How can I get the Docker target platform inside the Build Environment / Dockerfile I'm doing multi-platform builds with buildx and would like to know if there is a way to determine what platform is currently being build so I can avoid certain steps for certain environments.
For example, something like...
# No DOSEMU outside amd64
RUN if [ "$DOCKER_PLATFORM" = "amd64" ]; then \
      apt install dosemu \
    fi

This is typically done with a script, not the Dockerfile. The script (perhaps in bash or python) can run at build time to determine what environment it is in, and act accordingly. This can be included in the RUN command, but it risks becoming quite complex and difficult to read in the Dockerfile. Furthermore, each additional RUN or CMD entry in the Dockerfile adds a layer to the image, which is considered bad practice.
This script can instead take the arguments BUILDPLATFORM and TARGETPLATFORM as suggested in the buildx docs, which would make more declarative. Instead of discovering the target, you would declare it (and write your script accordingly), so that the user understands exactly what happens without having to look inside the build.


Automated Docker swarm reinitialization and token distribution Imagine you want to reset your Docker swarm from time to time.

How do you distribute join tokens to those zillions of nodes? How much automation is possible here?

Have the Swarm Manager place the worker join token in a Key/Value store.  We use AWS Parameter Store but I believe Consul would be another option (I don't use it).

Each node can then retrieve the token while it is bootstrapping.


Azure devops, fortnightly build trigger I'm trying to write a build pipeline that runs every second friday (essentially at the end of a sprint). Using the classic editor it appears I can only set a trigger that would run every friday. Is there any way I can achieve what I'm after?

Perhaps it runs every week but stops immediately if it can interpret the when the build was last run (although that doesn't seem to be exposed anywhere). I guess another alternative would be a triggering build that calls to the devops API to figure out if its the last day of the timebox. Neither of theses are ideal though for a fairly simple requirement (imo).

Thanks

I don't think you can alter the trigger right now in Azure DevOps. What I do is to create an extra task to start with, and use powershell (or your language of choice) to check if the week number is even or odd and then proceed with the build or not.


How to use remote Ivy artefacts in Maven jobs with different binary repository managers? Consider the following situation:

Alice -----              { Firewall }  Bob
|                                       |
Artifactory / Ivy repos  -  ---   --- Nexus / Maven Repos

That is, Alice uses Ant and Ivy to publish her artefacts in an Artifactory in Ivy repos, while Bob sits behind a firewall and builds Maven artefacts storing them in Maven repos in Nexus.

How can Alice provide her artefacts to Bob? (while both do not have to make large changes to their setup)

So far, I have considered the following options and decided to ask you before trying them out:

(1) Bob manages credentials to access Alice' artefacts in his build system and uses a Maven plugin for Ivy (which means configuration work for all relevant projects)

(2) Alice uses an Ant/Maven task to generate POMs for publishing/deployment step and offers an additional Maven repo, because Artifactory can support it different repo formats. This for Bob's most convenience though Alice needs to do configuration work of all relevant projects and there might be also other Bobs in future using other binary repository managers.

(3) Bob configures Nexus to be a proxy for Alice' Ivy repo (which is AFAIK was not possible as of 2014).

What would you do?

I'd go with (2). Since Bob has a more rigid setup (requires Maven metadata), and Alice can provide that (using more flexible Ant), that sounds like the easiest way to go.


How to tag source code using gitlabCI We got gitlab new to our environment and trying to create some CI CD pipelines using gitlab CI. I have got some better progress with running some maven goals, creating pipelines and archiving artifacts using my .gitlab-ci.yml as below. I tried to give give tags after script which doesnt work. Now, I am trying to figure out how can I automate git tags to my sourcecode. I would like to create tag for sourcecode after master branch got successful build. we are using Semantic versions to tag our source code. Finally, so whenever master got successful build I would like to create a tag to my master branch.

image: maven:3.5-jdk-8-alpine

stages:
 - build
 - deploy
 - tag

maven_build:
  stage: build

  script:
   - mvn clean package
artifacts:
 paths:
 - target/*.jar

after_script:
   - ls -a
   - cd target && ls -a
   - git --version
   - git tag -a 1.0.15 -m "Version created by gitlab-ci Build"
   - git push origin 1.0.15
only:
  - master

logs:

Running after script...
$ ls -a
.
..
.git
.gitignore
.gitlab-ci.yml
 LICENSE
README.md
pom.xml
src
target
$ cd target && ls -a
.
..
apidocs
classes
generated-sources
generated-test-sources
javadoc-bundle-options
maven-archiver
maven-simple-0.2-SNAPSHOT-javadoc.jar
maven-simple-0.2-SNAPSHOT-sources.jar
maven-simple-0.2-SNAPSHOT.jar
maven-status
surefire-reports
test-classes
Uploading artifacts...
target/maven-simple-0.2-SNAPSHOT-javadoc.jar: found 1 matching files
Uploading artifacts to coordinator... ok            id=60598296
responseStatus=201 Created token=Gu-eH1es

Job succeeded

I tried to change docker image and added couple steps for git tag. Below is the answer worked for me,

image: maven

stages:
- build
- deploy
- tag

maven_build:
stage: build

  script:
   - mvn clean package
   artifacts:
  paths:
   - target/*.jar

  after_script:
   - ls -a
   - cd target && ls -a
   - git --version
   - git remote remove origin
   - git remote set-url origin https://"username:passwd"@gitlab.com/accountname/projectname
   - git tag -a 1.0.15 -m "Version created by gitlab-ci Build"
   - git push origin 1.0.15
  only:
    - master


How to test provisioning and configuration in Ansible setup? Looking at trying to build some resilience into our Ansible setup which deals with provisioning and configuration.

I understand a few methods of testing on the configuration side of things but I'm wondering how best to implement testing on the provisioning side of things, and if there are any tools which can help with this type of implementation.

Currently a lot of our testing is done serially during the playbook which makes a lot of sense for stuff like "has service come up; is the vip available; has this async task finished" but what really concerns me is our ability to manage drift of configuration at both the application and provisioning layer (such as VM configuration). I'm aware Ansible isn't the best tool for working with configuration drift but I'm curious to see your own opinions.

If you have something to fully automate the process even better. (we have a few ugly scripts which report back in slack daily).

Note: Right now we have a few conditions where a reprovision might occur (e.g. rebuild from backup, critical systems issue) but typically it just loops through some of the ansible configuring tasks and thinks no more of it.

Some options out there..

Testing tools: Sorted by github stars

Serverspec - Ruby, most popular tool out there, built on ruby's rspec
Goss - YAML, simple, <10MB self-contained binary, extremely fast, can generate tests from system state
Inspec - Ruby, think of it as an improved serverspec, almost same syntax, made by the chef guys. Built to be easier to extend than serverspec
Testinfra - Python, has the cool feature of being able to use Ansible's inventory/vars

Major differences between them:

Ultimately, I would suggest spending a day experimenting with all of them to get a feel for them before deciding for yourself.

With the exception of Goss, all the frameworks can run against a remote machine (ex. over ssh). Goss only runs locally or in docker w/ dgoss.
All frameworks can be run locally on a server, but require Python or Ruby to be installed or embedded. Inspec provides a self-contained <150MB bundle with an embedded version of ruby. Goss is a single <10MB binary with no external dependencies.
Goss has built in support for nagios/sensu output, this allows for easier integration with monitoring tools.
Goss tests tend to be simpler, but less flexible since it's based on YAML. Other frameworks allow you to leverage the full power of the underlying language Python/Ruby to write tests or extend the tool's functionality. (simplicity vs flexibility)
Goss allows you to generate tests from current system state
Testinfra to my knowledge is the only one that has built-in support for ansible inventory and variables
Inspec is backed by Chef

Continuous/divergence testing:

Chef Compliance - works with inspec to continuously test your servers, paid product
Goss - Can be easily hooked into Nagios or Sensu. Also, supports exposing server tests as an http endpoint.

Testing harnesses for development:

kitchen - Testing harness tool, launches instance, runs config management code, runs test suite. Made by the chef guys
Molecule - Similar to test kitchen, but written specifically for ansible

Full Disclosure: I'm the author of goss

UPDATE: InSpec 4.x or above uses a mixed commercial / open source license - see comments.


Resources don't seem to show up in Terraform state after import I'm in the middle of importing a bunch of AWS resources into Terraform by doing the following:

put a stub resource into a .tf file
terraform import the resource (using the same address)
copy the relevant config out of the output of terraform show -no-color into a new .tf file

This has worked before, but now I'm doing a bunch of security groups and it doesn't seem to be working. I'll do an import:
terraform import aws_security_group.rds-launch-wizard-2 sg-XXXXXXXX

This succeeds. I would expect aws_security_group.rds-launch-wizard-2 to show up in the output of terraform state list or terraform show, but it doesn't. I feel like maybe I'm missing something easy? Thanks for any help.

I figured it out. The stub resource has to have a provider that is configured with the proper AWS region. All these security groups were in us-west-2. You need this:
resource "aws_security_group" "rds-launch-wizard-2" { provider = aws.us_west_2 }

instead of this:
resource "aws_security_group" "rds-launch-wizard-2" {}

This assumes you have a provider already configured thus:
provider "aws" {
  region  = "us-west-2"
  alias   = "us_west_2"
}


How to deploy multiple dependent micro services We want to deploy multiple microservices on AWS ECS.

The issue that we need to solve is how to deploy them in an atomic way:

Let says we have the front-end services which requires the user service version 2.0.

How to make sure the user service is available before the front-end one is deployed.

We have the idea to replicate the whole infra, deploy everything then make it available. But it seems to me complex. How do you make these spare instances, deploy the services, and make the switch?

We are using two ALB and target groups for each services (dynamic port mappings).

Such question could be an indication of a poor architectural slicing into microservices. From What are Microservices?:

  These services are built around business capabilities and
  independently deployable by fully automated deployment machinery.

The key point missed in such case would be their independently deployable aspect.

