One option that you could consider is using a continuous deployment tool like Jenkins, Travis CI, or GitLab CI. These tools can automatically deploy your code to a production server whenever you push your code to a certain branch in your git repository. This can save you the time and effort of manually deploying your code to your production server every time you make a change. Another option is to use a service like Heroku, which makes it easy to deploy and manage your web applications. With Heroku, you can simply push your code to a git repository, and Heroku will automatically build and deploy your application. Ultimately, the best option will depend on your specific needs and preferences, so it may be worth experimenting with different approaches to see what works best for you.

... mostly achieves the lock behavior, but it also creates the user. The state property only has possible values present and absent ... Right, that would be the best approach and expected behavior. One can obtain a fact on the user presence using ansible.builtin.getent and then conditionally use ansible.builtin.user. And also right, this would be too the recommended approach. In other words, currently there is no possibility to configure such within one single task and if not using shell module, custom scripts or custom modules. Similar Q&A https://serverfault.com/a/1035610/448950

The most obvious candidate to this task is ansible.builtin.file with state: touch. Right, this could be an option. However, it always appears as changed as the times need to be updated. According the documentation https://docs.ansible.com/ansible/latest/collections/ansible/builtin/file_module.html#parameters not necessarily since access_time and modification_time Should be preserve when no modification is required The following minimal example --- - hosts: localhost become: false gather_facts: false tasks: name: Create file file: path: "/home/{{ ansible_user }}/test.file" owner: "{{ ansible_user }}" group: "users" access_time: preserve modification_time: preserve state: touch name: Touch again file: path: "/home/{{ ansible_user }}/test.file" owner: "{{ ansible_user }}" group: "users" access_time: preserve modification_time: preserve state: touch will result into an output of TASK [Create file] *************************** changed: [localhost] TASK [Touch again] *************************** ok: [localhost] PLAY RECAP *********************************** localhost : ok=2 changed=1

NFS is a commonly used storage option for Kubernetes, but it is not as reliable as some other options such as persistent volumes or distributed file systems. This is because NFS relies on a single server for storage, which can be a single point of failure. Additionally, NFS can experience performance degradation when handling high volumes of data or a large number of concurrent connections.

Apparently during the AMI creation process, the default user password gets locked - a ! is appended to the password in /etc/shadow. I was able to just add passwd -u ubuntu to the user data of the launch template to unlock it and we are good to go.

One approach would be to use multiple authorized keys files, authorized_keys2 https://serverfault.com/questions/116177/whats-the-difference-between-authorized-keys-and-authorized-keys2 but there's no reason you can't use it and you can specify multiple authorized keys files in sshd config AuthorizedKeysFile Specifies the file that contains the public keys used for user authentication. The format is described in the AUTHORIZED_KEYS FILE FORMAT section of sshd(8). Arguments to AuthorizedKeysFile accept the tokens described in the TOKENS section. After expansion, AuthorizedKeysFile is taken to be an absolute path or one relative to the user's home directory. Multiple files may be listed, separated by whitespace. Alternately this option may be set to none to skip checking for user keys in files. The default is ".ssh/authorized_keys .ssh/authorized_keys2". this might not be the optimal solution to your problem, but I think you're going to have to hack on ansible yourself to get it to do what you want.

Q: "Disable communication to all the systems you do not want to update." A: The only safe way is to physically isolate such https://docs.ansible.com/ansible/latest/tips_tricks/ansible_tips_tricks.html#separate-production-and-staging-inventory . A firewall might be an option. But, it's not feasible if you want to keep ssh or other https://docs.ansible.com/ansible/latest/inventory_guide/connection_details.html#connection-methods-and-details that Ansible might use. On the configuration level, there are many options. 1) Special user Create a special user for this purpose on the systems you want to update. For example user ansible_update. Depending on your https://docs.ansible.com/ansible/latest/tips_tricks/ansible_tips_tricks.html#separate-production-and-staging-inventory configure the https://docs.ansible.com/ansible/latest/reference_appendices/config.html#default-remote-user to ansible_update. This way you make sure no other systems can be connected by mistake. In addition to this, you control who can connect to these systems by putting their public keys into the authorized_keys of the user ansible_update at the remote hosts. To enforce this you have to: monitor users at the remote hosts and their authorized_keys scan your project (playbooks, roles, inventory, configuration) for remote users other than ansible_update 2) Bastion host A better option is creating a https://en.wikipedia.org/wiki/Bastion_host and making it the only source of the configuration for the environment. 3) ansible-pull The most flexible option is configuring the remote hosts to https://docs.ansible.com/ansible/latest/cli/ansible-pull.html their updates on their own. Conclusion: Create special users, create a bastion host, and make the remote hosts pull the updates from it.

