Following you comment: no I cannot reproduce your problem. Since you did not provide the rest of your files (inventory, etc...) and I cannot guess where is your problem, here is a quick proof by example using the php:7.0-apache image.

The inventory (inventories/docker_test/hosts.yml)

---
all:
  hosts:
    docker_test:
      ansible_connection: docker

Launching the test container

docker run -d --rm --name docker_test php:7.0-apache

The test playbook.yml

---
- hosts: docker_test
  gather_facts: false

  tasks:
    # Your image does not have python which is mandatory for ansible
    # Please note this is for demo only. You should get python installed
    # by extending the image through a Dockerfile and build it.
    - name: Dirty low-level command to get python installed
      raw: apt-get update && apt-get install -y python3

    - name: Gather facts now we can
      setup:

    - name: Copy a dummy file
      copy:
        dest: /etc/apache2/sites-available/dummy.conf
        content: "# I'm a dummy file"

Playbook run and output

$ ansible-playbook -i inventories/docker_test/ playbook.yml

PLAY [docker_test] ********************************************************************************************************************************************************************************************************

TASK [Dirty low-level command to get python installed] ********************************************************************************************************************************************************************
changed: [docker_test]

TASK [Gather facts now we can] ********************************************************************************************************************************************************************************************
[WARNING]: Platform linux on host docker_test is using the discovered Python interpreter at /usr/bin/python3.5, but future installation of another Python interpreter could change this. See
https://docs.ansible.com/ansible/2.9/reference_appendices/interpreter_discovery.html for more information.

ok: [docker_test]

TASK [Copy a dummy file] **************************************************************************************************************************************************************************************************
changed: [docker_test]

PLAY RECAP ****************************************************************************************************************************************************************************************************************
docker_test                : ok=3    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0


iptables rules to permit GitHub Actions from breaking (chains default to DROP)

This can be achieved by running your build script in a docker container and applying your iptables rules inside that container, which won't affect the host runner's connectivity.
For example, if the below script is executed in a GitHub Actions job (in the Ubuntu 18.04 GitHub shared runner), it will run the build script (docker_script.sh) in a debian docker container that has no internet connectivity, except from the _apt user.
#!/bin/bash
set -x

###################
# INSTALL DEPENDS #
###################

apt-get -y install docker.io

##################
# DOWNLOAD IMAGE #
##################

# At the time of writing, Docker Content Trust is 100% security theater without
# explicitly adding the root public keys to the $HOME/.docker/trust/ directory
#
#  * https://github.com/BusKill/buskill-app/issues/6#issuecomment-700050760
#  * https://security.stackexchange.com/questions/238529/how-to-list-all-of-the-known-root-keys-in-docker-docker-content-trust
#  * https://github.com/docker/cli/issues/2752

docker -D pull debian:stable-slim

#################
# CREATE SCRIPT #
#################

tmpDir=`mktemp -d`
pushd "${tmpDir}"

cat << EOF > docker_script.sh
#!/bin/bash
set -x

# SETTINGS #
SUDO=/usr/bin/sudo

# DEPENDS #
${SUDO} apt-get update
${SUDO} apt-get install iptables curl

# IPTABLES #

# We setup iptables so that only the apt user (and therefore the apt command)
# can access the internet. We don't want insecure tools like `pip` to download
# unsafe code from the internet.

${SUDO} iptables-save > /tmp/iptables-save.`date "+%Y%m%d_%H%M%S"`
${SUDO} iptables -A INPUT -i lo -j ACCEPT
${SUDO} iptables -A INPUT -s 127.0.0.1/32 -j DROP
${SUDO} iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
${SUDO} iptables -A INPUT -j DROP
${SUDO} iptables -A OUTPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT
${SUDO} iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
${SUDO} iptables -A OUTPUT -m owner --uid-owner 100 -j ACCEPT # apt uid = 100
${SUDO} iptables -A OUTPUT -j DROP

${SUDO} ip6tables-save > /tmp/ip6tables-save.`date "+%Y%m%d_%H%M%S"`
${SUDO} ip6tables -A INPUT -i lo -j ACCEPT
${SUDO} ip6tables -A INPUT -s ::1/128 -j DROP
${SUDO} ip6tables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
${SUDO} ip6tables -A INPUT -j DROP
${SUDO} ip6tables -A OUTPUT -s ::1/128 -d ::1/128 -j ACCEPT
${SUDO} ip6tables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
${SUDO} ip6tables -A OUTPUT -m owner --uid-owner 100 -j ACCEPT
${SUDO} ip6tables -A OUTPUT -j DROP

# attempt to access the internet as root. If it works, exit 1
curl 1.1.1.1
if [ $? -eq 0 ]; then
        echo "ERROR: iptables isn't blocking internet access to unsafe tools. You may need to run this as root (and you should do it inside a VM)"
        exit 1
fi

# BUILD #

# ...
# <DO BUILD HERE>
# ...

exit 0
EOF
chmod +x docker_script.sh

##############
# DOCKER RUN #
##############

docker run --rm --cap-add "NET_ADMIN" -v "${tmpDir}:/root/shared_volume" debian:stable-slim /bin/bash -c "cd /root/shared_volume && docker_script.sh"

# exit cleanly
exit 0

Note that:

You have to execute the docker run command manually rather than just specify the container: in the GitHub Actions yaml file in order to add the NET_ADMIN capability. See Also https://stackoverflow.com/questions/63959783/how-to-run-script-in-docker-container-with-additional-capabilities-docker-exec/64045054#64045054

This is a security risk unless you pin the root signing keys before calling docker pull. See also https://security.stackexchange.com/questions/238529/how-to-list-all-of-the-known-root-keys-in-docker-docker-content-trust

The above script should be executed as root. For example, prepend sudo to it in the run: key for the step in the GitHub Actions workflow.


Run command from Jenkins to Linux Server

If you have ssh access from the Jenkins machine to the HAProxy machine, you could run an Ansible task:

ansible -i ha-inventory.ini ha-servers -m service -a name=haproxy state=restarted

Of course you could also have Jenkins do a simple ssh :

for server in ${server_list} ; do ssh server 'sudo service haproxy restart' ; done

For both of these, you would need

ssh keys set up between Jenkins and the HAProxy servers
sudo rights for restarting the service (at least) for the connecting user (probably jenkins)


As far as I see, there are two possible approaches, either by misusing reusing the Blue Ocean plugin or using the Groovy-based Jenkinsfile unit test tool.

The groovy approach might be a bit of overhead, since it is not a client-side Javascript verification. An idea would be to run an async task, server side that tests the code the developer provides and returns the results to the client. You mentioned that the shared libraries are not being parsed properly. This might be resolvable through the use of mock Jenkins commands and objects. This might also avoid the security risk which is created through shared libraries, which requires users having push rights.

The client-side solution might be to provide a playground via the Blue Ocean plugin or directly present the Jenkinsfile that has been created via a redirect of the Jenkinsfile to Blue Ocean.

All in all, there is no straight forward JS library solution to your problem, as far as I can tell.


How do I configure Jenkins to trigger on a pull request based on the Git branch's name?

Using a multi-branch pipeline you have several different ways of filtering branches, take for instance a regular expression for "foo". In order to use this job type, you must create a Jenkinsfile in your repo with build instructions using the scripted or declarative syntax. The term pull request is typically synonymous with services like Github and Bitbucket.

You can also filter within the pipeline itself using declarative syntax:

when {changeRequest branch: "foo.*", comparator: 'REGEXP' }

And also scripted syntax:

if (env.BRANCH_NAME ==~ /foo.*/){
    ...
}


Can Cypress with cucumber replace php unit and regression tests in CI/Cd pipeline?

Yes Cypress is capable to run in CI.

https://docs.cypress.io/guides/guides/continuous-integration.html#Record-tests

Most of the time it is just running cypress run. In our case we ran the docker cypress.


Terraform | After upgrading to 0.12 receive a lots of error "unsupported value for "%s" at 0: string required."

There is a clue in your error message, but it's only helpful if you know what you're looking for:

    | module.mongodb.instance_names is tuple with 1 element
    | module.mongodb.private_ip is list of string with 1 element

Your declaration of the instance_names output includes this expression:

["${data.template_file.instance_tags_name.*.rendered}"]

The data.template_file.instance_tags_name.*.rendered part of this returns a list of strings, and then the [ ... ] around it then wraps an extra list (or rather, tuple) around it, creating a single-element tuple containing a list of strings. That's why the tuple contains only one element, rather than having an element for each of your count instances.

This situation is what the upgrade guide discusses under Referring to List Variables, and that documentation includes some more background information on why this previously worked in 0.11 and why the change is required now.

To fix this, you should refer to just the splat expression alone, producing the flat list of strings that your formatlist call is expecting:

output "instance_names" {
  value = data.template_file.instance_tags_name.*.rendered
}

The automatic configuration upgrade tool described in the upgrade guide can make this change automatically in some cases, so I'd recommend using that as a starting point for your 0.12 upgrade process. It isn't able to fix everything, but it will do a lot of the straightforward rewriting work for you and will emit warnings about some more complex situations it's unable to handle.


Where is the git submodule revision actually stored?

The .gitmodules file just records the path and remote URL to the submodule repository. The commit itself is stored in the tree object. You can query it like this:

git ls-tree <ref> <path>

where <ref> is a reference to some commit (e.g. HEAD, master, a commit SHA sum) and <path> is a path to a submodule.

The output looks something like this:

160000 commit <sha> <path>

where <sha> is the commit in the submodule. The number in front has the following meaning, according to the Git book:

  Notice the 160000 mode for the DbConnector (submodule path of the example used in the book) entry. That is a special mode in Git that basically means you’re recording a commit as a directory entry rather than a subdirectory or a file.

See also this question on StackOverflow.


CI/CD for microservices in monorepo on Gitlab

Monorepos are nice because it eliminates the technical constraints between multiple projects. This does however open the door to other complications within your repository (naming conventions, cross-team dependencies, merge conflict increases, etc.). I do not have any experience with CircleCI, but I will provide some input based on other CI tools I have used.

