# Question
Title: Approaching user adds and edits with Ansible
I am going to be attached to a small project that basically organizes the users in a cluster of AWS Linux servers. The servers users assigned have different UIDS and maybe different GUIDs. I am hoping to use Ansible to fix this up and organize users better. I can get Ansible to run on a test environment but one thing has got me nervous is that `/etc/passwd` gets completely screwed up! So my questions are as follows:

1. Would a better approach be to overwrite `/etc/passwd` using Ansible. So basically I have a template of `/etc/passwd` and use a combination of Jinja2 and Ansible vault to rewrite the values in `/etc/passwd` (I am currently doing this with `sudoers` and it works well)? If this is the case, would I need to do anything with `/etc/shadow` or am I safe there?
2. Is Ansible smart enough where I won't need to use `/etc/passwd`? For example, I have user `bob` assigned to UID 5001 when he should be consistently assigned 5002. If I was to readd the user using the users module and specifically assign 5002 to his UID, would that work better?

Please let me know if you need any more information.

# Answer
> 4 votes
## If editing critical flat-files across multiple servers in one place is too scary..

One approach I have often recommended is to let system users reside in /etc/passwd files, and to add an additional Name Service Switch (NSS) source for humans that need to log in. For big projects (lots of users authenticating against the PAM user data), that means LDAP, and for small ones (few can be hundreds of such users), nss\_db + pam\_userdb.

With multiple NSS and PAM sources for users, you can avoid disabling a server when the human user accounts distribution fails for whatever reason. Services (like your privileged Ansible account) should always depend ONLY on the standard /etc/passwd files. LDAP (or even MySQL) is probably overkill for some cases (like yours).

Consider the old BDB backed gems, designed originally (for big FTP file distribution servers) to provide faster logins than /etc files, but otherwise work nearly the same. They store the same passwd and groups flat files' content, but loaded into a (now non GPL) BerkeleyDB NOSQL key/value database file which is faster to read. For this purpose, it's just an extra place to store user/group authentication/authorization data.

## NSS

https://en.wikipedia.org/wiki/Name\_Service\_Switch

https://www.systutorials.com/docs/linux/man/5-nsswitch.conf/

https://sourceforge.net/p/nssdb/home/Home/

## PAM

https://en.wikipedia.org/wiki/Linux\_PA

https://www.systutorials.com/docs/linux/man/8-pam\_userdb/

https://www.cyberciti.biz/tips/centos-redhat-vsftpd-ftp-with-virtual-users.html

## steps

1. collect your passwd, shadow, and group files on a secure server with the nss\_db Makefile
2. build the nss passwd and group db files using the provided nss\_db Makefile
3. extract the users and password hashes from shadow file and build PAM db file

```
awk -F: '{print $1;print$2}' shadow > users.txt # used like the vsftpd vusers.txt example

db_load -T -t hash -f users.txt pam-users.db

```
4. distribute the files to somewhere appropriate on your target servers (maybe /var/db/authdb/\*.db)
5. set up the target servers' pam.conf and nsswitch.conf files to use these db files
6. Steps 1-4 are the repeatable build/deploy process.

## why?

* Once you have working pam/nss configs, your risk of breaking services by updating/corrupting user auth/auth is very low.
* User authentication will work on each server with no external network dependencies like LDAP or MySQL etc.
* You can treat the DB files as immutable artifacts on the farm to reduce/prevent user auth snowflakes even if you can't have immutable servers.

---
Tags: ansible, amazon-ec2
---


# Question
Title: How to scale-down in a multi-tenant environment?
Cloud environments in AWS allow for multi-tenancy managed by the user himself, classic example are container orchestrators such as ECS or Kubernetes.

When you have two services, one needs memory another cpu and you put these in a single cluster. Then scaling-up is relatively trivial. Each time you need more capacity in terms of *either* cpu *or* memory, add more capacity. Since EC2 capacity means units in cpu and memory both.

*Scaling up* based on a single metric can very easily achieved using CloudWatch Alarms.

When *scaling down*, in order to reduce cost it requires to take into account both memory and cpu limits and not let any of the two drop below the required amount.

Since unfortunately CloudWatch Alarms do not allow to use boolean logic or take into account multiple metrics.

**What is a good way to implement *scale down* of capacity for an auto scaling group?**

# Answer
# Autoscaling is a good case for machine learning

## This is a hard problem to do well.

What you really want is something like Nest Thermostat for your EC2 infrastructure.

## There are (aforementioned) multiple dimensions of resource demand/limitations.

* CPU
* memory
* disk space
* disk IO
* network IO
* concurrency/latency/queue depth

## There are multiple indicators of demand (in addition to the above).

* concurrent unique visits/sessions
* pages per visit/session
* rate of engagement/interaction feature usage

## There are multiple common patterns of changing demand over time.

* daily user demand cycles
* weekly user demand cycles
* monthly ...
* annual ...
* special event/days
* DDoS load
* media/marketing exposure traffic spikes

## There are multiple financial decision factors.

* does revenue scale with traffic? How? (How conservative do you need to be?)
* is there a hidden cost to control (transaction costs, limits)?
* what's the cost model of scaling? (things in a pipeline scale together, things in a load-balanced cluster scale independently)

Before long, if you try to hand-optimize on hand-selected features you're going to have a monster of technical debt that is possibly more complicated than any other logic in your site. Amazon makes more money when you err (with a large margin) on the side of caution, so their tools will probably never get close to what you want.

Instead, choose an architecture/technology stack that can grow/scale so you don't have to get it exactly right the first time. Then pick a few factors which you think are obvious. Then try to come up with a way to sort multiple representative possibilities in order of preference. Then collect some real world data covering all those points. If you're lucky, a simple obvious hand-coded solution will jump out at you from looking at the data. If not, code up something that will give you an approximate model f(x1,x2,x3,x4) --\> y * app nodes, using an appropriate algorithm.

I bet you didn't think this one was going to be so much fun!
> 2 votes

# Answer
To be able to scale in with confidence on ECS, there's a few strategies:

* Create a 3rd custom metric which tracks the greater of the two metrics. For example, if CPU allocation is at 60% and memory allocation is at 70%, the metric should be set to 70%.
* Choose one of the two resources (CPU or memory), and always allocate a higher percentage of it to each container compared to the other resource. This way, you will always reach a shortage of your preferred resource before the other, and you don't have to worry about scaling up or down on it. While this is the easiest solution, the obvious downside is that you can't optimise for services that may be CPU or memory intensive, and you may end up with wasted resources.
* Do autoscaling without using CloudWatch metrics. Tools such as https://github.com/ameir/ECSpander are available to assist with this.

Kubernetes doesn't use CloudWatch metrics for scaling, it manages scaling by setting the ASG desired number of instances through internal mechanisms and therefore isn't subject to the issue you've described.
> 1 votes

---
Tags: amazon-ec2, amazon-cloudwatch
---


# Question
Title: Is there an image on dockerhub that is able to run make?
When one searches for make on dockerhub multiple images are returned, but none of them seems to be able to run make.

# Answer
> 5 votes
GNU `make` can be found in the gcc container.

> Compile your app inside the Docker container There may be occasions where it is not appropriate to run your app inside a container. To compile, but not run your app inside the Docker instance, you can write something like:
>
> $ docker run --rm -v "$PWD":/usr/src/myapp -w /usr/src/myapp gcc:4.9 gcc -o myapp myapp.c
>
> This will add your current directory, as a volume, to the container, set the working directory to the volume, and run the command gcc -o myapp myapp.c. This tells gcc to compile the code in myapp.c and output the executable to myapp. **Alternatively, if you have a Makefile, you can instead run the make command inside your container**

# Answer
> 1 votes
Depending on what language you want to build with, you can try some of these containers:

* Python: `lambci/lambda:build-python3.6`
* Nodejs: `amaysim/serverless:1.23.0`
* Golang: `amaysim/golang:1.8.3`

# Answer
> -1 votes
In my opinion there shouldn't be an image to run `make`, because if you want to build something from source you should install the dependencies and configure before run `make`, so I think it is just a command and you don't need an image to install it, even `make` is not a service to be in separate image, it must be used in `Dockerfile` to help you building your service from source during the image build time and not create a specific image for it.

---
Tags: docker, dockerhub, make
---


# Question
Title: Need a folder, always updated with the latest code from Git
I wonder if anyone knows of a tool or method that I can use to accomplish my goal of having a folder that always contains a copy of the latest code from my Git repository.

I need it to work generically with Git, as it may be hosted on VisualStudio.com, Bitbucket, GitHub or any other Git provider.

Background: I have a requirement to keep all the latest code in a big data store in Azure. It will be hundreds of repositories, frequently adding more. I find it more scalable to download the code from a folder rather than integrating directly with Git with that many repositories. So I am looking for some existing method or tool to go in-between and place a copy of the latest code from my Git repository in a folder.

# Answer
Use a Git post-receive hook to issue a `git pull` in the directory you want to keep updated. You might want to mount the directory you want to keep updated locally to the Git server, or execute that command remotely with `ssh` into Git Bash on Windows, or Powershell. Alternatively have the hook call a webhook and have the webhook execute the `git pull`. The webhook method will be easiest with BitBucket, I don't know about the others.
> 6 votes

# Answer
The standard pattern for this is to have a build that is triggered upon change to the git repository. The build will do nothing more than checkout the repository and make an archive of everything but the .git folder, then upload that to whatever file server(s) make(s) it available to all the things that need it. Implementation specifics depend on the git server, build server, file server, and build tool chosen but this should be trivial to implement in almost all cases.
> 4 votes

---
Tags: git, azure
---


# Question
Title: Monitor program progress on multiple servers
We have three servers that are running python programs that are running data analysis tasks inside a `tmux` session. The method we are using at the moment is ssh'ing into each of them connecting the `tmux` session and watching the output on the command line.

This method is tedious, so what we are looking for is a solution that automates monitoring of program progress(output on CLI) for multiple servers at the same time. We would ideally like a web UI solution but a CLI would also be perfectly suitable.

Thank you for reading.

# Answer
> 8 votes
Any time you're running ad-hoc long-running commands, you should step back and rethink your process, because that should be automated, including error handling.

