#announcements - June 2018

569 messages

This channel is for workspace-wide communication and announcements. All members are in this channel.
Archive: https://archive.sweetops.com

June 2018
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) has joined the channel
Bot
Botover 8 years ago
@Bot has joined the channel
chris
chrisover 8 years ago
@chris has joined the channel
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@Andriy Knysh (Cloud Posse) has joined the channel
wookasz
wookaszover 8 years ago
@wookasz has joined the channel
erik
erikover 8 years ago
set the channel topic: Cloud Posse Open Source Community
tamsky
tamskyover 8 years ago
@tamsky has joined the channel
tamsky
tamskyover 8 years ago(edited)
anyone else have trouble in their terminal with the selected glyphs in the prompt?
- https://github.com/cloudposse/geodesic/blob/master/rootfs/etc/profile.d/prompt.sh#L32-L35
tamsky
tamskyover 8 years ago

  WHITE_HEAVY_CHECK_MARK=$'\u2705 '
  BLACK_RIGHTWARDS_ARROWHEAD=$'\u27A4 '
  TWO_JOINED_SQUARES=$'\u29C9 '
  CROSS_MARK=$'\u274C '
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, it's unfortunately a bug we haven't solved
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
it's a combination of usign UTF8, prompts and terminals
tamsky
tamskyover 8 years ago
I've tried quite a few fonts in xterm 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i think most of us use iTerm2, but there are still some problems
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(OSX thing)
tamsky
tamskyover 8 years ago
what are the goals behind the glyphs ?
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: image.png
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
to visually communicate information like the powerline shell for zsh/bash
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I suppose we could create a non-fancy mode
tamsky
tamskyover 8 years ago
currently, the non-printing glyphs disturb readline, so history editing gets confused
tamsky
tamskyover 8 years ago
ok, I'll offer a non-unicode set of glyphs in a PR soon
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that would be awesome!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I know a few who would appreciate it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
wow, I think you might have helped me find the answer though
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we already use \[,\] in the PS1 , but maybe we need to throw in some \001, and \002 in there too 😃
Mike Crowe
Mike Croweover 8 years ago
@Mike Crowe has joined the channel
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
welcome @Mike Crowe! 😃
tamsky
tamskyover 8 years ago
yeah, but for you, they're printing, and for me they're not, so use of \[ won't help 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
hrm
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
can you send me a screenshot?
tamsky
tamskyover 8 years ago
@tamsky uploaded a file: image.png
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
oh wow, yea, that's bad
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: image.png
tamsky
tamskyover 8 years ago
I understand, but my guess is, iTerm is actually choosing a different font for rendering unicode glyphs, and the font in use for your terminal doesn't actually include those codepoints.
tamsky
tamskyover 8 years ago
which isn't something that most terminal programs can do (least among them: xterm)
tamsky
tamskyover 8 years ago
I'll admit it works in iterm, I tried it... I just can't use it.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
i agree we should offer a mode that does require it.
tamsky
tamskyover 8 years ago
ok, great, I'll do the work
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
🙏
tamsky
tamskyover 8 years ago
you got inputrc, readline and bash questions, I got answers.
tamsky
tamskyover 8 years ago
redirecting file descriptors in bash is still a head scratcher for me though
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, i'll never remember the syntax for that
tamsky
tamskyover 8 years ago

  [ -n "${UNICODE_PROMPT_DISABLED}" ] && {
      WHITE_HEAVY_CHECK_MARK=$'\u2705 ' ;
      BLACK_RIGHTWARDS_ARROWHEAD=$'\u27A4 ' ;
      TWO_JOINED_SQUARES=$'\u29C9 ' ;
      CROSS_MARK=$'\u274C ' ;
  } || {
      # these use 8859-1 codepoints:                                                                      
      WHITE_HEAVY_CHECK_MARK=$'X ' ;
      BLACK_RIGHTWARDS_ARROWHEAD=$'-> ' ;
      TWO_JOINED_SQUARES=$'¤ ' ;
      CROSS_MARK=$'× ' ;
  }
?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Let’s use something more generic. For example, PROMPT_STYLE=plain
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
As for the bash logic, please use standard if/then rather than pipeline notation
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Feels like we’re introducing technical debt if we repurpose the current variables.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I can take a look at it later tonight. Currently afk.
Mike Crowe
Mike Croweover 8 years ago
@tamsky
redirecting file descriptors in bash is still a head scratcher for me though

