# Question
Title: Should I run CI on merge state or HEAD of branch in a PR?
I'm using Jenkins Pipeline with Github for our CI purposes and I'm trying to think what the strategy should be for what is checked out to run.

Jenkins provides three options when discovering pull requests:

```
 1. Merging the pull request with the current target branch revision
 2. The current pull request revision
 3. Both the current pull request revision and the pull request merged with the current target branch.

```

I'm looking for opinions on what others choose. To run just the branch head because then it's clear exactly what is being run, or to run the merge state because then it makes you more confident when you merge.

Currently, I'm using just the PR branch HEAD and enabled Github to require a master merge if the branch is out of date.

# Answer
> 3 votes
Usually you want to test your code as closely as possible to how it's going to be deployed. This means you're going to want to run your tests against code that's been merged with master, so choose the first option (merge first, then test). There's no point in the 2nd option if you're never going to deploy the code in that state (i.e. unmerged).

Or for another perspective: good CI practices involve merging soon and merging often. This would naturally lead one to the first option.

---
Tags: jenkins, continuous-integration, jenkins-pipeline, github
---


# Question
Title: What package managers are supported on Microsoft hosted agents with CMake enabled?
Here, I can read that it is possible to setup a CMake build on a Microsoft hosted vsts agent. What C++ package managers (e.g. Conan) are supported for these agents?

It would be great if at least one of these package managers is supported: https://github.com/nlohmann/json#package-managers

# Answer
According to this page, the hosted agent supports NuGet, npm, and Maven.

It looks like it might also support `pip`. You could install `cget` using `pip` and then use `cget` to install your package. A bit of a roundabout way, but it might do what you need.

```
"C:\Program Files\Python36\Scripts\pip" install cget
cget install nlohmann/json

```

I don't have a way to test this right now, but I will try some real examples and edit tomorrow if I have time.

Since it is a CMake/Git project, you could also just clone the repository (or add it as a submodule) and build it every time. Since I often use libraries that aren't managed, I tend to take this route and leverage the caching that many CI platforms offer to keep my build times low. Sadly, it looks like VSTS hasn't gotten to this yet.
> 1 votes

---
Tags: azure-devops, dependency-management, azure-pipelines
---


title: Set user in aws

text:
# Question
Title: Set user in aws
I have a lot of instance in aws.I have build through terraform. I have made scripts of making user(e.g. **user1** rather than **ec2-user**).But i am facing one issue.when i check .ssh/authorized\_key. I have seen this line **Please login as the user "ec2-user" rather than the user "root"**.The problem is that whenever i login using this user(like user1@XXXXXXX) get this msg and denied to login but i have remove this line and try then it's working.but i want to remove this line not manually. How can i do?in this scripts i have done few steps.

* sudo adduser user1
* usermod -a -G sudo user1
* cp ~/.ssh/authorized\_key /home/user1/.ssh/authorized\_keys After this i am trying to login through ssh user1@XXXXX-XXXX and then show me this line on terminal **Please login as the user "ec2-user" rather than the user "root"**.So i have entered through ec2-user@XXXX-XXXX and then i have switched user to user1 from ec2-user.and then remove this line **Please login as the user "ec2-user" rather than the user "root"** because this line is by default come.after that i have easily login through user1@XXXXXX-XXXX but how can i configured without showing this line msg.

# Answer
> 1 votes
Terraform is awesome for setting everything up. I like it less for the actual configuration. After Terraform runs and sets everyhting up (ec2 security groups/instances etc,.) we run Ansible to configure additional users.

I recommend leaving AWS default user (ec2user, ubuntu) if you're using SSH Keys. Add to your 'authorized keys' all the public keys for users you want to allow ssh access. remember to edit 'sudoers' and create groups as needed. try separating users into groups and in 'sshd\_config' allow the groups to connect via ssh. (each member of the group needs to have his public key in 'authorized keys')

restart sshd and you're good.

---
Tags: terraform, linux, shell-script
---


# Question
Title: What percentage of microservice architectures employ polyglot programming models?
One of the tenets of microservices is the polyglot, autonomous services (developed in different programming languages). In my experience (online reading and YouTube and discussions with developers) it seems this is not really applied in practice except the big companies like NetFlix, AWS , Google. Will this assumption be true ? I will appreciate information on statistics about this e.g. reports, surveys.

# Answer
A good source for statistics could be stackshare.io.

In general, polyglot services i.e. *teams* delivering different stacks could create silos, and additional overhead for diverse toolchains; nevertheless I consider that larger organizations have the polyglot situation organically because this type of thing is not always an issue of top-management.

Arguments against polyglot approach: "Why You Should Think Twice Before Even Considering Polyglot Microservices"

Worth to mention is the polyglot toolkit Eclipse vert.x (though I am not sure how is this different to say "it has bindings to many languages").
> 2 votes

---
Tags: microservices, devsecops
---


# Question
Title: How do I run the InSpec using a wrapper profile?
This blog post describes wrapper profiles in detail:

https://blog.chef.io/2017/07/06/understanding-inspec-profile-inheritance/

At the very end of the post, it references a Git repo that contains an example of using a wrapper profile:

https://github.com/adamleff/inspec-profile-wrapper-example

When I clone the repo, cd to the `controls` folder, and attempt to run these tests:

```
inspec exec controls_from_other_profiles.rb

```

I get the following error message:

> Cannot load linux-baseline since it is not listed as a dependency of tests from controls\_from\_other\_profiles.rb.
>
> Dependencies available from this context are:

The dependencies are defined in `inspec.yml`.

How do I correctly run these tests?

# Answer
I stumbled across the answer. From within the profile directory, run this command:

```
inspec exec .

```

Don't forget to set the `depends` key in `inspec.yml`.
> 2 votes

---
Tags: chef, inspec
---


# Question
Title: Planning a backup system using postgress, chef and vault
As the title says I am working on planning a way to backup postgres using chef and vault. Idea is that we already encrypt the backups from postgres using a key (random binary string) and we would like to keep that going. We would like to store that string in Hashicorp Vault. My issue is I am not sure how to get it so that the key is made into a file then a few scripts are run. Then comes the issue that a more senior person wants these backups to only be weekly not every time the cookbook runs which if memory serves me right is every 24 hours.

I am not sure the best way to access the secrets in Vault from a chef cookbook. Nor have it run weekly.

I would have preferred to do this with cron jobs and bash scripts, but sadly that is not an option.

# Answer
> 1 votes
First chef runs as often as you configure it to do.

Second Chef is a configuration management system and not a crontab or an orchestration system.

Use chef to configure cron (that can not be not an option, try to find out why this is not considered) for your backup using consul-template to retrieve the secret from vault. Don't use Chef to run the backups because of the caveats you already mention.

However if you really want to shoot yourself in the foot, just add a guard on your backup command like this (604800 seconds is roughly 7 days):

`not_if { (Time.now() - File.mtime("/path/to/your/backup/file.tgz") < 604800 }`

---
Tags: chef, hashicorp-vault, backup, postgresql
---


title: ChaosMonkey for k8s?

text:
# Question
Title: ChaosMonkey for k8s?
Is there a kind of tool like ChaosMonkey specific for k8s that kill nodes and pods during office hours to train the team how to deal with issues and to harden the k8s cluster?

It is possible to create a script or program that kills random PODs, but if such a tool already exists then this will save time.

# Answer
You can take a look at kube-monkey. According to the `README`, it randomly causes failures in kubernetes clusters.
> 5 votes

# Answer
check this out, it's a very good guide Run Chaos Experiments Without Risking Your Job

Another one Powerfulseal powerful testing tool for kubernetes which adds chaos into a cluster.
> 4 votes

---
Tags: kubernetes, resilience-testing
---


# Question
Title: docker volumes on cifs share cause permission disaster
I have a small vm running docker it only has a 20gig SSD which is more than enough for the OS + SWAP + Docker and the container images. But now I want to run a nextcloud docker image on that host. Because of the lack of space I mounted a cifs share to /data and started docker linking nextclouds data directory to the share.

```
 docker run -v /data/docker-volumes/nextcloud/data/:/var/www/html/ -p 8080:80 nextcloud

```

The files are created but then docker tries to change the ownership of the files to www-data which does not work because the user www-data does not exist on the target system (the SMB Server). Which fails and terminates the docker instance.

```
rsync: chown "/var/www/html/data" failed: Permission denied (13)
rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1196) [sender=3.1.2]

```

There is no way to create the user www-data on the target system. Is there any way to get around this?

# Answer
> 4 votes
The problem can be solved by using mount options that force the application of the correct user and group eventhough these attributes can't really be set on the target system its sufficient to get around the docker related problem.

Also a reasonable set of privileges needs to be defined that is used for new files and folders.

```
mount -t cifs -o username=user,password=pass, \               # provide creds
  uid=www-data,forceuid,gid=root,forcegid, \                  # force gid and uid
  file_mode=744,dir_mode=744 //host/share /local/mountpoint   # set permissions for new files and directories

```

---
Tags: docker, containers
---


# Question
Title: Possibility of container breakout compared to VM (virtual machines)
What is exactly the (higher) vulnerability at least theoretically of a container compared to VM? given, all security recommendations are implemented (like, user context is root, no host sensitive volumes are mounted, tuned capabilities..).

How differently can an exploit compromise a container via network interface other than a VM? Could a "bad" TCP package force Docker daemon to create a container with root rights?

# Answer
Containers isolate an application on a shared OS, VM's isolate an OS on shared hardware. With those different levels of abstraction, you have different exploits and protections.

A successful kernel level exploit on a container will affect the shared kernel, and therefore breakout of the container isolation. Think meltdown and spectre.

A successful VM driver exploit could break out of the VM to the hypervisor running the VM's. I've heard of exploits on things like the floppy driver in VMs. These are much more rare than kernel exploits, so I'd give the advantage to VM's here.

It is possible to change the container runtime to spin up containers in small VM's. Projects like Kata Containers are working on this. So you could get the security of VM's while still getting some of the features of containers.

