How to get other than "" when interpolating {{ .Environment.SOME_VAR }} (with SOME_VAR set) into cache key?

A closer reading of the documentation about using environment variables in cache keys reveals the issue (emphasis mine):

  The environment variable variableName (supports any environment variable exported by CircleCI or added to a specific Context—not any arbitrary environment variable).

"exported by CircleCI" seems to mean the list of mostly-CIRCLE_...-prefixed variables (documented as "Built-In Environment Variables") while (unsupported) "any arbitrary environment variable" includes variables set in an environment section in config.yml.

I ended up working around this limitation something like this:

jobs:
  build:
    docker:
      - image: "nixorg/nix:circleci"

    environment:
      NIXPKGS_REV: "3c83ad6ac13b67101cc3e2e07781963a010c1624"

    steps:
      - "run":
          name: "Prepare For Cache Key"
          command: |
            echo "${NIXPKGS_REV}" > nixpkgs.rev

      - restore_cache:
          name: "Restore Nix Store Paths"
          keys:
            - paymentserver-nix-store-v1-{{ checksum "nixpkgs.rev" }}
            - paymentserver-nix-store-v1-

That is, instead of trying to use the value of NIXPKGS_REV from the environment in the cache key, an earlier step writes the value of that environment variable to a file and then the cache key is constructed using the checksum of that file.  Computing file checksums for use in cache keys is well supported so this produces a cache key which is derived from the value of the environment variable.  The key doesn't contain the value of the environment variable but since the key's only purpose is to be unique for certain unique inputs, using the checksum works just as well.


How can secrets be distributed in a docker swarm?

Once the secret reaches a manager node, it gets saved to the internal
  Raft store, which uses NACL’s Salsa20Poly1305 with a 256-bit key to
  ensure no data is ever written to disk unencrypted. Writing to the
  internal store gives secrets the same high availability guarantees
  that the the rest of the swarm management data gets.

https://blog.docker.com/2017/02/docker-secrets-management/


Should developer wait for CI pipeline to complete or start next task after pushing

Sit and watch the pipeline run?

No, that is not how you work efficiently.

Developers push their commits to the source control repository and then the CI/CD pipeline is triggered.

Developers may post a well-written pull request anytime they want. There is usually a visual mark representing an "on-going build"/"failed build"/"successful build".

Typically a brach can be merged whenever all these criteria is fulfilled:

at least one approver / or as many that is required to approve has approved.
a "successful build"
no unresolved merge conflicts

If any of these criteria not is fulfilled, they need to be fixed, but the developer does it whenever he has time or priority to do this task.


Suggestions to improve knowledge on docker

Some good next topics for the real world are...

Security. There are several security concerns with docker, for example

Is there a problem running stuff inside the container as root?
Is there a problem giving non-root users on the host access to the docker daemon?
Is there a problem with the docker daemon running as root on the host?
All three can be solved with docker out-of-the-box. Learn how to.

Networking. Check out the docker networking options.
Image sizes are a recurring problem, especially if you build your stuff inside a docker image. Your average naive first build image may be 1GB or more - try to get the same image, whatever it is, to 500, 300 or 200 MB.
Docker volumes; how to get configuration into your containers; etc.
Private artifact repositories.
Explore the environment: docker compose, docker swarm, etc.
Finally, take  a big leap on to your next technology... OpenShift? Kubernetes?


What is the difference between EKS and EC2 installed kubernets?

You absolutely could install Kubernetes to EC2 and setup the configuration yourself.  However, EKS will handle the bulk of the setup, configuration, maintenance, and monitoring for you.  Check out the feature page to determine if it is worth it to you.


How to disable some branches in Multibranch Jenkins Builds?

Jenkins can filter branches in a multibranch pipeline by name using a wildcard or regular expression.


How to execute shell command or call URL on new gitlab issue?

That's mostly what gitlab webhooks are for I think.

For your case that would be an issue event and you'll have to create something to parse the posted json and do whatever is needed on your CalDav infra to match your needs.


GitLab CI/CD job without pulling LFS files?

Yes, full cloning of LFS files can be restricted!  By default, GitLab will clone your repo into the CI/CD build directory.  To limit the clone from downloading the LFS files, tell it not to do it.  You do this by setting a variable in .gitlab-ci.yml like this.

# Other declarations etc above the specific job
jobname:
  variables:
    GIT_LFS_SKIP_SMUDGE: 1
# More job declarations, etc.

The "smudge" process replaces the link/pointers to the LFS files with the actual files.  By telling GitLab's CI job to skip the smudge, the LFS files aren't downloaded.

Placing GIT_LFS_SKIP_SMUDGE: 1 in a variables section at the top may make it apply to all of the defined jobs.


How to define global variables in groovy file, which I want to load and consume?

try this one

static void main(String[] args) {
      // Initializing 2 variables
      def x = 5;
      def y = 10;

      //Performing addition of 2 operands
      println(x+y);
 }

}

check this URL


Trunk Based Development - release branch testing

There are different strategies and, depending on your specific problem domain, you need to decide what makes sense for you.

For server side applications, especially micro services, you typically don't need release branches. You can work with pull requests, but once they hit master, it is common to deploy (from master) and never look back. Managing release branches comes with a cost and for server applications, there is not much benefit from my experience.

For other type of applications, release branches do make a lot of sense. In my current job, I'm working partly on Browser extensions where releases need to be planned. In contrast to the server side, pushing a broken extension release is something that you want to avoid at all costs, especially as rolling back is not possible. That is why we have code freezes (every two weeks or so).

At code freeze, we create a release branch from the current master. Trunk based development continues as before, but all new changes will not make it in the upcoming release. Instead there is a testing and stabilization window, where only bug fixes will be accept on the release branch. When a bug is found, it will be fixed on master first, and only then cherry-picked to the release branch. Once bugs are fixed, the release goes out and the whole process repeats.

Stable cycles of around 2-3 weeks tend to work well. Shorter is also good, but longer cycles can be problematic, as it encourages people to squeeze as much as possible in the upcoming release. Otherwise, if you miss it, you might have to wait for months. I would strong recommend to favor multiple small and predicable release cycles over big and unpredictable ones.

Our CI system runs for all development relevant branches (i.e., on master and all pull requests). To be best of my knowledge, we do not run tests for the release branches. Normally, a well-tested bug fix from master does not create problems on the release branch. However, I see no fundamental reason not to run tests on the release branch, too.

If you set it up from scratch, I would include release branches. However, from my personal experience, master (and pull requests) alone should give you most of the benefits already. Running tests on master helps to enforce that development does not break existing tests, or introduces warnings or other coding style violations.

In our setup, the CI system (Jenkins) runs after each commit. If there are no changes, it will not be triggered. However, in my previous job, we had costly integration tests, which were executed once a day but only on master, while unit tests ran after each commit. Again, that depends on your specific project.


Where/what is the `auto-devops` script in gitlab's "auto devops" staging stage?


How to terminate EC2 instance in Jenkins via Vagrant when job is stopped manually?

This can be achieved by using Post build task plugin and by adding the following Script command in Post-build Action, Post build task solved the problem:

vagrant destroy -f

Plus adding rule with Log text as "Build was aborted" make sure that above command is only invoked on aborted builds.

For example:


CodeReady Container for OpenShift won't start on Windows 10

Disable any VPNs on the computer
Create a virtual switch named crc

It took me some time to figure these out, so sharing


First try to review current caching parameter values.
Then check list in AuroraMySQL.Reference.ParameterGroups
And try to tune/increase caching parameters like query_cache_size

Alternative solution is to use architecture redesign with AWS CloudFront to reduce load on primary system (probbly web?).


Yes, I opened a support ticket and the AWS representative said that
Fargate is really intended as a stateless container solution. I took
that to mean it's more of a self-made Lambda rather than a managed
Docker solution. The suggestion to add persistent storage was taken
under consideration and will be added to the feature request list.
You can add the storage also at the time of container configuration may be you can use NFS or you can upload data from fargate to s3.

With bind mounts, a file or directory on the host machine is mounted into a container. Bind mount host volumes are supported when using either the EC2 or Fargate launch types. Fargate tasks only support nonpersistent storage volumes, so the host and sourcePath fields are not supported. For more information, see fargate task storage.

Your Amazon ECS service can optionally be configured to use Amazon ECS Service Discovery. Service discovery uses AWS Cloud Map API actions to manage HTTP and DNS namespaces for your Amazon ECS services. To create service discovery you can refer to here.


Docker bridge network Configuration for containers

Since you are using the tag "Docker-Machine" I'm assuming that you are using Docker Toolbox to manage Docker.  The problem is most likely an issue with Virtual Box configuration than your Docker configuration.

When you try pinging your container on port 9001, use the ip 0.0.0.0 instead of 127.0.0.1 or localhost.  Another way to test would be to get the IP address of the docker-machine, docker-machine ip, and use this IP to ping your container (e.g. use 192.168.99.100:9001.

If you are trying to access the container from another computer you may have to look into a solution like port forwarding as described here.


Why would graphite-webapp browser not display any body content?

You need to collect static assets in your Django

cd /opt/graphite/webapp && PYTHONPATH=/opt/graphite/webapp django-admin.py collectstatic --noinput --settings=graphite.settings

Static files will be installed in /opt/graphite/static.
Then you need to configure your webserver to serve them directly.
For Nginx something like:

location /static {
   root /opt/graphite
}


kubectl asking for username (k8s cluster created via kops)

I solved this temporarily with not the safest solution, but is working
When creating secret with kops named admin, can use that to generate user field in exported kops config by adding also
--admin in the export command


Trick a docker containers DNS to resolve a different url

If you want a DNS lookup of one domain to resolve to another one, you have 2 options.

