adamrushuk / devops-lab Goto Github PK

Evaluate using one of the following DNS providers:

• AzureDNS
• CloudFlare

https://github.com/kubernetes-sigs/external-dns

https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/azure.md

• Test using Service Principle auth creds file.
• Test using Managed Identity instead of Service Principle. Try AKS MI first.
• Add separate DNS MI and aad-pod-identity binding. Must use userAssignedIdentityID as per workaround here: kubernetes-sigs/external-dns#1548 (comment)

vmware-tanzu/velero#2081

https://chocolatey.org/search?q=velero

• http://nexus.thehypepipe.co.uk/#admin/system/api

• https://help.sonatype.com/repomanager3/rest-and-integration-api#RESTandIntegrationAPI-RESTAPI

• https://help.sonatype.com/repomanager3/rest-and-integration-api/script-api

• https://help.sonatype.com/repomanager3/rest-and-integration-api/script-api/examples

• https://github.com/sonatype-nexus-community/nexus-scripting-examples

• https://chocolatey.org/packages/chocolatey-nexus-repo#files

• https://github.com/pauby/NexusManagement/blob/master/docs

• https://github.com/sonatype/nexus-public/blob/master/plugins/nexus-script-plugin/src/main/java/org/sonatype/nexus/script/plugin/RepositoryApi.java

I usually dev between 06:00 - 09:00, so would like the AKS nodes to be deallocated if I forget to do this manually.

• Test PowerShell 7 func app worker: Azure/azure-functions-powershell-worker#371 (comment) - just add $env:FUNCTIONS_WORKER_RUNTIME_VERSION = '~7' when local, or add application setting FUNCTIONS_WORKER_RUNTIME_VERSION = '~7' for hosted function apps.
• Run choco install azure-functions-core-tools-3 --params "'/x64'" for local testing.
• Add support for UK time comparison
• Add zip script and zip hash script to find replace token in TF var
• Deallocate: mon-fri 06:00 - 09:00.
• Deallocate: sat-sun 15:00 - 06:00.
• Only notify (push notification to mobile) that AKS nodes running: sat-sun 15:00 - 06:00 https://www.dennisrye.com/post/twitchscanner/

Use locks or tags to skip prod VMs

https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-first-function-vs-code

Use config appsettings for Service Principal auth during local testing, and MSI once deployed. Azure/Azure-Functions#644 (comment)

Reference

• https://markheath.net/post/managed-identity-key-vault-azure-functions
• https://www.terraform.io/docs/providers/azurerm/r/function_app.html
• https://github.com/JustinGrote/terraform-azurerm-azure-function-powershell/blob/master/main.tf

Use Ansible and PowerShell 7 to do post deployment configuration via Nexus REST API.

• https://www.jonathanmedd.net/2020/03/running-powershell-7-commands-directly-on-ansible-localhost.html
• Investigate best dev process for PowerShell and Ansible. Ansible Debugger usage.
• Use Ansible container for local dev / testing
• Test using Module Defaults to reduce code: https://docs.ansible.com/ansible/latest/user_guide/playbooks_module_defaults.html

API TODO

• Test using result.json != none
• /beta/security/users/{userId}/change-password
• /beta/security/realms/active
• /beta/repositories/docker/hosted

Check flags used in PS pipeline test example to reduce output

• https://azure.microsoft.com/en-gb/updates/azure-spot-virtual-machines-are-now-generally-available/
• hashicorp/terraform-provider-azurerm#6086

1. debug https://github.com/adamrushuk/aks-nexus-velero/runs/588203017?check_suite_focus=true - add skip logic when admin password file has been removed: cat: /nexus-data/admin.password: No such file or directory
2. Add a wait for nexus pod to be ready: Error from server (BadRequest): pod nexus-0 does not have a host assigned

Troubleshoot ingress on hello deployment:

• https://managedkube.com/kubernetes/trace/ingress/service/port/not/matching/pod/k8sbot/2019/02/13/trace-ingress.html
• https://kubernetes.github.io/ingress-nginx/troubleshooting/

https://pascalnaber.wordpress.com/2018/06/17/access-dashboard-on-aks-with-rbac-enabled/

https://dev.to/cloudskills/using-containers-for-ansible-development-2n9n

Check what Jenkins agent docker image is used before building my own

https://www.google.com/search?q=vscode+docker+remote&rlz=1CDGOYI_enGB609GB609&oq=vscode.docker&aqs=chrome.2.69i57j0l3.4502j0j7&hl=en-GB&sourceid=chrome-mobile&ie=UTF-8

https://code.visualstudio.com/docs/remote/containers

Test mounted volume, sandbox, and attaching to running container (in AKS). Validate git and SSH connections. Use additional mount point for local .ssh folder.

https://code.visualstudio.com/docs/remote/containers-advanced#_developing-inside-a-container-on-a-remote-docker-host

https://aka.ms/vscode-remote/samples/kubernetes-helm

Add similar Dockerfile as used for building in Jenkins. Update to latest PowerShell and Az modules:

Install-Module Az.Accounts -Scope AllUsers -Acceptlicense -Force

Set bash autocomplete for kubectl and other CLIs

https://github.com/terraform-providers/terraform-provider-helm/releases/tag/v1.1.1

Install the same Ansible version as GitHub Ubuntu1804 runner: https://github.com/actions/virtual-environments/blob/master/images/linux/Ubuntu1804-README.md

https://launchpad.net/~ansible/+archive/ubuntu/ansible

sudo add-apt-repository ppa:ansible/ansible
sudo apt-get update

https://docs.ansible.com/ansible/latest/reference_appendices/interpreter_discovery.html

https://www.dennisrye.com/post/send-smartphone-notifications-powershell-ifttt/

https://github.com/sdras/awesome-actions

• Change stable//velero chart name to vmware-tanzu/velero : https://github.com/vmware-tanzu/helm-charts/tree/master/charts/velero#option-2-yaml-file

Test all interactions:

• are ports open?
• can I publish to each repo?
• can I query each repo?

https://stackoverflow.com/questions/33509194/command-to-delete-all-pods-in-all-kubernetes-namespaces/33510531#33510531

• https://github.com/oteemo/charts
• https://devopsinitiative.com/blog/2018/03/01/setting-up-nexus3-as-a-private-container-registry-inside-kubernetes/

https://www.edc4it.com/blog/java/minikube-nexus-statefulset-ingress

Need extra ports mapped. Check with:
kubectl describe sts -A

Test configuring another ingress in different namespace called nexus.

Add an insecure-repo setting or arg:

docker-machine provision default after updating $HOME/.docker/machine/machines/default/config.json

https://stackoverflow.com/questions/30654306/allow-insecure-registry-in-host-provisioned-with-docker-machine

Use new features like Managed Identity

• AKS Clusters using Managed Identity are now Generally Available (GA) and will no longer need a service principal.
• https://github.com/Azure/AKS/releases/tag/2020-03-16

• https://docs.microsoft.com/en-us/azure/aks/node-updates-kured
• https://docs.microsoft.com/en-us/azure/aks/node-image-upgrade
• Example: https://github.com/claranet/terraform-azurerm-aks/tree/master/modules/tools/kured
• Add repo badges, eg: https://raw.githubusercontent.com/claranet/terraform-azurerm-aks/master/modules/tools/kured/README.md

Pester

• https://github.com/marketplace/actions/pester-tests-report

Currently disabled as waiting for issue to be fixed: zyborg/pester-tests-report#1

https://github.com/hashicorp/terraform-github-actions

https://link.medium.com/OO4SOxJb24

kubectl rollout status deployment

Add readiness probes

• Search for and action TODO throughout code.
• Remove old comments

No longer needed.

Might be better than passing secrets around within GitHub Actions

• Prereqs will be dns zone and a key vault with a wildcard cert
• Create a initial_lab_setup.sh script, using gh CLI for github steps like secrets
• Set up acmebot from scratch: https://github.com/shibayan/keyvault-acmebot/releases/tag/v4.0.0

works when CI_DEBUG: false
test using CI_DEBUG: true

"Run after the first terraform apply, and viola. At least you are more confident that your code is idempotent any it does not create a new resource due to a random string or something within the code."

https://github.com/Azure/actions