Rather than connecting in to the servers to see status, a better approach is to push that information out. You can do a wide variety of things if your want to write a bunch of custom code, but the simplest thing is probably to start sending the output through syslog to a centralized logging system (syslog itself, or ELK, or whatever). That way you can monitor everything from a central location.

Thinking forward, if this isn't a one-off task, monitoring should be automated. That is, you should never have to just watch logs to see if things are progressing as they're supposed to. Instead, you should assume they are (and continue with other work) *until your alerting fires off*. This is an investment of time into getting reliable and wide-coverage alerting, but as your systems grow in complexity, it will pay off as you don't have to monitor **everything** any time you change **anything**.

# Answer
> 4 votes
## Graylog

Since two people already advised you to rethink your current process (which I second since it will cause you sleepless nights at some point ;)), I will go another route and recommend a specific piece of software which - in my opinion - fits most of your needs: Graylog.

I implemented and used a couple of ELK stacks for both log aggregation and business intelligence and also run/maintain graylog for about two years now at my current employer. I recommend graylog since it has the following features built-in and is - in my opinion - a bit easier to setup and maintain:

* A web-interface
* Multiuser capabilities
* Alerting

As far as I understand your scenario, it looks as if you need to act or be alerted on certain events that appear in your stream of log messages. If we look at the Graylog features:

> Trigger actions or get notified when something needs attention, such as failed login attempts, exceptions or performance degradation.
>
> Ideas: Send an email or Slack message to your team. Spawn a new machine to balance the processing load. Block IP ranges in your firewalls automatically when an attack is detected.

To give graylog a try I'd recommend the following two steps:

* Setup a dedicated host which is reachable by all you application hosts to run graylog (and its dependencies MongoDB and ElasticSearch)
* Send logs from your application to graylog (possibly as GELF messages)

Note: These two steps have the ability to fill pages and pages of best practices and should receive at least a couple of thoughts. Not to mention that graylog isn't a monitoring solution and graylog itself should be monitored by a proper monitoring tool (like e.g. Icinga, Prometheus, Nagios to name just a few).

# Answer
> 3 votes
I agree with @Xiong Chiamiov and I want to give more clarify option. If you want every line in the CLI to be monitored, I would suggest to redirect all the output to specific file and the error to another file, then use logstash or filebeat to send both of this files to Elasticsearch, then you can configure Logtril with Kibana to give you view, analyze, search and tail log events from multiple hosts in realtime with devops friendly interface

# Answer
> 1 votes
# centralized `tmux`

While the other answers are smarter and wiser for the long term I think the quick hacky CLI solution is worth mentioning. Run `tmux` on one server that can reach all of the others. A good place for this would be a jump box or some other place that folks are commonly logged in anyway. Within this "central" `tmux` ssh to each box in a different pane and tail whatever log files are necessary. You can use `ctrl`-`b` `"` to get more panes in one tab within `tmux`. Now all someone has to do to check things is attach to the "central" `tmux` session and they can see the whole cluster at a glance.

I spent a lot of time building the web UI solutions that you are working toward, but if you need it today hacking together something with `tmux` can save the day.

---
Tags: monitoring
---


# Question
Title: How to log outcome from multiple hosts in Ansible?
I've a playbook that runs EOS commands against multiple devices. Currently the whole thing is done in bash, creates one massive text file log and an engineer compares each day's log to the previous one for irregularities.

I'm attempting to have one simple playbooks that runs the commands and logs to json from which it'll be easier to automate the comparison, but I've just realised only logs from one device are saved as opposed to the two I'm testing against.

```
---
- name: Checks
  hosts: myhosts
  connection: local

  tasks:
  - name: Run Commands
    eos_command:
     commands:
      - show ip pim neighbor | json
      - show ip bgp summary | json
    register: result

  - name: Save to file
    copy:
     content: "{{ result.stdout_lines | to_nice_json }}"
    dest: "/home/homedirectory/results.json"

```

Would there be way to log both (and eventually all production) devices in the same file?

# Answer
This question has two approaches, and both has answers on SO:

1. Convert all Ansible output to JSON with `json` stdout callback and parse it with your favourite tools. The `eos_command` output for each device will be under different host key in the resulting json. See this and this.
2. Make `run_once` task to collect data from other hosts, like this:

```
- debug:
    msg: "{{ ansible_play_hosts | map('extract', hostvars, 'result') | map(attribute='stdout_lines') | list }}"
  run_once: yes

```

See this.
> 8 votes

# Answer
Use Ansible callback.

Stop looking at log files. Use log aggregation technology like Logstash.

https://github.com/ujenmr/ansible-logstash-callback

see also: https://groups.google.com/forum/#!topic/ansible-project/zOjsYxLN578
> 1 votes

---
Tags: ansible
---


title: Using Chef for multi-node operations

text:
# Question
Title: Using Chef for multi-node operations
I have an application I would like to configure using Chef that spans multiple nodes. Let's say that the process of doing it consists of

1. Do a thing on node A capturing the output
2. Do another thing on node B with that output
3. Back to node A now for some operation
4. Now on node B again
5. ...

One way to do this would be to write a recipe that stored the stage it was on on each node and just keep running it on both nodes repeatedly until eventually it had a chance to do all operations on all nodes. But this is clumsy and won't scale if there's node C, D, etc. I obv know about notify to sequence dependencies within a single node, but that won't work across multiple nodes. I can't be the only person who needs this, so is there a mechanism or a design pattern/best practice/TTP for this style of activity?

# Answer
> 6 votes
In short, Chef may not be the tool to use here.

Chef is a convergent model, so you have to write your recipes in an idempotent way such as after some runs it will be at the desired state according to the others nodes around.

Your approach about storing the state sounds the way to go, and you'll have to use an external orchestrator to schedule the chef-client runs alternatively on A and B.
If you have a chef-server, push jobs could be the way to go sticking in chef ecosystem, main advantage I see with it compared to others orchestrators is a pull model not needing an incoming administrative port nor ssh on the target nodes.

# Answer
> 3 votes
This is a textbook example of server orchestration and is something that Chef inherently is not intended to do. As noted by Tensibai, a server running Chef is a convergent system that achieves its own desired state based upon configuration settings set by recipes, attributes, data bags, etc. Without getting in to specific details about your infrastructure, a few approaches that you might be able to take are:

**Create independent idempotent operations**

As you stated in your question, creating a state of operation where your nodes could run repeatedly until all tasks have completed does not scale well. It may be possible however to redesign your nodes so that it doesn't matter. If nodes a and b run tasks to output their logs in parallel, and b completes before a, it could run the task that node a would normally run and vice-versa.

**Use an external orchestrator for delegation**

Using a delegator node will definitely scale much better if you intend to have many nodes to orchestrate. However, this could create conflicts with your chef client runs on the nodes being managed by the delegator. It would be very difficult to verify that your node configurations and the delegator node tasks do not conflict with each other. A clever way to manage this could be to incorporate the tasks in the configuration of each node and have the delegator set a value in a data bag or and attribute of the server to signal how it should configure itself (i.e. what tasks it needs to perform).

**Combine your infrastructure**

If each node runs it tasks serially depending upon the other nodes, and you have no cost/technical dependencies on running tasks on different nodes, You may want to consider combining your node configurations into one single node. This would eliminate any configuration conflicts you would have between any of your nodes. I imagine there are clear intentions for running your tasks on different nodes, but this is definitely an option to consider (maybe even at the cost of time to rewrite tasks for different nodes).

# Answer
> 1 votes
Use SaltStack to orchestrate your chef runs.

Your cross-node orchestration logic goes here https://docs.saltstack.com/en/latest/topics/orchestrate/orchestrate\_runner.html#more-complex-orchestration

And you can declaratively https://docs.saltstack.com/en/latest/ref/states/all/salt.states.chef.html

or imperatively https://docs.saltstack.com/en/latest/ref/modules/all/salt.modules.chef.html

drive Chef nodes to their desired state.

---
Tags: chef
---


# Question
Title: How do you monitor varnish cache inside a docker container?
How do you monitor varnish cache inside a docker container?

I have found many tools on Google relating to this but we are focusing only on `nagios` and `new relic`.

# Answer
> 2 votes
Varnish is monitored with what they call VSM. It's a file in your container. If you bind mount the folder where the files is, you can share the same folder / files in other containers that will be able to read it, and thus will be able to monitor your varnish instance. See the note about VSM and containers in varnish docs. I have been able to launch a `varnishstat` with statistics in a container with varnish in the image, but no varnish running, like this:

```
docker run --rm -it \
       --entrypoint=/bin/sh \
       -v /var/lib/docker/overlay2/$hash/merged/usr/local/var/varnish/$hostname:/varnish \
      emgag/varnish:5.1.3 varnishstat -N /varnish/_.vsm

```

---
Tags: docker, containers, nagios
---


# Question
Title: How to run "docker/compose" container on RPi3?
I have pull the image https://hub.docker.com/r/docker/compose/ `docker pull docker/compose`

But how can I run it to build my images on Raspberry Pi/rpi3?

# Answer
According to this reply it should run by issuing:

> ```
> docker run -ti --rm -v `pwd`/docker-compose.yaml:/docker-compose.yml -v
> /var/run/docker.sock:/var/run/docker.sock docker/compose:1.16.1 up
>
> ```
> 4 votes

---
Tags: docker, docker-compose
---


# Question
Title: How to visualize dynamic microservice architecture running with Consul?
Using Consul, you could allow your teams decentrally deploy and run microservices with dynamic dependencies.

It is also possible to list the services: `/catalog/service/:service`

Now, how to assess these dependencies automatically if the architecture grows dynamically to get a visual representation of service inter-dependencies?

# Answer
> 3 votes
I recommend that you take a look at the NetworkX library for Python. With a script you could query Consul and build a graph of linked nodes which could be rendered to an image file and served with a web server. A Flask microservice for this would be fairly simple to set up and provide a very useful visualization of your microservices spiderweb.

# Answer
> 0 votes
Consul is for service location; a service can use it to find another service so long as it knows the name of the service it wants to find. Consul is *not* for dependency tracking, and provides no insights into what services are using what other services (in fact it cannot, because service location does not have a way to indicate what service is doing the requesting, only what service is being requested).

