    security_group: my_securitygroup
    vpc_subnet: my_vpc_id
    image: my_ami_id
    region: us-east-1
  tasks:
    - name: Load timezones list
      shell: "echo {{ item }}"
      with_lines: "cat {{ timezones_path|quote }}"
      register: timezones

    - name: Launch instances
      ec2:
         key_name: "{{ keypair }}"
         group: "{{ security_group }}"
         instance_type: "{{ instance_type }}"
         image: "{{ image }}"
         wait: true
         region: "{{ region }}"
         vpc_subnet_id: "{{ vpc_subnet }}"
         assign_public_ip: yes
         count: "{{ timezones|length }}"
      register: ec2

    - name: Add new instance to host group
      add_host:
        hostname: "{{ item.1.public_ip }}"
        timezone: "{{ item.0 }}"
        groupname: launched
      with_together:
        "{{ timezones }}"
        "{{ ec2.instances }}"

    -name: Tag instances with timezones
      ec2_tag:
        region: "{{ region }}"
        resource: "{{ item.id }}"
        tags:
          Timezone: "{{ item.timezone }}"
      with_items: "{{ groups['launched'] }}"

    - name: Wait for SSH to come up
      wait_for:
        host: "{{ item.public_dns_name }}"
        port: 22
        delay: 60
        timeout: 320
        state: started
      with_items: "{{ ec2.instances }}"

- name: Configure instance(s)
  hosts: launched
  become: True
  gather_facts: True
  tasks:
    - name: Run deploy script
      shell: "/path/to/script.sh --tz {{timezone}}"

Path to script in last line should be for host which runs Ansible, not remote.


how can I import python module tkinter in gitpod

That problem occurs because the workspace-full-vnc image uses pyenv and the module path is different (source). To use python modules, you need to install them using python2 or python3 -m pip install ....


branch specific jenkins pipeline trigger

Do you have 2 different jenkins jobs configured for master and release branches? Since github webhook event is sent to Jenkins irrespective of branch, both your jenkins jobs may be getting triggered by this github webhook event. And since both jobs are configured with separate branches, they may be checking out those branches during jenkins job execution which is why you may be seeing respective branches being printed in both jenkins jobs.
Checkout jenkins multibranch pipeline if you haven't already so you don't have to maintain multiple jenkins jobs for branches.
Now coming back to your Jenkinsfile code, you can try following:

Replace env.GIT_BRANCH with env.BRANCH_NAME

Use allOf inside when condition instead of &&  -
stage("Step 3: Production Deployment"){
    when {
        allOf {
            expression { env.BRANCH_NAME == "origin/master" }
            expression { params.merged == true }
            expression { params.current_status == "closed" }
        }
    }
    steps{
        -----
        sh 'kubectl apply -f **.yaml'
    }
}

Note that github webhook will trigger the jenkins job for every branch push or PR merge event (irrespective of branch), so your jenkins job would have to handle multi-branch scenarios like explained in this official doc example.


Jenkins trigger build if shared library changes

This issue can be solved by using legacy SCM option. Go to Jenkins -> Manage Jenkins -> Configure System and select "Legacy SCM" option for share libs. this will resolve the issue completely, It worked for us.


Terraform: Route53, LB and CDN interdependencies

Modelling these permutations as a single module with lots of parameters is possible as you've seen, but it's often not an ideal way to model things because this sort of careful rollout strategy tends to require control over individual steps, rather than rolling everything all at once.

The Terraform team recommends using module composition instead. That means to split the problem into multiple smaller modules that the calling module can then combine to achieve the desired result.

In your specific case, it looks like there are three different building blocks: a load balancer, an optional Cloudfront distribution, and a DNS record. I'm going to show some examples of module composition using Terraform 0.12 features. If you're still using Terraform 0.11 then you can still follow a similar pattern, but Terraform 0.11's expression handling is more limited so the details would look different.

When breaking down this problem, my first step would be to identify what information needs to flow between these components. In this case:

The load balancer has some arguments of its own, but it doesn't depend on the other components at all.
The optional Cloudfront distribution needs to know the hostname of the load balancer.
The Route53 record needs a record name and zone id to populate an alias block; they could be for either the load balancer or the Cloudfront distribution depending on which of the two architectures the calling module is following.

In the full architecture where Cloudfront is used, these modules might be composed like this:

module "load_balancer" {
  source = "./modules/load-balancer"

  # ... load-balancer specific arguments
}

module "cloudfront" {
  source = "./modules/cloudfront"

  target = module.load_balancer.dns_name
}

module "dns" {
  source = "./modules/route53-record"

  alias = module.cloudfront.route53_alias
}

In the load-balancer-only architecture, we remove the cloudfront module and connect the DNS directly to the load balancer:

module "load_balancer" {
  source = "./modules/load-balancer"

  # ... load-balancer specific arguments
}

module "dns" {
  source = "./modules/route53-record"

  alias = module.load_balancer.route53_alias
}

Terraform 0.12 allows us to define that alias variable on the dns module with a specific object type, to easily pass the alias settings between modules as a single object value:

# (in the route53-record module)
variable "alias" {
  type = object({
    name    = string
    zone_id = string
  })
}

resource "aws_route53_record" "example" {
  # (other arguments as in your example)

  alias {
    name                   = var.alias.name
    zone_id                = var.alias.zone_id
    evaluate_target_health = true
  }
}

The idea here is that both of the other modules follow this conventional structure so that the route53-record module can be compatible with either of them without caring which one is used. This would then correspond with outputs in each of the other modules following the same structure:

# in the load-balancer module
output "route53_alias" {
  value = {
    name    = aws_alb.example.dns_name
    zone_id = aws_alb.example.zone_id
  }
}

# in the cloudfront module
output "route53_alias" {
  value = {
    name    = aws_cloudfront_distribution.example.domain_name
    zone_id = aws_cloudfront_distribution.example.hosted_zone_id
  }
}

With this different design, we can address your original use-case by giving control to the author of the calling module to drive the switch between these two models. In order to avoid downtime when switching from Cloudfront back to the load balancer, we need to repoint the DNS first and then destroy the Cloudfront distribution only when it is no longer used. So we can do that in two steps, first by modifying the first example above to point the DNS record at the load balancer while retaining the Cloudfront distribution:

module "load_balancer" {
  source = "./modules/load-balancer"

  # ... load-balancer specific arguments
}

module "cloudfront" {
  source = "./modules/cloudfront"

  target = module.load_balancer.dns_name
}

module "dns" {
  source = "./modules/route53-record"

  alias = module.load_balanccer.route53_alias
}

Then, once the Cloudfront distribution has become idle, remove that module altogether at your leisure and apply again to clean it up.

