a tech blog
Today I noticed that a Gitlab scheduled pipeline wasn’t running anymore - it should have automatically. I checked and it wasn’t enabled at all! At first I thought that somebody else on my team had made a mistake and accidentally disabled the scheduled pipeline. So I enabled the pipeline …
Yesterday I talked to someone about different git hosting solutions and they complained about the marketing bullshit on one of the homepages of a popular provider (guess who!). I then looked at one provider I liked using and sure enough, most of them use marketing bullshit, rather then selling what …
At my last project, I wrote a small Python utility program to create and delete secrets in Hashicorp Vault. This tool was executed inside a docker container (and the container ran in a CI -pipeline). The container also talked to some other services that use an internal CA that was …
I needed to check the payload my alertmanager in OpenShift was sending out to the target-system (which was not under my control and I couldn’t check what was received). There is some documentation online. However at the time of writing, the example in the documentation was not usable out-of-the-box …
Recently in a Gitlab- CI pipeline I needed to dynamically include several variables that lived inside a yaml-file. The file that needed to be included was defined as a CICD -variable coming from an external API -call that triggered the CI -pipeline. The file were called after version-numbers, e.g …
In a current project I’m templating files using Jinja2 with the help of the jinja2-cli . Having used (and taught )Ansible for years I’m quite familar with Jinja2 so this was a natural choice. The jinja2-cli can receive variables to template by different means. One way is by loading …
I recently created repositories in a new Artifactory instance. This was a testing instance and since I dind’t work with Artifactory much before this, I created them in the web-frontend by hand. I then wanted to get them as code so I could recreate them in the production Artifactory …
Dieses Jahr war ich zum ersten Mal auf der Stackconf . Da Netways auch diese Konferenz organisiert, war es wie gewohnt schön, alte Bekannte und auch neue Gesichter zu treffen. Es ist stets interessant, in den Gesprächen mit Kollegen aus unterschiedlichen Bereichen, von großen als auch kleinen Unternehmen, national und international …
In my last TIL I talked about how to set additional security headers for Gitlab. But I also had to do this for other applications I was supporting, where it was more straight-forward to do it (meaning: with code). I needed to set the access-control-allow-origin header in the other applications …
Recently, I had to configure some security headers in GitLab. GitLab uses Nginx as its web server, and it allows for easy configuration changes for some settings. For instance, enabling HTTP to HTTPS redirection can be done simply by setting nginx['redirect_http_to_https'] = true in the gitlab.rb configuration file. However …
Recently I had to create a Helm-Chart (still not a fan of it, at all!) where the image was different depending on if the helm-chart was used for local development or used in production. I had to resort to using an if-else-condition that I put into the _helpers.tpl -file …
Glab ist ein Opensource-Tool, das es ermöglicht mit Gitlab über die Kommandozeile zu arbeiten. Dadurch entfällt das Wechseln zum Browser, um Merge Requests zu erstellen oder zu genehmigen, einen Pipeline-Lauf zu starten oder Issues anzusehen. Glab kann mit Repositories arbeiten, die auf gitlab.com gehostet sind, aber auch mit eigenen …
Glab is an open-source tool that allows you to work with GitLab from the command line, eliminating the need to switch to a browser to create or approve merge requests, start a pipeline run, or view issues. Glab can work with repositories hosted on gitlab.com as well as with …
Some time ago I discovered an interesting use of the ternary-filter in Ansible. A ternary-filter in Ansible is a filter that takes three arguments: a condition, a value if the condition is true and an alternative value if the condition is false. Here’s a simple example straight from Ansible …
Recently, I found myself needing to incorporate a CODEOWNERS -file to multiple repositories within our Github organization. The objective was to automatically reviewers for pull-requests. And codeowners are a perfect tool for this. This way every colleague in our company can join our Github organization and get write-access to the …
As someone with years of experience using and teaching Ansible I want to share with you how I teach it to my colleagues in the most practical way possible. However, before I get into the actual content of the training, it should be emphasized how important a functioning and identically …
Since I spent some time today on this, I’d rather write it down. Creating a Prometheus datasource that uses Azure Authentication was not straight forward. Here’s the end result: --- - name: Create a datasource in Grafana hosts: localhost gather_facts: false tasks: - name: Create prometheus datasource community.grafana.grafana_datasource: name …