I don't see any reason why you wouldn't be able to. In your CI/CD system, instead of referencing your individual source repositories, you will use your main monorepo as the source repository and then reference the specific project directory within it.
It looks like as of GitLab version 9.1 this is supported.
In my opinion, this wouldn't be something that would happen on commit. You could do this, but I think it would slow down your development speed significantly and use up a lot of resources if you have many commits. The two key points to consider are:

Before every production release, you should run a full suite test on all projects in your infrastructure. This is the only way to be certain that all project dependencies are non-breaking.
Tests/provisionings must run in parallel. By doing this, your full repository testing speed will be the length of the longest test/provisioning in your repository. (As a side effect, this puts an emphasis on speeding up your slowest test)


How efficiently does GlusterFS deal with failures?

Gluster has built in data "translators" that automatically replicate data across all of your bricks. The particular type of translator you're interested in is called AFR for automatic file replication. The AFR translator also uses the DHT (distributed hash table) translator. It's important that you have at least two master bricks since if you only have one, you have a single point of failure. As long as you have at least two bricks, an auto-healing process is triggered by GlusterFS's daemon (it's automatically installed when you invoke gluster the first time) using the other master server's replicated/translated data if anything goes wrong. Actual disaster recovery that the auto healing can't fix requires going through a careful process documented here.

Other wisdom on the topic (for example, Redhat's documentation) recommends having at least six bricks in two sets, actually. This way, "even if we lose two bricks from each set, there is no data loss". Basically, the more bricks you have, the more redundancy you have, and the less chance of data loss you have (however, it'll become cost-prohibitive and time-prohibitive after a while).


Move Load balancer certificate to another AWS account

There's no need to delete it from the first account. AWS will issue certificates as long as you can prove domain ownership. Nothing stopping you from having a cert for the same domain in multiple accounts.


How to change the owner of VOLUME directory in Dockerfile?

As stated in the documentation, VOLUME instruction inherits the directory content and permissions existing in the container, so you can workaround the problem with a dockerfile like this:

FROM ubuntu:xenial
RUN useradd -d /home/ubuntu -ms /bin/bash -g root -G sudo -p ubuntu ubuntu
RUN mkdir /opt/myvolume  && chown ubuntu /opt/myvolume
WORKDIR /home/ubuntu
VOLUME /opt/myvolume

The creation of the directory has to be done as root (to be able to write within /opt).


How to close a branch by default after a pull request has been merged in Bitbucket?

What I really want is to add a comment to the accepted answer, but I don't have enough reputation to do so. So I'll note it here. I've closed BSERV-10344 because it's in the wrong tracker. This question is about Bitbucket Cloud (bitbucket.org), not Bitbucket Server (the behind-the-firewall version). The correct issue tracker for the feature request is at https://bitbucket.org/site/master/issues.

Also, re: "I'm not sure why they use different language for that", it's because Bitbucket Cloud supports Mercurial as well as Git. In Mercurial it's not possible to delete a named branch; they can only be closed. Since its support for Mercurial predates its support for Git, the terminology used is to "close" the branch.


Datapoints motivating introduction of SRE in organisation

The types of numbers you're looking for might be hard to come across, because they're highly variable (even within one organization, it varies service-to-service and team-to-team, in my experience.) The SRE Workbook is now available for free, and includes two case studies (chapter 3) that might be helpful. Also, New Relic's SRE eBook does a really good job of summarizing SRE in a concise way.

Another way to approach this would be to try to use what you know about your service today to create a risk assessment and estimate downtime you can prevent if you had SRE and dev support to eliminate those risks


Built codebase doesnt appear after deploying

Well after some research, it seems the initial issue was caused by the volume mount configuration in the host's docker-compose.yml

Even I put below line on build Dockerfile which copies the files to the given path

ADD . /var/www/html

Since the host's docker-compose.yml got line like below

volumes:
    - .:/var/www/html

The container mounting this directory as a new directory to it's Unix like filesystem. So it masks the underlying files.
So on the file system its a new directory and doesn't represent the underlying files. Basically its empty.
This Github issue confirms this.

Then it runs the wordpress:latest's docker-entrypoint.sh
Which set /var/www/html as the working directory and if it doesn't contain index.php and wp-includes/version.php (obviously it doesn't due to above matter, directory is new) inside, it downloads and extract WordPress source to this directory. That's why after the mount, my old bundled data wasn't there.

So I was basically tried to do something which was not intended.

As @Jeremy commented,

  as /var/www/html? It sounds like your mount is failing - and that the
  ADD Is superfluous

Another try Was totally wrong. Because I was adding a custom ENTRYPOINT script to my build Dockerfile, so it keeps ignoring the base image wordpress's ENTRYPOINT and CMD that's why it wasn't copy new source to the directory.


I think you can do this by Nodeselector. Firstly add a label for node selector in your daemonset config. Then label your nodes with the attached label. Now if you can set the autoscaling thresholds, it will be deployed on that node automatically on nodes that matches the label. Maybe you can tweak somehow to attach a label to your node when it is added to your pool.

Also, with Kubernetes 1.6+, we have the feature of rolling update strategy which is far better than onDelete.

Cheers


How do I autostart Jenkins agent machines?

We use AWS's EC2 Plugin to spin up spot instances in AWS for our Jenkins master based on a single AMI, exactly as you describe, so Jenkins does support this behavior.

From a quick bit of searching Google Cloud seems to offer a similar solution;

  Spotinst’s Jenkins Plugin helps you to do more with your Jenkins setup by allowing you to automatically configure and scale a designated Google Compute Engine Preemptible VM as Slaves up and down depending on the number jobs to be completed.


Is it possible to have an aws EKS infrastructure as code?

Is it possible to declare "a complete production level EKS with other aws services" using terraform?

Yes, and that is what many larger organizations do. I have implemented Kubernetes with other AWS resources this way for larger companies e.g. a bank, using Terraform.

I want to learn aws by experimenting. But I cannot afford spending that much money. So I need to be able to destroy everything and recreate the exact infrastructure whenever it's needed.

That should go well. You can use e.g. terraform apply to provision infrastructure and terraform destroy to take it down. I would also recommend to add tests on your infrastructure using e.g. Terratest and perhaps use tfsec in a pipeline so that you are comfortable that new changes does not break your cluster - using Infrastructure as Code the full way.

Is there a reliable way of declaring everything once and recreate the whole infrastructure declaratively (without touching aws console)?

Yes, that is a best practice.


Multiple Kafka brokers behind a single OpenShift service?

Yes, you can. HAProxy is purpose built to balance any TCP or HTTP connection. My old company used to run every component of Kafka with HAproxy.

Here is a whole project dedicated to running auto-scaling Kafka in Docker using HAproxy: https://github.com/pozgo/docker-kafka

You can even see their HAproxy config here where they specify the broker check (port 9092): https://github.com/pozgo/docker-kafka/blob/master/haproxy.cfg


Should compilers be kept in artifactory?

There are a few main reasons why you would use Artifactory (or any other binary repository manager) over a traditional file storage (in your case NFS).

The ability to manage your artifact versions
A central location to access artifacts across infrastructure (which you have accomplished with NFS)
The ability to download/recreate previous versions of the artifacts (you could also use a git/svn repository for this, but it would be contain MUCH more irrelevant metadata about the binary artifacts than would be useful to a user)
You want to control who/what has permissions to access the stored artifacts

If none of these are applicable in your use-case, I would say that Artifactory would be overkill and the effort to create and maintain it would not out way the value you would receive from it. Although I have used it in the past, and it is a great tool for what it aims to accomplish :)


You can use docker secrets a bit differently using docker-compose without having to use swarm. See this for the official documentation.
Example:

Create a simple compose file like so,

version: "3.7"

services:

  db:
    image: mariadb:10.5.2
    env_file:
      - ./db.env
    secrets:
      - rootpass
      - dbpass
      - mysqldb
      - mysqluser
    restart: always

Now add the following in the end

secrets:
  rootpass:
    file: /tmp/root_pass
  dbpass:
    file: /tmp/db_pass
  mysqldb:
    file: /tmp/mysql_db
  mysqluser:
    file: /tmp/mysql_user

Inside those files, keep your password, username, database name etc. in plain text. Then simply deploy the containers docker-compose up -d.

It's similar to how you define volumes and networks in a compose file.
Keep in mind that this isn't true secret implementation. Here's the github PR that added this feature, along with the main file if you're interested.


Historically, F5's Application Delivery Controller has been the enterprise-grade industry solution for doing this. With this solution you can:

Use iRules LX to communicate with other software to auto-scale on an as-needed basis
Load balance at Layer 4 (to achieve better throughput/acceleration) or Layer 7
Share memory between Virtual Servers (there may be a better way using iRules LX instead of just iRules)
Bridge or offload/terminate TLS on the Load Balancer
Have vendor support and consulting if needed
Do all of this in Amazon's cloud  (or anyone else's; you can also run it in-house)
Scale to millions more connections than Kubernetes, nginx, or any other load balancer solution that doesn't use a microkernel is capable of.


As mentioned, there are many ways to accomplish the final goal of exposing a site built from a Jenkins job to public traffic.

Both ideas could work, but here are some tweaks.

Instead of changing the job workspace directory, build the site to a sub directory in the workspace and symlink the directory with root directory of your site. This allows control over what is part of live site.
To put a boundary between the build and deploy, rsync would be more efficient and easier to manage than copying. Follow the same pattern of creating a sub directory and rsync to the site directory.

The decision depends on the requirements of the site. If it is static with no promise of up-time, a symlink will work fine, however if the Jenkins job breaks and breaks the workspace version of the site, the actual site will be down. I would recommend using rsync and adding a validation step between the build and rsync to ensure the site stays up.

Final note, using git or other scm provides backups which can be tagged. If the current build breaks, rolling back would be easy. However, if there is no scm (not recommended), keep some segregation between the build and live site to ensure it is not broken for an extended amount of time.


How to populate docker volumes in a build step to be used by a different container

docker-compose is just a glorified wrapper around docker which gives you a nice textual representation of all the options you would regularly give to docker build or docker run. Plus, of course, it bundles several docker images/containers together. That said, it has no provisions to run anything else than you would get by calling docker.

I don't see how you would use docker-compose build to populate a volume. Volumes are, by definition, not living inside docker images/containers, but outside (on the host system). docker build never writes to the host system, and you cannot mount volumes during docker build. docker-compose build basically only runs docker build for you, and also has no way to run or write anything on the host.