I can't tell exactly what you are trying, it looks like you might just not have Traefik and the services on the same network. Its also helpful to have a domain that's going to resolve to 127.0.0.1 on wildcard queries. This might be a valuable starting point as a working example. networks: traefik: name: demo_traefik services: proxy: image: traefik:latest command: > --accesslog=true --api.insecure=true --log.level=DEBUG --providers.docker=true --providers.docker.network=demo_traefik ports: - "80:80" - "8080:8080" networks: - traefik volumes: - /var/run/docker.sock:/var/run/docker.sock labels: traefik.http.routers.demo_traefik.rule: Host(traefik.localtest.me) traefik.http.services.demo_traefik.loadbalancer.server.port: 8080 example: image: nginx networks: - traefik scale: 4 labels: traefik.http.routers.demo_nginx.rule: Host(example.localtest.me) traefik.http.services.demo_nginx.loadbalancer.server.port: 80 whoami: image: traefik/whoami networks: - traefik labels: traefik.http.middlewares.whoami_strip.stripprefix.prefixes: /whoami traefik.http.routers.whoami.rule: Host(example.localtest.me) && PathPrefix(/whoami) traefik.http.routers.whoami.middlewares: whoami_strip docker compose up and then visit http://example.localtest.me/whoami in your browser.

Apparently rootless mode runs Docker only when a user session starts. After stopping the session, Docker stops too. I had to enable lingering: https://stackoverflow.com/questions/73299883/docker-containers-terminate-on-shell-logout $ loginctl enable-linger $UID

While I don't have extensive experience with it, I believe Istio and other service meshes are built for this (and more complex things). https://www.alibabacloud.com/blog/597011 Looks like it has a "global" DNS name format for inter cluster routing in addition to the local format. Services in the same Kubernetes cluster have the same DNS suffix, for example, svc.cluster.local. Kubernetes DNS provides the DNS resolution capability for these services. To deploy a similar configuration for services in the remote cluster, we name the services in the remote cluster in the .global format. The Istio installation package includes a CoreDNS server that provides the DNS resolution capability for these services. To use the DNS resolution capability, you need to direct the DNS service of Kubernetes to the CoreDNS service. Then, the CoreDNS service will act as the DNS server for the .global DNS domain.

Your ip show does mention 10.42.0.0/32, 10.42.0.200/32. No traces of 10.42.0.232, though. From LAN/outside SDN: can you connect any TCP port, or ping that address? anything that answers? I suspect nothing would. In addition to that Traefik rule, you mentioned creating a Service ... Are you sure you did it right? Look at kubectl get svc -A | grep 10.42.0.200, that would give you a working example -- something with an externalIP/externalIPs set, or some status.loadbalancer.ingress array ... configuration may vary, depending on how external IPs were implemented and kube version, .. And by the way, creating such Services: are you pointing to your application directly, or is it sent to Traefik instead? Assuming the latter: are you sure Traefik actually listens on such port. Also, while Traefik should be able to process TCP or UDP trafic, unless you can easily have several Services & backends accessible through the same proto/port combination: involving your ingress controller here might not be necessary.