Containers do have a huge different advantage over VM's. They run in a minimal environment with reduced capabilities, seccomp, and optionally selinux/apparmor configured. You can lock down that environment in ways you couldn't easily lock down a VM, with a read-only filesystem, and not including any of the tools like shells, interpreters, and libraries that an attacker may need to exploit your system to try attacking the kernel or horizontally pivot their attack.

As a result, there's no clear winner. The best answer is likely a combination of both, running a handful of containers with similar security requirements on their own VM.
> 2 votes

---
Tags: security, devsecops, virtualization
---


title: Definition of "Done" for DevOps

text:
# Question
Title: Definition of "Done" for DevOps
I've being recently interviewed for a DevOps position. One of the questions I was asked was:

> What is your definition of "done" in the DevOps context?

The question is rather broad, but, as I understand, the answer has to cover Automated builds & tests as well as Continuous Integration & Deployment & Delivery. I am looking for general principles and ideas that can be used to define "Done".

# Answer
> 12 votes
Instead of Continuous Integration and Continuous Delivery, I would define the definition of done as "*Active Continuous Improvement at all levels of the organisation*".

The other topics like automated builds, CI/CD, etc... these are just milestones and most definitely not the ultimate goal for the organisation in its DevOps efforts.

It does look like it might be "finished all DevOps" once you have an automated system with continuous integration. But in fact, even should you reach this stage, you will find plenty more to do.

Getting to a state where most people in the organization are constantly looking to continuously improve is extremely hard. Inertia often gets in the way, both existing inertia, and new inertia once some improvements were accomplished.

There is a lot to learn from Lean and from Theory of Constraints in this aspect. Both bodies of knowledge focus on the process of continuous/ongoing improvement and how to establish this process in an organization.

# Answer
> 3 votes
Prior to DevOps, an Agile team's definition of "done" typically meant is was "done" for the sprint (and accepted by the product-owner at or before the end of the sprint). In reality, there might be subsequent levels of testing/delivery/release-engineering before it was actually released & deployed.

From a DevOps perspective, the common saying is "Done means *deployed*" - the corresponding story or feature wouldn't go to the "done" column of the board until it was deployed to production environment.

# Answer
> 2 votes
DevOps is a continuous improvement in delivery cycles and meeting customer needs with top quality , less time and security without compromise on cost and performance. And of-course repeat the cycles with feedback from customers.

Ideally there is **NO** getting it all **"Done"** on DevOps. This question is rather a tricky one because its similar to asking

> When are you done with development or sales of a software in a Software company?
>
> Ans: Obviously once the company shuts down or you get kicked out !

Similarly there is no **Done** for DevOps culture. Of course there are deliverable and mile stones which one needs to complete like automating mundane repeated tasks , CICD pipelines etc

A very good explanation for DevOps given by IBM DevOps head.

https://www.youtube.com/watch?v=EIvOZA1HgHU

# Answer
> 2 votes
Scrum teams use definition of “done” to assess when work is complete on the product increment.

As per scrum guide when a product backlog item or an increment is described as “done”, everyone must understand what "done" means. Although this varies significantly per scrum team, members must have a shared understanding of what it means for work to be complete, to ensure transparency.

Daniel Gullo, Founder and Principal at Apple Brook Consulting, Certified Scrum Coach and Certified Scrum Trainer, shares his views on usage of definition of “done” in his recent blog. He says that there are different contexts of “done,” which can be applied at the story level, epic level, release level, product level, and so on.

Daneil says that there are different perspectives of “done”.

> The word “done” is often used to mean “complete” as in the Development Team saying: “We are done with this story.” It is also used to indicate “acceptance” as in the Product Owner saying “This story is done.” I typically teach and coach it this way: Don’t say “done.” Instead, use “complete” and “accepted” for more specific indications of status.

---
Tags: continuous-integration, terminology, continuous-delivery
---


# Question
Title: What is a good storage for storing performance results and visualizing in grafana
# Intro

I am a tester and need to analyze the results of automated tests (response times and etc.)

# Current situation

1) I run performance tests using locust.io
2) During test execution, response times of successful results are pushed to Graphite database
3) I visualize the results in Grafana

# Problem

I tried to calculate the average using Grafana to see if it matches the results generated by Locust. It doesn't.

After a while, i tried to figure out what could be a problem. Graphite has data retention. As a result, the smallest time period for a data point is 1 second.

My situation is that I could have several data points with a time difference of several milliseconds.

I thought I could use something like Prometheus as a substitute for graphite, but it doesn't seem to have an import of data. A solution would be installing Graphite Exporter, such that i can imitate "pushing" data to db. But I think installing this extension and setting everything up is an overkill. There should be a much simpler solution.

# Question

Could someone suggest a solution from personal experience? I need a db/storage to which I can write in a format `query_name responce_time timestamp`, and then use this storage as a data source for visualizing a report in Grafana.

Thanks in advance!

# Answer
Sadly nobody answered, so I will provide feedback about how i did it so far.

Graphite was not a good solution for me due to its retention policy. Performance tests sent data to the database every millisecond, and due to retention Graphite did not store all the results but only the last one per the period, meaning if you sent 100 data points in the last minute, the first 99 would be dropped, the 100th one would be stored. This fact was found by me somewhere on some forum. I do not claim I have setup/configured/used graphite correctly, yet the result was several days of debugging a bug which appeared an actual feature, lots of stress and questioning if my head and hands grow out of my shoulders.

Next option was to use InfluxDB. Sadly didn't work for the following reason:
\- If running InfluxDB in a Linux docker container, I was not able to bind mount it to a specific folder on host's OS outside of docker installation folder. A solution would be to try and use docker named volume. Maybe that would have worked, but I was short on time and patience.

The final solution was to use simply a Postgres DB. Created a timetable with all the metrics and a timestamp field. As a result, Locust writes the final session statistics into a CSV file. CSV file is parsed by a python script and parsed data is inserted into the table. Grafana then connects to the DB and quite nicely visualizes the results using a simple query.

Next possible question would be:

> how to store the results of every single request to gain better precision for the results of my performance tests?

My personal suggestion would be to use influxDB with a consistent storage saved in a named volume if you are using Windows host. There the smallest time period can go down to milliseconds and data retrieval was very easily setup by manually writing a simple select query. Yet, please do not take my word for it and try this out, because i haven't done this, so my thoughts are nothing but a theory.

Happy performance testing.
> 1 votes

---
Tags: testing, databases, performance, prometheus, grafana
---


title: Helm/ YAML indentation issue

text:
# Question
Title: Helm/ YAML indentation issue
I am etting weird YAML indentation with some conditional stuff, effectively I'm doing:

```
resources:
{{ toYaml .Values.resources | indent 10 }}
{{- if .Values.filebeat.enabled -}}
      - name: elastic-logger

```

But the final line is indented by 10, not 8 as it should be. in fact I can indent it by 0, 10, 100 - but it's always indented 10. any ideas? (edited) `.Values.resources` is for one container, and if `filebeat.enabled` then I'm adding another container to the array output:

```
 resources:
 {}
    - name: elastic-logger

```

# Answer
Turns out `-}}` is a special syntax which says 'eat up any following whitespace'. Removing the `-` fixed this.

I get a blank line, but don't really care, considering!
> 1 votes

---
Tags: yaml, helm
---


title: Leadership types for DevOps team?

text:
# Question
Title: Leadership types for DevOps team?
Would you say from experience, either task or relationship leadership style works better for DevOps? Or would you go for something else in this context than Forsyth's theory?

# Answer
> 6 votes
Different types of leadership styles are required. To start with DevOps in a company, one has to apply a different leadership style compared to when it has already been implemented.

When one starts with DevOps a cultural change has to be done and engineers should get rid of, for example, the "throw it over the wall" mindset. When DevOps has been implemented, a leader should be able to communicate well with other teams to connect multiple departments in a company.

In summary, in the beginning a leadership style that motivates people to implement DevOps is required. Later communication between teams and how the team will work in the organization, i.e. more focus on external.

A leadership style that could be used to implement DevOps is a transformational leadership style.

# Answer
> 0 votes
Healthy DevOps teams tend to be relatively small and relatively independent when they work really well. If you have a team like this, then task oriented leadership will work well because it fits nicely with the general DevOps philosophy.

---
Tags: culture
---


# Question
Title: Processing message queues quickly without wasting money on AWS Lambda
What are some strategies and patterns for processing message queues quickly?

I have a Lambda function that is invoked on a schedule every x minutes to process a number of messages in the queue. I could reduce the interval, but a lot of the time there won’t be any messages to process and as Lambda is priced per request this would be cost inefficient. So I’m looking for a few ideas on other ways to achieve this

# Answer
> 3 votes
An SQS queue can now be wired directly to a Lambda function as an event source, so you don't have to start the Lambda function on a schedule.

https://aws.amazon.com/blogs/aws/aws-lambda-adds-amazon-simple-queue-service-to-supported-event-sources/

---
Tags: amazon-web-services, aws-lambda, amazon-sqs
---


# Question
Title: Scanning fs in a Docker container is (much) slower than on host?
Is scanning/searching the filesystem slower in a Docker container, than on the host? Seems a lot slower from my testing and sometimes I get an EIO scan error.

Specifically I am scanning a read-only (:ro) shared volume.

In this case, the workaround is I can the host first before sharing the volume in the container, it seems much faster.

Any other workarounds? Is my observation imagined or real?

I am running Docker version `18.03.1-ce, build 9ee9f40`

on MacOS Sierra

# Answer
Docker on MacOS runs on a virtual machine (docker-machine), and it's known that docker-machine volume mounts may perform worse than what you'd expect. It becomes worse especially when it comes operations concerning lots of small files, like scanning the filesystem.

Official Docker documentation also mentions this, and suggests some workarounds by lowering the consistency guarantees.