So, no, docker-compose build will not be able to create the static files.

You could make your compose file so that it runs your generator (inside a docker container, writing to a named volume), and runs your server (nginx or whatever) in another container, mounting the same named volume (this would be your case 2, I believe). Then, with docker-compose up, it would fire up both those containers. The first one would populate your static files; the second would serve. The first would hang around and do nothing afterwards, which you could just ignore, but which would certainly be ugly. Unfortunately, you cannot use something like docker-compose up --rm to automatically the unneccessary jekyll container.

So, your best bet is to start the jekyll container yourself (docker run --rm jekyll:xyz -v ...:...), the --rm will remove the container after it is finished. Then docker-compose up with the actual server(s).


Linux Academy has many great courses on CloudFormation as well as other AWS and DevOps tools and services. They also have many guided labs where you will be given hands on guided learning of how to use various technologies.

Otherwise, creating templates and launching CloudFormation stacks is something that you could learn by just creating infrastructure piece by piece in your CloudFormation template (ex. add an S3 bucket to your CFT -> launch stack -> add and EC2 instance -> launch stack -> etc. etc.). The AWS documentation is very helpful along with a good plugin for your IDE.


Is it possible to install RPM build on Debian?

You can indeed build RPMs on Debian. You need the rpm and rpmbuild8 packages:

I tried it with a docker container:

docker run --rm -it debian bash -c 'apt-get update && \
apt-get -y install rpm librpmbuild8 && which rpmbuild'

More info on packages:

The following additional packages will be installed:
  dbus debugedit libapparmor1 libarchive13 libdbus-1-3 libdw1 libexpat1 libgdbm-compat4 libgdbm6 libicu63 liblua5.2-0 libmagic-mgc libmagic1 libnspr4
  libnss3 libperl5.28 libpopt0 librpm8 librpmio8 librpmsign8 libsqlite3-0 libxml2 netbase perl perl-modules-5.28 rpm-common rpm2cpio
Suggested packages:
  default-dbus-session-bus | dbus-session-bus rpm-i18n lrzip gdbm-l10n file sensible-utils perl-doc libterm-readline-gnu-perl
  | libterm-readline-perl-perl make libb-debug-perl liblocale-codes-perl alien python elfutils rpmlint rpm2html


How to create a database backup using docker-compose

The number of downvotes on the link that is mentioned in the question could indicate that there are issues with the instructions.

Perhaps one could use native commands to backup the database. For example, this answer shows how to backup a postgres database that runs in docker using the pg_dump command.


You can get all used User accounts with Cloudtrail, it would then be a text processing exercise to find the unused ones.


Isolate service networks with Docker Compose

I don't experience same issue with similar setup to what you describe. 'A' & 'B' can ping & access services on 'C' just fine. Few things to look at:

Port aside, can you ping 'C' from either of the other containers?
You probably shouldn't (can't?) name containers capital 'A', 'B', 'C' if you're going to build them in docker-compose. If that's what's actually used, try more meaningful names.
Does name resolution work if you do nslookup c from either a & b? It should resolve via nameserver 127.0.0.11
firewall on 'C' or service not up on c:8080?


How do I get Azure Release Pipelines to move a .jar from a Build Pipeline job and place it on a Linux VM?

You have two basic scenarios:

you have an Azure Pipelines agent running on the target machine
you have an SSH connection to the target machine

In the first case you just cp the file to the target location (given that the user running the agent has adequate permissions).
In the second case, you use a task like Copy Files Over SSH task to copy the file. For this latter you have to setup an SSH service connection in advance.


External access to internet from Kubernetes Pods

I found the solution ...

Check your network interfaces (ifconfig -a cni0).
Good config is:

  cni0: flags=4163  mtu 1450
          inet 10.244.0.1  netmask 255.255.255.0  broadcast 0.0.0.0...

That subnet (10.244.0.0) configured in flannel-deploy.yaml

But, by default, a new server may have:

  cni0: flags=4163  mtu 1450
          inet 192.168.0.1  netmask 255.255.255.0  broadcast 0.0.0.0...

Change it to:

ifconfig eth0 10.244.0.1 netmask 255.255.255.0 broadcast 0.0.0.0


Which server to set up for distribution of windows based application updates, patches and upgrades?

I recommend Chocolatey. There are more and more companies that are adopting this. For example, if one would like to install Gradle and navigates to the installation page:

  Chocolatey is “the package manager for Windows”.

$ choco install gradle


Route53 Routing Policies - Best Policy for US-based Ecommerce?

To answer your question, ill first try to give simple explanations for each policy to help with the confusion (https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy.html).

Simple: a basic routing policy that randomly sends a user to one of
your addresses.
Failover: You have a primary (active) route and a secondary (passive)
route. When the primary fails, it routes to the passive. If passive
fails, you have an issue.
Multivalue: Multiple routes that each have health checks. It will randomly select an address (Simple routing policy) from the healthy routes. A more
complex failover policy.
Geolocation: Route users dependent on where they are located. If a
user is in England and gets better latency in Germany, they will
still be routed to England.
GeoProximity: A more fine grained Geolocation. You would be able to    route people located on the border of France and Germany (based
on longitude) to a    specific route. "Traffic Flow Only" is to
specify that you must use the Route 53 traffic flow to configure this
policy. It is the most complicated of the route 53 policies
Weighted: This policy allows percentage based balancing. Routing 30%
of people to route-1, 20% to route-2 and 50% to route-3.
Latency: Route to the address that gives the user the best latency.

Now for your architecture, your current implementation would handle instance failures with the ELBs and the latency based routing (with health checks) would handle the routing failures. If you don't require routing your users to the lowest latency address, use the multivalue policy instead.


TeamCity web interface not accessible on Chrome

You will need to explicitly allow that port.  From the guide here:

You can modify the shortcut to Chrome so that it explicitly allows that port when chrome launches:  "C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\Application\chrome.exe --explicitly-allowed-ports=6666"


Question on NGINX reverse proxy when there are services on the host and on containers

I though about putting the container on a not used port, like 8999 for example, and proxying the request to this port, and blocking these ports on the firewall, so no one outside can access them. If I go with this option, does the nginx configuration inside of the containers will need the server_name still?

You're thinking along the right lines. You do need the server_name directives in the container, since it can be accessed both by app2.com/example and app3.com.

Here's an example setup. I'll emulate an nginx on the host machine with a docker container running on the host network.

Scroll down past the code and console log for some explanations.

Here is the listing of the files I used:

lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ tail -n +1 *

==> app1.html <==

I am app1!

==> app2_example.html <==

I am app2 in example subpath!

==> app2.html <==

I am app2!

==> app3.html <==

I am app3!

==> container_nginx.conf <==

server {
  server_name app2.com;
  location /example {
    root /var/www/app2/;
  }
}

server {
  server_name app3.com;
  location / {
    root /var/www/app3/;
  }
}

==> host_nginx.conf <==

server {
  server_name app1.com;
  location / {
    root /var/www/app1/;
  }
}

server {
  server_name app2.com;
  location / {
    root /var/www/app2/;
  }

  location /example {
    proxy_pass http://localhost:8999;
    proxy_set_header Host $http_host;
  }
}

server {
  server_name app3.com;
  location / {
    proxy_pass http://localhost:8999;
    proxy_set_header Host $http_host;
  }
}

==> nginx.conf <==

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" "$http_host" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

==> run.sh <==

docker run --name host_nginx --network=host --rm -d \
  -v `pwd`/nginx.conf:/etc/nginx/nginx.conf \
  -v `pwd`/host_nginx.conf:/etc/nginx/conf.d/default.conf \
  -v `pwd`/app1.html:/var/www/app1/index.html \
  -v `pwd`/app2.html:/var/www/app2/index.html \
  nginx

docker run --name container_nginx -p 8999:80 --rm -d \
  -v `pwd`/nginx.conf:/etc/nginx/nginx.conf \
  -v `pwd`/container_nginx.conf:/etc/nginx/conf.d/default.conf \
  -v `pwd`/app2_example.html:/var/www/app2/example/index.html \
  -v `pwd`/app3.html:/var/www/app3/index.html \
  nginx

Here is the log from my console, where I am testing things out.

lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ sudo ./run.sh
73ebc99b8fae1d18bcbc571adbab6b65eaa49f861d66f11a7490d61b4e1beb0f
9f3761ab0619255d9bde08eee70e1fb9b686b645f38d976de7c39d4c8f0ad70d
lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ curl app1.com
I am app1!
lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ curl app2.com
I am app2!
lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ curl app3.com
I am app3!
lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ curl app2.com/example

<title>301 Moved Permanently</title>

301 Moved Permanently

nginx/1.17.10

lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ curl app2.com/example/
I am app2 in example subpath!
lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ sudo docker logs host_nginx
127.0.0.1 - - [25/Apr/2020:15:11:15 +0000] "GET / HTTP/1.1" "app1.com" 200 11 "-" "curl/7.68.0" "-"
127.0.0.1 - - [25/Apr/2020:15:11:17 +0000] "GET / HTTP/1.1" "app2.com" 200 11 "-" "curl/7.68.0" "-"
127.0.0.1 - - [25/Apr/2020:15:11:20 +0000] "GET / HTTP/1.1" "app3.com" 200 11 "-" "curl/7.68.0" "-"
127.0.0.1 - - [25/Apr/2020:15:11:25 +0000] "GET /example HTTP/1.1" "app2.com" 301 170 "-" "curl/7.68.0" "-"
127.0.0.1 - - [25/Apr/2020:15:11:29 +0000] "GET /example/ HTTP/1.1" "app2.com" 200 30 "-" "curl/7.68.0" "-"
lllamnyp@lllamnyp:~/Cloud/dev/stackexchange/devops/q11420$ sudo docker logs container_nginx
172.17.0.1 - - [25/Apr/2020:15:11:20 +0000] "GET / HTTP/1.0" "app3.com" 200 11 "-" "curl/7.68.0" "-"
172.17.0.1 - - [25/Apr/2020:15:11:25 +0000] "GET /example HTTP/1.0" "app2.com" 301 170 "-" "curl/7.68.0" "-"
172.17.0.1 - - [25/Apr/2020:15:11:29 +0000] "GET /example/ HTTP/1.0" "app2.com" 200 30 "-" "curl/7.68.0" "-"

I corrected some errors in your config (missing semicolon here and there), changed the server roots to directories, rather than index.html and also the request for app2.com/example would request /var/www/app2/example/index.html so pay close attention to the way in which I mounted the files when starting up the containers in ./run.sh. Finally, it was necessary to do proxy_set_header Host $http_host; in the host nginx config, so that the requested Host header gets correctly relayed to the containerized nginx and both app2 and app3 work correctly.


