Blog & Insights

$ sudo yum install python3 python3-pip git
$ pip3 install --user pywinrm ansible

$ cd ~

$ wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-client-linux.tar.gz

$ mkdir bin && tar -xvf openshift-client-linux.tar.gz --directory bin && mv bin/README.md ~/openshift-client-README.md

$ wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-install-linux.tar.gz

$ tar -xvf openshift-install-linux.tar.gz --directory bin && mv bin/README.md ~/openshift-install-README.md

$ ansible --version
ansible 2.10.2
config file = None
configured module search path = ['/home/ec2-user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /home/ec2-user/.local/lib/python3.7/site-packages/ansible
executable location = /home/ec2-user/.local/bin/ansible
python version = 3.7.9 (default, Aug 27 2020, 21:59:41) [GCC 7.3.1 20180712 (Red Hat 7.3.1-9)]

$ aws --version
aws-cli/1.18.107 Python/2.7.18 Linux/4.14.193-149.317.amzn2.x86_64 botocore/1.17.31

$ oc version
Client Version: 4.5.14

$ openshift-install version
openshift-install 4.5.14
built from commit 9893a482f310ee72089872f1a4caea3dbec34f28
release image quay.io/openshift-release-dev/ocp-release@sha256:95cfe9273aecb9a0070176210477491c347f8e69e41759063642edf8bb8aceb6

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.2-0-g52c56ce", GitCommit:"d7f3ccf9a5bdc96ba92e31526cf014b3de4c46aa", GitTreeState:"clean", BuildDate:"2020-09-16T15:25:59Z", GoVersion:"go1.13.4", Compiler:"gc", Platform:"linux/amd64"}

$ pip3 freeze
ansible==2.10.1
ansible-base==2.10.2
certifi==2020.6.20
cffi==1.14.3
chardet==3.0.4
cryptography==3.1.1
idna==2.10
Jinja2==2.11.2
MarkupSafe==1.1.1
ntlm-auth==1.5.0
packaging==20.4
pycparser==2.20
pyparsing==2.4.7
pywinrm==0.4.1
PyYAML==5.3.1
requests==2.24.0
requests-ntlm==1.1.0
six==1.15.0
urllib3==1.25.10
xmltodict==0.12.0

$ pip3 show pywinrm
Name: pywinrm
Version: 0.4.1
Summary: Python library for Windows Remote Management
Home-page: http://github.com/diyan/pywinrm/
Author: Alexey Diyan
Author-email: [email protected]
License: MIT license
Location: /home/ec2-user/.local/lib/python3.7/site-packages
Requires: xmltodict, requests, requests-ntlm, six

$ aws ec2 describe-regions
$ aws ec2 describe-availability-zones --region us-east-2
$ aws ec2 describe-availability-zones --all-availability-zones

$ aws configure
AWS Access Key ID [None]: YOURACCESSKEYID
AWS Secret Access Key [None]: YOURSECRETACCESSKEY
Default region name [None]: us-east-2
Default output format [None]: json

By Brad Johnson, Lead DevOps Engineer

When considering infrastructure automation Terraform and Ansible are usually brought up. Both do some things really well, but also have limitations. Terraform is an infrastructure as code tool, whereas Ansible is a configuration management tool that can also do infrastructure as code. I've had people ask about how the tools compare and which one to use and when, so let's explore these tools and talk about the benefits of each. 

First, why would you use Terraform? The single most important reason is that Terraform, like Ansible, is platform agnostic. This means that if you have a hybrid or multi cloud application or service, you can use terraform to manage the infrastructure in a single repository. Cloud vendor specific solutions like AWS CloudFormation templates work well, but they are limited to using within the platform they are available in. With Terraform's ability to support multiple providers, you can do things like managing the infrastructure code definition of on-premise and AWS/GCP/Azure Cloud VMs, load balancers, DNS, or network configuration in the same set of files. Using a single common configuration language means greater flexibility in transitioning to new environments and reducing vendor lock-in. Another reason you should consider using Terraform is that, unlike Ansible, it works on the principle of understanding the current vs desired state. This means that if you do something like deploy a VM via Terraform, then later delete that block of configuration, Terraform will delete the VM. So your Terraform code is declarative of your infrastructure. With Ansible you would need to write additional code to perform an operation similar to this, as Ansible is not aware of the state from previous runs. Another benefit of Terraform is that you can see what it will do before you run it by using the 'terraform plan' command. 

