How do I use the remote-exec provisioner with Terraform? I am using Terraform 0.14 and AWS.  I am trying to write a .tf file that will invoke a remote-exec command via Terraform's provisioner.
This code does not work:
resource "aws_instance" "example" {
  ami           = "ami-1234"
  instance_type = "t2.large"
  key_name      = "foobar"
  user_data     = local.cloud_config_config

  provisioner "remote-exec" {
    inline = ["sudo yum -y install coolprogram"]
  }
}

The above will create the EC-2 instance.  But it won't run the inline command.  After I run "terraform apply" with the above content in my .tf file, I see "Error: host for provisioner cannot be empty"
I tried this .tf file variation, but I get an error about the variable:
resource "aws_instance" "example" {
  ami           = "ami-1234"
  instance_type = "t2.large"
  key_name      = "foobar"
  user_data     = local.cloud_config_config

  provisioner "remote-exec" {
    inline = ["sudo yum -y install coolprogram"]
  }
  connection {
    host     = "${var.host_name}"
  }
}

The hostname will be created dynamically.  Terraform's documentation does not mention a hostname.  I have tried different variables.tf files.
But I always get something like this:

aws_instance.example (remote-exec): Connecting to remote host via
SSH... aws_instance.example (remote-exec):   Host: example
aws_instance.example (remote-exec):   User: root aws_instance.example
(remote-exec):   Password: false aws_instance.example (remote-exec):
Private key: false aws_instance.example (remote-exec):   Certificate:
false aws_instance.example (remote-exec):   SSH Agent: false
aws_instance.example (remote-exec):   Checking Host Key: false
aws_instance.example (remote-exec):   Target Platform: unix

How do I use the remote-exec provisioner on an EC-2 server?

Terraform Provisioners are a last resort, so I'd encourage you to think about other options first.
In this case, your example suggests that you're already using cloud-init and so if at all possible I'd suggest modifying that cloud-init configuration to include a request to install the package you want to install. If you are using the cloud-config YAML format then you can use the Package Update Upgrade Install module to get a similar effect to your yum install command line:
packages:
 - coolprogram

However, if you've eliminated all other options except provisioners then the typical way to use remote-exec with an EC2 instance is to pass one of the instance's own IP addresses as the hostname, which you can do by using the special self object in the connection block to refer to the attributes of the object that the provisioner is running against, like this:
resource "aws_instance" "example" {
  ami           = "ami-1234"
  instance_type = "t2.large"
  key_name      = "foobar"
  user_data     = local.cloud_config_config

  connection {
    host = self.private_ip
  }

  provisioner "remote-exec" {
    inline = ["sudo yum -y install coolprogram"]
  }
}

The above example uses self.private_ip, which will work only if the host where you are running Terraform is running in or able to connect to the VPC where you're deploying this instance. Another option is to use self.public_ip to use the public IP address, but that will work only if your VPC has an Internet Gateway and your instance belongs to a security group that can accept incoming SSH connections from the internet.
In addition to supplying a suitable IP address, you'll also need to generate and assign an allowed SSH public key to the EC2 instance and provide the corresponding private key in the connection block, using the private_key argument. (Or one of the other authentication strategies that a connection block supports.)
These connection and authentication complexities are, as you hopefully saw in the Terraform documentation I linked earlier, one of the main reasons why provisioners are a last resort. Using cloud-init instead will avoid this because cloud-init runs automatically on system boot and retrieves the user_data string using a private API accessible from the instance's private network interface, and so it doesn't need any outside connectivity, to start any listening services, or to generate any new credentials.


Who redirect ports on Windows to access http container? When we use Linux, Docker can create a rule using iptables to do a port redirection to connect in the http of a container.

When we use Windows, how does this work?

it uses the Hyper-V Virtual Switch (https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/container-networking)


What does 1 vcpu mean precisely/exactly? When we are talking about "1 vcpu" in different cloud solutions:

Q: What exactly does it mean?

Ex.: if I will use a 10 vcpu machine for the same cpu intensive process (which only uses CPU) then I would see the same amount of CPU load on them? Would they finish at the same time regarding the same only-CPU-usage task?

Or the definition of vcpu could differ in the different cloud solutions?

vcpu = Virtual CPU, that's just the number of core of the instance. Nothing more, nothing less.

For the rest of your questions they're unrelated, this depends on the underlying hypervisor's physical processors, there's no guarantee they use the same type with same frequency.


Is there evidence to suggest that the Docker/Hashicorp ecosystem requires a higher calibre of software development engineer? Our build system at work is a series of Go pipelines with go agents running in docker containers on a docker cluster. It compiles java and runs tests. This is in a financial services institution.

We're using consul and registrator for service discovery and vault for secret storage.

I've experienced some pushback in my workplace about the perceived complexities of using docker for running compiles and tests. To counter this I've written lots of documentation, and run training courses.

There are some comments online that docker is complex.

In the Adrian Cockcroft videos, he mentions that in some cases they had to hire Google-level engineers, to wrap their heads around the concepts of distributed computing. In another video he mentions that it took them seven years to achieve their vision of containerisation.

My question is: Is there evidence to suggest that the Docker/Hashicorp ecosystem requires a higher calibre of software development engineer?

I apologize for the novel length response, but I want the industry to start having these discussions as the potential advantages are huge.

The problem is not that it is necessarily more complicated but that it requires experience that is difficult to find today and which goes against traditional models.

This is not an uncommon occurrence in the computing industry, and I personally remember a time when TCP/IP was considered too complicated.  The talent base will grow over time though.

Here are the main barriers I see today:

Tools:

On the platform side most Engineers are just really starting to leverage automation. Unfortunately they are leveraging configuration management tools which were designed to solve a different problem. As an example Puppet and Chef assume idempotency and long lived systems.  A large portion of the industry is just starting to get good at those tools but they are inappropriate for a model where dynamic istanciation is the rule and long lived systems are rare.

Most of the monitoring tools or management tools in use also assume long lived systems do not work well in a dynamic environment.

Then there is the whole we must have a single source of truth problem that I will ignore, however it is a significant barrier.

Virtualization:

This is mostly an issue with vendor lock-in and market forces.  But many SE's have been separated from the simple mechanics of virtualization that their is a knowledge gap.  These individuals are capable of the work but have spent most of their time managing vendors so understanding concepts like linux namespaces or c-groups is almost foreign.

Networking:

Docker and Kubernetes really need network segmentation, and tenant isolation.  While this happens at a google scale most companies are using fragile and expensive enterprise solutions.  These tend to either have no automation or massive centralized management.  Really each swarm or cluster needs it's own segment and the technologies like vxlan or sdn that enable this are just popping up.

Security:

Related to the lack of overlay networks, or shared VPCs between swarms and clusters across security domains this is a very hard nut for companies to crack right now.  Most security teams have no way to figure out how to audit these systems.  Most teams I see are trying to fix it with solutions that don't directly address the problem.  Segmentation and limited super user access will improve security in the long run, but like most humans they can't really parse json policy files with ease.

Related to the knowledge gap in virtualization, most team do not understand the attack surface involved here.  Mix this in with a tenancy to give into the need for super user access this is an unsolved problem for organizations.  As an example the default AWS VPC limit per region pretty much means anyone running kubernetes in AWS today most likely has serious security issues and any breach will be massive.

This is less of a problem on GCE but it is a very real concern today. This is far from an unsolvable, but it is a real problem.

In closing:

With all of those negatives I still think it is one of the most promising directions looking forward.  But our industry today is full of companies that struggle to even implement OpenStack, which is really just a a bunch of python wrappers, a message bus and a database.

It will be a hard sell for a while, but the advantages of true loose coupling will probably win out in the end.


Difference between azure devops, azure devops server and TFVC I am working on visual studio projects (Visual Studio Community). I have create local git repositories and remote respositories on https://dev.azure.com (azure devops).
Everything works great
Now, i want to work with Team Foundation Version Control. I need "Microsoft Team Foundation Server". It seems this product is now called "Azure DevOps Server". Is it the same thing than what i see on https://dev.azure.com ?
What should i do in order to work with Team Foundation Version Control instead of git ?
Thanks

Q: "What should I do in order to work with Team Foundation Version Control?"
A: TL'DR: Use the TFS command line client, tf.
?  But why use TFVC ?
Azure DevOps is confusingly several products. There is the cloud offering: DevOps Services, formerly known as Visual Studio Team Services, formerly, Visual Studio Online, formerly Team Foundation Service.  There is also an On-Premise offering: Azure DevOps Server, formerly known as Team Foundation Server (now 2020, formerly 2019, 2017, 2015, 2013, 2012, 2010, 2018, 2005). They do share a common REST API, albeit the on-prem lags behind.
Aside from the delay in getting features into the on-prem variant, the questions of choosing on-prem or cloud have nothing to do with choosing TFVC vs Git. It likely depends more on cost, infrastructure and people resources, geographic and network constraints.
You can see most of the Product Announcements from the Program Manager here.
From TFS 2005 to 2012, the version control engine was TFVC, a centralized version control tool. Team Foundation Server 2013 added native support as a centralized Git remote host (similar to Github/Gitlab/BitBucket,but on-prem), albeit in separate team projects. TFS 2015 Update 1 (clumsily) allowed hosting both in the same team project.
But, let's get back to today. Since TFS 2015, Microsoft has put very little effort into improving the TFVC side of their offering. It would seem today, they have essentially abandoned it. Team Explorer Everywhere is no longer maintained. In  2016, they open-sourced it. Admittedly, in  2017 they did reintroduce it after a large outcry. The Eclipse client was last updated for Neon release (2016-06). The tfs-plugin for Jenkins has not had a significant release since Mar 2018. On 2020-11-06 (Nov 6, 2020), the Visual Studio Code plugin will be removed from the VS Code Marketplace; users will have to rely on the tf command line.
The Program Manager's first post detailed TFS Usage within Microsoft. Those were last updated in 2013. A few years later, they are now boasting of having the world's largest Git repo and then acquired GitHub.
The basic question you should be asking is Choosing the right version control for your project? Do you want a Centralized model or a Distributed model of version control?
I have a lot (decades) of experience managing Centralized and Distributed version control systems. As MS documents, each have their strengths, weaknesses and trade-offs. But, why would you choose a centralized version control tool that is provided by a vendor that evidently no longer supports it?