The point could also be simply misunderstood: it doesn't necessarily mean that each microservice should be capable to perform its entire functionality by itself, it just means that it's able to gracefully bail when some other microservice its functionality depends on isn't available, maybe keeping track of "todo" stuff for later execution, when that microservice becomes available.

Seen from a different perspective: handling unavailability of external service dependencies should actually be part of each microservice functionality - so one could consider the microservice fully functional even when its runtime dependencies aren't satisfied :)

It's worth noting, I think, that in the above comments I'm referring to microservices unavailability regardless of its reason, be it deployment dependency order or something else (outages, for example).

Another thing to consider would be the finer difference between deploying the microservices and bringing them into action by switching the traffic to them. Switching traffic is often faster than the deployment itself, so the availability at the entire system level can be increased by first deploying all microservices and only after that performing the traffic switch for all of them.


Are there any tools to monitor custom console applications on Windows Server? Are there any DevOps tools or known practices to monitor custom made console application on an on premises (Windows Server) environment?

We developed an exe that needs to be continuously running, and if it fails we would like to know, so we can re-start it. Maybe there are tools to re-start them automatically?

This is probably a question better suited for ServerFault or StackOverflow.

One approach that may work is to Create a Windows Service from an Executable, then set the service to restart on failure/crash.


How to install Certbot via Ansible playbook? This is how I install Certbot in a Bash script:

apt-get update -y && add-apt-repository ppa:certbot/certbot -y && apt-get update -y
apt-get upgrade nginx python-certbot-nginx -y

That's the playbook syntax I found to install Nginx in default conf:

- hosts: localhost
    connection: local
    become: true

tasks:
    - name: install nginx
    apt: pkg=nginx state=installed update_cache=true

Is there no Ansible task to install Certbot as well, instead the above "heavier" Bash code?

Here is the direct Ansible translation of your bash install script:

- apt_repository:
    repo: 'ppa:certbot/certbot'

- apt:
    name: "{{ item }}"
    update_cache: yes
  with_items:
    - nginx
    - python-certbox-nginx


Chef - Setting Unique Node Attributes I'm fairly new to Chef and have been writing recipes for Kiosks that we use at work.

I've created a role for the Kiosk that contains a set of attributes, however one of these attributes is a unique ID that is different for each Kiosk node.

This ID is provided by our customer who uses the Kiosk, is abritrary, and can't be generated automatically.

What's best practice for setting this value? I'm using Chef Server and was thinking the best place to do it would be at Bootstrap but not entirely sure how.

Yesterday I asked similar question and found this similar question after getting replies in my own post. What people suggested me in my question is editing a node by knife edit and then setting an attribute for that particular node manually. This attribute would be assigned only to this node. Or the other way - you could create a wrapper cookbook that would override attributes of your "base" cookbook. For more details check out answers and comments for my question.


Jenkins pipeline: do "Declarative: Checkout SCM" step only I'm newbie in Jenkins.
I've created pipeine with parameters in Jenkinsfile in git. It works fine.

Problem is: when I push new parameters into Jenkinsfile, then press button "Build with Parameters", there are no new parameters. I will see them only on next build, after step "Declarative: Checkout SCM" will be done.

I know workaround: add parameter to skip all steps. Then I can run build and skip all steps (except "Declarative: Checkout SCM" of course) and afterwards run build with new parameters.

Question: is there are some magic URL or other possibility to update parameters from git before build?

As implied by the links in comments, for better or for worse, this behavior is an unavoidable consequence of how Pipeline is designed.  Pipeline configuration changes in your Jenkinsfile cannot be picked up by Jenkins without executing your Pipeline.  This includes things such as adding parameters.

My personal advice is to ensure that your Pipeline jobs are non-destructive, or in other words, to ensure that the worst thing that could possibly happen by running a job is nothing.  This allows you to pick up configuration changes by just running your job after committing the changes to your Jenkinsfile, and then you can simply abort the job (or let it run to completion if it's a short job) with the confidence that you won't break anything.  Then subsequent runs will have your configuration changes available.


How can I find the version of Docker I am using? As the title says, how can one find Docker's version?

For the daemon's version (meaning the engine's version) that's running on your server:
$ dockerd --version
Docker version 20.10.2, build 8891c58

For your client's version that's running on your local computer and with which you send commands to the daemon on the remote server:
$ docker --version
Docker version 19.03.13, build 4484c46d9d


Can't write to Docker volume My set-up

I have a Docker image based on php:7.4-apache.
I have two Docker volumes for saving files that need to be persisted.
On container start, I run Certbot to install HTTPs certificates.

Issue

I discovered that my application can't write to Docker volumes.

Debugging

Using ls -l I found out that the mountpoints of my volumes are owned by user 1451:

drwxr-xr-x 4     1451 users     176128 Mar 12 13:25 volume_mountpoint

My web server is running under user www-data.

Attempted solution

I've tried setting the user under which my container runs to www-data. This caused the volume mountpoints to be owned by www-data, which fixed the permissions issue. The problem with this solution is that Certbot requires root permissions and fails to acquire HTTPs certificate without it.

Question

What is the proper way to fix this issue? I need Certbot to run under root, but let mountpoints to be owned by www-data.

Solution that worked for me in the past: create a new image out of the existing one and let entrypoint script of that new image to modify permissions of your volume_mountpoint.

So in the case of your image (php:7.4-apache) you create entrypoint.sh file, something like

chown www-data:www-data -R /path/to/volume_mountpoint
apache2-foreground

And then your Dockerfile should be something like

FROM php:7.4-apache
COPY entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

This way it should correct the permissions when container starts. Note, that I haven't tested the above, might require some tweaks - but hopefully it shows the idea.

P.s. Maybe somebody has a better way of doing this - I would be very interested myself.


How do I access the web UI for Kubernetes clustered that were created via EKS? I need a URL and the web UI log in credentials for Kubernetes.  I created Kubernetes clusters in AWS with EKS.  I have API endpoint URLs for the clusters based on what I see in the EKS section of the web UI of AWS.  But when I go to them in a web browser, there is no prompt for a username or password.

I ran this command: "kubectl config view | grep http"

But when I go to those URLs I see "403 Forbidden" errors.

I expect a URL that would allow me to log in for the new Kubernetes clusters that I created.  What should I do to determine the URLs?  Hopefully the default credentials will be ascertainable.

With EKS, the Kubernetes UI need to be deploy manually. You have a fully detailed documentation on how to deploy Kubernetes UI in EKS.


Jenkins hangs on Windows CMD build that has GUI I am attempting to automate imports and exports of Oracle's PeopleSoft Application Designer. It is a GUI program but it can operate in the windows command line for certain tasks. This project has examples of how it is used in the command line.

The problem is that despite having parameters to hide the GUI, splash screen and to auto-quit, it is hanging when run in Jenkins. My suspicion is that despite hiding all graphics, the Windows Desktop Window Manager (or something) is still being called and Jenkins has no way to deal with that. I think this because when I execute the command, my CMD window loses focus.

I have tried both with "Execute windows batch command" and with Git Bash, "Execute Shell" and calling cmd.exe.

When I run this in the actual git bash window without hiding the GUI, the GUI still pops up, so the Git Bah program doesn't have the same issue.

How can I either suppress all GUI in a windows command OR give the program somewhere to put these invisible windows?

Alternatively, if I am way off base with this assumption that GUI is the problem, how can I troubleshoot?

The command I am using in bash:

cmd.exe /c "PSIDE.EXE -HIDE -SS NO -SN NO -PJTF TEST_PROJECT_NAME -FP C:\export -CT ORACLE -CD $PS_PROJ_DB -CO $PS_PROJ_USER -CP $PS_PROJ_PASS -QUIT"

Jenkins is installed directly on the Windows machine where the command is running.

My current, less ideal solution to this is to run Jenkins in a terminal logged in to a desktop rather than as a service. I'd rather not have to do that but it has solved the problem entirely.


How to resolve the host operating system 'localhost' address from within a container? I have two docker containers running:

Postgres 9.4: 0.0.0.0:5431->5432/tcp
Postgres 11: 0.0.0.0:5432->5432/tcp

I can connect to both of them via clients on my computer, but I am unable to access one container from within another. I would like to use Postgres's dblink feature - i.e. (in case it matters), I am running a query on one server that looks like this:

select
dp.*
from dblink(
    'dbname=mydb
    port=5431
    host=localhost
    user=postgres
    password=password', 'select 1'
) as dp (i int)

This results in an error along that says:

Could not connect to server: Connection refused
  Is the server running on host "localhost" (127.0.0.1) and accepting
  TCP/IP connections on port 5431?

And I guess this is because localhost is the loopback address inside the container. What is the way around this? (I'm super new to Docker by the way)

You are correct in that using localhost within the container is referencing the container, and not your network.  You could use inspect, find the ip, and hardcode the ip.  However, a simpler and cleaner solution would be to utilize Docker's network features.  When you run the containers you can put the containers inside a defined network.  Containers in this network can resolve requests to other containers using their container name instead of an ip (e.g. Server=container2).

Docker Network Documentation


Jenkins Docker - Make changes to gitconfig I have a self-hosted Gitea organization, and the way to access the repos requires some "secret" extraheader in .gitconfig. (2FA is also enabled)
When I look at Jenkins "Configure System" settings, under the "Git plugin" section, it seems that the only .gitconfig options I can change through the UI are "user.name" and "user.email".
Is there any way I can change extra .gitconfig settings, such as adding http.[url].extraheader, or a way to run git config --global commands, before a git clone or git pull is performed?

As far as I can tell, there is no way to tweak arbitrary git config settings from within Jenkins.  You would have to tweak your git config on your build agents.  If you're using permanent agents, this would involve logging in as the jenkins user and running git config --global ....  If you're using docker build agents, then you would need to bake the git config settings into your image.


How to trigger Jenkins Pipeline by push in specific branch in Bitbucket? I've created Jenkins Pipeline Job, activated "Build when a change is pushed to BitBucket" trigger. I've also specified branches to build. But pipeline is triggered by all branch changes.
Also I've created Freestyle job with similar configuration and trigger works correctly.
General Webhook didn't help, it triggered all jobs in Jenkins.