See: https://docs.docker.com/docker-for-mac/osxfs-caching/
> 3 votes

---
Tags: docker, docker-compose, dockerfile
---


title: chef database cookbook deprecated

text:
# Question
Title: chef database cookbook deprecated
I frequently use chef database cookbook and it is being deprecated doesn't receive any updates. They even disabled issues on the github so it is not possible to check if any issues I encounter have been discussed and possible solutions were proposed. The deprecation notice says that functionality of this cookbook is supposed to be moved to individual database cookbooks but this still isn't implemented, at least for MySQL. Is there any alternatives to this cookbook or I'm just stuck with creating another fork alongside hundreds of others?

# Answer
> 2 votes
If what you are looking for is a chef cookbook to manage MySQL, I would recommend checking this It is an officially maintained cookbook. Keep in mind that:

> This cookbook is concerned with the "MySQL Community Server", particularly those shipped with F/OSS Unix and Linux distributions. It does not address forks or value-added repackaged MySQL distributions like MariaDB or Percona.

I hope this could help.

# Answer
> 0 votes
MariaDB cookbook added support for `mariadb_database` and `mariadb_user` resources in the version 1.5.4 released on May 25 2018.

---
Tags: chef
---


# Question
Title: Advice needed - automate everything or only new/current projects
I watched Klaus Ita Keynote on FreeCodeCamp YouTube channel about devops and got inspired.

In previous job we had very good deployment system. We begun with Jenkins and pulling source from SVN, and then migrated over GitHub and used CircleCI. We also managed to use only single source code for many clients using multi tenancy approach, so everything was simplified to the bare minimum.

Now I started to work in another company, digital agency, and 80% of current projects are Wordpress.

I don’t think that we would be able to merge all clients under one source code (or we could try with multi tenancy, by managing seperate databases, seperating out plugins and themes), but at the moment all the projects are just copied to server via FTP. At least, GIT is used to keep versions.

I have in my mind, that I would really like to improve this deployment process by automating it as much as possible, at least with Jenkins and git-ftp, but th question is how to start doing this? I mean, move one-by-one project to Jenkins or only those that requires future upgrades? Or only new projects, that might come in? Is it worth that effort? What should we do with rest of 20% of custom projects?

I hope that you might share your experience, your failures and know-how’s to help one more soul to sleep better at night :)

# Answer
You can spend a lot of time, to automate something, which is done monthly and do routine staff manually on a daily basis - not the best way.

If you are time/resource limited, then find the bottleneck in the software delivery process and improve it, after that bottleneck is not a bottleneck anymore, find a new one and so on. So if you are spending 80% of your development time/resources on the new project, automate it first, and leave the old ones for the next step or vice a versa, depending where the main bottleneck is.
> 1 votes

---
Tags: jenkins, continuous-integration, continuous-deployment
---


# Question
Title: Merging Git Database Commits from One Branch to Another without Cherrypicking
We have main two Git branches at our company: During our Sprint,

Everyone has (local branches)

Release branch: Contains prepared/developed code, ready for testing, and

Master branch: Production- final ready code

I read in Git, Cherry picking is bad.

https://blogs.msdn.microsoft.com/oldnewthing/20180312-00/?p=98215 http://www.draconianoverlord.com/2013/09/07/no-cherry-picking.html

After items are placed in master, they are ready to be deployed. Sometimes , we do not move all Release items into Master, many reasons:, delay schedule, conduct more testing, late issues. What is the proper Git Devops strategy to only move certain items into Master? Should we backout commits, so we can do a clean merge?

Databases are different, as we are conducting change scripts, and not overwriting binaries like applications, etc.

Example:

Release branch *-------* -------------\> Master

Commit A, B, C, D, E -------------\> Commit B,D

# Answer
> 2 votes
> I read in Git, Cherry picking is bad.

Be careful of such blanket statements. They take on a life of their one, and after a while you have a lot of myths in your team (or workplace) about no cherry-picking, no re-basing, no xyz. These are all just tools; there are times to use them, and times to not use them. Nothing is generally bad.

> Sometimes , we do not move all Release items into Master, many reasons:, delay schedule, conduct more testing, late issues. What is the proper Git Devops strategy to only move certain items into Master?

Adam Dymitruk's Branch per Feature works splendidly for that. In short:

There are these branches:

* 1 `master` branch
* 1 `qa` branch
* n `feature-123` branches

The general principles:

* *Every* branch starts at `master`.
* *Only* `feature-123` branches receive regular commits.
* `qa` is created by starting fresh from `master`, and then merging any `feature-123` branches that should be in testing. Whenever `qa` needs to be changed, it is created fresh again, there are no other commits into it. This happens very frequently.
* When `qa` has been released/deployed, it is simply renamed to `master` and replaces the previous one. At this point, all remaining `feature-123` branches are rebased onto the new master. The `git rerere` cache is used to avoid having to do repeated conflict resolution.

This scheme works great *if* you have developers who can stomach the rebases. You frequently find people who think they are bad, or who simply do not allow it - then you're out of look obviously. But if you get it to run in your team, it is very smooth, and ultra flexible. You literally never ever need to "back a commit out" or do cherry-picking to revert a commit, or whatever.

Read Adam's page, it explains this in more detail, but basically that's about it. You'll need to create your own tooling for the individual steps (for example, to pull the feature branches which are supposed to go into `qa` from your Jira instead of manually doing that), but that's not too hard.

Addendum:

* Trivially, you can have more than one `qa`-type branch at any point in time. For example, you will likely start with one that always has all features which are deemed close to "done" (but which may not have successfully passed test yet); and maybe another one (let's call it `rc` \- release candidate) which contains a subset of that for the very next release.
* Adam also describes a `ci` branch; it is nice, but optional (we don't use it at all, and are not missing it).

# Answer
> 0 votes
we had the same problem, so now we have:

* jira (stories and tasks)
* bitbucket (git)
* bamboo (automated builds all branches and before pull-request)

brachces:

* production (only production release any time)
* master (development but ready to production branch)
* feature-branches (from master) -\> (completed story/task + all tests) -\> master
* hotfix-braches (from production) -\> all-branches-\> production -\> master -\> feature-branches

---
Tags: git, databases
---


title: What's the best complete DevOps setup?

text:
# Question
Title: What's the best complete DevOps setup?
I'm curious what everyone recommends.

Vagrant is for setting up test environments right? Ansible/Chef etc. seem good for servers you own, but what about cloud? Docker... great for standardizing app, so why use Ansible/Chef? Kubernentes.. good for deploying to multiple environments and scaling

I'm just trying to understand what the need for ansible or chef are? And how about Vagrant?

Also for the build cycle CI/CD pipeline with Git and artifacts.

Cloud providers:

AWS, GoogleCloud, Azure ? Which is best

Any recommendations about the best overall Devops setup?

Diagram would be best.

Stack is: Node, React, MongoDb, Postgres, etc.

# Answer
> Vagrant is for setting up test environments right? Ansible/Chef etc. seem good for servers you own, but what about cloud? Docker... great for standardizing app, so why use Ansible/Chef? Kubernentes.. good for deploying to multiple environments and scaling

Just a personal note: the way you formulate these things makes me assume that you are diving freshly into these tools, and trying to figure out what they are for. And your reasoning is "tool X is for purpose Y". I know the feeling, I started out like that as well, trying to wrap my mind around what all this stuff is for. The trap is that the real reasoning should be "tool X does Z", instead. Few of these are really limited to a particular purpose.

For example. You say "Vagrant is for setting up test environments". This is wrong. Vagrant is for spinning up VMs in an automated way, including a zoo of pre-made images. "Ansible is good for servers you own" is wrong. Ansible is a tool to execute commands on a remote server where you have ssh access, with a zoo of recipes/playbooks to do the most common tasks. And so on.

This is not to berate you, but to make it easier for you. Try to be a little less abstract, and just look at what the tool actually *does*. Then it gets relatively easy to find proper uses, and you also can use the same too for different purposes.

For example:

Vagrant is great for also setting up *development* environments, not just testing. Or, really, any VM at all where you want the actual content to be mostly configuration-as-code and want to avoid clicking around in a VM GUI.

> I'm just trying to understand what the need for ansible or chef are? And how about Vagrant?

Now you know what the need for Vagrant is. Vagrant literally solves the need to spin up VMs repeatably, automated, and have the configuration managed as files (i.e., checked into VCS together with the source code of your application, and so on).

> Also for the build cycle CI/CD pipeline with Git and artifacts.

Read the documentation of git & co and actually look at what it *does*. That, then, is its purpose, nothing more and nothing less.

Same for CI/CD. Continuous integration means *literally* that. To continuously (i.e., once or more a day, not just every few weeks or months, as it was done in the past) integrate (i.e., merge all the branches of your application that are in development currently). There is no hidden purpose there (or if there is, it should be obvious - doing it more often means every single time is more easy, since there's not such a long time inbetween). Obviously the *details* of how it works exactly without turning into a nightmare could be more involved, but the *purpose* is just what it says on the can.

> AWS, GoogleCloud, Azure ? Which is best

It does not make sense to think of "best" here. All three are extremely complex, and the fact that they are all still around means they all serve a purpose. You have to look at each of them, try them out, and compare them to your needs (and your personal likes/dislikes, sometimes).

> Any recommendations about the best overall Devops setup?

Clearly the best overall DevOps setup is the one that solves your problem and fits your overall needs and wishes. There are a vast amount of possibilities of good DevOps setups, and you have to choose for yourself.
> 7 votes

# Answer
The best stack depends on what environments and platforms your working with, how much standardization you already have, and if your working with open source or not. If you have the option of using containers for everything then you can simplify the stack and reduce the tool set used.

The other important note is you are deploying application artifacts and configuration as well as system artifacts and configuration. Many pipelines use different tools for parts but coordinate with an overall coordinator. The key is that all the configuration, changes etc are managed in the SCM and are deployed.

One common open source stack is some flavor of git (Github, Gitlab, etc) along with Jenkins and then ansible for system level configuration and deployment. This can be used if your using containers or not. The application deployment capability varies much more as their are more products in the market that specialize in this space so direction competition. It usually has more to do with the type of application being developed as to which application deployment technology is then used.