---
Tags: microservices, consul
---


# Question
Title: What are best practices for running Pipeline tests into a CI framework?
According to this github repo it is possible to test the Jenkinsfile, but this is run by Jenkins and if there are issues it will not run. Should one run such unit test in another CI? What are best practices to solve this issue?

# Answer
> 2 votes
Unit testing in an alternate CD/CI platform would be overkill in every situation I've built one. The shared-pipeline code repo you connect to Jenkins will be triggered by a Jenkinsfile. I suggest you define any and all testing in that particular Jenkinsfile - and keep this one simple enough that extensive testing of the Jenkinsfile defining tests for your Jenkinsfile does not also need a Jenkinsfile defining tests.

---
Tags: jenkins-pipeline, testing
---


# Question
Title: How to stop VPN connection started from Jenkins?
I've just discovered this site and I would like to ask my first question.

I have a pipeline project on Jenkins that basically do this:

* SVN update
* Build
* Deploy

As the deploy target machine is on a different network, I need to start an OpenVPN connection. This works fine using `bat 'start openvpn config.ovpn'`.

The problem is that I need to drop the VPN connection once the process has finished and there is no stop command for OpenVPN.

My first approach was to save the process ID that started OpenVPN and kill it later. Something like this:

```
stage('Connect VPN') {
        bat '''wmic process get parentprocessid,name | grep WMIC | tr -d \'WMIC.exe \' > wmic_pid
            start openvpn myconfig.ovpn'''
    }

stage('Deploy') {
    // Deployment process
}

stage('Disconnect VPN') {
    env.WMID_PID=readFile('wmic_pid').trim()
    bat 'taskkill -pid %WMID_PID% -t'
}

```

However, for some reason the process ID saved using wmic does not match with the one used by OpenVPN. This procedure works fine when its executed manually on a cmd.

Any ideas?

PS: I'm on a Windows Server 2012.

# Answer
Your question is sitting unanswered here because you're way "out in the weeds" - running pretty idiosyncratic batch scripts that seem to leverage cygwin on Windows, in short, you're in the "wtf" category here. That's ok! In this work, all of us are in this place for a lot of our day.

I suggest you consider switching these up for powershell tasks, you can use:

```
node {
    powershell 'get-process "Openvpn" | stop-process -force'
}

```

to help with this. This will simplify your build server and remove external dependencies on cygwin- which if you've ever grappled with at any scale, is a real monster. It's tough to install automatically, tough to keep up to date, a vuln factory, and poorly maintained.

Perhaps even bigger picture though, using a VPN tunnel in a deployment process is slightly unorthodox. You might consider pushing an artifact to a repository that both Jenkins and your target server have access to, then polling from the target server for the presence of a new build, then installing it. Or simply decouple your build and deploy phases with a manual step- one where you log into your production environment to kick off a deployment after a build/test succeeds.
> 4 votes

---
Tags: jenkins, jenkins-pipeline
---


# Question
Title: Process guidance for new development team leader
I've just recently taken over leadership of a small team of developers within our group. The previous Team Leader was very much into micro-management and ran the development stream in a six week waterfall approach. The developers were assigned the work items to they had to work on to the exclusion of other work. He was very controlling in that aspect. Needless to say, this didn't really meet the required objectives from the business users.

Moving forward, we want to change this work process. The applications being supported are very mature, with only small to medium feature improvements. The focus needs be much more agile in the delivery fixes/changes whilst allowing for the feature development in parallel.

Our team and environment is as follows.

Applications/Sites

* ASP.Net Websites
* SQL Server 2012 databases
* SQL Server Integration Services
* SQL Server Reporting Services
* Vendor Supplied 2-tier fat client application (has inbuilt customisation ability, all changes have to be manually migrated)
* Vendor Supplied Silverlight Web application (has inbuilt customisation ability, all changes have to be manually migrated)

Team

* 4 dedicated developers
* 1 first level support member (probably 15% dev work)
* 1 application support member (probably 30% support, 50% dev, 20% analysis)
* 1 DBA\Team Leader (probably 15% support, 60% dev, 25% analysis)
* 1 Department Manager (probably 20% dev work)

Definite Microsoft shop (mandated from head office)

* TFS 2017 (TFVC)
* All source code is in one TFS collection with no branching
* Visual Studio 2015 (planning to upgrade 2017)
* Multiple solutions/projects with some cross project dependencies
* We have control and buy-in for server setup and configuration

Current Workflow methodology

* Developers work directly against individual TFS Work Items
* No "Sprint" or Release date limitations. There would be significant resistance against this. From a business point of view, that as one of the main restrictions to the timely delivery of fixes/changes in the past.
* Management and Administration of processes needs to be very, very minimal
* Source code needs to remain on-premises (for the short term at least)
* All deployment should be as hands-off as possible (with the exception of the vendor applications)
* When an item of work is ready for next environment it should be deployed.
* Deployments into production environment requires sign off from Dev team and Business team.

Open to all suggestions on how we can best re-structure things to allow us to deliver what's required.

Cheers Phil

# Answer
I suspect I'm late to the party, but I've survived a few similar scenarios and might have some tips for you. It sounds like your team has been over-managed and has grown hostile to process or rules in general.

1. Do not go directly to Agile and sprint based development. Consider going with Kanban, and link work items to an epic/larger context. Sometimes that context will be "break/fix" and sometimes it will be features. Linking will help you make it clearer where time is spent. Kanban is preferable because it's likely the absolute minimum process necessary to get work done - it won't require you to bludgeon your team with buzzwords, burndowns, estimates, and other distractions. It WILL allow you to limit the amount of work in progress - I suggest you start with 3-4 things per team member and try to whittle it down until you can reach a state of continous flow. Lead your standup using this kanban board.
2. Look for opportunities to incentivize smaller delivery batches, and run them through an automated testing process. Use this process to gradually improve the code base and build trust with the release managers who currently introduce friction to your delivery process, which causes an increase in change/batch size, which causes increased risks, which "validates" the need for an outside gate to production.
3. Break up monolithic repositories, then break up monolithic applications. Smaller applications again mean smaller batch sizes and reduced risk.
4. LISTEN a lot. Your team has been traumatized by a toxic manager, and you have damaged goods on your hands. If you come in too hot, you'll break trust. ESPECIALLY through the early phases of this transition, building trust and rapport are the keys to you ever getting a devops practice off the ground.
5. DO NOT switch tools simply because other people, who seem to be better at this than your team, are using them. Do I think there are better workflows than your team has? You bet! But don't switch for superstitious or personal reasons. Understand WHAT your current toolchain prevents you from achieving and make sure that the underlying concepts are understood by every single member of your team before you begin.
6. Be prepared for this to take a year or two to really turn around. You will need to apply slow, predictable, steady pressure on the organization in order to drive meaningful or longterm change.
> 2 votes

---
Tags: deployment, continuous-delivery, methodology
---


# Question
Title: Use K8s Deployment Hostname In YAML Config
I am trying to convert some K8s examples from ReplicationControllers to Deployments. These examples are for a Selenium grid located: https://github.com/kubernetes/examples/tree/master/staging/selenium

When I run the examples as-is, my selenium-hub and selenium-nodes connect successfully. However, when I tried to convert `selenium-hub-rc.yaml` and `selenium-node-chrome-rc.yaml` into Deployments, the selenium-nodes will not connect to the selenium-hub.

In `selenium-node-chrome-rc.yaml` there are these variables:

```
...
env:
- name: HUB_PORT_4444_TCP_ADDR
value: "selenium-hub"
- name: HUB_PORT_4444_TCP_PORT
value: "4444"
...

```

`HUB_PORT_4444_TCP_ADDR` is the ip/hostname of the selenium-hub. The `selenium-hub-rc.yaml` shows the phrase `selenium-hub` in many locations. **Question 1**: which of these is actually defining the host name? (`.metadata.name`, `.spec.selector.app`, ...?)

```
apiVersion: v1
kind: ReplicationController
metadata:
  name: selenium-hub <-------------------
  labels:
    app: selenium-hub <-------------------
spec:
  replicas: 1
  selector:
    app: selenium-hub <-------------------
  template:
    metadata:
      labels:
        app: selenium-hub <-------------------
    spec:
      containers:
- name: selenium-hub <-------------------
....

```

Now, I changed this `selenium-hub-rc.yaml` to a deployment:

```
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: selenium-hub-deployment <---------- this is the hostname?
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: selenium-grid
    spec:
      containers:
      - name: selenium-hub <--------- this is the hostname?
        image: selenium/hub
        ports:
        - containerPort: 4444
...

```

But now the selenium-node won't connect and I believe it is due to `HUB_PORT_4444_TCP_ADDR`. I have tried:

```
- name: HUB_PORT_4444_TCP_ADDR
  value: "selenium-hub"

```

and

```
- name: HUB_PORT_4444_TCP_ADDR
  value: "selenium-hub-deployment"

```

Neither worked. **Question 2**: What is the hostname for a deployment? It seemed straight forward in the ReplicationController yaml e.g. `selenium-hub`, but I can't get it to work as a deployment.

~~Note, I have not changed the service in any way.~~ Actually I DID change it and that partially caused my initial issue.

# Answer
> 2 votes
My idea of where the hostname was coming from was wrong. According to the docs:

> Every Service defined in the cluster (including the DNS server itself) is assigned a DNS name.

and

> Currently when a pod is created, its hostname is the Pod’s metadata.name value.

So the hostname is actually the name of the service. The last sentence in my question says I did not change the service in anyway. That was an unintentional lie. I did change the service name, or else `selenium-hub` as the hostname would have worked.

Changing `HUB_PORT_4444_TCP_ADDR` to the `.metadata.name` of the *service* got me closer. The connection was timing out, though.

I believed some of the configuration was wrong in my service yaml. So instead of using my yaml file, I created the service via: `kubectl expose deployment <deployment name here>`

This created a service and I checked the selenium-hub and the node was finally connected. So there was an issue in my service yaml. To get the correct configuration I exported the currently working service: `kubectl get svc <service name here> -o yaml --export`

I copied the exported configuration to my service yaml file and it also worked. Here was the difference between the service yamls

```
old yaml (copied from GitHub example above)
---
apiVersion: v1
kind: Service
metadata:
  name: selenium-hub-service
  labels:
    app: selenium-grid
spec:
  ports:
  - port: 4444
    targetPort: 4444
    protocol: TCP ------------- [added in new config]
    name: port0 ------------- [deleted in new config]
  selector:
    app: selenium-hub
  type: NodePort ------------- [deleted in new config]
  sessionAffinity: None

```

I am not sure why adding `.spec.ports[0].protocol` and deleting `.spec.type` and `.spec.ports[0].name` fixed the issue. If anyone could clarify in the comments I would appreciate it.