While I don't know Bitbucket-specific solution, when it comes to triggering Jenkins builds, I prefer using a simple post-receive Git hook.

In Jenkins select Trigger this build remotely (or something similar, it's usually the very first option in Build triggers section), then set up the post-recevie hook to something like:

#!/bin/bash

username=user
token=1234567890abcdefgh

echo "Executing hook"

while read oldrev newrev refname
do
   branch_received=$(git rev-parse --symbolic --abbrev-ref $refname)
   echo "   /==============================="
   echo "   | PUSH RECEIVED"
   echo "   | Old revision: $oldrev"
   echo "   | New revision: $newrev"
   echo "   | Reference   : $refname"
   echo "   | Branch name : $branch_received"
   echo "   \=============================="
   curl -X POST -d "BRANCH=$branch_received" http://$username:$token@jenkins/job/job_name/buildWithParameters?token=$token
   res=$?
   if test "$res" != "0"; then
      echo "The curl command failed with: $res"
   fi
done

exit 0

Of course, the above runs for every branch and passes the branch name as a parameter to the job. In your case, since you have different job for every branch, you would call different URL depending on what branch was pushed and probably use build rather than buildWithParameters endpoint.


How to log outcome from multiple hosts in Ansible? I've a playbook that runs EOS commands against multiple devices. Currently the whole thing is done in bash, creates one massive text file log and an engineer compares each day's log to the previous one for irregularities.

I'm attempting to have one simple playbooks that runs the commands and logs to json from which it'll be easier to automate the comparison, but I've just realised only logs from one device are saved as opposed to the two I'm testing against.

---
- name: Checks
  hosts: myhosts
  connection: local

  tasks:
  - name: Run Commands
    eos_command:
     commands:
      - show ip pim neighbor | json
      - show ip bgp summary | json
    register: result

  - name: Save to file
    copy:
     content: "{{ result.stdout_lines | to_nice_json }}"
    dest: "/home/homedirectory/results.json"

Would there be way to log both (and eventually all production) devices in the same file?

This question has two approaches, and both has answers on SO:

Convert all Ansible output to JSON with json stdout callback and parse it with your favourite tools. The eos_command output for each device will be under different host key in the resulting json.
See this and this.
Make run_once task to collect data from other hosts, like this:

- debug:
    msg: "{{ ansible_play_hosts | map('extract', hostvars, 'result') | map(attribute='stdout_lines') | list }}"
  run_once: yes

See this.


Salt Stack Reporting - Executing commands based on environment Salt allows users to assign machines to environments by setting in /etc/salt/minion:

environment: example

You can then execute environments for that state with the command salt '*' state.apply saltenv=example

However, it appears that the same cannot be said for an arbitrary command. Running salt '*' cmd.run 'df -h' saltenv=example will run on all minions instead of just the minions in the "example" environment. How can I run commands for only a specified environment?

The answer is that you can't directly. You have to set a grain on the minions first by doing something similar to:

salt '*' cmd.run 'grep environment /etc/salt/minion | awk "{print \"environment: \" \$2}" >> /etc/salt/grains'
salt '*' saltutil.sync_grains
salt -G environment:prod cmd.run 'df -h'


Azure deploy pipeline with/without approval on separated enviroments I have two separate environments under my repository:

development (Approvals are not configured but the environment exists)
production (Approvals rules are configured via dev.azure.com UI)

The problem is, even we try to deploy to the development environment, the pipeline asking for approval. How we can fix the issue? Below, you can see simple two deploy jobs from YAML:
jobs:
    - deployment: Deploy_Dev
      displayName: 'Deploy Develop to Dev Machine'
      pool:
        name: Development
      condition: contains(variables['Build.SourceBranch'], 'refs/heads/develop')
      environment: 'development'
      strategy:
        runOnce:
          deploy:
            steps:
              - checkout: none
              - task: Bash@3
                inputs:
                  targetType: 'inline'
                  script: |
                    echo $(hostname)
                  workingDirectory: '/var/www'
                  noProfile: false
                  noRc: false

    - deployment: Deploy_Master_to_Hotfix
      displayName: 'Deploy Master to Hotfix Machine'
      pool:
        name: Hotfix
      condition: contains(variables['Build.SourceBranch'], 'refs/heads/master')
      environment: 'production'
      strategy:
        runOnce:
          deploy:
            steps:
              - checkout: none
              - task: Bash@3
                inputs:
                  targetType: 'inline'
                  script: |
                      echo $(hostname)
                  workingDirectory: '/var/www'
                  noProfile: false
                  noRc: false

Environment approvals work per-stage. Split your jobs into separate stages:
stages:
  - stage: development
    condition: contains(variables['Build.SourceBranch'], 'refs/heads/develop')
    jobs:
    - deployment: Deploy_Dev
      displayName: 'Deploy Develop to Dev Machine'
      pool:
        name: Development
      environment: 'development'
      strategy:
        runOnce:
          deploy:
            steps:
              - checkout: none
              - task: Bash@3
                inputs:
                  targetType: 'inline'
                  script: |
                    echo $(hostname)
                  workingDirectory: '/var/www'
                  noProfile: false
                  noRc: false

  - stage: production
    condition: contains(variables['Build.SourceBranch'], 'refs/heads/master')
    jobs:
    - deployment: Deploy_Master_to_Hotfix
      displayName: 'Deploy Master to Hotfix Machine'
      pool:
        name: Hotfix
      environment: 'production'
      strategy:
        runOnce:
          deploy:
            steps:
              - checkout: none
              - task: Bash@3
                inputs:
                  targetType: 'inline'
                  script: |
                      echo $(hostname)
                  workingDirectory: '/var/www'
                  noProfile: false
                  noRc: false


Is it possible to design headless tests with JMeter/Selenium? (and Docker) There are of course Dockerizations of Selenium and JMeter - but can they work together? All the tutorials I can find discuss desktop solutions so not headless.

JMeter supports headless operation, in fact it's even the recommended mode for best load testing results. From Non-GUI Mode (Command Line mode):

  For load testing, you must run JMeter in this mode (Without the GUI)
  to get the optimal results from it. To do so, use the following
  command options:

  -n
      This specifies JMeter is to run in non-gui mode

As for Selenium, things are a bit debatable, the Does Selenium support headless browser testing? SO post is probably interesting, personally I find Ross Patterson's and General Redneck's answers most useful - basically recommending the use of a virtual X server (Xvfb, for example) instead of a headless browser.

A nice related post: How To Run Your Tests Headlessly with Xvfb.


What are spells of Kubernetes? Question

What is spell of conjure-up in Kubernetes?

Background

Following Kubernetes on Ubuntu and run conjure-up kubernetes which showed the snapshot asking which spell to choose. But not sure what this is asking.

Spell selection in Conjure-up documentation tells spells and selections but not clear what they are still, hence look for some explanation and suggestion on which one to select (core or canonical) and what they are.

TL;DR: the "Canonical" version of Kubernetes has been customized by Canonical, the developers of Ubuntu, based upon their experiences of running Kubernetes.  "Kubernetes Core" on the other hand is the standard, official, distribution you would find on Kubernetes.io.  If you are looking to understand Kubernetes on Ubuntu then I would recommend the Canonical version, if you are wanting a standardised version then go for Kubernetes Core.

A Spell is a function of Conjure-Up which is a product created by Canonical to be able to provide "Turn Key" installations of popular Open Source technical stacks such as Kubernetes and Open Stack.  These stacks are typically non-trivial to install, so Conjure Up combines the installation of the software and configuration based upon guided best practice through a GUI and CLI interface.

  conjure-up lets you summon up a big-software stack as a “spell” — a model of the stack, combined with extra know-how to get you from an installed stack to a fully usable one. Start using your big software instead of learning how to deploy it.

Conjure Up is capable of deploying to Ubuntu, MacOSX and popular public clouds.

At the time of writing the following spells are available:

kubernetes
openstack
bigdata incorporating: Hadoop, Spark and Kafka


When should an application be copied to a new region? I'm taking my first course For AWS cloud practitioner and I am curious:

The case: I have a single, client-facing application hosted on an EC2 instance. Let's keep it simple and say it's brochureware, the database is in a volume attached to the instance. It's using us-west-2a as its availability zone.

The conundrum:
I understand the use of CDNs as they essentially store a copy of the application in the edge locations so clients can be delivered a static copy quickly without using up EC2 compute time.

I also understand regions but only to the extent that it is an initial starting point for building out your application.

What would be the nature of cases that would require me to duplicate my EC2 instance to a new availability zone and run the two exact same applications simultaneously?

A few things pop-up for me initially:

Computational availability (ex: the application client needs to request specific data, like a user defined request)
Zone based version control (ex: an incremental rollout of a feature)
And if I'm using this term right, fault tolerance (graceful degradation?). If one zone is down we can fall back to another.

Are these assumptions correct?

First a primer on regions and availability zones

Regions are physical places where the AWS resources are located.  As such different regions may offer different resources.  This is also important for latency-sensitive operations and data sovereignty laws.  Having an EC2 instance in the us-east-1 region means all of my instance resources are in that region of the United States.

Availability Zones, while in the same geographic area, may be backed by one or multiple data centers.  However, if you have an EC2 instance running in two availability zones, they will run in separate data centers.  So an EC2 instance in us-east-1a and us-east-1b will be in two separate data centers.

Imagine you have a mission critical application that needs high availability.  By setting up a load balancer (controlled by the region and not the availability zone) you can help scale your application across multiple availability zones and redirect traffic if something happens to an availability zone.  This helps create a highly available infrastructure.

To answer your three examples:

Computational availability is not really a factor.  You could always throw a larger instance (or multiple instances in the same availability zone) to decrease load.
While you could use multiple zones for rolling out upgrades, this can also be done within the same availability zone.
Your third point here is the main draw to the availability zones.  If a data center catches on fire, floods, gets hit by a meteor and all your EC2 instances are tied to that center then you would be unable to access whatever application you had running.


