Repost from https://withinrafael.com/2018/10/09/napkin-notes-unblock-nvidia-control-panel-store-app/

"
I wanted to get an early look at NVIDIA's Control Panel app in the Microsoft Store and ran into the error: "Supported NVIDIA Driver is not installed on your system."
It appears this experience is currently bound to OEM machines, but can be turned on with a registry tweak.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm\FTS\EnableRID69527=0x1

"

Link to store https://www.microsoft.com/en-us/p/nvidia-control-panel/9nf8h0h7wmlt

through out the years python has grown up from an alternative to perl to a serioulsy powerful langugae. one that rivals all other langugages around, beacuse of its simplicity, ease to read, and downright extensible feautre set. because of this and just how dynamic the langauge is, its one of the languages i recommend to all sysdevs and devops personel to learn. one of the big reasons windows users stayed away form this was because of the non-native windows solutions. this no longer is an issue. python is just as first class on windows as it is on linux. To simplyfy alot of the setup i scrippted this out using chocolately (that reminds me. I think my script has gotten big enough that i really need to modularize it. More to come in the future)

for the direct link to the script
https://github.com/msanda/freshsystem/blob/master/chocolatelysetupscript.ps1

for those that want to know what i am doing stay tuned.

Set-ExecutionPolicy Unrestricted

Chocolatey

iwr https://chocolatey.org/install.ps1 -UseBasicParsing | iex
choco install github --force --force-dependencies -y
choco install git --force --force-dependencies -y
choco install poshgit --force --force-dependencies -y
choco install visualstudiocode --force --force-dependencies -y

python code editor. comment it out if you dont need it. i prefer vscode either way

choco install pycharm-professional --force --force-dependencies -y

to be installed if writing python specific code

choco install python --force --force-dependencies -y
choco install ctags --force --force-dependencies -y
python -m pip install --upgrade pip
pip install pylint

Make SSH directory in you user space

mkdir $env:USERPROFILE.ssh

restart Computer after everything has been installed

shutdown /r /t 0 /d P:0:0

All that happens above is to setup your environment to get python binaries and install on your local machine. once this is done just start your editor and install plugins..

Since i use vscode there are 3 plugins i use for python development.
Python extension
Code Runner
dev skim
auto pep

if you are using virtual environments then you will need to edit your user settings with

// Place your settings in this file to overwrite default and user settings.
{
"python.pythonPath": "${workspaceRoot}/venv/bin/python",
"python.formatting.formatOnSave": true,
}

these tools are all awesome and should get you setup with code coverage as well as linting. be sure to also select file -> Auto save. this will allow automatic code linting as you progress

Jenkins 1.x and 2.x offer 2 differnt views to the same issue. in jenkins 1.x you only had the jenksin view plugin. so you just write your work jenkisn pipeline and skip the stages.

for this case you have

import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
// .....
stage('I am skipped') {
    Utils.markStageSkippedForConditional(STAGE_NAME)
}

for jenkins 2.X you have the blueocean view which has conditions for skipped steps. so to skip a sage you simply have to wrap the stage in a "when" condition

stage('My Conditional Stage') {
    when {
        branch 'master'
    }
    steps {
        echo 'Do that only on master branch'
    }
}

dont ususally post these. but in using jenkins alot i have to come to appreciate some useful pipelines that i modify alot. here are some links to some very useful jenkinss "stuff"

https://github.com/HRMPW/pipeline-examples - Pipeline examples written in groovy

3 steps can be used to control a jenkins pipeline

Stage
Lock
Milestone

stage the stage step remains but is now focused on grouping steps and providing boundaries for Pipeline segments.

example

stage('Build') {
steps{
script{
startbuild()
sh "echo $PATH"
}
}
}
}

This creates a simple visualize view in "stage view" of your pipeline plugin called build. which executes the startbuild() function

Lock this step limits concurency to a single build

stage('Build') {
steps{
script{
startbuild()
lock('lockedresource'){
sh "echo $PATH"
}
}
}
}
}

Lock can be used for restricting steps in a stage or for wrapping multiple stages to a single run path.

milestone ensures that older builds of a job do not overwrite a newer build

example

Build 1 is triggered

Build 2 is triggered

Build 2 builds faster than Build 1 and enters the Test stage sooner.