Ideally dont run docker as superuser(root). You should create a user within dockerfile and chown the file system with that user. You can create a user and then add access to that user on the file system. In the below example there is appuser , with ownership to src
FROM ubuntu:latest
RUN useradd -r -u 1001 -g appuser appuser
RUN chown -R appuser.appuser /src
USER appuser
CMD ["appuser", "/src/index.js"]

Its not recommended to run as root
You could also run as any user (Say root id = 0) if needed from externally
docker run -d --user 0 ubuntu:latest

You should never relay on gid/uid  of the linux user outside the container.


In a modern IaaS microservice based system is Zookeeper still a useful tool?

It's difficult to say whether other tools will be better if there is nothing really concrete to measure against. A good, partially biased answer comes from Hashicorp's Consul

This seems to describe why Consul would be inherently better than Zookeeper, from the point of view of ease of use:

  ZooKeeper et al. provide only a primitive K/V store and require that application developers build their own system to provide service discovery. Consul, by contrast, provides an opinionated framework for service discovery and eliminates the guess-work and development effort

... scalability:

  ZooKeeper provides ephemeral nodes which are K/V entries that are removed when a client disconnects. These are more sophisticated than a heartbeat system but still have inherent scalability issues and add client-side complexity. All clients must maintain active connections to the ZooKeeper servers and perform keep-alives.

... and simplicity :

  Consul provides first-class support for service discovery, health checking, K/V storage, and multiple datacenters. To support anything more than simple K/V storage, all these other systems require additional tools and libraries to be built on top. By using client nodes, Consul provides a simple API that only requires thin clients. Additionally, the API can be avoided entirely by using configuration files and the DNS interface to have a complete service discovery solution with no development at all.

It does not address the need for extra resources, but since the architecture is different, I would assume the need for resources is also less:

  Instead of only having server nodes, Consul clients run on every node in the cluster.

Hope this can provide some form of answer.


Internal Server Error while running docker-compose to install Gitlab

In the error message you presented your system is reporting port 443 is already in use. You need to confirm which ports you have in use for other services.

  listen tcp 0.0.0.0:443: bind: address already in use

For what it is worth I recommend you use a nginx reverse proxy. Please reference https://stackoverflow.com/questions/46195852/how-to-run-gitlab-in-docker-container-with-nginx-proxy-over-ssl-with-letsencrypt for further details.


You absolutely can do this.  However, you will need to make sure that the following is happening:

Setup the Docker host on the MSSQL computer in such a way that it can reach the AD server.  Using a bridge network may help (especially if you are using Docker for Windows).  If using Docker Toolkit you may need to look into a solution like port forwarding.
Commit your configuration changes to a new Docker image.  This will allow you to move the MSSQL container to a new computer or even run it with Kubernetes/Orchestration tooling.
Map your MSSQL container to a Volume for persistence.  Otherwise the data in the container will be eliminated between container restarts.


How to enable the npm cache in a Jenkins build slave that runs in docker?

I finally solved this by using Docker image layer caching for the npm install, following this answer

This means I moved the npm install out of the Docker slave image and into the actually frontend image, here is my final Docker file that truly caches the npm install in between builds if package.config has no changes:

FROM centos:7
MAINTAINER Brian Ogden

# Not currently being used but may come in handy
ARG ENVIRONMENT
ENV NODE_VERSION 6.11.1

RUN yum -y update && \
    yum clean all && \
    yum -y install http://nginx.org/packages/centos/7/noarch/RPMS/nginx-release-centos-7-0.el7.ngx.noarch.rpm \
    yum -y makecache && \
    yum -y install nginx-1.12.0 wget

# Cleanup some default NGINX configuration files we don’t need
RUN rm /etc/nginx/conf.d/default.conf

#############################################
# NodeJs Install
#############################################

#Download NodeJs package
RUN wget -q -O - https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.gz \
    | tar --strip-components=1 -xzf - -C /usr/local

# https://stackoverflow.com/a/35774741/1258525
# use changes to package.json to force Docker not to use the cache
# when we change our application's nodejs dependencies:
COPY ./package.json /tmp/package.json
RUN cd /tmp && npm install
RUN mkdir /app && cp -a /tmp/node_modules /app/

WORKDIR /app
COPY . /app

RUN npm run build-$ENVIRONMENT

RUN cd /app && cp -a dist/* /usr/share/nginx/html
COPY ./docker/conf/frontend.conf /etc/nginx/conf.d/frontend.conf
COPY ./docker/conf/nginx.conf /etc/nginx/nginx.conf

EXPOSE 80

CMD ["nginx"]


For now you can't.
But you have Analytics and there is a Code part that is in the roadmap.
Take a look there anyway. It has some awesome widgets so far.


What is the origin of "Release early and often"?

One of the earliest references to this term originate in Jim McCarthy's book Dynamics of Software Development. This term seems to also be embedded in the Lean Startup movement, which built upon ideas in Lean Manufacturing, TRIZ, and other sources explaining how to evaluate an experimental product and check if it fits the market before investing too much effort in its completion.


here are my 2 cents,

You can use GITLAB to have merge requests for all your security requests like adding users to the groups for every new user or existing users. the Mr can be approved by only your IAM admin. You can use GITLAB CI pipelines to go and perform the operation once the MR is approved. From the users side, the user has to  provide their keys and submit as an MR so that the IAM team can validate and approve it.
You can deploy your applications easily using Ansible and Gitlab CI. All you need is just source code of your application and some knowledge of YAML. I am sure, your folks already are equipped with that. Ansible can be used for infra provisioning as well so you can just run the show with them. With regards to os updates, I would say ansible can easily do it. Have the SDLC workflow in place for developing playbooks and once the playbook is modularized, it can used in production.

Let me know if I answered your query and if you have any other questions.


What are best practices for docker tag versioning?

I would direct you to my post Coupling docker registry and source control where dmaze answered from the official forums.docker.com.  Commit hash and branch name or tags suffices.

In your Dockerfile, use a LABEL to record the source of the build. That probably includes the commit hash from distributed source control (git, Mercurial), the branch name if relevant, any release tags if present, and possibly details like the timestamp of the last commit. docker history and docker inspect should be able to show these.
When you docker push your images, push them at least twice, with the commit hash and with the branch name as the “version” part (quay.io/mycorp/imagename:123abc7, quay.io/mycorp/imagename:dmaze-test). If release tags are readily available, the CI system should push images with these tags too.

We are currently using a combination of branch name/commit hash.  For us that seems to be enough.  timestamps while they are useful IMO just add clutter as they don't provide anything the commit hash doesn't.
I agree with 030 regarding:

who should be the authority on tracking / incrementing a build version

100% is responsibility of the CI to maintain such things, with proper communication between other teams.


The "D" in CI/CD means different things to different people, either delivery or deployment. For both groups, it rarely means release everything immediately to production. For the delivery group, the output of CI/CD is an artifact that can be deployed. For the deployment group, there are typically gates in pipelines with either automatic or manual checks before deployment happens. Automatic gates include the unit tests, CI tests, but also things like canary releases with monitoring of key metrics.
Manual approvals in Jenkins involve adding an input step to your pipeline. E.g.
input([message: "Ready to continue?"])

In my experience, having various stalled pipelines waiting for user approval is fairly common. I often include timeouts to clear out stale prompts, and sometimes I configure old prompts to automatically cancel with a more recent pipeline is approved to reduce the workload on users. If you do the latter, you may want to have a separate pipeline for backout/revert jobs since that would otherwise being a new job that gets promoted to production in an emergency and aborts all the other work in progress.
I still like to separate my builds from deploys with separate pipelines. It gives developers better feedback with their CI pipelines of what's working. Then the deployment team picks from a list of automatically queued up deployment jobs that were automatically triggered from those successful CI jobs.


In Ansible: you can use assert or fail module.

- name: "Make sure web_sites is dictionary"
  fail: msg="web_sites should be dictionary"
  when: web_sites is not dict

- name: "cluster_name should be shorter than 6 chars"
  assert:
       that: cluster_name|len <= 6

In Puppet: there is fail function evaluated during parsing phase which cause parsing failure on server (see question on StackOverflow)

 if length($cluster_name) > 6 {
      fail("Cluster name is too long. Should be less than 6 chars.")
 }


How to prevent Azure Traffic Manager from routing over high latency connections in a fail-over scenario?

Disclaimer: I have not setup a working example of this

I believe you are looking for Nested Traffic Managers

If you setup a main traffic manager that uses performance to select between North America and Europe child traffic managers.  As long as one of the services in East or West North America is functioning the child traffic manager will report its status as available and the main traffic manager will continue to send traffic to the child based on performance

Docs:
https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-nested-profiles


The ansible_local var is not being populated when using the setup module to gather custom facts on windows

According to documentation:

NOTE - For windows clients, the results will be added to a variable
named after the local file (without extension suffix), rather than ansible_local.

According to your example it should be in ansible_foo, but take into consideration that the files in the path must be PowerShell scripts (with extension .ps1) so maybe foo.fact wasn't actually executed.
Hope it helps.


How effective is ELK than other Monitoring tools?

ELK is pretty ineffective as a monitoring tool in a default configuration as it doesn't do monitoring - only reporting. ELK can only provide monitoring and alerting abilities if you configure additional add-ons such as ElastAlert.

Then, you are impacted by your ability to log errors via syslog. If messages come in via, say, SNMP traps, you will be unable to alert on these if you do not configure the appropriate plugin.

Like most monitoring systems, your effectiveness is determined mostly by 1) your input method and 2) if you have told the system to alert off of all of the correct messages.


How to run a build from a specific old tag in gitlab ci?

