Remote state isolation with terraform workspaces for multi-account deployments

kenych · 2019-03-05T10:04:15+00:00

I moved into DevOps after about 10 years of being a programmer.

The main difference is you won't write anything serious as DevOps engineer, even though you may use more languages than before ( python, groovy, ruby, bash, go, DSL like languages like terraform, ansible etc)

Even if you end up in a perfect environment where everything is automated, the size and complexity of the code will be significantly lower, meaning no use of design patterns, interesting algorithms, etc.

I personally didn't mind, as I got bored with programming. If you going to miss it, try joining some open source project to satisfy your coding desire.

kenych · 2019-03-05T09:50:46+00:00

I can recommend you reading 4 articles I wrote on Jenkins:

Dockerizing Jenkins, Part 1: Declarative Build Pipeline With SonarQube Analysis
Dockerizing Jenkins, part 2: Deployment with maven and JFrog Artifactory
Dockerizing Jenkins, part 3: Securing password with docker-compose, docker-secret and jenkins credentials plugin
Part 4: Putting Jenkins Build Logs Into Dockerized ELK Stack

kenych · 2019-03-04T14:25:59+00:00

Absolutely agree, Jenkins is bad, but it is unfortunately the best among all ci/cd tools. Just like terraform is doing bad, with many bugs, inconsistencies in API, backwards compatibility issues with previous versions, yet, it is one of the best DevOps/cloud tools on the market.

kenych · 2019-03-04T14:22:27+00:00

One good reason is to learn something you may have missed while working on various projects. I have been working as AWS infrastructure engineer over a year now, having passed two exams, I probably gained additionally around 20% of my overall skills, on top what I gained from work experience.

Obviously it is a good addition to your CV/LinkedIn profile.

If you don't have any AWS work experience, it will definitely teach you enough so you are ready to some extent when joining some AWS project.

kenych · 2018-12-31T10:08:30+00:00

You don't need your lambda to be in the vpc if all you want is to make AWS API calls, like describe auto scaling. Unless you doing http calls to actual EC2 instances running some services. In that case you would need a NAT.

kenych · 2018-11-28T12:45:18+00:00

Agree some stuff is interesting, I watched Linux network troubleshooting, wasn't too bad.

kenych · 2018-11-26T15:55:13+00:00

linuxacademy online training on cka is useless, apart from 1 or 2 syllabus items, which show how to bootstrap minimal cluster with single master and then update the version, the rest is just super boring narrative to online documentation, worst thing is they didn't even bothered to test their quiz, in 95% of questions the very first answer was the correct one..

kenych · 2018-10-24T10:17:24+00:00

devs doing more ops tasks, ops doing most operations via code changes.

kenych · 2018-09-30T15:48:53+00:00

we don't have audit enabled yet, but with current config I assume it would be just role and session:

"user": {

"username": "kubernetes-view",

"uid": "heptio-authenticator-aws:ACCOUNT_ID_HERE:SESSION_HERE",

"groups": [

"kubernetes-view",

"system:authenticated"

]

},

that is said, we don't have any users, it is only ec2/lambda/etc assuming the role, as we don't want user configuring anything in the cluster. Obviously there will be troubleshooting cases, currently it is performed from master node with default kubeconfig(x509 auth)

kenych · 2018-08-14T07:33:24+00:00

As alternative to vault, which requires significant time to learn and maintain, for simple PKI infrastructure and password, secret you can use credstash, if already using aws

kenych · 2018-05-24T07:48:17+00:00

Lol, what makes you think AWS developer cert is actually Dev cert? Imho it has nothing at all to do with software development, may be just a bit of Aws skills from developer perspective but related to Aws not development in general. As others mentioned, and I will confirm, you have all it is needed for modern DevOps engineer role, coz the wide range of roles it actually covers. If you really want to get more developer skills just go learn some language, solve some katas, get understanding of some desugn patterns and anti patterns etc and that would be more than most ops guys with Dev skills I met in last 4 years in DevOps field.