Modify the Container /etc/hosts file. By default any DNS lookup is done there. You schould do that in the Dockerfile.

Modify /etc/hosts in a Dockerfile

Maintain your own DNS servers with all mapping records. On container runtime just pass the DNS server.

Docker docs

  --dns   The IP address of a DNS server.


Am using both right now.

Nexus will support more repo types with the free version than Artifactory

but

Artifactory will have more repos support in the paid tier

Nexus now support Conda natively (since a few weeks ago if memory serves)

Artifactory will be quite pricey, especially if you plan on having tests and staging instances to test out your config and/or custom plugins as you will have to shell for at least a Pro instance (3K+USD).  Nexus will allow you to test most of these with the free version.

JFrog has exemplary support but a bit pushy with their sales.  They will have help around though to get you started should you need it.

I have not tried Nexus support or sales force so I cant comment (the free version was plenty enough for our needs).

I found the plugin framework to be more usable with Artifactory though it felt a bit limited.  Nexus seems more powerfull but it can be difficult to upgrade/remove plugins from a working instance.  On that front I much preferred Artifactory.

Overall we did go with Artifactory, personally I find them to be pretty much equivalent.  It will depend a bit on the actual technology you need supported (pypi, nuget, maven etc).


Jenkins: make a credential available to all users

I was a little confused by the OP question and follow up, so answering about GitHub access to jenkinsfile-based pipeline jobs:
Credentials stored in Jenkins can be available to all users with rights to create jobs. Use a GitHub deployment key for your repo. Yes you need a key for every repo. This does require a user in Github, of course, but there is nothing to stop you from paying for an extra so-called 'machine user.' We, however, just use a real person like me.

This GitHub deploy key allows you to trigger on repo changes, or keep your jenkinsfile in Github. Using jenkinsfiles and keeping them in GitHub, is the best way to do Jenkins, I think.


Is DevOps restricted to companies with SaaS products?

Absolutely not!

DevOps is all about breaking down the traditional silos (departments) in order to be more efficient.

Better communication between teams, improved visibility and reliable and automated process are ways to achieve a better product.

I used to work for a big media company where we would support an internal tool and develop public-facing websites.

The benefits of DevOps in our case were the following:

Through continuous building, we let know the development team earlier rather than later if there are integration or build problems with their code. They can fix issues while their mind is still on the piece of code they just committed.
Through continuous testing and delivery (into QA), we enabled the QA team to find problems earlier and report them earlier. This reduced the time it took to find and correct bugs as well as reduce the complexity of these investigation.
With out log collection & aggregation tools, we gave to the developers access to something they wouldn't usually look at (they were very keen on the debuggers :) - understanding how logs are seen and used by other teams improved the overall quality of logs
We often shared information and created documentation to share knowledge between teams, trying to break down walls. By understanding the Ops' needs, we create a few guides for what should always be kept in mind when bootstrapping an application (where/how to manage properties, etc.). By understanding the Dev's reality (code more features, faster, gogogogo!) we were able to have the ops create servers and clusters that were better suited to the dev's needs.
The overall quality of deployments was greatly improved too. Deployments were handled by our team, so we had perfect visibility on both Ops and Dev. This eliminated many issues related to the "code hand-off" where the dev would hand over a package and one-page document to the ops saying "Install this!".

Overall, I would say that regardless if you are updating your production environment once per day or once per month and regardless of how many customers you have or your business model, every enterprise can use better communication, better tools, better visibility, faster feedback, etc.


What are good options to implement a devops chatbot for Slack?

I have found StackStorm to be the most fully-featured ChatOps product.
It satisfies your requirements:

Authz, RBAC, ACL ✔
Extensible in Python ✔

See below.

StackStorm is marketed as a

Robust If This, Then That Platform

(but for DevOps)
StackStorm consists of a few components, beyond it's chatops capability:

Sensors:
Sensors are Python plugins for either inbound or outbound integration that receives or watches for events respectively. When an event from external systems occurs and is processed by a sensor, a StackStorm trigger will be emitted into the system.

Triggers
Triggers are StackStorm representations of external events. There are generic triggers (e.g. timers, webhooks) and integration triggers (e.g. Sensu alert, JIRA issue updated). A new trigger type can be defined by writing a sensor plugin.

Actions
Actions are StackStorm outbound integrations. There are generic actions (ssh, REST call), integrations (OpenStack, Docker, Puppet), or custom actions. Actions are either Python plugins, or any scripts, consumed into StackStorm by adding a few lines of metadata. Actions can be invoked directly by user via CLI or API, or used and called as part of rules and workflows.

Rules:
Rules map triggers to actions (or to workflows), applying matching criteria and mapping trigger payload to action inputs.

Workflows
Workflows stitch actions together into “uber-actions”, defining the order, transition conditions, and passing the data. Most automations are more than one-step and thus need more than one action. Workflows, just like “atomic” actions, are available in the Action library, and can be invoked manually or triggered by rules.
Packs
Packs are the units of content deployment. They simplify the management and sharing of StackStorm pluggable content by grouping integrations (triggers and actions) and automations (rules and workflows). A growing number of packs are available on StackStorm Exchange. Users can create their own packs, share them on Github, or submit to the StackStorm Exchange.

Audits
Audit trail of action executions, manual or automated, is recorded and stored with full details of triggering context and execution results. It is also captured in audit logs for integrating with external logging and analytical tools: LogStash, Splunk, statsd, syslog.

StackStorm's ChatOps is built into it's other components:

ChatOps leverages two components within StackStorm in order to provide a fluid user experience. These subsystems are the Action Aliases and Notifications subsystems. You can learn more about each of these individual components in their corresponding sub-sections.

but you can also use your own:

If you already have a Hubot instance, you’ll need the hubot-stackstorm module installed and the following environment variables set up:

Authentication can be done by StackStorm itself, or delegated to a proxy authentication system:

The service can be configured with different backends (i.e. PAM, LDAP, etc.) to handle the authentication. If a backend is not specified, an htpasswd-compatible flat file authentication backend is used. To use a different backend, select and install the appropriate python package from the StackStorm community repos and configure st2auth accordingly.

It also supports API keys.
As for RBAC, they claim that it is supported in their "Extreme Workflow Composer"

Role Based Access Control (RBAC) is only available in Extreme Workflow Composer. For information about Extreme Workflow Composer and the differences between StackStorm and Extreme Workflow Composer, please see stackstorm.com/product.

More at https://docs.stackstorm.com/install/ewc.html
StackStorm has "packs" which are predefined workflows, similar to IFTT or Zapier, which are sets of triggers, rules and actions. You can extend it with your own actions:

An action is composed of two parts:

A YAML metadata file which describes the action, and its inputs.
A script file which implements the action logic

As noted above, an action script can be written in an arbitrary programming language, as long as it follows these conventions:

Script should exit with 0 status code on success and non-zero on error (e.g. 1)
All log messages should be printed to standard error


Sonar Quality Gate behavior in Jenkins pipeline is unstable

It was related at the end to Sonar DB performance (after getting AWR reports):
https://stackoverflow.com/questions/59982345/how-to-maintain-cleanup-of-the-sonar-table-project-measures


Quest for a missing release of Apache Cloud Stack 4.7.1.3

As it came out, the instance is not Cloud Stack but Cloud Platform by Citrix, (a commercial fork?) so they have slightly different version numbers.

I.e.:

4.7.1.3 of Cloud Platform depends on CS 4.7.1.1.
4.11 of Cloud Platform depends on CS 4.10..?


How to avoid code duplication in bitbucket-pipelines?

Unlike the declarative pipelines in Jenkins, bitbucket does not seem to have such functionality. In order to prevent code duplication a script was created and the current bitbucket-pipelines looks as follows:

options:
  docker: true

pipelines:
  default:
    - step:
        script:
          - ./build-script.sh API true true
    - step:
        script:
          - ./build-script.sh Write true true
        deployment: production


Chef14 Load a provider in a recipe Chef::Provider::DeployKeyGithub

This compatibility issue was solved for chef14 with the new load format of a provider in a recipe.

deploy_key deploy_key_name do
      provider Chef::ProviderResolver.new(node, find_resource!("deploy_key[github]"), :nothing).resolve
      path "/home/#{current_user}/.ssh"
      credentials({
          :token => File.read('/root/someid').strip
      })
      repo 'test/test_config'
      owner 'root'
      group 'root'
      mode '0400'
      action :add
  end


What are the benefits of spreading the various services of a multi-tiers application over several user-define bridges?

Your updated question completely changed my understanding :)

Since the db is on a user-defined bridge in both cases, the advantages of using user-defined vs legacy/default bridges discussed in the doc section you referenced (which are applicable in both cases) aren't what differentiates the 2 cases. From that perspective they're equivalent.

Original Answer:

I think most/all of the differences between the legacy/default bridge and the user-defined ones listed in the doc section you referenced are pretty objective advantages :)

For your particular question, in User-defined bridges provide better isolation and interoperability between containerized applications we see:

  Using a user-defined bridge, only the web port needs to be opened, and
  the database application doesn’t need any ports open, since the web
  front-end can reach it over the user-defined bridge

Since in such case the db doesn't have open ports it can't be accessed from the outside, so all threats associated with having the db reachable from the outside are avoided.


Terraform | The "count" object can be used only in "resource" and "data" blocks,

The resource "azurerm_network_interface_backend_address_pool_association" "network_interface" block doesn't have the count argument set, so count.index is not meaningful in that block.

Given the specific pair of resource types you're using here, I expect your intent was to create one association for each network interface, in which case you'd add the following count argument to the second block:

  count = length(azurerm_network_interface.network_interface)

Although this didn't return an error on Terraform 0.11, it did not behave as I expect you intended: it would've created only one azurerm_network_interface_backend_address_pool_association for the first network interface, and left the others unassociated.

