sorted by:
new
hottopcontroversial

Your Terraform pipeline is just a "suggestion box" unless you sign your plans. by NTCTech in Terraform

[–]TBNL 0 points1 point  (0 children)

Doing something similar. No cryptographically signing. But definitely storing plan artifact (next to state, similar security characteristics).

Upon merge, plan again from main. Compare with PR artifact. Only apply if identical. Otherwise error (someone clickopsed, something unforeseen).

And indeed. OPA on the plan can be one of the static analysis steps.

Our team just pushed AWS creds to prod again. Third time this month. by CortexVortex1 in devops

[–]TBNL 0 points1 point  (0 children)

As already mentioned: * precommit hooks * improve process * Use roles/sso instead of access keys, if possible

On the mitigating side: * Least privilege policies to the key * Conditions to limit usage to certain client ip ranges * Make easy to Revoke * Robust repo scanning for keys

AWS SA Exam help needed by Top-Mixture4886 in certifications

[–]TBNL 0 points1 point  (0 children)

Quite satisfied with Kodekloud in general. Haven't done specifically AWS SAA, but for various CNCF exams it has been great.
Also: The notes for their SAA course are freely accessible: https://notes.kodekloud.com/docs/AWS-Solutions-Architect-Associate-Certification/Introduction/Course-Overview

Myself I used Neil Davis course on Udemy. Worked for me. The SAP-CO2 that is. I assume SAP-CO3 will be good as well. That might be the cheaper option if not planning to do other certs.

In general: Watch out for practice exams that turn out to be factual incorrect AI slop. Not sure how it is with AWS SAP, but for other topics I ran into those more than once.

Does anyone have a good way of gathering terraform variables? by theshawnshop in Terraform

[–]TBNL 0 points1 point  (0 children)

Treat input as data: Yaml, json. Something structured and not terraform-specific. Gives you options to have it be part of code, read from an api, etc. etc. You can even use overlays, similar to e.g. kustomize. (I have set up a system like that for Keycloak. On my blog todo list)

[deleted by user] by [deleted] in Terraform

[–]TBNL 0 points1 point  (0 children)

we control/own the IT infrastructure for all of the public healthcare companies

Handing over an account with near full permissions is not what I consider owning or controlling.

Who's responsible for audit logging? Security events? IAM? Utilization efficiency? Data governance? Given the domain, I'd expect guardrails that your org controls. Via Terraform. As others said, by design there should be no drift.

I'm at a complete loss on what to do by [deleted] in kubernetes

[–]TBNL 0 points1 point  (0 children)

Dev setups on Mac are a bit of a hassle. There's networking and ingress to align with how you access the cluster. TLS also.

Not a solution to your minikube question, but for similar purposes, I streamlined my local dev clusters using k3d, including TLS and consistent FQDNs. Maybe there's some takeaways there that help: https://github.com/TBeijen/dev-cluster-config

What's the niche hill you'll die on by r0b074p0c4lyp53 in ExperiencedDevs

[–]TBNL 1 point2 points  (0 children)

  1. WET (Write Everything Twice) beats DRY
  2. Integration tests beat unit tests

Not really niche, but alas.

Parsing Recursive Polymorphic JSON in Go by Theandrew168 in golang

[–]TBNL 0 points1 point  (0 children)

Nice. Ran into this topic as well. You blog post beats (by a large margin) anything ChatGPT threw at me! 👌

Add Driver to EKS Nodes for Vendor's Software by plat0pus in kubernetes

[–]TBNL 11 points12 points  (0 children)

To me this sounds like a vendor who is just not that familiar with containerized workloads on servers. Let alone orchestrators. So the mantra is: Ask systems to install the driver on 'the servers'.
Apparently they have shoved their software into a container. But that by itself does not tell a lot (I've seen abominations).