PS: Most people visualize Centralized Version Control like this:
 (from: https://scmquest.com/wp-content/uploads/2014/05/central_vcs.jpg)
and Distributed Version Control like this:
 (from: https://scmquest.com/wp-content/uploads/2014/05/distributed_vcs.jpg)
But that is really just a "disconnected, centralized model". Git allows for very complex distributed workflows, such as show below. You do not get that flexibility using centralized tools. But it can also be a total nightmare to keep track of what's where.

(from: https://howtodoinjava.com/vcs/how-distributed-version-control-system-works/)


AWS Production Configuration ASP.NET Core & Docker So we have an asp.net core application we are hoping to start using with docker and host this all on aws.

We have multiple clients that we set up this project for, each with their own configuration settings, such as connection strings, application name, token secret, mailing server information, etc...

The problem we are going to have/are having, is how to make production configuration not built into the source code/docker whilst being accessible for multiple instances/containers that will need to use this on ECS/EC2.

So the idea we currently have, which i was hoping someone could check or suggest a better solution if there is one, is that we will build the container free of the specific configuration, then access the appSettings.production.json which we would mount from outside of the container. Because this would be on amazon it would be stored in EFS if capable or S3.

Is this possible and an appropriate solution?

Thanks

If you are going full on AWS, I would suggest to have a look at AWS SSM parameters. When EC2 or ECS container are starting, you have a script that is going to fetch the parameters. Then you can do whatever you need to do: replace variables in config files with the parameters fetched previously for example.
You could also use files stored in S3. You would be able to copy it and place it in the right application folder when your EC2 or ECS container are starting.


auto delete aws S3 backups I need to automate deletion of aws S3 backups ... evidently if I tag the backup with one of daily, weekly, monthly, yearly then aws will delete based on my desired retention counts per those periods however I see no easy way to determine which of those tags I give to my daily backup process which is
//   Upload backup file

aws s3 cp /tmp/backup_2007020644.20200703.1248_blobs.tar  s3://foo-bar-baz-someaccount-us-east-2/backup_2007020644.20200703.1248_blobs.tar --region  us-east-2 --only-show-errors

aws s3api put-object-tagging --bucket foo-bar-baz-someaccount-us-east-2  --key backup_2007020644.20200703.1248_blobs.tar --tagging  --region  us-east-2 TagSet=[{Key=backuptype,Value=blobs}]

//   now lets list this s3 bucket

aws s3 ls s3://foo-bar-baz-someaccount-us-east-2 --region  us-east-2

2020-07-01 22:55:57   31904428 backup_2007010938.20200701.2233_blobs.tar
2020-07-01 22:55:43     893239 backup_2007010938.20200701.2233_mongo.tar
2020-07-02 15:30:36   34343354 backup_2007010938.20200702.1508_blobs.tar
2020-07-02 15:30:22     893676 backup_2007010938.20200702.1508_mongo.tar
2020-07-03 01:20:04   30596405 backup_2007020644.20200703.0055_blobs.tar
2020-07-03 01:19:51     893741 backup_2007020644.20200703.0055_mongo.tar
2020-07-03 12:48:44   34658003 backup_2007020644.20200703.1226_blobs.tar
2020-07-03 12:48:30     895294 backup_2007020644.20200703.1226_mongo.tar
2020-07-03 15:05:00   34657972 backup_2007020644.20200703.1248_blobs.tar
2020-07-03 15:04:46     895279 backup_2007020644.20200703.1248_mongo.tar

Alternatively I can code up my own logic to parse above listing then issue the delete command per backup file after my code keeps track of my retention policy. There must be a better way, any advice?

I think you're on the right track. Just need a tiny bit more logic on the backup process, then S3 can handle the rest.
Consider this:

A backup is uploaded every day.
If today is January 1st (for example), the backup is given a "yearly" tag.
Otherwise, if today is the 1st of the month, the backup is given a "monthly" tag.
Otherwise, if today is a Sunday, the backup is given a "weekly" tag.
Otherwise the backup is given a "daily" tag.

Next, set up S3 Bucket Lifecycle Policies with each tag as the filter.

Transition "yearly" backups to Glacier after 365 days (kept indefinitely)
Delete "monthly" backups after 365 days (1 year)
Delete "weekly" backups after 183 days (6 months)
Delete "daily" backups after 31 days (1 month)

References:

https://docs.aws.amazon.com/AmazonS3/latest/user-guide/create-lifecycle.html
https://docs.aws.amazon.com/AmazonS3/latest/dev/lifecycle-configuration-examples.html


How to send notification only in case of job output being non-empty We are using rundeck to scan logfiles for a service, and take action depending on what is found there. Basically, for each item found, for which a records does not exists, a git repository is initialized and a few rest endpoints are called, but that's not the point.

We are setting up the job to run as scheduled, say every couple of hours, and to send notification on failure, and additionally to send notification on success only when at least one action has been taken (ie. the shell script in the task entered the loop at least once). The script is written so that it only emits output on stdout when items to be actioned are found.

Is there a way in rundeck to trigger notification with this requirement? Or a way to script it without writing a plugin from scratch?

One possible workaround would be to switch the failure notification trigger off, and make the script return non-zero in case of no items actioned, but I am not comfortable in doing that.

The way I could think of are:

Writing your own plugin, from the notification plugin example page, adapting the example mail notification code could be a way.

Disabling success notifications in rundeck, and handle the success notification part in your script itself. This way that's your script responsibility to warn it did something in normal state and it's still rundeck responsibility to warn you the script failed.


Terraform - aws_security_group_rule doesn't support import I'm having a strange problem when trying to import an aws_security_group_rule into terraform.

I'm running the latest version of TF (0.11.11)

For example:

terraform import module.ec2.aws_security_group_rule.control_elb sg-securitygroupid_ingress_tcp_8080_8080_sg-sourcesgid

Returns resource aws_security_group_rule doesn't support import

However, looking at the documentation, this does seem possible?

https://www.terraform.io/docs/providers/aws/r/security_group_rule.html

Did you try to import in flat setup than modular setup? It seems that in modular setup there is a bug with Terraform. https://github.com/terraform-providers/terraform-provider-aws/issues/559


How to deploy Node app via Jenkins to Ubuntu(18.04)? I'm a very beginner in Jenkins and afraid that I ask you something not clear with a weird question.

I'd like to deploy my simple node app server to Ubuntu via Jenkins.

I tried to write a command in Build at a Job as below :

./script/deploy.sh

deploy.sh file is here.

#!/bin/sh
EOF
 npm install
 pm2 restart app.js --name="myApp"
 exit
EOF

When I run a build, it stucked with error as

FATAL: Could not checkout 0d563b394d506e8450833e9b36d7a7b44834df39

The Full log of Error.

 > git checkout -f 0d563b394d506e8450833e9b36d7a7b44834df39
FATAL: Could not checkout 0d563b394d506e8450833e9b36d7a7b44834df39
hudson.plugins.git.GitException: Command "git checkout -f 0d563b394d506e8450833e9b36d7a7b44834df39" returned status code 1:
stdout:
stderr: error: unable to unlink old 'node_modules/express-session/HISTORY.md': Permission denied
error: unable to unlink old 'node_modules/express-session/LICENSE': Permission denied
error: unable to unlink old 'node_modules/express-session/README.md': Permission denied
error: unable to unlink old 'node_modules/express-session/index.js': Permission denied
error: unable to unlink old 'node_modules/express-session/package.json': Permission denied
error: unable to unlink old 'node_modules/express-session/session/cookie.js': Permission denied
error: unable to unlink old 'node_modules/express-session/session/memory.js': Permission denied
error: unable to unlink old 'node_modules/express-session/session/session.js': Permission denied
error: unable to unlink old 'node_modules/express-session/session/store.js': Permission denied
HEAD is now at 0d563b3 commit

    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2042)
    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$900(CliGitAPIImpl.java:72)
    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$9.execute(CliGitAPIImpl.java:2341)
Caused: hudson.plugins.git.GitException: Could not checkout 0d563b394d506e8450833e9b36d7a7b44834df39
    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$9.execute(CliGitAPIImpl.java:2365)
    at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1242)
    at hudson.scm.SCM.checkout(SCM.java:504)
    at hudson.model.AbstractProject.checkout(AbstractProject.java:1208)
    at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:574)
    at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:86)
    at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:499)
    at hudson.model.Run.execute(Run.java:1816)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
    at hudson.model.ResourceController.execute(ResourceController.java:97)
    at hudson.model.Executor.run(Executor.java:429)
Finished: FAILURE

My questions :

1. How to deploy a node app to ubuntu via Jenkins.

Is my way right? or another way is better?

2. What error is it as following the log.

This article very clearly explains how to deploy a nodejs app using Jenkins:

https://blog.couchbase.com/create-continuous-deployment-pipeline-nodejs-jenkins/


Azure DevOps Pipelines running on incorrect branches I'm attempting to build different branches with different YAML configuration files in each branch. However, when I commit to a branch that should only trigger 1 pipeline it triggers both.

Development YAML:
    trigger:
    - master_Development

    pool:
      vmImage: 'windows-latest'

    variables:
      solution: '**/*.sln'
      buildPlatform: 'Any CPU'
      buildConfiguration: 'Release'
      buildPackageDirectory: 'packages'
      nugetConfig: 'SW.Api.Net/nuget.config'

    steps:

    - task: NuGetToolInstaller@0
      displayName: 'Use NuGet 4.4.1'
      inputs:
        versionSpec: 4.4.1

    - task: NuGetCommand@2
      displayName: 'NuGet restore'
      inputs:
        restoreSolution: $(solution)
        feedsToUse: config
        nugetConfigPath: $(nugetConfig)
        externalFeedCredentials: TelerikFeed
        restoreDirectory: $(buildPackageDirectory)

    - task: VSBuild@1
      displayName: 'Build solution'
      inputs:
        solution: $(solution)
        msbuildArgs: '/p:DeployOnBuild=true /p:WebPublishMethod=Package /p:PackageAsSingleFile=true /p:SkipInvalidConfigurations=true /p:PackageLocation="$(build.artifactStagingDirectory)\\"'
        platform: $(buildPlatform)
        configuration: $(buildConfiguration)

    - task: VSTest@2
      displayName: 'Test Assemblies'
      inputs:
        testFiltercriteria: 'TestCategory=Unit Test'
        platform: $(buildPlatform)
        configuration: $(buildConfiguration)

    - task: PublishBuildArtifacts@1
      displayName: 'Publish Artifact: drop'
      inputs:
        PathToPublish: $(build.artifactStagingDirectory)
        ArtifactName: 'drop'
      condition: succeededOrFailed()

