# Question
Title: How to mange data access in a CICD pipeline for multiple users with different permissions
TLDR Question;

Is it possible to setup a CICD pipeline so that it executes with the permissions of the user who triggered the build? If so which tools support this?

Full Question;

Apologies if this is a naive question as I am new to CICD. We are trying to setup a CICD pipeline for our project which requires access to a restricted database. The issue we are facing is that each user on the project has different levels of access (which I believe is managed via LDAP) within the database (for example user A can access datasets X, Y & Z whilst user B can only access Z & W).

Due to the nature of our work, code is typically executed interactively (something we are trying to move away from) and such to execute any api that access the database users need to enter their username and password i.e.

```
get_data(dataset = A, username = $USER, password=$PASSWORD)

```

Our challenge is thus how to enable the CICD pipeline to access these data-assets without accidentally enabling people to access data that they shouldn't have access to.

I think the most obvious solution is to create a user account for the CICD tool itself, only giving it access to the datasets it needs and then embedding the username and password as secrets within the CICD tool. Our fear with this is that it then means that the project owner becomes responsible for ensuring that everyone with write access to the project has access to the data-assets that the project uses. Given user permissions change fairly frequently (as does project ownership) this doesn't seem like the safest or most sustainable way of solving the problem.

Ideally we are looking for a solution where the CICD tool executes with the same permissions as the user who triggered the build. Are there any tools that support this ? Or alternatively are there any different solutions that could solve our use-case?

Any help/guidance/pointers would be greatly appreciated !

# Answer
> 2 votes
My general experience is that CI/CD tools don't support impersonation or claims based authentication well or at-all. In addition you probably want the CI/CD tool to have **more** access than your users, because you want them to **only use the CI/CD tool** to change things.

The way I have handled this in the past, however, was as follows:

1. Have the pipeline call the API of the CI/CD to find out who ran the pipeline
2. Use this pipeline to look up the group's that the user is a member of this (i.e. in LDAP)
3. If the member is of the appropriate group, continue. If not abort the build.

It's quite important to **abort** rather than **fail** the build because then it differentiates between an invalid user running the build, and a valid using running a build which then fails.

Another approach would be to sync LDAP groups with your CI/CD platform, and set permissions that way, although that may not give you the granularity you want.

# Answer
> 2 votes
Most CI/CD tooling will support permissions of some sort. For example:

* All of AWS CI/CD tooling supports limiting permissions via IAM. IAM also ties into AD which would give you that SSO (single sign on) feel. Virtually every major cloud provider will have equivalent permission based functionality (e.g. Azure, Google Cloud).
* Bamboo supports limiting who can edit, view, and run builds and deployments. It also supports defining global or plan variables and limiting who has access to viewing those variables. I'm sure similar functionality exists in Jenkins.
* Most CI/CD tools can be setup to trigger based on Pull Requests. This allows only admins access to the build details while the developers can trigger builds automatically.

Since you are specifically looking for a strategy where the person who triggers the build has specific permissions, a Pull Request workflow combined with permissions roles be what you are looking for.

---
Tags: continuous-integration, cicd, role-based-access-control
---


# Question
Title: How do I create multiple versions of a lambda function in terraform
I have it creating one version. It has latest and version 2 but can’t getting it to create more than one version of the same lambda?

```
resource "aws_lambda_function" "lambda" {
  function_name = "test-lambda2"
  publish = true
  runtime = "python2.7"
  source_code_hash =  "${data.archive_file.lambda_zip.output_base64sha256}"                                             handler = "index.handler"
  filename = "lambda_function.zip"
  role = "${aws_iam_role.iam_for_lambda_tf.arn}"
}

```

# Answer
> 2 votes
This is shown in the Hashicorp tutorial - "a new version of the lambda function. The suggestion there is to point to a different zipfile in S3.

I suppose in your case, the filename either needs to change, or the file contents need to change.

The suggestion from the tutorial is to use a variable for the filename, associated with the version of the application.

---
Tags: terraform, aws-lambda
---


title: Best solution for code develop

text:
# Question
Title: Best solution for code develop
What is the best git solution for java code development? Make my own git server? Developers (Linux, Mac, Windows) are working on their local computers, then they are using my own git server.

Would Jenkins with Maven be a better solution? What is the benefit?

Thank you.

**Update**

I would like to find the best, lean, and simplest solution for our develop team. Here is some info:

* Team of about 10 developers.
* Everybody has their own LOCAL (windows, mac, linux), and their own IDE.
* Project could be developed in java, php, javascript, css, html. I think this is not important for now.
* My conception is, that I have 3 servers, 1st for DEV, 2nd for TEST and 3rd for PRODUCTION.
* Every server has own git environment, as I mentioned above.
* Process should be from LOCAL -\> DEV (check by lead developer), then from DEV -\> TEST (check by customer), then from TEST -\> PRODUCTION.
* And this is question if is Jenkins / Maven useful, or only git is sufficient.

Thanks.

# Answer
> 4 votes
**The Git Server**

It's best practice to setup a Git server for the team to access. This way you have a central server that can be maintained, backed up, and focus on serving the source code.

While you could create your own, there are also several popular commercial options available that often have free private repositories (non-exhaustive list):

The Git server will just be a repository for your code. It will allow for workflows like Pull Requests to better manage the changing code base. However, the Git Server will not build your code or deploy it anywhere.

**Jenkins**

Jenkins will not actually store your source code. Instead it is a tool used for Continuous-Integration (CI) and Continuous Deployment (CD), a big part of DevOps culture. The basic idea is that the Jenkins server will take the source code put into your Git server, ensure it compiles, automated tests pass, and possibly even deploy to your test environment. Tools like Jenkins work with multiple programming languages.

Maven is a tool is specific to building Java projects. Tools like Jenkins often have options to use Maven to build the project.

Setting up a CI/CD tool like Jenkins would be a great next step after you have a consistent place for everyone to store their code.

**Best Solution**

Gitlab, Bitbucket Pipelines, Azure DevOps are just three examples of tools that both house Git repositories and can do CI/CD. There are many options available for Git and CI/CD, and you can even combine them if you choose not to select an all-in-one solution. Which tools are best is opinion based, and the best practice is to use a tool that helps manage your Git repositories and a tool for CI/CD.

---
Tags: jenkins, git
---


# Question
Title: Is it a good idea to have a secondary person on call for production operations?
The primary person on call could need help in situations such as:

* There are too many issues goes on
* Primary needs to step out for a short amount of time
* There are certain activities that are better taken up by a secondary person so that the primary can focus on more critical issues

So, is it a better practice to have a secondary on call for production operations? If so, does it make sense for alerts to automatically go to the secondary person in case the primary person doesn't acknowledge them on time?

# Answer
> 7 votes
I can't imagine having only one person on-call at a given time. There are several reasons that the primary person could be unable to handle an issue - perhaps they are unable to receive alerts, they have limited Internet access for a period of time, they or a family member could be ill and they are unable to work yet the on-call rotation hasn't been updated yet. If you have agreements in which you need to start and/or resolve issues in a specified amount of time, having only one person to get notified and start the work seems very risky.

Having a clearly-defined second person is also useful if the first person gets stuck. There's someone who knows that they are on-call and is hopefully doing the best they can to remain in communication and have access to the resources they need. It makes it easy to know who that person is and get help when it's needed outside.

However, if you are having "too many issues going on" or have so many on-call issues that the primary needs to "focus on more critical issues", that would seem to be indicative of poor product or process quality. Situations that require someone being called off-hours should be rare and not the norm, and simultaneous issues should be very rare.

Of course, this is likely to vary by system. Companies that operate at scale of Amazon and Google are vastly different than a B2B service with half a million total users globally who use the system during working hours. Larger, more complex systems with a need for greater up-time are going to have more people on call and shorter thresholds before proceeding down a call tree than smaller systems.

# Answer
> 4 votes
# Yes!

And consider a third and a forth person if you're large enough. Folks can get sick. Their phone might have run out of battery. They might be dealing with a major local power outage. Folks go on vacation and forget to update the pager schedule. All of that, and more, can be addressed in a more reliable way by having a timeout on ack'ing a page before escalating to the next level. Typically 30 minutes is reasonable to give somebody a chance to ack a page. After that it is wise to try to see if someone else is actually available.

## Escalation Tiers

I've typically seen these escalations arranged into tiers. The earlier tiers tend to have a few folks operating in rotation while later tiers don't get much noise and often are the same person all of the time. While there are many variations on this theme I typically see something like:

1. junior SRE/DevOps engineer
2. senior SRE/DevOps engineer
3. manager of SRE or DevOps team
4. director of engineering or operations

I usually see 3 layers in practice. It is less common to see the Director there. The first two layers can be arranged to help people sleep more:

1. SRE where it is day-time
2. SRE where is is night-time
3. a manager

But even if you only have:

1. yourself
2. the other guy

that's much better than it just being one of you.

---
Tags: operations, pagerduty
---


# Question
Title: Provisioning a server on behalf of a user on GCP/AWS/Azure and probably relinquish access
I'd like to build a service where I run a custom setup script on behalf of a user on an `t2.micro` equivalent instance but be able to probably relinquish access to the server. Any advice on the tech stack and flows that I could use to accomplish this?

Let's assume I have unlimited access to AWS resources to create as many instances as I like. The service is targeted at users unfamiliar with how even `ssh` works and we are basically setting up a custom software service automatically that runs on their dedicated service. But we need to prove that there is no way we can gain access to this user's server again.

Any help about creative ways to accomplish this?

# Answer
> 2 votes
Rather than provisioning resources on-behalf of a user which would require them exposing their credentials to you in some way, I would implement this using the various marketplaces:

This has a couple of advantages:

1. It's fully automated, you are never exposed to their subscriptions thus you don't need to prove that you no longer have access - you never had it in the first place.
2. Everything is created within the customer's Subscription (Azure), Account (AWS) or Project (GCP) thus they bear all of the costs, you then get money from the cloud provider based upon how you price yourself in the marketplace.
3. You can generally create more than just a VM, i.e. you could create a PaaS Database for persistence.

---
Tags: docker, amazon-web-services, terraform
---


title: How to secure appspec file?

text:
# Question
Title: How to secure appspec file?
What's the best way to ensure that developers can't modify the contents of the appspec.yml file used by AWS CodeDeploy? This file executes scripts on production servers with root privileges so it would be ideal if there were a way to ensure the files can't be modified by anyone with access to the application repository.

Please note that I'm looking for technical suggestions.

