RSS Feeds

Привет. Хочу разобрать один сумбурный кейс из поддержки Sentry-инстанса.

Проблема: Утро, как обычно. В Slack пишут разработчики: «Слушай, с Sentry что-то странное. Вроде работает, но issues не приходят». Смотрю, инстанс живой, но логов нет, новые issues действительно не создаются.

В прошлой статье была рассмотрена схема организации отопления и горячего водоснабжения (ГВС) отдельной квартиры с общим (и единственным) контуром циркуляции теплоносителя, основным источником тепла в виде индивидуального проточного газового водонагревателя (колонки или котла) и вспомогательным электрическим бойлером.

Configuring cloud-based environments is complex, as it requires considering networking, subscriptions, services, and all the components that make up the underlying infrastructure. Manual setup is error-prone, inconsistent, and difficult to reproduce.

This tutorial shows how to set up a fully automated cloud environment using GitLab as the main operations brain. All the cloud infrastructure is defined as code (hosted on GitLab) and deployed on AWS with OpenTofu through GitLab CI/CD pipelines. On top of this, these pipelines also handle the build and deployment of a real web application, using GitOps practices with Argo CD.

Why infrastructure as code and GitOps?

First, it is important to understand why infrastructure as code (IaC) and GitOps matter, and how GitLab brings these practices together in a single platform.

IaC ensures environments are:

• Reproducible: The same configuration can be deployed anywhere.
• Versioned: Every change is tracked in a Version Control System (VCS), with Git as the primary choice.
• Automated: No human interaction needed.

GitOps extends these principles into the application lifecycle. Instead of manually applying changes to Kubernetes clusters (or other infrastructure), the desired state of applications lives in Git. A GitOps operator like Argo CD continuously ensures the cluster reflects what is in the repository. This brings:

• Consistency between environments
• Faster recovery with rollbacks that are as simple as reverting a commit
• Better collaboration because teams can review and approve changes via merge requests
• Increased security through deployments that are performed without requiring direct access to the cluster by the developers

GitLab combines all the capabilities required for this approach:

• Source code management: Track infrastructure and application code in one place.
• CI/CD pipelines: Automate provisioning with OpenTofu and deployments with Kubernetes manifests.
• Terraform states: Store and manage infrastructure state files securely.
• Container Registry: Build, store, and manage container images next to the code and pipelines.

With GitLab, everything from provisioning cloud infrastructure to application delivery happens through one platform.

To follow this tutorial, you will need:

• Basic knowledge of GitLab CI/CD pipelines and Git
• Familiarity with iac (Terraform or OpenTofu) and GitOps
• An AWS account
• A Kubernetes cluster (EKS is provisioned in the tutorial)
• Dockerfile for the sample web application

This tutorial includes instructions to:

• Provision a complete AWS environment (networking, EKS) using OpenTofu
• Configure Kubernetes tools (Argo CD, CertManager) automatically
• Deploy a sample web application using GitOps principles with Argo CD
• Build and package a sample web application with GitLab CI/CD

Read on to learn how to reproduce this example in your own GitLab environment. You can find the source code of this example in the SATEC Public Demo Group.

Provision a complete AWS environment (networking, EKS) using OpenTofu

The first step is to provision the cloud infrastructure with OpenTofu (the open-source Terraform fork). We can declaratively define networking components and create an Amazon EKS cluster.

To make this process reproducible and secure, we rely on GitLab CI/CD variables instead of hardcoding values. These variables allow us to configure the AWS environment dynamically across pipelines.

The following environment variables are required and need to be declared under Settings > CI/CD > Variables in the parent group (to be inherited by all projects):

• TF_VAR_region: AWS region where the infrastructure will be created (e.g., eu-west-1)
• TF_VAR_instance_type: EC2 instance type for worker nodes (e.g., t3.medium)
• TF_VAR_instance_count: Number of worker nodes in the cluster
• TF_VAR_cluster_name: Name of the EKS cluster to provision
• AWS_ACCESS_KEY_ID: AWS access key for authentication
• AWS_SECRET_ACCESS_KEY: AWS secret key for authentication

All variables are defined as protected in GitLab, and sensitive ones such as the AWS secret access key are also masked, ensuring they are only exposed in secure CI/CD contexts. Security can be further enhanced by following this CI/CD variables tutorial. Separating code from configuration makes the pipeline both flexible and independent of environments.