Composition is the primary way we model relationships in Terraform, so it's most natural to use composition when working with modules too, rather than building big modules with lots of conditionals to handle every permutation. Composition allows flexibility in how to make changes to the infrastructure in future so that the maintainer of the top-level module can be the one to decide what tradeoffs to make, such as making smaller changes to avoid downtime.

I used modules above because the original question was about modules, but I'd note also that after this decomposition we're left with one module per resource whose name is the resource type, which is one of the "smell tests" in When to write a module?.

If decomposing these into separate modules ends up just creating modules that are thin wrappers around single resource blocks then it's usually better to just eliminate the module altogether and just use the resource types directly.

However, if one or more of the modules still raises the level of abstraction (e.g. by providing hard-coded good values for most of the resource arguments and only exposing a small subset of them for customization) then that module in particular may still be warranted.


Within the CloudWatch integration in PagerDuty, you can change the "Derive name from" field to something like "Alarm Description".


Are there Docker Hub comparable public Docker image repositories?

With Docker following the Open Container Initiative, in the event that Docker were to disappear, people would still have access to images stored outside of Docker Hub.

While there is not a public mirror of Docker Hub, you do have access to other registries that often store the official image.

For example, if you were to pull the official Docker SQL Server image, you would target mcr.microsoft.com/mssql/server:2019.  So even though the image can be searched on in Docker Hub, the image still exists outside of Docker Hub.  The three big cloud providers (Azure, AWS, and Google) all have container registries that allow public access.  Many of the cloud registries support storing of images in regions and would allow "mirrored" architectures that are transparent to the public and disaster recovery (i.e. end users only pull from one link and the provider routes to an active available registry).


Can Terraform pull down the newest state file by itself?

Did you try to use remote state storage like S3?

Also you can use Terraform Cloud to organzie workflow and have the shared state.


Why a chef is the boss of the kitchen but a fullstack dev is not often the leader of a dev team?

IMHO the comment is a bit misleading, in the sense that a chef is the boss of the kitchen mixes up and/or attempts to compare the unique leader/chef role (in French, chef literally means chief/boss/leader) with the expertise required to fill that role. By contrast, the full-stack developer is just an expertise, it is not a unique role.

If I'm not mistaken to become a chef one has to have experience in every other position in the kitchen. Similarly, a full-stack developer's expertise covers frontend, backend, etc - every other more specialized expertise required for the team's product. Which is probably the starting point for the comparison in the comment.

As I mentioned in my answer to that post, scale matters.

In a large team, the requirement for the leadership position isn't necessarily the technical expertise. Which is why often in software development the team leadership's role is a management position, not a technical one. Clear labour division example, if you want.

It's not impossible to even have multiple persons qualified to fill the chef role in the same kitchen, but only one can actually fill that position at any time, a chef in this context really refers to the role, not to the expertise. Also - there may be many types of chefs in a kitchen, see, for example Chef Jobs on Cruise Liners :)

But in a small resource-starved team where the team leader has to be selected from between the only full-stack developer and one or more less-experienced ones - probably the full-stack developer will be the leader, just like the only person qualified to be a chef in a small kitchen.


The confusion might come from the concepts behind the tools you are using. So let's start with a little definition.

  Laravel and Artisan

Laravel

Framework for building a full MVC Web application in PHP. It is the equivalent of Spring-boot with Java or Rails with Ruby.

Artisan

Laravel's console driven interface for development. It provides tools such as the web server coming with PHP 5.4+. When using the "serve" command a simple web server will start. This is perfect for development, but I would suggest you use a server that gives you proper configuration flexibility in production such as Apache or nginx.

  Your other thoughts

Java/Ruby/PHP/Javascript

Are programming languages. Node.js is like an ecosystem that allows you to run client/server/middleware/tools Javascript based applications. Someone did a great job of comparing it with a Java ecosystem. Right here.

  But is Laravel artisan serve possible for production?

In theory, yes. It would require your development setup to be in production as well. Hence from this assertion, the answer becomes self evident for security, operability, configuration and performance to name a few. You will need a different configuration for production.

  How to serve RESTful API?

No matter which language you use, choose a library or a framework that will give you the tools to implement your APIs. Since Laravel is your framework, you can take a look at this tutorial to get started.


Convert the zip file into a gz file before running docker build, possibly in a wrapper script.

Or even go one step further, and extract the archive first, then use COPY to copy the resulting folder contents.

When you are using archives from the internet on the other hand, ADD http://somewhere/file.gz /data will extract the downloaded file directly into that folder. If you have a problem with zip/gz format there, then use RUN curl -o somewhere/file.gz /tmp/file.gz && tar xzf /tmp/file.gz && rm /tmp/file.gz to only create a single layer without leaving the file behind.


There's no generic answer to this, but a ton of options.  Usually the right choice for you would be dependent on what monitoring and alerting stack you're already using.

For instance, if you are using Graphite, Prometheus, rrdtool, or any other round-robin database to record a metric when you're sending out emails, those all have APIs that allow you to query them across a time range to see what the values were.  And depending on what alerting system you're using (Nagios, Icinga, Sensu, etc.) there is probably already a plugin that allows you to easily interact with that particular metrics database.

From another perspective, if you're logging when you send emails, then a log system like ELK will allow you to search and see if any of those log lines are found.  Again, the various alerting systems will have plugins to most common log systems.  (There are also individual systems designed purely for those tools, like ElastAlert with its flatline type for ELK.)

Thirdly, you could approach it the way that you are, by checking in with customer.io's API on a regular basis.  But no, there is not one standard tool for doing this, but rather one (or at least one!) per alerting system.

Finally, you might consider doing synthetic checks instead of or in addition to your real-user monitoring.  This means having an automated test that performs actions that you expect to result in sending an email, and then checking to see that an email gets sent.


How to make an AWS S3 bucket accessible over HTTP?

Download - yes. Simply set each Object ACL to be publicly readable.

List - sort of. If you set the Bucket ACL to publicly readable anyone can list the content. However it's a rather human-unfriendly XML listing.
You can generate your directory listings to some index.html files through an external process and configure the bucket to serve those.