Please also note I'm using CodeDeploy as part of CodePipeline with GitHub as source.

# Answer
The way I handled this in the past was to have a separate repository that contains the scripts, as most of them ended up shared across multiple projects anyway. Then your `appspec.yml` file just contains references to the scripts and imports them via a submodule. It's not perfect because a developer could change the `appspec.yml` to call his own scripts instead, although that's a lot more obvious.

Another approach I have used on Azure is to require that scripts are signed with a specific GPG key. I used a PowerShell and a CodeSigning certificate, but I suspect there is an equally suitable solution with GPG.

A final approach would be to automatically fail the build or reject the commit if changes are detected within `appspec.yml` except when those changes are made by an "approved" person.
> 2 votes

# Answer
You could store this file in a Version Control System (VCS) like CodeCommit and ensure that the developers can only merge it when a pull request has been approved by you.
> 1 votes

---
Tags: aws-codedeploy
---


# Question
Title: Force Jenkins to reschedule parallel pipeline step as soon as node goes offline
Exactly this. In our environment, we're using GCE preemptible nodes and the Jenkins GCE plugin. As a consequence of this, it's highly likely (even expected) that a node will go away during the course of a build. The problem is, the Jenkins GCE plugin just marks that node as "offline", but a parallel job "part" that was assigned an executor on that node will just keep churning away there, seemingly forever, apparently in the hope that the node will come back.

The question I have, then, is simple:

Is it possible to force Jenkins to reschedule (***NOT*** fail) a parallel build "part" as soon as the node it's executing on goes offline? If so, how is this done?

# Answer
> 2 votes
There are two approaches to this, neither of them, in my opinion, are especially good as they don't strictly "NOT Fail" the build:

1. Use a plugin such as Naginator which can be configured to restart the build until it passes. This can be quite frustrating as you need to differentiate between ephemeral/preemptable virtual machines being terminated and a truly failed build.
2. Move to an orchestrator model that manages individual jobs and restarts them based upon a set of rules.

Perhaps a better solution would be to develop a Jenkins Plugin similar to the EC2 Fleet Plugin which is responsible for spinning up and maintaining Spot Instances (i.e. similar to GCEs Preemptable Instances) resubmitting jobs when they fail due to instance reclamation.

---
Tags: jenkins, jenkins-pipeline
---


title: Trigger Jenkins Job from Azure DevOps

text:
# Question
Title: Trigger Jenkins Job from Azure DevOps
I want to trigger Jenkins Job when anyone pushes the code in Azure DevOps Repository. However, when I set up Jenkins Service Connection in Azure DevOps I am getting the following error:

> Failed to query service connection API: 'JenkinsURL'. Error Message: 'A task was canceled.'

I have tried enabling port 8080 in the VM to resolve this.

# Answer
> 2 votes
The error message you have provided indicates that this is a problem with the configuration that could be permission related. Here are some steps to help resolve this issue:

* You can follow guides where other people have configured the two. Pay special attention to the permission settings that are selected.
* Double check your permissions on the servers. While you may have configured Jenkins to communicate with Azure DevOps, you still need to make configuration changes in DevOps.
* Double/Triple check your URLs on both systems. I've been burned by dropping an **s** on http or missing a character on a copy paste.
* If you are setting this up within Azure check the Azure Role Based Access Control to make sure proper permissions exist.

---
Tags: jenkins, azure-devops, cicd
---


# Question
Title: Deploying software that depends on a virtual machine using Docker
# About

I am developing a piece of software which consists of a Node.js application which controls a virtual machine that runs Android-x86. Also there are some pieces of the Android SDK like ADB the software depends on.

# My current approach

Currently there is no smart way of deployment whatsoever at all. Everything has to be installed manually. Depending on the system I also get issues regarding networking and so on from time to time.

To solve problems of these kinds I usually would use Docker. Therefore that was my first thought here as well. So such a Docker container would simply run the Node.js application as well as the virtual machine.

# My problem

For me it became a bit confusing (and maybe even pointless) when I wanted to use a virtual machine inside of a Docker container. Due to there is obviously no way I can run an Android-x86 Docker container I cannot come up with any other solution than a virtual machine inside of Docker.

# My question

Is it fine to do as I mentioned or are there any better ways or even best practices to use a virtual machine inside of a container?

# Edits

* I want to add that a possible solution does not have to be utilizing Docker. If there is any other technology that is able to create a container-ish construct which in further consequence is able to run a virtual machine I would be happy to get to know it.

# Answer
> 2 votes
Frankly, I've never seen running a VM inside Docker. I believe it would be very slow. Have you checked if https://github.com/budtmo/docker-android is useful?

This Video talks about the Docker and Android SDK as well - https://www.youtube.com/watch?v=YwBAqMDYFCU

---
Tags: docker, virtualbox
---


# Question
Title: Datapoints motivating introduction of SRE in organisation
As there is no Site Reliability Engineering dedicated stackexchange, I found this to be closes one.

There are multiple great resources to use as inspiration for slidedeck about SRE principles \[SRE slides\].

Still I can't find :

* short
* concise
* examples
* motivating spending resources to implement SRE in organisation.

Most what I experienced in my professional life were highly confidential cases and numbers. I am concerned that most numbers that SREs know, are to remain "internal" to be presented internally within corporations.

However, maybe you know some study, (preferably set of) nice examples of post-morthems (even one by one is good), from which we could make a strong arguments like "after introducing SRE model into organisation velocity of changes grown from n to m release pushes per x, with increase of availability by y and decrease of costs by z" (brainstorming) or other hard data points?

\[SRE slides\] - some examples:

P.S. If this question could be rephrased to fit better into this site guidelines, please provide me a suggestion in comment and give me a change to improve. Otherwise, I will appreciate other better platforms (However e.g. reddit.com/r/sre did not make great impression to me)

# Answer
> 3 votes
The types of numbers you're looking for might be hard to come across, because they're highly variable (even within one organization, it varies service-to-service and team-to-team, in my experience.) The SRE Workbook is now available for free, and includes two case studies (chapter 3) that might be helpful. Also, New Relic's SRE eBook does a really good job of summarizing SRE in a concise way.

Another way to approach this would be to try to use what you know about your service today to create a risk assessment and estimate downtime you can prevent if you had SRE and dev support to eliminate those risks

# Answer
> 1 votes
I am operating in both DevOps and Site Reliability Engineering organisations across several companies. I would say that SRE has the advantage of being far more concrete than DevOps.

* **DevOps** emphasises principles and mindsets, for example, the three ways of DevOps: Systems Thinking, Amplification of Feedback Loops and a Culture of Continuous Experimentation and Learning. DevOps more of an extension to Agile that a different operating model.
* **Site Reliability Engineering** emphasises the specific approaches, metrics and measures that Google (and others) apply to achieve a high level of service availability and confidence in the customer. f.ex: The ratio of toil to improvements, quantitative risk analysis and mathematical approaches to SLIs and SLOs.

Because SRE Implements DevOps it's a little unfair to try and compare organisations who do one but don't do the other, so I would actually suggest that all of the content in Accelerate can just as easily be applied to Site Reliability Engineering, thus if you need peer-reviewed data-driven analytics to start there.

---
Tags: sre
---


# Question
Title: Serve an application built by the pipeline
In the company that I work, the frontend application is very complex, so one of our layers of testing includes building/serving the application and testing with integrations mocked (The application isn't deployed anywhere on this step).

Right now we are trying to migrate from Jenkins to Gitlab CI, but I have no clue how to do this. I have the build artifact (Some html/css/js) but I couln't find any information how to share the artifact with some Gitlab CI `service`.

Basically what I want do achieve is Build -\> Serve the application that was built -\> Run some tests on it

Is it possible to do this?

# Answer
> 1 votes
Gitlab CI/CD offers Docker Engine. If you can create a docker image, you can serve the application the same way as you were doing with Jenkins. You can find more details on how to integrate both here.

Hope it helps.

---
Tags: continuous-integration, gitlab, gitlab-ci-runner
---


# Question
Title: Configuration of AWS CodePipeline for Android CI/CD
I'm trying to set up a basic CI/CD pipeline for an Android project using AWS CodePipeline and I have 3 steps in the pipeline as follows:

1. ***Source:*** Pull project from GitHub repo
2. ***Build:*** Build the android app using a Docker image (futurenda/ android-sdk)
3. ***Test:*** Run instrumentation tests (Espresso tests)

Currently the Source and Build steps work fine (both are successful). From my understanding of running tests in CodePipeline, you can use CodeBuild and simply invoke the tests as you normally would from the command line. In this case, to invoke Espresso tests I can run `sh gradlew connectedAndroidTest` on my local machine.

I've set the pipeline up with the Build and Test steps being 2 separate CodeBuild projects, each with their own `buildspec.yml` file. For the Build step (which is working), the file is named `buildspec-build.yml`, and is found by CodeBuild without issue. However, for the Test step (not working) my `buildspec.yml` file is not found. They are both located in the root of my project (and confirmed to be pushed to my remote GitHub repo).

The error I receive is: `stat /codebuild/output/src712781592/src/buildspec.yml: no such file or directory`. This happens during the `DOWNLOAD_SOURCE` step in the CodeBuild project. I've checked to CodeBuild project to ensure it is indeed expecting a file named `buildspec.yml`.

Any ideas?

Here are both of my buildspec.yml files, if it matters:

`buildspec-test.yml` (found by CodeBuild):

```
version: 0.2
phases:
    build:
        commands:
          - $ANDROID_HOME/tools/bin/sdkmanager "build-tools;27.0.3" "platforms;android-27"
          - sh gradlew assembleDebug
    artifacts:
         files:
             - app/build/outputs/apk/debug/app-debug.apk
             #some other stuff here.

```

`tester-buildspec.yml` (not found by codebuild):

```
version: 0.2
phases:
  build:
    commands:
      - sh gradlew connectedAndroidTest
artifacts:
  files:
    #other stuff that doesn't really matter here

```

Just to recap: I have a pipeline set up with 2 CodeBuild projects as steps within the pipeline. The first CodeBuild project finds the `buildspec.yml` file, but the second one doesn't.

# Answer
The indentation looks incorrect for the artifacts section in your `buildspec-test.yml` file. It is nested under the phases section. That way it is not being output properly and can't be picked up by the next build.

It should be the same as in your second file.

```
version: 0.2
phases:
  build:
    commands:
      - $ANDROID_HOME/tools/bin/sdkmanager "build-tools;27.0.3" "platforms;android-27"
      - sh gradlew assembleDebug
artifacts:
  files:
    - app/build/outputs/apk/debug/app-debug.apk
  #some other stuff here.