Once configured, the OpenTofu pipeline can be executed automatically to:

• Provision networking resources (VPC, subnets, gateways, routing tables)
• Provision EKS control plane and worker node groups
• Trigger the pipeline to deploy Argo CD and CertManager into the new cluster

The diagram above illustrates how the infrastructure provisioning process works.

1. A GitLab pipeline is triggered from the infrastructure repository, which contains the Terraform/OpenTofu configuration files.
2. GitLab CI/CD executes the OpenTofu commands, using the integrated Terraform state backend to securely manage the state file in GitLab.
3. OpenTofu connects to AWS through configured providers to create all required resources: the VPC, subnets, gateways, load balancers, and the Amazon EKS cluster distributed across multiple availability zones.

At the end of this stage, the AWS environment and Kubernetes cluster are fully provisioned and ready to operate.

The final step of this process (post-deploy) is to trigger a secondary GitLab pipeline (located in a dedicated repository), which is responsible for deploying Argo CD and CertManager automatically into the new EKS cluster using the Helm Provider.

Configure Kubernetes tools (Argo CD, CertManager) automatically

Once the AWS infrastructure and the EKS cluster have been successfully provisioned, the next step is to configure the Kubernetes tools required to operate the environment, which are Argo CD, CertManager, and Ingress NGINX Controller.

This process is fully automated through a secondary GitLab pipeline hosted in a separate repository.

The execution of this second pipeline is triggered automatically from the infrastructure pipeline, using a trigger job once the OpenTofu provisioning stage has completed successfully.

In practice, this means that the deployment of these core components happens seamlessly as part of the same end-to-end workflow, there are no manual steps required. The deployment itself is handled by OpenTofu using the Helm provider, which allows managing Helm charts declaratively as code through GitLab.

A simplified workflow looks like this:

1. The first pipeline provides the EKS cluster and triggers the second one via a GitLab trigger job.
2. The second pipeline uses OpenTofu with the Helm provider to:
   • Download Kubeconfig from the EKS cluster.
   • Install Argo CD (for GitOps management).
   • Install CertManager (for automated TLS certificate management).
   • Install Ingress NGINX Controller (for ingress traffic routing). (Note: Ingress NGINX Controller is being deprecated in the Kubernetes ecosystem; for new deployments, it is recommended to consider alternatives such as Traefik or an API gateway-based approach.)
3. Each Helm release is defined in the OpenTofu configuration, allowing upgrades or rollbacks through standard infrastructure code changes.
4. Finally, a third pipeline is triggered to deploy the sample web application. This pipeline applies to the Argo CD application manifests that define the web app and its associated resources.

Deploy a sample web application using GitOps principles with Argo CD

Once all the core Kubernetes components (Argo CD, CertManager, and Ingress NGINX Controller) are installed, the final stage of the automation pipeline begins. This step is executed automatically right after the Helm chart installation process is completed.

A third GitLab pipeline is triggered, responsible for deploying a sample web application into the newly created EKS cluster through Argo CD.

The diagram below shows the overall process:

In this stage, GitLab uses the kubeconfig generated by OpenTofu to connect to the cluster and apply the Argo CD application manifests that define the desired state of the web application.

The pipeline:

• Downloads and updates the kubeconfig file to connect to the EKS Cluster.
• Updates credentials and repository information dynamically using CI/CD variables.
• Creates the Kubernetes namespace for the application (aws-summit-app).
• Applies the Argo CD manifests (repository.yaml, application.yaml, cluster-issuer.yaml).
• Creates a Container Registry secret to allow the application to pull images securely from GitLab using an access token.

All these actions are performed automatically through GitLab CI/CD, with no manual intervention.

Once the manifests are applied, the Argo CD controller detects them and synchronizes the application state with the repository, deploying the sample web page into the EKS cluster.

The result is a fully operational Kubernetes environment, where:

• Infrastructure is provisioned with OpenTofu.
• Cluster tools are installed declaratively with Helm.
• Applications are deployed and managed via GitOps using Argo CD.

This approach ensures end-to-end automation, traceability, and reproducibility, all managed by GitLab.

Build and package a sample web application with GitLab CI/CD

Before the application is deployed through Argo CD, it must first be built, containerized, and published to the GitLab Container Registry.