How do I implement user authentication and management in Kubernetes? I'm trying to architect a micro-service application, that runs in Kubernetes.
It consists of several RESTful APIs. I want a central point to implement authentication for these APIs.
In my product, users would be able to sign themselves up on a website. Signing up would have to give them access to the API's.
So what I'm looking for is a/the way to have central authentication in Kubernetes for users accessing the APIs.
I would also require to be able to programmatically add users to this auth layer, so I can have users sign themselves up for access.
I've seen ingress controllers that do central auth, but I haven't found if they support programmatically adding accounts. I've also seen API gateway software that might do what I want, but I'm not sure if and if so, which ones can run in Kubernetes.
Does anyone have experience in such a setup, that can point me in the right direction?

I'm trying to architect a micro-service application, that runs in Kubernetes. It consists of several RESTful APIs. I want a central point to implement authentication for these APIs.

This is a good idea.

So what I'm looking for is a/the way to have central authentication in Kubernetes for users accessing the APIs. I would also require to be able to programmatically add users to this auth layer, so I can have users sign themselves up for access.

Just to make it clear: Kubernetes is a container orchestrator, e.g. a way to manage your services. It consists of a control plane (think management of apps) and a data plane (think your apps and customer traffic). Both parts may require proper authentication and authorization. When it comes to your "business idea" - it is about the data plane - here this problem is orthogonal to the platform (e.g. Kubernetes or Heroku) that you run your apps on. So think how you should solve your problem with Microservice architecture, and not so much about Kubernetes.

In my product, users would be able to sign themselves up on a website. Signing up would have to give them access to the API's.

The most common protocol for this nowadays is to use OpenID Connect - that is the protocol behind both e.g. Google Accounts and Microsoft Azure AD. What you need is an OpenID Connect provider implementation. The most commonly used open source implementation is Keycloak. Remember, this kind of service is stateful and you will need a database as well.
Instead of setting up your own OpenID Connect provider, you could also let the user use an account that he already has, e.g. a Google Account or Twitter Account - it depends on your use case.

I've seen ingress controllers that do central auth, but I haven't found if they support programmatically adding accounts. I've also seen API gateway software that might do what I want, but I'm not sure if and if so, which ones can run in Kubernetes.

What you talk about here is mostly validation of authentication and this is sometimes done using "auth aware ingress controllers". With OpenID Connect protocol, the user send a JWT-token as proof of authentication, and you could redirect unauthenticated users to your Open ID Connect provider.


Unable to connect to Elasticsearch [ Error: Request Timeout after 30000ms ] I have installed elasticsearch-oss 7.9.2 and kibana 7.9.2 on ubuntu 18.04 when I start elasticsearch service then it's started normally but when I start service kibana it's not starting and shows error 'Unable to connect to Elasticsearch. Error: Request Timeout after 30000ms'

Put the following setting in /etc/elasticsearch.yml and it will work.
network.host: 0.0.0.0
discovery.type: single-node


How to get dependency from file share in Azure DevOps pipeline We are trying to set up a CI pipeline for building several Docker containers and deploying them to a container registry using Azure DevOps. Our code, the Docker and configuration files all reside in a Azure git repository and building those containers just works fine.

However, we have to build one container around a tomcat app that we only have as a .war file that is approx. 20Mb in size. We do not want to commit this file to our repository (we are not convinced that using git LFS would solve the problem because of experiences in other projects), but instead keep it on an azure storage account (either blob or file share storage).

My problems start when I want to include a task to download this file into the build environment as a task in the build pipeline. Getting a file that is openly accessible is easy with either a powershell or bash script. However, in order to download from the storage account you first need to authenticate and I can not find a good way to achieve this.

Steps for download are described here: How To Download Azure BLOB Storage Using Azure PowerShell. According to this article, you have to use the connection string from the Access keys page. You can create your custom secret variable (Variables) and save a connection string in your new variable. Then in your ps scripts you can reference to connection string (stored in variable) with "$env:VARIABLE_NAME".


Mapping Outbound IPs to 1 IP in Azure App Services I have 3 components of my architecture running in 3 separate Azure App Services. Each app service has 4 outbound IPs. So whenever I have to deploy my app onto the client's premise, I have to whitelist 12-16 IPs on their on-premise Firewall.

Is there any way I can deploy a NAT which uses only 1 public IP and I can provide just 1 IP to the client?

If I manage to make this architecture work then how would I modify my API calls to these services, since at the moment I'm using their 1 public IP to access their individual service, with just 1 IP how will I distinguish API calls made to different app service.

Azure Application Gateway allows you to provide one public IP for those App Services.

You have to make the following steps:

Provision Application Gateway
Add listeners with host name for eachof the App Services
Add backends for each of the App Service
Create HTTP Settings with Override with new host name and Pick host name from backend target options
Add rules to connect listeners corresponding to backends

At the end customer has to white-list one public IP assigned to Application Gateway and create DNS entries to point all App Services addresses to one public IP.

Materials:

Application Gateway support for multi-tenant back ends such as App
service
How an application gateway works


Jenkins plugin site to ignore certificates Is there a way that I can tell Jenkins to ignore certificates for the update site.

Background

I have an air-gapped Jenkins installation and there is currently proper way to make a proxy repo. Thus I have the following setup:
- I have modified the hosts file on the Jenkins host so that updates.jenkins-ci.org points to the host of the internal artifact repo
- There is a reverse-proxy in front of artifact repo which handles traffic for updates.jenkins-ci.org

However we are only allowed to use https thus there will be a name mismatch error as the certificate does not match the hostname of the artifact repo host

Remark: I don't want to generally disable the checks but only for the update site so the The Skip Certificate Check plugin is not the solution for me

Following your comment confirming you can use your own signed certificates internally.

One solution would be to replace the current certificate on your repo with a new one holding updates.jenkins-ci.org as an alias. This response on stackoverflow has the necessary info to get you going.

Meanwhile, the plugin higlighted above by @casey vega in the comments (which I didn't know) seems to be a solution much easier to manage.


Looking for Ansible equivalent method to yml Anchors, Aliases, when using include file Using Ansible with the aci_rest module, requires the authentication parameters (hostname, username, password, method, validate_certs) to be defined in every task e.g.

aci_rest:
  hostname: "{{ inventory_hostname }}"
  username: "{{ apic_username }}"
  password: "{{ apic_password }}"
  method: post
  validate_certs: no
  path: /api/node/mo/uni/controller/nodeidentpol.json
  method: post
  ...etc

The YML Anchors, Aliases syntax works perfectly fine within one file.

- aci_rest:
    <<: *aci_login
    path: /api/node/mo/uni/controller/nodeidentpol.json
    method: post
    ...etc

However not when variables and tasks are in different files using any of these functions:

vars_files:
include_tasks:
include_vars:

The full playbook has 70+ tasks with the authentication info repeated every time. I have not been able to find a way to not use repeat code. Is there a way to do this similar to yml alias?

There is module_defaults playbook-level option:

- hosts: localhost
  module_defaults:
    file:
      owner: root
      group: root
      mode: 0755
  tasks:
    - file:
        state: touch
        path: /tmp/file1
    - file:
        state: touch
        path: /tmp/file2


Modify sudoers file with ansible playbook template I am trying to create a sudoers file with ansible template. The sudoers file should look like below:

Cmnd_Alias LS = /bin/ls
Cmnd_Alias LESS = /usr/bin/less
Cmnd_Alias DU = /usr/bin/du

%support1 ALL=(ALL) NOPASSWD: LS, LESS, DU

What I have managed so far is below:

Cmnd_Alias LS = ls
Cmnd_Alias LESS = less
Cmnd_Alias DU = du

%support1 ALL=(ALL) NOPASSWD: LS, LESS, DU

The template looks like below:

{% for item in commands %}
Cmnd_Alias {{ item|upper }} = {{ item }}
{% endfor %}

%{{ group }} ALL=(ALL) NOPASSWD: {% for item in commands %}
{{ item|upper}}{% if not loop.last %}, {% endif %}
{% endfor %}

vars

commands:
  - ls
  - less
  - du

As far as I know, ansible template module does not have anything which will execute the command in the remote server and print the output otherwise I was thinking of changing template file to look like below:

{% for item in commands %}
Cmnd_Alias {{ item|upper }} = `which {{ item }}`
{% endfor %}

%{{ group }} ALL=(ALL) NOPASSWD: {% for item in commands %}
{{ item|upper}}{% if not loop.last %}, {% endif %}
{% endfor %}

and the output will be like what I wanted.

Is there any other method which can make it simple?

BTW I have already checked this post

TL;DR: KISS. Don't use less.

People often make a mistake with ansible by trying to make variable things that don't need to be. Unless there are multiple places where you define the list of commands that support can access, it is perfectly acceptable to just put them in the template create file:

templates/etc/sudoers.d/support1

Cmnd_Alias LS = /bin/ls
Cmnd_Alias LESS = /bin/cat
Cmnd_Alias DU = /usr/bin/du

%support1 ALL=(ALL) NOPASSWD: LS, LESS, DU

or even explicitly as you don't reuse the Cmnd_Alias anywhere

%support1 ALL=(ALL) NOPASSWD: /bin/ls
%support1 ALL=(ALL) NOPASSWD: /bin/cat
%support1 ALL=(ALL) NOPASSWD: /usr/bin/du

And add some task like:

- name: add templates
  template:
    src: {{ item }}
    dest: /{{ item }}
    owner: root
    group: root
    mode: 0640
  with_items:
    - etc/sudoers.d/support1

You would only use templates instead of files because late on there might be some variable to add to all those or the group name might come from variable if you get another role that creates the groups.