---
Tags: kubernetes
---


# Question
Title: Kanban to catch a quick-moving situation
We have a brownfield project which was recently struck by disaster (many people leaving for unrelated reasons, too many new customers, much too large backlog for much to few people, etc.). Management support is still fine. Thank bob the product owner (decades of knowledge) is still here. The devs have seen some glimpses of DevOps benefits from a very nicely-received DevOps colleague who is doing practical work as well as evangelisation, so there is no resistance on that front, either.

At the moment, we are bringing in new people from all over the place (i.e., split across different cities and even countries, though all speak the same language), and getting the know-how under control etc. We are also focusing a *lot* on automation before starting actual development again, because everybody saw what happens when we don't. Also, we have bundled *everybody* together - devs, ops, testers, to make use of every last bit of knowledge and avoid future silos. So it is a very dynamic situation.

My main objectives are:

* Get people to work instead of panicking, i.e., give the individual devs focus.
* Shield devs and ops from panicked management and stakeholders.
* Make it more transparent for stakeholders to see what is happening with their tasks/epics, to reduce panicked zero-warning status calls.

Most people, as well as me, are used to Scrum (or more likely Zombie-Scrum or Scrum-But ;) ), but I believe it is too early to do proper Scrum here. So I will likely implement Kanban (in Jira).

What are your best practices here?

* One column per person/pair? Or rather one column per stage for the tasks (i.e., "in development", "in testing" etc.)? I think I'd prefer the first, because it very clearly shows whether a person/pair has their hands full - we could use a full column really well for telling a manager to go away. Also, we have quite diverse roles in the team (i.e., a DevOps expert who will be focusing on the CI/CD pipeline and such; or the testers).
* In the usual Scrum process, the P.O. would not be part of the actual sprint board, but do his good work in the backlog. Would you propose to give a column to the P.O. so he can focus on fleshing out a few task at a time? This would put the P.O. well inside the team, which I would like. Is it a good idea? (Yes, I am aware that Kanban does not actually label those roles, but I hope you see what I mean...).
* Alternatively to the previous: I believe The IT Sceptic had an article about having two boards - one focused on the stakeholder epics, the other on the actual short-term tasks. Do you have experience with that? Would that help in this situation, in your experience?

These may seem like three distinct questions, but are, in my mind one: how to structure the Kanban board - around people, or around tasks?

# Answer
> 4 votes
We are a product development shop - and in fact we build a Kanban tool (SwiftKanban), in addition to others. We have a lot of experience with Kanban and DevOps and separate boards for epic/ story detailing vs. dev/ ps tracking. Our DevOps setup is still being fully automated and being gradually fleshed out. We've been on this journey since 2010-11 - and we have achieved significant business benefits exactly of the kind you are looking for.

We started with a single Kanban board, but with 2 separate swim lanes for the product manager and the dev team - see below -

Planning Lane for the Product Owner

Dev Lane for the main dev activity

Since we had a single team doing development as well as maintenance/ customer related work, as also refactoring work, we also had a few other lanes to help them visualize their overall workload -

Over the last 6 years, we have evolved, as have our dev/ engineering practices. While we never used Scrum - and don't have sprints, we do production releases every 4-6 weeks, we deploy to an internal staging server (which we use as our internal production server, where we use our product for dev as well as other functions such as marketing, sales, support, implementation services, etc.) every week or less, and we have a single workflow between Dev and Ops as you will see below.

From that separate planning lane, we have evolved to a full upstream Kanban board - which is our roadmap planning board, where we track Themes, Epics and Stories - and lay out stories in up to 4 releases out. We did this as we gradually figured out just how much work needs to get done to identify and detail the work to be done as well as to get stakeholder alignment so everyone agrees that we are working on the right stuff.

Roadmap Planning Board

Stories from this board get pulled to the Dev board. Internal and customer reported defects are directly added to this board's Ready queue.

Dev Board

As you can tell, the Product Owner (Product Manager) is responsible for the Roadmap board, while the Sr. Dev Manager is responsible for the Dev Board. While Dev team members deply to Staging server, the Ops team ensures they have the right CI/ CD environment to do that. After Dev/ Validation, it is the Ops Team's job to deploy to production once sufficient valuable work has been completed (typically 4-6 weeks).

Both boards are accessible to all senior stakeholders as well as CEO, Sales and Marketing so everyone can track what is going on and what is prioritized for upcoming releases.

At the same time, we ensure we follow some of the recommended Kanban cadences, including the Daily Standup Meeting, the Weekly Replenishment Meeting (where fine-tuning of the story/ defect prioritization takes place) as well as Release Retrospective and a Quarterly Strategy Review Meeting.

The Kanban boards and cadences ensure that everyone is aware and aligned; and if there are conflicts, they are resolved during one of these meetings (other than the Daily Standup).

Besides key Kanban practices - including a reasonably strict adherence to WIP Limits - we have also, of course, invested heavily in engineering practices to enable a true continuous delivery/ deployment environment - and that journey still continues. We are a Test Driven Dev shop and developers are responsible for JUnits, Functional Automation, and Peer Review. Our code repository is Subversion and integration/ deployment is orchestrated using Jenkins. Subversion is integrated with our Kanban tool so all work at each stage is also updated on the card as well (via comments on the card).

Overall, to answer some of your questions more specifically,

1. Yes, it makes a lot of sense to provide a separate board to the product owner and another to the dev/ ops teams and link cards across them as needed.
2. And it makes sense to organize the board by tasks/ workflow stages rather than people as that gives you greater flexibility with using cross-functional folks in different stages of the workflow.
3. Most importantly, it lets you easily visualize and measure which workflow stages might be bottlenecks (rather than which people - which would typically be inaccurate) and what tweaks you might need to make to improve your flow and throughput and reduce lead time.

All the best with your transition to Kanban! If you need any more help with respect to Kanban, I strongly recommend reading David Anderson's book on the Kanban Method as well as refer to our comprehensive Kanban guide.

Hope this helps.

# Answer
> 2 votes
The beauty of a kanban board is that it lets you see what everyone on the team is working on; if work is related, it should be on a common board (in my opinion). However, one way to deal with specialization of teams is to use swimlanes, particularly if the tasks have common phases.

Take a simple board for example, with a To Do pile, a Doing pile, and a Done pile. Create a swimlane for each of your subteams, and and limit their WIP accordingly; this allows for common visibility with some independence.

I think two boards makes sense when the phases are more complex; if you have to have a pipeline between teams for some things (i.e, you need QA review after the devs do their code before an item is done for epics), but not for others (fixes), then two different boards with different phases makes sense. However, you have to deal with the complication of shifting between boards.

---
Tags: culture, methodology
---


# Question
Title: How to integrate multiple "feature" react apps into monolithic PHP repo?
We have a mono-laravel-repo and are in the process of migrating to a cleaner, easier to maintain dev reboot.

We have recently moved towards migrating our existing PHP based views into multiple React-based "features" that live in a `/react` directory and are organised into `/react/featureName` sub-directories. This means Laravel's controllers mostly handle data and authentication only.

Each feature is maintained by one or more developers, have their own dependencies, tests and functionality.

We're currently serving builds in the public root of our project organised by feature:

```
js/FeatureName.hashed.js
css/FeatureName.hased.css

```

which works great except that we share many packages between `features`. React itself, react-router etc.

We intend to use Laravel's `mix.js` as much as possible, but hacking directly on `webpack.config` is also an option.

I've explored the `mix.extract()` option that allows us to define *vendor.js* builds separate from other application logic but it stops there.

So here are my question(s)

1. What approaches are there to manage multiple `package.json` files that live in each feature directory
2. How do we identify common packages and lock them into a root `/package.json` file. (Independently, all developers already use `yarn`)
3. How to accomplish this with as little friction as possible for all react based developers - so that they get to simply continue with whatever they are already doing and DevOps handles the gritty bits?

I understand there might be a need for more information, please shout out what you need in the comments and I'd be happy to update the question.

# Answer
> 1. What approaches are there to manage multiple package.json files that live in each feature directory

One could leave the package.json in every feature directory and let the CI read the package.json when building the app. One could define the versions of dependencies in the package.json to get control about the app. If the app works with version A.B.C of a certain library then one could define this version to prevent that an update will break the app.

> 2. How do we identify common packages and lock them into a root /package.json file. (Independently, all developers already use yarn)

Discuss this with the team and figure out what is the best solution for everybody. Multiple solutions are possible. Everybody should be happy with a certain approach.

> 3. How to accomplish this with as little friction as possible for all react based developers - so that they get to simply continue with whatever they are already doing and DevOps handles the gritty bits?

DevOps in my opinion means that a certain team that consists of multiple specialties, e.g. test, dev, ops is responsible for a certain app. This means that the whole team should agree with a certain approach and everybody should work and handle issues according that process instead of `DevOps handles the gritty bits` which is about silos and "throw it over the wall"
> 2 votes

---
Tags: configuration-management, configuration, monorepo
---


# Question
Title: How to create a database backup using docker-compose
According to this documentation one could create a database backup

docker-compose.admin.yml

```
version: '3'
services:
  dbadmin:
    build: db_data/
    links:
      - db

```

running

```
docker-compose -f docker-compose.yml -f docker-compose.admin.yml \
run dbadmin db-backup

```

results initially in:

```
ERROR: Error processing tar file(archive/tar: invalid tar header):

```

and when it is run for the second time:

```
ERROR: Error processing tar file(exit status 1): unexpected EOF

```

# Answer
> 0 votes
The number of downvotes on the link that is mentioned in the question could indicate that there are issues with the instructions.

Perhaps one could use native commands to backup the database. For example, this answer shows how to backup a postgres database that runs in docker using the pg\_dump command.