With your stack there is no reason you could not use Git with Jenkins with Kubernetes which which ever cloud you decide to use. Cloud choice is based on all sorts of factors many that don't have anything to do with technology.
> 4 votes

---
Tags: docker, amazon-web-services, continuous-integration, kubernetes, deployment
---


# Question
Title: How to set an existing IAM role to a new instance while spinning in terraform?
I am trying to attach an existing role created in AWS, but I am not able to add it in Terraform Code. I tried to add the role in instance profile but it didn't work either for me.

Is there any direct way to add it in the resource in Terraform Code ?

*`iam_instance_profile = "my-role"`*

> **Note:** my-role is having the full access of ec2.

# Answer
you can add role like below

```
role = "${aws_iam_role.ec2_role_name.name}"

```

Please check - https://www.terraform.io/docs/providers/aws/r/iam\_instance\_profile.html
> 1 votes

---
Tags: amazon-ec2, terraform
---


# Question
Title: Bad practice having a single SSH gateway with access to all environments?
I have started at a new company and am in the process of locking down SSH access to be through a single SSH gateway server.

My question is, should I create a separate SSH gateway server for each environment? (QA, Dev, Stage, Prod)

We are fully in AWS so my current plan is to create an SSH Gateway server on a DevOps VPC and create peer connections to the QA/Dev/Stage/Prod VPCs.

Then I would manage access to environments via SSH keys.

My concern is that this single SSH gateway server has access to all environments, which is a little terrifying. But that being said, it is easier to manage and monitor access.

# Answer
I assume your users connect to the gateway with ssh (possibly with additional credentials like a hardware-generated one-time-password), and then jump to the actual servers with a second ssh connection.

In itself, this is fine (and the usual thing that's done regularly by companies I've worked with). The secondary ssh connection (still) takes care of only letting those people in who are authorized. The job of the gateway is primarily to avoid the need for the ssh port of the servers to be open to the internet on the network level.

Obviously, you want to avoid people opening ssh tunnels, using proper settings in your global ssh/sshd configuration, and you will want to tighten down the gateway itself (for example, by having read-only home directories for your incoming users; and having no tools installed that can help in somehow bypassing any of your rules - i.e., no telnet, netcat and so on; ideally a chroot environment in which nothing except the `ssh` executable is available).
> 1 votes

---
Tags: amazon-web-services, security
---


# Question
Title: How to access report data from Sonarcloud.io aka SonarQube API, or functionality no more available?
Thanks to SonarCloud.io, you can perform static code analysis without own infrastructure.

But, is there an API to access data shown in Sonar dashboard?

What I can find so far, is the "Sonar Web API" documentation but it looks very scarce. There are also docs for older version, but API documented there seems to be no more available.

Is there more "hidden" API functionality? I can't see it mentioned in the Enterprise edition.

# Answer
Ok no so obvious but at least one possible way is:
> 1 votes

---
Tags: analysis, sonarqube
---


# Question
Title: Diagnosing large delay in file sync to Docker for Mac
Preface: I understand that Docker for Mac has file syncing performance issues, but everything I've read about the issues is related to slow read access. I don't really have a problem with slow read access. My problem is that updates I make to files on my host machine can sometimes take 10+ seconds to update on the running container!

Here's my docker-compose file:

```
version: '2'

services:
  ps-cms:
    image: [obfuscated]
    container_name: ps-cms
    mem_limit: 2048M
    ports:
      - "9080:80"
      - "9443:443"
    volumes:
      - .:/var/www/html/site:cached
      - ./xdebug.ini:/etc/php/conf.d/docker-php-ext-xdebug.ini
    environment:
      - MYSQL_HOST=ps-db
    networks:
      - connector
    extra_hosts:
     - "mysite.localhost:127.0.0.1"

  ps-db:
    image: mysql:5.6
    container_name: ps-db
    mem_limit: 512M
    environment:
      - MYSQL_ALLOW_EMPTY_PASSWORD=yes
    ports:
      - 33006:3306
    networks:
      - connector

networks:
  connector:

```

Software:

Docker Engine: 18.03.1-ce Docker Compose: 1.21.1 Docker Machine: 0.14.0 PHP Storm: 2018.1

In the Docker for Mac preferences, under "file sharing", I removed everything there and just added my one project folder, since I heard that can affect performance.

Does anyone have advice on what could be causing this sync delay?

# Answer
> 1 votes
I figured this out, and it was related to the opcache settings for PHP in my docker image. The opcache re-validate frequency was set to 60 seconds, meaning that PHP caches files in memory for that long before referring to the filesystem again. Changing this to 2 seconds resolve the issue, but adds a significant performance penalty :(.

See more info: https://drupal.stackexchange.com/questions/253111/delay-in-code-changes-on-custom-pages-in-drupal-8-in-a-docker-environment

---
Tags: docker, docker-compose
---


title: certbot renewal fails over ipv6

text:
# Question
Title: certbot renewal fails over ipv6
I'm using LetsEncrypt CA for SSL certificates with a cron job that renews them. Recently moved one of our domains to dual ipv4/ipv6 stack and now the certificate renewal fails for that domain:

```
Attempting to renew cert (nodrama.io) from /etc/letsencrypt/renewal/nodrama.io.conf produced an unexpected error: Failed authorization procedure.

www.nodrama.io (tls-sni-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization ::

Incorrect validation certificate for tls-sni-01 challenge.

Requested 1d2e60bbb911a0fa373af1c71068a98f.df68ccc953b03b03cbca639fa7b20469.acme.invalid from [2600:1f16:14a:7b00:e9ba:752c:feb8:49d5]:443.

Received 1 certificate(s), first certificate had names "5de1f81c71783962782726ac76156d00.51706d503a8be636f033680ff5a1664e.acme.invalid, dummy". Skipping.

```

If I remove the 443 over ipv6 from the nginx server configuration then the challenge goes through, cert is renewed. Bring it back and after that the content is availiable on ipv6 over https:

```
Connected to nodrama.io (2600:1f16:14a:7b00:e9ba:752c:feb8:49d5) port 443 (#0)
* found 592 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* server certificate verification OK

```

# Answer
> 1 votes
Changed the challenge from tls-sni to:

> --preferred-challenges http

and the certificates are renewed.

---
Tags: ssl, nginx, certbot
---


# Question
Title: Jenkins hangs on Windows CMD build that has GUI
I am attempting to automate imports and exports of Oracle's PeopleSoft Application Designer. It is a GUI program but it can operate in the windows command line for certain tasks. This project has examples of how it is used in the command line.

The problem is that despite having parameters to hide the GUI, splash screen and to auto-quit, it is hanging when run in Jenkins. My suspicion is that despite hiding all graphics, the Windows Desktop Window Manager (or something) is still being called and Jenkins has no way to deal with that. I think this because when I execute the command, my CMD window loses focus.

I have tried both with "Execute windows batch command" and with Git Bash, "Execute Shell" and calling cmd.exe.

When I run this in the actual git bash window without hiding the GUI, the GUI still pops up, so the Git Bah program doesn't have the same issue.

**How can I either suppress all GUI in a windows command OR give the program somewhere to put these invisible windows?**

Alternatively, if I am way off base with this assumption that GUI is the problem, how can I troubleshoot?

The command I am using in bash:

`cmd.exe /c "PSIDE.EXE -HIDE -SS NO -SN NO -PJTF TEST_PROJECT_NAME -FP C:\export -CT ORACLE -CD $PS_PROJ_DB -CO $PS_PROJ_USER -CP $PS_PROJ_PASS -QUIT"`

Jenkins is installed directly on the Windows machine where the command is running.

# Answer
My current, less ideal solution to this is to run Jenkins in a terminal logged in to a desktop rather than as a service. I'd rather not have to do that but it has solved the problem entirely.
> 1 votes

---
Tags: jenkins, windows, bash
---


title: Terraform: Delay the MySQL Provider

text:
# Question
Title: Terraform: Delay the MySQL Provider
I have a Terraform project which uses the MySQL provider. Because of the way Terraform works, the MySQL provider will fail to load correctly because the AWS\_RDS instance doesn't exist. Is there a way for me to delay or split my project so that the MySQL provider doesn't load during the main "apply"?

I've examined workspaces, and I see that you can use a count to trigger a resource to load or not load based off of the workspace name. But that didn't work anyway I thought.

I've also seen this issue mentioned on the Hashicorp GitHub, but on one seems to be offering a workaround

Any help is greatly appreciated.

Here is a snippet of my data-storage configuration thus far:

```
resource "aws_db_subnet_group" "default" {
  name       = "${var.database_subnet_group_name}"
  subnet_ids = ["${var.database_subnets}"]

  tags {
    Name = "${var.database_subnet_group_name}"
  }
}

resource "aws_rds_cluster_instance" "cluster_instances" {
  count              = 1
  identifier         = "app-aurora-cluster-${count.index}"
  cluster_identifier = "${aws_rds_cluster.some_cluster.id}"
  instance_class     = "db.t2.medium"
  db_subnet_group_name = "${var.database_subnet_group_name}"
  publicly_accessible = true
}

resource "aws_rds_cluster" "some_cluster" {
  cluster_identifier = "app-aurora-cluster"
  availability_zones = ["${var.database_azs}"]
  database_name      = "${var.database_name}"
  db_subnet_group_name = "${var.database_subnet_group_name}"
  master_username    = "auroradmin"
  master_password    = "%XwPn}gU6sX<y8Wx"
  skip_final_snapshot =  true
  vpc_security_group_ids = ["${var.database_security_groups}"]
}
/*
# This has to be commented out during the first pass
# because Terraform will try to connect to the
# MySQL Aurora server to refresh the state even
# though it currently doesn't exist.
# Configure the MySQL provider
provider "mysql" {

  endpoint = "${aws_rds_cluster.some_cluster.endpoint}"
  username = "auroradmin"
  password = "%XwPn}gU6sX<y8Wx"
}

```

# Answer
I think you could achieve something similar by first running Terraform against your RDS resources, and then running Terraform again on all resources.