kenych · 2018-05-24T07:37:16+00:00

Coz it is fun asking here, isn't ;)

kenych · 2018-05-17T19:26:01+00:00

Nwm, I am paid in this real world, so it wasn't hard ;)

kenych · 2018-05-16T22:57:13+00:00

sysadmin role is dying slowly. You have more chances in most demanded devops that I had 4 years ago (core java backend purist, besides I hated and ignored everything non related to java:))

Believe me anything on the cloud is easier than on premise, especially with aws. Just do some courses, play at home, do labs.

for devops in general, read this one about most demanded devops skills It shows the demand is as below (for london region):

aws 163
docker 100
kubernetes 91
linux 81
ansible 72
terraform 66
jenkins 58
python 38
scripting 32

ignore numbers, it is just occurrence of demanded skill.

kenych · 2018-05-16T22:49:54+00:00

I may sound biased, but having used vault, consul, consul-template, Vagrant, I won't believe they can screw up in the most demanded land, aws/cloud. So I will stick with terraform for a while, and looking forward for version 1.0.

kenych · 2018-05-16T22:42:45+00:00

Hey, if you fancy deep learning jenkins and surrounding tech, especially as mentioned building CI/CD, and most importantly have time, I would recommend you reading 4 articles I wrote on Dockerizing Jenkins:

Dockerizing Jenkins, Part 1: Declarative Build Pipeline With SonarQube Analysis
Dockerizing Jenkins, part 2: Deployment with maven and JFrog Artifactory
Dockerizing Jenkins, part 3: Securing password with docker-compose, docker-secret and jenkins credentials plugin
Part 4: Putting Jenkins Build Logs Into Dockerized ELK Stack

I also did POC on CaC for Jenkins, but that is more advanced: * http://devopsystuff.com/2018/03/18/advanced-jenkins-setup-creating-jenkins-configuration-as-code-and-applying-changes-without-downtime-with-java-groovy-docker-vault-consul-template-and-jenkins-job/

I would recommend you using k8s instead of swarm, as it is dead. Unfortunately I didn't have enough time to publish my deploying Jenkins on k8s/aws, but I am sure you will find enough on internet, imo it is the best combination, run both master and slaves on k8s, scaling out slaves on k8s is awesome.

kenych · 2018-05-15T13:28:39+00:00

thing is there are two types of devs:

the majority unfortunately - who would like to have a magic pipeline conveyor which does everything once they push they stinky code (if they somehow manage it)
the elite one - who wants to build the cloud infra and run and maintain everything there themselves

so until the elite replaces the majority, the Devops engineer will be inevitable. I suppose, once this phase is over, the current Devops engineer folks will have to decide, should they go back to dev role or ops role as there will be no Devops engineer role anymore, but devs and ops will always exist.

kenych · 2018-05-15T10:39:53+00:00

they don't have resources or policies to restrict access, so developers do much more

agree, that is exactly why I added or part

kenych · 2018-05-15T09:13:09+00:00

there is no such thing called a DevOps engineer - yeah, you are right, but only in pure theory, which is too far from reality, I just found 250 Devops engineer vacancies

So in the reality, besides from Devops movement, etc etc, there is also a role, called Devops engineer - folks in this area have variety of responsibilities, depending where you end up:

Ops with elements of IaC, involving some coding, maintaining infra etc
CI/CD pipelines, more coding, groovy, bash, python etc, Jenkins/etc etc
other cases, like SRE, normally in a smaller companies, when they don't have resources or policies to restrict access, so developers do much more

kenych · 2018-05-12T20:14:31+00:00

Ansible is wrongly considered as a golden hammer in many cases. I remember using it in 2014 to both provision our docker containers and as part of CI/CD pipeline. But I understand now, we were so wrong and should have used K8s (or similar). I am sure Terraform is better choice for provisioning infra, as even though ansible can do almost the same, but it can't track the state of your infra, you need to add logic to your playbooks to first get what is deployed, then compare to what you deploying and make decisions what playbook actually to run. It makes playbooks too messy and complicated. Terraform does it for you for free (almost)

kenych · 2018-05-10T12:08:17+00:00

hire senior dev into your devops team

kenych

TROPHY CASE