Within the project

go to CI / CD -> Pipelines
press Run Pipeline
under Create for choose the branch or tag you want to run the pipeline for
press Create Pipeline

Now to trigger a manual Job you can use the jobs of the recently created pipeline.


AWS has the CloudTrail service that tracks most of the API calls done in your account. Then stores these in files in your specified S3 bucket.

https://aws.amazon.com/cloudtrail/

Using CloudTrail you can see who, or which service, called which change - in many cases also including which arguments were used.

Unfortunately it doesn't support ALL services at the moment.


How to use n3dr with nexus 3 servers with self-signed certificates?

@titou10 created a pull request and solved it in version 3.3.4-rc1.

This is to inform that the issue has been solved.

https://github.com/030/n3dr

https://github.com/030/n3dr/tree/3.3.4-rc1


Automate custom docker image deployment on AWS

I will give it a try and explain all required steps with examples.

Please add comments with questions and improvement suggestions if anything is not well enough explained.

The OP (original poster) refers to awscli; while I provide corresponding examples, I also discuss limitations of this approach and give examples of doing same with Python.

EC2 deployment

The purpose of this answer is to demonstrate that as OP correctly assumed, no Web UI access neither human interaction is mandatory to deploy a container on an AWS EC2 instance.

Scope and limitations

In this use case, we want to start just one container manually for demo/research purposes, therefore we explicitly decide to do no orchestration.

For a complex and possibly more realistic deployment scenario, this example is therefore not reusable. For same simplicity reasons, we will use EC2 service and create there a single virtual machine.

According to a short documentation research, there seems to be no official AMI with pre-installed Docker daemon. Thus we need to deploy some default EC2 instance and install there Docker daemon, then start the daemon.

While using a private registry, a login there is required; for simplicity purposes, I give also an example to run a container from the public Docker Hub registry.

Also, I am not going to provide a copy-paste automation script but single steps which can be easily adopted towards individual needs. In any case, intermediate results require parsing and passing operations which is then a pure programming activity concern.

A boilerplate automation could be done either with bash using awscli or with Python, using the boto3 SDK for AWS.

Python is worth to consider because you can do better processing of JSON responses you get from AWS. You can also tell Python to execute SSH login and bash commands on the remote host.

Execution plan

A. Identify recent Linux AMI (Amazon Machine Image) ID
B. Create keypair and instance (further, also referenced as VM)
C. Connect to the instance
D. Install and configure Docker daemon
E. Run container

A. Identify recent Linux AMI image ID

Search for a recent and up-to-date Amazon Linux image following the official documentation:

$ aws ec2 describe-images --owners amazon --filters 'Name=name,Values=amzn2-ami-hvm-2.0.????????.?-x86_64-gp2' 'Name=state,Values=available' --query 'reverse(sort_by(Images, &CreationDate))[:1].ImageId' --output text
ami-01f14919ba412de34

B. Create keypair and VM

With awscli, you would just say:

$ aws ec2 create-key-pair --key-name ec2-docker-test

However, the API sends you your public key wrapped in a JSON data message. Therefore, using Python it is way easier to process this data message to a .pem file:

import boto3
ec2 = boto3.resource('ec2')

# create a file to store the key locally
outfile = open('ec2-keypair.pem','w')

# call the boto ec2 function to create a key pair
key_pair = ec2.create_key_pair(KeyName='ec2-docker-test')

# capture the key and store it in a file
KeyPairOut = str(key_pair.key_material)
print(KeyPairOut)
outfile.write(KeyPairOut)

With the AMI ID we have got previously we can now create the VM:

instances = self.ec2r.create_instances(
                 ImageId=AMI_ID,
                 MinCount=1,
                 MaxCount=1,
                 InstanceType=instance_type,
                 KeyName='ec2-docker-test'
             )

AWS API allows also lookup of instance state and IP. With little bit more  Python/boto3 stanzas you can acquire this data to know when you can proceed.

Note: Firewall consideration

To configure firewall access, please create a security group and link it to machines's VPC. For readability reasons, example is not included.

C. Test SSH connection

As soon as the instance is up and running, you can do everything you like by means of remote command execution.

In a Bash script, you would use ssh only or scp to upload a local bash script and run it remotely.

 ssh -t <REMOTE_IP> -i <KEY_FILE> <COMMAND>

With Python, you use further modules like paramiko to establish SSH connection and run commands remotely.

client = paramiko.SSHClient()
client.connect(ip, username=username, key_filename=key_filename, port=port,
                           timeout=timeout,
                           auth_timeout=timeout)

stdin, stdout, stderr = ssh.exec_command("whoami")

For readability purposes, I list further commands unwrapped. In your script, you might want to use elementary helper subroutines to have calls like ssh_call(command).

D. Install and configure Docker daemon

As said above, anything else from here is running remote commands.

That is, the concluding steps are, following an example in the official documentation; proceeding is same as you would do it locally, but you need to wrap it in your script and pass over intermediate results if required:

install and configure Docker daemon
login to your Docker registry if needed
pull image
run Docker container

    sudo yum update -y
    sudo amazon-linux-extras install docker
    sudo service docker start
    sudo usermod -a -G docker ec2-user
    # relogin or continue with sudo, which you shouldn't
    aws ecr get-login --no-include-email --region region

E. Run container

Pull custom image and run container from a private registry in AWS.

    docker pull aws_account_id.REGISTRY.ecr.REGION.amazonaws.com/REPOSITORY/IMAGE:TAG
    docker run --name MYSERVICENAME -d -p PORT_HOST:PORT_CONTAINER IMAGE:TAG

Pull an official public  image and run another container listening on port 8001 in a single step:

    docker run --name nginx -d -p 8001:80 nginx:latest

Alternative scenario with ECS

As described in these Python/boto3 examples here and here, it's possible to define an machine cluster with the AWS ECS service and run containers there.

Please note that ECS cluster offers you an abstraction either from AWS EC2 or AWS Fargate to deliver the actual virtual machines.

If we go for EC2, again we need to pick up a recent machine image, but this we need a machine optimized for ECS. In a nutshell, these machines will have an ECS agent; through its configuration, we assign a machine to our target cluster.

A small bonus is also that ECS machines have Docker daemon already preinstalled.

So, we create an ECS cluster and add a virtual machine to it.

ecs_client.create_cluster(clusterName=cluster_name)

ec2_client.run_instances(
        ImageId=AMI_ID,
        MinCount=1,
        MaxCount=1,
        InstanceType="t2.micro",
        IamInstanceProfile={
            "Name": "ecsInstanceRole"
        },
        UserData="#!/bin/bash \n echo ECS_CLUSTER=" + cluster_name + " >> /etc/ecs/ecs.config"
    )

In the cluster, we can create a task definition of the service which are both abstract of the container concept.

ecs_client.register_task_definition(
        containerDefinitions=[
        {
          "name": "<MY_SERVICE>",
          "image": "<MY_IMAGE>",
          "portMappings": [
            {
              "containerPort": 80,
              "hostPort": 80
            }
          ]
        }
        ],
        family="hello_world"
    )

Now, possibly you ask yourself, how would the Docker daemon on the instance know about your private registry to pull the specified image? For that, the machine's ECS agent needs additional configuration.

Now, you can launch the service, which will use the previously defined task to tell the previously authorized Docker daemon to pull the previously built and published image from ECR and run the container on the machine you've included in the ECS cluster in the data center house that Jeff built.

ecs_client.create_service(
        cluster=cluster_name,
        serviceName=service_name,
        taskDefinition=task_name,
        desiredCount=1,
        clientToken='request_identifier_string',
        deploymentConfiguration={
            'maximumPercent': 200,
            'minimumHealthyPercent': 50
        }
    )

Configuration of security groups in the ECS context has been highlighted on StackOverlow already. In short, these are further calls to the API parts related to security group management.

Conclusion

Both Bash and Python implementation options have their benefits and drawbacks.

Seen on long term, Python being a general purpose programming language with large community, allows complex string manipulation and abstractions from a cloud API or a system process.

Without knowing the real goal of the deployment, an end-to end of above steps might not be worth the effort in terms that for deploying a set of related containers which is more typical scenario, other approaches could be more pragmatic.

Before stepping into technical implementation, best is to make well elaborated decisions and choices addressing business goals and budget:

how many times will automation need to run and in which time period vs. time to implement it end-to-end from the beginning?
assess whether you need only EC2, or ECS with EC2 either Fargate for stateless tasks, or maybe you need Kubernetes?

Further reading: "The Benefits of Managed Kubernetes vs. Amazon ECS" (short argument from a cloud consultant blog as of August 2019).

  A 2018 CNCF survey cites 83% of organizations use Kubernetes as
  their container orchestration solution vs. 24% for ECS.


Cant ssh into running container containing portainer through docker exec

Containers may or may not include a shell, depending on how the container was built. Looking at docker hub it looks like the base image may be based on a "scratch" image, meaning that there may not be anything in the container other than the code needed to run the portainer service. The image layers here also suggest this is the case.
If you want a shell, you may want to use the portainer/portainer-ca:alpine tag. That should give you a container with a full alpine os (and the shell you are looking for). As another note, you may want to try using /bin/sh instead as not all images provide a bash shell.


Jenkins, Jenkins SSH Plug-In, EC2, "ubuntu" user and "www-data"

The ssh plugin gives you both options,
Either send build artifacts to remote server or run a command on the remote server.
The name of the plugin is "send build artifacts over ssh".. use that


archive contents of a reviewboard server as read-only

What I ultimately want is to have these old, archived reviews be
  searchable and for all the links to work more or less as expected for
  the sake of convenience.

As already indicated in one of the comments, wget could be used to retrieve the content:

wget -r --no-parent devops.com

will create a devops.com folder and put all files in this directory.


Yesterday I asked similar question and found this similar question after getting replies in my own post. What people suggested me in my question is editing a node by knife edit and then setting an attribute for that particular node manually. This attribute would be assigned only to this node. Or the other way - you could create a wrapper cookbook that would override attributes of your "base" cookbook. For more details check out answers and comments for my question.


In the AWS CLI how do I treat a special character as a string?