If you need to use variable, the thing you can do is to use a list of hashes like this:

sudoers.support1.commands:
- { alias: "LS", path: "/bin/ls" }
- { alias: "DU", path: "/usr/bin/du" }

Then in the template:

{% for item in sudoers.{{ group }}.commands %}
Cmnd_Alias {{ item.alias }} = {{ item.path }}
{% endfor %}
%{{ group }} ALL=(ALL) NOPASSWD: {{ sudoers.{{ group }}.commands | map(attribute='alias') | join(', ') }}

It is not safe to use /usr/bin/less

In all this you did not notice much important thing and that is the use of less as viewer. Sadly that is a security hole. You can type '!bash' for invoking bash. And by pressing 'v' you get into editor based on VISUAL, EDITOR or LESSEDIT variables. So you can give them '/bin/cat' and they can always pipe the content into less themselves. Note this is still a security hole as some files in unix are very intentionally restricted for example:

/etc/shadow
/etc/sudoers
/etc/ssh/ssh_host_rsa_key
$HOME/.ssh/id_rsa


Workplace viewport scripting Working with DevOps toolchains requires switching contexts between code, dashboards and command line terminals (local and remote). That is just for one project - and many of us work in more than one.

To reduce switching and navigating, folks and me too use more and more monitors - 4K (UHD) is a welcomed technology.

Say altogether, a set of windows and terminals for a context is a DevOps viewport (or maybe there is a better word).

Now, what are - if any - convenient means to "script" windows/terminals configurations as a CasC (Configuration as Code) artefact so you could easily load and switch your CI/CD environment viewports?

Windows 10 environment?
Ubuntu Linux environent?

There are tools around the web for saving desktops. Still best solution I found out to be running a set of virtual machines on your computer, having one setup in one vm.

That takes some space, but you can save the state of vm upon vm shut down and come back to exactly same state when you come back. Maybe sessions have died but the windows certainly are as you left them.

Solution is stated on http://www.makeuseof.com/tag/save-restore-windows-session/ and it is for windows but I suppose the same will apply for Linux vm too.


Upgrading jenkins using chef Can you please help me out how to upgrade an existing application which is jenkins using chef. I am trying to upgrade Jenkins from 1.x to 2.x and I have a cookbook for 1.x. what steps do I need to take to upgrade 1.x version to 2.x along with plugins. Environment: Rhel and using rpm package to install jenkins

So first of all, Chef is just a manner of upgrading/configuring, it will help you keep a reproducible state and keeping configuration in line but it won't do black magic and translate your jobs for you.

Now for Jenkins 1 to Jenkins 2, Jenkins-ci site says Jenkins 2 is Backward Compatible.
While this is true, when you update the pipeline plugin, not all plugins are compatible yet. There's a compatibility list on the pipeline plugin github page.

I would recommend installing a fresh Jenkins 2 and porting your jobs from Jenkins 1 to Jenkins 2. This will spot breaking plugins in Jenkins 2, allow you to strip up not needed anymore plugins and refactor your jobs.
This way you can also take advantage of defining the pipelines with a Jenkinsfile along with the code of your application.


How do I enable Google App Engine API with Terraform? I'm attempting to enable the AppEngine service via Terraform but I'm getting an error:
Error: Error creating App Engine application: googleapi: Error 403: App Engine Admin API has not been used in project <redacted> before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/appengine.googleapis.com/overview?project=<redacted> then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry., accessNotConfigured

As far as I know all that should be required to enable the service/API is:
// Enable AppEngine API - required to automagically create datastore
resource "google_project_service" "appengine_api" {
  project = var.project
  service = "appengine.googleapis.com"

  disable_dependent_services = true
}

The terraform service account was located in a separate project and the API needed to be enabled for appengine in the account the Terraform service account runs in even though it was creating a resource in an another project.


Is there something like Jenkins pipeline scripts for Bamboo? In Jenkins I setup my tasks using groovy pipline scripts stored in git or subversion.

This way I only need to setup the input of the required parameters.
The processing (additional checkouts, installation, builds, tests and other ansible tasks) are defined in the pipline script.

My question is: Is there a way to do somtehing similar with bamboo?

I don't think Bamboo has that natively but there are plugins such as this one:  (https://marketplace.atlassian.com/plugins/com.cobalt.cdpipeline.cdpipeline/server/overview).

Atlassian also has a different product called Bitbucket pipeline (https://bitbucket.org/product/features/pipelines) that may be more similar to what you want but it's more of a CircleCI type of Pipeline.


Jenkins Select unique parameter with multiple values Hello I want the following behaviour.
A want my job to be parametrized. The thing is that I want to select a unique parameter with multiple values.
I have a unique parameter named number with 2 options (1, 2) and then set of values linked to each option:

Parameter name: var
Options:
1
2

Let´s say:

One set of values:

value1: "1.0.0"
value2: "myname"
value3:"build/libs"

Another set of values:

value1: "2.0.0"
value2: "myname2"
value3: "var/lib"

In the "Build section" I select "Execute shell" with the following lines:
echo ${var.value1}
echo ${var.value2}
echo ${var.value3}

So when building the job I would like to select from a dropdown list with 2 values as said above: 1 and 2.
If I select 1, I would like to take the first set of values so that it would dislplay:
1.0.0
myname
build/libs

On the other hand if I select 2, I would like to display the second set of values:
2.0.0
myname2
var/lib

I have tried "Extended Choice Parameter plugin" but I don´t know how to manage this situation.
Thank you.

My suggestion is to set job parameterized with two options, and just set up variables in the Shell Build step, like this:

if [ "$VAR" == "1" ]; then
    value1="1.0.0"
    value2="myname"
    value3="build/libs"
elif [ "$VAR" == "2" ]; then
    value1="2.0.0"
    value2="myname2"
    value3="var/lib"
fi

echo ${var.value1}
echo ${var.value2}
echo ${var.value3}


Does Ansible have component akin to PuppetDB? I know Puppet from (limited) experience and have noticed that in configuration management there is now a strong trend towards Ansible.

On the one hand, I understand that Ansible does not require an agent, because it makes intelligent use of ssh.

On the other hand, these are features have come to like about Puppet:

access to system-wide configuration state and history (PuppetDB) via REST API
ability to keep backups of overwritten files (filebuckets)
ability to encrypt part of the Hiera configurations (.eyaml)

Among these, PuppetDB seems to me the most important and useful (e.g. for integration with other tools). Therefore my question is this: Does Ansible have something akin to PuppetDB, i.e. a component that offers an API where it could e.g. be asked "What packages are installed on host x?" or "On which hosts is package y installed?"

(This question was migrated over from StackOverflow).

UPDATE Significant downside of Puppet it my experience so far: Not so much the fact that it requires an agent (from what I have seen, Ansible's use of Python also introduces an agent of sorts in the form of a Python interpreter ;-), but that it wants its agent to act as root only and always.

The direct answer is "no".

Ansible does not have any database, because it is supposed to be run by different operators from different computers and it's purpose is to be sure that target systems are in the exact state, as specified in playbooks.

There's an option to attach external facts cache backends to Ansible. So you can setup redis as your cache, Ansible will populate it with gathered facts during playbook run and you can later query redis for them. But it is very limited solution, because there are not too much facts gathered by Ansible, for example there are no information about installed packages – you will have to gather them yourself an use set_fact with cacheable option to put them into external cache.


What are formal criteria for establishing declarative pipelines, or pipelines as a code? Stepping from "crafted" DevOps toolchains to declarative pipelines is imo next transformation step towards even more productivity which requires additional effort.

Any experiences what can be the "critical mass" where this investment is a clear pay-off and not an overkill?

Pipeline as Code (PaC) means that the CI/CD configuration will be stored in the VCS instead of in the CI/CD tool itself, e.g. configuring it manually by using a UI.

  Any experiences what can be the "critical mass" where this investment
  is a clear pay-off and not an overkill?

Imagine that more than 100 jobs have been configured manually the last couple of years and one would like to transform all these jobs to PaC then it would mean that less resources will be available to create new features and therefor not advisable, but if one would create tasks to address this and transform a manual job to a PaC one every sprint then it could be beneficial in the long run.

Advantages of PaC

No endless searching for configuration anymore

One advantage is that one does not have to look in various places, e.g. CI/CD tool, documentation how a CI/CD job has been configured as the relevant stuff resides in the same place as the code, i.e. VCS.

No endless and unnecessary debugging anymore

Another advantage is that someone cannot break the CI/CD job easily like it is possible when it is configured using a UI. If for example someone has to change the CI/CD could then one has to change the code in the VCS. As every code change could be tracked, it will be immediately clear who changed the pipeline and what was changed when a pipeline is broken.


How to execute a Jenkins job until the build is green We have got test automation in Jenkins, and we would like to execute it at midnight.

But sometimes it fails, and sometimes it passes. Our idea is to execute the daily builds from 1:00 AM until it is green. How we can execute a job until it is green?

For example:

Execute job at 1:00
Execute job at 2:00 if the previous is green, etc.

We can run it hourly, but how is it possible to insert the condition?

This pipeline will run each day at 1 AM. It'll restart if the build fails.

pipeline {
    agent any

    triggers {
        cron('0 1 * * *')
    }

    stages {
        stage ('Build') {
            when {
                expression {
                    // When last build has failed
                    !hudson.model.Result.SUCCESS.equals(currentBuild.rawBuild.getPreviousBuild()?.getResult()) == true
                }
            }

            steps {
                sh "./myjob.sh"
            }

            post {
                failure {
                    // If the current job has failed, trigger it without
                    // waiting.
                    build job: "${JOB_NAME}", wait: false
                }
            }
        }
    }
}

If you want to wait before to re-trigger the job, you can add the option quietPeriod: (seconds) to the build step (https://jenkins.io/doc/pipeline/steps/pipeline-build-step/).

You might have to add these methods to the scriptApproval:


vagrant on windows 10 incorrect network configuration on multi-machine setup I have a problem with vagrant that is running on windows 10 when I deploy centos 8 machines all the machines have eth0 with the same Ip and they cannot communicate with each other

the ip 10.0.2.15 is always present. this is the vagrant file:

Vagrant.configure("2") do |config|
  # The most common configuration options are documented and commented below.
  # For a complete reference, please see the online documentation at
  # https://docs.vagrantup.com.