```
> 3 votes

---
Tags: amazon-web-services, continuous-integration, build-pipeline
---


title: reboot server during Ansible tasks

text:
# Question
Title: reboot server during Ansible tasks
I have 3 scripts that must be run on server one by one. for example:

```
- name: find config
  shell: /data/scripts/config1
  become: yes
  become_user: root
  tags: find_config

- name: change config
  shell: /data/scripts/config2
  become: yes
  become_user: root
  tags: change_config

- name: confirm config
  shell: /data/scripts/config3
  become: yes
  become_user: dbusr1
  tags: confirm_config

```

in second script `config2` there is a reboot command and then the rest of script will be run at start up. something like this:

```
some variables
.
.
commands before reboot
.
.
reboot command
.
.
commands that run at start up

```

does this reboot affect ansible tasks? how i can write tasks that wait until `commands that run at start up` be run then execute `config3`? is this even possible in ansible? what modules should i use?

# Answer
> 4 votes
Use this source code for reboot your client machine

```
---
  - name: System Reboot
    hosts: debian
    become_method: sudo
    become_user: root
    become: true
    tasks:
      - name: reboot nodes     # Reboot client side debian machine
        shell: sleep 2 && shutdown -r now "Ansible reboot"
        async: 1
        poll: 0
        ignore_errors: true
      - name: wait for the server to come back  # when server timeout it through error. That error is handle by ignore_errors.
        local_action: wait_for
        args:
          host: "{{ inventory_hostname }}"
          port: 22
          state: started
          delay: 120
          timeout: 200
        ignore_errors: true

```

# Answer
> 3 votes
https://docs.ansible.com/ansible/latest/modules/reboot\_module.html

> ```
> - name: Unconditionally reboot the machine with all defaults
>   reboot:
>
> - name: Reboot a slow machine that might have lots of updates to apply
>   reboot:
>     reboot_timeout: 3600
>
> ```

---
Tags: ansible, linux, centos
---


# Question
Title: Ansible: Test if multiple RDS instances are all stopped
With Ansible, I'm stopping several RDS (it could be EC2) instances.

Then I want continue only when all of them are in the state stopped. I use the following task:

```
- name: Wait for RDS modify to finish
  rds_instance_facts:
    aws_access_key: "{{ assumed_role.sts_creds.access_key }}"
    aws_secret_key: "{{ assumed_role.sts_creds.secret_key }}"
    security_token: "{{ assumed_role.sts_creds.session_token }}"
    db_instance_identifier: "{{ item }}"
    region: "{{ region }}"
  loop: "{{ vars[ 'list_rds_resources_ids1_' ] + vars[ 'list_rds_resources_ids2_' ] }}"
  register: aws_rds_facts
  until: aws_rds_facts[0].db_instance_status == "stopped"
  retries: 90
  delay: 10

```

Right now, my code is testing only the first element. How to make the test on all existing elements at the same time ?

# Answer
> 1 votes
I found the solution to my problem:

In the main.yml task :

```
- include: wait_rds_are_stopped.yml
  when: chosen_action == "stop"
  loop: "{{ vars[ 'list_rds_resources_ids1_' + environment ] + vars[ 'list_rds_resources_ids2_' + environment ] }}"
  loop_control:
    loop_var: outer_item

```

In the wait\_rds\_are\_stopped.yml task:

```
- name: Wait for RDS stop to finish
  rds_instance_facts:
    aws_access_key: "{{ assumed_role.sts_creds.access_key }}"
    aws_secret_key: "{{ assumed_role.sts_creds.secret_key }}"
    security_token: "{{ assumed_role.sts_creds.session_token }}"
    db_instance_identifier: "{{ outer_item }}"
    region: "{{ region }}"
  register: aws_rds_facts
  until: aws_rds_facts.instances[0].db_instance_status == "stopped"
  retries: 90
  delay: 10

```

Thus, the loop control is outside. The stop of the 3 databases has been launched before, without waiting, so we save time. And the external loop will finish only when all the databases are stopped.

# Answer
> 2 votes
If I understood you correctly, you need `free strategy`. It will run all tasks ASAP, not waiting for anything. https://docs.ansible.com/ansible/latest/plugins/strategy/free.html

Bear in mind, that logs will be a mess :)

---
Tags: ansible, amazon-rds
---


title: Waiting for privilege escalation prompt

text:
# Question
Title: Waiting for privilege escalation prompt
I'm new with Ansible so hope to find answers here. I'm trying to run some playbook but getting an error:

```
fatal: [10.65.30.117]: FAILED! => {
  "msg": "Timeout (12s) waiting for privilege escalation prompt: "
}

```

Here are the steps which I performed:

1. I installed Ansible 2.6.17 on RHEL 6.8 using root user.
2. I update /etc/ansible/host with new group of IPs (with root user)
3. I created playbook file (with some other user) with the following content:

```
  name: sample_playbook
  hosts: [ansible_clients]
  remote_user: ronenal
  become: true
  tasks:
     - name: create file
       file:
         path: /tmp/ansible.log
         state: touch
         mode: u=rw,g=r,o=r

```

When I execute `ansible-playbook -sample_playbook.yml` I'm getting the above error.

I set `ANSIBLE_DEBUG=1` and it looks like it related to sudo command. The user which I use is not in the sudoers list.

My questions:

1. Is it required to be a privileged user in order to execute Ansible playbook?
2. if no, what am I doing wrong?
3. if yes, is that mean that I need to add this user to the sudoers users list?

# Answer
You don't need to be a privileged user (in your local machine) in order to execute Ansible playbook.

When using `become`, Ansible allows you to ‘become’ another user, different from the user that logged into the machine (remote user).

For more details see Understanding Privilege Escalation

In your inventory of hosts `/etc/ansible/host` you have specified a group of IPs with root user while you are specifying a `remote_user: ronenal` in your playbook.

So you need to run ansible-playbook with --ask-become-pass or -K.
> 2 votes

# Answer
I agree with Fodil, but I would also recommend using **psexec** for working with windows. Ansible has a command **"win\_psexec"** that helps to use escalated privileges without using **Become**.
> 1 votes

---
Tags: ansible, windows
---


title: Clear Sonarqube Current Analysis

text:
# Question
Title: Clear Sonarqube Current Analysis
I want to clear Sonarqube project current code analysis and make the project blank. Is it possible? I know we can clear all the previous analysis, but I want to clear the current analysis of Sonarqube project.

# Answer
If you mean removing a "snapshot" of an analysis according to the most recent SonarQube documentation you should be able to this. Also if you have access to the database SonarQube is using then you could remove the analysis directly from there. That option may introduce other issues though depending on how SonarQube handles it.
> 1 votes

---
Tags: sonarqube
---


# Question
Title: Multiple Microservices in CI environment
hey we have a GitLab stage and inside that we need to start an environment with several containers we pull from a local registry.

We use compose and a docker in docker solution for that at the moment.

The problem is, that the compose.yml now hold all the configuration for each service.

So if we change it for one service, we need to update it in each docker-compose.yml in each project.

What is the standard approach for such a setting?

Thanks

# Answer
> So if we change it for one service, we need to update it in each docker-compose.yml in each project.

That's sounds like duplicate code and there are many ways to avoid that. But without more detailed information about how your setup looks like it's difficult to help.

Within a pipeline you can access other projects and their source code. Maybe Git Submodules is an option. Or you might be interested in the include keyword of GitLab CI.
> 1 votes

---
Tags: docker, docker-compose, gitlab, cicd, docker-in-docker
---


# Question
Title: How to provide multiple configs for EC2 node using Terraform and cloud-init?
I need to use several configs on my EC2 node using Terraform.

```
data "template_cloudinit_config" "puppetserver_config" {
    gzip             = true
    base64_encode    = true
    part {
        filename     = "initial.sh"
        content_type = "text/x-shellscript"
        content      = "${data.template_file.initial_config.rendered}"
    }

    part {
        filename     = "puppetserver_config.cfg"
        content_type = "text/cloud-config"
        content      = "${data.template_file.puppetserver_config.rendered}"
    }
}
data "template_file" "puppetserver_config" {
    template = "${file("${path.module}/puppetserver_config.tpl")}"
}

data "template_file" "initial_config" {
    template = "${file("${path.module}/initial_config.sh")}"
}

```

node declaration:

```
resource "aws_instance" "puppetserver" {
    depends_on             = ["aws_security_group.puppetserver"]
    count                  = 1
    key_name               = "${var.key_name}"
    ami                    = "${data.aws_ami.centos7.id}"
    instance_type          = "${var.instance_type}"
    user_data              = "${data.template_cloudinit_config.puppetserver_config.rendered}"
    security_groups        = ["${aws_security_group.puppetserver.name}"]

    tags {
        Name = "puppet"
    }
}

```

But when it's being bootstrapped I see only `initial_config` worked. `puppetserver_config` is ignored. How to make it work properly? May be I have wrong extensions for my configs? Or I just do not trigger its' launching? Thanks in advance.