I found that if I put it in a script it sees it as a string and it's only an issue running directly from the terminal/command prompt but not an issue when running from a script with the header/shabang
#!/bin/bash
My final goal for this is for it to be part of a script so this has resolved my issue.
Im still not 100% on the issue when directly in the terminal and don't know if it's specific to the shell I'm using?


How to grant all resources in an AWS account the ability to assume role?

There are several ways to enable access, and your question touches on more than one.

First method, is giving EC2 instances access to do API calls with the AWS API in another account. For this, the instances would need the appropriate IAM credentials. You can assign an IAM Role to an instance. The relationship is then "IAM Policy" -> "IAM Role" -> "IAM Instance Profile" -> "EC2 Instance". This Policy can give permission for this instance to do the sts:AssumeRole API call in the account of this IAM/EC2, and assume a role in the second account. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html

I have not tested this, but as far as I know, while the above description is correct - it will not work with the sts:AssumeRole API since it requires non-temporary (non-session) credentials. And the credentials provided to the EC2 instance are in fact sts:GetSessionToken type of credentials provided to it via the EC2 metadata service.

The same applies to worker nodes, and pods, running in EKS. There is a way to enable this for EKS that is described in details in the documentation. https://docs.aws.amazon.com/eks/latest/userguide/security-iam.html

On the other hand, if all you need is to access RDS and talk to your MySQL/PostgreSQL database - you don't need any IAM credentials. Just a clear path through the network where security groups allow these instances to access the RDS database. In EC2 and RDS, security groups allow to include foreign-account security groups as a filter for "source IP addresses". So when you choose to do something like that, you don't really need to specify the IP address of your EC2 instance where the application is executed, but rather just specify which security group is being used by that instance, with the addition of the account number. https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html

The S3 service does require IAM credentials to write/read data from it, but in this case it also allows to specify a permissions policy on the S3 bucket itself. So while the above method of sts:AssumeRole credentials might not work, you can create S3 buckets that do allow access from a peer account. https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-s3/

Very similar to this, the ECR service also has an option to allow the GetLogin API call from another account. https://aws.amazon.com/premiumsupport/knowledge-center/secondary-account-access-ecr/

And naturally the simplest way, is to provide credentials directly to EC2 instances. This can be done either by writing them into a file. For example the aws CLI is using the file ~/.aws/credentials, and it allows to specify multiple named profiles so you can specify which account needs to be controlled. https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html

Another alternative, is to create a service that is a "Credentials ATM Machine". One excellent tool for doing this is HashiCorp Vault https://www.hashicorp.com/resources/deep-dive-vault-aws-auth-backend. AWS even has a QuickStart CloudFormation template to deploy Vault in your account. https://aws.amazon.com/quickstart/architecture/vault/


If you launch the statefulset with the following key set
{"spec":{"template":{"spec":{"serviceAccountName":"myserviceaccount"}}}}

you can run
curl \
https://kubernetes/apis/apps/v1/namespaces/<NAMESPACE>/statefulsets/<STATEFULSET> \
-k -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
| jq '.spec.replicas'

to extract the replica count. This, of course, relies on the service account (myserviceaccount in this example) to have appropriate permissions to actually query the k8s API for this information, as well as having curl and jq available in the container.
You could then setup some kind of background job in the container to regularly make this request and update an env var or file or whatever.


What is difference between release and deployment?

From Wikipedia:

  Release management is the process of managing, planning, scheduling
  and controlling a software build through different stages and
  environments; including testing and deploying software releases.

Depending on the context the term release is used to reference either of:

the version of the software being released (from a version control system prospective)
the artifacts actually being delivered corresponding to that version (which can include physical media, printed documentation, etc)
the process leading to making those artifacts available and, in the case where the release includes deployment - deploying them in the respective environment (which may or may not be the production one)

Continuous Deployment (together with Continuous Integration and Continuous Delivery) is the modern DevOps methodology aiming to releasing better quality software as fast as possible.

So you can see Continuous Deployment being part of the release management in some cases, but you can also see release management without it - for example in the waterfall development model.

Related: How does continuous integration relate to continuous delivery / deployment?


Gitlab Runner not running scripts with Windows shell configuration

stages are required

stages:
  - stage1

stage1:
  stage: stage1
  script:
    - echo hello

Could you try the following:

before_script:
  - pushd . && uru 233 && popd && set HOME=c:\ && ruby -v && bundle install

stages:
  - rspec
  - rubocop
  - flay

rspec:
  stage: rspec
  script:
    - bundle exec rspec

rubocop:
  stage: rubocop
  script:
    - bundle exec rubocop

flay:
  stage: flay
  script:
    - bundle exec flay *


How to append namespace before metric name in prometheus?

Found this solution:
static_configs:
  - targets: ['monitoring.api.endpoint.net']
metric_relabel_configs:
- source_labels: [__name__]
  regex: '(.*)'
  replacement: 'compute_${1}'
  target_label: __name__


Which AMI was my EC2 instance created from?

Is there any way to tell which AMI my EC2 instance was created from?

Short answer: yes.

Longer answer: yes - how would you like to get it?

The AMI which the EC2 instance was launched with is part of the EC2 instance metadata

Every instance publishes its metadata, which you can retrieve via the HTTP interface:

curl http://<instance.ip.address>/latest/meta-data/ami-id

(lifted directly from the AWS docs)

Many people prefer the Python library for the AWS API (boto3). In this particular case you would need to use the instance.image_id method.


Can't change Windows Docker storage location (The parameter is incorrect)

The issue was that the E: drive was formatted with exFAT partition. After I formatted it to NTFS it started to work.


Ensure a line is uncommented in an XML file using ansible

As mentioned in the question and the comments on it, this isn't an area in which Ansible excels.  The "best" solution depends a bit on the type of file you're dealing with, and the structure of it.

The cleanest way to deal with these sorts of changes in Ansible is to templatize the entire thing; this allows you to see the entire file at once, rather than piecing it together through many places, and is much less fragile than pattern- or line-based approaches.  When you need to add configuration in multiple places (for instance, different roles), that's when dynamic-loading directives become very useful, like Apache httpd's Include:

Include /etc/httpd/conf.d/*.conf

This then allows you to write individual configuration files from different places, and let the client software concatenate them.  However, as far as I can tell from a quick search, Tomcat doesn't support this, so you would need to operate with a single template file.

lineinfile is a hacky solution that's very fragile, and template is almost always a better option.  However, in this case, the node that you're adding is a self-closing one, so as long as it is top-level, it can go anywhere and lineinfile will work (I know you say it won't, but I'll get back to that).  xml is a similar option that's a bit less fragile.

Those two you've ruled out because they can't delete the comment you have in the file.  However, I'll argue that that's an improper requirement (in most cases, and probably yours).

When using a configuration management tool, the source of truth shifts from the files themselves on servers to the configuration that's checked in to master.  If someone wants to edit the file, they'll do so by editing the configuration management scripts, not by editing the file directly on the server.  Therefore, there is no need for comments in the resultant file that lives on the server, except perhaps one at the top that says "this is auto-generated, go look at source control instead".  The comment should be in your templating code - and as long as the result compiles and works correctly, you shouldn't care at all what it looks like.


kubernetes How to test if an operator has already been applied

Not sure why this is required since Kubernetes is declarative and will not do anything is nothing has changed. Nonetheless, you can run it with the --server-dry-run=true flag. What attributes are going to be changed in the resource will not be mentioned but it does mention which resource(s) will be changed in the apply. You will need to parse the output message to identify if something changed or not since the exit code is always 1.
Sample outputs:
$ kubectl apply --server-dry-run=true -f ./configmap.yaml # First run
secret/my-conf created
$ kubectl apply --server-dry-run=true -f ./configmap.yaml # Re-run without modifications
secret/my-conf unchanged
$ kubectl apply --server-dry-run=true -f ./configmap.yaml # Re-run with modifications
secret/my-conf configured


How to resolve merge conflicts in Azure DevOps current UI

Try this solution: Pull Request Merge Conflict Extension. It helps to resolve conflicts inside the pull request page.


How to performance test websites using Gatling that are encrypted using Certbot?

If it is possible to switch https to http temporarly then gatling can record the clicks. When the recording was done, https was activated again and the test could be run against https as well. In summary, recording works if the site is http and running it works against https. Note that the recorder file contains http and this need to be changed to https.


Mitigate false positives due to daylight saving time in CloudWatch anomaly dectector

My current understanding is that it is not possible to avoid false positives. At least not if traffic comes from different time zones around the world (as in the context of this question).

AWS operates on UTC times, but this is irrelevant for the anomaly detection. It does play a role if you set timers, but it is not taking into account for the predictions of AWS. In other words, switching to UTC will not make false-positives less likely.

When thinking about it, it is hard to avoid false-positives. If a  time-shift in Europe or the US happens, you could take that  into account and predict the new traffic. But that requires extra domain knowledge. The AWS predictor only sees a  generic time series.

There are other events such as Christmas, which will impact the expected traffic. Again, with extra knowledge you could improve predictions. But the problem is too difficult for the AWS predictor, as it does not have that domain knowledge.

In our concrete case, we still kept the alerts, as they do have value even with the known false-positives. Humans with knowledge about the underlying system, can reject the false-positive. It is not ideal, but it is a trade-off that we are willing to make.

Note that other types of graphs are not susceptible for these types of problems. For example, error rates instead of total number of errors. It is not always possible, but if you can use rates, the system will be more stable in my experience.
AWS allows to set alerts on math expressions such as errors / requests. The advantage is that normalized rates tend to be agnostic of external events.


Ansible: Exclude a parameter if variable is not set

Q: "In the event that variable item.ppsize is not set I want to exclude that entire parameter from being included."
A: Use the default filter to omit module parameters using the special omit variable
    pp_size: "{{ item.ppsize|default(omit) }}"


Jenkins Docker - Make changes to gitconfig

As far as I can tell, there is no way to tweak arbitrary git config settings from within Jenkins.  You would have to tweak your git config on your build agents.  If you're using permanent agents, this would involve logging in as the jenkins user and running git config --global ....  If you're using docker build agents, then you would need to bake the git config settings into your image.


DNS hosting choices - how to programmatically update DNS settings

Amazon web services provides such a service,  called Route53. You can actually use REST calls,  but it is much easier to use their command line tools or bindings for PHP,  Python or JavaScript.