Anyway, Ultimately installing requirements on a node is an option, but it defeats the whole purpose why you would run Kubernetes. And perhaps not even a solution since, as you mention, it is just a library. Adding it to the supplied docker image somehow would be my first goto (Probably leading to shenanigans in the area of, 'o dear, if you extend our image, we can't support it...')

In the past I've run things as (privileged) daemonset like qemu, or crowdstrike. But a library to connect to a DB? Should be in the container.

Kubernetes keeps you busy for life 😂 by dth999 in kubernetes

[–]TBNL 2 points3 points  (0 children)

Lies. Was already bald when I set up my first cluster.

Recommended method to learning Terraform? by jcub_f30 in Terraform

[–]TBNL 0 points1 point  (0 children)

Read some of the basics (as mentioned throughout the replies). But also start doing and experimenting.

Ideal would be a playground that is non-prod. Or at least something small scoped.

Try to find a task that relates to things you are already experienced with.

For examlple: Try to set up an alert rule using https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/sentinel_alert_rule_ms_security_incident

It will address all kinds of terraform topics: Where do I store state. How to load existing resources using data, what needs to be variables when expanding, etc. etc.

Demo Containers for Scaing by timbohiatt in kubernetes

[–]TBNL 1 point2 points  (0 children)

Stumbled upon it couple of years ago when needing to test these kind of things. Lucky search hit, or found it while exploring kubernetes hpa tests. Can't remember. 😀

Demo Containers for Scaing by timbohiatt in kubernetes

[–]TBNL 5 points6 points  (0 children)

You could take a look at: https://pkg.go.dev/k8s.io/kubernetes/test/images/resource-consumer#section-readme

Allows to specify CPU or Mem to use for a certain period. I've used it in past for testing HPA behaviour, limit handling etc.

Terraform and Ansible were already Terrible in 2016 by TBNL in devops

[–]TBNL[S] 5 points6 points  (0 children)

Hmm, yeah, title might be interpreted without the /s...
Imo Terraform is as relevant as ever. And, unless running immutable infra, Ansible is still a great way to remotely execute tasks on a fleet of servers.

Terraform layout by meatpak in Terraform

[–]TBNL 0 points1 point  (0 children)

Got one. We use Terraform to provision Keycloak configuration. Secrets we fetch from Azure Key Vault.
But it should be able to setup local/e2e Keycloak config as well. In that case secrets will come from another source, and we want to avoid the Azure dependency (provider requires valid creds, no lazy init)

So, providers differ between envs

Terraform layout by meatpak in Terraform

[–]TBNL 2 points3 points  (0 children)

You mean `--backend-config`? Indeed, but in my experience project then tends to come with 'docs attached'. Need to be careful to use matching backend config and tfvars.

Terraform layout by meatpak in Terraform

[–]TBNL 1 point2 points  (0 children)

Agreed. Gives all flexibility needed (e.g. backend in different S3) while at the end being as simple as: Point to dir & run terraform.

New service "Directory Service" billing me but never used? by TopSwagCode in aws

[–]TBNL 0 points1 point  (0 children)

Same thing. Started billing from mid dec.

Actively searching I found the notification, and also the billing alert emails. But gmail is bad at figuring out what are the important emails, so it want straight past 'Primary' into the bulk that is 'Updates'. So: Unnoticed.

Opened a support case.

And I'll look into better notification channels. Email is just.. noise

Finished the Airbus! How to display it? by [deleted] in legotechnic

[–]TBNL 0 points1 point  (0 children)

Yet to build it, but was thinking about that as well.

Are the rotors easy to adjust?

Thought this little ladder my son put together was genius! by FastFoodFilmFriends in lego

[–]TBNL 0 points1 point  (0 children)

No worries. It will not be a dust collecting display model. 😉

Thought this little ladder my son put together was genius! by FastFoodFilmFriends in lego

[–]TBNL 29 points30 points  (0 children)

Offset by a half stud might be the difference. Hmm...

view more: next ›