If associating only the first one was your intent instead, then replace the count.index in the second block with 0 to be explicit that it's using only the first one:

  network_interface_id    = azurerm_network_interface.network_interface[0]


What are some good Kubernetes training courses?

To understand kubernetes internal, it's good to have good understanding of containers, docker, etc.

Here, is the list of useful docker and kubernetes resources:

1) Play with Docker Classroom https://training.play-with-docker.com/

2) Docker Interactive Tutorials https://www.katacoda.com/

3) Play with Docker (PWD) https://labs.play-with-docker.com/
    Play with Kubernetes(PWK) https://labs.play-with-k8s.com/

4) Introduction to Kubernetes course on edX also his company, CloudYuga is a certified Kubernetes service provider and training partner

5) Blog by Docker Captain, https://collabnix.com/
    Also, search kubenetes blogs on Medium which are very useful.

6) Kubernetes The Hard Way github repo by Kelsey hightower updated with latest kubernetes 1.12.0 version.

Hope this helps.


How to only allow API Gateway requests to reach our EC2 instances

Since November 2017, it is now possible to directly interact with servers in a VPC \o/

See:

https://stackoverflow.com/questions/32671394/can-i-specify-http-endpoint-in-a-vpc-as-resource-in-aws-api-gateway
http://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html


During development you generate a fair amount of different artifacts. These might include:

The source code
The compiled application
A deployable package
Documentation

and potentially others as well

While you could use a source control system to store all of them, it's usually massively inefficient, as source control systems are usually designed to handle text based files, and not binary files. You might be able to use them as a simple storage mechanism, if most of your releases are text based, and you don't have to store a lot of binary data.

Artifact repositories however are designed to store all kinds of files, including binary ones. This includes anything from zipped up source codes, to build results, to things like docker images as well. Also, they usually not only store these artifacts but also help manage them using various additional functions, for example:

Versioning support: properly store some metadata, like when each artifact was built, what their version number is, store their hashes, etc.
Retention: make sure you only keep the important artifacts, and automatically delete ones that are only snapshots / not needed anymore, etc. based on various criteria you can set up
Access control: set up who can publish and who can download the various artifacts
Promotion: ability to promote artifacts. For example you can have snapshot artifacts with a short retention period on a server near your coders, and a separate repository near the live servers, where only artifacts that have been deemed deployable appear. This also includes support for various version channels, and moving artifacts between them (like promoting a specific version from beta to stable).
Act as a native repository for the artifacts. Meaning you can use it as the main repository for maven, rubygems, docker, etc. This can also include caching of artifacts from the official repositories as well.


Is Azure's B-2 app service plan better than a S-1 for production environments?

The B-series has this name from burstable adjective.

It means that you do not have 100% of the cores for 100% of the time (see Introducing B-Series, our new burstable VM size).
For example B-2 you have guaranteed only 40% out of a potential 200%.

The suggestion to pick a different serie for production workload, is to guarantee the CPU available.


How to change ownership of folder inside the container after build?

you need to create the www-data user in the dockerfile eg
RUN addgroup -g 1000 www-data && adduser -G www-data -g www-data -s /bin/sh -D www-data

RUN chown -R www-data:www-data /home/www-data && \
    chown -R www-data:www-data /var/www


Have you tried setting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables? By setting these variables before you run your cli commands, you should not have to run the aws configure command.

  Environment Variables

  Environment variables override configuration and
  credential files and can be useful for scripting or temporarily
  setting a named profile as the default.
  The AWS CLI supports the following environment variables.

  AWS_ACCESS_KEY_ID – AWS access key.

  AWS_SECRET_ACCESS_KEY – AWS secret key. Access and secret key
  variables override credentials stored in credential and config files.

  AWS_SESSION_TOKEN – Specify a session token if you are using temporary
  security credentials.

  AWS_DEFAULT_REGION – AWS region. This variable overrides the default
  region of the in-use profile, if set.

  ....


As @JSapkota mentioned the URL was wrong. It must be https://keycloak-server/auth/admin/realms.

- name: "Create Realm for service Keycloak"
  uri:
    url: "https://keycloak-server/auth/admin/realms"
    method: POST
    src: "realm.json"
    remote_src: "no"
    status_code:
     - 201
    headers:
      Content-type: "application/json"
      Accept: "application/json"
      Authorization: "Bearer {{ keycloak_token.json.access_token }}"
  register: keycloak_realm_create

Take care about the return status code. It is "201 created" and the uri module must know, that this is fine.

This works one time. Because in the next run the REST API responses with 409 the uri module fails.
To be idempotent, you need to check first, if the realm exists. This can be done via GET /auth/admin/realms/{{ keycloak_realm_name }} and check the return code, if it is 404 or 200. If it is 404, then you make a "POST" otherwise a "PUT". So, this a complete example:

- name: "Set facts"
  set_fact:
    keycloak_admin_user: "admin"
    keycloak_admin_pass: "password"
    keycloak_base_url: "https://keycloak.server"
    keycloak_realm_name: "myrealm"
    keycloak_realm_data_file: "realm.json"

- name: "Create Token for service Keycloak"
  uri:
    url: "{{ keycloak_base_url }}/auth/realms/master/protocol/openid-connect/token"
    method: POST
    body_format: form-urlencoded
    body:
      username: "{{ keycloak_admin_user }}"
      password: "{{ keycloak_admin_pass }}"
      grant_type: "password"
      client_id: "admin-cli"
  register: keycloak_token

- name: "Find out, if Realm {{ keycloak_realm_name }} for service Keycloak exists"
  uri:
    url: "{{ keycloak_base_url }}/auth/admin/realms/{{ keycloak_realm_name }}"
    method: GET
    status_code:
     - 200
     - 404
    headers:
      Accept: "application/json"
      Authorization: "Bearer {{ keycloak_token.json.access_token }}"
  register: keycloak_realm_exists

- name: "Create Realm {{ keycloak_realm_name }} for service Keycloak"
  uri:
    url: "{{ keycloak_base_url }}/auth/admin/realms"
    method: POST
    src: "{{ keycloak_realm_data_file }}"
    remote_src: "no"
    status_code:
     - 201
    headers:
      Content-type: "application/json"
      Accept: "application/json"
      Authorization: "Bearer {{ keycloak_token.json.access_token }}"
  register: keycloak_realm_create
  when: "keycloak_realm_exists.status == 404"

- name: "Update Realm {{ keycloak_realm_name }} for service Keycloak"
  uri:
    url: "{{ keycloak_base_url }}/auth/admin/realms/{{ keycloak_realm_name }}"
    method: PUT
    src: "{{ keycloak_realm_data_file }}"
    remote_src: "no"
    status_code:
     - 204
    headers:
      Content-type: "application/json"
      Accept: "application/json"
      Authorization: "Bearer {{ keycloak_token.json.access_token }}"
  register: keycloak_realm_create
  when: "keycloak_realm_exists.status == 200"

Also I had the problem, that after every request the Keycloak server responses with a 403 when I don't refresh the token before the next call to Keycloak. But I think, this depends on Realm token settings of the admin realm.


Is it useful to track dev time with CI/CD?

You can use the rich jira rest API for this kind of automation work. Jira API provides mechanism to update logged hours using PUT /rest/api/2/issue/{issueIdOrKey}/worklog/{id}

You can use this rest API endpoint to update the corresponding issue with the difference of first commit timestamp and first successful CD.

Find more about it here.


Best practices for external backups for S3 buckets?

In terms of S3, for increased durability, consider cross region replication as an option if you want to increase the durability. AWS also provides their AWS Backup service you might investigate. I'm not certain of any benefit to transferring large amounts of data for durability to another provider. You'll pay a lot more for transfer, and it won't be integrated first class with the security IAM provides.

If the concern is about someone maliciously doing something then there are security best practices, access logging, cloudtrail, and other options to provide assurance. If it's more about the possibility (as low as it seems) for a bucket to fail, then the cross-region replication might be a great option for you with minimal configuration impact.


Azure DevOps pipeline upload to FTP after create directory on remote server

I'm just about positive that this Task is buggy and custom FTP Commands do not work at all. However, if the directory you specify in "Remote directory" does not exist it will be created so don't worry about doing a mkdir.


Force Jenkins to reschedule parallel pipeline step as soon as node goes offline

There are two approaches to this, neither of them, in my opinion, are especially good as they don't strictly "NOT Fail" the build:

Use a plugin such as Naginator which can be configured to restart the build until it passes.  This can be quite frustrating as you need to differentiate between ephemeral/preemptable virtual machines being terminated and a truly failed build.
Move to an orchestrator model that manages individual jobs and restarts them based upon a set of rules.

Perhaps a better solution would be to develop a Jenkins Plugin similar to the EC2 Fleet Plugin which is responsible for spinning up and maintaining Spot Instances (i.e. similar to GCEs Preemptable Instances) resubmitting jobs when they fail due to instance reclamation.


Automating the creation of an Apache virtual-host file specifically

This has already been covered a bit in the comments, but I figured I'd lay out a more extensive answer.

  Is there a way to automate that / shorten the amount of lines code (the actual script-file is much bigger in principle), maybe even from some built-in behavior in Apache itself and without involving further software?

You can use a2ensite as a replacement for your very last line, the ln; all it does is set up symlinks into /etc/apache2/sites-enabled, which is where Apache httpd looks by default for configuration.  Some details may vary by distribution.

However, this only changes your script a tiny bit.  There are much larger problems you have to address.

First, I'll mention that no, Docker is almost certainly not the solution you want.  Docker works best when used in a container orchestration layer like Kubernetes, and while I can easily imagine an architecture with a single Docker image that takes in parameters to create different vhosts, it's a much more complicated system than your presumably one-host system and requires substantial changes to how everything works.  Docker is a hip new thing, but what many people do not realize is that it solves a set of well-understood problems and creates a set of new, poorly-understood ones, and it's likely that you don't have the problems that such an architecture would solve.  So let's set that aside for now.