This process is managed through a dedicated CI/CD pipeline and follows a GitOps repository structure, where the source code and Kubernetes manifests are stored in separate repositories.

In this setup, the GitLab group is organized into two main sections:

• Apps/ contains the source code repositories for the applications.
  • Example: aws-summit-app/web holds the source code of the sample web page.
• Deployments/ contains the repositories with Kubernetes manifests for each application.
  • Example: aws-summit-app/web within Deployments defines the Kubernetes manifests to deploy the web page (deployment.yaml, ingress.yaml, service.yaml, etc.).

This separation enables a clean GitOps workflow because application code and deployment configurations are independent but remain synchronized through automation.

The CI/CD pipeline defined in the application repository automates the following tasks:

• Build and package: The pipeline compiles the source code and builds the Docker image using the provided Dockerfile.
• Publish to the GitLab Container Registry: The image is automatically tagged and pushed to the integrated GitLab Container Registry.
• Update deployment manifests: Once the image has been published, the pipeline executes a job that updates the image reference inside the corresponding deployment repository (under Deployments/aws-summit-app/web).

These are performed automatically by committing the new image tag or creating a merge request.

Once the commit or merge request is created, Argo CD automatically detects the change in the deployment repository and synchronizes the updated manifests with the Kubernetes cluster, ensuring that the new application version is deployed without any manual intervention.

Summary

This tutorial demonstrated how to build a fully automated cloud environment with GitLab as the central hub, achieving the goals we set out at the beginning: infrastructure that is reproducible, versioned, and automated. By combining OpenTofu for infrastructure provisioning, GitLab CI/CD for pipeline orchestration, and Argo CD for GitOps-based application delivery, teams can manage the entire lifecycle — from cloud resources to running applications — through a single platform.

As a GitLab partner with deep expertise in cloud infrastructure and DevSecOps practices, Clober (SATEC group) can help organizations implement similar automated environments tailored to their specific needs.

Note: This blog post is based on a live demo originally presented at AWS Summit Madrid 2025 by the Clober DevSecOps team (SATEC group).

Resources

• GitLab CI/CD components
• GitLab Container Registry
• GitLab-managed Terraform state management

The official talk is of the government acting with understanding and flexibility. But devastated lives tell another story

There is anger about the case of Joyce Thomas, a 78-year-old retired nurse who has lived in Sweden for 21 years. Her husband died there; her son, grandchildren and home are there. Yet she has been told to leave because her post-Brexit residence application was late. Her case is appalling and predictable – but far from isolated.

The Guardian has also reported on the plight of Horace Mason, 74, who faces being deported after a court ruling, despite having lived in Sweden for 25 years. This is sad but not surprising.

In her husband’s first term, her absences sparked conspiracy theories. This time, she is somehow keeping an even lower profile

Anyone seen a 56-year-old woman around lately? Tall, cinnamon blond hair, fond of a fancy hat and, to quote Vogue, occasionally dresses like a “freelance magician”. She goes by the name “Melania Trump” or “first lady”, and she appears to be missing again. According to an analysis by the Daily Beast, Melania has only made 38 public appearances this year – with the last being the World Cup final. She’s been MIA for about a month.

To be fair, this isn’t out of character. During her first stint in the White House, the first lady’s frequent absences sparked various conspiracy theories, including one that she had a body double. But it seems Melania is keeping an even lower profile during Trump 2.0. NBC reported on Monday that she’s done about half as many public events as she did at this point in Trump’s first term. A senior adviser told the outlet she “prioritises results over appearances”. I dunno about that. Her highest-profile public appearance this year was when she held a surprise press conference telling everyone not to speculate about her relationship with Jeffrey Epstein. This had the predictable result of getting everyone to speculate about her relationship with the dead sex offender.

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Задача звучит просто: выяснить, называют ли бренд ChatGPT, Claude, Perplexity, Gemini, Алиса AI и GigaChat, когда пользователь спрашивает совета или ответа у ИИ. На практике эта задача раскладывается на десятки технических решений, каждое из которых меняет результат в разы. Ниже устройство замера, формат хранения и три моих ошибки, которые обесценивают всю работу.

Рано или поздно в инфраструктуре появляется задача автоматического обновления TLS-сертификатов. В простом случае она решается установкой certbot: один домен, один сервер, cron-задание и дальше можно не вспоминать об этом годами.