However, if you already have a significant amount of infrastructure deployed, it can be time consuming to import your current environment to manage under Terraform. You can use it for new deployments without importing existing environment configurations, however it won't be able to manage those existing resources. Terraform also stores the state of what was provisioned in a state file. This means that if there are multiple people working on the code then they must run it out of a single common location with the same state file. Cloud providers can use cloud storage buckets to store the state file. The ideal solution might be using a CI or Orchestration system to run the 'terraform apply' to deploy infrastructure changes, and gating the process via approvals in ITSM. It is critical to ensure actual changes are applied from a single source of truth, like a master git branch. Also, while Terraform is extensible with custom providers ,you will need to write them in Go, which is not yet as widely used as Python. 

Now let's look at why Ansible. The best thing about Ansible is that it can handle a wide variety of configuration and deployment tasks using standard modules and it's easily extensible with Python. You can deploy a VM, use templates in case of custom configuration files, communicate with REST APIs, interact with git repos, and easily configure Linux or custom software all using already available standard modules. Building your own custom Ansible modules, which typically isn't needed given the exhaustive Ansible library, requires minimal programming effort. An example 'hello world' module only requires 4 lines of Python code. Drop the code in a 'library' directory next to your playbook and you're ready to use it. Ansible also comes with 'ansible-vault' which provides a way to store sensitive variables in encrypted yaml files in your playbook repo, which can be decrypted at runtime using a vault password. Because of these features, you can easily implement a wide variety of use cases using Ansible to achieve configuration as code. Some example cases we've used Ansible for include deployment of Linux OS hardening changes to meet security standard compliance,  configuring Apache Tomcat and Oracle Weblogic as part of application server deployment, integrating with ITSM (IT Service Management) and CMDB (Configuration Management Database) platforms, and interacting with silent installers and CLIs using Keyva built custom modules like one for Python Pexpect. 

Now, given that Ansible does not store state of the resources, you will need to write playbooks to handle removal of resources. Meaning, even if you deployed something and Ansible made sure it was 'present', to remove it you would usually need to run the same function with the named resource as 'absent'. For simple things like removing a file, this is easy and you just need to remove the code after it is run once everywhere. For more complex use cases, you can get around this limitation by writing playbooks in a way that queries existing resources into variable lists, compares to what is in Ansible, then removes the items that do not match. However, this would take additional time, is more complex, and does not account for any changes that were made on target resources manually. From a configuration, compliance and remediation standpoint, this may actually be desirable for some organizations. 

What's great about both tools is that they can work with each other. There's no reason to believe that one tool needs to own the whole process. Given their differences in scope, while they can do similar things, they are in no way replacements for the full functionality of the other. Terraform can be set up to run Ansible on a host after provisioning to do the configuration of that host. Likewise, Ansible can use the Terraform module to plan or apply a Terraform project as a step within a playbook. The Ansible module for Terraform also returns the outputs from Terraform as variables that Ansible can consume and use for further action. When designing and implementing  infrastructure-as-code in your environment, it is important to consider which tool is best suited for each part of the task. It is also imperative to consider combining Terraform with Ansible when deploying infrastructure. If you need help getting started or advice on best practices around implementing infrastructure-as-code, please reach out to [email protected]. 

By Anuj Tuli, CTO

Many organizations that use PowerBI for business insights and analytics have a need to run their reports against various data sources, including workloads that they may have residing in Amazon AWS. There can be a number of various data sources configured for AWS; this blog walks through how to set up connectivity between PowerBI and AWS Aurora MySQL Database.  

Assumptions:  

• You have access to AWS Control Tower 
• You have an account for access PowerBI SaaS (powerbi.com) and to download the client 
• You have Administrator access to the Windows machine that we will use as our MS Data Gateway server within AWS.  

First, let's look at various configurations that we need to set up on the AWS side -  

• Create a new keypair specifically for this work. This is optional. You can choose to use an existing keypair for AWS access.  
• Create Aurora DB with Dev/Test template. This is optional. You can choose to use an existing DB cluster instance. 
• If you don't have a public internet gateway set up for the VPC, we will need to set one up.  
• Create RDS instance connectivity subnet (or leverage one directly inherited via the VPC) set up with the appropriate inbound connection. 
• If you plan on connecting to your Database instance from an external client (i.e. external to private AWS subnet), then you will need to make the Database publicly accessible. This can be done by going to your RDS console, selecting the database instance, select 'Modify' button, and enable 'publicly accessible' property under Additional Networking options. 
• Capture the endpoint name of the Database instance (Reader or Writer) under the Connectivity and Security tab from the RDS console. 