The first problem you have is that you're writing Apache configuration (primarily) by hand, with templating in bash and limited validation.  In reality in your example this isn't a big deal since it's a small and simple config, but it's easy to start this way and end up with a large block of sed and ed commands (this I know from experience).

The larger problem is in how ephemeral your changes are.  You configure all these vhosts, great.  Then your server dies.  What happens?  You're probably going to spend a lot of time trying to rebuild it.  Hopefully you have a recent backup to help, but the point here is that the last few decades we've settled into this idea of treating configuration the same way as code - rather than setting things up by hand, you write all of your configuration into text files and a program translates that into configuration on the server.  This has a multitude of benefits, including backups, code review, and a history of changes that you can look back on.  Most configuration management tools also provide convenient abstraction layers.  Here is an example that lays out how to translate an Apache vhost file into an Ansible template, and then you only need to add new entries to the variable list and rerun the configuration.  When it comes to things like your database passwords, those too can be stored and version-controlled in Ansible Vault or a similar product.


We've configured the plugin properly (we're able to invoke acunetix from jenkins although we're having issues getting the report copied into the Jenkins workspace). The issue he might have run into is that you might have more than one jre installed and you have to register the certificate on the keystore JRE that Jenkins is using (you can check which one is being used by jenkins by looking at the "<executable>" tag in the jenkins.xml config file)

In a default installation the jre being used by jenkins and its keystore are located inside the jenkins folder: .\jenkins\jre\bin\keytool and .\jenkins\jre\lib\security\cacerts

With this configuration, you can verify if the certificate is in the keystore by using the command:
keytool -list -keystore "jenkins\jre\lib\security\cacerts"


Unable to mount docker folder into host using docker-compose

If you use CentOS 7 (as I have ). You may have SELinux turned on by default.check https://www.rootusers.com/how-to-enable-or-disable-selinux-in-centos-rhel-7/
or mount like this:

  volumes:
   - ./database:/var/lib/mysql:Z
   - ./_conf/mariadb.cnf:/etc/mysql/my.cnf:Z
   - ./logs:/var/log/mysql:Z


Artifactory is a product by JFrog that serves as a binary repository manager.  That said very often one will use a 'artifactory' as a synonym of the more general binary repository, much like many people use Frigidaire or fridge to denote the refrigerator regardless if it is a Frigidaire brand or not.

The binary repository is a natural extension to the source code repository, in that it will store the outcome of your build process, often denoted as artifacts.  Most of the times one would not use the binary repository directly but through a package manager that comes with the chosen technology.

In most cases these will store individual application components that can later be assembled into a full product - thus allowing a build to be broken in smaller chunks, making more efficient use of resources, reducing build times, better tracking of binary debug databases etc.

Here are some of the most popular package managers that can be managed using a binary repository:

Java: jar, ear, war etc has Maven and the official MavenCentral.  There are many other package managers that will use the maven binary repository format as well (ivy, gradle etc).
.Net: nuget for .NET components (DLL and EXE) but can also be used as a distribution mechanism under windows thorugh systems like Chocolatey.  Newer versions of Powershell can also leverage this to distribute powershell modules though the powershell gallery of which one could build a local distribution with a binary repository and a repository in nuget format.  Also check OneGet if Windows distribution management is of interest to you.
In JavaScript: we have npm which is one of the most popular, will require nodejs.
In python: there is pip and the official package index pypi, which one can also create a local instance through binary repository that will support the format.

This list is far from complete, just gives an idea of what's out there.

The binary repository can allow to host all of these under one roof, making their management much simpler for teams.  Note that you do not need a very large team to start reaping benefits from binary package management.  The initial investment is not very large and the benefits are felt immediately.  Especially now that more and more platforms, frameworks and languages are integrating this dependency management directly in them.
Their biggest advantage I have found however was to create an environment that your programmers will find natural and comfortable making it essential.  It helps you as a devops creating a solid tool-chain and it helps them making the overall experience fit naturally in their stack of choice.

As I said earlier there are many products out there that can serve as binary package managers, some more generic than others in their target usage, varying also widely in their accessibility and prices.

My personal opinion is that binary repositories are as vital a part of a well designed devops setup as the source code repository or continuous integration.


How to sort displayed tasks in the order they were run rather than by the time it took each task to run?

You can add an entry in your ini file to set the sort_order for the callback plugin to none.

[callback_profile_tasks]
sort_order = none

By default it is set to descending, which is why the tasks are displayed in decreasing order of time taken.

Refer: https://docs.ansible.com/ansible/latest/plugins/callback/profile_tasks.html#parameter-sort_order


Do AWS backups of large empty volumes take longer than small ones?

Firstly I would argue that backup time does not matter,  as it usually doesn't correlate with the restore time.

In regards to restore time,  snapshots restore on volumes almost instantly,  as data is only copied onto the volume from S3 when requested.

So as long as you only request actually used data from the volume, it would only matter how much data is used on the volume to determine the time to restore.

This link explains the process well https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-restoring-volume.html


Is it a good idea to have a secondary person on call for production operations?

I can't imagine having only one person on-call at a given time. There are several reasons that the primary person could be unable to handle an issue - perhaps they are unable to receive alerts, they have limited Internet access for a period of time, they or a family member could be ill and they are unable to work yet the on-call rotation hasn't been updated yet. If you have agreements in which you need to start and/or resolve issues in a specified amount of time, having only one person to get notified and start the work seems very risky.

Having a clearly-defined second person is also useful if the first person gets stuck. There's someone who knows that they are on-call and is hopefully doing the best they can to remain in communication and have access to the resources they need. It makes it easy to know who that person is and get help when it's needed outside.

However, if you are having "too many issues going on" or have so many on-call issues that the primary needs to "focus on more critical issues", that would seem to be indicative of poor product or process quality. Situations that require someone being called off-hours should be rare and not the norm, and simultaneous issues should be very rare.

Of course, this is likely to vary by system. Companies that operate at scale of Amazon and Google are vastly different than a B2B service with half a million total users globally who use the system during working hours. Larger, more complex systems with a need for greater up-time are going to have more people on call and shorter thresholds before proceeding down a call tree than smaller systems.


How to create a local network mapping in linux

Do you have network constraints to create a new subnet or what is the reason?
if it's not useful at all, you can just map the port and open the firewall of your PC so that the other machines can see the application.
version: '3'
services:
  nextclouddb:
    image: mariadb
    container_name: nextcloud-mariadb
    volumes:
      - /home/username/data/mysql:/var/lib/mysql
      - /etc/localtime:/etc/localtime:ro
    environment:
      - MYSQL_ROOT_PASSWORD=STONGPASSWORD
      - MYSQL_PASSWORD=ANOTHERSTONGPASSWORD
      - MYSQL_DATABASE=nextcloud
      - MYSQL_USER=nextcloud
    restart: unless-stopped

  nextcloudapp:
    image: nextcloud:latest
    container_name: nextcloud-app
    volumes:
      - /home/username/data/html:/var/www/html
      - /home/username/data/config:/var/www/html/config
      - /home/username/data/apps:/var/www/html/custom_apps
      - /home/username/data/data:/var/www/html/data
      - /home/username/data/themes:/var/www/html/themes
      - /etc/localtime:/etc/localtime:ro
    restart: unless-stopped
    ports:
      - 2287:80


How to keep configuration files automatically during apt-get upgrade or install?

There are options you can pass through apt-get to dpkg that will handle the config choices. We usually do something like:

apt-get install -y --no_install_recommends -o Dpkg::Options::='--force-confdef' -o Dpkg::Options::='--force-confold' <package_name>

When using ansible you can do:

  apt:
    pkg: "{{ item }}"
    only_upgrade: yes
    install_recommends: no
    force: yes
    dpkg_options: 'force-confdef,force-confold'
    state: latest
  with_items:
    - <package_name>

For further details on the ansible apt module options look here


Istio Keeps On Showing TcpProxyValidationError Errors

Restarting Istio controlplane should fix the issue on hand (pods in istio-system, most likely pilot).
More importantly do not run Istio 1.2 its very outdated version with many bugs and security issues.


Ansible: Copying different files to different guests for use with the same role

Another approach that I found uses the include_role directive. So instead of the playbook being:

---
- hosts: M2
  - roles:
    - role: apache2

It becomes:

---
- hosts: M2
  - tasks:
    - include_role: apache2

Then I can add tasks directly after that apache2 task that configure apache2:

---
- hosts: M2
  - tasks:
    - include_role: apache2

    - copy:
        # etc


How do Sensu handler notification plugins determine the path of their JSON config files?

Okay, so it turns out this wasn't my problem, but I know the answer to the question I asked:

The file /opt/sensu/embedded/lib/ruby/gems/2.4.0/gems/sensu-plugins-microsoft-teams-2.0.0/bin/handler-microsoft-teams.rb defines a function get_setting, which looks like this:

def get_setting(name)
  settings[config[:json_config]][name]
end

config[:json_config] is the string passed with the -j switch.

On to config: the file /opt/sensu/embedded/lib/ruby/gems/2.4.0/gems/sensu-plugin-2.7.1/lib/sensu-handler.rb requires sensu-plugin/utils, which defines the following:

module Sensu
  module Plugin
    module Utils # rubocop:disable Metrics/ModuleLength
      def config_files
        if ENV['SENSU_LOADED_TEMPFILE'] && File.file?(ENV['SENSU_LOADED_TEMPFILE'])
          IO.read(ENV['SENSU_LOADED_TEMPFILE']).split(':')
        elsif ENV['SENSU_CONFIG_FILES']
          ENV['SENSU_CONFIG_FILES'].split(':')
        else
          ['/etc/sensu/config.json'] + Dir['/etc/sensu/conf.d/**/*.json']
        end
      end

      def load_config(filename)
        JSON.parse(File.open(filename, 'r').read)
      rescue
        {}
      end

      def settings
        @settings ||= config_files.map { |f| load_config(f) }.reduce { |a, b| deep_merge(a, b) }
      end
...