# after hours of troubleshooting i found out that there might be something wrong with encoding. `/var/log/cloud-init.log` says:

```
[root@ip-172-31-29-73 ec2-user]# cat /var/log/cloud-init.log
Aug 10 09:45:24 ip-172-31-29-73 cloud-init: Cloud-init v. 0.7.6 running 'init-local' at Thu, 10 Aug 2017 13:45:24 +0000. Up 5.79 seconds.
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: Cloud-init v. 0.7.6 running 'init' at Thu, 10 Aug 2017 13:45:31 +0000. Up 12.31 seconds.
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: ++++++++++++++++++++++++++Net device info+++++++++++++++++++++++++++
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: +--------+------+--------------+---------------+-------------------+
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: | Device |  Up  |   Address    |      Mask     |     Hw-Address
|
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: +--------+------+--------------+---------------+-------------------+
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: |  lo:   | True |  127.0.0.1   |   255.0.0.0   |         .
|
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: | eth0:  | True | 172.31.29.73 | 255.255.240.0 | 0a:99:c0:8b:b0:60 |
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: +--------+------+--------------+---------------+-------------------+
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: +++++++++++++++++++++++++++++++Route info++++++++++++++++++++++++++++++++
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: +-------+-------------+-------------+---------------+-----------+-------+
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: | Route | Destination |   Gateway   |    Genmask    | Interface | Flags |
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: +-------+-------------+-------------+---------------+-----------+-------+
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: |   0   |   0.0.0.0   | 172.31.16.1 |    0.0.0.0    |    eth0   |
 UG  |
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: |   1   | 172.31.16.0 |   0.0.0.0   | 255.255.240.0 |    eth0   |
 U   |
Aug 10 09:45:31 ip-172-31-29-73 cloud-init: ci-info: +-------+-------------+-------------+---------------+-----------+-------+
Aug 10 09:45:32 ip-172-31-29-73 cloud-init: 2017-08-10 09:45:32,367 - cc_write_files.py[WARNING]: Undecodable permissions None, assuming 420
Aug 10 09:45:32 ip-172-31-29-73 cloud-init: 2017-08-10 09:45:32,372 - util.py[WARNING]: Running module write-files (<module 'cloudinit.config.cc_write_files' from '/usr/lib/python2.7/site-packages/cloudinit/config/cc_write_files.pyc'>) failed

```

# Edit:

I have a similar but properly working config for my backend nodes:

```
data "template_file" "backendnode_config" {
    template = "${file("${path.module}/backendnode_config.tpl")}"
    vars {
        puppetserver_address = "${aws_instance.puppetserver.private_ip}"
        puppet_environment   = "${var.puppet_environment}"
    }
}
data "template_cloudinit_config" "backendnode_config" {
    gzip             = true
    base64_encode    = true
    part {
        filename     = "initial.sh"
        content_type = "text/x-shellscript"
        content      = "${data.template_file.initial_config.rendered}"
    }
    part {
        filename     = "backendnode_config.cfg"
        content_type = "text/cloud-config"
        content      = "${data.template_file.backendnode_config.rendered}"
    }
}

```

# Answer
It sounds like you want to do some configuration management upstream from the terraform. I would suggest following a pattern of writing Packer templates to build and provision the AMIs *before* running the terraform plan and apply. By judiciously applying tags to the image name, you can write a `data` statement to reliably find it.

Your pipeline will be a bit longer (you need to add the packer build step to it), but your configuration will be more reliable and easier to maintain.

Note: I realise that this does not answer your actual question -- it is more along the lines of "don't do what you want, do something else. My opinion is that since terraform is for provisioning infrastructure, it is something of an abuse to extend its use too far into configuration management, and it would be better to use something more suited to the job.
> 2 votes

---
Tags: amazon-web-services, amazon-ec2, terraform, cloud-init
---


title: Chef 12: Error while uploading cookbook

text:
# Question
Title: Chef 12: Error while uploading cookbook
I am using Chef and trying to upload a cookbook on chef-server but getting an error in response:

> {"error":\["Invalid key all\_files in request body"\]}

However, I can see the list of cookbook using `knife node list`

My chefDK version:

```
chef -v
Chef Development Kit Version: 2.0.28
chef-client version: 13.2.20
delivery version: master (17c1b0fed9be4c70f69091a6d21a4cbf0df60a23)
berks version: 6.2.0
kitchen version: 1.16.0
inspec version: 1.31.1

```

Chef-server version is `12.0.5`

Logs:

```
DEBUG: Response body contains:
{"error":["Invalid key all_files in request body"]}
DEBUG: Chef::HTTP calling Chef::HTTP::JSONInput#handle_response

```

I can't upload more logs, if one needs particular info then I can provide.

Any help?

# Answer
> 1 votes
This question seems to have been answered in the Chef issue. To close the loop, I will summarise it here:

This was a bug introduced in Chef 12:

> The issue is with `chef_solo` vs `chef_zero`. It seems `chef_solo` was the old way of doing Chef things. So I added `chef_zero.enabled true` in the `knife.rb` file to activate `chef_zero` instead of `chef_solo`. When you do this, you should be able to upload.

It was subsequently fixed in Chef 13:

> This is fixed in Chef 13.3.3, which will be released in the ChefDK 2.2 release

At the time of writing, Chef is in major version 15, so this issue is very unlikely to be encountered in the wild.

---
Tags: chef
---


# Question
Title: Measure service unavailability during upgrade
I am deploying a microservices - based application using an orchestrator (Rancher specifically).

During the service upgrade (when new images are being pulled and services re-discover one another), there is a small service outage.

What is the best / recommended way to measure the downtime?

I am performing e.g. a

```
watch -n1 'wget --spider http://some.endpoint.whoa'

```

but I want to time the duration of e.g. `502` responses.

# Answer
What you suggest might be the simplest way to collect the data, but you will have to do quite a bit of work to extract the availability over certain periods.

I think it's fair to say that if you want availability, **you need a monitoring system**. This means having an extra service in your catalogue to continuously probe the availability of your microservices over time. Storing them in a time-series database would allow you to make queries to establish availability over various periods.

There are many tools which could do this for you. A good starting place would be the CNCF monitoring landscape
> 1 votes

---
Tags: microservices, rancher, upgrade, high-availability
---


# Question
Title: How to implement GitLab Flow branching model for microservices?
Recently I’ve been looking into alternatives to the git flow branching model and since I’m already using GitLab, I stumbled upon their own branching model called GitLab flow. I’m currently trying to get my head around how to implement this properly for microservices. We will assume, that I am deploying all services to the same kubernetes cluster, each deployment should reside in its own namespace.

If I understand this model correctly, one should continuously deploy the master branch to a staging environment and deploy tagged commits occasionally to the production environment. While this works properly if there are only two environments, I’d also like to make use of the dynamic environments available in GitLab, i.e. for each branch off of master, I want to be able to create a review deployment.

Now if I have e.g. multiple microservices which make up a single application, what’s the best way to deploy all microservices to a separate kubernetes namespace for each branch, when pushing the repository of a single microservice using GitLab CI. I can’t think of a clean solution as soon as there are dynamic environments involved.

How am I supposed to handle the above use case properly for microservices? Are there branching models / git workflows which work better for microservices?

# Answer
> 1 votes
We also switched from Git Flow to GitLab Flow several months ago and so far we're very happy with our decision. It works very well with GitLab, it's easy to understand and less error-prone and you don't need additional Git commands (which are quite slow on Windows).

We use Docker Compose to organize our microservices and have a separate project/repository just for the staging and production compose file(s) of our actual application. In the project and CI of each service you can then combine such compose files with a specific one that just tells Docker to use the specific branch of the specific service (and maybe other branch specific settings).

The production compose file contains the production specific settings and tells each service to use a specific tag:

```
service1:
    image: examples/service1:1.5.4
    ports:
        - "8000:8000"
    volumes:
        - "/data"
service2:
    image: examples/service2:3.5.2

```

The staging compose file tells each service to use the image of the master branch:

```
service1:
    image: examples/service1/master:latest
service2:
    image: examples/service2/master:latest

```

Then the compose file for a specific branch of service 1 just looks like that:

```
service1:
    image: examples/service1/some-branch-name:latest

```

When you deploy a review environment for the specific branch with all three compose files at once you'll get something like the following:

```
service1:
    image: examples/service1/some-branch-name:latest
    ports:
        - "8000:8000"
    volumes:
        - "/data"
service2:
    image: examples/service2/master:latest

```

---
Tags: git, gitlab, project-management
---


title: Store named volumes on another drive

text:
# Question
Title: Store named volumes on another drive
I'm really familiar with Docker on Linux but my company's IT department uses Windows. They're interested in converting VM-based services over to Docker so I'm trying to get them set up with a good Windows-based Docker infrastructure.

I've started with a couple containers managed by `docker-compose`. I would like to use named containers rather than hardcoding paths. For example:

```
volumes:
  portainer_data:

services:
  portainer:
    image: portainer/portainer:latest
    volumes:
      - portainer_data:/data

```

They created a 900GB `E:` drive to hold persistent data. **How can I get all the named volumes for all containers to be stored in `E:\Volumes`?**

* I figure it would make it super easy for them to configure backup. Instead of having to script a bunch of steps using `docker cp` I could just tell them, "Back up the `E:` drive". Easy.
* If I understand Docker Desktop and Hyper-V correctly, volumes are stored inside a MobyLinuxVM. The VM is on the `C:` drive and only has 48GB to play with.

(Please let me know if there's a better way to tackle this in general. I'm open to frame challenges. Down the road I'd like to add Kubernetes or Docker Swarm to the mix, but one step at a time.)

**OS:** Windows Server 2019 Datacenter

# Answer
> If I understand Docker Desktop and Hyper-V correctly, volumes are stored inside a MobyLinuxVM.

That's right and it seems to be possible to move the whole VM to another drive as described here.

Maybe you could solve you problem by using a volume driver as described in the official docs.

Another approach is to use a Linux VM with Docker and tell your Docker on Windows installation to use another daemon by setting the DOCKER\_HOST environment variable. This will give you more control and will allow you to use everything available on Linux (mounting, symbolic links, ...). But of course this will not work if you or your IT department want to use Windows containers some day.
> 1 votes

---
Tags: docker, docker-compose, windows, volume
---


# Question
Title: Tunnel docker traffic though VPN or SSH, during build stage
Well, the title says all. I have no success trying to route docker's network traffic through an active VPN connection (openconnect) or SSH tunnel (sshuttle). Docker creates a virtual network interface called `docker` which seems to be ignoring all the iptables rules that sshuttle adds. In VPN case however the entire docker process disconnects while OS's traffic is being routed through VPN.

Please note that I am not trying to push a contained behind VPN. The problem occurs specifically on build stage.

# Answer
> 1 votes
Docker actually manipulates `iptables` behind the scenes, so there is a good chance that `sshuttle` is interacting with docker in unpredictable ways. Any rules that need to be added to IP Tables that affect the `docker` interface need to be added to the `DOCKER-USER` chain as per Docker and `iptables`.

It's quite an involved topic so I would also consider reading an exploration of Docker networking and the overview of the docker network.

There is also an old question on StackOverflow but based upon the comments the current highest voted answer no longer works.

---
Tags: docker
---


# Question
Title: How to get 'diff' on Windows TravisCI machines?
Attempt was `choco install git -y`, but it does not seem to be available:

```
The command "diff -u <(echo -n) <(gofmt -d ./)" exited with 2.
diff: /dev/fd/62: No such file or directory

```

Windows Travis Build

# Answer
> 2 votes
When `git` is installed it usually doesn't add the `diff` executable to the path because it would conflict with other versions of `diff` native to Windows, for example, the `Compare-Object` alias in PowerShell.