---
Tags: docker-compose
---


# Question
Title: archive contents of a reviewboard server as read-only
My team was using an Ubuntu box to host an instance of Reviewboard 2.5.2 that we used for a few years before migrating to a Bitbucket service in the cloud. The machine was maintained by my predecessor who has long-since left the company.

Edit: to clarify, the new service is not Reviewboard, but Bitbucket, and it's hosted on an internal cloud service.

Now that we have a service elsewhere that we don't need to maintain, we want to take this old server offline permanently, but would like to preserve the contents site itself -- that is all of the reviews -- for posterity.

I'd rather not just spin up another Reviewboard instance and I'd also rather not be in the business of maintaining a physical web server -- the idea is that I'd put this in our company cloud.

Now I've done a dump of the json-formatted data via RBTool, however this isn't really useful to me in its current form. Edit: it's not useful because I was hoping for an off-the-shelf way to dump the website in static form.

What I ultimately want is to have these old, archived reviews be searchable and for all the links to work more or less as expected for the sake of convenience.

Has anyone had luck doing something like this?

# Answer
> What I ultimately want is to have these old, archived reviews be searchable and for all the links to work more or less as expected for the sake of convenience.

As already indicated in one of the comments, wget could be used to retrieve the content:

```
wget -r --no-parent devops.com

```

will create a devops.com folder and put all files in this directory.
> 0 votes

---
Tags: linux, backup, repository
---


title: Devops Jenkins nexus integration?

text:
# Question
Title: Devops Jenkins nexus integration?
I want to try to upload any set of artifacts from any type of project ( Java, node, PHP, .net, go ).

I know that once a developer pushes a code to git, Jenkins should take it and run the test case on it.

If it is success then push it to production? Am I right? I'm not sure about the flow.

I wonder how Nexus and Maven ( is it needed, if so why? ) will come into a picture of DevOps flow?

I know Nexus it's repository manager ( which store artifacts \[ final executable file after code compilation ( which we can see in Java, go but not in PHP or node ) \] ) please, correct me if I wrong.

Do I need Maven?

# Answer
No, you don't need maven.

Maven is a build automation tool as ant and gradle are, generally, but not limited to, jvm based projects.

Nexus is an artifact repository, but some others exists. Artifact repositories software have different set of features (license, different storage options, different repositories type support like gems or npm ..., search support, web interface ...).

> I know that once a developer pushes a code to git, Jenkins should take it and run the test case on it.
>
> If it is success then push it to production? Am I right? I'm not sure about the flow.

Generally, in order to achieve continuous deployment, which is what you are asking for precisely here, you would:

1. setup a hook when you commit
2. have a continuous integration tool that receive the hook
3. the CI does whatever needs to be done for the project to be tested / build / runnable
4. the CI deploys the previously built software

Jenkins, for example, supports pipeline as code, it would allow you to put a `Jenkinsfile` in your repository, that would tell Jenkins how to do step 3 and 4 (travis and circleCI and others CI also supports this).

You can tell your CI in steps 3 to upload some artifacts to an artifact repository and on step 4, to retrieve them in order to deploy the software, but you don't need to.

My advice would be to design your CD system the simplest way you can, don't introduce not necessary parts like an artifact repository if you don't need it, add it when you face a problem that needs it.

As a first step, your CI, can during the deployment steps, simply copy your artifacts to the target server.
> 2 votes

---
Tags: jenkins, jenkins-plugins, devsecops, nexus, n3dr
---


# Question
Title: How to avoid and fix the warning from Graphite-manage?
We installed Graphite on our Linux server, and when we started running it, we saw the following warning from the `graphite-manage` script:

```
 graphite-manage syncdb --noinput

 /usr/lib/python2.7/site-packages/graphite/settings.py:246: UserWarning:
 SECRET_KEY is set to an unsafe default. This should be set in
 local_settings.py for better security
 warn('SECRET_KEY is set to an unsafe default. This should be set in
 local_settings.py for better security')
 Creating tables ...
 Installing custom SQL ...
 Installing indexes ...
 Installed 0 object(s) from 0 fixture(s

```

How do you avoid this warning? What is needed to fix it?

# Answer
A `SECRET_KEY` has to be set in the `/opt/graphite/webapp/graphite/local_settings.py` file. More information could be found here.
> 1 votes

---
Tags: linux, python
---


# Question
Title: CentOS 7 SSH login with Keys Authentication
Is there any possibility to create one master account (for one master laptop for example), from which I can log in to all accounts available on the server ?

My server has Keys Authentication enabled and PasswordAuthentication disabled.

Now, after reboot I can login to server from my (master laptop) as root, but I can not login as a regular user, I get „access denied".

# Answer
Yes, but you will first need to log in as the master or root account, and then `sudo su otheruser` in order to log in as that user. There is no way to log in as any user without first going through a privleged user's account.

An additional caveat is that the user you are trying to log in as needs to have a shell of `/bin/bash` or similar valid shell in `/etc/passwd`. If the user has a shell like `/bin/fase` or `/bin/nologin` you will be unable to change to this user's account (but neither will anyone else for that matter).
> 1 votes

# Answer
edit your /etc/ssh/sshd\_config and add

```
AuthorizedKeysFile    /etc/ssh/all_users_authorized_keys

```

Put your pubkey in that file, and restart the sshd.

See: https://www.ssh.com/ssh/authorized\_keys/openssh

The default behavior (which we are all probably familiar with) is

```
AuthorizedKeysFile    %h/.ssh/authorized_keys

```
> 0 votes

---
Tags: linux
---


# Question
Title: Unregister a VM within VMware Fusion from command line
Is there anyway of unregistering a virtual machine on OSX using the command line with VMware Fusion (so that the VM can then be deleted)?

I've looked around, and found this thread, which suggests

> manually remove the VM from inventory before running the DeleteVM command

But where is this inventory? Or is there a better way of unregistering a machine via the command line?

# Answer
> 0 votes
There doesn't seem to be a "proper" way of unregistering a virtual machine sadly.

I went around this by stopping the virtual machine using `vmrun` in Fusion, deleting the source folder of the VM, and restarting Fusion so that the application registers that the VM is not there anymore.

---
Tags: vmware, vmware-fusion
---


# Question
Title: How to implement Devops environment test section?
In our university, our instructor gave Devops environment improvement as a project. I am in the test section of this project and I have a few questions that I can not understand.

Our instructor said that we must write an adapter that interacts with interface(a other group should provide interface) and allows people in this environment to test their own code. Then he wanted us to investigate the Cucumber, Selenium and Junit.

If the code-owner people are going to write their own tests, why am I learning Cucumber? Will not the man who wrote the code write his test with Cucumber?

I am very confused in this regard, please help me with Devops test title.

# Answer
A software development team will typically have to test their software. One kind of test that can be done is UI testing, typically done through Selenium and the likes. The stack of services required to run UI tests systematically is often the hardest to set up. Companies like BrowserStack specialize in minimizing that set up task for developers.

I suggest you investigate how to set up Selenium along with a few browsers to allow the other group to test their software. This task will typically revolve around X11, xvfb, x11vnc, selenium/selenium-grid and one or multiple browsers. Docker images from the selenium team itself are pre-built and offer a great level of functionality out of the box.
> 1 votes

---
Tags: testing
---


# Question
Title: Is there a website that shows the popularity of CI/CD tools?
There are websites that indicate the popularity of programming languages and open source tools. Is there something comparable for CI/CD tools as well?

# Answer
> 17 votes
I normally use stackshare. It doesn't show you usage as reported by the people running the tools but it has a decent community size and seems to be gaining more use rather than less.

It lets you compare tool features, community popularity and shows you who else is using those tools in their stack if that matters to you.

# Answer
> 6 votes
Although not entirely relevant to your question in terms of popularity, devops bookmark is a very nice website which helps discover tools and frameworks in the DevOps landscape.

You are also able to filter tools and frameworks which works with different languages, platforms, licenses and topics which is really handy!

# Answer
> 5 votes
I really like the Cloud Native Landscape. The tools are categorized in a huge map.

Also you can visit awesome-ciancd for a bunch of tools and a brief explanation about each of them.

---
Tags: continuous-delivery
---


# Question
Title: Why not use configuration management tool instead of Dockerfile?
I'm pretty new to Docker and configuration management tools.

At first I started writing bash scripts to provision my Vagrant boxes for my development machines, but now I've switched to using Chef for that so that I can use the same source to provision both development and production environments to try and get them as similar as possible.

Since I've started using Chef I've come to enjoy the DRY aspect of not having to copy and paste shell script lines from project to project, the ability to provision machines running a variety of linux distributions using one consolidated source, and the convenience of using community provided cookbooks.

Now that I've been using Chef to provision my vm's it feels like taking a step backwards when I am adding RUN commands followed by shell commands to a Dockerfile to achieve what could be achieved by just running a Chef recipe.

I've googled and haven't found anything (but maybe I just missed it) but it doesn't look like there is an easy way to use Chef recipes to build Docker containers. Why is that?

I understand that containers are meant to be immutable and configuration management tools are commonly used to re-configure machines during their entire lifespan, but wouldn't they still offer a lot of benefits if used during the initial building of the container?

# Answer
The tool you need is Packer using Docker as the "builder" and Chef as the "provisioner". Then you can add the resulting image to your repo and reuse it without having to pack again, until your recipes change.
> 5 votes

# Answer
These strategies have nothing to do with one another.

*Containers* (like Docker) are a methodology for deploying and isolating applications. Containers are well liked because they're transportable. They can be developed on and previewed locally in most cases, so putting applications in them makes sense.

*As for why Docker uses shell scripting*: A docker image is literally a linux container image. It's a linux operating system and the point of that container to be as lightweight and efficient as possible. If you started adding Chef, Ruby, Erlang, and all the other libraries required to have Chef as a provisioner on a Dockerfile you'd be eliminating the point of using containers.

*Configuration Management* is for provisioning a compute node. Your configuration end state is usually reflected in code and has a central server for maintaining state. Tools like vagrant allow you to use chef to configure Vagrant machines, largely out of convenience for developers. While you can use most of these tools in a *local-only* mode, the maintenance of them becomes quite burdensome. Those central servers are for things like automatically sorting out versioning and dependency management.