The company I work for provides a broad scope of IT services to our customers and to be able to offer the best quality services, we rely heavily on automation, especially Red Hat Ansible. In this blog post, we’ll look at what our workflow looks like when automating with …
As someone who frequently works with both GitHub and GitLab repositories, I often find the need to get an overview of various projects that exist within an organization or group. At my workplace, we use GitLab’s group- and subgroup functionality to organize our team-specific and customer-specific structures. Recently, I …
I wanted to check if some services where running on a machine. The names of the services all start with integration@ , e.g. integration@foobar . So to check for all the services, I simply ran systemctl status integration@* and it worked: ● integration@identity.service - integration App identity Loaded: loaded (/etc …
Gitlab does not yet allow archiving all projects in a group at once. To do this, you can either manually archive every project in the frontend, our you can do it via the API . Here’s an API -call to archive all projects within a group (using the gitlab-cli). for …
When reading the title you may think: “d’oh! that’s easy, with git log , of course!” And of course it’s done with git log . But what I didn’t know is that with git log -p path/to/file you can show the history of a file including …
When I wanted to inspect Docker-Container that existed in a remote Docker-registry, I normally used skopeo : skopeo inspect docker://ubuntu:latest { "Name": "docker.io/library/ubuntu", "Digest": "sha256:9a0bdde4188b896a372804be2384015e90e3f84906b750c1a53539b585fbbe7f", "RepoTags": [ "10.04", "12.04", "12.04.5", } This command show me all the information about the image that I needed …
In a .gitlab-ci.yml job, if you do not specify a tag for an image, the latest tag is used by default. The default configuration of the gitlab-runner to pull Docker images is if-not-present , which means the image is only loaded if it is not already present. This in turn …
Randomly some Docker-containers on a clients Linux machine wouldn’t start - they’d fail with the error: docker: Error response from daemon: OCI runtime create failed: container_linux.go:349: starting container process caused "process_linux.go:319: getting the final child's pid from pipe caused \"EOF\"": unknown. It didn’t matter …
Often times I find a interesting or useful project on Github that is abandoned and has some issues. Then I hope that someone already forked the repository and continued working on it. To find a fresh fork, I had to go to the Insights-tab in the repository, click on “Forks …
As part of my job I routinely create new Github repositories for my colleagues. One unfortunate side-effect is that I am automatically subscribed to all those repositories and get mails for any new issues, pull requests and so on. This culminated in hundreds of mails over the weekend when we …
I needed to create multiple Github repositories and grant access to them for different users. After creating the first repository by hand and granting access to it, I had enough of it. There are just too many damn clicks! So I used the CLI . Github has a nice cli-program called …
Actually I did not learn this today but already some years ago. Sometimes I need to connect to remote servers that have no hosts-file or dns-entry. But I don’t want to remember IP -addresses! Luckily I do have these servers defined in Ansible’s hosts-file and I could theoretically …
I recently wanted to share a code-snippet with a colleague. I decided to use Gitlab Snippets for this. However the snippet was more of some hundred lines of code in a text-file which I didn’t want to simply copy-paste. Lucky for me I had python-gitlab installed, a Python library …
There was a need to iterate over the hosts in an Ansible inventory-file (don’t ask). After fiddling around with grep and sed, I found an easier method: ansible-inventory --list all | jq " ._meta.hostvars| keys[]" ansible-inventory --list all lists all hosts including their variables in a nice big json response …
For one of our customers we needed to install the Docker-plugin for loki. To install it, you run: docker plugin install loki However this failed with the following error message: Error response from daemon: dial unix /run/docker/plugins/d442cff8568254659f9aa7d2dd5a30526b69d1ac62593c628b65da8b9e933c6a/loki.sock: connect: no such file or directory Running strace …
We have a set of common pipeline jobs that are shared among different projects in Gitlab. We include them like this: include: - project: 'shared/gitlab/linting' ref: master file: - markdown.yml - ansible.yml When you do this, these included jobs get executed with the runner that is defined in the …
The nginx http_limit_conn module to limit http connections works as advertised. It limits the number of connections an ip-address (or other directives) can make to the nginx. Also: the Ansible hardening-role for nginx as a default limit of 5 connections ( see ). This bit me hard: One website I host makes …
And it is (at least for my instance) 4194304 bytes. That is 4,19 mb. You can easily achieve this by running some Ansible playbooks in diff-mode that unpack many files. :) Job's log exceeded limit of 4194304 bytes. Job execution will continue but no more output will be collected.
