12

TL;DR: Infrastructure as Code is a way to automate and backup your environment. In ideal case, after a disaster, you could restore your Infrastructure fully and automatically by Provisioning new resources, Restoring Configuration from Code Repository and Recovering Data from Backup. Overview Infrastructure as Code relies on three main concepts: Automation ...


7

ChatOps is an absorbing topic; practically it means something very different to each team using it. So much so that Atlassian have put together what could be considered to be a Chat maturity model. Sputnik: Trying chat out to see how it works. Mercury: Starting to move to chat. Gemini: Chat as the primary source of communication, experimenting with bots. ...


6

In short, I see two categories of tests for your infrastructure: 1) does it have everything you need to run your application and 2) does it not have any superfluous stuff. First and foremost, you can treat the test suite of your actual software as a kind of "meta test" for your infrastructure. As long as you create the infrastructure from scratch for each ...


6

Part of adopting the Immutable Infrastructure Pattern is decomposing your system into small manageable pieces that can move through CI/CD Pipeline very quickly, this means that OS patches can be done quickly and in a controlled manner. I often see clients ending up with a halfway house where infrastructure is mostly immutable. However, there are a few ...


5

Alright... you're not going to implement every tool or automation at the same time, as some of them have quite deep impact on your development processes (and I daresay, development culture). Take a step-by-step approach; research each individual tool. Figure out what it actually does, what it is useful for. Play around with them, install them locally, go ...


5

Before explaining what it exactly is, let me quote a really nice definition, straight from Wikipedia: Infrastructure as Code (IaC) is the process of managing and provisioning computing infrastructure (processes, bare-metal servers, virtual servers, etc.) and their configuration through machine-processable definition files, rather than physical ...


5

There are, as always, a few ways to solve this. You can use a central source to keep secrets that each server reads from ala Hashicorp Vault. While popular this is not my preferred approach as its rather complex. There are quite a few key value stores that can provide similar functionality such as AWS Parameter Store. You can manually put data in these ...


5

You can use a remote backend as a data source. That is working well for us thus far but this project is not very mature and we will likely refactor a time or ten. data "terraform_remote_state" "network" { backend = "s3" config { // some variables related to config would likely go here } } then for the teams not managing the network to consume ...


4

I'd go with node.run_state to store a transient variable in a run and define it in a ruby_block so it happens at converge time, something like this: yum_package 'somepackage' ruby_block 'set myvar' do block do node.run_state['my_var'] = Mixlib::ShellOut.new('/bin/somecommand').run_command.stdout.strip end end As far as I know requiring 'mixlib/...


4

The layout of your repository depends in many ways upon the context you are developing the automation in. If, for example, you are building out the infrastructure for a product as part of a product team, then it would make sense to tie the infrastructure to the product - i.e. keep the infrastructure in the same repository as the software source code. If ...


4

Hi and welcome to DevOps SE! While DevOps is not self-purposed, maybe it is worth to step back for a moment to find out the actual problem before trying out solution. As you have asked a more or less generic question, I'll give you sort of a "DevOps primer" stick more to methodology rather than give you a list of tools. How detailed you would tailor the ...


3

You've got a couple of options: 1. Embed the source code to the CloudFormation template I do just that in my ec2-start-stop demo. You'll see file ec2-start-stop.template.yml with these lines: StartStopLambda: Type: AWS::Lambda::Function Properties: [...] Runtime: python3.6 Code: ZipFile: Fn::...


3

I've been responsible for setting up DevOps processes in two companies from scratch so hopefully this will help. Others have asked questions about business objectives but I'm going to give you a brief rundown of some of the problems we had and the technologies I used to fix it. Infrastructure Creation/Management was slow and error prone - I started ...


3

It depends on what you are willing to rent and allow to be managed by someone else. If we look at this diagram: It shows a full range of options. At one end is Do It Yourself with on-prem hardware and setting up networks etc. Next to that is ”co-lo” which implies you buy servers that are installed in someones rack/network/data centre. Next to that is IaaS ...


3

Welcome to containers, a very exciting direction indeed. Software configuration management tools such as the ones you mention do cater for containers in many ways and if you're already familiar with Terraform then you'll probably already know this. Kubernetes for instance can manage deployments and replication sets (of containers; 'pods') and nodes much ...