I can't comment, so using an answer. What exactly do you mean by "However, when they were finished there were no parallel jobs available in our account." If you use the MS hosted agents, and if you bought three parallel jobs, you should see them in the Organization settings -> Parallel jobs overview. If not, try lo log out, clear cache etc. The purchases are indeed for a month, as explained https://azure.microsoft.com/en-gb/pricing/details/devops/azure-devops-services/ , the costs would be about 40 euros for a month, so for three it would be around 120 euro a month. As an alternative, and as suggested by others, you could use self hosted agents. They are cheaper, and depending on resources on the host where you install the agent, they run faster. And then, depending on your needs, there are several ways that might speed up your deployment process, but that usually depends on what you've already configured and your needs. And then last, if you are a really early user of DevOps, there was an option to pay for hosted agents by the minute. That could explain your situation, but I've checked several organizations inclusing a few already several years old but I can't find any reference of it.

Supermicro offers this Redfish Reference Guide, which describes its Redfish REST API in detail. Right. According the documentation you've referenced, Ch. 4 "Using RESTful APIs" p. 13 ff., the structure of the REST API call seems to be https://${URL}/redfish/v1/${CATEGORY} ... followed by further actions, commands, tasks or payloads. Can someone explain how to map the API options to the Ansible modules? After looking up the module documentation examples and the source code https://github.com/ansible-collections/community.general/blob/main/plugins/modules/redfish_config.py https://github.com/ansible-collections/community.general/blob/main/plugins/modules/redfish_command.py it turns out that the modules using https://github.com/ansible-collections/community.general/blob/main/plugins/module_utils/redfish_utils.py as a wrapper the utilize the REST API. It maps the REST API structure to the parameter structure of the modules (category, command, payload). For a better understanding you may have a look into the mentioned source. How can I use the Ansible modules to set the hostname or to provide NTP settings? https://github.com/ansible-collections/community.general/blob/main/plugins/module_utils/redfish_utils.py#L2729 it seems to be the manager_services for NTP. Because of the lack of the specific environment I'm not able to investigate this further and to do tests, therefore for how to use it you may also have a look into the source. To get familar with the Redfish RESTful API you may also have a look into https://github.com/DMTF/Redfishtool it was originally written during the development of the Redfish specification to help find ambiguities in the spec. Further Examples There are some explanations and a general programming example from a bigger production environment available Krenn Wiki https://www-thomas--krenn-com.translate.goog/de/wiki/Redfish?_x_tr_sl=de&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp Documentation https://www.dmtf.org/sites/default/files/standards/documents/DSP2060_1.0.0.pdf

Jenkins uses string interpolation to take password as input and it uses AES to encrypt and protect secrets, credentials, and their respective encryption keys. So, using direct or simple approach will not work. Although you can try to assign the password to a string variable and the print it in log it works in most the cases until the password itself is saved after encrypting.

Can you share output of kubectl describe pod mongodb-arbiter-0 Mainly interessting are events at the end if possible within timeframe when you start the deployment until it crashes.

Do not store your generated binaries in git. Git stores every version of a binary as a full new version, not just the changes. Your projects must be setup in the way that the binaries can be rebuilt anywhere. Then in the pipeline your code is copied to a second directory structure and the projects will build and generate the binaries for you. From there unit tests are done and whatever more is in the pipeline. Use git rm to remove them from the repo (optional) git filter-branch to remove them from old commits git gc --prune=now to garbage collect them from the ..git directory

Project settings > Settings

Uploading an artifact lets it be accessed by a future github action run. It doesn’t commit and push the file to the repo. See the docs for how to manually retrieve artifacts: https://docs.github.com/en/actions/managing-workflow-runs/downloading-workflow-artifacts You might want to look into services like ReadTheDocs or github pages, as potential places to automatically publish the output from your latex build. E.g., https://docs.github.com/en/pages/getting-started-with-github-pages/configuring-a-publishing-source-for-your-github-pages-site .

Fix the condition {% if production_env == "prod" or production_env == "stage" %} password: "{{ group_token }}" username: usernamedoesntmatterhere {% elif production_env == "dev" %} password: "{{ mytoken }}" username: "{{ mytokenname }}" {% else %} NONE {% endif %}

No there is no way to tell Terraform to skip creating a resource if it already exists. Is there a reason why you want to skip resource creation? Why not import the existing resource into Terraform state file so it doesn't try to create the resource that already exists? You could provide more background information for this.