On your first pass, you can use `-target` option to target only a subset of the resources. (ie. RDS resources).

Be aware that using this option is not recommended in Terraform docs. If I were you, I would use it for time being and change it as soon as one of these issues below is solved: https://github.com/hashicorp/terraform/issues/10462 https://github.com/hashicorp/terraform/issues/2430 https://github.com/hashicorp/terraform/issues/4149

For details on how to use `-target` and its caveats, see: https://www.terraform.io/docs/commands/plan.html#resource-targeting
> 1 votes

---
Tags: terraform, mysql, terraform-module, terraform-workspace
---


# Question
Title: Terraform: ignore_changes conditionally? (temporary EC2 instance public IP address)
I've got a couple of EC2 instances managed by Terraform, with public IP addresses in a VPC.

With each Terraform run, I'm updating DNS records based on those public IPs.

I don't need these instances on all the time though, and when I shut them down, they of course lose their public IP address.

At first this was causing `associate_public_ip_address` to become `false`, and Terraform wanted to recreate the instances. `lifecycle.ignore_changes` solves this:

```
resource "aws_instance" "instance1" {
  associate_public_ip_address = true
  ...

  lifecycle {
    ignore_changes = ["associate_public_ip_address"]
  }
}

resource "cloudflare_record" "record1" {
  domain = "example.com"
  name   = "server1.example.com"
  value  = "${aws_instance.instance1.public_ip}"
  type   = "A"
}

```

But... the `public_ip` attribute also becomes blank ;). This causes an attempted update to the A record, which fails because you can't set a blank record.

So, I'm trying to work out a solution. I could use elastic IPs, which I might end up resorting to, but I'd ideally like to avoid that if I can. My next thought was... is there any way I could use `ignore_changes` conditionally, and thus ignore changes to the DNS record's `value` if it is blank?

Are there any other solutions you can recommend?

# Answer
> 1 votes
Maybe you could use "count" attribute for this?

```
resource "cloudflare_record" "record1" {
    count = ${aws_instance.instance1.public_ip == "" ? 0 : 1}"
    ...
}

```

---
Tags: amazon-ec2, terraform
---


# Question
Title: How to create AWS application load balancer using saltstack
I was trying to create application load balancer with salt stack. I am using salt boto\_elbv2 which is having option to create target groups but dont have option to create load balancer, how can i achieve it ?

# Answer
> 1 votes
Please follow official doc to create LB

Please create a IAM role or mentioned secret and access key as below

```
elb.keyid: HHTYHLSHDJFJFJFJFJFJFFSVJS
elb.key: basjbsdfbdsfdsjfbkgbsfbdsjfbfdgdfgdfs

```

Then Create config for ELB

```
Ensure myelb ELB exists:
    boto_elb.present:
        - name: myelb
        - region: us-east-1
        - availability_zones:
            - us-east-1a
            - us-east-1c
            - us-east-1d
        - keyid: GKTADJGHEIQSXMKKRBJ08H
        - key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
        - listeners:
            - elb_port: 443
              instance_port: 80
              elb_protocol: HTTPS
              instance_protocol: HTTP
              certificate: 'arn:aws:iam::1111111:server-certificate/mycert'
              policies:
                  - my-ssl-policy
                  - cookie-policy
            - elb_port: 8210
              instance_port: 8210
              elb_protocol: TCP
        - backends:
            - instance_port: 80
              policies:
                  - enable-proxy-protocol
        - health_check:
            target: 'HTTP:80/'
        - attributes:
            cross_zone_load_balancing:
              enabled: true
            access_log:
              enabled: true
              s3_bucket_name: 'mybucket'
              s3_bucket_prefix: 'my-logs'
              emit_interval: 5
            connecting_settings:
              idle_timeout: 60
        - cnames:
            - name: mycname.example.com.
              zone: example.com.
              ttl: 60
            - name: myothercname.example.com.
              zone: example.com.
        - security_groups:
            - my-security-group
        - policies:
            - policy_name: my-ssl-policy
              policy_type: SSLNegotiationPolicyType
              policy:
                Protocol-TLSv1.2: true
                Protocol-SSLv3: false
                Server-Defined-Cipher-Order: true
                ECDHE-ECDSA-AES128-GCM-SHA256: true
            - policy_name: cookie-policy
              policy_type: LBCookieStickinessPolicyType
              policy: {}  # no policy means this is a session cookie
            - policy_name: enable-proxy-protocol
              policy_type: ProxyProtocolPolicyType
              policy:
                ProxyProtocol: true

# Using a profile from pillars
Ensure myelb ELB exists:
    boto_elb.present:
        - name: myelb
        - region: us-east-1
        - profile: myelbprofile

# Passing in a profile
Ensure myelb ELB exists:
    boto_elb.present:
        - name: myelb
        - region: us-east-1
        - profile:
            keyid: GKTADJGHEIQSXMKKRBJ08H
            key: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs

```

Register instance with ELB. **salt.states.boto\_elb.register\_instances(name, instances, region=None, key=None, keyid=None, profile=None)**

```
add-instances:
  boto_elb.register_instances:
    - name: myloadbalancer
    - instances:
      - instance-id1
      - instance-id2

```

You may find this blog post useful also.

---
Tags: amazon-web-services, salt
---


# Question
Title: Internal network between container Docker Compose with outgoing connection
I am a newbie to Docker. I am trying to run my application containing from multiple containers

Here is my **docker-compose.yml** file

```
version: '3.3'
services:
  php-service:
    container_name: 'php-service'
    build: './php-service'
    networks:
      - backend
    ports:
      - '8666:8666'
  go-service:
    container_name: 'go-service'
    build: './go-service'
    ports:
      - '8825:8825'
      - '8835:8835'
    volumes:
      - './go-service:/go/src/go-service'
    networks:
      - frontend
      - backend
    depends_on:
      - 'mongo'
      - 'consul'
  consul:
    image: 'consul:latest'
    networks:
      - backend
    ports:
      - "8300:8300"
      - "8400:8400"
      - "8500:8500"
      - "8600:53/udp"
  mongo:
    image: 'mongo:latest'
    container_name: 'mongo'
    networks:
      - backend
    ports:
      - '27100:27017'

networks:
  frontend:
    internal: false
  backend:
    internal: true

```

What I want to achieve.

The Outside World - is a network space of a hosting machine where the Docker daemon is running.

1. Go-Service, PHP-Service, Consul and Mongo Db communicate over internal network not exposed to the outer world. Let's call this network **backend**.
2. I want services inside **backend** network to be able to send outgoing requests to outer world
3. Another network is for the outside world, I need to expose only specific ports. In my case I want to expose 8825 and 8835 only. So that ports will be exposed as **localhost:8825** and **localhost:8835** on the hosting machine

Is it possible to get the desired configuration?

Or maybe I am doing something wrong, please suggest any other good way to achieve this.

Thank you so much

# Answer
> 8 votes
Internal Docker networks mean there is no gateway configured to reach the outside internet, you can only reach other containers from that network. In your scenario, none of your networks should have this definition.

Without setting the internal network flag, containers can reach out of the docker host, potentially to the internet if the host has that access. This is one-way access, containers can access the external network, but that external network cannot access the containers.

To access a container from outside of the Docker host, you need to publish the port on the host mapping into the desired container (or service). Publishing ports with the `ports` section in the `docker-compose.yml` file is only needed to provide external access, not access between containers. Applications inside containers need to listen on all interfaces (0.0.0.0) for both publishing ports on the host and for container to container communication. However, you can publish ports on a specific interface on the host, e.g.:

```
ports:
  - '127.0.0.1:8825:8825'
  - '127.0.0.1:8835:8835'

```

For container to container communication, it is not necessary to expose or publish the port. All that is needed is a user defined network (which you have) in common between the containers. Then the containers can communicate using Docker's built-in DNS to resolve the service name (e.g. consul and mongo) and the application port inside that container (e.g. consul:8300). To avoid the external network from accessing these containers, do not publish any ports from them.

Side note: from your `docker-compose.yml`, you should also consider removing `container_name`, `depends_on`, and `build` since they won't work if you try to transition to swarm mode.

---
Tags: docker, docker-compose, networking
---


# Question
Title: How do you know which secrets and credentials of your production services were used, and by whom/what?
The context of the question is Secrets management.

As the title says, how do you know which secrets and credentials of your production services were used, and by whom/what?

# Answer
> 1 votes
The short answer: you would need to use a secret management system that provides 'audit logs'.

There are many options for handling secrets out there, but unless the tool you use has audit logging, you'll never truly know for sure what credential was used where.

I see you mentioned using Hashicorp's Vault. That's a really good one. They have audit logging built in; they call it 'Audit Devices', which can be enabled with a simple command.

Again, there are many perfectly valid options for *handling* secrets: Chef vault, 1password, environment variables injected by your build instances, home-grown solution using encrypted files stored on object storage, etc.... However, unless the system specifically says it provides audit logging, you'll never truly know what was used when and where.

You can design a secrets system with the best intentions, and make many rules that employees have to follow in regards to have the secrets are accessed, but for auditing purposes, you want to know *where* the rules have been broken. If you have a firm requirement to always know when and where secrets where used, I recommend you stick with something like Hashicorp Vault, turn on Audit Devices, and then ship the log somewhere for storage or processing.

# Answer
> 0 votes
Totally stack dependent but as mentioned HashiCorp Vault will provide audit logs, and the other I am familiar with is AWS Parameter Store and Secrets Manager which will provide logs to CloudTrail. The AWS approach is a great one for those already using AWS and looking for an easy barrier to entry. Vault is more powerful but with that comes more complexity to install, run, and maintain (the open-source version at least.. enterprise is awesome but pricey last time a company i work for inquired). The worst thing you can do in my opinion is try to write your own tool for this. Whatever tool you decide on, or if you try to write it, logging is an absolute must

---
Tags: amazon-web-services, security, microservices, encryption
---


# Question
Title: Re-initialize etcd-cluster completely (on coreos)
Over the past updates (espcially the update to `etcd-wrapper`: https://github.com/coreos/coreos-overlay/tree/master/app-admin/etcd-wrapper) my etcd-cluster with five machines broke. Now I'm trying to recover from that.