  # Every Vagrant development environment requires a box. You can search for
  # boxes at https://vagrantcloud.com/search.
  config.vm.define "ansible" do |ansible|
    ansible.vm.box = "bento/centos-8.1"
    ansible.vm.hostname = "ansible"
    ansible.vm.network "private_network", ip: "10.0.2.10"
  end

  config.vm.define "ldap" do |ldap|
    ldap.vm.box = "bento/centos-8.1"
    ldap.vm.hostname = "ldap"
    ldap.vm.network "private_network", ip: "10.0.2.100"
  end

and this is the ip configuration on the first machine;

[vagrant@ansible ~]$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:72:fe:6e brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute eth0
       valid_lft 86077sec preferred_lft 86077sec
    inet6 fe80::5054:ff:fe72:fe6e/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:91:b2:04 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.10/24 brd 10.0.2.255 scope global noprefixroute eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fe91:b204/64 scope link
       valid_lft forever preferred_lft forever

[vagrant@ansible ~]$ ip route show
default via 10.0.2.2 dev eth0 proto dhcp metric 100
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 metric 100
10.0.2.0/24 dev eth1 proto kernel scope link src 10.0.2.10 metric 101

is it getting eth0 by dhcp? and then assigning the ip i want to eth1? is there something i can do with virtualbox configuration on windows?

i need both machines to see each other

eth0 is used by vagrant for nat configuration in order to establish portforwarding. eth1 private networks that you have configured should allow you to ping/nslookup from one node to another. You can use the following to customize the ip of the nat but I don't see why would you do that:

config.vm.provider "virtualbox" do |vbx|
  vbx.customize ['modifyvm', :id, '--natnet1', '192.168.169.0/24']
end

Update: tested your setup it doesn't work, this is some CentOS 8 specifics.


mysqld: [ERROR] Found option without preceding group in config file /root/.my.cnf at line 1! I'm trying to create a .my.cnf file for my MySQL docker-container that would allow me to prefill the user and password for the MySQL client. To achieve this I created the following dockerfile:
FROM mysql:5.7
RUN touch ~/.my.cnf && echo -e "[client]\nuser=root\npassword=$(echo $MYSQL_ROOT_PASSWORD)" >> ~/.my.cnf

But when starting the container I always get the errors:
mysql5.7-database    | 2021-04-01 18:38:51+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 5.7.33-1debian10 started.
mysql5.7-database    | 2021-04-01 18:38:51+00:00 [ERROR] [Entrypoint]: mysqld failed while attempting to check config
mysql5.7-database    |  command was: mysqld --verbose --help --log-bin-index=/tmp/tmp.5imGsNRXXC
mysql5.7-database    |  mysqld: [ERROR] Found option without preceding group in config file /root/.my.cnf at line 1!
mysql5.7-database    | mysqld: [ERROR] Fatal error in defaults handling. Program aborted!

The environment variable $MYSQL_ROOT_PASSWORD is successfully set with the correct password.
I can login with the password in the $MYSQL_ROOT_PASSWORD

The result of echo -e "[client]\nuser=root\npassword=$(echo $MYSQL_ROOT_PASSWORD)" is:
[client]
user=root
password=<my-generated-password>

When I create the .my.cnf file manually in the running docker container, it works like a charm. Any advise?

The default Dockerfile shell is sh. I don't think echo there has the -e modifier for backslash. Newline & other special symbols will work by default. In your command, resulting .my.cnf would contain a litteral -e.
Remove -e or use the original command in Dockerfile in a different shell, for instance:
RUN /bin/bash -c '<your-command>'


How to schedule a Jenkins Job dynamically based on the time value in database I have a situation where there is a database in which a table consists of scheduled time to build. This schedule time to build may vary from day to day. Say for example,

Today the entry in db is 09/01/2020 5:00 PM
Tomorrow the entry can be 10/01/2020 4:00 PM

So, based on the above table, I need to schedule a Jenkins job today at 5:00 PM and tomorrow at 4:00 PM Is there any possibility in Jenkins to configure the build based on the above table entries.

Thanks in advance

Jenkins itself isn't very good at using external data sources to drive dynamic job scheduling.  The reason for this is that job configuration, including scheduling, is built statically, either manually via the web UI, or with code via a Pipeline script which is run at job execution time.  Even if the Pipeline script builds the job configuration in a dynamic way, the configuration itself will be locked in until the next job execution.

The easiest way to have flexible build schedules is use an external source to drive your builds.  The hook mentioned in the comments would be ideal, but it sounds like that is not possible for you.  Another idea would be to have a cron job on your database server that runs once a day, grabs the build time from the database, and schedules the build for that time.  I'm sure this isn't a great solution, but it's just an example.


Active directory integration issue with Jenkins The active Directory login is not working for us on DMZ server since the request is going to multiple domain controllers servers (which cause us slowness in login- almost 10 minutes). how can we limit it to only one DC server?

Jenkins version: 2.176.1

We had to mention the specific DC on the Site field


How can I use bash functions in makefile? If I need to use something like NVM in my makefile, I run into a problem, because NVM exports some bash functions that are not available in Make, even if my shell is defined as bash in the makefile.
How do I cause make to "inherit" all the parent shell's functions? Is there a way to make NVM accessible to a makefile, without writing export -f for a zillion little NVM bash functions?

One possible issue is that the NVM install script only writes the commands to set itself up to either .bash_profile OR .bashrc. Depending on your systems configuration, it may only be setup for interactive shells, not ones spawned by other programs (more info). Sourcing the nvm setup script can be a good option, as a previous comment noted. If you have a number of commands to run for 1 make target, look into .ONESHELL. Sourcing $NVM_DIR/nvm.sh should take care of it.
Another option that invokes bash directly with the interactive flag might work as well.


Is JS an reasonable choice for a DevOps internal tool (i.e. cloud-formation runner, scripts)? I'm working on a project to move our current stack from a mix of half-manual, half-undocumented, half-ansible into a solid code-defined architecture on AWS. Our plan is to use AWS CloudFormation heavily and off-load the following tasks to an internal tool:

Pipelining (running CFs / scripts in order)
Scripting tasks (that cannot be accomplished through CloudFormation)
Templating (if/as necessary)
Internal Validation

This tool would be expected to build our entire environment more or less from scratch (bar a few things which can't be automated).

Our product (at least on the backend) is built entirely in Javascript, and while it isn't my first language of choice I'm leaning towards writing this tool in Javascript. My other option would be Python as I favor that language more. However I see major value in being able to stick with a single language (libraries, tooling, paradigms, etc.)

Is JS an acceptable solution for this type of tool?
Would it raise major eyebrows if we were to bring on a DevOps Engineer in the future?
Is it unusual to use JS in the DevOps community?

We already leverage JS (via https://serverless.com/) for some of our automation.

Definitely. Especially when using AWS services, the aws-sdk for JavaScript is superb.

Writing code using JavaScript in a shop that has both frontend people writing JS in some framework (Angular/React/Vue/...) and backend people using Node.js removes barriers. Just pushing to use JS provides the org. with even more developers who don't have barriers to reading and fixing infrastructure code.

For example, I am quite proficient in using Python, Ruby, Shell, JavaScript (even Perl). But when it comes to fixing or adding something to HashiCorp's tools like Terraform, I just don't have the time to learn Go sufficiently enough - so I don't do it. If a tool like Terraform was written using JavaScript, I would have added my contribution for that missing service a long time ago.

JavaScript support is excellent in AWS Lambda as well, and that is quite a big
deal. For example, one of the ways to make CloudFormation do things you never thought it could is to write an AWS::CloudFormation::CustomResource implemented in a Lambda function.

Another good example is streaming CloudWatch Logs into ElasticSearch. If you ever try to press that button you discover that AWS just creates a JavaScript function for you in Lambda.

JavaScript is everywhere in DevOps and AWS, doing the same thing with Java, or C# or even Go would take much more time.

Should you bring a "DevOps Engineer" in the future (please don't), and that person does not know JavaScript while all your code is the backend and frontend is in JavaScript then simply don't hire such a person. It is a bad fit for both you and them.


AWS ECS Fargate, auto scaling and load balancer For a ECS service with launch type "fargate", it is possible to configure a load balancer and auto scaling. I don`t understand, how those two types of scaling work in this case, and how they work together.
My example
I define a task, and set the task size to "0.25 vCPU". I then configure the service to use a load balancer, and auto scaling. I set the auto scaling to a maximum number of 4 tasks.
My questions

I would expect, that the task is executed with 0.25 vCPU. When the task runs out of CPU, it starts another one, which uses another 0.25 vCPU. This is done until the maximum number of tasks is reached, this means a use and costs of 1vCPU in my example. Is this expectation correct?
What is the role of the load balancer? As I understand it, it is just needed for routing and https certfificate. Or does it play a role at scaling, too?
When I want to scale container based, then I need an own task definition for every container, right? And an own load balancer for every service? Is it possible to use one load balancer for multiple services?

In which AWS docs I can read about those topics?

Load balancing will route the requests across tasks while autoscaling will increase or decrease the number of tasks based on the traffic.
starting new tasks when cpu threshold exceed is autoscaling, this can be setup with cloudwatch events.
you can load balance services based on rules and then route them to target groups. read here


use different kubectl configs in different terminal sessions If I run kubectl get svc, it seems to be the same across terminal sessions - how can use a local configuration that's only loaded for my current terminal session?

If the answer is a local config file and using KUBECONFIG env var to point to it, then how can I generate a local config file? If I use:

export KUBECONFIG=`dirname "$BASH_SOURCE"/conf`
aws eks update-kubeconfig --profile=alex --name ignitecluster

I get this error:

  Content not a dictionary.

Set the KUBECONFIG environment variable with a value that includes the relevant Kubernetes configuration file, the environment variable only applies to your current session/window.


Has `docker-compose` to be phased out in favor of `docker stack`? According to the August 2017 article the core functionalities of docker-compose were integrated into the new docker stack command. At the end of the article, the author also assumes docker-compose will soon to be deprecated. The docker stack deploy documentation is currently pretty sparse.