Rather than allowing Build 1 to continue and possibly overwrite the newer artifact produced in Build 2, you can use the milestone step to abort Build 1:

stage('Build') {
milestone()
echo "Building"
}
stage('Test') {
milestone()
echo "Testing"
}

One of the craziest CI/CD tools out there is Jenkins. Now the reason why this tool is by far the most popular tool out there is that of how you can bend and break it to do things that it was never intended for. I have worked in organizations that have used Jenkins ask a CI tool, A Scheduler (cron box), and advance vault (credential injections), Build system etc. one the less know uses of jenkins is the Jenkinsfile usage. now, this was introduced in Jenkins 1.X as a plugin using and was formally introduced as the Jenkins workflow. in Jenkins 2.0 it was renamed to the jenkins pipeline.

so what is a jenkins file.
In its basic form is a Groovy script that is executed as several steps thereby creating a more intelligent dev CI/CD system.

So here is a simple jenkins file

pipeline {
    agent none 
    stages {
        stage('Example Build') {
            agent { docker 'maven:3-alpine' } 
            steps {
                echo 'Hello, Maven'
                sh 'mvn --version'
            }
        }
        stage('Example Test') {
            agent { docker 'openjdk:8-jre' } 
            steps {
                echo 'Hello, JDK'
                sh 'java -version'
            }
        }
    }

Using CloudFlare SSL with AWS and Azure

After a period of time of creating resources in either AWS or azure you will come to the point where you will need to use a SSL certificate. In this post, i will talk about how to use cloudflare's wildcard cert and how to import it into AWS and Azure for use in the respective clouds.

Cloudflare SSL setup

This is the easiest step of this process.
For a shared SSL cloudflare provides 1 free SSL cert per account. To claim your free ssl cert.

1. login to Cloudflare

2. Head to crypto, Scroll down to Origin Certificates and click create certificates.
   

3. From here generate an Origin certificate with private key of type PEM and continue with the setup

4. you will be present with a screen with an Origin certificate and Private Key. Copy these keys and treat them as passwords. once you hit ok on this screen you will not be able to get the data.

   • Copy the Origin cert and save as Origincert.pem
   • Copy the Private key and save as privatekey.key
   • Go to https://support.cloudflare.com/hc/en-us/articles/218689638-What-are-the-root-certificate-authorities-CAs-used-with-CloudFlare-Origin-CA- and Copy the Cloudflare Origin CA - RSA root to a file called cloudflare_certificatechain.pem

5. Open up a terminal ( Use Windows Subsytem for Linux or just upload the files and do this on a linux box)

   openssl pkcs12 -export -inkey privatekey.key -in Origincert.pem -name wildcard -out wildcard_withchain.pfx -certfile certificatechain_Cloudflare_origin.pem 
   

Enter a password to have greater security.

6. copy wildcard_withchain.pfx to the same directory as the other files above.

   note
   moving forward all sites that need the SSL key will need to have the cloud icon enabled in cloudflare. this allows cloudflare to verify and ssl Chain.

AWS import Certificate

1. Open up Aws in the browser and head to Certificate manager (https://console.aws.amazon.com/acm/home)
2. click on Import Certificate
   • for Certificate body copy the contents of Origincert.pem and paste in the field
   • for Certificate Private Key Copy the contents of privatekey.key and paste in the field
   • for certificate chain copy the contents of cloudflare_certificatechain.pem and paste in the field
3. Hit Review and Import.

Once verified you will see your certificate in the certificate manager and this can be used by your Load-balancer and other AWS resources

Azure

There are 2 ways to use certificates in Azure as of 8/23/2017 . The easy way and the harder way.

Easy way

1. Find the appservice of the WebApplication you want to Protect in the portal (Portal.azure.com)
2. Go to settings -> Custom domains
3. Click the + next to hostname and Associate the service with a custom domain name, and hit validate
4. Close the blade and go to settings -> SSL Certificates
5. Click upload certificate.
6. upload wildcard_withchain.pfx
7. click + next to Add binding
8. Select the hostname needed and the Certificate you just uploaded. Leave SSL type as SNI SSL

Hard Way

In this scenario We will be using the Azure Key vault. This allows us to do SSL key rotation. If the Newly uploaded ssl cert is the same name as the one already existing,all new deployments and existing deployment will pull down the new certificate. This allows you to change your SSL in one place instead of many.

while working with cloud providers one has to take extreme lengths with trying to be locked in. One of the areas that is extremely difficult to avoid lock-in, is with user management. Ther is nothing worse that working in one organization and having several different user accounts to get access to your cloud resources. so you really have 2 options at this point.

