I have 2 pods and my application is based on a cluster i.e. application synchronizes with another pod to bring it up. Let us say in my example I am using appod1 and appod2 and the synchronization port is 8080.

I want the service for DNS to be resolved for these pod hostnames but I want to block the traffic from outside the apppod1 and appod2.

I can use a readiness probe but then the service doesn't have endpoints and I can't resolve the IP of the 2nd pod. If I can't resolve the IP of the 2nd pod from pod1 then I can't complete the configuration of these pods.

E.g.

app1_sts.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    cluster: appcluster
  name: app1
  namespace: app
spec:
  selector:
    matchLabels:
      cluster: appcluster
  serviceName: app1cluster
  template:
    metadata:
      labels:
        cluster: appcluster
    spec:
     containers:
       - name: app1-0
         image: localhost/linux:8
         imagePullPolicy: Always
         securityContext:
          privileged: false
         command: [/usr/sbin/init]
         ports:
         - containerPort: 8080
           name: appport
         readinessProbe:
            tcpSocket:
              port: 8080
            initialDelaySeconds: 120
            periodSeconds: 30
            failureThreshold: 20
         env:
         - name: container
           value: "true"
         - name: applist
           value: "app2-0"

app2_sts.yaml

apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    cluster: appcluster
  name: app2
  namespace: app
spec:
  selector:
    matchLabels:
      cluster: appcluster
  serviceName: app2cluster
  template:
    metadata:
      labels:
        cluster: appcluster
    spec:
     containers:
       - name: app2-0
         image: localhost/linux:8
         imagePullPolicy: Always
         securityContext:
          privileged: false
         command: [/usr/sbin/init]
         ports:
         - containerPort: 8080
           name: appport
         readinessProbe:
            tcpSocket:
              port: 8080
            initialDelaySeconds: 120
            periodSeconds: 30
            failureThreshold: 20
         env:
         - name: container
           value: "true"
         - name: applist
           value: "app1-0"

Check the Statefulset

[root@oper01 onprem]# kubectl get all -n app
NAME             READY   STATUS    RESTARTS        AGE
pod/app1-0       0/1     Running   0               8s
pod/app2-0       0/1     Running   0               22s
NAME                        READY   AGE

statefulset.apps/app1       0/1     49s

statefulset.apps/app2       0/1     22s
kubectl exec -i -t app1-0 /bin/bash -n app
[root@app1-0 ~]# nslookup app2-0

Server:         10.96.0.10

Address:        10.96.0.10#53
** server can't find app2-0: NXDOMAIN
[root@app1-0 ~]# nslookup app1-0

Server:         10.96.0.10

Address:        10.96.0.10#53
** server can't find app1-0: NXDOMAIN
[root@app1-0 ~]#

I understand the behavior of the readiness probe and I am using it as it helps me to make sure service should not resolve to app pods if port 8080 is down. However, I am unable to make out how can I complete the configuration as app pods need to resolve each other and they need their hostname and IPs to configure. DNS resolution can only happen once the service has end points. Is there a better way to handle this situation?

I am trying to scan container images using the blackdock scanning tool. Unfortunately, I couldn't find any free version to play around with; please provide guidance and the simplest way to scan the docker images.

I have tried using this resource - https://github.com/blackducksoftware?q=docker&type=all&language=&sort= . Not able to install it.

I am trying to take a dictionary from one or more async tasks "register: task_variable" then collecting it as a list based on its id's and running a wait task using async_status on the resulting list generated from the id's

But i am getting an "Unexpected templating type error" with the Jinja "sync_do_list() takes 1 positional argument but 2 were given"

I've been trying various things for hours too many to remember and i just cant get past this

Here is the code in it's current form:

loop: "{{ (task_variable.results|default({}, true)) | selectattr('ansible_job_id') | map(attribute='ansible_job_id') | list([]) }}"

Some of the wait tasks add together multiple test_variables if multiple asyncs need to complete to proceed

Some of the tasks that generate the task_variables are wrapped in whens so may never generate a variable hence why i am doing a loop like that to be able to handle them all as appropriate

The code is on my work laptop so hard to get it over without manually typing it, but this is the only piece that really matters, any help would be appreciated. thanks.