Currently I only use it for the `etcd-lock` while updating the machines. So there is basically no important information in there (yet).

I tried a lot of stuff and since, in my opinion, the documentation is not that structured, I mixed a lot of infos form different parts together. Currently I'm in a state, where one node wants to elect a leader with another node. But that other node *thinks* it is part of another cluster. And I cannot do anything on the first one anymore. `etcdctl` just revokes all actions with the info, that the cluster is not healthy...

So I want to do a fresh start again!

Could someone point me to some part of the documentation, that explains that? It seems, that the *disaster recovery* part (https://coreos.com/etcd/docs/latest/op-guide/recovery.html), that allegedly contained the info, has changed (and is also depreacted).

Additionally it would be really helpful, if someone could point me to the part of the docu, that explains how to setup a `etcd-cluster` without re-installing the whole system.

Thanks in advance!

PS: I would have gladly selected some better tags (like `coreos`, `etcd`, `etcd-cluster`), but I am not allowed to create them now :)

# Answer
I managed to fix it. First I disabled and deleted all `etcd2`-related units. Then I created a new dropin to the `etcd-member.service` with the following content:

```
[Service]
Environment="ETCD_OPTS=--name cluster00 \
  --discovery https://discovery.etcd.io/<MY_ID> \
  --listen-client-urls http://<NODE_IP>:2379,http://127.0.0.1:2379 \
  --listen-peer-urls http://<NODE_IP>:2380 \
  --advertise-client-urls http://<NODE_IP>:2379 \
  --initial-advertise-peer-urls http://<NODE_IP>:2380"

```

I generated a new discovery id for the cluster.

Then I teared down the old cluster completely, by deleting all content of `/var/lib/etcd/*` and the directory `/var/lib/etcd2` completely and (re-)started the etcd-member service.

Be aware, that I don't have ssl enabled at this point!
> 0 votes

---
Tags: linux, servers
---


# Question
Title: Pros and cons of different deploy strategies
I am not sure about the best way to deploy my program.
Lets assume i have two relevant branches release(tested and ready to deploy code) and master.
I have two options

1.Merge the release to master and deploy master to production.
2.Deploy release to production and then merge to master.

Which strategy you use and why.

# Answer
> 4 votes
Assuming there are no changes in Master that are not in your release branch and you don't rebuild after you merge the code then you could deploy first and then merge to master. If either of those are not true, then merging first would be more common.

The process depends on how you handle your branching strategy. If other things could be merged into master that are not part of the release branch then you need to merge first and rerun the pipeline of tests. If master represents production and all new work is now in the release branch then yes, you can deploy then push, or do them as a step in the pipeline assuming the deploy is successful then do the merge.

---
Tags: continuous-integration, deployment, git, continuous-deployment, workflow
---


# Question
Title: Get all change logs of since last successful build in Jenkins Pipeline
In my Jenkins pipeline, I can get change logs of the current build by this.

```
def changeLogSets = currentBuild.changeSets

```

Is there a way to get all change-logs since last successful build?

# Answer
You may try something like this:

```
node('my_kubernetes_pod') {
    passedBuilds = []

    lastSuccessfulBuild(passedBuilds, currentBuild);

    def changeLog = getChangeLog(passedBuilds)
    echo "changeLog ${changeLog}"
}

def lastSuccessfulBuild(passedBuilds, build) {
    if ((build != null) && (build.result != 'SUCCESS')) {
        passedBuilds.add(build)
        lastSuccessfulBuild(passedBuilds, build.getPreviousBuild())
    }
}

@NonCPS
def getChangeLog(passedBuilds) {
    def log = ""
    for (int x = 0; x < passedBuilds.size(); x++) {
        def currentBuild = passedBuilds[x];
        def changeLogSets = currentBuild.rawBuild.changeSets
        for (int i = 0; i < changeLogSets.size(); i++) {
            def entries = changeLogSets[i].items
            for (int j = 0; j < entries.length; j++) {
                def entry = entries[j]
                log += "* ${entry.msg} by ${entry.author} \n"
            }
        }
    }
    return log;
}

```

Additionally, you may try out "Changes Since Last Success Plugin": https://wiki.jenkins.io/display/JENKINS/Changes+Since+Last+Success+Plugin

But it will not work together with pipeline, this is a separate approach.
> 12 votes

# Answer
As I found may be this will helps you. With this you can fetch latest successful build change log file of any project build with Jenkins.

```
$DirectoryA = "D:\Jenkins\jobs\projectName\builds"  ####Jenkind directory
$firstfolder = Get-ChildItem -Path $DirectoryA | Where-Object {$_.PSIsContainer} | Sort-Object LastWriteTime -Descending | Select-Object -First 1
$DirectoryB = $DirectoryA + "\" + $firstfolder

$sVnLoGfIle = $DirectoryB + "\" + "changelog.xml"

write-host $sVnLoGfIle

```
> 2 votes

---
Tags: jenkins, jenkins-pipeline
---


# Question
Title: Why does amazon charge for free tier usage?
I have an issue with amazon free tier account, I have deployed two EC2 instances (1 linux and 1 windows) on amazon each having 30GB of storage which is permissible under free tier, these instances are continuously running 24/7 so that they are always available,what I don't understand is that starting last month I have had charges to my account for exceeding cloud storage usage that have left me confused.

I have read details on Free Tier more than 5 times but I still can't understand what I'm doing wrong, checked the Cost Explorer, the only thing that comes to mind is perhaps the 30GB is applied universally for all instances but I am not sure as I don't know how my account usage is calculated. I have tried contacting support assistant but I am yet to receive any response from them.

I would really appreciate if someone helped set some things straight because I have hit a wall with this one.

# Answer
My free tier account uses 30ish GB for in a VM, and I am getting a warning that I am approaching the GB limit (which I am), since day one.

For me, although I'm not a native speaker, the description ...

```
STORAGE & CONTENT DELIVERY
Amazon Elastic Block Storage
30 GB

any combination of General Purpose (SSD) or Magnetic

Persistent, durable, low-latency block-level storage volumes for EC2
instances

```

...also seems pretty straightforward: 30 GB for your volumes for your instances. Summed up, not "per".
> 1 votes

# Answer
There is no EC2 under always free tier, only under 12 months free tier.
> 1 votes

---
Tags: amazon-web-services, amazon-ec2, billing
---


# Question
Title: Jenkins Pipeline job - remember previous values
I have a Jenkins Pipeline which uses Terraform and create a compute environment in GCP. There are like 5 questions in the build i.e.

```
1) GCP Project Name
2) Number of RHEL Servers
3) RHEL Server names
4) Number of CentOS Servers
5) CentOS Server names

```

This is a standard build job and users cannot build servers if not using this build.

The problem is that when a user comes back to request more servers, they have to fill up all the details again. They have to remember all the values they passed previously.

So the questions is: How do I make this user friendly without creating a separate build job for each GCP project and hard coding the values.

# Answer
Depending on how long you keep builds for, the Rebuild option in the left hand sidebar will allow you rebuild a previous run of the job with the parameters intact.

Simply find a previous build of the job that that particular user kicked off last time, click into it, then choose Rebuild from the sidebar.

Again this will only work if Jenkins keeps enough builds. We save two weeks for a particular job and I have a coworker who saves a link directly to x build of the job, then once he rebuilds updates his link to the new one, etc. This way he can just open the link he has saved, click Rebuild, and he's good to go as long as he's inside that two week window.

I believe you can even choose to `Keep this build forever` for a couple of your "template" builds, making them more easily accessible.
> 2 votes

---
Tags: jenkins, jenkins-pipeline, terraform
---


# Question
Title: AWS: Application vs Classic Load Balancer
My senario is this:

I am using 2 EC2 instances which I want reachable via urls as follows:

```
sub1.domain.com
sub2.domain.com

```

I am aware of the fact that AWS Application Load Balancers currently support host based routing so I guess this is now feasible.

Currently I am using 2 **Classic** Load Balancers on AWS to support access to those instances;

Is there a reason for me to switch to the host-based routing scenario of ALBs?

Perhaps the motive for this question is silly, but lately Amazon in its console, has grayed out the Classic ELB and marked it as

> Previous Generation

(I guess this wouldn't be a strong motive but it kind of discourages you a bit from using Classic ELBs henceforth...)

P.S. Haven't got the chance to test it, but I assume if I have issued an AWS wildcard certificate for `*.domain.com`, this would cover all target groups (i.e. hosts) under the ALB, right?

# Answer
> 3 votes
1) you are using **2** classic ELBs instead of **1** ALB so costs savings can be a factor

2) using a layer7 loadbalancer vs a layer4 gives many features and capabilities not possible otherwise

you can see a comparrison here: https://aws.amazon.com/elasticloadbalancing/details/#compare

3) yes that wildcard would fit all your needs (sub1/sub2.domain.com)

---
Tags: amazon-web-services, amazon-ec2, load-balance
---


# Question
Title: I have an custom AMI and want to run certain config commands at initial boot, depending on the autoscale instance that starts it. How do I do this?
I have a custom AMI that contains the dependencies for several applications.

The only difference between the applications is several configuration options that can be configured by a bash script. (i.e. enabling/disabling certain supervisor groups.)

Each different app is triggered by an different autoscale instance.

How do I get the instance to run a different script on boot by an autoscaler?

# Answer
If I am understanding you correctly, you have one AMI used in several autoscaling groups and want to run a specific “bootstrap” sequence on it depending on the autoscaling group it belongs to.

This is not difficult to accomplish because the launch configuration you created to map the autoscaling group to the AMI can accomodate user data which can be a shell script.