Bash is not inherently a step back. For instance, many organizations building *fully immutable image pipelines* build their images using Bash. This ensures stability and predictability as well as a common language among engineers (Many engineers may come from different config management backgrounds).

**Immutable vs Config Management**. Immutable infrastructure does not change and must be entirely replaced in order to be updated. Config Management implies that the state of a machine is maintained by an agent or foreign connection (like with Ansible).

Docker containers are inherently immutable. You don't persist data on them and they must be rolled in order to be updated.
> 5 votes

---
Tags: docker, chef, configuration-management
---


# Question
Title: How to automate Powershell's interactive Get-Credential method?
I am trying to write a python script which automates the powershell's Get-Credential method. Here is something i wrote:

```
import subprocess
COMMAND_LINE = 'powershell'
powershell = subprocess.Popen(COMMAND_LINE, shell=True,
                                   stdin=subprocess.PIPE,
                                   stderr=subprocess.STDOUT,
                                   stdout=subprocess.PIPE)
output = powershell.stdout.readline()
print output.rstrip()
powershell.stdin.write('$cred = Get-Credential\n')
powershell.stdin.write('Administrator\n')
powershell.stdin.write('Password')
output = powershell.stdout.readline()
print output.rstrip()
out = powershell.communicate()[0]
print(out)

```

But i am unable to pass the password as above, i am getting following exception:

```
> PS /root> $cred = Get-Credential
>
> Windows PowerShell credential request Enter your credentials. User:
> Administrator Password for user Administrator: PS /root>
> PasswordPassword : The term 'Password' is not recognized as the name
> of a cmdlet, function, script file, or operable program. Check the
> spelling of the name, or if a path was included, verify that the path
> is correct and try again. At line:1 char:1
> + Password
> + ~~~~~~~~
>     + CategoryInfo          : ObjectNotFound: (Password:String) [], CommandNot    FoundException
>     + FullyQualifiedErrorId : CommandNotFoundException

```

As i am new to python, Can anyone help me here?

# Answer
> 5 votes
Your python problem is the `\n` after the commands, `write` already append a newline, so your script does the following:

```
$cred = Get-Credential # Start the command
# This line is ignored as extraneous after Get-Credential, but you can see it in your output.
Administrator # Send proprely to the User: prompt
# Sent to the Password: prompt
Password # Send to the shell input, causing the error at end of your log.

```

Now that's a quite hard way to automate the credential object in powershell, usually the object is build by other way like described in this blog post (quoting here for completeness):

```
$password = "mypassword" | ConvertTo-SecureString -asPlainText -Force
$username = "nwtraders\administrator"
$credential = New-ObjectSystem.Management.Automation.PSCredential($username,$password)

```

And used as such:

```
Get-WMIObject win32_logicaldisk -ComputerName Server1 -Credential $credential

```

# Answer
> 3 votes
I am by no means an expert but there is an alternative to creating a script containing 'plain text' passwords, which obviously isn't very secure.

I have written the following code snippet based on this article Who Are You? Or, Slipping By the Get-Credential Cmdlet by Jeff Hicks and now use this in order to automate a remote session.

```
# Create a secure string for the password
$Username = Read-Host "Enter Username"
$Password = Read-Host "Enter Password" -AsSecureString

# Create the PSCredential object
$Credentials = New-Object System.Management.Automation.PSCredential($Username,$Password)

# Server Variable
$Server = Read-Host "Enter Server Name"

# Create Remote Session
Enter-PSSession -ComputerName $Server -Credential $Credentials

```

When running this code, you will get the following output:-

```
PS Scripts:\> .\Snippets\Enter-SecureCreds.ps1
Enter Username: ##YOUR-USERNAME#
Enter Password: *************
Enter Server Name: 192.168.1.10

```

Password is obfuscated with * when entered.

As advised in Jeff's article

> This credential only exists for as long as your PowerShell session is open. But be careful, because even though the password is stored as a secure string, if I have interactive access to the console session, I can still see the password by invoking the GetNetworkCredential() method:

```
PS S:\> $Credential.GetNetworkCredential()

UserName          Password          Domain
--------          --------          ------
admin             P@ssw0rd          mydomain

```

> This isn't necessarily a security violation, unless you walk away and leave your session wide open for anyone to access. There may also be situations where you have a legacy application that can't use a PSCredential and you need to pass values like username and password to it. Just be aware.
>
> IMPORTANT: It is a security no-no to hard-code any password in any plain text file. Ideally, you'll want to provide some secure mechanism for the script user to provide the necessary password. Also, don't forget to secure your console if you are keeping the credential object.

I hope you find this as useful as I have.

---
Tags: linux, python, powershell
---


# Question
Title: Unable to launch multiple EC2 instances in different availability zones using terraform
Whenever I try to launch the instances, I am getting the following error message. Please help with this.

Error: Error applying plan:

```
3 error(s) occurred:

* aws_instance.example[0]: 1 error(s) occurred:

* aws_instance.example.0: Error launching source instance: InvalidParameterValue: Invalid availability zone: [{us-east-1b]
        status code: 400, request id: 2637e297-236d-4e3b-b5a4-b5afe3df5e67
* aws_instance.example[2]: 1 error(s) occurred:

* aws_instance.example.2: Error launching source instance: InvalidParameterValue: Invalid availability zone: [ us-east-1d}]
        status code: 400, request id: 59244720-ab1c-48c7-a9b8-3eb6a23bd5ae
* aws_instance.example[1]: 1 error(s) occurred:

* aws_instance.example.1: Error launching source instance: InvalidParameterValue: Invalid availability zone: [ us-east-1c]
        status code: 400, request id: 1e335e56-f129-4ea0-a5c6-09b0501b6e18

Terraform does not automatically rollback in the face of errors.
Instead, your Terraform state file has been partially updated with
any resources that successfully completed. Please address the error
above and apply again to incrementally change your infrastructure.

```

# Answer
It looks like you're using the wrong brackets? I think you need to use a list:

```
variable "azs" {
  description = "Run the EC2 Instances in these Availability Zones"
  type = "list"
  default = ["us-east-1a", "us-east-1b", "us-east-1c"]
}

```

Source
> 1 votes

---
Tags: amazon-ec2, terraform
---


# Question
Title: What are best practices for sharing and accessing Vault secrets?
When one follows a Hashicorp's Vault demo, one has to issue `vault init -key-shares=1 -key-threshold=1` at a certain moment that generates a `key 1` and `root token`:

```
Key 1: ABC
Root Token: XYZ

```

If person A generates a secret by executing `vault write secret/hello value=world` how could person B check on his/her computer the value of `secret/hello`?

# Answer
> 3 votes
Assuming person B has a role which also allows them access to the path `secret/hello`, then they would simply run `vault read secret/hello` from their own machine.

If you're following the demo, I think the vault server will be on your local machine? So if someone else is to connect to it they would need to set `VAULT_ADDR` to point to the IP where the server is running.

---
Tags: hashicorp-vault
---


# Question
Title: Geographically, where are the travis-ci jobs run?
Where are the travis-ci servers located? Does travis-ci leverage AWS EC2?

# Answer
> Where are the travis-ci servers located? Does travis-ci leverage AWS EC2?

According to this documentation, the servers are located in the USA and AWS EC2 is used as well.

> Your code, depending on which platform or language runtime you're using, is run on virtualized servers running in:
>
> * Amazon EC2 datacenters in Ashburn, VA, USA,
> * MacStadium datacenters in Atlanta, GA, USA,
> * Google Compute Engine datacenters in Berkeley County, SC and Council Bluffs, Iowa, USA.
> 3 votes

---
Tags: cloud, travis-ci
---


title: What are spells of Kubernetes?

text:
# Question
Title: What are spells of Kubernetes?
# Question

What is **spell** of conjure-up in Kubernetes?

## Background

Following Kubernetes on Ubuntu and run ***conjure-up kubernetes*** which showed the snapshot asking which spell to choose. But not sure what this is asking.

Spell selection in Conjure-up documentation tells spells and selections but not clear what they are still, hence look for some explanation and suggestion on which one to select (core or canonical) and what they are.

# Answer
**TL;DR**: the "Canonical" version of Kubernetes has been customized by Canonical, the developers of Ubuntu, based upon their experiences of running Kubernetes. "Kubernetes Core" on the other hand is the standard, official, distribution you would find on Kubernetes.io. If you are looking to understand Kubernetes on Ubuntu then I would recommend the Canonical version, if you are wanting a standardised version then go for Kubernetes Core.

A `Spell` is a function of Conjure-Up which is a product created by Canonical to be able to provide "Turn Key" installations of popular Open Source technical stacks such as Kubernetes and Open Stack. These stacks are typically non-trivial to install, so Conjure Up combines the installation of the software and configuration based upon guided best practice through a GUI and CLI interface.

> conjure-up lets you summon up a big-software stack as a “spell” — a model of the stack, combined with extra know-how to get you from an installed stack to a fully usable one. Start using your big software instead of learning how to deploy it.

Conjure Up is capable of deploying to Ubuntu, MacOSX and popular public clouds.

At the time of writing the following spells are available:

* `kubernetes`
* `openstack`
* `bigdata` incorporating: Hadoop, Spark and Kafka
> 10 votes

---
Tags: kubernetes, installation
---


# Question
Title: Private docker registry that attempts a pull-through on images not found locally
I have a docker registry image running on a local network with the command

```
docker run -d -p 5000:5000 --restart=unless-stopped --name registry -v /mnt/part_sdb/registry:/var/lib/registry registry:2

```

but enabling the caching of images stored in Docker Hub requires one to pull the image, and push it in the local registry

Is there a way to configure the docker registry to do automatic pull-through if the image requested is not available locally **while preserving the ability to push local images**?

from this article:

> The catch is that you will probably run the public Registry as a mirror *or* as a regular registry, so you will probably end up running two containers — one as a mirror, another as your local Registry (not a big deal). In artifactory you can set up as many registries as you want (local or remote), each with its own URL. Or you can “mix” them on a single URL with a virtual registry (if you think it is a good idea).

# Answer
> 1 votes
Yes, it is possible. The entire subject is discussed in Registry as a pull through cache, from where the below quotes are taken.