Production YAML:

trigger:
- master

pool:
  vmImage: 'windows-latest'

variables:
  solution: '**/*.sln'
  buildPlatform: 'Any CPU'
  buildConfiguration: 'Release'
  buildPackageDirectory: 'packages'
  nugetConfig: 'SW.Api.Net/nuget.config'

steps:

- task: NuGetToolInstaller@0
  displayName: 'Use NuGet 4.4.1'
  inputs:
    versionSpec: 4.4.1

- task: NuGetCommand@2
  displayName: 'NuGet restore'
  inputs:
    restoreSolution: $(solution)
    feedsToUse: config
    nugetConfigPath: $(nugetConfig)
    externalFeedCredentials: TelerikFeed
    restoreDirectory: $(buildPackageDirectory)

- task: VSBuild@1
  displayName: 'Build solution'
  inputs:
    solution: $(solution)
    msbuildArgs: '/p:DeployOnBuild=true /p:WebPublishMethod=Package /p:PackageAsSingleFile=true /p:SkipInvalidConfigurations=true /p:PackageLocation="$(build.artifactStagingDirectory)\\"'
    platform: $(buildPlatform)
    configuration: $(buildConfiguration)

- task: VSTest@2
  displayName: 'Test Assemblies'
  inputs:
    testFiltercriteria: 'TestCategory=Unit Test'
    platform: $(buildPlatform)
    configuration: $(buildConfiguration)

- task: PublishBuildArtifacts@1
  displayName: 'Publish Artifact: drop'
  inputs:
    PathToPublish: $(build.artifactStagingDirectory)
    ArtifactName: 'drop'
  condition: succeededOrFailed()

Why would the pipelines not be separately triggering they target different branches?

I have solved this issue, it had to do with the path to the pipeline.
I created a directory called pipelines/dev and pipelines/prod in the root of my repo. And I pointed either build pipeline to the respective yaml config file. Now it will only build on the commit of the specific branches.


Large number of host emulation What would be the best way to emulate (or really to instantiate) a large number of hosts / virtual machines / docker containers in the cloud?

Assume I want to run a scenario where 10,000 hosts are running the same application. Is there a cloud service which provides the ability to  "clone" a single host to 10K instances? Is there a way to configure slight changes in those hosts (in terms of Geo location / IP / hostname / MAC address)?

you create a Docker Swarm stack file:

---
version: '3.1'

services:
  ubuntu:
    image: ubuntu # or your custom Docker image
      deploy:
        replicas: 10000

Then, with docker stack you can run your 10000 Ubuntu's on one or - probably better in this case - a set of Swarm hosts. This could be bare metal or AWS. Enjoy!

For MAC address is very interesting question which I hope other colleagues here can answer. Geolocation should be no problem as this is AFAIK a system setting - virtual OS does not implement a physical GPS sensor.

Docs give an example how to set a fixed MAC address on docker run - possibly this can be translated to the stack YML file as well.

docker run --mac-address=".." ...


Pass Ansible parameters to include_role I have a role that contains this task:
- name: Download something via Git
  include_role:
    name: git_cached
  vars:
    params:
      repo: https://somerepo
      dest: /some/path

I would really like to then have the git_cached role look like this:
- git: {{ params }}

I don't want to have to duplicate all of the parameters like this:
- git:
    repo: "{{ repo }}"
    dest: "{{ dest }}"

Because then, I have to do it for all the parameters, even the ones I don't typically use. I just want to basically "override" certain parameters that I pass into the include_role task.
Is what I'm trying to do possible?

Q: "Override certain parameters that pass them into the include_role task."
A: The parameter tasks_from serves this use-case. For example, create the task file
shell> cat roles/git_cached/tasks/git.yml
- git:
    repo: "{{ params.repo }}"
    dest: "{{ params.dest }}"
    recursive: "{{ params.recursive|default(ommit) }}"
    depth: "{{ params.depth|default('1') }}"

Then "call" this task
    - name: Download something via Git
      include_role:
        name: git_cached
        tasks_from: git.yml
      vars:
        params:
          repo: https://somerepo
          dest: /some/path

You might want to complete the task with all git parameters:

The parameters repo and dest are required.

In some parameters, like recursive, the default values are defined. You can either omit the parameter, in which case the default value will be used, or define your own default.

Some parameters, like depth, don't have defaults.  Also here you can either omit the parameter, in which case the parameter won't be used or define your own default.

It's a good idea to "namespace" the variables.

It's a good idea to put the default variables into roles/git_cached/defaults/main.yml


Migrating from TFVS to GIT using GIT-TFS We have a large TFS repository which we would like to migrate to git.

We are considering using git-tfs for a while, in order for everything to continue working while we migrate.

We have large (or small, but rapidly changing) binary files scattered throughout the code, which have been checked-in to tfs throughout the history.

My worries about git-tfs I have not been able to find accessible answers for:

What is the source of truth for git-tfs? Is it a git server, a tfs server, or some hybrid, or none of the above?
If it is a git server, how would this affect workflow while knowing binary files exist?
We thought of using lfs, but not sure how this wuold play with git-tfs.

I would love some light shed on this topic, as it would be quite pointless to migrate only to find out binary files make the new repo not usable

As of Azure DevOps Server 2019, migration from Team Foundation Version Control (TFVC) to Git is a simple import command.  However, there are caveats to the migration due to how very different Git is in how it stores changes.

Microsoft has a great write-up for this migration and if you have the newer version of Azure DevOps Server or if you're in the cloud, you don't need git-tfs.

But, a few highlights:

Git is distributed version control, which means that you have a full copy of the files and all historical changes simply by cloning the repository to your machine.  You technically don't need a server, but if you have a team and collaborate, a server is needed to share changes with the team via appropriate Git workflows and branching.
Git is really good at storing text files and will only ever store a single copy of a file with each commit storing a snapshot of the differences in that file over time.  Binary files require storage of the full file for each commit that changes the file.
When binary files need to be stored in a Git repo, it's best to use Git LFS (Large File System).  This allows you to mark files as large/binary and Git will only track a reference to the file, not the actual file itself.  This keeps the repository small and nimble.
When you have an enormous repository (files/history) that is in the 2-4 GB range, you may need the Microsoft-contributed Virtual File System for Git, which Microsoft uses for its enormous 500 GB Windows code-base that developers all around the globe work from.  Contributions from Microsoft and the rest of the open-source community have done a great job of keeping Git commands performance-tuned for larger repos, but VFS for Git is a big leap for repos that cannot be small.

If you are still running an older version of TFS that doesn't yet have the easy import option, that's OK.  Usage of git-tfs is a viable solution and Microsoft also has a great write-up for how to approach this manual migration.  In either case, there will potentially be work involved if your code-base if you stored a lot of binary files in TFVC compared to text/code.

What git-tfs is actually doing is creating a historical clone of your TFVC repository into a local Git repository by replaying the history and creating Git commits.  The tool can be used as a way to bridge a TFVC repo and Git repo, but you are better off fully migrating to Git and removing the TFVC repository.

Once you decide to fully migrate, it's best to do the migration in a few steps locally in the new cloned Git repo before pushing it to the TFS server as the origin.  This allows you to clean up any history of binary files that may be needed.  The BFG Repo-Cleaner can be used for this which can re-write history in the Git repo to remove all but the latest change to files like binaries, thus reducing the physical size of the Git repo on disk.


Passing a jenkins credential (global) to a python script I have a global jenkins credential and a config script that includes the line

API_TOKEN = "Token XXX"

For security reasons we can't keep the token in the script itself as its in version control. Is there a way to pass the jenkins credential to the python config script from jenkins?

Specifically for credentials, CloudBees recommends using the Credentials Plugins, which inject the credentials in the environment available to the invoked scripts. From Injecting Secrets into Jenkins Build Jobs:

  Credentials plugin - provides a centralized way to define credentials that can be used by your Jenkins instance, plugins and
  build jobs.
  Credentials Binding plugin - allows you to configure your build jobs to inject credentials as environment variables.
  Plain Credentials plugin - a plugin dependency required by the Credentials Binding plugin.

Inside your script you'd pick up the variable from the script's environment:

API_TOKEN = os.getenv('API_TOKEN')

In a similar way you can pass any arbitrary variables (other than credentials), using the EnvInject Plugin (watch for the warnings, tho). See related:

Jenkins inject environment variable
Environment variables in Jenkins

Another possible approach is to configure Jenkins to pass the value as an argument to your script. Inside your script you'd pick up the value using your preferred method of processing the script arguments.


Gitlab Runner not running scripts with Windows shell configuration I have a Gitlab Runner running locally on my windows box. It works fine for the before script section.

my .gitlab-ci.yml follows:

before_script:
  - pushd . && uru 233 && popd && set HOME=c:\ && ruby -v && bundle install

rspec:
  script:
    - bundle exec rspec

rubocop:
  script:
    - bundle exec rubocop

flay:
  script:
    - bundle exec flay *

It does not do anything after the before script, though. Does not run any of the jobs.

How can I find out what's going on?

I was able to fix it with a super-non-ideal/hacky solution that I don't like:

rspec:
  script:
    - pushd . && uru 233 && popd && set HOME=c:\ && ruby -v && bundle install && bundle exec rspec

rubocop:
  script:
    - pushd . && uru 233 && popd && set HOME=c:\ && ruby -v && bundle install && bundle exec rubocop

flay:
  script:
    - pushd . && uru 233 && popd && set HOME=c:\ && ruby -v && bundle install && bundle exec flay *

People sending comments have also prompted me to add that in Windows it seems to be stopping at the first array element in every script session.

With a Docker configuration for the runner I can do things like:

my_job_name:
  script:
    - a command
    - another command

With the windows shell runner it just stops after a command if I do it this way. Stringing the commands together seemed to work, but I would rather not have to put everything on one line.

stages are required

stages:
  - stage1

stage1:
  stage: stage1
  script:
    - echo hello

Could you try the following:

before_script:
  - pushd . && uru 233 && popd && set HOME=c:\ && ruby -v && bundle install

stages:
  - rspec
  - rubocop
  - flay

rspec:
  stage: rspec
  script:
    - bundle exec rspec

rubocop:
  stage: rubocop
  script:
    - bundle exec rubocop

flay:
  stage: flay
  script:
    - bundle exec flay *


Jenkins SSH connection on remote server immediately closes after login I created a user for jenkins on my remote server that worked previously just fine, but now when I try to login with shh on the server the connection closes immediately after login. This is strange because on the website that is hosting jenkins it seem to work just fine, I can log there with chrome no problem and it evan builds succefully. My only problem is when I SSH with that user jenkins on the server.
Will add here the ssh -v logs when I get disconnected:

debug1: client_input_channel_req: channel 0 rtype exit-signal reply 0
debug1: client_input_channel_req: channel 0 rtype eow@openssh.com reply 0
Last login: Tue Mar 12 09:21:23 2019 from 82.78.220.8
debug1: channel 0: free: client-session, nchannels 1
Connection to 145.239.84.136 closed.
Transferred: sent 2652, received 3604 bytes, in 0.5 seconds
Bytes per second: sent 5268.4, received 7159.7
debug1: Exit status -1

This is what I get after I insert the password.