Next, we will configure the PowerBI components -  

• If you don't have an account already, sign up for PowerBI SaaS (powerbi.com)  
• We will spin up a new Microsoft Windows server (we used Server 2019, with .NET framework 4.7+) within our AWS EC2 environment. This Windows server will work as a jump box, as well as the MS Data Gateway that talks to PowerBI SaaS. The AWS keypair will be used to decrypt the Windows 'Administrator' password, so we will associate the public internet gateway with this machine, so we can RDP directly onto this box and download the following components: 
  • Download and install Visual Studio 2019 x64 redistributable (https://aka.ms/vs/16/release/vc_redist.x64.exe) 
  • Download and install MySQL 8.0.21 ODBC connector (https://dev.mysql.com/downloads/connector/odbc/) 
  • Download and install MS Data Gateway installer (https://go.microsoft.com/fwlink/?LinkId=2116849&clcid=0x409) 
  • Download and install PowerBI Desktop Client (https://www.microsoft.com/en-us/download/confirmation.aspx?id=58494) 
• Once the ODBC connector is installed, we will open up the console and add the data source under 'System DSN' tab. This is where we will be defining the connection to AWS Aurora MySQL Database. Click on 'Add' and enter the Database endpoint gathered from AWS, port (default 3306) and associated credentials. You also have the option to 'Test' the connection string. 
• If the Test connection is successful, you are now ready to configure the Gateway instance in PowerBI SaaS.  
• You can use the PowerBI Desktop Client to now create reports and publish them to your PowerBI SaaS tenant. Upon configuring the Gateway instance in PowerBI SaaS, you can also control the schedule for report generation from the Aurora Datasource. 

One of the most common ODBC errors we've seen is when the ODBC connector is unable to connect to the database. This usually happens either because the public subnet for the VPC is not associated with the Windows EC2 instance, or the public accessibility flag for the database is not set.  

If you have any questions or comments on the tutorial content above, or run in to specific errors not covered here, please feel free to reach out to [email protected] 

By Anuj Tuli, CTO

Organizations that have embarked on the journey to collecting and analyzing data are tasked with three distinct workstreams to achieve their goal – 1) Identifying the right data to capture, 2) Bringing data from various sources into the data warehouse, 3) Performing guided analysis on the captured data so as to derive meaning from it.  

A modern data warehouse platform helps bring these activities together, so that you can easily identify, capture and retrieve data from various sources, and provide visibility and reporting capabilities for chosen interpretation. Snowflake is built for data scientists and data engineers, and it supports modern data and applications that use as much unstructured data as structured data. 

Snowflake offers SaaS data warehousing services, and have also made available a number of connectors for data retrieval on their github here - https://github.com/snowflakedb. There is also a community page that provides hands-on exposure to the Snowflake platform, and other educational videos. More info here - https://community.snowflake.com/s/education-services 

Keyva provides services and offerings around Snowflake data warehousing platform. You can always reach our team at: [email protected] to request additional information. 

By Anuj Tuli, CTO

Kong recently announced the availability of its certified container-based Kong Enterprise on Red Hat Marketplace. You can find the press release announcement here. 

Kong Enterprise provides the ability to configure RBAC, includes enterprise wide support, and many other features, in addition to the agility and speed offered by the community version. Red Hat Openshift is one of the most widely used enterprise container platforms. With Kong's addition to Red Hat Marketplace, organizations that use Openshift can now leverage API abstraction capability natively as part of deploying their microservices based workloads, while managing the full lifecycle of deployed API layer (abstraction, monetization, reporting, throttling) via the Kong interface.  

Keyva has strategic partnerships with both Red Hat and Kong – and provides project managed deliverable based consulting services around Red Hat Openshift and Ansible offerings, as well as Kong Enterprise offerings. Keyva's IP offerings include certified ServiceNow integrations - for Openshift, as well as for Kong.  

By Anuj Tuli, CTO

ServiceNow recently announced the general availability of their latest Paris release. Highlights in this release include Process Automation Designer to manage your automation workflows through a single console, Predictive Intelligence Workbench which provides platform recommendations based on machine learning, and Playbooks for Customer Service Management to provide enhanced customer service processes.  

You can look up release notes for Paris release here - https://docs.servicenow.com/bundle/paris-release-notes/page/release-notes/family-release-notes.html 

Keyva is a Premier Partner of ServiceNow and has multiple "NOW" Certified integrations available on the ServiceNow store. You can find more about these integrations here. Our ServiceNow App for Red Hat Ansible Tower and ServiceNow App for Red Hat Openshift offerings are already certified against the latest Paris release. 