1. You can usually get around this by adding `C:\Program Files\Git\usr\` to the path which contains all of the UNIX ports of functionality such `diff`, `grep`, `awk`, `sed`. You do have to be careful as some commands are used more commonly on Windows than others, the most common one is `find`.
2. A second option would be to fully qualify the call to `diff` by appending `C:\Program Files\Git\usr\bin`.

---
Tags: windows, travis-ci
---


# Question
Title: What is the difference between php-cli and php-fpm, why 2 php variants and why choose one or the other?
Looking at https://hub.docker.com/\_/php I can see reference to `php-cli` and `php-fpm`.

Now, I am aware of the concepts of PHP FPM - Fast CGI Process Manager. I'm also aware the PHP can be run in the command line and for php composer and Symfony console.

Does the Docker `php-fpm` not have PHP CLI tools like `php-fpm`. Or is `php-fpm` a superset of `php-cli` ?

Why would one choose one or the other?

Thank you.

# Answer
They are different tools for different purposes:

* **php-cli** is the standalone tool for running a PHP scripts in the same way you would run it from the command line: `php somescript.php`. It seems you can also use it to base other images from.

> This variant contains the PHP CLI tool with default mods. If you need a web server, this is probably not the image you are looking for. It is designed to be used both as a throw away container (mount your source code and start the container to start your app), as well as a base from which to build other images.
* **php-fpm** is the FastCGI server implementation of PHP which you would use with a FastCGI compliant web server such as Apache or Nginx.

> This variant contains PHP-FPM, which is a FastCGI implementation for PHP. See the PHP-FPM website for more information about PHP-FPM.

You also have two other variants:

* **php-apache** which is just Apache configured with `mod_php`
* **php-alpine** is the smallest possible Docker image based upon Alpine Linux, albeit with some compatibility issues.

You can see all of the Dockerfiles on GitHub and whilst it doesn't appear that `php-fpm` is based upon `php-cli` practically they are likely to be very similar and `php-fpm` is probably a superset of `php-cli`.
> 15 votes

---
Tags: docker, php, images
---


# Question
Title: Why does Docker hub allow non-official Docker images and why do they exist?
**Note: also posted in Security StackExchange as there is a security aspect to this question (sorry for cross-posting).**

I'm evaluating Docker images for my development and production setups.

When I research how to do something in Docker, quite often I find answers that include the author's own Docker image. For me, this is not suitable as this hinders the transparency of the solution and uncertainty of reliance on future maintenance by that author. Both of these potential issues have security implications.

While the Docker Hub, can provide a convenient centralised and well-known outlet for publishing one's own Docker images, derived from officials, what would be the advantage of using these unofficial images over the originals.

I am aware of reverse engineering tools, as described in answers on Stack Overflow and that at least some of the unofficial Docker images have an associated GitHub repo that apparently shows how the Docker image was built. But this is an inconvenient level of "indirection" or friction to being really sure (if at all possible) as to the contents of the Docker image.

# Answer
As with most elements of Information Security, there is a balancing act between usability and security; an increase in usability often results in a correlated decrease in security and visa versa.

As a thought experiment...

> I can make any server 100% secure by wiping the hard drives, putting it through a shredder and then melting down all of the components parts. It also makes it 0% usable.

Docker Hub is no different, the desire is to make these images accessible for the common good, at the cost of traceability and provenance of the images. Fortunately, there are several tools such as JFrog Artifactory and Sonatype Nexus Lifecycle which enable you to apply governance to any Open Source repository (i.e. Docker Hub, Nuget, NPM, etc).

One aspect that I think Docker Hub gets wrong, that other sites get right, namely NPM, is presenting clear information about what Source Repository an image is generated from, that I suspect is due to the decoupled nature of Docker Images from the source code that generates them.
> 6 votes

# Answer
This capability is part of what makes Docker Hub great.

Imagine you have a project that requires a very specific system configuration. For example, you want to use a database, but have a specific configuration for it. Docker Hub will allow you to pull the official image (e.g. MySQL), make your changes (e.g., change the default location the database runs, add scheduled tasks), and push your new image. In this example I can now use my custom image as a base for my development and I do not have to script or manually run these configurations every time I pull.

There are security issues as you have now diverge from the official image. Future updates to the official image will not be updated unless you rebuild with the new official image and push.

Additionally, you are correct in that Docker Hub is somewhat opaque in how these images are generated. Using my above example I could easily decide I want to switch to MariaDB as my base image, and push to something that makes people thing it is MySQL due to the tag. Because of this, I prefer to start with official images whenever possible.
> 4 votes

---
Tags: docker
---


# Question
Title: How to find the Linux distro used as the basis for an official docker image?
I already think I understand that docker containers "share" the same Linux kernel running on their host. But inside a particular docker container, the software stack could be a distro debian, alpine, centos or ubuntu and on top of that various other software components, such as a web server, database, language interpreter etc.

Indeed there are official images for such distros.

But there are also official images for Apache (httpd) and PHP (php)

My question is, how can I find out the default distro that these sit upon?

I ask, because for example, I've seen a Dockerfile which starts with:

`FROM php:7.2-fpm` (which is one of the official PHP images)

Followed by:

```
RUN apt-get update && apt-get install -y \
        libfreetype6-dev \
        libjpeg62-turbo-dev \
        libpng-dev \
    && docker-php-ext-install -j$(nproc) iconv \
    && docker-php-ext-configure gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/ \
    && docker-php-ext-install -j$(nproc) gd

```

Source: hub.docker.com/\_/php (see section "How to install more PHP extensions")

Also, what distro is used for the httpd (Apache) official image?

# Answer
> 1 votes
As I wrote this question I found a link to the original source code for these official images, which answered my questions:

For example, for official image `php:7.2-fpm`, the base image is: debian:stretch-slim

And for official Apache image, `httpd` it's debian:buster-slim

So, to find out the distro upon which official images are based on, go here: https://github.com/docker-library

...and append your official image of interest to the URL.

---
Tags: docker, dockerfile
---


# Question
Title: Is it possible to read secured keys from aws-secrets-manager without using aws access and secret key?
I've created a local development environment for new developers coming to work in the company I work for.

One of the microservices running as part of this local development environment requires access to some AWS s3 bucket.

Up until today, I required each user who used this solution to get AWS access and secret keys by himself but lately the company has implemented Okta SSO solution and now there's a new motivation to use one single dedicated AWS access key through Okta which has read-only access to the required resources in AWS.

I want to avoid hard coding this AWS access key in my code and instead, I want to store the access and secret keys in AWS Secrets Manager and then using an assume role to read the keys from there but the problem is that I have to authenticate somehow against the company's AWS account in order to be able to assume the role and read the keys from AWS SM.

Is there any way to do this?

# Answer
create a service which authorizes against SSO and the provides temporary credentials via AWS STS Service. That way you don't have to store anything anywhere and once the user loses access to SSO they will also lose access to AWS. You need a role with the access to your dev environment and the developers will assume that role.
> 1 votes

---
Tags: amazon-web-services, aws-iam
---


# Question
Title: How to use feature toggles and frequent deployment under SOX compliance?
Feature toggles (or feature flags) enable me to deploy unfinished features without comprehensive manual testing of features toggled off. We can toggle the feature on for certain users, try it out, and then choose to toggle it off or on for all users. This enables more frequent integration as suggested by version control strategies such as Trunk-Based Development, and more frequent deployment of the trunk (master) branch into user's hands.

Sarbanes-Oxley rules require that all features that are in user's hands be fully tested.

So if I have a SOX-compliant system, how do I proceed with using feature toggles without having to do full manual testing of the feature toggled ON? It makes sense to do regression testing with the feature toggled OFF, but the most common need is to integrate and deploy good code but not incur the manual testing cost of the "on" state for a feature toggled off by default.

**So any suggestions on ways to have Sox-compliant feature toggles without comprehensive manual testing of the toggled-off feature on every release?**

# Answer
It depends on how you're managing your feature flags. Ideally, you're using a flagging system that allows you to target specific users or segments of users so that an untested feature isn't inadvertently enabled for all your users. Some feature management systems (like LaunchDarkly) allow you to target users any way you want.

For example, a common workflow (for teams who use feature flags) is to release a new feature under a flag that's only turned on for the product team that's working on that feature. So, even if the feature hasn't been tested, it's guaranteed that only the right users have access to that new feature.

This allows your product team to continue to work on the feature and test it in production (if that's appropriate). Of course, a full set of tests should cover that feature before it's released, but it's nice that product teams have a way to iterate quickly without the hangups of a process that didn't involve feature flags.
> 1 votes

---
Tags: continuous-deployment, feature-toggles, feature-flags
---


title: Container for every user

text:
# Question
Title: Container for every user
Please help me here based on your experiences.

We have launched a desktop application where users can download all their online data from several platforms at one place. Our motto is to provide users access to their digital footprint so that they can utilize it in their own different ways.The whole idea of desktop application is to put privacy first, Our servers only have access to the users login information and never had access to the users data, which is also encrypted at rest on users machine with user's mnemonic.

Based on the users feedback, We have realized that most of the users did like our platform but they don't want to bear the hassle of installing a desktop application. For them, Making use of their data (search, organize etc) is more important than military grade privacy.

As a result, we have decided to provide both the options to the user, Desktop application as well as web app.

Now shifting such a huge data on users machine (around 50GB to 1 TB for single user) to common database on cloud would be a cumbersome task, In terms of servers required for replication, sharding , caching etc, their costs and complexities which comes with data at scale.

Our Approach:

We are thinking to maintain docker containers for every user with their storage on Elastic file system on AWS. Data on rest on EFS for a container will always be encrypted with user's mnemonic and will only be decrypted on successful users login.

Every user docker container will have a small SQLite database to make this data searchable and indexed. In future, containers can also have their own Elastic search database with any other NoSql or Sql database.

The identities of the users can be put of AWS Cognito or Any decentralized identity system.

One other approach could be: Instead of running dockers we can keep different encrypted SQLITE DB for different users.

It would be a problem because then we have to keep track of all the SQLite db files present being accessed by the user, because SQLite doesnt support multi threading, we cannot open different instances of same SQLite database,

In case of docker, We will only spin docker when user logs in, that ways we always know that only one instance of SQLite is being accessed.

Our worry: We are still trying to figure out loopholes in this approach. Please help us in identifying the same.

Note: https://aws.amazon.com/blogs/containers/welcome-to-the-aws-containers-blog/

# Answer
Based upon my understanding you essentially have a Data Partitioning problem, in that you need to maintain a degree of separation between each of your customers but also host the service centrally.