Basic auth - nope. You can look at something like S3 pre-signed URLs to protect the content.

Hope that helps :)


Using Prometheus to monitor Spring Boot Applications in Kubernetes Cluster

The best way to deploy prometheus to kubernetes is with the helm chart:

https://github.com/helm/charts/tree/master/stable/prometheus

If you haven't used helm yet, its a very simple install to your laptop/etc and the cluster (and the newest version doesn't even require a cluster side install).  It takes like 30 seconds.  It's a package manager for kubernetes and it allows you to install, upgrade, list, and delete "charts" which are basically simple wrappers around kubernetes YAML files (with some nice templating).  It would even be good to wrap your spring boot apps in a helm chart =).

Once you've got prometheus running well, there is a good tutorial here on setting up actuator's prometheus endpoint in spring-boot and getting it picked up by prometheus by editing its values.yaml.

https://www.callicoder.com/spring-boot-actuator-metrics-monitoring-dashboard-prometheus-grafana/

# my global config
global:
  scrape_interval:     15s # Set the scrape interval to every 15 seconds. Default is every 1 minute.
  evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute.
  # scrape_timeout is set to the global default (10s).

# Load rules once and periodically evaluate them according to the global 'evaluation_interval'.
rule_files:
  # - "first_rules.yml"
  # - "second_rules.yml"

# A scrape configuration containing exactly one endpoint to scrape:
# Here it's Prometheus itself.
scrape_configs:
  # The job name is added as a label `job=<job_name>` to any timeseries scraped from this config.
  - job_name: 'prometheus'
    # metrics_path defaults to '/metrics'
    # scheme defaults to 'http'.
    static_configs:
    - targets: ['127.0.0.1:9090']

  - job_name: 'spring-actuator'
    metrics_path: '/actuator/prometheus'
    scrape_interval: 5s
    static_configs:
    - targets: ['HOST_IP:8080']

There's also some info at the end of the tutorial about surfacing all this in Grafana for slick visualization.


IAM Role for Fargate has two policies:

The first one describes which service can assume the role and its permissions. In this case it will be the ecs-tasks.amazonaws.com service (= Fargate) that can call sts:AssumeRole to get all the permissions from this Role.
When Fargate assumes the role it gets the permissions specified within, these are the SSM, KMS and SecretsManager permissions.

If you are using CloudFormation you can do something like this:

  FargateRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        # This says that Fargate can assume this role
        Version: '2012-10-17'
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
      Path: /
      Policies:
      - PolicyName: FargatePermissions
        PolicyDocument:
          # This says what permissions will
          # the Fargate container receive
          Statement:
          - Action:
            - ssm:GetParameters
            - secretsmanager:GetSecretValue
            - kms:Decrypt
            Effect: Allow
            Resource: '*'

If you are building the role manually in the console be sure to select in the first step that it's an IAM Role for ECS Task, that will create the equivalent of AssumeRolePolicyDocument from the above code snippet.

Then in the next step add the policy without the sts:AssumeRole:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "ssm:GetParameters",
                "kms:Decrypt"
            ],
            "Resource": "*"
        }
    ]
}

That should create the IAM Role you need. Ideally you should also restrict the access only to specific resources instead of using "Resource": "*" but for start it's easier to just use the wildcard.

Hope that helps :)


Vault `SSH-CA` Elliptic Curve rather than `RSA`

I think the answer should be yes to ecdsa but no to ed25519, but that it is currently no to both.
You can externally generate an ecdsa keypair and load it into ssh/config/ca but vault-1.4.3 cannot sign using it. I haven't tried ed25519.
Golang's ssh code (which vault uses) doesn't appear to know how to sign with ed25519 but should be able to sign with ecdsa. However, I think there's an issue with an inappropriate default being set elsewhere that means it is always being told to use an rsa-based signing algorithm and hence doomed to fail for ecdsa keys. See:
https://github.com/hashicorp/vault/issues/8414#issuecomment-656145432
If I am right, it looks like an easy fix so it may be available soon.
This is possible as of August 2020, see https://github.com/hashicorp/vault/pull/9824, tested with vault 1.6.2


pod to pod can not be reached through service clusterIP running in the same minion

The response from the called service is not DNAT'ed back to set src to the service clusterIP. So the response packet is going directly via cni0 bridge and not getting into iptables, preserving pod's IP.

to fix this i added the following option to kube-proxy and issue was gone.

--masquerade-all=true


Jenkins parameters default to env variable?

You need to use double quotes instead of single quotes.  Single-quoted strings don't perform string interpolation.

For instance:

parameters {
    string(
        name: 'DEPLOY_BUILD_NUMBER',
        defaultValue: "${BUILD_NUMBER}",
        description: 'Fresh Build and Deploy OR Deploy Previous Build Number'
    )
}


Does the Chef bash resource create history entries?

In this case, the best way would be to use chef data bags which is specifically known for this.
A great documentation is given at https://docs.chef.io/data_bags.html

Also, As Roland pointed above in the comment, make sure to use sensitive true in your bash resource to avoid any such information printed on screen or going to the logs.


Trigger downstream pipeline job via generated variable in upstream freestyle job

The variable GIT_AUTHOR is only visible in the build step where it's defined. You can dump the parameters for the downstream job in a properties file:

cd $WORKSPACE/prancer/
GIT_AUTHOR=$(git show --format="%an" | head -1)

echo '-------------'
echo 'git_commit is '$GIT_COMMIT
echo 'git_branch is '$GIT_BRANCH
echo 'git_author is '$GIT_AUTHOR
echo '-------------'

cat > alex_test_pipeline.properties &lt&ltEOF
GIT_COMMIT = $GIT_COMMIT
GIT_BRANCH = $GIT_BRANCH
GIT_AUTHOR = $GIT_AUTHOR
EOF

In the Trigger parameterized build... step, replace the Predefined parameters with Parameters from properties file (or something like that - I don't remember the exact wording) and select the filename used above. You might also want to check Build only if file exists.


According to the docs tmpfs is linux only.

RAM disk

If you want "RAM only storage", you can literally use a RAM disk. ie:

diskutil erasevolume HFS+ 'DockerDisk' `hdiutil attach -nomount ram://2097152 `

Then you can point volumes at /Volumes/DockerDisk. Drop and recreate at will.

Docker will still store its VM and images on disk. See: Docker > Preferences > Disk.