You can always reach our team at: [email protected] to request additional information. 

By Anuj Tuli, CTO

The Docker container engine is generally accepted as the de facto standard for container run times. Docker Enterprise is the supported enterprise option that provides container orchestration layer leveraging Kubernetes (or Swarm) and also supports highly-available and highly-scalable cluster architecture.  

Launchpad 2020 is an inaugural virtual event that covers technical sessions and other major announcements around the Docker Enterprise platform. The event will be help on 16th September 2020 – and is scheduled to reveal a new offering called Docker Enterprise Container Cloud. The technical tracks are categorized for Docker Enterprise, Operations and IT, and Developer focused talks.  

You can find the detailed agenda for this event here - https://mirantis.events.cube365.net/mirantis/launchpad-2020/agenda 

Keyva provides services and offerings around open-source Docker and Docker Enterprise platforms. You can always reach our team at: [email protected] to request additional information. 

By Anuj Tuli, CTO

Keyva announces the certification of their ServiceNow App for Red Hat OpenShift against the Paris release (latest release) of ServiceNow. ServiceNow announced its early availability of Paris, which is the newest version in the long line of software updates since the company's creation.  

Upon general availability of the Paris release, customers will be able to upgrade their ServiceNow App for OpenShift from previous ServiceNow Releases – Madrid, New York, Orlando – to Paris release seamlessly. 

You can find out more about the App, and view all the ServiceNow releases it is certified against, on the ServiceNow store here - https://bit.ly/2Z3uPJn 

$ sudo yum install python3 python3-pip git
$ pip3 install --user pywinrm ansible

$ cd ~

$ wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-client-linux.tar.gz

$ mkdir bin && tar -xvf openshift-client-linux.tar.gz --directory bin && mv bin/README.md ~/openshift-client-README.md

$ wget https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-install-linux.tar.gz

$ tar -xvf openshift-install-linux.tar.gz --directory bin && mv bin/README.md ~/openshift-install-README.md

$ ansible --version
ansible 2.10.2
config file = None
configured module search path = ['/home/ec2-user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /home/ec2-user/.local/lib/python3.7/site-packages/ansible
executable location = /home/ec2-user/.local/bin/ansible
python version = 3.7.9 (default, Aug 27 2020, 21:59:41) [GCC 7.3.1 20180712 (Red Hat 7.3.1-9)]

$ aws --version
aws-cli/1.18.107 Python/2.7.18 Linux/4.14.193-149.317.amzn2.x86_64 botocore/1.17.31

$ oc version
Client Version: 4.5.14

$ openshift-install version
openshift-install 4.5.14
built from commit 9893a482f310ee72089872f1a4caea3dbec34f28
release image quay.io/openshift-release-dev/ocp-release@sha256:95cfe9273aecb9a0070176210477491c347f8e69e41759063642edf8bb8aceb6

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.2-0-g52c56ce", GitCommit:"d7f3ccf9a5bdc96ba92e31526cf014b3de4c46aa", GitTreeState:"clean", BuildDate:"2020-09-16T15:25:59Z", GoVersion:"go1.13.4", Compiler:"gc", Platform:"linux/amd64"}

$ pip3 freeze
ansible==2.10.1
ansible-base==2.10.2
certifi==2020.6.20
cffi==1.14.3
chardet==3.0.4
cryptography==3.1.1
idna==2.10
Jinja2==2.11.2
MarkupSafe==1.1.1
ntlm-auth==1.5.0
packaging==20.4
pycparser==2.20
pyparsing==2.4.7
pywinrm==0.4.1
PyYAML==5.3.1
requests==2.24.0
requests-ntlm==1.1.0
six==1.15.0
urllib3==1.25.10
xmltodict==0.12.0

$ pip3 show pywinrm
Name: pywinrm
Version: 0.4.1
Summary: Python library for Windows Remote Management
Home-page: http://github.com/diyan/pywinrm/
Author: Alexey Diyan
Author-email: [email protected]
License: MIT license
Location: /home/ec2-user/.local/lib/python3.7/site-packages
Requires: xmltodict, requests, requests-ntlm, six

$ aws ec2 describe-regions
$ aws ec2 describe-availability-zones --region us-east-2
$ aws ec2 describe-availability-zones --all-availability-zones

$ aws configure
AWS Access Key ID [None]: YOURACCESSKEYID
AWS Secret Access Key [None]: YOURSECRETACCESSKEY
Default region name [None]: us-east-2
Default output format [None]: json