I wanted to build an executable python script on PyPi, so it can be run like MyPackage instead of python MyPackage.py . Finding out how to do this with Poetry was hard. Googling for “Python [distribute\|publish] executable” didn’t yield any useful results. I don’t even know how …
In Python if you want to execute something after a for-loop has finished, you can use a else-clause. This code: for i in range(5): print(i) else: print("Finished") Prints: 0 1 2 3 4 Finished
I am running Percona Monitoring and Managent (“ PMM ”) as a service for my fellow colleagues so they can monitor their databases. PMM runs as a container on a virtual machine, listening on port 8080. On the same virtual machine runs another nginx webserver as a reverse proxy for the container …
I host my private servers at Hetzner , a really nice, reliable and cheap german webhoster. Previously I managed my DNS zones with Route 53 from Amazon. There I paid 50 cents per zone per month. I have multiple zones so this adds up at the end of the year. Then …
Today I wanted to take the text of a Confluence page and convert it to Markdown. Getting the text was rather easy (after some duckduckgoing): Confluence provides a REST - API that returns among other things the content of pages in json. Here’s the curl-command to do this: curl "https …
Suppose you run a database as a service (DBaaS) for example in Azure. You have automated backups configured in case something bad happens. However these backups do not save you against a accidental database deletion as the backups get deleted, too! Then there’s the Open Telekom Cloud ( OTC ). The …
Using Ansible’s import_playbook module I was always under the impression that the module accepts no parameters and boldly stated so ! However another commentor helpfully pointed out that I was wrong. Here’s an example. The first playbook ( importer_playbook.yml ): - import_playbook: imported-playbook.yml vars: foo: hunter2 … simply imports a second …
If your Matomo server is unreachable it may be that your website cannot load! You can defer loading the Matomo tracking. For ways to do that, check that blog post: https://matomo.org/blog/2017/04/different-ways-embedding-piwik-tracking-code-faster-website-performance/
The Open Telekom Cloud provides Redis as a Service called Distributed Cache Service . The used Redis version is 3, first published on 1 Apr 2015. The latest 3.0.x release was published on 28 jan 2016. The current version is 6.2.2, published on Mon April 19 2021 …
Here I list my other writings that I published and talks that I held. Writings Mob Programming - Remote Teams in the Flow | Telekom MMS Blog ( Internet Archive ) Ansible Best-Practices | Telekom MMS Blog ( Internet Archive ) Erfahrungen und Best-Practices mit Ansible | Telekom MMS Blog ( Internet Archive ) Updated: Erfahrungen und Best-Practices mit Ansible …
Recently I tried to resize a LVM logical volume with its volume group and the physical disk belonging to the vg. Because the logical volume contained all partitions except for /boot I knew it would be hard. I also knew that I had no backup and no snapshot of the …
Curl has support for sftp and scp, among many other protocols. In one of our php-applications we use libcurl to transfer files via sftp to a remote datacenter. We recently migrated this application into a docker-container. With it we transferred the private key into the container, so the application can …
I have an Ansible role that deploys microservices, of whom I have a list of. The microservices are called foo , bar and baz . I also have a list of stages, called DEV , QA and PROD where the microservices get deployed to. Of course, every microservice needs to connect to a …
Some time ago I talked with a co-worker about his internal project. He was the owner of a product that tried to provide a generalized, hardened and fully codified Jenkins instance. This was done with the help of mostly Puppet and Groovy code. I was in this project for six …
Recently, I utilized the yum-config-manager program, which is part of the yum-utils package, to add an additional repository into a CentOS box (of course this works with RedHat, too). The process involves installing yum-utils and adding a repository using the yum-config-manager command. Subsequently, a file is dynamically generated in the …