Open Ports on Google Cloud Load Balancer

You can't add deny rules to GC firewall. The default policy is Deny. You can only add allow rules - allow everything you need and let everything else get rejected.

Since the ports you need to block are allowed by default, you simply need to remove them. Check the name of the default rule:

gcloud compute firewall-rules list [NAME …] [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,…]] [--uri] [GLOBAL-FLAG …]

and delete it with:

gcloud compute firewall-rules delete NAME [NAME …] [GLOBAL-FLAG …]

You may check here for more detailed explanation on how to handle Google Cloud firewall.


The split function returns a list of strings. I believe encapsulating the function in a list is what is giving you the error. Have you tried removing the brackets around the split function? Something like:

!Select [ "0",  !Split [ "," , !ImportValue [ !Sub "${ExportPrefix}-SubNets" ] ] ]


Azure DevOps deploy to Azure VM's without a public IP

Yes it is possible. I was working on something like that a few days back. You can use Self-Hosted agents directly on one or all of the VMs: https://docs.microsoft.com/en-us/azure/devops/pipelines/agents/v2-windows?view=azure-devops


Either use the --query attribute

aws rds describe-db-snapshots --query "DBSnapshots[?Encrypted].DBSnapshotIdentifier"

If the [?Encrypted] does not work, try [?Encrypted == 'true'] as the first is from JMESPath improved filters. The quotes might need to be backticks in some case. It all depends.

Second way:

aws rds describe-db-snapshots --output json | jq '.DBSnapshots | map(select(has("Encrypted"))) | .[].DBSnapshotIndetifier'

One of them should work. Might need a bit messing around as I don't have your output to tune the jq command. Feel free to edit and fix the answer.


Is Google Kubernetes (GKE) worth it for a program that runs once a week?

If your workloads are exclusively ephemeral, the answer is probably not worth the infra management effort of deploying K8S.

Kubernetes is best suited for types of workloads that are continuous, with regular incoming traffic and that require zero downtime. That's why it enables you to do things like rolling updates and implementing advanced traffic management patterns like Canary releases.

While you could have your cluster autoscale down to 0 worker nodes you would still incur in the cost of running the control plane node which requires running pods for the apiserver, the controller-manager, the scheduler and the kube-proxy in addition to running the autoscaler pods and log/metric collectors.

Deploying and destroying the clusters on demand is definitely feasible if you manage the cluster with Infrastructure as Code and design your pipelines so that they can setup and teardown clusters with minimal human intervention (waiting for apiserver to come up, waiting for workers to register and come up, etc). An even more elegant way of approaching it would be with using the Cluster API although this would require a management cluster.

Now, is it worth dealing with all the complexity inherent to K8S only to benefit from the downscaling and only to run occasional workloads? I'd say is probably best to manage your instances as regular autoscaling groups.


Kubernets docker registry behind nginx-ingress

First of all 404 error is resource error in kubernetes. It means your container in the pod is not created by your first script. Even if it is created and you can see it then your labeling is wrong in the second script.

I would suggest you check matchlabels of both YAML scripts. So in your case I can see that matchlabel is docker-registry in the spec section of the first script, but I don't see any docker-registry in the second script. I believe that in your metadata part of ingress script should have "name = docker-registry" instead of "name=docker-ingress".


DevOps is not a role and in words of @Tensibai here:

  DevOps is roughly an organization pattern aiming at breaking the silo between developers and sysadmins.

So, you could already be on the DevOps moto and if you don't think you are, you can probably just try to implement the DevOps pattern on your organization or move to another organization with that pattern already implemented.

You may want to become an Infrastructure Engineer, a SysAdmin Engineer, an Automation Engineer, a Site Reliability Engineer, a Performance Engineer... but surely you can not become a DevOps Engineer.

You can get a good sense of your path by reading some questions and answers on this site. Here are a few ones:

What is DevOps?

What is the difference between DevOps engineer Vs DevOps consultant Vs DevOps architect?

What is the difference between SRE and DevOps?

What could be a valid definition of DevOps to introduce it to a novice?

What is the difference between the traditional Development and Operations
Model and Site Reliability Engineering?

What is the difference between Sysadmin and DevOps Engineer?


Site monitoring browser-only tool running in frontend only?

You have a few options for this:

If you can pay for this, use commercial API monitoring solutions like Runscope or APImetrics. They're easy to setup, have no maintenance overheads, and show you detailed data and alerting etc. The problem with this approach is that they cost money, and if you have a miniscule ops budget or this is a hobby project, it can be hard to justify spending on this.

...which brings me to the alternative: roll your own. If you have your own system monitoring and metrics setup (Nagios/Icinga/Sensu, and Grafana etc), you can write check scripts for whatever data you need (availability, response time or latency etc). Some of these tools integrate with time series databases like graphite/influxDB, so you can push the check data to that and use a visualization tool like Grafana to show graphs and charts based on this data (here's a blog post describing Icinga-Grafana integration)


what you're looking at is a resource declaration, mostly a class taking a block as parameter.

In ruby the do code end syntax is the prefered way over the curly braces syntax { code } which is prefered for inline code.

So mostly, what you have is the same as:

aws_elastic_lb('elb_qa'){ aws_access_key aws[‘aws_access_key_id’]; aws_secret_access_key aws[‘aws_secret_access_key’]; name ‘elb_qa’; action :register }

In recent version of chef (14.X) the name attribute should be the name of the block (what is just after the resource type (aws_elastic_lb)

More details in this SO quastion about ruby syntax.

Concerning Chef itself I highly suggest you follow the tutorials at https://learn.chef.io for a better overview of what is what in cookbooks.


What is the difference between Sysadmin and DevOps Engineer?

Mainly DevOps is not a role (when used as such it's more a buzzword than a real role).

DevOps is roughly an organization pattern aiming at breaking the silo between developers and sysadmins.
The main goal is to build teams with devs and sysadmins (along with testers usually) responsible for a product (application) from its definition, architecture decisions up to the maintenance in run of this product.
Each member of the team will be part of the decision on the whole life-cycle of the product, a dev will do some sysadmin tasks in production, and a sysadmin will participate  in the design phase of the product to avoid caveats from the infrastructure perspective for example.

At ideal, a sysadmin would also be part of the development team for the product, in real world sysadmin code more on the configuration around the product and monitoring solutions, but being able to voice concerns to other members of the team avoid a lot of misunderstanding on the deployment process.


How to reconcile Infrastructure as Code and not storing env config in code?