The article is six months old now. So, is docker stack the way to go, or is there still some advantage in using docker-compose today? Especially, I will soon introduce Docker to students. Is it worth spending time studying with them details of docker-compose or should I just jump to docker stack?

There are a few features of docker-compose that are not implemented in docker stack deploy and vice versa.

With docker-compose, you can run privileged containers and change capabilities which is not supported with swarm services yet. You can also run a container that is designed to exit, e.g. a batch job, more intuitively in docker-compose than in swarm mode. If your containers are designed for sysadmin tasks, this may make more sense.

With docker stack deploy, you get access to secrets and configs, along with replication settings, configuration of rolling updates, ingress networking with the routing mesh, and various other swarm mode features. If your containers are designed for highly available microservices, this makes more sense.

Both of these use the same docker-compose.yml definition file (with version 3 required for swarm mode). That makes moving between the two fairly easy. There are also projects like compose-on-kubernetes and kompose that make the transition to kubernetes with the same stack definitions easy.


EKS node cannot pull docker image from ECR: "no basic auth credentials" Using the eksctl tool, I created an EKS cluster with 5 nodes. My application's docker images are stored in ECR registries in the same region. I deployed my kubernetes cluster and everything has been happy for the past 6 weeks or so.

This morning, I came in and found 3 pods were in an ErrImagePull state. Using kubectl describe pod <pod name>, I found the error:

Failed to pull image "<ECR REGISTRY>/<IMAGE>": rpc error: code = Unknown desc = Error response from daemon: Get <ECR REGISTRY>/<IMAGE>: no basic auth credentials

My understanding of EKS and ECR is that I don't need a pull secret (and I haven't used one for any of the other running pods) so my guess is that some process or docker image on that node died but I can't find any docs on this.

Update: I forgot all about this question. When I created the original node group, I failed to include the --ssh-access flag which prevented me from getting onto the node and see if a kubernetes process had failed. I never found the actual solution; I simply added a taint to the problem node, created a new node, and went about my business. I'm still trying to find time to spin up a new node group with ssh access.

Do your IAM roles that are attached to EC2 instances that are in EKS cluster have ECR iam policies?
If not please update IAM roles
Ref Link:
https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_on_EKS.html#:~:targetText=The%20Amazon%20EKS%20worker%20node,policy%20permissions%20for%20Amazon%20ECR.&targetText=When%20referencing%20an%20image%20from,tag%20naming%20for%20the%20image.


Storage gateway reset cache I have a problem in the storage gateway: the cache volume is full. When we look at the operating system there is still space available on that volume.

Based on the referenced aws model, only the files accessed regularly should be kept in the cache, but apparently it is keeping all the files, thus filling the cache and causing the requests of the users and applications to be made directly in aws. This causes slowness: it takes 2 minutes to open a 2 MB pdf file.

Our local storage is very large (4TB volume) and it is full, in addition to other smaller volumes that are also almost full.

How can I check if it is actually retaining only the recently used files or if it is retaining all the files?

And how could I perform the cache cleaning and start a new storage cycle in a safe way in order to avoid increasing the cache?

After much tryings, i was look for problem with implementation of solution and reads documentation of resource, and to my surprise that requirements are not attends.Só i   change that configurations mistakes and the storage gateway is flying.

The misconfiguration was about requirements, the minimo indicated by AWS is 16GB of memory, and at least 20% local storage used to cache  all data used loaded to AWS storage.


Ansible temp dir change Ansible version 2.9.2

Is it possible to change ansible temp dir for one playbook only?
I have VMs with r/o root. So, the playbook fails.
Even if I run my playbook under root user on target VM it can't create ansible temp files that it creates in current user's home dir on target VM.
I know that I can change it in ansible.cfg file, but I need it only for one VM type.

I need to make changes to other not r/o drives.

Q: "Is it possible to change ansible temp dir for one playbook only? I have VMs with r/o root."

A: Yes. It's possible. Configure the variable ansible_remote_tmp.
In some cases, a better solution to this problem is ANSIBLE_PIPELINING. Quoting from Risks and limitations of become:

Use pipelining. When pipelining is enabled, Ansible does not save the module to a temporary file on the client. Instead, it pipes the module to the remote python interpreter’s stdin. Pipelining does not work for python modules involving file transfer (for example: copy, fetch, template), or for non-python modules.

Notes:

Quoting from Release notes:

The ANSIBLE_REMOTE_TMP environment variable has been added to supplement (and override) ANSIBLE_REMOTE_TEMP. This matches the spelling of the config value. ANSIBLE_REMOTE_TEMP will be deprecated in the future.

remote_tmp is not among configuration options in Ansible Configuration Settings

See remote_tmp parameter of the sh plugin.

There are open bugs mostly with Windows


How do I get Azure Release Pipelines to move a .jar from a Build Pipeline job and place it on a Linux VM? I know Azure release pipelines can deploy to on-premise servers and other cloud VMs.  My pom.xml file enables Maven to create a .jar file.  My Azure build uses this pom.xml file.  The Azure build works fine by itself; there are no errors when it runs.  I want to place the .jar file on to a Linux server via either the same Azure build pipeline job or a different Azure Release Pipeline.  How do I do this?

I've looked at documentation.  When I changed the build with a pathToPublish: stanza in my Azure build job, the job completes, but there is a warning:

  [warning]Directory '/home/vsts/work/1/a' is empty. Nothing will be added to build artifact 'MyBuildOutputs'.

I don't see how "publishWebProjects" would be relevant.  Nothing I am doing is relevant to the web.

When I try to create a new and separate release pipeline in Azure (that will hopefully include the same build pipeline job), the different stages that I choose from never involve deploying to a VM.  Plus none of the options are obvious to me as to how to configure a source (i.e., to use the .jar file from the previous step a build job).  Maybe the source defaults to the Artifact thus created by the Maven build job that I configured.  In the Pipeline job I configured a Git repo as an Artifact, but I am not 100% sure Azure knows I want the .jar file that it can produce with Maven to be the artifact to be deployed as the source of the pipeline job itself.  Which Template, in the Pipeline options for a given stage, do I choose as the stage in a new release pipeline to move a .jar file to a Linux server?

You have two basic scenarios:

you have an Azure Pipelines agent running on the target machine
you have an SSH connection to the target machine

In the first case you just cp the file to the target location (given that the user running the agent has adequate permissions).
In the second case, you use a task like Copy Files Over SSH task to copy the file. For this latter you have to setup an SSH service connection in advance.


How to raise awareness about the security risk involved with running Docker? I'm in the process of preparing a Docker course for students with little to no familiarities with containers, the underlying OS mechanisms involved, and their implied limitations.

In many Docker tutorials, security concerns often go unmentioned. And it is easy to assume there are not much security issues involved by running containerized application on a general purpose system.

On my side, I would raise students awareness about these issues early as part of my course. It is not necessarily about teaching them how to mitigate these issues. But really about dismantle that misconception Docker is secure by default. Unfortunately, I could not afford spending to much curriculum time on these aspects.

So, I'm looking for tools and/or examples that could be easily run and understood by my students so they get an idea of the possible security implications of using Docker. What would you suggest?

For what it worth, I initially thought about:

rooting a Docker host -- which seems a good example
and running Docker Bench. But from that answer, Docker Bench is probably not the best tool for my particular needs.

A tool that I think is rather under recognised is s2i. The basic idea is that you don’t put a Dockerfile into your source repo specifying the runtime to use you keep your app code bare (just code). The decision as to which security patched s2i image to compile and run the code with is a separate matter that is independent and can be centrally managed.

The way this is used in the OKD world is that a “BuildConfig” pulls your code from git to make an application image and is trigger by either a git webook or a docker registry push that updated the s2i image with a security patch.

In our case we have many node and php apps. To security patch either runtime we push the latest s2i image into our OKD docker registry and that causes all our application images to be recreated and redeployed.

Why I think that is of interest is that it basically says that what the code is, and how the code is run from a container security perspective, should not be conflated. They are two concerns that are not on the same cadence. A high impact vulnerability should be patched in the main test environment immediately and not be dependent on talking to several scrum teams about pushing a change to the Dockerfile in each team’s git repo.

When you have many apps or many small dev teams that separation to do “policy based security patching” of containers can be very useful. You can run s2i on your desktop or with container based SaaS ci tool such as circleci. It would be straightforward to run it in, say, Jenkins. That means you can have, say, dozens of micro service Jenkins deploy jobs triggered by git webook that run s2i and push the final image. You can then control the version of the s2i image you use in all the Jenkins jobs in one place. You can then script a security update that updates the s2i docker url to the latest security fix and triggers all Jenkins release jobs to run to apply the patched s2i to all microservices. No code or config needs to change in any git repo.

While I mention OKD by default it doesn’t let you run a container image as uid 0 (root). It uses a random uid and gid 0. This is for security in case the process gets out of its jail and tries to modify the host. Most public docker images just expect you run as root and file permission don’t let you run the app in the image as an arbitrary uid as docker —user ${rand_uid}:0. You have to bake an image that gives gid 0 the file permissions to run the app. The s2i images all work under these circumstances.

If you need apps in docker to lookup the use details in /etc/passwd when running as a random uid the you can fake that. Here is a script that runs git in docker as random uid where git wants to lookup the current in /etc/passwd so the script fakes it.

The lesson here IMHO is that while in theory docker gives perfect isolation in practice all code is subject to security flaws. In theory many small dev teams will update all Dockerfiles immediately or very frequently but in practice dev teams are focused on features not long term security patching. (I work with one microservies platform that currently has >200 git repos and dev teams on three continents so coordinating anything is a challenge.) So security should be “defence in depth” and take concrete steps to do centralised patching of container images, not run containers as root, and use a random uid that isn’t in the host /etc/passwd so cannot read or write outside of its jail.


How to model Man, Machine, Measures, and Process in a DevOps world? In The Phoenix Project when on one of the tours of the plant we're told that each workstation is a combination of Person, Machine, Measurement, and Process. This makes a lot of sense, after all we have people, servers, KPIs, and instructions.