Here is an entry point to get you started, the route53 change resource record sets call can be used to update or insert  one or many records on a domain.
 https://docs.aws.amazon.com/cli/latest/reference/route53/change-resource-record-sets.html

Of course you need to create an account, set up permissions and delegate name servers to route53.

It's also not free,  but fairly cheap at $0.50 for first 25 domains, then $0.10 after.  All charges per month.


Best AWS EC2 instance class for general Kubernetes cluster

I think the instance class is going to vary based on the kind of workloads you run. You might start out with X but next thing you know your running a bunch of random stuff. You can always run a cluster of different instance classes and then have the scheduler schedule your workloads to the right instance.

M5 and t3 are Nitro based instances. They have a big list of benefits https://aws.amazon.com/ec2/nitro/ . My favorite being that I can log into those instances using my AWS account with no SSH keys.

My personal workloads are more memory-hungry. Since you can't throttle memory like cpu you should factor that in when sizing your instances. I think fewer denser instances are probably more favorable than lots of small instances.

I'm not sure what your use case is for running nginx rever proxies but you may want to look into kubernetes ingress.


What about installing an Antivirus on Windows K8s nodes?

I don't have much experience with Symantec (I don't really like the product).
But searching on Google apparently has some steps to set up, as they don't natively support Kuberentes as an application.

Look if these two articles can help you.

https://support.symantec.com/us/en/article.tech246815.html

https://www.symantec.com/content/dam/symantec/docs/solution-briefs/securing-containers-think-your-containers-are-secure-en.pdf


How to use Jenkins github user credentials to access github api in my script?

You want the Credentials Plugin.

The administrator of the Jenkins instance can add the plugin, then add the credential (access token) that the job needs. Then, in the job, use the credential as a variable.

See the documentation for more details.


Can a cross platform app be run as a container on both Linux and windows hosts?

But if I have a simple app like a python hello world, what prevents this from running on both operating systems?

It won't work in the same way that copying /usr/bin/python from a Linux machine to a Windows machine and using it to run your application doesn't work.

Docker isn't running the hello world script, it's running Python, which needs to be compiled for specific operating systems and architectures.


Docker update with persistent storage and 0 downtime

Docker itself does not provide such rolling update feature. You have to do it by hand which is not an easy task. Even if you want to use a one node Swarm cluster, the scheduler does have downtime.
The scheduler applies rolling updates as follows by default:

Stop the first task.
Schedule update for the stopped task.
Start the container for the updated task.

If you only have one machine, you can try something like k3s, which is a lightweight Kubernetes distribution. You'll be able to use a Deployment, a Kubernetes object, which provide zero downtime rolling update feature.


How can I best deliver read only data assets to a Kubernetes application?

we'd prefer not to bake them into the actual Docker image itself (plus we want the ability to change the assets without having to recompile the application images).

This is indeed good properties to have. You are on the right track.

  The problem, however, comes with our read-only data assets (similar to a game's asset files).

This can be solved with multiple solutions, it's hard to tell what is the best for you. Here are some alternatives.

Persistent Volume - ReadOnlyMany

  I know that we're essentially looking for a persistent volume for Kubernetes, but the problem for us is bundling all of the data into a single package that has the same delivery convenience as a Docker image.

Yes, you could create a Persistent Volume with access modes:

accessModes:
- ReadWriteOnce
- ReadOnlyMany

then (by an automatic process)

Load your data onto the volume with a Job using access mode ReadWriteOnce
Load the volumes to your pods/services using access mode ReadOnlyMany

and keep the volume immutable, you create a new when you need to change content. You can also use multiple volumes this way.

CDN

  our read-only data assets (similar to a game's asset files).

This inherently also sounds what typically is served by Content Deliver Networks. But it depends on your use case if this is a good solution or not.

Buckets

Data for e.g. CDN is usually stored by "buckets" at cloud providers, that may also be an option, then your applications load data using HTTP typically. Minio may be an alternative if you want to do this in your cluster.


Windows Docker in swarm with Linux nodes connection issue

I think Windows Server 2016 needs at least 17.09 Docker EE to support overlay networking and VIP's. I recommend updating it.

I was wrong, the latest version is indeed 17.06.2-ee-6 and should support overlay and VIP.

Second, ping isn't a good test, as it may not be available on the VIP or container IP depending on the setup (Docker has changed over time if the VIP does or does not respond to ping). I recommend using something that tests the Exposed container port, like curl. For testing you can just use something like bretfisher/netshoot which has common utilities like that installed.

Third, you could be resolving Swarm services on the network using the service name, not the internal hostname of containers. Depending on which network endpoint mode you use (VIP or DNSRR) in the service, this will resolve the correct VIP or the correct container IP for other containers on the same Docker network.

Also, you want a minimum of 3 manager nodes to follow raft consensus rules in a Swarm. 2 managers actually makes it less fault-tolerant then 1 manager.


Jenkins - Running code in Windows agent but script says we are in Linux

I got the answer.
As Mark Waite answered here:

https://groups.google.com/forum/#!topic/jenkinsci-users/aGYt-OEYds8

Use the isUnix pipeline step rather than writing your own version of that step.  The System.properties that you are using will execute on the master, not on the agent.  When it executes on the master, it will report the os.name value of the master.


Questions about Ansible connection to remote hosts

Can't answer 1 (I always thought it just uses the default /bin/sh unless specified otherwise?).

It will make the connection more than 10 times.  A single task will typically have an SCP or SFTP connection to copy the taskfile that'll get remotely executed, then another connection to trigger the script.  You can monitor this happening by running your playbook with -vvv, such as:

ansible-playbook deploy_app.yml -u maplebird -vvv

3rd-level verbosity shows all connections to client.
By default, Ansible will execute tasks concurrently on all hosts up to the max configured number of forks.  So, it'll run task 1 on both hosts, then it'll run task 2 on both hosts, etc.  Forks are defined in ansible.cfg, and default to 5.  Change this variable to a higher number or comment it out:

forks = 5

Optionally, you can also do a rolling batch when running playbooks by specifying the serial option in the playbook.  This will only concurrently execute tasks for however many hosts you've defined.

Say you're running a playbook against 5 hosts, and have the serial option set.  With serial = 1, it will run the full playbook 1 host at a time.  With serial = 2, it will run hosts 1 & 2, then hosts 2 & 3, then host 5.  Example:

name: deploy to all webservers
hosts: webservers
serial: 2
roles:
   - deploy_application

More reading:

Serial (rolling) playbook runs:

http://docs.ansible.com/ansible/latest/playbooks_delegation.html#rolling-update-batch-size

Forks:

http://docs.ansible.com/ansible/latest/intro_configuration.html#forks

Hope this helps.


How to implement a frozen test environment?

TeamCity has a Shared Resources build feature which allows you to define a resource which multiple Build Definitions depend upon it.  Build Definitions can either require a Read Lock or a Write Lock, you can also define if these locks are exclusive or allow a degree of parallelism.

If we make the following assumptions about a shared environment named PreProd:

A Shared Resource exists named "PreProd".
All build definitions, such as deployments, that make any change to that environment take an exclusive Write Lock on "PreProd".
All build definitions, such as non-restrictive tests, that perform read-only operations on the environment take a non-exclusive Read Lock on "PreProd".
TeamCity is the only process that can do anything on PreProd, albeit perhaps via another tool.

Therefore the following are true:

When a deployment is happening then nothing else can use PreProd, they will be queued.
When a test is running, any deployment would be queued until the tests complete.

You can use a similar mechanism with Jenkins using the Exclusion plugin.  In fact, you could build this functionality into any process using locking or semaphore - for example Apache ZooKeeper or HashiCorp Consul.


Provisioning a server on behalf of a user on GCP/AWS/Azure and probably relinquish access

Rather than provisioning resources on-behalf of a user which would require them exposing their credentials to you in some way, I would implement this using the various marketplaces:

Azure: Virtual Machine Offer Publishing
AWS: How to List Your Product in AWS
GCP: Sell on GCP

This has a couple of advantages:

It's fully automated, you are never exposed to their subscriptions thus you don't need to prove that you no longer have access - you never had it in the first place.
Everything is created within the customer's Subscription (Azure), Account (AWS) or Project (GCP) thus they bear all of the costs, you then get money from the cloud provider based upon how you price yourself in the marketplace.
You can generally create more than just a VM, i.e. you could create a PaaS Database for persistence.


Deriving an item value from a structured file in Zabbix

If your Zabbix agent is 2.2 or later, you could use Zabbix agent item vfs.file.regexp like so:

vfs.file.regexp[/proc/meminfo,^Dirty.*([0-9]+),,,,\1]

If your Zabbix is 3.4 or later, you can use a master item to collect the data blob (perhaps with vfs.file.contents) and then extract and parse the desired values with item value preprocessing.


Where is the documentation of Kubernetes API server configurations?

https://github.com/kubernetes/kubernetes/blob/master/cluster/centos/master/scripts/apiserver.sh

# Insecure kube configuration parameters go under here when node['kubernetes']['secure']['enabled'] == 'false'
<% if node['kubernetes']['secure']['enabled'] == 'false' -%>
KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"
...

# Secure kube configuration parameters go under here when node['kubernetes']['secure']['enabled'] == 'true'
<% if node['kubernetes']['secure']['enabled'] == 'true' -%>
KUBE_API_ADDRESS="--bind-address=0.0.0.0 --insecure-bind-address=127.0.0.1 "
...

It seems that the KUBE_API_ADDRESS will only listen to 0.0.0.0 if kubernetes has been secured.


How to find the PHP version that is used by the latest `phpdoc/phpdoc` docker image?

The Dockerfile provided in the Q&A indicates that the image uses the latest php:7 as a base image. One could inspect the version as follows:

docker run -it php:7 php -v

Result

PHP 7.3.11 (cli) (built: Oct 25 2019 02:24:51) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.11, Copyright (c) 1998-2018 Zend Technologies

How to use an older version of php in conjunction with this container?

It is possible to use a specific version by checking the tags of php on dockerhub. According to this list, 7.2.25 is currently the latest 7.2. If one changes the from of the Dockerfile to FROM php:7.2.25 and build the image again, then 7.2.25 instead 7.3.11 will be used inside the container.