You have suggested that you instantiate a Docker container for each of your customers, I think there are a couple of issues with this:

1. Containers are designed to be somewhat ephemeral, you can use some of the concepts within Kubernetes to effectively create a singleton per customer, however:
    1. Availability will likely be hurt by virtue of it being a singleton if the pod, node or cluster fails then that pod will need to be rescheduled.
    2. The cost is likely to be quite high, as each of those containers will consume some resources regardless of whether they are being used or not.
2. Depending on how many customers you have, you get into the realms of too many containers:
    1. Orchestrators such as Kubernetes, Docker Swarm and Mesosphere are generally designed to support a large number of containers, however, the expectation is that's lots of the same workload not lots of disparate workloads. Kubernetes has in the past experienced slowdown when lots of ConfigMaps, Pods and CustomResourceDefinitions are deployed.
    2. Whilst lightweight each container will consume system resources, not just Memory, CPU but also TCP/IP pool exhaustion.
3. Isolation - containers are a good way to isolate workloads from each other, but it's not infallible - Read Containers are not VMs

If I were to approach your problem I would be inclined to use Kubernetes as a Microservices platform hosting your application across multiple ReplicaSets then implement your partitioning at the datastore level in AWS via DynamoDB and EFS. You are already encrypting your data so you have cryptographic certainty that isolation can be achieved.
> 2 votes

---
Tags: docker, amazon-web-services, containers
---


# Question
Title: Jenkins declarative pipeline: use branch if it exist
I'm currently trying to adopt my declarative pipeline in the following way:

I have multiple stages, some apply for all branches, some only for specific names.

What I'm now searching for is a way to get a when condition for the existance of a branch like this:

```
if branch b exist
   checkout branch b
else
   checkout branch a

```

Sadly I haven't found a solution for it. I'm pretty sure there is a way using the **git plugin** though.

There's a StackOverflow solution for scripted pipelines, but I can't translate them though.

Can someone help me with this or point me at the right direction?

# Answer
When using Declarative Pipelines you can achieve the goal of running some steps only for certain branches by using the when directive with the build-in condition `branch`:

> **`branch`** Execute the stage when the branch being built matches the branch pattern (ANT style path glob) given, for example: when { branch 'master' }. Note that this only works on a multibranch Pipeline.

```
pipeline {
    agent any
    stages {
        stage("Build") {
            when { branch "master" }
            steps {
               echo "I am a master branch"
            }
        }
    }
}

```

If you use Scripted Pipeline, you may also access the `BRANCH_NAME` from environment variable and do something with it:

```
if (env.BRANCH_NAME == 'master') {
   //do something
}

```

Also have a look at Flow Control to understand how you can control the flow of your pipeline.
> 4 votes

# Answer
There's a `resolveScm` step implemented by the Pipeline: Multibranch plugin:

```
checkout resolveScm(source: [$class: 'GitSCMSource',
                             credentialsId: '<credentialsId>',
                             id: '_',
                             remote: 'https://your.git.remote/repository.git',
                             traits: [[$class: 'jenkins.plugins.git.traits.BranchDiscoveryTrait']]],
                    targets: [BRANCH_NAME, 'master'])

```

Above procedure will look whether `$BRANCH_NAME` exists, check it out if yes and check out `master` otherwise.
> 5 votes

# Answer
Sometimes it is easier to ask forgiveness than permission.

Instead of trying to figure out whether branch `b` exists, just try to check it out.

If it fails, checkout branch `a`.

```
script {
    try {
        checkout([
                $class: 'GitSCM',
                branches: [[name: 'b']],
                userRemoteConfigs: [[url: url]]
        ])
    }
    catch (Exception e) {
        checkout([
                $class: 'GitSCM',
                branches: [[name: 'a']],
                userRemoteConfigs: [[url: url]]
        ])
    }
}

```
> 2 votes

# Answer
```
pipeline {
  agent any
  stages {
    stage('Tests') {
      when {
        branch 'master'
      }
      steps {
        echo 'foo'
      }
   }
}

```
> 1 votes

---
Tags: jenkins, jenkins-pipeline, jenkins-blueocean
---


# Question
Title: Create User Using Ansible with Authenticate Pem File
Community, I am creating a user on the client machine using Ansible but the issue is it creates a user and add authenticate file but getting an error while SSH to that machine using created, User. Following is my source code.

```
  ---
    # This file is used to create a single user or multiple with password
    - hosts: hostMachine
      become_method: sudo
      become_user: root
      become: true
      gather_facts: no
      vars_files:
        - ../../../group_vars/required_varlist.yml
      tasks:

        - name: Ensure group is exist
          group:
            name: "{{ item.groups }}"
          with_items:
            - "{{ users }}"

        - name: create a new user without password
          user:
            name: "{{ item.username }}"
            group: "{{ item.groups }}"
            groups: "sudo,{{ item.username }}"
            shell: /bin/bash
            createhome: yes
          with_items:
            - "{{ users }}"

        - name: Add Sudo privileges to user
          command: usermod -aG sudo "{{ item.username }}"
          with_items:
            - "{{ users }}"

        - name: Add user in  sudoders
          shell: sh -c "echo \""{{ item.username }}" ALL=(ALL) NOPASSWD:ALL\" >> /etc/sudoers"
          with_items:
            - "{{ users }}"

        - name: create directory
          file:
            path: "/home/{{ item.username }}/.ssh"
            state: directory
            mode: 0700
            owner: "{{ item.username }}"
            group: "{{ item.groups }}"
          with_items:
            - "{{ users }}"

        - name: Set Authorized key token from the file
          become: true
          authorized_key:
            user: "{{ item.username }}"
            state: present
            key: "{{ lookup('file', '{{ pem_file_path }}') }}"
            # path: '/etc/ssh/authorized_keys/"{{ item.username }}"'
          with_items:
            - "{{ users }}"

        - name: restart ssh
          service: name=sshd state=restarted

```

required\_varlist.yml

```
  ---
    password: raspberry
    users:
      - username: ABC
        groups: ABC
    pem_file_path: /home/ubuntu/XYZ.pem

```

# Answer
I suspect what is happening here is you are trying to insert the **private key** into the `authorized_keys` file, which is invalid as only the **public key** is required on the target machine.

What you need to do is extract the public key from the private key:

```
- name: Generate an OpenSSL public key with a passphrase protected private key
  openssl_publickey:
    path: /tmp/key-{{ item.username }}.pub
    privatekey_path: {{ item.pem_file_path }}
    privatekey_passphrase: ansible
    format: OpenSSH
  with_items:
    - "{{ users }}"

```

and then use the public key:

```
- name: Set Authorized key token from the file
  become: true
  authorized_key:
    user: "{{ item.username }}"
    state: present
    key: "{{ lookup('file', '/tmp/key-{{ item.username }}.pub') }}"
  with_items:
    - "{{ users }}"

```
> 2 votes

---
Tags: ansible, linux, authentication
---


# Question
Title: What are the ways to get authorized access to mlflow through Azure Active Directory?
What are the ways to get authorized access to mlflow through Azure Active Directory?

Requirements:

* I need to grant access to the mlflow web interface installed on a Ubuntu 16 Virtual Machine in Azure cloud to only allow authorized users.
* Granting access will be done through group membership in Azure Active Directory.

# Answer
> 0 votes
It looks like MLFlow doesn't natively support any authentication schemes and the recommendation is to use a reverse proxy such as Nginx to only forward requests to MLFlow if a valid authentication cookie is provided, redirecting any requests without a cookie or an invalid cookie back to the Identity Provider.

## Azure AD Application Proxy

You can configure Azure AD Application Proxy to add authentication, although you will also need to protect MLFlow from unauthorised access by putting it in a virtual network or creating rules to only accept connections from Azure AD Application Proxy.

## Used managed ML Flow in Azure

There is also the potential of using MLFlow that is part of Azure Databricks, which probably also includes authentication.

## Nginx

There are complete instructions on setting this up on the Nginx for a generic application. In summary, however, you will need to:

* configure Nginx as a reverse proxy
* prevent access to MLFlow from anything other than Nginx
* create an application in Azure Active Directory for Nginx
* configure Nginx to look for the JWT token and validate it

You would also be able to use other products such as Google's Identity Aware Proxy and ForgeRock's Identity Gateway.

---
Tags: azure, active-directory
---


# Question
Title: How to get the device name of a specified mount point with ansible facts?
Using Ansible facts I can get the list of "ansible\_mounts":

```
        "ansible_mounts": [
            {
                "block_available": 423698,
                "block_size": 4096,
                "block_total": 507604,
                "block_used": 83906,
                "device": "/dev/sdb1",
                "fstype": "ext4",
                "inode_available": 130999,
                "inode_total": 131072,
                "inode_used": 73,
                "mount": "/boot",
                "options": "rw",
                "size_available": 1735467008,
                "size_total": 2079145984,
                "uuid": "b5cfa485-21d2-4e66-b3a3-80f250acf9d9"
            },
            {
                "block_available": 42446481,
                "block_size": 4096,
                "block_total": 131007993,
                "block_used": 88561512,
                "device": "/dev/sdd1",
                "fstype": "xfs",
                "inode_available": 524243436,
                "inode_total": 524287936,
                "inode_used": 44500,
                "mount": "/u01",
                "options": "rw",
                "size_available": 173860786176,
                "size_total": 536608739328,
                "uuid": "f34a9499-ca4e-4db6-801a-16efb72a629d"
            },
            {
                "block_available": 3010686,
                "block_size": 4096,
                "block_total": 4095466,
                "block_used": 1084780,
                "device": "/dev/sdc1",
                "fstype": "ext4",
                "inode_available": 984674,
                "inode_total": 1048576,
                "inode_used": 63902,
                "mount": "/",
                "options": "rw",
                "size_available": 12331769856,
                "size_total": 16775028736,
                "uuid": "829e9504-965b-4660-acc2-12d10d022a3c"
            }
        ],

```

How I can get the value of `device` where `mount` value is "/" ?

# Answer
> 6 votes
Use json\_query. For example

```
    - set_fact:
        my_device: "{{ ansible_mounts|json_query(query) }}"
      vars:
        query: "[?mount=='/'].device "
    - debug:
        var: my_device

```

gives

```
    my_device:
      - /dev/sdc1

```

To get the first element of the list only append the filter first

```
    - set_fact:
        my_device: "{{ ansible_mounts|json_query(query)|first }}"

```

---
Tags: ansible
---


# Question
Title: How can I enable active tracing by default for an AWS Lambda function using Terraform?
On the console, there’s the option to enable active tracking for X-ray tracking but I can see this in the Terraform `aws_lambda_function` resource the `aws_xray_sampling_rule` resources?