Basically you need to configure the cache as a proxy for Docker Hub:

> **Configure the cache**
>
> To configure a Registry to run as a pull through cache, the addition of a `proxy` section is required to the config file.
>
> In order to access private images on the Docker Hub, a username and password can be supplied.
>
> ```
> proxy:
>   remoteurl: https://registry-1.docker.io
>   username: [username]
>   password: [password]
>
> ```

Of course, you also need to configure your docker daemon to use your local cache (but I presume that may be already done from the context of the question):

> **Configure the Docker daemon**
>
> Either pass the `--registry-mirror` option when starting `dockerd` manually, or edit `/etc/docker/daemon.json` and add the `registry-mirrors` key and value, to make the change persistent.
>
> ```
> {
>   "registry-mirrors": ["https://<my-docker-mirror-host>"]
> }
>
> ```

---
Tags: docker, registry
---


# Question
Title: How to test database applications in QA testing environments?
### Process

Our current process is:

1. Build process produces a windows setup (msi).

This setup consists of a web site deployment and also database scripts - which can create a new database or upgrade an existing version.
2. The QA person needs to snapshot their Application server and their Database server.
3. The QA person then runs the setup on their own windows server.
4. The setup installs a web site and updates the database.

The purpose of the snapshots is to give them something to rollback to - to compare any behavioural changes between different versions of the application.

### Current Technology and Environments

We rollout to Windows Server 2008r2 and above. The Database servers are Windows Server 2008r2 and above with SQL Server 2008r2.

Our QA is a bit mixed in terms of what Virtualisation is being used. Our teams work in two ways, one with SQL Installed on the server and another process with the traditional app server / sql servers being separate. The servers are running on mix of storage using SSD / SAN and SAS drives, each server generally has 60gb HD, running 4gb ram. SQL Servers have 8gb or more

### Drawbacks

The biggest drawback is the speed at which the environments are backed up - in terms of speed and the amount of space they take up.

### My Thoughts

One of my ideas is to either create an app / script or use some tool to backup / snapshot the application server and MS SQL database at the same time.

### Questions

I would like to know how other people are rolling out changes with a similar process to what we go through.

Additionally:

1. What other tools are available for example?
2. Also what recommendations would you make?

# Answer
The biggest problem with database backups is that you cannot simply snapshot them. You first have to make sure the DB is not mid-transaction when taking a snapshot, otherwise you will restore to an inconsistent state. In the case of windows, you can leverage the Microsoft SQL VSS writer to snapshot your database. You will want to be sure that when you take a snapshot of the VM, HyperV is capable of leveraging this VSS writer.

If you have a particularly large dataset, it may be better to leverage your storage filer to use delta-clones if your filer has this feature and it can help to address the size/time issue you are experiencing with backups.

In terms of deploying the new application to QA there are several ways to do this. One is to have an automated build system such as Jenkins, Travis CI or a similar tool automatically trigger a backup and deployment upon a code commit. This can be done by leveraging a configuration management tool such as SaltStack, Puppet or Chef (which all run on Windows) that can automatically set up and configure a SQL server for you and deploy your application if you are able to script a SQL install with PowerShell. Personally, I would recommend SaltStack as it's Reactor will allow you to broadcast a beacon when your backup/snapshot completes and trigger a build (Puppet lacks this capability).

One option for spooling up a VM each time is to leverage a system like The Foreman which has a HyperV plugin. You could then use SaltStack (vis-à-vis Reactor. This is probably the best way if you backup system blocks until the entire backup is complete, which I doubt) or your automated build system (Jenkins/Travis) interact with The Foreman's REST API to request a host be spun up. Once this comes up, it would automatically check in with your configuration management system to install SQL server and restore the snapshot in the new VM. If you combined this with an automated testing battery, you might even be able to implement a "Push on Green" system to repeat this process into your next environment if all the QA tests pass.

The advantage to using a piece of middleware like The Foreman is that it will allow you to deploy into any virtualization system or even the cloud and prevent you from being locked into HyperV and make your environment more portable.

I am sure there are other ways to get there, but this is one way I have used in the past to implement similar deployment workflows.
> 2 votes

---
Tags: testing, backup
---


# Question
Title: Move Load balancer certificate to another AWS account
I have two AWS accounts. Created a load balancer on "first" account, requested a certificate and using it for HTTPS.

Now I need to move this load balancer certificate to "second" account because it is requested for the same domain I need to use.

What is the procedure to do this.

1. Delete certificate from first aws and request again from the second aws?
2. Is there any way to export the certificate?

# Answer
> 4 votes
There's no need to delete it from the first account. AWS will issue certificates as long as you can prove domain ownership. Nothing stopping you from having a cert for the same domain in multiple accounts.

---
Tags: amazon-web-services, load-balance
---


# Question
Title: Best tool for Docker Container test automation?
In my project i am building about 200 containers I want to check in a smoke test if the containers are still running after a rebuild in pipeline.

I want to bring up the container with certain parameters and check if it is responding on ports (service being up), or run simple test inside the container. Best would be to use docker-compose for starting containers, so that paramateres can easily be configured.

Example for a nginx container

1. run "nginx -t" inside the container to check if the container still has a valid configuration file
2. check if nginx is exposing services on port 80 and 443

Similar for other containers, main topic is checking ports for rest services. After bringing up the container(s), the tests should be run and then the whole thing shoudl be shutdown again.

What is the best tool for doing such a thing automated - and not writing everything manually?

# Answer
Although we're deploying to Kubernetes, we've found that `docker-compose` is a nice way of running tests in CI. Either set the `IS_TEST` flag in your container or use a separate `Dockerfile` where tests scripts are wired up. That way you can just run `docker-compose build` to test, and pull in any dependencies you might need as well.
> 2 votes

# Answer
One could use serverspec to test whether a service like nginx is exposing ports, .e.g:

```
require 'spec_helper'

describe port(80) do
  it { should be_listening }
end

describe port(443) do
  it { should be_listening }
end

```

Once the serverspec code has been written one could create a script that starts the nginx, subsequently runs the serverspec and finally destroys the nginx.
> 1 votes

---
Tags: docker, continuous-integration, testing
---


# Question
Title: What does it mean that "outside of memory-managed code execution runtimes (JVM, Go, etc.) the usefulness of unikernels starts to rapidly decline"?
The benefit of unikernels is managing a large number of applications in a protected space. (Some might say all the benefits of Docker without all the overhead). (Please don't get me wrong - I'm a huge fan of docker and use it 20 times a day in my work - I'm using this question as a a way to explore an idea).

The following commentator writes:

> Another minor point is that outside of memory-managed code execution runtimes (JVM, Go, etc.) the usefulness of unikernels starts to rapidly decline.

Now to me, a server application written in C++ (not memory managed) vs Java (memory managed) has no impact on the utility of a unikernel. In both you get the isolated protected way to manage your application lifecycle. Perhaps I'm missing something.

My question is: **What does it mean that "outside of memory-managed code execution runtimes (JVM, Go, etc.) the usefulness of unikernels starts to rapidly decline"?**

# Answer
Well, I'm not a big expert on the matter and, in fact, I don't understand the statement. I've read it several times and there is no further explanation, so I cannot say it's make sense or not for me because I just don't know where the idea comes from.

Anyway I'll try to expose what I think here. The main difference about managed and unmanaged code is who is in charge of the memmory management. If it's the developer, we're talking about unmanaged code (C language). If there is a garbage collector or any other similar mechanism, it's managed (Go, Java, .Net platform, Python even bash if you want to consider it!!). So I don't undertand how important is who reserves/frees/whatever the memmory.

And, IMHO, pros of unikernels are supossed to be:

1. Performance.
    1. Kernel modes are supressed (rings for x86, modes for arm, ...) and the application that will be running in the system, as well as any library needed, is compiled and statically linked into the kernel and the overhead introduced by these mechanism (syscalls basically) are supressed.
    2. Kernel is reduced as much as possible. No USB, bluetooth, support for lots of FS and unnecessary code is just not compiled. Kernel gets tiny.
2. Security. This is a sensitive topic. Again, I think unikernels are safer than the traditinal ones. If it's a well-done job, there won't be nothing than the minimun functionalities implemented into the system, so this should reduce possible break-points. However, if any is found, this will be more dangerous. Every single process is running by the privileged privileged (and only, multiuser capabilities are disabled in unikernels) user in the system. Privileged Remote code executions can happend. However, it should be in a container-like system. You just can restart it and (in no persistent systems) all the work done by the attacker should be gone (but still an upgrade should be needed...).

As I said, I cannot figure out the reason of this statement, but I think it's related to performance rather than security. In that case, I'm wondering why should be a performance improvement reducing syscalls compared to containers if:

1. Containers share the running kernel within the host where are running, so syscalls are done just once as there is just one instance of the kernel running.
2. Unikernels, as said, do not use syscalls and every procces runs in privileged mode (can access the harware directly). But, in this case (I THINK) as far as kernels are different, you need a virtualization layer, so total running kernels are 2. Unikernel has no syscalls but the host kernel does, so syscalls are not supressed and will run once. Of course, I'm assuming that no-one will run a unikernel system on a bare-metal.

So, the number of syscalls should be pretty similar to the containers scenario. Isn't it?
> 0 votes

---
Tags: docker, containers
---


# Question
Title: Where is the documentation of Kubernetes API server configurations?
## Questions

Where is the explanations or documentations of the Kubernetes API Server configuration parameters?

## Background

There are parameters to configure for Kubernetes API server e.g. KUBE\_API\_ADDRESS (which seems needs to be changed from 127.0.0.1) for multi node cluster to work.

Looking for a definite configuration documentation of how to configure API server but so far could not find one.

Setup CentOS (Kubernetes.io) says below.

```
# The address on the local server to listen to.
KUBE_API_ADDRESS="--address=0.0.0.0"

```

Kubernetes GitHub says below.

```
# --insecure-bind-address=127.0.0.1: The IP address on which to serve the --insecure-port.
KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"

```

Connecting to Kubernetes API server from outside of Vagrant box #250 says below.

> By default kube-apiserver listens only on 127.0.0.1. Without reconfiguring it it is not possible to connect to Kubernetes using kubectl from another machine.