I will also post the sshd logs:

Accepted password for jenkins from 82.78.220.8 port 40872 ssh2
pam_unix(sshd:session): session opened for user jenkins by (uid=0)
Received disconnect from 82.78.220.8 port 40872:11: disconnected by user
Disconnected from 82.78.220.8 port 40872
pam_unix(sshd:session): session closed for user jenkins

I have this setup in the passwd:

jenkins:x:113:118:Jenkins,,,:/var/lib/jenkins:/bin/bash

I have to add that I can ssh with other users on the server just fine.
I also tryed to su jenkins from root: This will just freeze my terminal and will open something like this:

jenkins@vps531680:/root$ root@vps531680:~# root@vps531680:~# logout

and I will get disconnected.

I also tryed this sudo usermod -s /bin/bash jenkins:

bash: /root/.bashrc: Permission denied
jenkins@vps531680:~$ Killed

On the weird side is that if I just reboot the server, for like 5-10 mins after that my jenkins user works just fine, but I will get disconnected after that time and I won't be able to SSH again, only after another reboot and for 5-10 mins. Any advice will be apreciated!

Check to see if the home directory for Jenkins was created?

/home/jenkins


Ansible YAML inventory - Groups that are allways members of other groups Situation:

I have a group "webservers" where I put all webservers in. As well as a group "mysqlservers" for the database servers respectively.

Now I do also manage some LAMP servers and I want them to be always part of the webservers and mysqlservers group, as well as manage them in a group "lamp"

This is my approach:

---
all:
  hosts:
    host1:
    host2:
  children:
    webservers:
      hosts:
        web1:
        web2:
        web3
      children:
        lamp:
    mysqlservers:
      hosts:
        db1:
        db2:
        db3:
      children:
        lamp:
    lamp:
      hosts:
        lamp1:
        lamp2:
        lamp3:
...

Is that the correct approach? If I followed the ansible docs examples, I would have defined the "lamp" hosts as children of webservers and mysqlservers, but I really want to reduce redundancy. So is it possible to create the group as a child of "all" and just reference it as children of the specified groups without repeating the hosts?

According to this best practices post, your file will look like this

file: test

[webservers]
web1
web2
web3

[mysqlservers]
db1
db2
db3

[lamp]
lamp1
lamp2
lamp3

[misc]
host1
host2

[all:children]
misc
webservers
mysqlservers
lamp

[webservers:children]
lamp

[mysqlservers:children]
lamp

You can analyse your file by using ansible-inventory:

ansible-inventory --inventory-file=./test --list

output:

{
    "_meta": {
        "hostvars": {
            "db1": {},
            "db2": {},
            "db3": {},
            "host1": {},
            "host2": {},
            "lamp1": {},
            "lamp2": {},
            "lamp3": {},
            "web1": {},
            "web2": {},
            "web3": {}
        }
    },
    "all": {
        "children": [
            "lamp",
            "misc",
            "mysqlservers",
            "ungrouped",
            "webservers"
        ]
    },
    "lamp": {
        "hosts": [
            "lamp1",
            "lamp2",
            "lamp3"
        ]
    },
    "misc": {
        "hosts": [
            "host1",
            "host2"
        ]
    },
    "mysqlservers": {
        "children": [
            "lamp"
        ],
        "hosts": [
            "db1",
            "db2",
            "db3"
        ]
    },
    "ungrouped": {},
    "webservers": {
        "children": [
            "lamp"
        ],
        "hosts": [
            "web1",
            "web2",
            "web3"
        ]
    }
}


How to performance test AWS Lambda functions? AWS Lambda cost is dependent on the time a function runs, and to some extent on memory footprint. Having functions that finish faster, and take up less memory can save quite a lot of money. Especially when such a function is executed often.

How can a Node.js Lambda function be tuned for speed and small memory footprint to save on cost?

Are there other aspects for Lambda that are advantageous to improve?

Dawny33 response is good, but I would start earlier in the development process.

Keeping an eye on your cloud environment to make sure that your functions behaves as you expect (including your "production" functions, which might operate on a different data set) is crucial, because it might reveal things that are impossible to reproduce locally or with a test data-set.

Nonetheless, I would say that this performance testing that you do in an optimization purpose should start straight from the developer's machine. Or, at least, from some local environment before pushing to the cloud.

The reason I say so is that while AWS Lambdas are amazing on many points, the fact that you don't have a full control on the server will limit your instrumentation abilities. I'm not saying instrumentation is impossible when in serverless, but try figuring out how many CPU interrupts you have (and how many are caused by your code) just for fun ;)

So what I advise, and this is actually not limited to serverless, is to start the profiling early. NodeJS profiling can be made with many different tools, NewRelic, dynatrace and AppDynamic are some of the big players. There is also smaller player, some of them are just a NPM package to install (like Nodefly). It is also possible to do some NodeJS without any additional tool, as there is a profiler built into the V8 engine. This documentation from NodeJS will get you started.

Whatever tool you choose, you want to install it locally and collect profiling data. That might involve running an agent or including a package in your package.json. Your tool's instructions will tell you how to install it. A good profiler will let you know how much memory and CPU you use. Better tools will give you insight on how many remote calls were made, how long they took.

Use the profiling data that the tool gives you to identify bottlenecks and address them. There's no limit on how much profiling you can make. Some people (crazy?) will look at the system calls of their most critical function. You might have to do that kind of thing if you want to shave nanoseconds of your function (but then, maybe AWS Lambda isn't the best choice to start with).

It's also worth noting at this point that I haven't mentioned anything specific to AWS Lambda. That's because your optimizations will most likely not be AWS Lambda specific (after all, in serverless you shouldn't be worried about the server/environment).

Make sure that not only your code works, but that it works the way you expect it to. Don't over optimize, but keep a critical eye on CPU and memory usage. Should a 2MB array really grow to 10MB when you sort it? Probably not.

Then you will be able to use tools mentioned by Dawny33, or some other tools, to confirm that your functions perform similarly when deployed to Lambda. You will however already have a very high level of confidence in your function and will only need to validate that they behave properly, not fully profile them.


Is Cypress ok for acceptance tests on APIs in a CI/CD pipeline? I have a small team but a gigantic application. We don't have PHP unit testing, so we will be using Cypress as a baseline for quality. Everything will go through a CI/CD pipeline and use regression end to end to make sure we haven't broken any modules or projects. One example is a FedEx API for shipping and we have multiple addresses, using GUI testing will be too slow, so I wonder if using Cypress is okay for that task as opposed to put another system (Postman with CLI) in the pipeline running testing with dynamic data (multiple Postal Codes and addresses? )

Cypress is designed for front-end end-to-end testing.  It is designed for testing a users interaction with your application and verifying that it works correctly (e.g. logging in with a valid username and password load the landing page).  Tools like this are designed to allow running in a headless mode which will let you run the tests in CI tool without loading a GUI.

Since it appears that your goal is to test the API interaction you are probably better off using a tool designed for that purpose.  Most API test tools allow you to send a request to your API and verify certain things about the response (i.e., response code, response headers, response bodies).

While using an end-to-end tool (like Cypress) will ultimately test your API, it will take longer to setup, run, and often be more brittle.  To use your above example, a tool like Cypress will require a script/test steps that log into your system, selecting multiple addresses for shipping, and verifying that everything displays properly.  A tool like Postman would just test that when you send a request to your FedEx API with a specific body and headers, you get the expected response, body, and headers back.  Setting up something like Postman will require a new tool, but will ultimately save time

Many of the API tools also provide a command line test runner and integrate with various CI tools (non-exhaustive list):

Postman - Free, relatively easy to setup, and includes an automated testing tool (newman).
SmartBear - Commercial product that integrates with most CI tooling.
Rest-Assured - Open source option for REST API testing.


DevOps SOX Compliance I'm coming from the dark side, compliance, and am looking to gain better knowledge on DevOps & how to implement SOX controls on these processes. I'm hoping to build a good knowledge base in order to be able to recommend controls that will provide good assurance to the auditors while minimizing the impact on the actual operations. Also, so that when I meet with our internal DevOps teams, I can speak knowledgably on this.

I've done some research through ISACA whitepapers and various other sources:

https://www.oreilly.com/learning/compliance-as-code
https://www.oreilly.com/webops-perf/free/devopssec.csp?intcmp=il-webops-free-product-na_new_site_compliance_as_code_text_cta
https://www.contino.io/insights/why-devsecops-is-an-auditors-best-friend
https://start.jcolemorrison.com/

Do you have any other suggestions on resources for building control frameworks for DevOps workflows? Or just DevOps in general?

what you are looking for is compliance and security for containers.  There are companies that can do this out the box for you, and even though I'm not advocating for either you can see what they offer and use that as a template.

https://www.twistlock.com/platform/container-compliance/
https://www.aquasec.com/use-cases/container-auditing-compliance/

As a HIPAA security officer and DevOps manager, I've been reviewing these processes.  The way to think of DevOps in your sense is probably the automation and culture of ship fast, fail early and fail often.  The goal is to not disrupt the pipeline from security and compliance.  Technically this looks like adding automated compliance checks in the pipeline before, during and after go live.  As automation gets built, you can replace the automation with a manual process'.  You can check out subjects like DevSecOps which is the same concept of ensuring compliance and probably closer to what you'll need to do.

here's an AWS diagram that might help https://aws.amazon.com/blogs/devops/implementing-devsecops-using-aws-codepipeline/


Add stages to Jenkins declarative pipeline through shared library Is there a way to write a stage in a Jenkins shared library so that it can be added to declarative pipelines?
Background
For many projects, I need to run tests on multiple different servers.  My solution is to create a bunch of parallel stages, one for each of the servers that I want to run on.  I've gotten to this pipeline (running on 2 servers as an example):
pipeline {
    agent any
    stages {
        stage('Test') {
            parallel {
                stage('San Jose') {
                    agent {
                        label "test && san-jose"
                    }
                    steps {
                        sh 'run-tests'
                    }
                }
                stage('Dallas') {
                    agent {
                        label 'test dallas'
                    }
                    steps {
                        sh 'run-tests'
                    }
                }
            }
        }
    }
}

Which is great, but I'd really like to keep my code DRY and not have to copy and paste this Test stage to every project I have (especially since this has to run on about 10 servers, with only the label changing each time).
I could put the whole pipeline into my shared libary (like Jenkins's example in the documentation), but then I can't customize the other stages (for example, adding a release stage).
What I'd really like to do is this:
pipeline {
    agent any
    stages {
        runOnServers {
            sh 'run-tests'
        }
        stage('Release') {
            echo 'release'
        }
    }
}

Question
Is there a way I can do this?