So settings is going to load all JSON files nested anywhere under /etc/sensu/conf.d/ and deep-merge them. Beyond that, the path is not relevant to Sensu's ability to load it using the string slack; that's the name of the entry in the JSON payload. This mechanism is common to all Sensu config, not just handler plugins. Documentation is here: https://docs.sensu.io/sensu-core/1.8/reference/configuration/.

I looked at my log files, and it does seem to be finding and loading the files I had optimistically placed under /etc/sensu/conf.d/teams.d/, but it's not working.

Before I found the answer documented here, I took a stab and renamed the directory from teams.d to microsoft-teams.d, and the configuration object defined within from teams to microsoft-teams. I don't know why that would have had any effect, but it's working now. Maybe I had fat-fingered or copypasta'd something and resolved that inadvertently in the process of adding the microsoft prefix.


Identifying a benchmark to compare overall performance of VM virtualization vs hardware

You should do a comparison of commercial virtualization products on the same hardware resources, OR benchmarking commercial virtualization products individually, there are ways to do it, you can even script it.

For example, VMmark is a free tool used to measure the performance and scalability of virtualization platforms VMmark

Since your question is very generic, you should clarify real performance, overall performance. It might mean "real performance in virtualization".


Is there a CI tool that guarantees no regressions in the branch quality level?

As far as I can tell, you're looking for a tool that will reject commits that break the build—a CI tool probably won't be able to prevent regressions by actually fixing your code, but it can stop you from adding bad code to the repository.

Atlassian has a few interesting applications of Git hooks:

  Server-side pre-receive hooks are an especially powerful compliment to continuous integration because they can prevent developers from pushing code to master, unless the code meets certain conditions – like elite ninja guardians, protecting it from bad code.

If you're using Git, the hooks are very powerful (and there are similar hooks for SVN, Mercurial and other version control systems), and you might find it useful to use them to run pre-commit checks.

The Git documentation has a page on creating a hook to reject pushes if they don't meet a certain criteria which could easily be adapted to this use-case.

However, a lot of people would argue that rejecting commits is a bad idea on a feature branch—you'll just be wasting time fighting against your CI system when the build breaks for some reason, instead of actually fixing the bug.

On the master branch, it could make sense to reject broken merges, because you might want to ensure it always builds. For a feature branch, you will inevitably break things, and since the code isn't going into production now, it makes more sense just to warn you than actually reject your commit altogether.


Cleanest way to prematurely exit a Jenkins Pipeline job as a success?

Figured it out. Outside of any stages (otherwise this will just end the particular stage as a success) do the following;

if( $VALUE1 == $VALUE2 ) {
   currentBuild.result = 'SUCCESS'
   return
}

return will stop the stage or node you're running on which is why running it outside of a stage is important, while setting the currentBuild.result prevents it from failing.


Is there a way to make Prometheus to scrape only the metrics which are present in Grafana?

I haven't found any way to do that, so I created a simple CLI based on Python, which can assist with the task - make sure you don’t scrape metrics in Prometheus, which you don’t present in Grafana dashboards.
frigga - https://github.com/unfor19/frigga


Best practice for Jenkins docker to deploy to other container

Where you say:

  Building the docker container from another docker container is also
  said to be bad practice and I also understand the reasoning for that,
  so that's a no-go, too.

Perhaps there are bad ways of doing that but it can be a solid pattern. By way of example if you use openshift Kubernetes it runs s2i as builder images on your cluster. s2i checks out your code from git, compiles it, and pushes it to a new layer in your docker repo. It has an incremental flag where it will tar up your library deps folders at the end of a build and store as a docker layer. Then the next time you build it does a clean checkout then untars the libraries from the last build. That speeds up the next build a lot as it has the local maven cache from the last build. It also means the s2i build container can be launched on a different host in the cluster at each execution and it just connects to git and the central container registry and does a fast repeatable build.

s2i is a stand alone tool that can use your local docker demon. So it acts as a single commandline ”compile my stuff into an updated docker image”. There are community supported s2i images for php7, node.js, Java etc. I recall that the java s2i will run a maven build with the “openshift” profile and expects your to copy the built WAR to “./deployment”. When you run the image that s2i writes out to your container registry it launches wildfly that is in the base layers and it deploys whatever finds in the deployment folder (but double check its been a while since I looked at it).

In your case If you are using Jenkins I suggest you take advantage that it supports building docker images. Append a docker pipeline step to create your image and push it to your chosen container registry. Enterprises that use Jenkins to build and Nexus for storing JARs and WARs are now using Nexus as their container registry. They can stick with Jenkins and Nexus and simply reconfiguration things to move into the world of containers.

I should also point out that you can be more “microservice-like” by skipping installing tomcat. You can use maven jetty plugin or maven tomcat plugin to just run the code with “mvn jetty:run” or “mvn tomcat7:run”. You can set a full blown config file for the servlet container via the plugins. Maven let's your set whatever jvm options you want. (note: after Tomcat 7 there doesn't seem to be support for this modern approach see the next paragraph where the mainstream now uses Jetty for this).

If you like spring you can use spring boot to build an excutable JAR that runs your webapp. The JAR will be large as it has everything to run the webapp including the servlet container packed into a single JAR. You can run it as “java -jar” and it runs your webapp in an embedded servlet container. Better yet configure it's maven plugin to make an executable jar you can simply run as “./my-app-1.0.0.jar” and it will lunch. That makes building a docker image trivial. You don’t have to install tomcat you only need a container with Java on it and copy in your spring boot executable JAR and run it as the CMD. Spring Boot is very mainstream for Java microservices and it runs Jetty under the bonnet.


Should I run several applications in Docker in a single server?

Yes, sure. As long as your resources are enough (i.e., you're not running out of RAM, HDD, CPU, networking), and as long as you are fine with one gigantic single point of failure, there is no reason whatsoever to not run many docker containers on one machine.

Keep in mind that the overhead of docker is really small - it's all just namespacing on the host kernel, it's not like you're spawning copious amounts of VMs or anything like that.


Jenkinsfile: Pull image from registry endpoint A, push built image to registry endpoint B

Try to chain withRegistry like this:

docker.withRegistry('https://registry:10500', 'credentials-id') {
    docker.withRegistry('https://registry:10501', 'credentials-id') {
        docker.build(imageToBuild.getName(), '-f ' + imageToBuild.tag + '.Dockerfile .').push();
    }
}


Passing a jenkins credential (global) to a python script

Specifically for credentials, CloudBees recommends using the Credentials Plugins, which inject the credentials in the environment available to the invoked scripts. From Injecting Secrets into Jenkins Build Jobs:

  Credentials plugin - provides a centralized way to define credentials that can be used by your Jenkins instance, plugins and
  build jobs.
  Credentials Binding plugin - allows you to configure your build jobs to inject credentials as environment variables.
  Plain Credentials plugin - a plugin dependency required by the Credentials Binding plugin.

Inside your script you'd pick up the variable from the script's environment:

API_TOKEN = os.getenv('API_TOKEN')

In a similar way you can pass any arbitrary variables (other than credentials), using the EnvInject Plugin (watch for the warnings, tho). See related:

Jenkins inject environment variable
Environment variables in Jenkins

Another possible approach is to configure Jenkins to pass the value as an argument to your script. Inside your script you'd pick up the value using your preferred method of processing the script arguments.


Why is one not allowed to use a Boolean in a docker-compose.yml?

This come from a design choice of YAML language about booleans

Every unquoted value matching this "regex":

 y|Y|yes|Yes|YES|n|N|no|No|NO
|true|True|TRUE|false|False|FALSE
|on|On|ON|off|Off|OFF

Will be converted to True  or False.

This start causing a problem when your code will test an environment value to be yes or no for example taking this script (other examples in the PR discution):

if [ "$SOME_VAR" == "yes" ];
then
  echo "Variable SOME_VAR is activated"
else
  echo "Variable SOME_VAR is NOT activated"
fi

And setting in your compose file

environment:
  SOME_VAR: yes

Will result in SOME_VAR being True when the script run, hence taking the wrong case as it is not equal to yes.

So the choice has been made to disallow boolean to prevent unwanted behaviors hard to debug when you're not aware of the YAML rule.

I see two way to get over the problem:

Using an env_file instead, they are not parsed IIRC and should prevent the conversion.
As you already said, use a wrapper script around your launcher to define the value instead before launching the app, something along the line of this should do:

AUTOAPPLY=false
if [ "$SOME_VAR" == "true" ]
then
    AUTOAPPLY=true
fi

./target/universal/stage/bin/APPNAME -Dplay.evolutions.db.default.autoApply=$AUTOAPPLY


Kubernetes create multiple jobs based on template and list

Have you checked the documentation for cron-jobs? You can use the run command.

$ kubectl run hello --schedule="*/1 * * * *" --restart=OnFailure --image=busybox -- /bin/sh -c "date; echo Hello from the Kubernetes cluster"
cronjob "hello" created

This way you can loop through your customers in a bash script to deploy your containers.

Not knowing the big picture its hard to answer completely, but I also think ansible templates would work for this. You could turn your above config file into a jinja2 template. You could pass your customers in as a JSON dict and use with_items to loop through them or treat your customers as an inventory. This would give you an easy way to deal with certain "snowflake" customers.