This one still doesn't click for me:
exec 1> >(logger -t process-psv) 2>&1
Mike Crowe
Mike Croweover 8 years ago
I get it in principle, but I always have to lookup how to do it
sarkis
sarkisover 8 years ago
@sarkis has joined the channel
Mike Ballou
Mike Ballouover 8 years ago
@Mike Ballou has joined the channel
Robert Tisdale
Robert Tisdaleover 8 years ago
@Robert Tisdale has joined the channel
Alex Perelman
Alex Perelmanover 8 years ago
@Alex Perelman has joined the channel
Dave Yu
Dave Yuover 8 years ago
@Dave Yu has joined the channel
yurchenko
yurchenkoover 8 years ago
@yurchenko has joined the channel
Evan Petrie
Evan Petrieover 8 years ago
@Evan Petrie has joined the channel
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@tamsky I had a long chat with @Mike Crowe today. lots of great feedback. one of the things that came up was using a dotfile manager. You recently shared your dotfiles. is this something you would use?
tamsky
tamskyover 8 years ago
I'd need to understand what the "dotfile manager" would do?
tamsky
tamskyover 8 years ago
w.r.t. geodesic and friends
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so there's a convention/interface for adding shell customizations (E.g. aliases, prompts, etc)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
tamsky
tamskyover 8 years ago
conventions would be awesome. the lack of .inputrc in the current geodesic has me adding
ADD <https://raw.githubusercontent.com/play-with-docker/play-with-docker/master/dockerfiles/pwm/.inputrc> /conf/.inputrc
to many sub-Dockerfiles
tamsky
tamskyover 8 years ago
I think the interface is the important part
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i'm actually not familiar with .intputrc, which is probably why it's not there 😃
tamsky
tamskyover 8 years ago
I'm trying to figure out how I'd set some default for PROMPT_STYLE in my OSX shell that would get honored in geodesic shells
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
consider passing --env-file?
tamsky
tamskyover 8 years ago
I know I heard once here in slack that someone wanted $PWD mapped into their geodesic shell.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
could also introduce something like a ~/.geodesic/env file
tamsky
tamskyover 8 years ago
sure, have the docker run wrapper test for the file ~/.geodesic-env and add the flag --env-file ~/.geodesic-env if it exists
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Mike Crowe added this to track it: https://github.com/cloudposse/geodesic/issues/148
sarkis
sarkisover 8 years ago
also @Mike Crowe if you don't mind making an issue around the region issue from yesterday... I do want to take a look but it's looking more like this weekend the earliest
sarkis
sarkisover 8 years ago
sorry for delay on that 😞
Mike Crowe
Mike Croweover 8 years ago
@sarkis -- actually, I needed to ping @Andriy Knysh (Cloud Posse) instead of you. It was his repo
sarkis
sarkisover 8 years ago
ah ok - i still don't mind looking into it... if he can't get to it
Mike Crowe
Mike Croweover 8 years ago
Ah, @Andriy Knysh (Cloud Posse) replied in the other channel with some feedback. I'll get it setup and submit a PR with his feedback
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
sarkis
sarkisover 8 years ago(edited)
to be clear i was referring to: >@sarkis Ran into an interesting situation today. Using Cognito, it needs certificates in us-east-1 in order to be used for the auth domain. We're in us-east-2, so I'm going to have to: ...
Mike Crowe
Mike Croweover 8 years ago
right
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
ah, @Jamie replied to that
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
in the other channel
sarkis
sarkisover 8 years ago
ah yea reading over that code - looks like thats it @Andriy Knysh (Cloud Posse) 🙂 - yep @Mike Crowe just referenced that - going to get us a PR soon 👍️
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
yea it’s a nice way to do it, specify two providers with alias
provider "aws" {
  region = "us-east-2"
}
provider "aws" {
  alias  = "east"
  region = "us-east-1"
}
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
we use us-west-2 too for all other stuff
Mike Crowe
Mike Croweover 8 years ago
For @tamsky and @Erik Osterman (Cloud Posse) -- .inputrc, prompt and all this fall under this rubric of "dotfile" management. IMO, the way to approach this is:
* Move any files that are "user breakable" from /etc/profile.d into a cloudeposse/geodesic-dotfiles (which has the default configuration for environment, prompt, anything shell related)
* Dockerfile for geodesic has something like:

ENV USER_HOME=<https://github.com/cloudposse/geodesic-dotfiles>
RUN curl -fLo /usr/local/bin/yadm <https://github.com/TheLocehiliosan/yadm/raw/master/yadm> && chmod a+x /usr/local/bin/yadm
RUN cd /conf && yadm clone $USER_HOME

* This would put the user in control of their bash setup -- they could clone the "breakable" dotfiles from cloudposse/geodesic-dotfiles and then add their custom settings
Mike Crowe
Mike Croweover 8 years ago
though I'm sure once I try to implement this I'll find some holes in that logic
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, something along those lines...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
could you add that to the issue? @Mike Crowe
Mike Crowe
Mike Croweover 8 years ago
Yeah
tamsky
tamskyover 8 years ago
personally I don't think we need a dotfile manager
tamsky
tamskyover 8 years ago
I put it under the rubric of "homedir" management
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
what I don't like about homedir management is consistency
tamsky
tamskyover 8 years ago
I see what you're getting at
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
it's like an escape hatch
tamsky
tamskyover 8 years ago
if I don't want to make my homedir git repo public, then here be demons
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
should only be used when knowing what you're doing.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, true
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
cloning git private repos in docker no fun
tamsky
tamskyover 8 years ago
especially using some 3rd party "manager" 😃
tamsky
tamskyover 8 years ago
I'm pretty certain alias commands will want to enter the mix as well at some point.
Mike Crowe
Mike Croweover 8 years ago
yadm = git (but the .git directory is offset from your home directory).
yadm clone [repo]
yadm add .inputrc
yadm commit
yadm push
etc
tamsky
tamskyover 8 years ago
I already have a git repo
Mike Crowe
Mike Croweover 8 years ago
But, I'm not planning on putting my home directory in geodesic. But my aliases, maybe some other helpers, yea
sarkis
sarkisover 8 years ago
i guess my Q would be - when would we want to do something more than just terraform plan/apply or like chamber cli commands in geodesic.. since it mounts your homedir to /localhost - i can do most things outside of the container
Mike Crowe
Mike Croweover 8 years ago
Here's a flavor:

 $ yadm ls
Commit: 4d4ee021adb12c3c147f69dc0979f00094456c08 (HEAD -> master)
Author: Mike Crowe <drmikecrowe@gmail.com>
Date:   2018-04-06 22:20:14 -0400 (10 weeks ago)

Latest changes

 .aws/config                                  |  11 ++++++
 .bash-custom/bash-it.sublime-project         |  11 ++++++
 .bash-custom/bash-it.sublime-workspace       | 339 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 .bash-custom/custom.aliases.bash             |   2 +-
 .bash-custom/environ.bash                    |   4 +-
 .bash-custom/functions.bash                  |   7 ----
 .bash-custom/history.bash                    |   2 +-
 .bash-custom/nvm.bash                        |   2 +-
 .bash-custom/rerun.bash                      |   2 +-
tamsky
tamskyover 8 years ago

what I don't like about homedir management is consistency

vs
it's like an escape hatch

should only be used when knowing what you're doing.