1. Suffer the management of 2 different IAM ( identity access management) services, and have cranky devs bothering you left and right to reset passwords
2. use a cloud SAML provider.

I choose to take on option 2 for the easy of management and access to online password resets. AKA things I don't want to waste my time on. Yes, you do lose a degree of freedom if you are going pure cloud IAM. but you also have much less late night calls.

For my solution, i decided to test the limits of Azure Active Directory. Yes i am perfectly aware i could have gone the other route and used Identacor (https://www.identacor.com), auth0 or gone native to Amazon clouddirectory or made the super far jump with Amazon cognito but since we have a bunch of local application and we use sql server at work anything Active directory base had my interest ( sorry SAML providers, but i will get back to you guys in a second).

So how does this work out..
Pretty simple actually. If you have an ldap directory or an Active directory on prem/or in the cloud. all you need to do is install an application that creates the sync between your on prem with the cloud.

In the next blog series, i will be talking about the gotcha and why in some cases the free version of Azure active directory is all you need.

You can pipe any file or output into your clipboard using the command clip ( for CMD) and set-clipboard ( for powershell).

This is stupid handy for the crazy situations such as piping the output of a file to your clipboard and pasting in a word doc or blog post

clip < testme.txt

or

get-content "c:\testme.txt" - Totalcount 50 | set-clipboard

The above powershell command gets the first 50 lines of text from testme.txt and saves it to the clipboard.

install chef on windows via winrm to (ssl over winrm 5986)

knife bootstrap windows winrm ncsqldr.cloudapp.net --winrm-user --winrm-password '<password>'--node-name ncsqldr --winrm-transport ssl --winrm-port 5986

install chef on windows via winrm. currently there is an issue with verifying ssl certs that were created for the domain you are registered to ( typically if you create a vm in azure or aws) so we are going to use use the non ssl

knife bootstrap windows winrm <Windows Address> --winrm-user <username> --winrm-password '<password>' --node-name ncsqldr --winrm-port 5985 -r "role[<orgname>-windows]"

install chef on linuux via ssh

knife bootstrap <linuxaddress> --ssh-password '<password>'--ssh-user <username>--node-name cortexnodeapp --run-list "role[<orgname>-cortex]" --use-sudo-password  --ssh-port 6022 --sudo

install chef on linuux via ssh using public key

knife bootstrap <linux address> -i "C:\Users\Mak Sanda\OneDrive\mak_linux" --ssh-user <username>--node-name cortexpythonapp --run-list "role[<orgname>-cortex]" --use-sudo-password  --ssh-port 7022 --sudo

https://supermarket.chef.io/ - to get new publicly availble recipes

Upload users via knife to server

knife data_bag from file users data_bags\users\

upload admins via knife to server

knife data_bag from file admins data_bags\admins\

Create Databag for users

mkdir data_bags/users
knife data bag create users
Create your <username>.json files

Admin

mkdir data_bags/admins
knife data bag create admins

Use knife to encrypt passwords in a role

knife encrypt password --search "role:web_server" --username "install" -- password "password" --admins "install, mak"

Create a cookbook

cd ~/chef-repo
knife cookbook create <cookbook_name>

upload cookbooks

cd to directory
knife cookbook upload --all

To upload a specific cookbook

cd to cookbooks
knife cookbook upload <cookbookname>

upload roles

cd to roles directory
knife role from file .\<nameofrole>.rb

to list all roles on servers

knife role list

Change into the chef-cookbooks directory on your Workstation:

cd ~/chef-cookbooks

git checkout the master branch:

git checkout master

Pull the latest code:

git pull

git checkout the v4.2.1 tag:

git checkout v4.2.1

Initialize your local configuration file:

git submodule init

Sync the submodules:

git submodule sync

Fetch all data from the submodules:

git submodule update

This is optional, but to ensure only the latest cookbooks are used, delete all of the current cookbooks (only perform this on a Chef Server dedicated to Rackspace Private Cloud):

knife cookbook bulk delete .

This is optional, but to ensure only the latest roles are used, delete all of the current roles (only perform this on a Chef Server dedicated to Rackspace Private Cloud):

knife role bulk delete .

Upload cookbooks to the Chef Server:

knife cookbook upload -a -o cookbooks

Upload roles to the Chef Server:

knife role from file roles/*.rb

Just started so this will take some time to update