Yes, but (to the best of my knowledge) you will have to use Scripted Pipeline within the shared library.  This means that the closure that you will pass to the shared library (in the below example, the closure is sh 'run-tests') will also have to be Scripted.
Jenkinsfile:
pipeline {
    agent any
    stages {
        stage('Test') {
            steps {
                runOnServers {
                    sh 'run-tests'
                }
            }
        }
        stage('Release') {
            echo 'release'
        }
    }
}

In your shared library, a file named vars/runOnServers.groovy:
def call(Closure closure) {
  parallel({
    SanJose: {
      node("test && san-jose") {
        stage('SanJose') {
          closure()
        }
      }
    },
    Dallas: {
      node('test dallas') {
        stage('Dallas') {
          closure()
        }
      }
    }
  }
}


How not expose my backend I'm studying Docker and how to properly publish my containers coding a very simple web application. It has only two containers, backend and frontend. I've published the source code here: https://github.com/sinayra/hello-private-world
If I run locally each node application, its works "fine" (everything is public, but this is not what I want in the end of the day). Then, I created Dockerfile for each container, to try to simulate a real application. For the frontend, I exposed the port 3000 to access from the host. However, I don't want to expose the port 3333 for the host, and, because of that, my front can't fetch the data from the back.
Here is my index.html from the frontend.

    <title>Hello Public World</title>

Message from backend:

Its Dockerfile:
# pull official base image
FROM node:lts

# set working directory
WORKDIR /usr/src/app

# install app dependencies
COPY package.json ./
RUN npm install

# add app
COPY . ./

EXPOSE 3000

# start app
CMD ["npm", "run", "start"]

My index.js from backend:
const express = require("express");
const app = express();
const cors = require("cors");
const port = 3333;

const allowlist = ["http://localhost:3000"];
const corsOptions = {
  origin: allowlist,
  methods: "GET",
  preflightContinue: false,
  optionsSuccessStatus: 204,
};
app.use(cors(corsOptions));

app.use(express.json());
app.get("/", (req, res) => {
  console.log("GET /");
  res.json({ message: "Hello Private World!" });
});

app.listen(port, () =>
  console.log(`Example app listening at http://localhost:${port}`)
);

Its Dockerfile:
# pull official base image
FROM node:lts

# set working directory
WORKDIR /usr/src/app

# install app dependencies
COPY package.json ./
RUN npm install

# add app
COPY . ./

#EXPOSE 3333

# start app
CMD ["npm", "run", "start"]

And the Docker compose file
version: "3.8"
services:

  backend:
    image: helloworld-private
    build:
      context: ./backend
      dockerfile: Dockerfile
    working_dir: /usr/src/app
    container_name: "express_container"
    volumes:
      - ./backend/:/usr/src/app
      - /usr/src/app/node_modules
    networks:
      - webappnetwork
    expose:
      - "3333"

  web:
    image: helloworld-public
    build:
      context: ./web
      dockerfile: Dockerfile
    working_dir: /usr/src/app
    container_name: "liveserver_container"
    links:
      - backend
    volumes:
      - ./web/:/usr/src/app
      - /usr/src/app/node_modules
    environment:
      - PORT=3000
    networks:
      - webappnetwork
    ports:
      - "3000:3000"

networks:
  webappnetwork:
    driver: bridge

Is there any abstraction layer that I'm missing?

The layer that you're missing is nginx proxy. See my toy Mafia Game project here how to do it:

Shell deployment project (uses either Docker compose or k8s) - https://github.com/taleodor/mafia-deployment
Vue.js frontend - https://github.com/taleodor/mafia-vue
Express.js backend - https://github.com/taleodor/mafia-express
(Optional) detailed write-up about CI/CD and how it's built from DevOps prospective - https://itnext.io/building-kubernetes-cicd-pipeline-with-github-actions-argocd-and-reliza-hub-e7120b9be870

The missing piece in your case is nginx proxy that you use in your UI.
So what you need to do is to define some location for your api - i.e. /api. Then your proxy it via nginx - see my nginx configuration for the project above here - https://github.com/taleodor/mafia-vue/tree/master/nginx. At the same time it's highly recommended for performance to deploy static resources on the same nginx.
Use Dockerfile to define environment variables and defaults, i.e. in my project - https://github.com/taleodor/mafia-vue/blob/master/Dockerfile
Finally, you can update configuration via environment variables in your docker-compose yaml or k8s definitions.


How to connect a build node to a Jenkins master? I'd like to connect a build node to the Jenkins master. Ideally without using a web browser or being in front of the physical machine. What would be the easiest way to achieve that?

Connecting a node to Jenkins through a terminal only is a two step process.

First, you should ssh into into your node machines and set them up with the following steps:

Make a jenkins user shell:  sudo adduser jenkins --shell /bin/bash
Create the directory after switching to the jenkins user:  mkdir /home/jenkins/jenkins_slave
Create your SSH credentials to be used in the following bash script.

Then, once your nodes are set up, you will need to connect to your jenkins machine and run bash script such as this one to connect your nodes to your master:

#!/bin/bash

JENKINS_URL=$1
NODE_NAME=$2
NODE_SLAVE_HOME='/home/build/slave'
EXECUTORS=1
SSH_PORT=22
CRED_ID=$3
LABELS=build
USERID=${USER}

cat <<EOF | java -jar ~/bin/jenkins-cli.jar -s $1 create-node $2
<slave>
  <name>${NODE_NAME}</name>
  <description></description>
  <remoteFS>${NODE_SLAVE_HOME}</remoteFS>
  <numExecutors>${EXECUTORS}</numExecutors>
  <mode>NORMAL</mode>
  <retentionStrategy class="hudson.slaves.RetentionStrategy$Always"/>
  <launcher class="hudson.plugins.sshslaves.SSHLauncher" plugin="ssh-slaves@1.5">
    <host>${NODE_NAME}</host>
    <port>${SSH_PORT}</port>
    <credentialsId>${CRED_ID}</credentialsId>
  </launcher>
  <label>${LABELS}</label>
  <nodeProperties/>
  <userId>${USERID}</userId>
</slave>
EOF


What are the responsibilities of a project manager in a DevOps project? A project in DevOps should logically change the management mechanisms.
What are the responsibilities of a project manager in a DevOps project ?

Note: A project DevOps of what I understand is a project that has a beginning and an end, it is a temporary effort to create a product or a unique result and that uses the concept DevOps to produce a software.

Truth would be that should not happen in a DevOps environment
.
Your "project" will probably use Agile concepts, but there's nothing in DevOps telling how a project has to be run because DevOps is product centric (more details on the blog post and with search on this term).

"DevOps" is about breaking silos and have a team composed of developers, architects, ops, exploitation peoples who handle a software on its lifetime, that is antagonistic with the waterfall project approach.

To quote here Jez Humble:

  Products not projects

So your answer would be : There's not responsibilities for a project manager on a DevOps product because the main idea behind devops is to have a team handling the product on long term and not on a planned project time only.


Is there a common name for describing "spans" of versions? I'm looking for a way to pithily define a abstract term that declares all versions that a bug effects, or that a feature behaved a certain way.  For example, feature X worked way Y in versions 1.3 to 1.5, but then they changed it.  I thought of calling 1.3 to 1.5 a "version span", but wondered if there was some common terminology that I would not have to explain all the time to everyone?

This could get more complicated for bug fixes that are done on different minor versions of multiple major versions.  For example, a bug that was first introduced in 1.4 and fixed in versions 1.6 and 2.2.  2.1 also exhibits the bug because 2.1 branched from 1.4.  So now you have a "version span" of 1.4 - 1.6 & 2.1 and all their patch versions and build versions etc.

I have never heard of a common name for what you describe; and rarely, if ever, have I seen a notation where someone references to something which has a "begin" and "end" version. It just is not that applicable in a general fashion; this is probably why there is no such name. Also changelogs usually don't contain this information except for extremely bad breaks that need some kind of notice about which span(sic) of versions one should rather stay clear of.

The closest you could get to a common name (popularized by Jira, for example) is probably to call 1.3 in your example the "affected version", and 1.5 the "fixed version"; possibly allowing multiple values there. But they also have no name for the span as an entity.

Note that it is not really a problem if you have multiple old maintenance releases like you are describing. Those would just lead to multiple spans distributed over the branches.

Regarding your edit:

  Instead of having to look through release notes this would be a table of features mapped to versions. Release notes typically have "bugs not fixed" but release notes never show bugs not yet found. My customer has multiple variants/branches of systems deployed all over the world, and wants a quick and easy way to know which variants and deployments have which features and bugs.

Been there done that. You are doing well to approach this with care, it can really "explode" after a while. If you are using a tool like Jira, you should really find a field for each issue which allows you to mention releases related to the issue. If you decide do go manually, just list your version ranges in whatever format seems right to you.

I would not bother with finding a name for a range of versions, but just call them "affected versions".


Error when using 'ansible-local' provisioner with Docker container I'm getting an error when running the ansible-local provisioner with a docker builder in Hashicorps Packer.