I'm pretty sure we can't have both consistency and escape hatches
tamsky
tamskyover 8 years ago
I'll rejoin the conversation in a couple hours. Good luck to us
Mike Crowe
Mike Croweover 8 years ago
So, for my local development, I have a pretty extensive .bashrc that configures a bunch of stuff. However, there's a case to be made for those guest systems (like geodesic, remote ssh logins, etc), maybe that needs to be a public gist or something different
tamsky
tamskyover 8 years ago

ENV USER_HOME=<https://github.com/cloudposse/geodesic-dotfiles>
RUN curl -fLo /usr/local/bin/yadm <https://github.com/TheLocehiliosan/yadm/raw/master/yadm> && chmod a+x /usr/local/bin/yadm
RUN cd /conf && yadm clone $USER_HOME

@Erik Osterman (Cloud Posse) I guess this reminds me that I've been wondering how/what you expect geodesic users to handle geodesic -- as a template that individuals and organizations modify and then use internally, a stepping off point, so to speak.... or
more as a common central starting point for all things in the CP ecosystem?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I've seen both. I think inheriting from our "base image" is a great start, but anticipate that as a company's usage increases, that they'll eventually "hard fork" and have their own base.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
organizations with a sizable ops team may prefer to manage their own.
Jeremy G
Jeremy Gover 8 years ago
@Jeremy G has joined the channel
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Jamie Nelson (BitFlight) has joined the channel
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Erik Osterman (Cloud Posse) you May have noticed the two new alerts repos I put in.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
They are 90% done codewise. Needs readme done.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I’m going to rename all the repos so that the alert subject is last. So that they sort nicely.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
And in the latest repos I’ve added ‘additional endpoints’ variables
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So instead of only having an sns topic, you can pass in autoscaling groups as endpoints, or lambda functions as endpoints.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So I’ll add that feature to the others too
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
thanks sweet!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Mike Crowe was just telling me that tackling cloudwatch alerts of the type you’re creating are next up on his list of things todo
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
thanks @Jamie Nelson (BitFlight)! do you want us to review anything yet?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I’m doing a demo of them to my client next week, so I should have the code to 100 by Tuesday. I’ll do my pull requests then. :)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Mike Crowe if you put yours off till next week I’ll have the template sorted. And we can both continue making alerts modules
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
The alerts modules are for:
Awareness - such as slack.
Automation- such as asg scaling
Deployments- such as rolling back a codedeploy if the alert is triggered on a new version
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I’ll do a push to my branches in a moment so you can see what’s been done
LeoGmad
LeoGmadover 8 years ago
@LeoGmad has joined the channel
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
@Erik Osterman (Cloud Posse) and @Mike Crowe and the rest, I'm wanting to do a training day for my clients engineering team
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
I've just written this up today
Purva
Purvaover 8 years ago
@Purva has joined the channel
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
If anyone wants to use it you're welcome, and if anyone has any good inputs for it, please let me know.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that’s cool
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we’re starting to do more training. we’ll need to develop more materials like this.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
@Purva, @chris have you guys tried/started doing any terraform training?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Jamie Nelson (BitFlight) looks like a good start. Inevitably, a big project you’re taking on to teach this stuff.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Totally big job. I need to get their team of 14 introduced to what Terraform can do.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I don't need to train to pro level. But I do need to get them thinking about what they can accomplish with Terraform
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Day one is being filled out, and will likely need more READMEs
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Day two is taking a more real world example, and working through that.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
In this case it will be creating a CI/CD pipeline for Serverless deployments
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
With updating a lambda function, and API Gateway, and doing a rolling deploy with monitored events which would cause roll back.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Once training week is done, i'll be back to the modules...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
would love to incorporate something like this eventually into docs.cloudposse.com
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
One more fargate tip: no more than 20 tasks running per account per region
tamsky
tamskyover 8 years ago