EDIT: as far as doing this with Vanilla Kubernetes, I don't think it's possible. You could add your own custom controller and extend the kubernetes API. This would allow you to creat an API object that defines a customer, and then have a custom controller pick that up and create your cron job. Check out https://github.com/coreos/prometheus-operator as they have implemented such a solution to allow multiple teams to run there own Prometheus solution on the same cluster.


How can I send monitoring notifications to Google Chat in Google Cloud Platform?

I think the current solution is to implement some script to send notification. I followed this guide and wrote a Python Cloud Function to do the notifications.


What are known component intelligence tools?

(upon request from comments)

BlackDuck has tools to monitor use of open source components, and "manage open source compliance & security"


Jenkins Console Output character issue, but plain text show correct

that is formatting issue
you may try to configure jenkins job to use formatted output as well
check it out https://wiki.jenkins.io/display/JENKINS/AnsiColor+Plugin
try all available schemes one by one, some of then should works well


I don't know the inner of bamboo, but I assume it works like a bash script.

What happens is that variables are replaced before execution, in bash that would be echo "echo $VAR" > test.sh and test.sh will only contain "echo" because VAR is replaced by it's value before the command is executed.
If you want test.sh to contain echo $VAR you have to tell bash to ignore the replacement on the first call by escaping the $ sign:

echo "echo \$var" > test.sh will give echo  $VAR in the file.

In the same note, the notation ${VAR} and $VAR are the same, using braces is a good practice when you do concatenation like in echo "Size is ${VAR}Kb" as without the braces like this $VARKb bash would try to find a variable named VARKb and return an empty value.

To address PrestonM different behavior, I assume there's either
 - the fact running under windows with the powershell interpreter doesn't behave the same
 - or just that bamboo has a special case for variables prefixed with bamboo. and as such escape them.

If someone want to test you may try:

echo "${VAR}"
echo "${bamboo.VAR}"
echo "\${VAR}"

and edit the results in this answer.


How do you back up Jenkins jobs & master configs?

There are many ways to do this but the easiest way I can think is doing a backup of the Jenkins Home folder.

You can see where is your Jenkins home with:

echo $JENKINS_HOME

And for example, if you only want to backup the jobs you can go to:

cd $JENKINS_HOME/jobs

And make a backup for that folder.

All that configuration will be a bunch of XML files.

If you are using the official Jenkins docker image, the home will be on:

/var/jenkins_home


Dev environment for legacy Visual Studio code?

... legacy projects that all require different versions of visual studio ...

Don't you just love Visual Studio?

  ... I want to set up the projects such that it doesn't matter which visual studio the project is opened ...

If your "legacy" goes back beyond .Net 2, then you're out of luck.

New, shiny versions of Visual Studio won't open .Net 1.* projects and will shrink away in horror from anything that needs anything created in 'Studio 6 (except, possibly, C++, the one language that's survived .Net-ification largely unscathed).

Most of the newer stuff will happily co-exist, but you'll probably need to think about  containerising the earlier stuff.


Is there a system which automates everything (OS release, and above) to host websites on?

TL;DR Pick software that focuses on long-term support. Use containers so that you can separate the runtime you need for your app from the security patching of the underlying infrastructure.

Long Answer:

I used to run some old PHP sites running popular content management systems. The plugins would fall out of support such that I could not upgrade the content management system else the plug-ins would break. So then I would stick on the latest major version things worked on and hope that no new security holes would come. I then ran monitoring software and manually fought off any scripts that got injected through security holes. Then the operating systems that support that old version of PHP I needed would fall out of support. I then couldn't easily move the hoster to take better use of cheaper deals or high availability. So I would find ports of the legacy PHP I needed onto the oldest version of an OS that hosters would support. Total nightmare.

What this demonstrated to me was that some software isn't built to last more than three or four years. Millions of sites would have had the same issues as me but tens of millions more wouldn't have as they would have been shutdown else rebuilt from scratch on newer software. So the first lesson here is that if you think you need to build for the long term you need to figure out if your using software that cares about long-term support and has a published lifetime.

The world has moved on and the PHP7 world is taking a new approach to having a predictable software release cycle and lifetime (still quite short I might add, but more predictable). You should not just assume nor expect any distro or any community to be with you for the long haul unless that is exactly what they said they are trying to do. And if that is what they are trying to do then they won't do other things that are in conflict with that such as run hot new framework features that are trending on stackoverflow.

These days I happen to be helping a company that is running Node.js 8 and PHP 7.x on RHEL7 containers on kubernetes on AWS. They get long-term support of security updates with a published lifetime. I have automated the detection of new security patches to the PHP and Node.js containers. A weekly job checks the upstream container registry and if there is a new security patched version it is announce to a team chat room along with the command to patch the containers in the test environment. A commercial subscription to those patches is included in my managed kubernetes hosting costs. Yet as its all opensource I could fall back to using Centos7 if I wanted to cut some costs.

As I am running containers I don't care whatsoever what patches are being applied to the IaaS nor the version of kubernetes I am hosted on. I am on openshift.com and they have upgraded to 3.11 through security fixes without telling me. They just patch the worker VMs and bounce them and kubernetes starts my containers on other VMs. I am insulated from all the security patching of the cluster I am on because I am running containers that have inside them the minimal operating environment needed to run my app. That only changes when I choose to upgrade to a new container and with long-term security patch support; I don't need to do that for years. I understand that the Kubernetes hosts that run my containers themselves run a very stripped down distro to maximise their security and customer density. It doesn't matter to me. The idea of an IaaS stack of Linux that goes out of support seems a totally alien concept to me now even through I lived many years with that problem.

It also means that I am free to move to any cloud or hosting provider that can run my containers. It doesn't have to be kubernetes it could be Docker Swarm or whatever. All that I am betting on is that this better way of working with containers will be supported in the long term. I think that's a good bet. A container image is only a json file naming a load of tar files that are the layers in the image. Yes; its just tar files and json. As long as the container host can load my files from a tar and attach a TCP/IP stack my stuff will run. I am pretty confident that this approach will have a very, very long shelf life.

I don't think that anyone that is trying to run apps should start out on IaaS today. PaaS is one solution but tends to have very strong vendor lock-in. CaaS is the new sweet spot. Choice. Stability. Control. Portability. If it runs under docker on your laptop just push it to the container orchestrator you are renting space on. My containers only have one thing in them. The hosts that they run on only does secure container hosting.


Limits of, or preconditions for of Blue-Green deployment?

I must admit that I don't quite get the examples your giving. Sure, random numbers will be different between the two environments.

Blue-green means simply to have two nearly identical production environments with some kind of router/load balancer in front. Clients talk to the load balancer, and the LB routes requests to one of the two environments.

To deploy a new version, you provision all machines/services/etc. in the inactive environment, test to your heart's content, and then do the instant switch (on the router) if you're satisfied.

Actually, I don't see anything that requires any precondition at all about this. Obviously, one precondition is that you are at all able to create a second, fully fledged production environment in the first place; and that there is a technical solution that works as a load balancer in the above sense. That may get very complicated if you have a widely distributed system which you want to switch completely at once. That may just become to complex.

But aside from that, nothing special compared to, for example, running a separate test environment next to your dev/prod environments.


SQS: What could high number of visible messages mean if messages received & deleted are normal?

there was no sudden surge in the number of messages received or depression in number of messaged being deleted from the queue that corresponds with this surge

Yes, it looks like there was.

But first, be sure you have the correct definitions in mind for these metrics, because your intuitive interpretation might be reversed.

"Sent" means sent to SQS and added to the queue (it does not mean sent to consumers) and "received" means delivered to a consumer (it does not mean received by SQS).

Beginning at approximately 1600 on January 3 there is an unexplained dip in "received" performance.  The consumers slowed down and accepted messages at a slower rate, despite the fact that the available messages did not justify that reduction, suggesting that the consumers were not able to process messages at their typical rate.

Beyond this point, the messages "sent" (enqueued) continued its undulating pattern, but the messages "received" (dequeued) and "deleted" (after processing) assumed a much flatter pattern, despite the fact that they had previously been following the same visual pattern as the "sent" value.

It appears that your consumers have slowed down, for external reasons (probably unrelated to SQS -- something else the consumers communicate with, like maybe a database, is not responding as quickly as usual), and so the consumers are no longer able to keep up with the offered workload, and a backlog is growing.  "Visible" messages are the messages in the queue that are waiting for an available consumer to be ready to receive them.

Theoretically, it could be that this is an internal performance problem inside SQS, but this seems very unlikely so I'd suggest that your consumers and the components of your stack that they interact with should be the focus of your troubleshooting.


How to copy files recursively to a Kubernetes pod?

kubectl cp by default does recursive copies when given a directory, although it seems to be picky about trailing slashes.  If foo is the directory you'd like to copy, simply run

kubectl cp /path/to/foo <pod-id>:/path/in/container/


How to dimmension VMWare VM linux servers to run kubernetes container clusters?

There are several related system engineering trade-offs and choices involved in answering your question. It may be helpful going forward to tackle this question by first prioritizing your objectives and then making the selection and trade-off decisions about VLAN structure, cluster(pod) sizes, etc. to decide which options give you the most bang for the buck in vertical scaling.

For example, you didn't explain how cpu intensive your web apps are or how much load balancing (based on the front end API management and back end messaging) you expect you will need. While load balancers may not seem relevant to your Docker/K8s design question, the impact this can have on how you size your cluster nodes is obvious if you consider what impact too many nodes and a poorly distributed or overworked load balancer could have on your VLAN design.

The 'one app per VM' design you described suggests your app's workloads are pretty big (for an 8GB VM). Again need more info to delve into this more deeply, but assigning a DB VM per App VM seems a bit wasteful in terms of K8s worker/manager efficiency unless there's a severe reliability and resiliency requirement.