There are, as always, a few ways to solve this.

You can use a central source to keep secrets that each server reads from ala Hashicorp Vault. While popular this is not my preferred approach as its rather complex. There are quite a few key value stores that can provide similar functionality such as AWS Parameter Store.

You can manually put data in these stores and/or store it encrypted in git. Using tools such as kops (AWS only) or ejson (provider agnostic) you can have the secrets in the same repo as the app. Then have the app either fetch all the secrets at deploy time or just the decryption key so it can load the encrypted file.


Where to start? Scaling PHP applications on AWS

Here's a rough approach to scaling any stateless app on AWS:

Run the app in an Auto Scaling Group (ASG). An ASG makes it easy to manage multiple servers, will automatically replace failed servers, and allows you to automatically scale the number of servers up or down in response to load.
To run an ASG, you need to create a Launch Configuration. This is a "template" that specifies the configuration for each server in the ASG: i.e., what type of instance to run (e.g. t2.micro), what AMI to run on the instance, the security group settings, etc.
The AMI you run on each instance in the ASG should have your app already installed (i.e., your PHP app). You can define your AMI as code using a tool like Packer.
The app in your AMI should be configured to run on boot using a process supervisor (e.g., using systemd or supervisord; this will also ensure the app is restarted automatically if it crashes.
Every time you change something in your app, run a build process to create a new AMI, update the Launch Configuration to use this new AMI, and roll that AMI out across your ASG. For example, you could do a zero-downtime deployment (somewhat similar to a blue-green deployment) by doubling the size of the ASG, waiting until all the new servers (from the updated Launch Configuration) launch and pass health checks, and then reducing the ASG back to its previous size (the ASG will terminate oldest instances by default).
With an ASG, you have more than one server, but you want to give your users a single endpoint to use. The typical solution to this is to deploy a load balancer in front of the ASG. If you're building a typical HTTP/HTTPs app (e.g., just about all PHP apps), you'll want to use the Application Load Balancer (ALB); if you're building an app that listens directly for TCP connections, you'll want the Load Balancer Classic or Network Load Balancer. Whichever load balancer you pick, AWS will create a domain name for it that you can use, and any requests you send to that domain name will be routed in round-robin fashion to different servers in your ASG.
You should a) configure the load balancer to perform health checks on your app so that it only routes to healthy servers and b) configure your ASG to register all of its servers in the load balancer automatically and to use the load balancer for health checks.
You can create Auto Scaling Policies for the ALB that change the number of servers in your ASG depending on various CloudWatch metrics. For example, you could configure the ASG to add servers when average CPU usage is over 80% and to remove servers when CPU usage drops below 60%.

For more info, check out A Comprehensive Guide to Building a Scalable Web App on Amazon Web Services.


Windows network share application deployment automation

Check out Otter it's basically the only Configuration management/Infrastructure as Code tool with native Windows support or Possibly BuildMaster as well which is more on the release coordination deployment automation side of things.

If you're a Windows heavy shop definitely take a look at the tools mentioned on the Winops wiki page - will probably help point you in the right direction.


Here is my YAML for multiple artifacts from a single build.

pool:
  name: Hosted Windows 2019 with VS2019
  demands:
  - msbuild
  - visualstudio
  - vstest
  - npm

steps:
- task: NuGetToolInstaller@0
  displayName: 'Use NuGet 4.4.1'
  inputs:
    versionSpec: 4.4.1

- task: NuGetCommand@2
  displayName: 'NuGet restore'
  inputs:
    restoreSolution: '$(Parameters.solution)'

- task: VSBuild@1
  displayName: 'Build solution WebApi'
  inputs:
    solution: '$(Parameters.solution)'
    msbuildArgs: '/p:DeployOnBuild=true /p:WebPublishMethod=Package /p:PackageAsSingleFile=true /p:SkipInvalidConfigurations=true /p:PackageLocation="$(build.artifactstagingdirectory)\\"'
    platform: '$(BuildPlatform)'
    configuration: '$(BuildConfiguration)'
    msbuildArchitecture: x64

- task: PublishBuildArtifacts@1
  displayName: 'Publish Artifact: WebApi'
  inputs:
    PathtoPublish: '$(build.artifactstagingdirectory)'
    ArtifactName: 'dotnet-webapi'
  condition: succeededOrFailed()

- task: DeleteFiles@1
  displayName: 'Delete build.artifactstagingdirectory for Angular'
  inputs:
    SourceFolder: '$(build.artifactstagingdirectory)'
    Contents: '**'

- task: Npm@1
  displayName: 'npm install'
  inputs:
    workingDir: project/ClientApp
    verbose: false

- task: Npm@1
  displayName: 'npm run prod-build'
  inputs:
    command: custom
    workingDir: project/ClientApp
    verbose: false
    customCommand: 'run prod-build'

- task: Npm@1
  displayName: 'npm run dev-build'
  inputs:
    command: custom
    workingDir: project/ClientApp
    verbose: false
    customCommand: 'run prod-dev'
  enabled: false

- task: CopyFiles@2
  displayName: 'Copy Angular/Dist to build.artifactstagingdirectory'
  inputs:
    SourceFolder: project/ClientApp/dist/ClientApp
    Contents: |
     **
     !config.json
    TargetFolder: '$(build.artifactstagingdirectory)'

- task: PublishBuildArtifacts@1
  displayName: 'Publish Artifact: Angular'
  inputs:
    ArtifactName: angular


In short, it's not practically possible. This S/O answer is quite detailed.

Jenkins used a cron
expression, and
the different fields are:
MINUTES Minutes in one hour (0-59)
HOURS Hours in one day (0-23)
DAYMONTH Day in a month (1-31)
MONTH Month in a year (1-12)
DAYWEEK Day of the week (0-7) where 0 and 7 are sunday

cron syntax simply does not support every n days.
An impractical option wuld be to have a daily job with a Conditional BuildStep to calculate if this day is n × 30 days from a given fixed day and abort if not..
But every 30 days doesn't really align w/calendar anyways, so is that really the intent?


Serverless framework: how to specify a c++ lambda function with provided deployment package

I don't see any documentation from serverless.com that they support C and C++ (while AWS Lambda might do), I have asked about it now so that we can know:

https://forum.serverless.com/t/c-and-c-support/8045

("Supports Node.js, Python, Java, Go, C#, Ruby, Swift, Kotlin, PHP, Scala, & F#") but if you want to try then I think that you should try some other name than "function" for your function. I did not try this at home but all examples use some other name than "function" because that word might be reserved.

https://serverless.com/framework/docs/providers/aws/guide/resources/

If that still won't work, check your path to your code and maybe you also want to set up everything up with a CI/CD pipeline with GitLab for example. That's how I do it.


