November 2022 Summaries

Continuous Integration and Delivery (CI/CD) are essential components of the DevOps framework, facilitating the transformation of code into live products through a series of best practices aimed at optimizing deployment pipelines. Tools like Jenkins and Octopus Deploy play crucial roles in this process, with Octopus focusing on simplifying complex deployments through Continuous Delivery. The adoption of Agile methodologies is emphasized for continuous collaboration and improvement, contrasting with traditional waterfall methods. Key practices include frequent code commits, the use of version-controlled code, and Configuration as Code, which enhance traceability and flexibility. Keeping builds "green" through dedicated deployment tools and automated testing is vital for agile and reliable software delivery. Additionally, strengthening feedback loops via telemetry data and using fit-for-purpose technologies are highlighted as crucial strategies. Security is paramount, with a focus on compliance and the creation of Software Bill of Materials (SBOMs) to meet regulatory demands. Overall, the post outlines eight best practices for leveraging CI/CD to enhance software development efficiency and reliability, with additional resources available in the DevOps engineer's handbook.

Navigating the challenges of adding a federated user account to an existing Elastic Kubernetes Service (EKS) cluster on AWS, this guide by Shawn Sesna outlines the necessary steps and considerations for achieving this integration. When working with EKS clusters created by different accounts, users often face restrictions in accessing detailed deployment resources unless they are added to the aws-auth config map. The guide explains how to create an EKS cluster using AWS CLI in Octopus Deploy and the importance of identifying the AWS role mapped to the federated account. It provides a detailed walkthrough of modifying the aws-auth config map to include federated user roles, emphasizing the need to format the {{SessionName}} correctly to avoid access issues. This process allows federated users to view cluster details, and although troubleshooting may be required for node group health issues, the guide aims to streamline the integration process for users facing similar challenges.

Octopus Server is phasing out support for custom-built authentication mechanisms by the end of 2023, a decision prompted by the complications and maintenance challenges associated with the existing server extensibility model introduced in Octopus 3.5. Originally implemented to accommodate customer-specific authentication requirements and simplify development, the extensibility model led to unintended complexities and maintenance burdens due to the dependency structures and architectural commitments that became difficult to change over time. While current custom extensions will continue to function with required recompilations for dependency updates, they will cease to work in future builds, prompting Octopus to consolidate customer-created modifications into official providers. Users with entirely custom integrations are encouraged to communicate their needs to Octopus to address potential gaps as the company prioritizes a streamlined, more robust authentication system with enhanced safety checks.

Mark Harrison's post discusses the integration of Octopus Deploy with HashiCorp Vault to manage sensitive values and secrets more efficiently. Octopus Deploy, which has supported sensitive variables since version 2.0, now offers step templates to facilitate secret retrieval from HashiCorp Vault, making it a certified HashiCorp partner. The post details the use of different authentication methods including LDAP, JWT, and AppRole, and explains how these methods can be implemented in Octopus Deploy processes via custom step templates. AppRole, recommended for automated workflows, is highlighted for its security practices like response wrapping to avoid storing sensitive information. The post also covers the retrieval of secrets through the Key-Value Secrets Engine, offering guidance on retrieving multiple secrets, handling namespaces, and using versioned secrets. By using these templates, Octopus users can enhance their deployment and runbook processes with secure and efficient secrets management, leveraging Vault's features without additional dependencies.

With the end of support for .NET Framework 4.5.2 and .NET Core 3.1, the Tentacle software is transitioning to .NET Framework 4.8 for its Windows installer and .NET 6 for all other applications, including the Windows Docker image. This change is necessary to ensure continued security updates and library support, with the plan to eventually move entirely to .NET 6. Users are advised to ensure their systems are compatible with the new frameworks, particularly those still using older versions of Windows, such as Windows 7 SP1 and Windows Server 2008 SP2. If upgrading is not possible, users should lock their Tentacle versions to maintain functionality. The full transition for the Windows installer to .NET 6 is expected by early to mid-2023, allowing users time to update their systems to compatible versions.

Kubernetes offers three types of services—ClusterIP, NodePort, and LoadBalancer—each catering to different network exposure needs for pods. ClusterIP services are ideal for internal communications within a Kubernetes cluster, providing the smallest exposure surface by allowing pods to interact without external access, suitable for components like databases. NodePort services extend this internal exposure by opening specific ports on each node, making pods accessible to external clients via these ports, although their use in production is limited due to firewall restrictions and the complexity of port-based URLs. LoadBalancer services build on NodePort by integrating with external network infrastructure, such as cloud providers' load balancers, to offer predictable URLs and advanced traffic management features, although they come with additional costs. Understanding these service types helps in selecting the appropriate method for exposing pods based on the specific requirements of internal communication, external access, or the need for scalable and flexible connectivity options.

Minikube enables DevOps teams to develop Kubernetes applications locally by providing a local Kubernetes cluster, and while it can download Docker images from external registries, deploying locally built images requires loading them into the minikube cluster. The process involves building Docker images, such as the sample Octopus underwater app, and pushing them to minikube using commands like `minikube image load`. Deploying these images requires a YAML configuration file that specifies deployment details, such as the image and image pull policy. It's crucial to understand the image pull policy, especially when using the "latest" tag, as the default policy may cause Kubernetes to attempt downloading a non-existent image from the Docker registry, resulting in an ImagePullBackOff error. To avoid this, the image pull policy should be set to "Never" or "IfNotPresent," or a specific image tag should be used to ensure proper deployment in the minikube environment.

A high severity vulnerability in OpenSSL versions 3.x was announced, but Octopus Deploy is unaffected as it relies on OpenSSL versions 1.x. This vulnerability impacts servers that validate client certificates, a process utilized by Octopus Tentacle to register with the Octopus Deploy Server. However, since Octopus Tentacle uses OpenSSL 1.x, it remains secure from this specific threat. The version in use by Octopus Tentacle is supported until September 11, 2023. Further information about the vulnerability is available on the Datadog blog.

Matthew Casperson's article from November 2, 2022, explores the process of bulk deleting Kubernetes resources, highlighting the use of the kubectl command for managing Kubernetes deployments. It details how resources can be efficiently deleted by utilizing the same YAML file used for their creation, and explains the significance of deployments in managing pods, where deleting a deployment also removes its associated pods. The article further delves into manual deletion methods using the --all argument, the impact of namespaces in organizing resources, and the use of labels for selective deletion. It also highlights the importance of the --dry-run argument to safely preview deletions, ensuring that bulk operations are conducted cautiously. Overall, the guide provides a comprehensive understanding of Kubernetes resource management, focusing on the efficiency and safety of bulk deletion operations.