Next, what are your options to replace the magnetic HD with SSD? Costs for 100GB and 500GB SSD have dropped significantly and replacing your mag HD with SSD could certainly give your clusters a good deal of disk performance headroom when you scale up. In addition to performance, despite the added costs, overall system reliability (MTTF, MTTR) will increase dramatically. New SSD drives have 6GB data channels which is probably at least double what your mag HD have now. In building a Docker/K8s cluster of any size, disk channel bandwidth and processor core count can cover a multitude of design sins.

Finally, not sure what your project delivery timeframe is for this, but it might help your thinking all this over and making the best choices if you can take a step back and model this with SysML (using MS Visio) and look at your design and then apply Architectural Tradeoff Analysis Method.

ATAM and the theory behind it, despite its name, is really rather simple both in theory and in practice. ATAM gets its name because it not only
reveals how well an architecture satisfies particular quality goals (such as performance or "modifiability" or scaling in your case), but it also provides insight into how those  goals interact with each other — how they
trade off against each other. Doing ATAM upfront does point out critical design decisions with the most far-reaching consequences and are the most difficult to change after a system has been implemented.

SysML and ATAM is also a kind of insurance policy against painting yourself into a corner when you are asked to cost justify your design choices or forecast TCO when a change in either the web app design or your VMWare infrastructure occurs in the future.

ATAM info here >>>

SysML info here >>>


Not sure if this would work for you, but what I do is store all of the build metadata into a BuildInfo.json file. You could just save it as an XML file like you said, but I found it easier to parse info with Groovy if it was a JSON file. Along with the most recent commit hash, we store most of the build information in this file, including the result, duration, user who kicked off the build, etc.

One advantage of this approach is we're able to create other jobs that take action of already built products, such as for deployments. These jobs can just look for the presence of a BuildInfo.json file and take action based off the information contained within. Example:

import groovy.json.*

def build_info = [
    'Product': 'MyApp',
    'Build Type': 'Full',
    'Build Name': currentBuild.displayName,
    'Version': '1.2.3.4',
    'Source Branch' : params.Branch,
]

def json_output = readJSON text: groovy.json.JsonOutput.toJson(build_info)
writeJSON file: "BuildInfo.json", json: json_output, pretty: 4


Should I struggle for minimalistic context in GitLab CI jobs?

Your use case is very simple, so relying on GIT_STRATEGY=fetch is probably sufficient and as you said the default behavior.
You should be cautious using artifacts unnecessarily as they are uploaded to the gitlab server.
The answer to your question generally depends on a few things, like the size of your repository, network connection, runner executor type, and so on. One option is to configure a cache (in this case at the pipeline level and for the deploy just set the GIT_STRATEGY=none:
default:
  cache:
    key: "$CI_COMMIT_REF_SLUG"
    paths:
      - deployment.spec.config

build:
  stage: build
  script:
    - build something

deploy:
  stage: deploy
  variables:
    GIT_STRATEGY: none
  script:
    - push-deployment ./deployment.spec.config

An added benefit here, depending on your build process, is the possibility of caching your dependencies when running multiple pipelines against the same branch. Note that you can only cache files relative to the project build directory.


You could use the command rabbitmq-diagnostics -q ping in case you just need a basic check.
healthcheck:
  test: rabbitmq-diagnostics -q ping
  interval: 30s
  timeout: 30s
  retries: 3

More information on how to run more advanced health checks could be found here


Founded argument to have no sandbox CI/CD?

A CI/CD system is, after all, just another software product/system. Regular upgrades and at least some changes in the plugin installations could be treated as changes of the software product itself.

I see no founded reason for which such software product can't also use as part of its own development process a CI/CD solution. Maybe even itself - the most recent production version, for example - if it's flexible enough (I'm still investigating such possibility for the CI system I'm working on).

Now, a CI/CD system deployed/actively used in a certain software development project is effectively a software product deployed in a specific environment.

Changes to the configurations of the CI/CD system aren't actually software changes, they're changes of the environment in which the software system is deployed. These are trickier to address in a CI/CD pipeline. Some even impossible. You'd have to replicate the environment as close as possible. But it's unlikely you'll be able to do that at 100% - just like no dev/QA/etc environment is exactly as the production one.

Some environment changes could be tested in a CI/CD pipeline. For example changes to a test script: both the old and the new versions can be executed as parallel pipeline jobs with the same set of artifacts for a period of time, long enough to determine the test quality and stability before making the new version the official one and retiring the old one.

Finally, don't forget that most CI systems are reactive: they detect breakages, but human action is required to identify the culprit and/or make repairs before the development process can be resumed. Applying such CI system to an actively used CI/CD system one would allow the show-stopper problems you mention. Only a non-blocking CI system can completely prevent them (disclaimer: I'm the founder of the company owning the referenced page and offering such system).


Trigger a GitlabCI pipeline after it detects a change via a curl callback

One could set up a webhook between github and gitlab, see settings>integrations>github in gitlab or trigger a pipeline in gitlab by configuring github.

https://docs.gitlab.com/ee/ci/ci_cd_for_external_repos/github_integration.html

If one does not have a github account and one cannot fork the github project, one could create a script that runs on daily basis and triggers the gitlab pipeline by calling the pipeline API if "new release in github" is applicable.


Continuous Integration infrastructure for multiple iOS projects

Is there any other viable solution, maybe better than the ones above :) ?

For Jenkins probably no, due to the license issues you mentioned (you have to run macOS on Apple branded hardware). If you can work with that then it's definitely a solution.

If not, then I'd suggest you to check for a hosted iOS continuous integration system where you don't have to deal with the Apple hardware / licensing, the service will manage it for you, e.g. https://www.bitrise.io

There are also services where you can rent Apple hw and you can configure it any way you like, https://www.macstadium.com is one of them (probably the biggest one).


Why don't the instances in the auto-scaling group get assigned public ip addresses unless it's a default vpc?

i got the answer from aws support:

he reason why you are seeing that notification is because it is in accordance to your launch configuration (staging-1-deploy) settings. During the creation of a launch configuration, the assignment of public IP addresses to EC2 instances defaults to Only assign a public IP address to instances launched in the default VPC and subnet. (default) [1]. To support automatic assignment of public IP addresses to your EC2 instances as they are launched, you will have to change the launch configuration settings. Since a launch configuration cannot be edited [2], you can create a new one by copying your current launch configuration. Follow the steps below to achieve this:

1 - Go to your AWS console, select Launch Configurations, select staging-1-codedeploy
2 - At the bottom of the details, click the grey Copy Configuration button on the right.
3 -  ClickEdit Details link, then click Advanced Details on the resulting page.
4 -  Go to IP Address Type and select the second option, Assign a public IP address to every instance.
5 - [optional] Change the name of the launch configuration if need be and
6 - Save launch configuration

You can now proceed to use your new launch configuration for your auto-scaling group and all your EC2 instances will be assigned public IP addresses as desired.
I have attached a few screenshots to show some of the steps described above.


AWS ECS vs EKS for hybrid cloud strategy

This is a very broad question (and BTW you have a typo in the title, it should say ECS not ECR).
In terms of general positioning this may be a good starting point.
Given in the title you mention "hybrid" deployments you may be interested in investigating and investigating ECS Anywhere and EKS Anywhere. They are both coming in 2021.


Decoupling data of devops tools eg jenkins nexus

You might want to explore immutable architecture.

Steps

CI with static analysis(Sonarqube, because free!), pushing version artefacts to Nexus.
Base Image using Packer. These must be revisited from time to time. Base Image has security hardening, log shippers, monitoring tools etc.
Environment/Application specific images from Base image.
healthCheck and version API for each application(healthCheck API in deployment and version for visibility of code in different VMs).
Deploy App using Terraform and Ansible.

Can use Jenkins 2.0 (pipeline as code) to achieve points 1,2,3. It can be part of each application itself.

Let me know if this answers your question.


How to ensure equitable distribution of SQS messages in a distributed systems setting?

If there are 100 messages in the queue and 5 consumers, the initial distribution will be no more than 10-10-10-10-10.

A single response can never return more than 10 messages.

This seems like a non-issue.

Race conditions related to multiple consumers should be a non-issue as well.  SQS is designed for multiple simultaneous consumers.

Use long polls and a 20 second max wait timer and be amazed. (No, a 20 second wait does not delay messages by 20 seconds.  It doesn't delay them at all.  You sort of need to see it in action to really understand how it works.)

You're definitely overthinking some things, I suspect.


The answer is: it depends.

Before I answer, I need to provide definitions for a couple of terms to prevent ambiguity.

1) Deploy is defined as the act of changing executables in an environment. This might mean that new source is copied over, and some process is restarted. Or a new version of a docker container is placed into an orchestrator - doesn't really matter.

2) Release is defined as the act of making new functionality available to users of the system.

Do note that while in most organizations release and deploy happen together, they definitely don't have to be.

  Every released change (usually) requires new code to be deployed. But not every deployment of code means new changes were released to be used.

Let us first look at the best case possible. Where you don't have any button that requires pushing, to get a deployment to happen. Every change sent to your version control system - automatically gets tested for correctness and is automatically deployed to your system.

Now your question is optionally several different questions:

Do I have a way to release a new feature and is that way manual? (button)
Do I release ALL available (multiple) features at the same time when that button is pushed?
Do my feature releases require changes to happen in multiple decoupled parts of the system?

Since releasing new functionality requires some business approval. For example, the UX and correctness of the new functionality must actually bring value to your customers. It makes sense to have a "dark" release that only some friendly customers can see and provide feedback for. Then when these customers are happy with the value they get, your business can decide to make this new functionality generally available (GA).