Edit:

So to fix that error I had to change list([]) to list

The end result however is has been changed to

loop: "{{ [task1, task2, task3, task4] | selectattr('results', 'defined') | map(attribute='results') | selectattr('ansible_job_id', 'defined') | map(attribute='ansible_job_id') | list }}"

Where any of the tasks can be empty or undefined and they will get filtered out correctly but must remain as a list even if only checking one task

The resulting {{ item }} can be passed into an async_status and avoids having to check what is defined and what isn't via when statements and such.

Sorta, but the additional process it does is compilation of the source code (or linking to a jenkins agent that compiles the code). Then it can deploy the finished build to wherever you tell it. This could be just outputting the build to a network share, or it could be sending it to a virtual machine or docker container to run and test for bugs

The /etc/rancher/k3s/registries.yaml is read by https://devops.stackexchange.com/q/16152/18965 . You can validate it works properly with a command like this,

sudo k3s crictl pull     docker.io/alpine:3
sudo k3s ctr images pull docker.io/library/alpine:3

Continuous Testing is a https://en.wikipedia.org/wiki/Continuous_integration of Continuous Integration. CI's main purpose is to integrate your development efforts into a production-ready state as often as possible. The production-readiness is granted via continuously testing the recently integrated code. Continuous Integration does not work properly without Continuous Testing, but you could continuously test without making your development code production ready all the time. In my experience the CT term is not really in use anymore.

Issue got resolved with the use of https://www.jenkins.io/doc/pipeline/steps/file-operations/ methods like folderCreateOperation & fileCreateOperation. Example code snippet below:

def path = "${workspace}\submodule\newFolder"
fileOperations([folderCreateOperation(folderPath: path)])
dir(path) {
    fileOperations([fileCreateOperation(fileName: 'newFile.properties', fileContent: 'Git_Tag=${env.Git_Tag}')])
}

I recommend running all the dependent microservices on cloud and deploy only the microservice that is under active development in your laptop.

I have thousands of servers that, by default, for security and space do not create a $HOME when you ssh in.

This seems to be posing a problem for Ansible as it keeps trying to chdir to home that does not exist. Can I get Ansible to use another directory in the ansible.cfg or just stop this behaviour completely?

ansible.cfg

[defaults]
inventory      = /home/welshch/.ansible/hosts

remote_tmp     = /tmp

local_tmp      = ~/.ansible/tmp

interpreter_python = auto_silent

roles_path    = /home/eekfonky/.ansible/roles

host_key_checking = False

Here is the error with the server name changed for security reasons;

☁  .ansible  ansible-playbook get_fleet_info.yml -vvvv
fatal: [ldap-corp-search-server.com]: FAILED! => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    },
    "changed": false,
    "module_stderr": "OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017\r\ndebug1: Reading configuration data /home/eekfonky/.ssh/config\r\ndebug1: /home/eekfonky/.ssh/config line 2: Applying options for *\r\ndebug3: /home/eekfonky/.ssh/config line 9: Including file /home/eekfonky/.ssh/bastions-config depth 0\r\ndebug1: Reading configuration data /home/eekfonky/.ssh/bastions-config\r\ndebug1: /home/eekfonky/.ssh/bastions-config line 10: Applying options for *.corp.amazon.com\r\ndebug1: /home/ekfonky/.ssh/bastions-config line 35: Applying options for *.pdx*.server.com\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 58: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug2: mux_client_hello_exchange: master version 4\r\ndebug3: mux_client_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux_client_request_session: entering\r\ndebug3: mux_client_request_alive: entering\r\ndebug3: mux_client_request_alive: done pid = 27395\r\ndebug3: mux_client_request_session: session request sent\r\ndebug1: mux_client_request_session: master session id: 2\r\ndebug3: mux_client_read_packet: read header failed: Broken pipe\r\ndebug2: Received exit status from master 1\r\nShared connection to ldap-corp-search-server.com closed.\r\n",
    "module_stdout": "Could not chdir to home directory /home/eekfonky: No such file or directory\r\n",
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",
    "rc": 1
}

I have a user that needs to authenticate against a company source repository when using git clone. To set this up for the user I need to specify a users private key (not the host private key in /etc). Is there a method to do this?

The user it configured with https://cloudinit.readthedocs.io/en/latest/topics/examples.html?highlight=system_info#including-users-and-groups , which doesn't have a mechanism to install the user's private key.

Note: Let's say you're provisioning a a new machine and adding a user bob on it. How do you install a private key for a bob such that he can authenticate with something using ssh?