My template (template.json):

{
  "builders": [
        {
            "type": "docker",
            "image": "ubuntu",
            "commit": "true"
        }
    ],
   "provisioners": [
        {
            "type": "shell",
            "inline": ["sudo apt-get update"]
        },
        {
            "type": "shell",
            "script": "setup_ansible.sh"
        },
        {
            "type": "ansible-local",
            "playbook_file": "./kubeadm.yml"
        }
   ]
}

The error:

docker: Executing Ansible: cd /tmp/packer-provisioner-ansible-local/5a8f3bad-8413-16c3-b255-6a06a9076ef3 && ANSIBLE_FORCE_COLOR=1 PYTHONUNBUFFERED=1 ansible-playbook /tmp/packer-provisioner-ansible-local/5a8f3bad-8413-16c3-b255-6a06a9076ef3/kubeadm.yml --extra-vars \"packer_build_name=docker packer_builder_type=docker packer_http_addr=\"  -c local -i /tmp/packer-provisioner-ansible-local/5a8f3bad-8413-16c3-b255-6a06a9076ef3/packer-provisioner-ansible-local135505282
docker: ERROR! the playbook: packer_builder_type=docker could not be found

It seems that there is some bug in Hashicorps Packer 1.2.0, consider downgrading or upgrading to v1.2.1, comments in GH issue page confirm that the deployed fix is working.


Ruby and Rest service in Docker I am new to DevOps on the Ruby stack. I have Ruby on Rails application. It uses several Rest based service. Each of the services is deployed with Docker. There are no DevOps efforts now. We use Gitlab as SCM, I am assigned to do the DevOps to help the developers. We want to have three environments (development, staging, production).

I have set up an AWS Elastic Container Registry to host docker images. Two accounts (DevOps and developers) so that Gitlab CI/CD pipeline can build and upload images when developers commit code in dev, release branch respectively.

I am not sure how to handle the developer workflow. e.g. Developers testing the microservices locally. I believe the developers have to pull the images every time they need to test one of the microservices. How will a developer know that an image was updated when some other dev has updated the AWS ECR registry.

I am confused. I would like to get some suggestions on how to support the continuous development and do the continuous release for all environments. Any suggestions or pointers to books or courses that I can get more information around this is also helpful.

Actually you need to implement per feature branch deployment. Because development environment use for testing app before QA.
And feature branch deployment is very difficult to implement especialy at the begginging of devops.

May be at start will be enough to use docker-compose to build latest version of developer's application. On their localhost.


Can you remove a commit made to a branch on AWS code commit? I know of git rebase but don't know if it can be used with AWS code commit?
Or if there's any other method of removing a commit to revert back to before it was made and merged?

Simplest answer is to just revert the commit.  AWS Code Commit is standard Git and will support everything Git allows you to do.
I.e. find commit hash:
git log -n1
commit 444c954e458cc446e2a7a1f2659adf71bdf55580 (HEAD -> my-branch, origin/my-branch)

Then do the revert:
git revert 444c954e458cc446e2a7a1f2659adf71bdf55580
git push

It'll revert your repo to whatever state it would be without that specific commit.  Note that if you have other commits that modified the same files afterward, you will have a merge conflict and will have to fix them manually.


See Azure DevOps WorkItems/Tasks in Planner? We are using Microsoft Teams and Planner since a while. Now we are migrating from Bitbucket/Bamboo to Azure DevOps.
If I create a Team in Microsoft Teams with a Planner-Board, I can see all my tasks in Planner. But when I have tasks in Azure DevOps, I can't see this tasks in Planner. Teams and Azure DevOps is connected to Azure AD. Is there a way to show DevOps-Tasks in Planner?

I don't think that this feature is currently available out-of-the-box.  However, you can build a Poower Automation Flow or Logic App that integrates the two of them.
In the long run, I would suggest that you remove Planner from the equation, and just use the kanban board in Azure DevOps for task management. You can display the kanban board inside Teams as well.


Are there any best practices and/or tools for cleaning old Docker images on a regular basis? Is there an elegant way or a best practice when it comes to deleting old images from the Docker registry?

I see a lot of requests/issues here: https://github.com/docker/docker-registry/labels/delete, but didn't find a good/popular solution for it.

So, is there a tool or a technique which would help me do that?

Also, is there any best practices which you follow while doing it?

I've had good luck with
Spotify/docker-gc. It can be run from cron or as a docker container.

  A simple Docker container and image garbage collection script.

  Containers that exited more than an hour ago are removed.
  Images that don't belong to any remaining container after that are removed.


Jenkins: how to run task every 30 days Jenkins version is 2.235.5 (I should update it to next LTS version 2.249).
I configured Jenkins to run a job periodically every 30 days: Build Triggers → Build periodically → Schedule:
H 3 */30 * *

And now I see:

Would last have run at Saturday, October 31, 2020 3:20:39 AM EDT; would next run at Sunday, November 1, 2020 3:20:39 AM EST.

So it will be started again after 1 day, not 30 days…
How to run a job periodically every 30 days?
Update: history of Jenkins "predictions" for schedule above (job was created October 28):

Would last have run at Thursday, October 1, 2020 3:20:06 AM EDT; would next run at Saturday, October 31, 2020 3:20:06 AM EDT.

Would last have run at Saturday, October 31, 2020 3:20:39 AM EDT; would next run at Sunday, November 1, 2020 3:20:39 AM EST.

Would last have run at Sunday, November 1, 2020 3:20:43 AM EST; would next run at Tuesday, December 1, 2020 3:20:43 AM EST.

In short, it's not practically possible. This S/O answer is quite detailed.

Jenkins used a cron
expression, and
the different fields are:
MINUTES Minutes in one hour (0-59)
HOURS Hours in one day (0-23)
DAYMONTH Day in a month (1-31)
MONTH Month in a year (1-12)
DAYWEEK Day of the week (0-7) where 0 and 7 are sunday

cron syntax simply does not support every n days.
An impractical option wuld be to have a daily job with a Conditional BuildStep to calculate if this day is n × 30 days from a given fixed day and abort if not..
But every 30 days doesn't really align w/calendar anyways, so is that really the intent?


GitHub Actions Runner execute commands with sudo GitHub Actions I have a GitHub action set on self hosted Ubuntu VPS on Linode.
I ran sudo ./svc.sh install and then ./svc.sh start. The runner is up and working but I have a command in my yaml file that needs to run as sudo. I have this command in sudoers file to run without sudo
%sudo ALL= NOPASSWD: /bin/systemctl restart twentydb.service
But still when I push on the server the following error occurs.
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
name: restart the service
run: |
sudo systemctl restart twentydb

I also need to set up 2 more runners on the same server and same setup.

airtower-luna from GitHub community answered it here and it worked for me
Answer pasted below:
The command in your workflow file is not the same as the one in your sudoers file, sudo doesn’t know they are functionally equivalent. Use twentydb.service in the workflow, too.
Also, is the user your runner runs as in the sudo group? If not, that entry won’t apply to it. However, I’d suggest using a separate entry for the user rather than adding the runner to the sudo group.


How can we automatically transition Epic Jiras based on the transitions of underlying Jiras? We are keeping track of our software development and engineering components in Jira by having Epics to contain all of the Jiras required for a deliverable.

We would like to have our Epics transition automatically, based on some simple rules applied to the transitions of the underlying Jiras.

For example, the first underlying Jira that moves to "in-progress", should automatically transition the parent Epic to "in-progress"; and the last Jira that moves to "done" should automatically transition the Epic to "done".

Is there any way to set up triggers to automatically transition Epics based on the transitions of underlying Jiras?

I think this link on the Atlassian Community forum may be what you're trying to do.


Can Terraform pull down the newest state file by itself? We started using Terraform to create VMs in some Cloud Providers.

But we are a team with several people.

Terraform has a state file.

Whenever someone changes something via Terraform, ex.: creating, decomming VMs, that state file need to be again sent to the others too, or else, when the others open their terraform, it will re-create the decommed VMs or destroy existing ones since they had old state file.

My question: Can Terraform pull down the newest state file by itself? Or manually, before doing anything, humans needs to be trusted to "always download the newest state file"? Humans will make mistakes..

Did you try to use remote state storage like S3?

Also you can use Terraform Cloud to organzie workflow and have the shared state.


Change Ansible module based on variable or group There are many Ansible Network modules (for example: ios_user, asa_user, nxos_user) which share the same (or similar enough) interfaces. Currently, my playbook has to conditionally execute tasks based on the host's group or variables. This leads to a lot of duplicated code as the only real difference between the tasks is the module name.

Is there a way to select the module to be run based on group or variable values without adding extra tasks, roles, or playbooks?

For example, this is how the playbook currently looks:

- hosts: ios
  tasks:
    ios_user:
      provider: "{{ cli }}"
      ...
- hosts: asa
  tasks:
    asa_user:
      provider: "{{ cli }}"
      ...
- hosts: nxos
  tasks:
    nxos_user:
      provider: "{{ cli }}"
      ...

I'd love to have something like this:

- hosts: all
  tasks:
    {{ module_name }}:
      provider: "{{ cli }}"
      ...

I swear I saw some feature like this in passing, but I'm having a hard time finding it again. Along with version 2.5 making netconf_cli a first-class connection type, this would solve a large number of problems and inconveniences in our org.

Elaborating on @030's answer, here's how you can use variables for modules:

You need to group the target hosts in groups, for the example I'm using server1.example.com as member of hosts1 group and server2.example.com as member of hosts2 group.
You create group variables:

group_vars/hosts1
group_vars/hosts2

Both files contain a variable named module with different value, in the test I use stat.

Your playbook will look like this:

test.yml

---
 - hosts: all
   user: me
   tasks:
     - name: test module variables
       action: "{{ module }} path=/home/me/myfile"

The result of the play:

[me@myserver]$ ansible-playbook test.yml -i test

PLAY [all] ********************************************************************************

TASK [Gathering Facts] ********************************************************************
ok: [server1.example.com]
ok: [server2.example.com]

TASK [test module variables] **************************************************************
ok: [server1.example.com]
ok: [server2.example.com]

PLAY RECAP ********************************************************************************
server1.example.com        : ok=2    changed=0    unreachable=0    failed=0
server2.example.com        : ok=2    changed=0    unreachable=0    failed=0


How to assign static ip in docker for Windows for linux container? I want to assign static ip to my docker container in docker for Window for linux container.
I have achieved same in linux container using macvlan but macvlan doesn't support for docker for Windows.
Does any one have work around how can i assign static ip to my linux container so it directly expose to outside world without port mapping.
I have also tried to use transperent driver in window container with LCOW enabled but as my application need privileged and bind mount to cgroup window container can not be used.
Note:I have specific scenario to use static ip as port mapping is not working for my application.