Сложности начинаются, когда инфраструктура вырастает…

Понятие разработки без кода сегодня все чаще звучит в разговорах о будущем цифровых профессий. Это направление открыло дорогу в IT для людей, которые раньше не считали себя техническими специалистами, но хотели создавать продукты и решать задачи без углубления в кодинг. О том, как стать no-code специалистом и и какие возможности открыты для них на российском рынке, рассказала Яна Смирнова, разработчик студии визуализации данных AkademiaDev.

Анонс The Elder Scrolls 6 состоялся в далеком 2018 году, но игра-по-прежнему находится в активной стадии разработки. А значит, чтобы вернуться на Тамриэль, нужно запускать старый-добрый Скайрим, которому в ноябре исполнится уже целых 15 лет. 

Благодаря активному фанатскому сообществу и огромному количеству модов, вполне можно не только подтянуть графику пятой части, но и исправить многочисленные баги, усовершенствовать ИИ персонажей и оживить игровой процесс. Предлагаем вашему вниманию авторскую подборку модов, которая поможет вернуться к истории Довакина в обновленном исполнении.

• Two fans were wearing shirts with XX-XY message

• Another fan told to cover shirt supporting trans people

• League: ‘This should not have happened’

At least three fans were asked by WNBA security personnel to cover shirts that had messages about transgender women participating in women’s sports during Sunday’s game in Atlanta between the Dream and the Indiana Fever.

The league said in a statement Monday that the fans should have been allowed to wear the shirts.

It has been likened to a monster, an oil rig – and the Parthenon. Now, for its 40th birthday, the astonishing London landmark has joined the Open House festival, to grant admirers a rare look around the inside

In his 2012 book A New Kind of Bleak, the critic Owen Hatherley called it “monstrous, compelling” and utterly messed-up. Back in the 1980s, a then Prince Charles suggested it had been inspired by a North Sea oil rig. But none of this stopped it from becoming, in 2011, the youngest ever building to be given Grade I-listed status in the UK.

And now, as part of its 40th anniversary celebrations, the Lloyd’s building will open to the public for the first time since 2014 for one day only during London’s Open House festival. The iconic building in the heart of the financial district was designed by architect Richard Rogers to house the global insurance marketplace. Its futuristic facade has been a celebrated part of the City of London skyline since it opened in 1986, but the interior is rarely seen by the public. Visitor galleries with a view of the trading floor have long been shut for security reasons.

Platform set to launch later this year will enable loyalty card members to sell preloved Billy bookcases and Poäng chairs

• Business live – latest updates

Ikea is taking on eBay, Facebook Marketplace and Vinted with its own secondhand selling site in the UK.

The new platform, which will enable shoppers signed up to the Swedish company’s membership scheme to connect directly to one another to buy and sell pre-owned Ikea items locally, is due to launch in the next few months.

12 августа Сбер выпустил своего первого универсального ИИ-агента. Новость эта стала федерального уровня, т.к. про неё написал ТАСС! Более того, было заявлено, что это “первый в России автономный универсальный ИИ-агент”. Как основатель компании, которая запустила ИИ-агентов в феврале этого года на своем ядре, мне конечно же стало интересно протестировать решение от Сбера. Более того, в апреле этого года мы получили Грант от Яндекса на миллион рублей на токены моделей ИИ, и с этого месяца мы сделали поддержку моделей Alisa Ai LLM и Yandex GPT Pro, но это тема для отдельного поста.

 Итак, приступаем. Тестировать я начал 14 августа. У меня на счету cloud.ru лежало 293 рубля еще с проекта, который я делал в прошлом году. Я решил начать с подсказки “Расскажи, что ты умеешь” и просто кликнул на неё. Прошло почти 5 минут и чего-то ИИ-агент задумался. Я устал ждать и отошёл от компа. Скриншот прилагаю:

Уолтер Шлосс в течение 44 лет опережал индекс S&P 500 примерно на 5% в год. Он зарабатывал, покупая акции, которые большинство инвесторов бы проигнорировало. Это и есть стоимостное инвестирование. При таком подходе инвесторы ищут статистически дешёвые акции. Стоимость таких бумаг намного ниже материальных активов компании или её способности приносить прибыль.

Глубокое стоимостное инвестирование — это стратегия покупки непривлекательных и непопулярных акций. Затем следует выжидательная позиция. Почему эта стратегия эффективна и как на ней заработать?