In the shell script provided as user data, it is customary to retrieve meta data so that the instances can correctly identify itself in logs and arrange other similar last minute details. This meta-data could also contain a reference to the auto-scaling group, which you could take advantage of to reduce the little overhead due to autoscaling-group management.
> 4 votes

---
Tags: amazon-web-services, amazon-ec2, autoscaling
---


title: Jenkins Node Image at Kubernetes Plugin

text:
# Question
Title: Jenkins Node Image at Kubernetes Plugin
I'm working on huge pipeline with different development environment (python, node, java). For manage this CI pipeline our teams using Jenkins at Kubernetes environment.

I want to give PipeLine node annotation at Groovy Script show as below .

```
 node("test-py") {
   sh "python -m -v py.test TEST_FILE.py "
 }

```

How I can create pod with image , with Jenkins Kubernetes Plugin .

# Answer
Have a look at the documentation presented here:

https://github.com/jenkinsci/kubernetes-plugin

You need to specify a Kubernetes pod in your pipeline. An example of your use case would look similar to this for a single python container. You'll notice that containers: \[\] expects an array so you can include additional containers.

```
def label = "mypod-${UUID.randomUUID().toString()}"

podTemplate(label: label, containers: [
    containerTemplate(name: 'python', image: 'python:3.7-alpine', ttyEnabled: true, command: 'cat'),
]) {
    node(label) {
        stage('Get a Python project') {
            git 'https://github.com/oğuz/project.git'
            container('python') {
                stage('Test a Python project') {
                    sh "python -m -v py.test TEST_FILE.py "
                }
            }
        }
    }
}

```
> 0 votes

---
Tags: jenkins, continuous-integration, kubernetes, python
---


title: VSTS deployment variable

text:
# Question
Title: VSTS deployment variable
So I'm automating a process we currently have where we deploy a database and then have an exe that 'activates' the database. The default values are different for each product and is determined by a cmd line arg.

I've created 3 VSTS Release environments based on the hardware IO board for the environment. How can I pass in this product flag at deploy time as it isn't dependent on the environment or release itself.

Edit: The product flag value isn't known until the database is deployed into an environment, and value can not be set in the release definition creation time or at release time. Only when deployed into a particular environemnt

# Answer
Closing this issue as we were able to modify the process with the teams involved to be able to define the variable when the release is created.

Our answer is to modify the existing process and accompanying software to remove this need

Edit: To clairify the software that activated the database was re-written to allow CLI variables to be passed, which can be set for each environment.
> 0 votes

# Answer
While you can use the Release Description field the moment you Start a Release

which fills in the `$(Release.ReleaseDescription)` variable, I discourage this approach.

The whole point of a Release Pipeline is to automate and having users inputting data is against this approach. If you do not trust VSTS for Secrets, you can store them in Azure KeyVault or similar and pull them down while releasing. It is not a chance that there are Tasks to facilitate this.
> 0 votes

---
Tags: deployment, azure-devops
---


# Question
Title: Can a cross platform app be run as a container on both Linux and windows hosts?
I have read (and seen several online videos) that Linux containers can’t be run on windows and visa versa. It is my understanding that this is due to the fact that the container doesn’t contain a kernel and therefore it relies on the host kernel.

But if I have a simple app like a python hello world, what prevents this from running on both operating systems?

# Answer
> 1 votes
> But if I have a simple app like a python hello world, what prevents this from running on both operating systems?

It won't work in the same way that copying `/usr/bin/python` from a Linux machine to a Windows machine and using it to run your application doesn't work.

Docker isn't running the hello world script, it's running Python, which needs to be compiled for specific operating systems and architectures.

# Answer
> 0 votes
You can run your Docker containers on all major platforms, but Docker on Windows and Mac runs your containers on a Linux VM.

It takes care of mapping volumes, ports etc. from your host machine to containers, so mostly you don't have to think about the VM layer. But you still have configure limits of VM resources (RAM, CPU etc.) and there might be adverse effects on performance.

I don't think you can run Linux-based Docker containers on a Windows machine directly without a VM (not taking WSL into account) as even a simple "hello world" app would use a Linux base image with Linux binaries, which cannot be run on a Windows machine without some kind of emulation or virtualization.

See: https://docs.docker.com/docker-for-windows

---
Tags: docker, containers
---


title: DirectAdmin 2 users same folder

text:
# Question
Title: DirectAdmin 2 users same folder
So I'm still a rookie in devops but I am looking for a way where we can link a folder from user1 to a folder from user2.

I guess its sort of a symbolic link? How would you do something like that? Or what is the best solution to do this? Ca

# Answer
> 0 votes
You cannot create hardlinks to directories. So, Yes, you can create symbolic links `ln -s <Target> <Link>` however, please keep in mind the access permissions.

---
Tags: linux
---


# Question
Title: Is Azure's B-2 app service plan better than a S-1 for production environments?
When using Azure's WebApps to run C# MVC based applications on production environments, I'm always wondering about when to use the B-2 (Basic-2 with 2-cores and 3.5 GB) and when to use S-1 (Standard-1 with 1-core and 1.75GB).

It sure sounds like the B-2 would result in better performance, still all official recommendations for production use is to run it on S-1 or above. Maybe there's some CPU throttling on B-\* plans? Or other 'bottle-neck' that I'm not aware?

Or should I be better off just using the B-2 for production (over a S-1)?

# Answer
The B-series has this name from *burstable* adjective.

It means that you do not have 100% of the cores for 100% of the time (see Introducing B-Series, our new burstable VM size). For example B-2 you have guaranteed only 40% out of a potential 200%.

The suggestion to pick a different serie for production workload, is to guarantee the CPU available.
> 2 votes

---
Tags: azure
---


# Question
Title: Docker hostnames are not resolved in a custom network
I have the following configuration in my `docker-composer.yml` file.

```
version: '3.3'
services:
  service-1:
    container_name: 'service-1'
    build: './service-1'
    depends_on:
      - 'mongo'
      - 'consul'
    networks:
      backend:
        aliases:
          - service-1
  service-2:
    build: './service-2'
    ports:
      - '8825:8825'
      - '8835:8835'
    networks:
      frontend:
      backend:
        aliases:
          - service-2
    depends_on:
      - 'mongo'
      - 'consul'
  consul:
    image: 'consul:latest'
    networks:
      backend:
        aliases:
          - consul
  mongo:
    image: 'mongo:latest'
    networks:
      backend:
        aliases:
          - mongo

networks:
  frontend:
  backend:
    internal: true

```

When my containers start they are not able to communicate between each other using host names. Most of containers use the mongo db container, but they are not able even reach it and I am getting the following error.

```
Error connecting to mongo : no reachable servers

```

Please help me to solve the problem, I got stuck.

Thanks.

# Answer
You've got a lot of unneeded settings in the compose file, here's a stripped down version that would work just as well:

```
version: '3.3'
services:
  service-1:
    build: './service-1'
    networks:
      - backend
  service-2:
    build: './service-2'
    ports:
      - '8825:8825'
      - '8835:8835'
    networks:
      - frontend
      - backend
  consul:
    image: 'consul:latest'
    networks:
      - backend
  mongo:
    image: 'mongo:latest'
    networks:
      - backend

networks:
  frontend:
  backend:
    internal: true

```

You automatically get the alias of the service name for each container, no need to duplicate that. You also lose the ability to scale a service if you give it a container name. I'd also recommend moving the build step out of the compose file and use an image name for the apps you're building locally.

---

Now for the likely issue, you have a depends\_on in your compose file. At best, this will not do what you're looking for. All it checks that the other container has been created and started, but not that the application inside is ready to serve traffic, and a DB may take time to become available. At worst, you'll get an error that it's unsupported if you try to move this into swarm mode.

Instead of depending on docker for this, update your application entrypoint to check for the external dependencies and wait a minute or two for them to become available before failing. A very simple example tool for this is wait-for-it that is written as a bash shell script.
> 1 votes

---
Tags: docker, docker-compose, dockerfile, networking
---


# Question
Title: In a Database Per Service model - should i include the database in the service container?
I am implementing a simple setup with two micro services and would like each of them to have their own DB - each service is running in it's own container. Should i include the DB's in each service container (so each container will contain the service application + DB with a total of two containers), or should i create a new container for each DB (with a total or four containers)?. Given the fact that each DB is used only by one service, it seems cleaner to encapsulate the Service+DB in a single container which will be the overall service. On the other hand - deploying a DB as a container is much simpler and faster than combining it with the application container.

# Answer
> 3 votes
Keep the DB containers separate. The concept of microservices and containers is to allow each part to be independently updated without introducing changes and outages to the rest of the application stack. Containers should also be running a single app per container to allow error detection and log gathering from that application. Each container is simply an isolated process, so unlike a VM, there's little overhead on the host to split each of these out.

---
Tags: docker, containers, microservices, databases
---


# Question
Title: Suggestions to improve knowledge on docker
I am new to Docker and tried some hands-on (not deeper learned upto basics of image,container) by following docker official documentation.

To take my learning curve to next level, I have implemented what I read by taking sample applications like "Dockerising a Node.js and MongoDB App by nida sajid", run a sample java restful webapplication which takes name and email and storing it into mysql container. I've done this by using 2 containers:

1. tomcat - Used to deploy war file
2. mysql - To store the data(name&email))

My question: what are the advanced concepts that I can learn and, can you suggest me so that I can improve my knowledge

1. What are the advanced concepts in docker other than this (like used in real world scenario)?
2. Any suggestions (like websites,videos) to improve my knowledge?
3. How to use Docker with Jenkins?

# Answer
> 5 votes
Some good next topics for the real world are...

* Security. There are several security concerns with docker, for example
    + Is there a problem running stuff inside the container as `root`?
    + Is there a problem giving non-`root` users on the host access to the docker daemon?
    + Is there a problem with the docker daemon running as `root` on the host?
    + All three can be solved with docker out-of-the-box. Learn how to.
* Networking. Check out the docker networking options.
* Image sizes are a recurring problem, especially if you build your stuff inside a docker image. Your average naive first build image may be 1GB or more - try to get the same image, whatever it is, to 500, 300 or 200 MB.
* Docker volumes; how to get configuration into your containers; etc.
* Private artifact repositories.
* Explore the environment: docker compose, docker swarm, etc.
* Finally, take a big leap on to your next technology... OpenShift? Kubernetes?