You need create user define network

docker network create -d transparent --subnet=10.1.1.0/24 --gateway=10.1.1.1 TransparentNet3

Then you need run container with key --ip

docker run -it --name nano03 --network=TransparentNet3 --ip 10.1.1.1 someimage:sometag


Multi platform test on Travis-CI using Docker I am trying to write my .travis.yml to perform multi platform test on Travis-CI using Docker. The platforms I want to test on:

Ubuntu 14.04
Ubuntu 16.04
Debian 8
Debian 9

The whole concept in a nutshell is (for all 4 distros):

docker pull ubuntu:trusty
docker run ubuntu:trusty
Run make test inside the container (on my repo's clone)
Copy the result.xml back to Travis
Run scp result.xml ${SERVER_USER}@${SERVER_ADDR}:/home/${SERVER_USER}/result/

I know how to run scripts inside a docker container but how am I going to get the current branch inside the container and run make test on it make me go crazy.

Any help will be much appreciated!

This functionality is built straight into travis. Have a look at here.

Secondly you should not need to specify a branch as part of your make script as travis will triggered on a specific branch and therefore that revision would already be checked out.


Mass remove/add to multiple security groups cross region Would it be possible to create a script or use something like terraform to mass remove/add security group entries across several regions under the one account based on the security group name? Specifically we are allowing remote access to a few instances based on public addresses that are changing frequently, so updating manually has become tedious. Thanks!

Do you already manage your resources with Terraform or are you looking for something to iterate through your AWS environment to change those settings?
If you're currently not managing your environment with Terraform, you'll have to import your resources into Terraform before you can begin making changes to your environment.
Your request sounds more like something you'd use the AWS CLI or perhaps Ansible for. Terraform isn't intended to perform scripting tasks on an environment.


How do I edit my AWS ASG scheduled action useing the aws CLI my scheduled action is called training
my ASG is called temp_4_jenkins as I was planning to set up a pipeline on a Jenkins on my personal account to run the CLI commands.
aws application-autoscaling put-scheduled-action --service-namespace ec2 \
  --scalable-dimension ec2:instance:1 \
  --resource-id instance/t2.micro \
  --scheduled-action-name training \
  --schedule "cron(10 9 * * *)" \
  --scalable-target-action MinCapacity=0,MaxCapacity=0

I get back the error
An error occurred (ValidationException) when calling the PutScheduledAction operation: 1 validation error detected: Value 'ec2:instance:1' at 'scalableDimension' failed to satisfy constraint: Member must satisfy enum value set: [cassandra:table:ReadCapacityUnits, dynamodb:table:ReadCapacityUnits, dynamodb:index:ReadCapacityUnits, rds:cluster:ReadReplicaCount, comprehend:document-classifier-endpoint:DesiredInferenceUnits, elasticmapreduce:instancefleet:SpotCapacity, lambda:function:ProvisionedConcurrency, comprehend:entity-recognizer-endpoint:DesiredInferenceUnits, appstream:fleet:DesiredCapacity, dynamodb:index:WriteCapacityUnits, elasticmapreduce:instancefleet:OnDemandCapacity, rds:cluster:Capacity, cassandra:table:WriteCapacityUnits, dynamodb:table:WriteCapacityUnits, elasticache:replication-group:Shards, custom-resource:ResourceType:Property, sagemaker:variant:DesiredInstanceCount, kafka:broker-storage:VolumeSize, ec2:spot-fleet-request:TargetCapacity, elasticache:replication-group:Replicas, elasticmapreduce:instancegroup:InstanceCount, ecs:service:DesiredCount]
I found the command in the docs
https://docs.aws.amazon.com/autoscaling/application/userguide/application-auto-scaling-scheduled-scaling.html
Then tried to modify it to ec2s instances?
I might be missing something obvious but why is the error talking about RDS and fleets I want to edit the schedule on my auto-scaling group to change the number of ec2s that get spun up?

I just solved it using put-scheduled-update-group-action
aws autoscaling put-scheduled-update-group-action --auto-scaling-group-name temp_4_jenkins --scheduled-action-name training --start-time 2020-11-23T09:10:00Z --min-size 0 --max-size 0 --desired-capacity 0 --region eu-west-1 --output json


How do I run the InSpec using a wrapper profile? This blog post describes wrapper profiles in detail:

https://blog.chef.io/2017/07/06/understanding-inspec-profile-inheritance/

At the very end of the post, it references a Git repo that contains an example of using a wrapper profile:

https://github.com/adamleff/inspec-profile-wrapper-example

When I clone the repo, cd to the controls folder, and attempt to run these tests:

inspec exec controls_from_other_profiles.rb

I get the following error message:

  Cannot load linux-baseline since it is not listed as a dependency of
  tests from controls_from_other_profiles.rb.

  Dependencies available from this context are:

The dependencies are defined in inspec.yml.

How do I correctly run these tests?

I stumbled across the answer.  From within the profile directory, run this command:

inspec exec .

Don't forget to set the depends key in inspec.yml.


Why could the encrypted Ansible files not be decrypted although the vault password file has been set? Follow-up to this Q&A.

According to this and this documentation it should be possible to define a default vault password file by specifying vault_password_file = ~/.vault_pass.txt in one of the following files:

* ANSIBLE_CONFIG (an environment variable)
* ansible.cfg (in the current directory)
* .ansible.cfg (in the home directory)
* /etc/ansible/ansible.cfg

Although the password file exists and the log indicates that the ansible.cfg is used that contains the definition, the decryption fails:

user@host$
Using /etc/ansible/ansible.cfg as config file
ERROR! Decryption failed on /path/to/ansible/group_vars/production/vault

Discussion

  Is the pass correct for this vault?

Yes. When ansible is run using --vault-password-file=~/.vault_pass.txt the decryption succeeds.

  Just so that we're clear - the name of the environment variable is ANSIBLE_VAULT_PASSWORD_FILE, correct?

No. When this variable is used it works, but the aim is to set it in the ansible.cfg by setting /etc/ansible/ansible.cfg.

  What Ansible version is used?

user@host:/dir$ ansible --version
ansible 2.2.2.0
    config file = /etc/ansible/ansible.cfg
    configured module search path = Default w/o overrides

  Does using a full path in the config works?

The decryption failes as well when the full path instead of ~, i.e. /home/user/.vault_pass.txt was specified.

I found an issue with Ansible/Python causing a failure to decrypt.

Specifically, Ansible 2.7.10 and 2.7.13 under Python 3.6.8 on Ubuntu 18.04 would not decrypt (using ansible-vault edit -vvvvv) a vault file that was identical to file that decrypted OK on macOS 10.13 using Python 3.7.2 with same Ansible versions.

Upgrading to Python 3.7.3 on Ubuntu (using apt-get install python3.7 on 18.04) fixed this.

Your issue may be different, but if on Python 3.6 or lower, I would try upgrading to 3.7.


Why is Docker-in-Docker considered bad? In August 2013 Jérôme Petazzoni created Docker in Docker, dind for short, this allowed Docker containers to be created inside of Docker Containers, this functionality proved very popular resulting in Jérôme's GitHub Repository receiving over a thousand stars and three hundred forks.

As of Docker 1.8, released two years later in August 2015, Docker in Docker is directly supported by Docker out of the box.  However, the use of Docker in Docker comes with a warning, seemingly related to Jérôme's Post: Using Docker-in-Docker for your CI or testing environment? Think twice. which focuses on the reasons why Docker in Docker is not a great choice for Continuous Integration.

Why is it considered bad to use Docker in Docker?  Is it simply a case for avoiding Turtles all the way down? or performance considerations?

Continuous Integration Concerns

In short: Docker in Docker (dind) doesn't handle concurrency well.

The reason why you shouldn't use dind for CI is because Docker was designed to have exclusive access to the directory it uses for storage (normally /var/lib/docker). Dind doesn't respect this as all child processes use this directory concurrently. Every time you rebuild (from CI for example), anything related to your app in this directory could get wiped out and forced to start from zero. How would your users like it if they entered their payment details, clicked "Purchase", and suddenly found themselves back on the login screen as if they'd never done anything? That's just not good UX. Two rebuilds occur at once? That's really going to end badly for everyone involved (including your data integrity).

Other Concerns

From the link the OP posted, security concerns arise as the system will try to apply security policies in a very "CSS-like" fashion where a lower container could have access to an outer container's resources unless explicitly prohibited. Remember when you could access web server resources by doing something like "mywebsite.com/../another_folder/private_resource.txt"? Also, sometimes filesystems just don't play well with each other when they're nested in this way.

The Fix

Thankfully, the blog post in the OP has a good solution for the issue. Unless your needs are not met by "build/run/push Docker containers from your CI system itself running on Docker", you can use -v mode (add a data volume to your container) on the Docker socket (usually /var/run/docker.sock:/var/run/docker.sock) to allow the kind of access you need to the "shared" data volume. These containers will be started alongside the parent, instead of underneath, forcing synchronous IO. Now you have the same thing (almost) as dind but without the downsides that come with Docker not being build for concurrency.

Reference (from OP): Using Docker-in-Docker for your CI or testing environment? Think twice.


Which option do I select for Security Group Source? I am developing my Security Group for a VPC that has my Elasticbeanstalk, RDS and ElastiCache services and I am at this dashboard:

Under Source, it used to be that you could select sg-0x12345-my-application, but now it only gives you the option of Custom, Anywhere or MyIP and I am not sure which one is the equivalent to selecting the security group for the architecture I am building this SG for.

Use Custom and then start typing sg-... and it should pop up a list of available groups.


azure activity log, how to find releases My security department has asked to ingest logs from Azure with the goal being to identity releases. The security team wants to be able to say:

  Hey, there was a release on mm/dd/yyyy at noon (because we see it in the Azure logs), show me the
  corresponding internal approval for that?

I've been looking around in the Azure Activity Log, but I can't seem to find anything related to releases, overwrites, or anything else that's clearly new-code being dropped onto a PaaS instance.

Like I'm pretty sure there was a release (devops build/release, pushed the code to a Paas) during this timeframe but I'm not seeing it.

Is there a way to do this? Am I barking up the wrong tree?

Edit: my little highlight there on the "Write Event" isn't related, just something that happened to a database at the time.

Activity Logs can only able to show the resource level logs like creating a resources,deleting a resources modify the SKU of the resources etc,

Assuming from your question you are saying web app deployment from azure devops,which is more like a deployment of code to an existing webapp which will not be covered by activity logs. You need to go to that azure app service then you can that deployment details in Deployment Center


Multiple builds from one branch but different CSS values Looking for advice on how best to configure my workflow.