3

The documentation shows that you can have 40+ branches with different configurations. You express concern that the configuration becomes large. With a good editor that isn't really a problem. Yet that feels wrong, right? With git, in general, a repository per independent deployable works better than a single repository holding many independent deployables. ...


3

"best suited" is the question. How do you measure this? what are the metrics and why do you choose them? I think you are looking for some kind of "tools combination", earlier tested on production by someone else's if preferred. What you want to do is try some opensource/free private cloud on-premises and run IaC on this private environment. You can test ...


3

Important Since AWS CloudFormation templates use the JSON syntax for specifying objects and data, you will need to add an additional backslash to any backslash characters in your regular expression, or JSON will interpret these as escape characters. For example, if you include a \d in your regular expression to match a digit character, you will need to write ...


3

You hint in the title about immutable infrastructure, so it sounds like you already know the solution: don't change existing servers, but bring up new ones with your changes, switch over to them, and switch back to the old ones if necessary. Theoretically any of the standard config management tools can roll back by simply checking out a previous commit and ...


3

General Notes I don't really understand this one: However, this seems clunky, as I have to create the logic to read this file in every script that is made. You can source all variables from a bash file in one line (source file-name.sh). If they are "exported", you can pick them up in applications in any language you like (Java, python, or whatever), ...


2

This is a common problem in configuration management, and while I can't speak for Chef as I haven't worked with it, I can tell you how this is solved by both Puppet and SaltStack. Firstly, this distinction becomes a little less important with interpreted languages since there isn't much difference between including this sensitive data in a configuration ...


2

A prime use-case for Enterprise IT would be to reinvent their process for handling Major Incidents (sometimes called "Incident War-room") by utilizing the ChatOps practice. I've captured this and additional use-cases relevant to Enterprise IT - in a blog series: https://community.hpe.com/t5/IT-Operations-Management-ITOM/ChatOps-ChatBots-and-Enterprise-IT/...


2

The specifics depend on the exact use case. If the value is only used as a property on another resource, you would use the lazy helper method. If you don't need the output, you would use the execute resource. In some more complex cases you might use a ruby_block resource or write your own custom resource.


2

My limited experience is indeed that often, you can get a first solution very quickly with pre-made automation code; unfortunately, often there either appear unexpected problems during "first contact", or later during use, especially when you wish to expand the configuration for unusual cases. So, indeed, I do tend to approach this with an open mind. I will ...


2

'Suitable' can honestly be whatever works for you. I personally feel its perfectly reasonable to do a manual install of Chef server. It is the CM tool to help provision the rest of your fleet. You will not be setting up Chef server over and over again. You do it once, and then never again, in theory. That theory breaks down however, in respect to server ...


2

@jasper welcome! This really might depend on the context. On long term it's worth to take a deeper look for a moment if you are not after quick shots and go beyond experiments for a sustainable (and large) infrastructure. So we have got many clouds out there. Deployment automation means, they have some API. So what does make a deployment automation tool ...


2

here are my 2 cents, You can use GITLAB to have merge requests for all your security requests like adding users to the groups for every new user or existing users. the Mr can be approved by only your IAM admin. You can use GITLAB CI pipelines to go and perform the operation once the MR is approved. From the users side, the user has to provide their keys ...


2

There may be a significant speed difference between provisioning an environment and bringing up that environment. Especially when it comes to what you mentioned: IaaS and hybrid environments - those are VMs and bare metal servers - it may take many seconds/minutes for some of them to come up. So there may still be value in patching those environments, ...


2

You can use the count meta-parameter to achieve the effects of an if-else statement. It is talked about in detail in the link below and I also pulled one relevant example out. I'm not 100% sure if you can give both the data source and resource the same name without a conflict; but I assume it would work. It may be dependent on the resource you're creating ...


1

Here two parts: use IaC tools like Terraform to create environments and use Docker to deploy applications. 1) You can use Terraform with workspaces to make production and development. Maybe use Packer to prepare AMI images to reduce time for building. 2) Decide what CI/CD pipeline you will use to deploy apps. And first of all here you should know what ...


Only top voted, non community-wiki answers of a minimum length are eligible