# Answer
> 3 votes
First one which docker recommends, Play with docker classroom which is inspired by the Docker Playground where you can create five instance to play around docker and docker swarm for four hours all for $0 cost. Credits to Docker Captain – **Marcos Nils** & **Jonathan Leibuisky** for building this amazing tool for Docker Community. You can start with the beginner level and complete the advanced level to get the good glimpse of docker and how you can think of using it for your infrastructure with the help of these interactive tutorials.

There is best paid training and consultation on the Docker, Kubernetes, Advanced Linux , Linux Kernel etc. technologies by, CloudYouga Trainings. I have done a course from them and it is amazing with complete in-depth details of the concept. And, they are planning to add more course in their portfolio related to DevOps.

For introductory course in devops, Intro to DevOps by Udacity to understand the terminology and architecuter to address the problems.

This Udemy course Docker Technologies for DevOps and Developers - Udemy is good to understand the docker terminology and Devops skills to apply the right workflow and better deployment. Another course Docker for Professionals: The Practical Guide - Udemy

**Learn new technologies right in your browser by** Katacoda - Interactive Learning Platform for Software Engineers is one of the best interactive tutorial for docker and its related technologies. This is personally my favourite because I could test my deployment and then go and catch for the pros and cons of the system. Wonderful idea. And, the best part is you could write your own interactive tutorial using Katacoda Teach which they called scenario using this platform.

“Ship your Apps with Confidence” by Codeship is a Continuous Integration Platform in the cloud. They have tag line **Building for the builders** which states everything and this is one of the best platform for CI/CD and parallel deployment. You could test and run your CI/CD pipeline using docker, kubernetes, etc. **(Note: Last week Codeship is acquired by the CloudBees)**

Stay up to date with everything about docker by another Docker captain, **Ajeet Singh Raina**, Docker Captain Blog which teach you about docker on raspberry pi, IoT devices, LinuxKit, InfraKit, docker on aws, azure, digital ocean, etc. etc. **Collabnix** is conglomerate of open collaboration & LINUX. Lot of enthusiasm and energy, tips and tricks and perfect guide to IT infrastructure, system management, integration and automation, etc.

Some other useful links and tutorials for docker:

1. Docker curriculum - Docker for Beginners
2. Container Tutorials
3. Docker Tutorials and Labs docker/labs **(Most Recommended)**
4. Training modules from EMC {code} codedellemc/training
5. **Awesome Docker** at veggiemonk/awesome-docker

Hope this helps. Thank you.

# Answer
> 1 votes
Welcome to the Docker world :-)

* Advanced concepts - try Docker Swarm to run and scale a distrubuted system.
* This community, local Docker user groups, moby GitHub, Slack channels
* You can use Jenkins or any other CI tool for the next level of integration, "source to image" aka "image bakery"

# Answer
> 1 votes
I'll seriously recommend you katacoda.com to explore almost any advanced topic on Docker that you're interested in. The topics aren't limited to docker, they cover almost any cloud technology. They are interactive and some are really advanced, so you can try a topic, get a feeling and if you liked it, go deep on it.

# Answer
> 0 votes
Basically you need to build intuition into :

* how to distinguish between host, docker daemon, and docker instance
* how to share ports, volumes
* create docker files

I have written a tutorial on that here :

http://javagoogleappspot.blogspot.com/2018/07/docker-basics.html

---
Tags: docker
---


# Question
Title: Is running load balanced autoscale apps cheaper on AWS Kubernetes than just using EC2 resources?
We're running like 100+ servers on AWS EC2 with like 20 microservices all load balanced and autoscaled with 2 to 3 instances.

The cost has become....very significant.

I'm wondering if migrating these to Kubernetes or ECS would be cheaper?

# Answer
From your comment I assume a cpu load under 5% in average considering all instances together.

Each of your actual instance can be a pod on a kubernetes node, using quite larger instances you can reduce to a dozen of m3 or m4 machines with a single (or two) load balancer in front for the same quality of service.

You'll have machines used at 70% (ideally) and using an autoscaling group with a scaling policy to take care of spinning up a new node in case of burst.

The main idea is that you should be able to host on fewer machines with a better average load and thus reduce your cost, the first net gain is the reduction in number of load balancers, but this could be debated with Application Load balancers which allow to route by context or host.

Be warned there's a learning curve with kubernetes, but according to your description this sounds the perfect use case.

Beware of the 'all in k8s' trap, some things are better handled out of kubernetes, like large database systems or CPU/memory intensive task as they disrupt the load repartition and brings some more complexity. I.e: keep both possibilities, k8S and usual ASG/instances based hosting.
> 2 votes

---
Tags: amazon-web-services, kubernetes, amazon-ec2, amazon-ecs
---


# Question
Title: How to automatically publish git releases/comments to the site?
Sorry if title isn't correct. I'm trying to figure out what to search for on this matter.

I'm looking for the easiest way to automatically have my semantic versioning and commits visible on my site when commits / releases happen.

I recently started using Git, GitHub, GitFlow, Axosoft, and GitKraken. Are there any options, plugins, or RSS type feeds in those products that do this already or is this something I would have to create using Git webhooks which would call my site and insert into my DB?

I can handle the PHP/MySQL. I'm just looking for recommendations on how to setup the communication between the products I listed above so that I can create a PHP page showing this to my customers...

* \[timestamp\] - RELEASE v2.1.1
* \[timestamp\] - \[axof: 2\] ENHANCED XYZ \[...a sentence or two of details...\]
* \[timestamp\] - RELEASE v2.0.1
* \[timestamp\] - \[axof: 1\] BUG ABC FIXED \[...a sentence or two of details...\]

# Answer
> 1 votes
We did have a similar situation and did try out a few options. Let me suggest them and you can choose if they suit your need.
We had **Jira for User Story** (requirements), **Bitbucket for SCM**, **Jenkins for CI orchestration**, to name a few. Am not going into the other components since they may not be relevant from what I understand based on the description.
So, to start with, Jira would hold our (developer) user stories, and the developers start analysis based on that. Once they are clear, they pull the relevant code base from Bitbucket straight into the IDE (Eclipse) using git plugins, complete the work and push code back into Bitbucket. Two things were needed to be followed *'as part of the comment given during commit'*:

1. The Jira ID for the user story for which the change is being made
2. The actual comments for the change
E.g., **\[JIR-BBA\]:: Code updated to pull correct URL from database.**

Then, in the Jenkins job, we strip down the same into 'JIR-BBA', i.e. Jira ID, and the comment. The Jira ID would then be fed into the Bitbucket plugin which would directly update the corresponding Jira story. And this would also provide a hyperlink in Bitbucket which would directly take you to the job run in Jenkins, thus providing a 2-way communication.
Now the other part in your question, about the status of the build. For this we followed the below steps:

1. Created a Python script that would connect to Jira and can be run from the command prompt. This is easily available if you search for those 2 terms. The script would take in 4 parameters: i. Jira URL, ii. Jira credential, iii. Jira ID, iv. Comments
2. In Jenkins, we called the python script which would connect to Jira using the above credentials, and update the correct Jira task with the comments the developer provided (from the build job) and the job completion status (from SIT Deploy, SIT Test, UAT Deploy, etc.)
3. Now, inside Jira, once you go to the task, you shall find comments being updated for each of the jobs like 'Dev done', 'QA done', etc. depending on how you would want to get it update for each of the Jenkins jobs. That way, you are maintaining a traceability for each of the requirements so that you know which stage each of them are deployed into or test failed.
Thus you do not need to go into Jenkins each time for the status as the latest is already available in Jira.

# Answer
> 0 votes
If we are talking about Continuous Deployment then you need to focus on the following steps:

1. store continuously updated code
2. run quality assessments
3. run security assessments
4. prepare release
5. finish release -\> bump up development version
6. deploy release to customer's environment

You use GitHub to store the code. That's great. All next steps might be covered with Travis CI or other CI available:

* quality & security assessment - separate build step with unit tests, test coverage reports, code quality check or external tool integration such as CoverityScan, XRay etc.
* releases - common functionality in TravisCI as you can see here
* code base versioning - might be covered using additional scripts based on GitFlow
* deployment - if you use Heroku as PHP runtime then deployment from Travis CI would be nice and clean (for others you would probably configure more details)

Good example can be found here but you need to change it in order to support PHP instead of Nodejs. Based on GitFlow btw.

As for the page for your customers with software versions you can use GitHub Pages with Repository Metadata plugin. More info here.

# Answer
> 0 votes
There is a `hub` utility from GitHub which extend your git with extra features and commands. This includes creating the releases on the GitHub.

```
$ hub release --help
usage: git release
   or: git release create [-d] [-p] [-a <ASSETS_FILE>] [-m <MESSAGE>|-f <FILE>] <TAG>
Retrieves releases from GitHub for the project that the "origin" remote points to.

```

---
Tags: git, continuous-deployment, github, php
---


# Question
Title: How do I configure an AWS network load balancer with an A record in Cloudflare
I am trying to use an AWS Network Load Balancer to point at a group of servers. I would then like to take my DNS and point it at the load balancer. However, after I set everything up I cannot find and ip address for the AWS load balancer. I only see a URL value but the A-record in Cloudflare requires an actual IP.

How do I configure the DNS to point at the Load Balancer?

# Answer
> 2 votes
You create a `CNAME` record referencing the assigned hostname of the balancer as the target.

`CNAME` records are not valid at the apex of a zone (i.e. the "naked" domain, without `www` or any other prefix) but Cloudflare allows you to create one there -- sort of -- they actually allow you to *believe* that you're creating one there, and then their service automatically transforms it into one or more valid A-records, dynamically.

This feature is enabled by default at the apex.

https://blog.cloudflare.com/introducing-cname-flattening-rfc-compliant-cnames-at-a-domains-root/

---
Tags: amazon-web-services, load-balance
---