Elastic Beanstalk give error Root Object doesn't exist in Jenkins

This error occurs because you used a variable ($) and wildcard name (*.war).

Elastic Beanstalk plugin does not support Variable or wildcard name in the Value.

I suggest a use full path of Jenkins job instead of ${WORKSPACE} and full war name like ROOT.war instead of *.war


I found this same error in StackOverflow, problably that you problem it's about your authentication anonymous

If help you: JENKINS Authentication Fails


How do I get the UUID of a build Mac from Azure DevOps?

These steps in the Azure DevOps docs may be helpful: Sign Your Mobile App.

Basically you should be able to generate your p12 and provisioning profile on a mac you control, and then using the "Install an Apple certificate/provisioning profile" tasks you can install the certs onto the mac agent for building.  No UUID should be needed for the agent.  Here's a guide that may be useful (it's targeting iOS, not macOS but the concept is the same).

The way I set this up on a project was to go through Microsoft's AppCenter which had tooling to automatically handle the provisioning profile madness: Deploy Documentation.


How to exclude a certain linenumber of an Ansible playbook when testing it using Molecule?

According to the yamllint documentation you need to add a special comment to the line -- <string-to-be-excluded>  # yamllint disable-line rule:line-length

---
#defaults/main
firefox_checksum: sha512:49d776cfb5f42c6e5ea1a55a80d9f6bad223080b16baa0d39de63534c25e68340091b4e16be5355d565f81291cb94fb996f03ae7e3e4c7a28021b0a0929daf58 #yamllint disable-line rule:line-length


Best practice when automating Drupal (or other soft) installation regarding database settings

Your question sounds like you should have a look at what I call Features Configuration Management, aka FCM. FCM is not only about using Drupal's Features module, and not about Configuration Management (as introduced in Drupal version 8). Instead, it is a special case of Software Configuration Management, aka SCM, applied to Drupal.

Mostly because Features can be considered as a code generator, whereas that generated code may be considered as the build script (as in your question). Which can then also be used to be migrated through multiple environments.

Have a look at my (popular) answer to "How to use the Features module in a 3 dev environments?" for (way) more details about all this.


What practices or tools enable Continuous Deployment of Databases?

Pramod Sadalage and Scott Ambler wrote a book Refactoring Databases: Evolutionary Database Design that is an incredibly solid primer to the subject of DBs in a CD org/team.


How to avoid the flakyness that comes with "gpg --recv-key"?

Download the key once:

gpg --keyserver pgpkeys.mit.edu --recv-key A0E98066
gpg --export A0E98066 > openresty-agentzh-A0E98066.gpg

Then later you can import the key without having to access the keyserver:

gpg --import openresty-agentzh-A0E98066.gpg


Access service in remote Kubernetes cluster using ingress

https://wso2-apim-gateway/ is the URL that will point to the gateway service according to your configuration. This is defined by the host: wso2-apim-gateway part of your configuration. Note that your load balancer (172.17.17.100) is a private IP address, so you will need to be on the same network to access it.

I can't see any further configuration required, except perhaps TLS certifications - if you receive a 5xx response, you may want to check the logs of the ingress-nginx deployment/replicaset.


Is there one website that contains all relevant DevOps news and gets updated on a daily basis?

There is a protocol for this: RSS, Rich Site Summary. Technically, there are 3 protocols RSS, RSS2 and Atom, but most readers support all of them, and many servers mix RSS and RSS2 features.

First, choose your RSS reader, from:

browser add-ons like Feedbro,
centralized aggregators like Feedly and FeedReader,
stand-alone applications like RSSOwl
mail clients like Thunderbird.

Second, choose the sources you care about and subscribe to them - you're the curator and most news websites publish RSS feeds. Many don't even know about it, as CMSs like Wordpress sometimes publish an RSS feed by default. I wouldn't be surprised if it had something to do with SEO... Soon, you'll have an OPML list of your favourites.

From your question:

https://kubernetes.io/feed.xml
https://www.docker.com/blog/feed/
https://ubuntu.com/blog/feed
https://aws.amazon.com/blogs/devops/feed/
https://devblogs.microsoft.com/devops/feed/
https://cloudblog.withgoogle.com/products/devops-sre/rss
https://blog.centos.org/feed/
https://github.blog/feed/

And a few personal recommendations:

https://www.theregister.co.uk/devops/headlines.atom
http://feeds.arstechnica.com/arstechnica/security
https://stackoverflow.blog//feed
https://xkcd.com/rss.xml
https://www.theregister.co.uk/data_centre/bofh/headlines.atom

Many readers will have an option to search for a feeds on a website, which simplifies the search.


how to control pod termination speed in kubernetes

There is a default grace period for pod termination of 30 seconds. See: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.

You can customize the grace period setting terminationGracePeriodSeconds at the pod spec level.


Which Users Should I Create With Terraform And Which With Ansible?

I'd say to do it as you last explained it: using the admin user created by tf with ansible, and then create any other user using ansible.

The downside is from the security pov, does ansible needs an admin user ? If yes then keep the tf created user, if not then i'd suggest creating a new non-admin user for ansible.

As ansible is a ssh based config mgmt tool, you should think about using a strong pki.

Using the std tf admin user may results in a unique admin created on your every ubuntu vm, with the very same ssh key and this is not a very good practice (although it is a widely spread practice from my personal experience), this is where a real and strong pki may help you.

Anyway, tf needs to create an (admin) user so keep it that way, then switch to you config mgmt to handle any other required users.


the best way I think is to create a var  yml file and include it in your ansible-books:

    - name: Include vars of stuff.yaml into the 'stuff' variable (2.2).
      include_vars:
        file: stuff.yaml
        name: stuff

see include_vars_module


How can I deploy an AWS Lambda function from Jenkins?

I found the solution while trying to manually deploy the Lambda function as a jar file. These are the steps -

Create your Lambda function as a Maven project using the AWS documentation.
Create your Jenkins job as a Maven project and specify package in the goals section.
Follow the Jenkins Lambda plugin documentation for deployment and specify target/your-project-1.0-SNAPSHOT.jar as the Artifact location.