However, whenever I model a process (the lifecycle of a Support Ticket for example) I struggle to take this into account.

My workflow states typically include:

First Line Assistance
Tech/Dev/More Technical Team Assistance
Code Review
Testing
UAT
Deployment

I can quite easily measure the cycle types, throughputs, and queue times of each of these states but I don't feel this does justice to the Man, Machine, Method concept. It's an idea which is frustratingly hinted at in the book but not expanded on...

We know that wait time is a function of utilisation so monitoring how busy people and servers (the finite resources) are is critical. Is there any defined process for expanding my measurements from a simple finite state machine to the Man, Machine, Method, Process idea in the book?

What they are talking about is Kaizen 5M (Man, Machine, Material, Method, Measurement). It is approach to continuous improvement at every station in the process and the Ms are possible points of improvement and to which there is a corresponding question (5Qs). Sometimes Environment is added for 6th, like in this process that explains how to construct the questions using the Ishikawa diagram. These are pretty much essentials of the TPS / Lean Manufacturing. But the improvements are not in utilization, they are improvements in quality. You never strive for utilization as that is counterproductive to the throughput of the system.

It is important to understand that Man, Machine, Material, Method and Measurement are not easily separated. Sometimes Machine, Material and Measurement come on one side together and Man and Method on the other side. As you can replace a Man and a Method on that work station.

In terms of software development, you have Software (Machine), Issues (Material), Code Quality/Acceptance (Measurement), Man (Programmer) and Method (Development Process). The man trains on the machine and becomes familiar with it, with the material being worked on, understands the measurement required, learns the process. All those are living in the Man's brain and so are not easily separated once learned. Changing a Method is only possible if the Man has not fully internalized it yet, otherwise it gets easier to change Man and Method. Also Machine, Material and Measurement are often tied together through automation and configuration. That is why those are being drawn on opposite sides of the diagram.

If you read the book carefully, it does not really talk about utilization other than on the bottleneck of a value chain. In order to elevate and exploit the bottleneck. Several methods are employed for that in the book, including Kanban.

You don't want to optimize the individual stations of your process (Customer->Support->Development->Review->Testing->User Acceptance->Deployment->Customer), but you need to model the transitions between those work stations, their dependencies and to monitor Work In Process (WIP) moving through the system. Usually through an Issue Tracking Software (or Kanban system), which is equivalent to materials tracking in manufacturing. Where the WIP piles up in front of the work station in your critical chain process, you will find your bottleneck and that is the place where you want to optimize using Kaizan (5Ms,5Qs)

Notice: I've added Customer both at the start and the end of your process, as each value chain has to start and end with a Customer otherwise it does not represent value to the company.


Tool for storing per environment configuration I have a requirement to store configuration information on a per environment basis in a tool.

This is a tool with a GUI for adding/updating configuration values (e.g connection strings). This should have a default value and be able to change this based on different environments.

There should be an API to retrieve these configuration values during deployment to a particular environment to add to the application.

I have searched for a while and can't see any tools that would fit this bill. Are there any suggestions?

Note: Currently the settings are in TeamCity variables and deployment is via PowerShell scripts.

There are many tools that can do something like this, including configuration management tools like Chef, Ansible, or Puppet; and KVS tools like Consul and etcd. You could also integrate it as a build step in your CI server, or sidestep the issue using live configuration at runtime against an external configuration store (again, something like Consul or etcd, or any database at all).


CI/CD pipelines Azure devops automatic merge after deploy release I have a classic env. setup like following:

I have 2 branches : Develop and Master.

Is there any way in azure devops to setup the following rule:

When a deploy is succeeded on dev environment (defined in the
release pipeline of azure devops) ------> create automatically a pull request to merge develop into Master.
or the other one: if a Build of develop branch is succeded ------->
    create automatically a pull request to merge develop into Master.

Any help will be appreciated.

I would look into Azure Functions. Create a gate trigger and enable azure function after a successful release.

References:
https://docs.microsoft.com/en-us/azure/devops/repos/git/create-pr-status-server-with-azure-functions?view=azure-devops


Is it ok to logout after calling docker stack deploy? If I immediately terminate the process that called docker stack deploy will the docker swarm continue?

My use case is this:

In my CI job I ssh into my swarm cluster node.
I copy the new stack.yml file and issue
docker stack deploy -c stack.yml stack
Since this immediately returns, my CI job disconnects from ssh.

My question is whether this can lead to some unforeseen side-effects? Is my deploy being terminated midway? Or will docker swarm be smart enough to keep going on its own.

Thanks

It is safe. As soon as docker returns it is safe to logout/leave the shell.

The issue was that Docker 18.06.0-ce broke docker stack deploy. Reverting to 18.03.1 (specifically 18.03.1~ce-0~ubuntu) made it work.


VSTS Azure for DevOps: Unit test checking mechanism on pull request Is there a way in VSTS Azure for DevOps to implement unit test checking mechanism on pull request.

The condition is to only allow commits that change something in the unittest folder for example.

Notes:

we are using GoCD as a CI/CD system so it's external building.
Git is internal hosted within VSTS.

If you have the option, Github offers Actions which allow you to run workflows on different events - one of them being push.

If Github is not an option, I would recommend creating a build where deployment of the artifacts only happens if the build is done on master.

On your feature branches, on checkin, a build will happen which will pull the latest code, compile, and then run unit tests, security scanning, and code coverage (if applicable). Since this is a feature branch, the build ends there.

If it is on master, it then performs the steps to package/deploy the artifacts.

In Branches > Master > Branch Policies (in the ellipses menu), add a Build Validation.

I recommend marking it required.

If you aren't worried about merge conflicts causing a rebuild, you can make it expire immediately upon master changing (requiring a rebuild, which will fail on merge conflicts).

If you are a large team where you might frequently step on one another, you can make it never expire and leave it up to the developer to fix manually before they are able to merge.


Issue with cloudformation in target groups and ASG I am trying to use cloudformation to setup a ASG and I have a target group which I would like to associate with the ASG. The target group is created okay but when I go to attach it to the ASG I get an error message. I'd like to be able to attach this as I want a ALB in front of the ASG

As the error message states, TargetGroupARNs value should be of type List. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-as-group.html#cfn-as-group-targetgrouparns


How to populate docker volumes in a build step to be used by a different container I currently have a Docker compose based web app that uses Nginx as a reverse proxy that forwards traffic to a Flask and Grafana docker instance. The task at hand is to integrate a SSG (static site generator) such as Jekyll into the setup.

The most straight forward approach is to:

have a Jekyll container continually run and serve the static aspect of the site via Nginx redirects (jekyll serve).
Another approach would be to run the build command in the Jekyll docker image and have the output be shared via docker volumes with Nginx.
Yet another is to generate the site in the Nginx container

The downside with the first two solutions is that they create a Jekyll docker instance that is only used once and then persists. In 1.'s case, the serving can be directly handled by Nginx. In 3.'s case, there is no separation between Jekyll and Nginx. This would be useful since Nginx is also responsible for routing traffic to the other Docker instances.

The question is, is there a way to populate a Docker volume with a Dockerfile by Jekyll so that this can then be mounted by Nginx? Step by step:

docker-compose build: build the site and populate the static-site volume
docker-compose up -d: Nginx mounts the static-site volume and serves it

Does this approach even make sense?

docker-compose is just a glorified wrapper around docker which gives you a nice textual representation of all the options you would regularly give to docker build or docker run. Plus, of course, it bundles several docker images/containers together. That said, it has no provisions to run anything else than you would get by calling docker.

I don't see how you would use docker-compose build to populate a volume. Volumes are, by definition, not living inside docker images/containers, but outside (on the host system). docker build never writes to the host system, and you cannot mount volumes during docker build. docker-compose build basically only runs docker build for you, and also has no way to run or write anything on the host.

So, no, docker-compose build will not be able to create the static files.

You could make your compose file so that it runs your generator (inside a docker container, writing to a named volume), and runs your server (nginx or whatever) in another container, mounting the same named volume (this would be your case 2, I believe). Then, with docker-compose up, it would fire up both those containers. The first one would populate your static files; the second would serve. The first would hang around and do nothing afterwards, which you could just ignore, but which would certainly be ugly. Unfortunately, you cannot use something like docker-compose up --rm to automatically the unneccessary jekyll container.

So, your best bet is to start the jekyll container yourself (docker run --rm jekyll:xyz -v ...:...), the --rm will remove the container after it is finished. Then docker-compose up with the actual server(s).


Possibility of container breakout compared to VM (virtual machines) What is exactly the (higher) vulnerability at least theoretically of a container compared to VM? given, all security recommendations are implemented (like, user context is root, no host sensitive volumes are mounted, tuned capabilities..).

How differently can an exploit compromise a container via network interface other than a VM? Could a "bad" TCP package force Docker daemon to create a container with root rights?

Containers isolate an application on a shared OS, VM's isolate an OS on shared hardware. With those different levels of abstraction, you have different exploits and protections.

A successful kernel level exploit on a container will affect the shared kernel, and therefore breakout of the container isolation. Think meltdown and spectre.

A successful VM driver exploit could break out of the VM to the hypervisor running the VM's. I've heard of exploits on things like the floppy driver in VMs. These are much more rare than kernel exploits, so I'd give the advantage to VM's here.

It is possible to change the container runtime to spin up containers in small VM's. Projects like Kata Containers are working on this. So you could get the security of VM's while still getting some of the features of containers.

Containers do have a huge different advantage over VM's. They run in a minimal environment with reduced capabilities, seccomp, and optionally selinux/apparmor configured. You can lock down that environment in ways you couldn't easily lock down a VM, with a read-only filesystem, and not including any of the tools like shells, interpreters, and libraries that an attacker may need to exploit your system to try attacking the kernel or horizontally pivot their attack.

As a result, there's no clear winner. The best answer is likely a combination of both, running a handful of containers with similar security requirements on their own VM.