How do I expire users credentials for Kubernetes in Azure?

First How to check Check certificate expiration

You can use the kubeadm alpha certs check-expiration command to check when certificates expire on a given cluster.

Simplest remedy : you can choose to upgrade the control plance which will renew the certs and then you are good and secure as before loosing your laptop.

Automatic certificate renewal

  Note : kubeadm renews all the certificates during control plane upgrade.

This feature is designed for addressing the simplest use cases; if you don’t have specific requirements on certificate renewal and perform Kubernetes version upgrades regularly (less than 1 year in between each upgrade), kubeadm will take care of keeping your cluster up to date and reasonably secure.

  Note: It is a best practice to upgrade your cluster frequently in order to stay secure.

Another option is to perform Manual certificate renewal

  Note: The default Kubernetes certificates normally reach their expiration date after one year.

Refer more on kubeadm alpha certs renew command usage.

You probably also need to explore the beta feature for Certificate Rotation


You can get to know if your site is up and running in the following way,

Map both the ports of inside container to the host using -p option and try to curl localhost:port

Scenario:-

Run your container with the following command,

docker run -d --name website -p 80:80 -p 22:22 mob

Explanation:-  -p host_port:container's_port

Now, curl localhost:80 or localhost:22

If your service is running properly, you will have got the response

P.S:- Make sure nothing is running in 80 and 20 on host before running the docker run command


Dockerize CI installation on master node VM

Pros

possible to run the CI on a container orchestration platform

Cons

docker in docker in docker


Why not something like Redis? (can use it through ElastiCache). Hard to answer this without knowing the operational requirements of this project. Is this data strictly for logging/research, or is it operational (i.e. this "table" is consulted in order to know which lambda to invoke).

Dynamo vs. RDS - depends how spiky your traffic is. Dynamo is very scalable and will give you a guaranteed throughput. But if you traffic can grow 10x over hours (spiky) Dynamo might be too expensive, since you'll need the maximum throughput provisioned or else you'll get throttled.

RDS is basically managed RDBMS on an instance type that you choose, so it can handle larger spikes, but ultimately not as scalable as Dynamo.

Again, I would consider Redis, for it's simplicity (seems like you just need a KV/counter store), and incredible speed/efficiency. If it's just for logging, it's probably good enough.


GCP - Can't create a tpu on europe-west1

According to "TPU types and zones" TPUs are only available in a very limited set of regions, namely:

Europe, Middle East and Africa

europe-west4-a (Eemshaven, Netherlands)

Americas

us-central1-a, b, c and f (Council Bluffs, Iowa, USA)

Asia-Pacific

asia-east1-c (Changhua County, Taiwan)

Note: not every SKU is available in each region, so double check the above page when planning your deployments.

In addition to specifying a valid zone, you will need to make sure the TPU API is enabled, and your account has the relevant IAM permissions: Cloud TPU\TPU Admin.

At the moment TPUs are predominantly designed for centralised data processing rather than close-to-edge processing. Hence the somewhat limited number of locations TPUs are available within.


Azure DevOps and private Docker registry

To use any of Docker's tooling you need a Docker account.  Part of this is that Docker will use base images from Docker Hub to build images that may be stored in a private repository.
For the Docker ID getting permission denied verify that you used the ID and not your e-mail.
Microsoft and others have put together great documentation both Azure Pipelines and private Docker registries:
Introduction to private Docker container registries in Azure (will help you make sure it is configured properly)
Accessing Azure resources from a Dockerfile (useful since you may be trying to do something similar in your build pipeline)


Jenkins Pipeline and stash Pull Request Builder not working on PR create/update

To expand on the answer above - try using:

branch: "origin/pr/${pullRequestId}/from"

Because in groovy, string interpolation is not done for simple strings - i.e. strings within single quotes. See http://groovy-lang.org/syntax.html#_string_interpolation for details on that.


Giving a meaningful name to Dockerfile's VOLUME

You do not specify a volume source when you define a volume in an image. Doing so would be a potential security exploit where an image could mount a private volume with a common name and send the contents of that volume over the network. To create your volumes with known names, and have that defined in a file, you would do that at runtime with a docker-compose.yml file when the container is created. E.g.

version: '3'
volumes:
  - app_data
services:
  app:
    image: your_image:1.0
    volumes:
      - app_data:/data


Looping through hosts from an inventory group in a group_vars file

Yes. It is possible to create a YAML data structure with Jinja and read the variable in with the filter from_yaml.

The play

- hosts: group1
  vars:
    script_dir: /tmp
  tasks:
    - debug:
        var: filewatches

with the group_vars

$ cat group_vars/group1.yml
filewatches: "{{ filewatches_var|from_yaml }}"
filewatches_var: |
    {% for host in groups['worker'] %}
    - type: "copy"
      directory_name: "{{ host }}"
      shell_script: "{{ script_dir }}/ascript.sh"
    {% endfor %}

and with the inventory

$ cat hosts
...
group1:
  hosts:
    test_01

group2:
  hosts:
    test_02
    test_03

gives

ok: [test_01] => {
    "filewatches": [
        {
            "directory_name": "test_02",
            "shell_script": "/tmp/ascript.sh",
            "type": "copy"
        },
        {
            "directory_name": "test_03",
            "shell_script": "/tmp/ascript.sh",
            "type": "copy"
        }
    ]
}


How trigger a build by a commit in a branch prefix?

It's recommended that you use a convention of prefixing your grouped references (like branches) with "folder" prefixes.

For example, when you create sprint branches, create them with the names:

sprints/sprint01
sprints/sprint02
sprints/sprint03

Then, configure your build trigger Include filters with this prefix:

sprints/*

... and then an Exclude filter for master, since by default it is also included.

Once configured, this should build only the sprint branch (topic branch) that was committed to.

Reference: https://docs.microsoft.com/en-us/azure/devops/pipelines/build/ci-build-git?view=azure-devops&tabs=designer


GitLab CI/CD: How do I generate a change log between pipeline runs?

Note: the answer is rather speculative, based on docs only, I didn't actually use GitLab pipelines yet.
You may be able to use the Pipelines API. More specifically you could get a pipeline's variables:

Get variables of a pipeline
GET /projects/:id/pipelines/:pipeline_id/variables

Attribute Type            Required    Description
id            integer/string  yes         The ID or URL-encoded path of the project owned by the authenticated user
pipeline_id   integer         yes         The ID of a pipeline

Example of response
[
  {
    "key": "RUN_NIGHTLY_BUILD",
    "variable_type": "env_var",
    "value": "true"
  },
  {
    "key": "foo",
    "value": "bar"
  }
]

I'm suspecting that in the response you'd find the variables shown in a pipeline creation response example, which include these which could be of interest to you:

  "id": 61,
  "sha": "384c444e840a515b23f21915ee5766b87068a70d",

  "before_sha": "0000000000000000000000000000000000000000",

I'm uncertain if the before_sha for the current pipeline is what you're looking for, if not you'd just get the sha for the previous pipeline ID, which you could derive from the current pipeline ID (via the CI_PIPELINE_ID environment variable, see Predefined environment variables). I'm assuming that the pipeline IDs are consecutive.


DTAP

As monitoring is part of production it should be part of DTAP as well. This implies monitoring in Development, Testing, Acceptance and Production as well. If somebody modifies a check in production and it will silence some check and if the team does not get reported that there are issues then the customer will be impacted and that could be a huge problem. In short, if monitoring is part of production it should be applied to all stages of DTAP as well.

Testing

If custom scripts are used in splunk and these are written in Python or some other language, then you should also apply unit tests and integration tests. In most monitoring systems, a 0, 1, 2 and 3 exit code are checked so this should also be covered in the tests. If a monitoring is written in bash, one could use BATS and Powershell can be tested as well with Pester.

Why testing these scripts? Again, same reason as depicted in the DTAP section. Imagine that somebody breaks some monitoring script by introducing a typo and you do not get notified, then this could have a huge impact on the customer and also on the team. Imagine that you have to debug for a couple of days because some script is not working well, while that could have been prevented. So I advocate to apply unit tests, integration tests and even CI for this "simple" monitoring scripts.


Docker vs CMS - related or a different thing?

Something like puppet would help automate and configure the Docker Container.  CMS is configuration/provisioning and Docker is like you said a virtualization platform.  You're trying to compare two completely different things.  Here is an article on how to configure puppet with docker, sometimes an example helps.  https://puppet.com/blog/building-docker-images-puppet

For another way to classify, Docker is the VM you host your software.  CMS is automation on how to provision it.

As a side note, most people are moving to Kubernetes to orchestrate and provision containers on the cloud.


Deploy helm chart from Jenkins to Kubernetes

Use a docker image within your pipeline that has helm and other tools installed.

To quote the docs:

  Pipeline is designed to easily use Docker images as the execution
  environment for a single Stage or the entire Pipeline. Meaning that a
  user can define the tools required for their Pipeline, without having
  to manually configure agents. Practically any tool which can be
  packaged in a Docker container. can be used with ease by making only
  minor edits to a Jenkinsfile.

It then gives an example that we can modify to show running helm:

pipeline {
    agent {
        docker { image 'your_image:1.0' }
    }
    stages {
        stage('Deploy') {
            steps {
                sh 'helm list'
            }
        }
    }
}

This is a total game changer. Docker is the plugin to end all plugins. Before Docker you had to find a plug-in written in Java that to exposes a DSL to be scriptable in a Groovy sandbox. That was because it was not secure or scalable to let you simply run your own tools and scripts on a shared Jenkins. You were not even allowed use the full power of Groovy or Java. With Docker it is safe run any script or tools. So you no longer have the indirection of Java plugins and you can use the full power of any Linux tool on any Linux distro.

This approach is exactly how new cloud based build engines work. With bitbucket.com pipelines and cricleci.com you don’t need any plugins. You simply say which containers to use and what commands to run within them just like the example above. The build engine simply checks out the code where the docker container can see it.

Once you have used Docker based builds for a while doing it the old way feels very restricted and limiting. For example consider having to move files around in the build. In a pipeline with Groovy if you are new to Jenkins you have to look at a huge amount of (very ugly) documentation to just to basic things. If you use docker you can simply use standard bash and Linux commands.