This should build your Lambda function with Maven and then deploy it to AWS.


If I understand Docker Desktop and Hyper-V correctly, volumes are stored inside a MobyLinuxVM.

That's right and it seems to be possible to  move the whole VM to another drive as described here.

Maybe you could solve you problem by using a volume driver as described in the official docs.

Another approach is to use a Linux VM with Docker and tell your Docker on Windows installation to use another daemon by setting the DOCKER_HOST environment variable. This will give you more control and will allow you to use everything available on Linux (mounting, symbolic links, ...). But of course this will not work if you or your IT department want to use Windows containers some day.


Mostly for devs but knowledgeable to others with the "disaster girl" meme:
"Works on my machine.. Ops problem now!" This illustrates that lack of responsibility can endanger the whole company, and the value of software working only in a specific environment is not absolute.

Also, the matrix of hell. Adding Docker might seem as one column more, but containers will become to-go technology and the standard architecture on long term. So, you can run Docker containers also with Kubernetes or Apache Mesos.


This question seems to have been answered in the Chef issue. To close the loop, I will summarise it here:

This was a bug introduced in Chef 12:

  The issue is with chef_solo vs chef_zero. It seems chef_solo was the old way of doing Chef things. So I added chef_zero.enabled true in the knife.rb file to activate chef_zero instead of chef_solo. When you do this, you should be able to upload.

It was subsequently fixed in Chef 13:

  This is fixed in Chef 13.3.3, which will be released in the ChefDK 2.2 release

At the time of writing, Chef is in major version 15, so this issue is very unlikely to be encountered in the wild.


So basically I've ended up turning these flags off (/app/management/kibana/settings)
filterEditor:suggestValues
discover:searchOnPageLoad
doc_table:highlight
visualize:enableLabs
telemetry:enabled

Other ideas I had in mind:

adding nginx as a proxy caching all the static files (js for plugins / images)
warmup script (periodically makes requests to predefined hot pages for Kibana to internally cache these pages) if that would work
migrate to hosted cloud solution which might be optimized better for the loading time


This seems to be a proxy issue in your config. It is solved by setting NO_PROXY as follows:

  Edit the proxy environment variables in the OpenShift Origin control files. Ensure all of the files in the cluster are correct.

HTTP_PROXY=http://<user>:<password>@<ip_addr>:<port>/
HTTPS_PROXY=https://<user>:<password>@<ip_addr>:<port>/
NO_PROXY=master.hostname.example.com,10.1.0.0/16,172.30.0.0/16

  Supports host names and CIDRs. Must include the SDN network and service IP ranges 10.1.0.0/16,172.30.0.0/16 by default.


What git command could be used to check when a remote branch was created?

Note: this answer shows how to find branches that have been *updated* a long time ago, not branches that have been *created* (i.e., spliced off of some parent) a long time ago. I believe this is what the OP actually wanted (as opposed to the title he chose for the question), as this would lead to good candidates for deletion.

You have to recall that a branch in git is nothing "physical". It is, by definition, and literally, only a simple text file in .git/refs which only has its file name (which is the branch name) and the hash of the tip/head commit. It has no date information or anything else.

So git branch will not help you here.

The object type that has dates associated with it are commits, in git. So you have to list commits. This is done with git log.

So a working command would be:

git log --remotes --before 2018-01-01 --no-walk --decorate

You can read up the details on https://www.git-scm.com/docs/git-log , but in short, it means

--remotes: start with any and all remote branches (substitute --branches for local branches)
--before ...: only list commits older than the date given
--no-walk: only list the very first commit for each branch, don't walk back the history
--decorate: display all tag and branch names associated, just in case

This will give you all branch heads that are older than your given date.


Overview of Gitlab CI/CD process for multi-project SOA application. Releasing and Versioning

Managing versions of different services can be tricky. For now I've never found a good HOW TO out there. Like most things you do what suit you the best. Here is a couple of suggestion you could use:

-> Tag docker image with their commit sha:
Pretty easy to do when you are using gitlab this is an already set environment variable that you can uses when building you image in the CI/CD pipeline. It's easy to track what code this container. Also when rolling back one of your service you can see directly the merge request you are rolling back on.

-> Continuous deploy on your staging environment:
When one is merging a new feature on the master of one of your services deploy it as soon as possible so you can test the impact on all other services.

-> When staging looks good trigger a release job:
That job release shall be present on all your services. The purpose of this job is to:

Check if the service current version (commit sha) match the currently deployed in production.
If not trigger the deploy job to production for this commit sha pipeline.
If the deploy to production job work then we shall store the current sha deployed in a new folder somewhere in a K/V store that way we keep a single source of truth of what's is being deployed and when

More on that K/V store and release job:

This shall be trigger form a different pipeline on a project you use only to remotely trigger the updated versions on your whole SOA-application.
That way we have a repo that contain a script that will trigger the job release of all the services.
It will create a new folder on your K/V store and all the triggered release job of your application will write their current version in it (updated or not)
Once finished only service that had change will be deployed but you will have a major version for your wall application like this on the K/V store:

release_0.1.5:
 - user_service = COMMIT_SHA
 - payment_service = COMMIT_SHA
 - organisation_service = COMMIT_SHA
 - ect..

When this job is replay it will detect that the folder already exist and so will trigger the deploy of all the version present in it so you can rollback your App to an older state.

Deploy to production job on each of your service can be protected to only be triggered from the main release project. But for quick fix reason you could also let it open just make sure it update the current K/V folder.


What package manager does the gitlab docker CI image use?

https://hub.docker.com/_/docker/

Seems it's just a reference to the above... Which uses APK as the package manager


Jenkinsfile update using version control

It sounds like you want a when statement.
As I understand it, you want to execute stage B when you are on branch update/jenkinsfile. In order to do this, you need to add a condition to stage B:
pipeline {
    agent any
    stages {
        stage('A') {
            steps {
                sh 'echo "Step A"'
            }
        }
        stage('B') {
            when {
              branch 'update/jenkinsfile'
            }
            steps {
                sh 'echo "Step B"'
            }
        }
    }
}

Note that you also need your jenkins to discover this new branch - this will depend on how you have configured the job. The above assumes that you have a multibranch pipeline job which is configured to include that branch.


Why is Rails (with Nginx/Passenger via Ansible) unable to see my RAILS_MASTER_KEY environment variable?