I'm currently manually enabling it in the console to enable me to test it but I'd like to enable it through Terraform when I build the Lambda?

# Answer
> 2 votes
This looks like it was added to Terraform back in May 2017, you enable it with the `tracing_config` block:

```
tracing_config {
  mode = "Active"
}

```

You will also need to make sure that Terraform has a minimum of Write access to X-ray to enable the above to work:

```
data "aws_iam_policy" "aws_xray_write_only_access" {
  arn = "arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess"
}

```

---
Tags: amazon-web-services, terraform, aws-lambda
---


# Question
Title: service-to-pod communication is broken in kubernetes
I have an in house 5 node cluster running on bare-metal and I am using Calico. The cluster was working for 22 days but suddenly it stopped working. After investigating the problem I found out that the service to pod communication is broken while all the components are up and kubectl is working without a problem.

From within the cluster (component A) if I try to curl another component (`bridge`) with its IP it works:

```
$ curl -vvv http://10.4.130.184:9998
* Rebuilt URL to: http://10.4.130.184:9998/
*   Trying 10.4.130.184...
* TCP_NODELAY set
* Connected to 10.4.130.184 (10.4.130.184) port 9998 (#0)
> GET / HTTP/1.1
> Host: 10.4.130.184:9998
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 200 OK
< X-Powered-By: Express
< Accept-Ranges: bytes
< Cache-Control: public, max-age=0
< Last-Modified: Mon, 08 Apr 2019 14:06:42 GMT
< ETag: W/"179-169fd45c550"
< Content-Type: text/html; charset=UTF-8
< Content-Length: 377
< Date: Wed, 23 Oct 2019 09:56:35 GMT
< Connection: keep-alive
<
<!doctype html>
<html lang="en">
<head>
    <meta charset="utf-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />

    <title>Bridge</title>

    <meta content='width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0' name='viewport' />
    <meta name="viewport" content="width=device-width" />
</head>
<body>
    <h1>Bridge</h1>
</body>

</html>
* Connection #0 to host 10.4.130.184 left intact

```

ns lookup for the service is also working (it resolve to the service IP):

```
$ nslookup bridge
Server:    10.5.0.10
Address 1: 10.5.0.10 kube-dns.kube-system.svc.k8s.local

Name:      bridge
Address 1: 10.5.160.50 bridge.170.svc.k8s.local

```

But the service to pod communication is broken and when I curl to the service name most of the times (60-70%) it stuck:

```
$ curl -vvv http://bridge:9998
* Rebuilt URL to: http://bridge:9998/
* Could not resolve host: bridge
* Closing connection 0
curl: (6) Could not resolve host: bridge

```

When I check the endpoints of the that service I can see that the IP of that pod is there:

```
$ kubectl get ep -n 170 bridge
NAME     ENDPOINTS                                               AGE
bridge   10.4.130.184:9226,10.4.130.184:9998,10.4.130.184:9226   11d

```

But as I said the curl (and any other method) that uses the service name is not working. And this is the service description:

```
$ kubectl describe svc -n 170 bridge
Name:              bridge
Namespace:         170
Labels:            io.kompose.service=bridge
Annotations:       Process: bridge
Selector:          io.kompose.service=bridge
Type:              ClusterIP
IP:                10.5.160.50
Port:              9998  9998/TCP
TargetPort:        9998/TCP
Endpoints:         10.4.130.184:9998
Port:              9226  9226/TCP
TargetPort:        9226/TCP
Endpoints:         10.4.130.184:9226
Port:              9226-udp  9226/UDP
TargetPort:        9226/UDP
Endpoints:         10.4.130.184:9226
Session Affinity:  None
Events:            <none>

```

This problem is not limited to just this component and it is like this for all the components.

I restarted the CoreDNS (deleted its pods) but it is still the same. I was facing this problem before and previous time I thought it is related to Weavenet that I was using and I needed the cluster so I tore down the cluster and rebuilt it with Calico but now I am sure that this is not related to CNI and it is something else.

**Environment**: \- Kubernetes version (use `kubectl version`):

```
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:11:31Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.0", GitCommit:"2bd9643cee5b3b3a5ecbd3af49d09018f0773c77", GitTreeState:"clean", BuildDate:"2019-09-18T14:27:17Z", GoVersion:"go1.12.9", Compiler:"gc", Platform:"linux/amd64"}

```
* Cloud provider or hardware configuration: This is a bare-metal cluster of 5 nodes, 1 master and 4 workers. All nodes are running Ubuntu 18.04 and they are connecting to the same subnet.
* OS (e.g: `cat /etc/os-release`):

```
NAME="Ubuntu"
VERSION="18.04.2 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.2 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

```
* Kernel (e.g. `uname -a`):

```
Linux serflex-argus-1 4.15.0-55-generic #60-Ubuntu SMP Tue Jul 2 18:22:20 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

```
* Install tools: Kubeadm
* Network plugin and version (if this is a network-related bug): Calico "cniVersion": "0.3.1"

# Update

After deleting all the kube-proxy pods problem seemed to be solved but I still like to know what caused this problem. Btw I didn't see any error in the kube-proxy logs.

# Update 2

The journalctl also doesn't show any strange activity, it just shows some logs when I deleted the pod of kube-proxy:

```
giant-7:~$ sudo journalctl --since "4 days ago" | grep kube-proxy

Oct 23 12:24:16 serflex-giant-7 kubelet[31145]: I1023 12:24:16.751108   31145 reconciler.go:181] operationExecutor.UnmountVolume started for volume "kube-proxy" (UniqueName: "kubernetes.io/configmap/02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea-kube-proxy") pod "02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea" (UID: "02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea")
Oct 23 12:24:16 serflex-giant-7 kubelet[31145]: I1023 12:24:16.751237   31145 reconciler.go:181] operationExecutor.UnmountVolume started for volume "kube-proxy-token-4t5tq" (UniqueName: "kubernetes.io/secret/02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea-kube-proxy-token-4t5tq") pod "02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea" (UID: "02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea")
Oct 23 12:24:16 serflex-giant-7 kubelet[31145]: W1023 12:24:16.765057   31145 empty_dir.go:421] Warning: Failed to clear quota on /var/lib/kubelet/pods/02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea/volumes/kubernetes.io~configmap/kube-proxy: ClearQuota called, but quotas disabled
Oct 23 12:24:16 serflex-giant-7 kubelet[31145]: I1023 12:24:16.782557   31145 operation_generator.go:831] UnmountVolume.TearDown succeeded for volume "kubernetes.io/configmap/02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea-kube-proxy" (OuterVolumeSpecName: "kube-proxy") pod "02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea" (UID: "02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea"). InnerVolumeSpecName "kube-proxy". PluginName "kubernetes.io/configmap", VolumeGidValue ""
Oct 23 12:24:16 serflex-giant-7 kubelet[31145]: I1023 12:24:16.840793   31145 operation_generator.go:831] UnmountVolume.TearDown succeeded for volume "kubernetes.io/secret/02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea-kube-proxy-token-4t5tq" (OuterVolumeSpecName: "kube-proxy-token-4t5tq") pod "02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea" (UID: "02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea"). InnerVolumeSpecName "kube-proxy-token-4t5tq". PluginName "kubernetes.io/secret", VolumeGidValue ""
Oct 23 12:24:16 serflex-giant-7 kubelet[31145]: I1023 12:24:16.851656   31145 reconciler.go:301] Volume detached for volume "kube-proxy-token-4t5tq" (UniqueName: "kubernetes.io/secret/02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea-kube-proxy-token-4t5tq") on node "serflex-giant-7" DevicePath ""
Oct 23 12:24:16 serflex-giant-7 kubelet[31145]: I1023 12:24:16.851679   31145 reconciler.go:301] Volume detached for volume "kube-proxy" (UniqueName: "kubernetes.io/configmap/02a1a1fb-2411-4f0e-98e1-ef2dbd6149ea-kube-proxy") on node "serflex-giant-7" DevicePath ""
Oct 23 12:24:25 serflex-giant-7 kubelet[31145]: I1023 12:24:25.973757   31145 reconciler.go:207] operationExecutor.VerifyControllerAttachedVolume started for volume "kube-proxy" (UniqueName: "kubernetes.io/configmap/4e7f5d97-fd49-461b-ae38-6bc5e3f0462b-kube-proxy") pod "kube-proxy-qpj4h" (UID: "4e7f5d97-fd49-461b-ae38-6bc5e3f0462b")
Oct 23 12:24:25 serflex-giant-7 kubelet[31145]: I1023 12:24:25.973826   31145 reconciler.go:207] operationExecutor.VerifyControllerAttachedVolume started for volume "lib-modules" (UniqueName: "kubernetes.io/host-path/4e7f5d97-fd49-461b-ae38-6bc5e3f0462b-lib-modules") pod "kube-proxy-qpj4h" (UID: "4e7f5d97-fd49-461b-ae38-6bc5e3f0462b")
Oct 23 12:24:25 serflex-giant-7 kubelet[31145]: I1023 12:24:25.973958   31145 reconciler.go:207] operationExecutor.VerifyControllerAttachedVolume started for volume "kube-proxy-token-4t5tq" (UniqueName: "kubernetes.io/secret/4e7f5d97-fd49-461b-ae38-6bc5e3f0462b-kube-proxy-token-4t5tq") pod "kube-proxy-qpj4h" (UID: "4e7f5d97-fd49-461b-ae38-6bc5e3f0462b")
Oct 23 12:24:25 serflex-giant-7 kubelet[31145]: I1023 12:24:25.974027   31145 reconciler.go:207] operationExecutor.VerifyControllerAttachedVolume started for volume "xtables-lock" (UniqueName: "kubernetes.io/host-path/4e7f5d97-fd49-461b-ae38-6bc5e3f0462b-xtables-lock") pod "kube-proxy-qpj4h" (UID: "4e7f5d97-fd49-461b-ae38-6bc5e3f0462b")
Oct 23 12:24:26 serflex-giant-7 systemd[1]: Started Kubernetes transient mount for /var/lib/kubelet/pods/4e7f5d97-fd49-461b-ae38-6bc5e3f0462b/volumes/kubernetes.io~secret/kube-proxy-token-4t5tq.
Oct 23 12:24:26 serflex-giant-7 kubelet[31145]: E1023 12:24:26.645571   31145 kuberuntime_manager.go:920] PodSandboxStatus of sandbox "ff4c1ba15b8c11a4fe86974286d81ebe4870d9e670226234fae6c7c21ce36c1d" for pod "kube-proxy-qpj4h_kube-system(4e7f5d97-fd49-461b-ae38-6bc5e3f0462b)" error: rpc error: code = Unknown desc = Error: No such container: ff4c1ba15b8c11a4fe86974286d81ebe4870d9e670226234fae6c7c21ce36c1d

```

# Answer
> 1 votes
Sounds like the problem has been resolved by deleting all of the `kube-proxy` pods, which is an aggressive solution but if it works then good work!