Should this feature break the system when released, it is possible to turn off the switch that made it released in the first place. All of which does not require any new code (or old code) to be deployed to the system, because the code is already there.

When you consider that deploy and release are separate, it makes the decision to deploy everything together or separately simpler.

The manufacturing world and Toyota Production System specifically have taught us that having small batches is much more beneficial than batching work items together. TPS even goes as far as to strive for single-piece-flow, where each work item is delivered to the next work center alone and not in a batch.

Agile methodologies have taken a cue from TPS and also describe the benefits of having small-batches. These would be described as a "sprint" with a definite deployed deliverable at the end and striving to keep the sprints as short as possible. This allows to run short experiments and receive feedback regarding the value of the changes created as soon as it is possible to do something about them.

Continuous Delivery is taking this even further by saying that any finished code, should be deployed to your systems as soon as it was auto-tested. And a release can happen at any time when someone decided to do so. And experiments can be validated as part of the development cycle. Moving the definition of "done" for a developer away from "I finished writing my code" and towards "I received feedback from customers that they received value". The shorter the feedback cycle is - minutes, seconds, etc... the better. And batching is a deterrent to short feedback.

By having a button that by definition batches things together, would mean that risk of problems is higher. Learning from TPS, Agile and CD means that single-piece is far superior and has many benefits.

The answer "it depends" is correct because all of what I wrote above highly depends on the maturity of your organisation. The amount of automation you have. The amount of communication you have. And many other factors.

Separating release from deployment requires continuous integration and deployment. As well as a system that enable to select which features to release. For example https://github.com/intuit/wasabi or https://www.infoq.com/presentations/etsy-deploy


What are the best logging/metrics reporting tools for use with OpenShift?

The question hasn't had an answer in seven months so I will promote my upvoted comment to an answer:

Finding the lifecycle of a specific message across services is known as "distributed tracing". Distributed tracing requires more than just capturing logs. OpenShift uses Kubernetes which is part of cncf.io/projects which governs opentracing.io and has one tracing solution jaegertracing.io. As Jaeger is a sister project to Kubernetes you are likely to find it widely supported. Here is an openshift commons video about it.

I should mention that the question is likely to gather a lot of answers of the type "the only tool I have used is the best tool ever!". Experts will avoid answering such questions. On many sister StackExchange sites, often questions that get such answers get put on hold by moderators as been unhelpful.

I recommend that you don't look at new tools before fully exploring the tools that are near to hand or "most obviously stable and well supported". As EFK (sometimes more amusingly know as FEK as it sounds naughty) ships with OpenShift its worth really digging into what it can do. Then ask questions about how to do the things that it appears it cannot do. That is the style of question that helps everyone and that experts will gladly answer and you may then find that the most stable and widely support tool meets your needs. That is the best outcomes as it is going to be the easiest to get running, the least likely to break on upgrades, and the least likely to itself go down causing you late nights fixing it.


What strategies can be employed to secure sensitive data in log files?

I think the solution comes down to a broad spectrum of approaches that ensures data protection:

Data Classification: The most efficient technical strategy is to categorise the data at the point of creation rigorously. At its core, the developers are responsible for ensuring that all logged information is assigned a category.  Categorization can, for example, be achieved through Splunk Metadata which, in turn, can be used to direct log entries to different buckets based upon their data categorization.
Event Partitioning: There is often a desire to log sensitive information along side non-sensitive information. For example, if a new user was to sign up you may log:

Customer ID (Restricted)
Customer Type (Restricted)
Aquisition Source (Unrestricted)
Correlation ID (Unrestricted)

It is possible to split this one "Event" into two parts, one containing the Restricted information and one containing th Unrestricted information.  This aligns with the first point by allowing filtering rules to direct to different buckets.
Data Masking: In specific circumstances it may not be possible to categorise the data at source, in my experience logging solutions do allow for Masking Rules to X out sensitive data.  In the linked example a sed command is used to apply a regular expression to all data from a specific source.  Once the restricted data has been masked out then the event can be considered to be Unrestricted.  Care must be taken with the rule to ensure that information critical to an event such as a correlation ID doesn't match the Regular Expression used to match sensitive data.
Event Filtering: As a last resort it may be necessary to filter all events of a particular type or source into a separate bucket if they contain sensitive data that cannot be categorised or masked.  In this case the information in a restricted bucket could only be accessed through a Break-Glass mechanism to bypass access controls under the provisions of an incident.

With each of these solutions, testing is key to ensuring that nothing slips through the cracks.  Logging and Event Management must be considered to be a first class Non-functional Requirement with the same level of development rigour applied to a solution - including peer review and tests to ensure that data is properly categorised and partitioned in the tool of choice.


Jenkins is running as a docker image in a kubernetes cluster and won't come up due to plugin version incompatibility

If you know what plugins are causing the issue, you can use the Jenkins CLI to remove or downgrade those plugins.  For instance:

java -jar jenkins-cli.jar -s http://localhost:8080/ install-plugin SOURCE ... [-deploy] [-name VAL] [-restart]

Installs a plugin either from a file, an URL, or from update center.

 SOURCE    : If this points to a local file, that file will be installed. If
             this is an URL, Jenkins downloads the URL and installs that as a
             plugin.Otherwise the name is assumed to be the short name of the
             plugin in the existing update center (like "findbugs"),and the
             plugin will be installed from the update center.
 -deploy   : Deploy plugins right away without postponing them until the reboot.
 -name VAL : If specified, the plugin will be installed as this short name
             (whereas normally the name is inferred from the source name
             automatically).
 -restart  : Restart Jenkins upon successful installation.

I believe you can also just drop an .hpi file into a plugins directory in your Jenkins installation, but I've never needed to resort to this solution before, so I can't say how well it works.


How to implement GitLab Flow branching model for microservices?

We also switched from Git Flow to GitLab Flow several months ago and so far we're very happy with our decision. It works very well with GitLab, it's easy to understand and less error-prone and you don't need additional Git commands (which are quite slow on Windows).

We use Docker Compose to organize our microservices and have a separate project/repository just for the staging and production compose file(s) of our actual application. In the project and CI of each service you can then combine such compose files with a specific one that just tells Docker to use the specific branch of the specific service (and maybe other branch specific settings).

The production compose file contains the production specific settings and tells each service to use a specific tag:

service1:
    image: examples/service1:1.5.4
    ports:
        - "8000:8000"
    volumes:
        - "/data"
service2:
    image: examples/service2:3.5.2

The staging compose file tells each service to use the image of the master branch:

service1:
    image: examples/service1/master:latest
service2:
    image: examples/service2/master:latest

Then the compose file for a specific branch of service 1 just looks like that:

service1:
    image: examples/service1/some-branch-name:latest

When you deploy a review environment for the specific branch with all three compose files at once you'll get something like the following:

service1:
    image: examples/service1/some-branch-name:latest
    ports:
        - "8000:8000"
    volumes:
        - "/data"
service2:
    image: examples/service2/master:latest


windows 10 vs windows server 2016 as jenkins slave

Unless you do something distro-specific (i.e. something which depends on the specific version of Windows) there should be no issues.


Solutions:

You have a few choices to resolve the security issue in git client plugin 3.0.0-rc.

1) Install git plugin 3.12.1 and git client plugin 2.8.5 from the Jenkins update center
2) Upload git plugin 3.12.1 and git client plugin 2.8.6 into your Jenkins server from the "Advanced" tab of the "Manage Plugins" page inside "Manage Jenkins".
3)Install git plugin 4.0.0-beta11 and git client plugin 3.0.0-beta11 from the Jenkins experimental update center.
4)Upload git plugin 4.0.0-beta11 and git client plugin 3.0.0-beta11 into your Jenkins server from the "Advanced" tab of the "Manage Plugins" page inside "Manage Jenkins"

If you choose git plugin 3.12.1, you are choosing the released git plugin and the most stable.

If you choose git plugin 4.0.0-beta11, you are choosing the most recent pre-release git plugin with more bug fixes than are available in git plugin 3.12.1.

Reference: Git Client Plugin

GitHub Link

Plugin manual download

Related Issue : https://issues.jenkins-ci.org/browse/JENKINS-59336


How to run/deploy devilbox (Docker image) docker-compose on GCP without a Dockerfile?

Firstly, docker-compose is is a tool for defining and running multi-container Docker applications. (https://docs.docker.com/compose/).
Dockerfile is single-container, if you want to run multi-containers on GKE you should convert docker-compose to kubernetes deployment.

You can manually convert or use http://kompose.io/ to convert automatically.


Is it possible to create a robot account in bitbucket without creating a new email account?

After doing some research and comparing various documents it seems that a bot account is basically a real user account and needs a separate email account in order to create such an account as using an email account to register a new account results in, e.g.: This email account is already in use.

Combined with quote retrieved from the link that is defined in the question:

  User accounts are intended for humans, but you can give one to a
  robot, such as a continuous integration bot, if necessary.

It seems to be necessary to create a new email account if a bot account has to be created as:

git repositories, like github, bitbucket and gitlab check whether an email account already exists if a new user is created
to clarify that the user is a bot and not a human


Apache Airflow federation - observe remote dag in full detail?

I spent a long time on this problem and made 2 custom solutions as nothing out of the box exists.

Both steps require you to either use both the experimental and the extra plugin API or to have access to the remote database.

At that point, basically either:

Make a GUI plugin on a separate page that hits the APIs and shows all tasks (list exec dates, list tasks in exec date, get status of each).
Make python operator steps in your dag to call out to the state of the remote dag steps with the same name.  It's hard to reflect anything outside of running/done though as you need your step to keep checking in case the remote end restarts the step/tries again.

The APIs are slow, so this isn't fun.  I'd recommend going for the DB if you have the option.

Airflow 2.0 will fix the APIs apparently, and then this may be a lot easier.