Root cause: environment variables from /etc/environment are not passed to Passenger. The standard method seems to be passenger_env_var in your nginx config as suggested by user joshaidan.


How to keep original and new repositories in sync during a migration? (including the commit history)

Simply keep pushing stuff between the repositories. Git pushes are designed for exactly that.

So, if origin is the old repository, and newis the new one, and you want to move new stuff in the master branch from origin to new, then, locally:

git checkout master && git reset --hard    # to clean up any local changes, optional
git pull origin
git push new

That's it. master is a branch like any other, so if you have multiple branches, rinse and repeat.


Change owner of files created inside a Docker container without changing the Dockerfile

No need to change the Dockerfile. Just define a certain user, e.g. jenkins and a certain uid, e.g. 1000 and ensure the same uid is used when a folder is mounted.

ARG user=jenkins
ARG uid=1000

# Jenkins is run with user `jenkins`, uid = 1000
# If you bind mount a volume from the host or a data container,
# ensure you use the same uid
RUN mkdir -p $JENKINS_HOME \
    && chown ${uid}:${gid} $JENKINS_HOME \
    && addgroup -g ${gid} ${group} \
&& adduser -h "$JENKINS_HOME" -u ${uid} -G ${group} -s /bin/bash -D ${user}

RUN chown -R ${user} "$JENKINS_HOME" /usr/share/jenkins/ref

https://github.com/jenkinsci/docker/blob/master/Dockerfile-alpine


You could issue an npm pack which will create a tgz and then you could push it to an artifact manager like Nexus3. By doing this one uses the same approach as creating artifacts in Java like JARs and WARs. If you ensure that the artifacts cannot be overwritten, you specify a version and restrict publication to an artifact manager by the CI like jenkins then the artifacts are immutable and you are in control. E.g. if there is a bug in version X you could revert it to the previous version that was working well.

Note: if you are planning to use npm pack I would suggest to use an abbreviation like @angular does to ensure that there is a clear destinction between artifacts that were created by your company and libraries from npmjs.org. This could be done by adding an abbrevation of your company like @z to the package name. A name could look like: @z/some-package.


What is the best way to deploy a compiled language project with docker and jenkins?

I do not know how how about Jenkins, but GitLab CI has feature called artifacts which allow you to

explitely share some files/directories between builds
download them from GitLab Pipeline view

Additional pro is that allows you to make deployments manual actions.

Also if you are building fat JARs you do not need Docker for your deployments at all.

So the best solution for you is to have separate task for building release and separate for deployment (which can be manual job or not).


In our case yes, it is just ease of deployment/operations. We have existing skills with k8s and that's what we're most comfortable operating.

I guess you're right that its somewhat odd to run Concourse's scheduling inside of k8s scheduling, and it would be great to see Concourse being able to leverage Kubernetes directly at some point.


Jenkins configuration to support multi-config multi-branch CI

You can use a Jenkinsfile for this. You can add logic  with groovy for every condition you've listed above.

You'll want to use a multi-branch pipeline build for sure, and just write in conditions / switches to determine what you want to do based on the current branch. Jenkins provides a global environment variable for all builds: BRANCH_NAME

The job will run on any branch that contains the Jenkinsfile and you can write conditions in for steps if you  want to include / exclude certain branches. You can use the when directive for full-step conditions: https://jenkins.io/doc/book/pipeline/syntax/#when

For handling credentials: https://jenkins.io/doc/book/pipeline/jenkinsfile/#handling-credentials


How to export Cucumber Reports via Jenkins Pipeline

Working off what @chupasaurus said, here's what I came up with:

node('master') {
    dir("../builds/${BUILD_NUMBER}/") {
        sh "cp -r cucumber-html-reports $WORKSPACE"
    }

    archive "cucumber-html-reports/*"
}

Obviously all this does is archive the report for that build, but you can easily extend this to copy it somewhere else where it can be hosted or manipulated. Just make sure you put this after the Cucumber Reports plugin step.


https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

https://linux-audit.com/linux-capabilities-hardening-linux-binaries-by-removing-setuid/

  With Linux capabilities, you can grant certain privileges to a process
  without granting all the privileges of the root user. To add or remove
  Linux capabilities for a Container, include the capabilities field in
  the securityContext section of the Container manifest.

In summary, in k8s it is possible to assign certain privileges to a pod. Assign the privileges that are required by a certain container.

There is an open issue:

https://github.com/kubernetes/kubernetes/issues/7961


PowerShell Desired State Configuration:

Pro's

Great support for Microsoft Technologies (IIS, Exchange, SharePoint, etc.)

Con's

OS and PowerShell Version requirements can become prohibitive.
WinRM and the LCM can be flakey requiring fiddling around restarting services to get it working.
Opensource Ecosystem isn't as strong.

Ansible:

Pro's

Huge Open-source ecosystem around Ansible, with many ways of doing one task.
Support for a wide range of technologies, enabling you to use Ansible YAML for vSphere, Azure, AWS, etc.
Easy to hire people with Ansible experience.

Con's

Poor support for the nitty-gritty of Microsoft Products, however, you can use the win_dsc module to call DSC from Ansible.
Ansible is becoming less important with the advent of Cloud, Kubernetes and Terraform.

Personally, I use DSC for my workstation and that's it now.  Previously I used it to bootstrap MongoDB and Redis clusters but eventually switched to Ansible because it meant throwing away the hard to maintain DSC and using open-source Ansible modules from Galaxy.


There is an improvement issue open for, I think, exactly what you're looking for: Bamboo should be able to group projects:

  Description

  I'm mulling over redoing our project heirarchy and grouping things a
  little more logically, and realize that being able to group projects
  in Bamboo would be brilliant. It's already stellar that each project
  can contain multiple build plans. Having project groups (a la Jira)
  would make my OCD squeal. Any chance of this?


IaC Deployment in Azure with Terraform + Chef vs. Puppet vs. Ansible for Data Engineers

Cloud setup could be done completly by Terraform. Check out terraform provider resources for required parameters ex. Azure Data Factory
Configuration management stuff mostly in use for OS tuning inside Virtual Machines. So maybe you don't need them at all.


terraform - how should I clone my code repo?

You can achieve the clone of the repo and the execution of docker-compose in several ways.

You are right when you think that cloud-init could do that. Check this link for more information


I can't find the jenkins password to unlock the website

Try finding this file: C:\Program Files (x86)\Jenkins\secrets\initialAdminPassword