Best I can offer you is a collection of links about diagnosing Kubernetes problems:

Not a great answer I'm afraid, but we may have missed the opportunity to diagnose the issue.

---
Tags: kubernetes, dns
---


# Question
Title: What are trusted providers that offer wildcard certificates and associated costs to be used in an Orchestration Platform like Kubernetes?
Currently, certbot and nginx are used to create a trusted webpage. Recently, an attempt was made to move the images to a kubernetes cluster on google cloud platform. A guide was found to configure an SSL loadbalancer. It was tried and it shows multiple textboxes to insert a key, cert and chain.

An attempt was made to see whether Google offers wildcard certs as well, but no information was found. Certbot itself announced last year that they will support wildcard certs, but that does not seem to be the case as well. First impression is that using certbot in the google loadbalancer will not be possible or will be cumbersome as the certs have to be renewed every three months.

When one Googles: `cheap wildcard ssl` then a lot of results are shown. The questions are which of these providers can be considered as safe, what are the costs and what providers do you use and why?

# Answer
> 2 votes
Have a look at "Ingress" and "Cert-Manager":

# Answer
> 0 votes
For using kube-lego you can follow this step:

Visit https://github.com/jetstack/kube-lego/tree/master/examples/gce and follow instructions to have a kube-lego namespace working.

Create an ingress like this:

```
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
      name: app-ingress
      annotations:
        kubernetes.io/tls-acme: "true"
        kubernetes.io/ingress.class: "gce"
    spec:
      backend:
        serviceName: backend-service
        servicePort: 80
      tls:
      - hosts:
        - example.com
        - api.example.com
        secretName: app-ingress-tls
      rules:
      - host: example.com
        http:
          path:
          - path: /*
            backend:
              serviceName: backend-service
              servicePort: 443
      - host: api.example.com
        http:
          path:
          - path: /*
            backend:
              serviceName: backend-service
              servicePort: 443

```

remember to replace backend-service with your own service name and exampl.com with your domain.

You can put as more host sections as you need, each host section should be associated with a domain on the tls section.

Use the app-ingress-tls secret to mount as a volume on your service.

# Answer
> 0 votes
Let's Encrypt is a free TLS/SSL service you can use with your Kubernetes cluster and a lot of the work is automated. You can setup Kubernetes Cluster to reach out to Let's Encrypt and confirm you are the owner of the domain name and to issue you a cert.

Let's Encrypt will not take the word of your Kubernetes Cluster, but instead make a request to that domain name you supposedly own and if you truly do own it, you will reply. When you respond to that route, you will automatically get a certificate from Let's Encrypt thats going to save it into a secret and make it available to your application. Typically, its good for 90 days and then it will automatically go through this process again.

The challenge for you is setting up the infrastructure to make this happen.

Step 1. You need to purchase a domain name. You can use many different services out there, but I would recommend domains.google.com.

Step 2. You want to set up your domain name by going to your Kubernetes Cluster dashboard in **Services** and then finding the **Ingress service** and thats the IP you will use for your domain name to point to. You are going to click on the **DNS** of the domain name you purchased, look for **Custom resource records** and setup to custom records. The first one will ensure a user who goes to mycluster.com gets forwarded to the IP specified, the second one ensures that a user who goes to www.mycluster.com gets forwarded to the same IP specified.

So you add the `@` symbol with an `A` record and a 1 hour time to life which is how long it takes for the record to take effect and the IP address assigned to your Load balancer. No port, just the IP address.

The second record type is `C` name with `www`, 1 hour time to life and obviously thats for your `www.mycluster.com` and thats pretty much it for that.

Step 3. Is setting up your Kubernetes cluster to obtain a TLS certificate.

Step 4. You will have to complete an issuer and certificate config files

Step 5. Deploy your new changes

Step 6. verify the certificate

---
Tags: kubernetes, ssl, devsecops
---


title: Cloudformation YAML not well-formed

text:
# Question
Title: Cloudformation YAML not well-formed
I have a cloud formation template that I want to import some values from another template. Currently the other template exports a string by joining together an array (better way of doing this?).

In my template I want to import into I am getting the below error when trying to update my stack in the AWS console.

`Template format error: YAML not well-formed. (line 71, column 28)`

Here is lines 70 and 71 from my YAML file

```
SubnetId:
        Fn::Select [ "0", [ Fn::Split: [ ",", Fn::ImportValue [ !Sub "${ExportPrefix}-SubNets"] ] ] ]

```

Have also tried this..

```
Fn::Select [ "0", [ {Fn::Split: [ ",", Fn::ImportValue [ {Fn::Sub "${ExportPrefix}-SubNets"}] ]} ] ]

```

I have checked and all spaces should be spaces and all tabs be tabs.

# Answer
> 1 votes
The split function returns a list of strings. I believe encapsulating the function in a list is what is giving you the error. Have you tried removing the brackets around the split function? Something like:

```
!Select [ "0",  !Split [ "," , !ImportValue [ !Sub "${ExportPrefix}-SubNets" ] ] ]

```

---
Tags: amazon-web-services, aws-cloudformation
---


# Question
Title: How to share RDS snapshots across account roles?
I'm using an AWS account which has different roles for the different environments we use. For example, we have a `Development` role for our development environment and a `Production` role for our production environment.

At any point of time, we switch into or assume as one of the roles to access the services in the particular environment. Neither roles can see nor access each other's services and they function as though they are separate accounts.

The problem now is, there are some application issues with an RDS instance in the production environment. The production database resides in the `Production` role. My intention is to clone the database in production over to the development environment for debugging reasons. However, since the environments are in different roles, they can't see each other's resources. The snapshots of the databases in one environment is not visible in another.

Since the roles are technically not accounts, I can't use the "Share snapshot" feature too because that would require me to input an account number instead of a role name.

Is it possible for me to allow the use of RDS snapshots across account roles so that I can clone the RDS instances? If so, how can I do it in the AWS console?

# Answer
To my knowledge there are only Tag based Iam policies available to limit access to resources for certain users or user groups.

Because of this, you should simply be able to tag an RDS snapshot both production and development for you to access it with your development user or group.

There are a large number of security considerations to think through, so don't undermine the security setup. I would therefore expect that only manual tagging is appropriate for this specific use case
> 1 votes

---
Tags: amazon-web-services, databases, amazon-rds, role-based-access-control
---


# Question
Title: Run command from Jenkins to Linux Server
I have a HAProxy server setup in Azure Linux Machine. How can I run a HAProxy start/stop command from Jenkins to multiple Linux server?

# Answer
If you have ssh access from the Jenkins machine to the HAProxy machine, you could run an Ansible task:

`ansible -i ha-inventory.ini ha-servers -m service -a name=haproxy state=restarted`

Of course you could also have Jenkins do a simple ssh :

`for server in ${server_list} ; do ssh server 'sudo service haproxy restart' ; done`

For both of these, you would need

* ssh keys set up between Jenkins and the HAProxy servers
* sudo rights for restarting the service (at least) for the connecting user (probably `jenkins`)
> 1 votes

---
Tags: jenkins, linux
---


# Question
Title: Deploying software that depends on a virtual machine for non-tech savvy users
# About

I am developing a piece of software which consists of a Node.js application which controls a virtual machine that runs Android-x86. Also there are some pieces of the Android SDK like ADB the software depends on.

# My current approach

Currently there is no smart way of deployment whatsoever at all. Everything has to be installed manually. Depending on the system I also get issues regarding networking and so on from time to time. I also created another question here where I first thought about using Docker.

# My problem

While researching if I can solve this using Docker I came up with solutions that require Kubernetes as well. I want to deploy the software to non-tech savvy users as well. So I cannot afford to have Docker and Kubernetes as dependencies due to the complexity of the installation process.

# My question

Is there any technology that I am not aware of that can simplify the setup process for the end user? The perfect scenario would be a virtual machine or container containing the whole environment that can somehow be converted to a single binary which can be installed/executed.

# Answer
> 2 votes
I argue that K8s+docker is a good approach even for a non tech person. For k8s you can use microk8s which is available on linux, windows and macos. It creates a local, single-node k8s cluster for you. You can write a script (if the target OS is linux or mac) and automate the installation of kubectl, microk8s, enable addons and install your component k8s yaml file. If the target OS is windows you have to see how they automate stuff and use that method.

---
Tags: deployment, virtualbox
---


# Question
Title: What is docker? what problems does it solve?
I'm a jr. developer and I'm being required to learn docker. I googled around and read a bunch of articles about docker but couldn't really understand what it was for, what problem does it solve.

Example about GIT. When I was at university when we had our thesis, my groupmates and I use facebook messenger or email to pass parts of the code, we indicate what file is it for and on what line, so I understand how GIT resolves a problem. but what about docker? When I deployed to AWS, I ssh thru the server, git clone your repo, do an npm install, so whats the difference? I still have to do that right but with one command? `docker compose run` or something? so thats it? hope someone can explain it to me. thank you and have a good day.

# Answer
> 0 votes
Docker is a technology that allows you to create OS-level virtualization for software delivery. There are many, many articles written about what this technology is, how it can help developers and companies, and tutorials on how to get started.

To answer your question of why as a developer you may care (non-exhaustive list):

* Building an application that is immediately ready for deployment.
* Removing cumbersome installs for quick prototyping and testing. I use it all the time to setup a SQL server to test scripts before deploying them.
* Removes the "It works on my machine" since all the application dependencies are in a "container".
* Allows you to easily run and port services that usually would require several minutes of installations and configurations.

For your AWS example, imagine not having to SSH into a server, pull source down, and setup the environment **every time** you want to scale up or out. Most cloud providers now have options to deploy your containers and not worry about all those steps (see AWS ECS).

The Docker-Compose you mentioned is slightly different in that it is a way to easily run multiple containerized services together.

---
Tags: docker
---