I have an application, that we currently customise for clients (white label) but our OLD devs have made the deployment of this very messy, multiple branches for each client. So merging is a nightmare and some clients are missing features etc.

The only difference between the clients version of our app, is some minor CSS changes and a couple of images.

We currently build with Jenkins and host with AWS Elastic Beanstalk.

What my question is, once we have merged and corrected the issues with the old developers. Am I able to trigger a single or multiple builds, from 1 branch and replace all the CSS values in my app and a couple of images? So we can just push to our master branch and build our production app and also all our clients white labels

If I correct understand Your problem, You want to build app with diffrent ccs and images.

Jenkins suports maven and simplest way is to use maven profiles plus maven-war-plugin
eg.:

<build>
<plugins>
    <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-war-plugin</artifactId>
        <configuration>
            <webResources>
                <webResource>
                    <directory>src/main/profile/webapp/${images.folder}</directory>
                    <targetPath>images</targetPath>
                </webResource>
            </webResources>
        </configuration>
    </plugin>
</plugins>

<profiles>
<profile>
    <id>prod_client_1</id>
    <properties>
        <images.folder>prod_client_1</images.folder>
    </properties>
</profile>
<profile>
    <id>prod_client_2</id>
    <properties>
        <images.folder>prod_client_2</images.folder>
    </properties>
</profile>

For other resources filtering maven-resources-plugin

At least should be helpful this approach sharing resources across projects


Getting error while trying to communicate with apiserver in kube-state-metrics pod I am getting error:
# kubectl logs  kube-state-metrics-fdc49658-g98sl -n monitoring
I0523 11:30:25.206556       1 main.go:86] Using default collectors
I0523 11:30:25.206766       1 main.go:98] Using all namespace
I0523 11:30:25.206800       1 main.go:139] metric white-blacklisting: blacklisting the following items:
W0523 11:30:25.206886       1 client_config.go:543] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I0523 11:30:25.216265       1 main.go:184] Testing communication with server
F0523 11:30:55.217773       1 main.go:147] Failed to create client: error while trying to communicate with apiserver: Get "https://10.96.0.1:443/version?timeout=32s": dial tcp 10.96.0.1:443: i/o timeout

Here is the manifest for Kube-state-metrics:
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kube-state-metrics
spec:
  selector:
    matchLabels:
      app: kube-state-metrics
  replicas: 1
  template:
    metadata:
      labels:
        app: kube-state-metrics
    spec:
      nodeSelector:
        boardType: aarch64
      serviceAccountName: prometheus
      containers:
      - name: kube-state-metrics
        image: carlosedp/kube-state-metrics:v1.9.6
        ports:
        - containerPort: 8080
          name: monitoring
---
kind: Service
apiVersion: v1
metadata:
  name: kube-state-metrics
spec:
  selector:
    app: kube-state-metrics
  type: LoadBalancer
  ports:
  - protocol: TCP
    port: 8080
    targetPort: 8080

This doesn't look like kube-state-metrics but your node configuration/networking issue. You will need to debug node to node communication. I would start by checking on which nodes the kube-state-metrics is scheduled and launch a temporary pod on that node to see if you can access the API Server pod correctly. The error could be in subnet, security groups/ firewalls, or other networking and security-related components.


How to make Jenkinsfile credential visible to many stages In Jenkinsfile, I want to make an ssh key visible to all stages in the pipeline.

From the official document, I learned that:

environment directive is used to defy environment variables for used within Jenkinsfile
The scope of the variables defined depends on the placement of the environment directive
One can set the some types of credentials insideenvironment directive with the help of the credentials helper
The types of credentials supported by the helper are:

Secret text
Usernames and passwords
Secret files

For other types of credentials, the document suggests using the snippet generator, which generates a step.

Example of an ssh key step

withCredentials([sshUserPrivateKey(credentialsId: 'jenkins_aws_to_bitbucket', keyFileVariable: 'BITBUCKET_PRV_KEY')]) {
    // some block
}

This is meant to be used in a stage like:

pipeline {
    agent {
        // define agent details
    }
    stages {
        stage('Example stage 1') {
            steps {
                withCredentials(bindings: [sshUserPrivateKey(credentialsId: 'jenkins-ssh-key-for-abc', \
                                                             keyFileVariable: 'SSH_KEY_FOR_ABC')]) {
                  //
                }
                withCredentials(bindings: [certificate(credentialsId: 'jenkins-certificate-for-xyz', \
                                                       keystoreVariable: 'CERTIFICATE_FOR_XYZ', \
                                                       passwordVariable: 'XYZ-CERTIFICATE-PASSWORD')]) {
                  //
                }
            }
        }
        stage('Example stage 2') {
            steps {
                //
            }
        }
    }
}

Snippet source

Question

If the steps are within a stage, are these credentials visible within other stages?
If not, how to make these credentials global ~ visible within all stages

No, the credentials will only be visible within the block passed to withCredentials, not outside of that.
There is no way to make the credentials globally available without switching to Scripted Pipeline.  With Scripted, you can wrap your entire job in withCredentials.  This is not possible with Declarative.


Is there a way to make Prometheus to scrape only the metrics which are present in Grafana? As a customer of Grafna Cloud, I need to minimize the number of DataSeries that are being sent (remote_write) to Grafana Cloud, to avoid being overcharged for metrics that I don't really use.
This can be done by filtering out the metrics that I don't use in my Grafana dashboards, is there a way to do that automatically? Without having to write down all the metric_relabel_configs rules manually?

I haven't found any way to do that, so I created a simple CLI based on Python, which can assist with the task - make sure you don’t scrape metrics in Prometheus, which you don’t present in Grafana dashboards.
frigga - https://github.com/unfor19/frigga


salt-stack: capture group for regex include_pat is it possible to have a capture group with include_pat when copying files ?

I would like to do something like that:

copy_template:
    file.recurse:
    - name: '{{ service_path }}\$1'
    - template: jinja
    - include_pat: E@^(.*)\.template$
    - source: {{ pillar['locations']['systemtoolsfolder'] }}\

A capture group is a type of backreference. Saltstack, being python based, uses the re.match object to do regular expression matching, which appears to support backreferences, so these backreferences are allowed.
However, you be unable to pass the value of the backreference \1 in the - include_pat field back to - name because the - name field is never processed by the re.match object. Even if it were, variable scope would prevent you from sharing the backreference between re.match calls.
Instead, you will need to do one of the following:

Rename all the files in - source from myfile.conf.template to myfile.conf

Use cmd.run to do a batch file rename after your file.recurse and add to your file.recurse an onchanges pointed to a previous event in order to defeat the idempotency (that is, to prevent it from writing out the .template files every time salt runs). You will also be sure to use a require and onchanges in your cmd.run that references copy_template
This will have the unfortunate side-effect that you will never be able to update your jinja templates. You will only be able to deploy them the first time - at least not without first deleting what is there, and then re-writing and re-copying from the source.

Use file.managed for every template file.

For example:
copy_template1:
  file.managed:
    - name: '{{ service_path }}\template1.conf'
    - template: jinja
    - source: {{ pillar['locations']['systemtoolsfolder'] }}\template1.conf.template
copy_template2:
  file.managed:
    - name: '{{ service_path }}\template2.conf'
    - template: jinja
    - source: {{ pillar['locations']['systemtoolsfolder'] }}\template2.conf.template
...
and so forth


Persistent data in MySQL with Docker If I startup MySQL server during docker build (derived from official MySQL Dokcer Image) in two different statements, would be database files be pertained?

I would say yes, but it seems to be wrong. Why?

Logfile:

180228 08:54:50 mysqld_safe Logging to '/var/lib/mysql/c2712433a4da.err'.
180228 08:54:50 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
mysql: [Warning] Using a password on the command line interface can be insecure.
mysql: [Warning] Using a password on the command line interface can be insecure.
Tables_in_FOOBAR
address
category
Removing intermediate container b3ff83bbf273
 ---> 0b366a0d31a9
Step 9/9 : RUN chmod 777 /var/lib/ -R && ./ingest_data.sh
 ---> Running in 149361f7d465
180228 08:55:00 mysqld_safe Logging to '/var/lib/mysql/c2712433a4da.err'.
180228 08:55:00 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
mysql: [Warning] Using a password on the command line interface can be insecure.
Database
information_schema
mysql: [Warning] Using a password on the command line interface can be insecure.
ERROR 1049 (42000): Unknown database 'FOOBAR'

As you can see, in the first RUN statement I can list tables I have created in a new database, but in the second RUN statement the database is gone.

Note. Normally, you would not transport your application data in production containers (immutability principle) but for demo and test purposes this can be nevertheless useful.

That's a known issue .. since image layers are built using containers, data saved to folders does not make it to the next layer or your final container

Removing intermediate container b3ff83bbf273

If you want data to persist between updated containers you have to manually map data to the host outside the container-specific mount points.

For example, when creating a container use the -v option to map a volume:

docker run -d -v /var/container_data/mysql:/var/lib/mysql mysql_image

For a detailed documentation
https://docs.docker.com/engine/reference/run/#volume-shared-filesystems


Ansible: Copying different files to different guests for use with the same role I have a role, let's call it apache2. The role installs apache2 and all of its dependencies.

Now I have two machines, let's call them M1 and M2. Both M1 and M2 need to have apache2 installed. However, each of them needs their own set of files installed into the web root. So M1.yml looks like:

---
- hosts: M1
    - role: apache2

M2.yml looks like:

---
- hosts: M2
    - role: apache2

Obviously I can't just put the files into the role's files directory, as they are different for each. Options of which I am aware:

Create a post_tasks section for each playbook that copies over the necessary files and configures the server.
Create a copy_files role that takes the files as a variable

The reason I don't like #1 is because I might have a bunch of similar roles (apache2, nginx, ftp, etc.) each of which requires installation and files to be copied over. I'd like to keep each "together", meaning that the "install apache2" and "copy apache2 files to guest" tasks are both specified near each other in the file.

The reason I don't like #2 is because it seems heavyweight to basically just wrap a task as a role.

Is there another option I'm not thinking of? And of the available options, which is considered best practice?

Another approach that I found uses the include_role directive. So instead of the playbook being:

---
- hosts: M2
  - roles:
    - role: apache2

It becomes:

---
- hosts: M2
  - tasks:
    - include_role: apache2

Then I can add tasks directly after that apache2 task that configure apache2:

---
- hosts: M2
  - tasks:
    - include_role: apache2

    - copy:
        # etc