Kubernetes 1.7 /etc/kubernetes/apiserver is below.

```
###
# kubernetes system config
#
# The following values are used to configure the kube-apiserver
#

# The address on the local server to listen to.
KUBE_API_ADDRESS="--insecure-bind-address=127.0.0.1"

# The port on the local server to listen on.
# KUBE_API_PORT="--port=8080"

# Port minions listen on
# KUBELET_PORT="--kubelet-port=10250"

# Comma separated list of nodes in the etcd cluster
KUBE_ETCD_SERVERS="--etcd-servers=http://127.0.0.1:2379"

# Address range to use for services
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"

# default admission control policies
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota"

# Add your own!
KUBE_API_ARGS=""

```

# Answer
> 4 votes
https://github.com/kubernetes/kubernetes/blob/master/cluster/centos/master/scripts/apiserver.sh

> ```
> # Insecure kube configuration parameters go under here when node['kubernetes']['secure']['enabled'] == 'false'
> <% if node['kubernetes']['secure']['enabled'] == 'false' -%>
> KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"
> ...
>
> # Secure kube configuration parameters go under here when node['kubernetes']['secure']['enabled'] == 'true'
> <% if node['kubernetes']['secure']['enabled'] == 'true' -%>
> KUBE_API_ADDRESS="--bind-address=0.0.0.0 --insecure-bind-address=127.0.0.1 "
> ...
>
> ```

It seems that the `KUBE_API_ADDRESS` will only listen to 0.0.0.0 if kubernetes has been secured.

---
Tags: kubernetes, documentation
---


# Question
Title: Kubernetes API Server KUBE_SERVICE_ADDRESSES parameter and Pod Network configuration
# Question

Where is the Kubernetes documentation regarding KUBE\_SERVICE\_ADDRESSES parameter of API server and Pod network configuration?

## Background

KUBE\_SERVICE\_ADDRESSES parameter value needs to go hand-in-hand with CIDR configuration of the Pod network, because `KUBE_SERVICE_ADDRESSES` is "Address range to use for services" and I suppose `services` communicate in the Pod network.

Trying to find out a Kubernetes document which explains it but looks no specific documentation. Please suggest if this is true and where is the documentation related.

**/etc/kubernetes/apiserver**

```
# The address on the local server to listen to.
#KUBE_API_ADDRESS="--insecure-bind-address=127.0.0.1"
KUBE_API_ADDRESS="--insecure-bind-address=0.0.0.0"

# The port on the local server to listen on.
# KUBE_API_PORT="--port=8080"

# Port minions listen on
# KUBELET_PORT="--kubelet-port=10250"

# Comma separated list of nodes in the etcd cluster
KUBE_ETCD_SERVERS="--etcd-servers=http://127.0.0.1:2379"

# Address range to use for services
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"

# default admission control policies
KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota"

```

## Related sites

Using kubeadm to Create a Cluster (3/4) Installing a pod network says specific CIDR needs to be specified to `kubeadm init` as a option `--pod-network-cidr`.

Deploy a Multi-node Kubernetes Cluster on CentOS 7:

> Create a flannel-config.json file that will define the Flannel settings. The subnet specified in the Flannel settings should match that of the API server KUBE\_SERVICE\_ADDRESSES value. This is the subnet that the containers will use.

# Answer
https://kubernetes.io/docs/getting-started-guides/centos/centos\_manual\_config/

> ```
> # Address range to use for services
> KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"
>
> ```
> 3 votes

---
Tags: kubernetes, configuration
---


# Question
Title: String to specify to KUBE_SERVICE_ADDRESSES (API Server configuration)
What are the strings to set to `KUBE_SERVICE_ADDRESSES` and their meanings? Which documentation or GitHub repo to look into to understand?

Background: I have seen a few strings but not sure what these strings mean. Such as:

```
KUBE_SERVICE_ADDRESSES="--portal_net=10.254.0.0/16"
KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=10.254.0.0/16"

```

# Answer
> 1 votes
According to this Q&A and this code the `--portal_net` was renamed to `--service-cluster-ip-range` since version 0.18.

> ```
> # --service-cluster-ip-range=<nil>: A CIDR notation IP range from which to assign service cluster IPs.
> # This must not overlap with any IP ranges assigned to nodes for pods.
> KUBE_SERVICE_ADDRESSES="--service-cluster-ip-range=${SERVICE_CLUSTER_IP_RANGE}"
>
> ```

---
Tags: kubernetes, configuration
---


# Question
Title: Which Chef software do we need to install for Windows?
I am using Windows 8.1. Which Chef do I need to install to cover all Chef modes like workstation, node, and chef-server?

I want all three of these in my Windows 8.1.

# Answer
> 4 votes
A node in chef terminology is a machine managed with chef-client.

Chef-client is available for various OS, windows, Linux, Aix, Mac etc.

However the chef-server is only available for linux.

# Answer
> 3 votes
To clear which module you need to install & where, just go through the terminology of chef at chef.io For workstation, you need to install chefDK

For node, you need to install chefclient

For chef server, you need to install chefserver \- not available for windows

Note: Always use the stable and latest version of the above-mentioned components.Hope this helps.

---
Tags: chef, windows
---


# Question
Title: CI/CD for microservices in monorepo on Gitlab
I'm working on a project that consists of several different services in different languages (a React webapp, a Scala backend, some Python stuff etc). I currently have each of these services in separate repositories on Github, and build them separately using CircleCI.

Some people seem to promote mono repos. As I'm planning to migrate the code over to Gitlab I wanted to take the opportunity to understand how this could be made into a monorepo. I have three questions:

1. Assume I put all the services in the same Project (Gitlab repos are called Projects right?), can I then get the CI/CD system to build each component independently?
2. Can I have Gitlab emit several images into my container registry?
3. Assume I commit a change to one service, and want to make sure it works with my other services before I deploy, how do I best setup integration tests that condition the success of my commit on the interaction with my other services?

# Answer
> 4 votes
Monorepos are nice because it eliminates the technical constraints between multiple projects. This does however open the door to other complications within your repository (naming conventions, cross-team dependencies, merge conflict increases, etc.). I do not have any experience with CircleCI, but I will provide some input based on other CI tools I have used.

1. I don't see any reason why you wouldn't be able to. In your CI/CD system, instead of referencing your individual source repositories, you will use your main monorepo as the source repository and then reference the specific project directory within it.
2. It looks like as of GitLab version 9.1 this is supported.
3. In my opinion, this wouldn't be something that would happen on commit. You could do this, but I think it would slow down your development speed significantly and use up a lot of resources if you have many commits. The two key points to consider are:

1. Before every production release, you should run a full suite test on all projects in your infrastructure. This is the only way to be certain that all project dependencies are non-breaking.
    2. Tests/provisionings must run in parallel. By doing this, your full repository testing speed will be the length of the longest test/provisioning in your repository. (As a side effect, this puts an emphasis on speeding up your slowest test)

---
Tags: continuous-integration, continuous-deployment, gitlab, microservices, monorepo
---


# Question
Title: A comparison of idempotence and immutability
Many in the DevOps apply the cattle-not-pets mentality by implementing immutable infrastructure and redeploying when changes are needed (instead of modifying).

Configuration management has a *similar* principle of idempotence. What are the comparative benefits, similarities and drawbacks of immutability vs. impotence and which is more efficient? Can these be used synergisticly (eg, periodic deletion and redeployment of VMs or Docker containers using configuration management?)

# Answer
The two terms are very different.

Let us start with `immutability`, which literally means "no mutations" or "no changes". In the DevOps sense, it means that once you created an artifact, be that a container image, or a VM image, or maybe a package from compiled code - you declare that you will never ever change it. Often if any changes are required, you declare that a new version of "thing" will be created instead.

The term `idempotence` means that when changes are applied **multiple** times, the state is mutated (changed) just **once**. First, it already assumes that there are going to be changes applied which means that you cannot have something both immutable and have idempotent actions done to it (no actions are done to it by contract).

In the use of configuration management tools, `idempotence` is used in some cases when applying the same change multiple times. Like adding the line that says `localhost` to the `/etc/hosts` file, you don't really need multiple such lines and if one already exists it is safe to not try to append again.

Also `idempotent` is a term used to describe *actions* that attempt to change things, while `immutable` is used to describe *nouns* (objects) that are set against changes done to them.

---

Why is an `immutable` object useful? Because when you copy it around, for example from a dev environment to qa to production. You already know quite a lot (but not everything) regarding how it is going to behave. In many cases, the parts that are working will be consistent, and the parts that are broken are going to be consistent as well.

Why are `idempotent` actions useful? Because when you want to change a state of some object, in many cases it is useful to only verify that the change has been applied and apply changes just in case it is required. For example, when a configuration item in a file is missing or has the wrong value, it is useful to add it just once or change it just once while applying the action multiple times. In many other cases, like *log files*, you don't want to have idempotent actions because you often do want to append another line each time some event happens.
> 10 votes

# Answer
Immutable infrastructure is, in my mind, a different pattern to Configuration Management. While they can be used together, they approach problems by nature in two different ways.

The concept of Immutable Artifacts has a long history, Unix systems have been using them for decades to deploy software packages. But once they were deployed the configuration files were changed so things became mutable. Idempotency provides some nice guarantees with mutable files, we can know when things have changed and only update things that need updating. However it doesn't solve all the problems of mutable objects, we still need to cater a seemingly infinite number of edge cases. Because things are mutable and we are being idempotent we need to establish first what changes need to be made, then execute them generally in a very specific order. When deploying software packages, particularly with zero down time deployments, we need to carefully orchestrate changes to prevent any requests being dropped.

This complexity can ultimately be avoided by deploying immutable artifacts instead of mutating them in place, because we simply replace some object with another (whether it be a binary, or a container or a Virtual Machine), bring it into service and retire the old one. This is just one example of a zero down time deployment.

With advancements in tooling to allow us to deploy immutable artifacts to thousands of systems in a very small amount of time we are seeing using immutable tools to manage systems as a lot more feasible than configuration management. However the tooling is not there yet and there is still a use case for both. I did a talk on this subject which explains the linear progression from fully mutable to fully immutable, it's a spectrum and each company will chose where best fits for them.
> 2 votes

---
Tags: configuration-management, immutable-servers, cattle-vs-pet
---