which can be changed
tamsky
tamskyover 8 years ago
have you tried requesting a limit increase, or is that already on your path forward?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Hasn’t affected me yet. Eric and @sarkis have been working on an ecs fargate module for a client, so I was hoping to point it out!
sarkis
sarkisover 8 years ago
@Jamie Nelson (BitFlight) thanks!
sarkis
sarkisover 8 years ago
i bet they'd raise the limit like any other - just depends if you have biz level support on how quickly they get around to it 🙂
sarkis
sarkisover 8 years ago(edited)
highly recommend this for clients that have business level+ support btw: https://aws.amazon.com/premiumsupport/trustedadvisor/ - one of the things it does is track if you get close to service limits
sarkis
sarkisover 8 years ago(edited)
Other useful info includes reserved instance allocation and idle ebs volumes
Mike Crowe
Mike Croweover 8 years ago
Hey guys, I'm finding a need to document a geodesic module for internal use. For example, the inputs needed, but also I need to export the outputs from the modules included. For example:

module "ecs_alb_service_task" {
  source                    = "git::<https://github.com/cloudposse/terraform-aws-ecs-alb-service-task.git?ref=0.1.0>"
...


However, I typically want the outputs of this alb in my state, so I need to re-output the CP module's output like this:

output "app_service_name" {
    value = "module.ecs_alb_service_task.service_name"
    description = "ECS Service name."
}

Check this out: https://gist.github.com/mike-zipit/fa936438c1edbb5f26ba68eec1cffaf8
This is WIP, but would like to validate if this is a need others see
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Looks in line with some of things we are doing for readme generation
Mike Crowe
Mike Croweover 8 years ago
@sarkis do you have a minute? I'm trying to use terraform-aws-ecs-alb-service-task but having a weird problem
sarkis
sarkisover 8 years ago
sure whats up
Mike Crowe
Mike Croweover 8 years ago
So, using terraform-aws-ecs-alb-service-task, the nginx container deploys and comes up (I see the default page). However, when my custom container deploys, it ends up dying
sarkis
sarkisover 8 years ago
anything in the ECS service logs/container output?
Mike Crowe
Mike Croweover 8 years ago
what's strange is I think it's a health check
Mike Crowe
Mike Croweover 8 years ago
@Mike Crowe uploaded a file: image.png
Mike Crowe
Mike Croweover 8 years ago
I've ssh'd into the container (fixed various environment/permission issues I had), and I can run the container manually on the ECS host with docker run .....
sarkis
sarkisover 8 years ago
does it go into a loop of starting/stopping the container?
Mike Crowe
Mike Croweover 8 years ago
yep
sarkis
sarkisover 8 years ago
i think you are right in that it sounds like the scheduler is giving up after failed healthcheck threshold and just keeps trying to start a "healthy" container
Mike Crowe
Mike Croweover 8 years ago
I've bumped up the timeout on the alb:

  health_check_timeout  = 20
  health_check_interval = 30
Mike Crowe
Mike Croweover 8 years ago
Plus, my target groups look like this in the EC2 console:
Mike Crowe
Mike Croweover 8 years ago
@Mike Crowe uploaded a file: image.png
Mike Crowe
Mike Croweover 8 years ago
(the healthy one is the nginx controller -- the others are failed deployments of my container)
sarkis
sarkisover 8 years ago
do you have your target group tf resource handy?
sarkis
sarkisover 8 years ago
i ran into something similar when i wasn't pointing my target resources to the right healthcheck endpoint
sarkis
sarkisover 8 years ago
endpoint/port
Mike Crowe
Mike Croweover 8 years ago
@Mike Crowe uploaded a file: image.png
sarkis
sarkisover 8 years ago
and the above unhealthy status seems to reaffirm this is where the issue is...
Mike Crowe
Mike Croweover 8 years ago
oh, traffic port -- is this supposed to be ip?
sarkis
sarkisover 8 years ago
what is on that custom container?
sarkis
sarkisover 8 years ago(edited)
i dont think there is any http server on your custom container*
Mike Crowe
Mike Croweover 8 years ago
a microservice. if you GET /, it returns a JSON document of the status
sarkis
sarkisover 8 years ago
ah ok... i think i know something else to look into.. does this container take a bit to load?
Mike Crowe
Mike Croweover 8 years ago
yeah, it does
sarkis
sarkisover 8 years ago
so there is a grace period
sarkis
sarkisover 8 years ago
before ECS will start considering failed healthchecks as unhealthy
Mike Crowe
Mike Croweover 8 years ago
ah, good point.
sarkis
sarkisover 8 years ago
let me find it
sarkis
sarkisover 8 years ago(edited)
startPeriod
The optional grace period within which to provide containers time to bootstrap before failed health checks count towards the maximum number of retries. You may specify between 0 and 300 seconds. The startPeriod is disabled by default.
sarkis
sarkisover 8 years ago
that's my guess right now - is that the container is taking a bit to start.. healthchecks failing and getting into a loop there
sarkis
sarkisover 8 years ago
sarkis
sarkisover 8 years ago
which reminds me to fix the README on that ^ 😛
Mike Crowe
Mike Croweover 8 years ago
well, i don't think that's in the terraform-aws-ecs-alb-service-task module yet, is it?
sarkis
sarkisover 8 years ago
sarkis
sarkisover 8 years ago
i'm in the process of cleaning this all up and things may change 😞 - but all that module does is allow you to create a json doc out of terraform code - it's not required to use it ... you can just modify your .json for the container_definition_json
Mike Crowe
Mike Croweover 8 years ago
btw, did you see the issue I submitted about the environment variables? I had to just use pure .json files because I couldn't pass environment variables in
sarkis
sarkisover 8 years ago
did not, until now.. I just assigned to myself and will reproduce and see if we can workaround that
sarkis
sarkisover 8 years ago
lmk if the startPeriod fixes your issue - now I'm 🤔 about it
Mike Crowe
Mike Croweover 8 years ago
testing it now
Mike Crowe
Mike Croweover 8 years ago
BTW, another thin I ran into but didn't report yet is this: we need the ability to customize the task security policy (we needed to grant permissions to SSM with a specific arn). I hacked it like this in the module (it's not ideal, but I think you get the idea):

data "aws_iam_policy_document" "ecs_execution_role" {
  source_json = "${var.custom_policy_document}"

  statement {
    sid       = "vLMpjauEwiCGsAJ9tJKsbSgn"
    effect    = "Allow"
    resources = ["*"]

    actions = [
      "ecr:GetAuthorizationToken",
      "ecr:BatchCheckLayerAvailability",
      "ecr:GetDownloadUrlForLayer",
      "ecr:BatchGetImage",
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
  }
}
sarkis
sarkisover 8 years ago
hmm yea that makes sense and should be an option to pass in our own existing or managed security policy (if not provided then generate)
sarkis
sarkisover 8 years ago
would you mind opening an issue @Mike Crowe if not, I can 🙂
Mike Crowe
Mike Croweover 8 years ago
I'll do it later today if that's ok
sarkis
sarkisover 8 years ago
that works - i don't know if i can get to anything today - so would be tomorrow at the earliest after client work
Mike Crowe
Mike Croweover 8 years ago
that may have done it -- not getting an OOM error (so further along in the chain)
Mike Crowe
Mike Croweover 8 years ago
btw, do you know how to kill an ecs codepipeline deploy when it fails?
Mike Crowe
Mike Croweover 8 years ago
@sarkis Adding:

health_check_grace_period_seconds  = 30

to my local copy of terraform-aws-ecs-alb-service-task fixed the issue
antonbabenko
antonbabenkoover 8 years ago
@antonbabenko has joined the channel
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
this implements the common pattern of provisioning an ECR integrated with CI/CD to deploy containers to an ECS task and adding an ALB ingress
Mike Crowe
Mike Croweover 8 years ago
That's pretty sweet -- needed that 2w ago 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but it's also just a prime example of using all other ecs modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(realize it's a bit late)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
😞
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
also, this uses our "readme generator" to convert a README.yaml (using gomplate) to a README.md
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
as part of this, it uses terraform-docs to generate the wellformed markdown
Mike Crowe
Mike Croweover 8 years ago
I scheduled a quick call with you tomorrow about this. I think what I did has a different application
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
ok, look forward to talking at 10:30
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: image.png
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
being able to easily identify out-of-date modules and automatically generate all the output definitions from nested modules is something I've wanted
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Did any of the modules i made help with the ecs web app?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I think we used your ecs codepipline changes
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@sarkis would know more
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i can walk you through what we have this week sometime
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we're showing the client how to use it right now 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
and i think sarkis also used your ecs task module as an initial starting off point
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
i'd be really interested in your feedback on our ecs-web-app module <--- from an interface perspective
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
does it make sense?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
we'll probably create an ecs-job-app soon <--- which wouldn't depend on an ALB
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I read through it earlier very briefly and I thought it was well made from what I saw. I’ll give it a test later on - :)
sarkis
sarkisover 8 years ago
yea the codepipeline and codebuild code you contributed - thanks a ton Jamie!
sarkis
sarkisover 8 years ago
I'll make sure you get credit in the READMEs for those projects
Rohit Verma
Rohit Vermaover 8 years ago
In my init-terraform scripts, I am seeing mount -a failing to mount s3 to local
Rohit Verma
Rohit Vermaover 8 years ago
(dev-admin) backing-services ➤ init-terraform 
/bin/sh: s3fs: not found
Rohit Verma
Rohit Vermaover 8 years ago
I was looking at previous chats, seems like this is common
sarkis
sarkisover 8 years ago
what version of build-harness?
sarkis
sarkisover 8 years ago
and geodesic
Rohit Verma
Rohit Vermaover 8 years ago
i am using a fork of geodesic,
Rohit Verma
Rohit Vermaover 8 years ago
Also I am not sure where we are putting build-harness version, I think its always master
Rohit Verma
Rohit Vermaover 8 years ago
<https://raw.githubusercontent.com/cloudposse/build-harness/master/templates/Makefile.build-harness>
Rohit Verma
Rohit Vermaover 8 years ago
My geodesic is mostly in sync with master
sarkis
sarkisover 8 years ago(edited)
@Rohit Verma what does which s3fs return? (from inside geodesic container)
Rohit Verma
Rohit Vermaover 8 years ago
 s3fs
Error: goofys takes exactly two arguments.
Rohit Verma
Rohit Vermaover 8 years ago
i am on goofys v0.19.0
sarkis
sarkisover 8 years ago(edited)
looking at the s3fs on my geodesic container...


cat /usr/local/bin/s3fs
#!/bin/bash
# This script is used to mount filesystems from `/etc/fstab`
export DEVICE="$(eval echo ${1})"
export MOUNT_POINT="$(eval echo ${2})"
export BUCKET_REGION="${BUCKET_REGION:-${AWS_REGION}}"

# Evaluate the bash envs passed in via args and then execute goofys
exec goofys --file-mode=0600 --dir-mode=0700 --region=${BUCKET_REGION} --sse --acl=private ${DEVICE##s3://} ${MOUNT_POINT}
sarkis
sarkisover 8 years ago(edited)
probably an issue with one of the last 2 args there ^ not being set
sarkis
sarkisover 8 years ago
not sure yet why - tried to reproduce to no avail...
Rohit Verma
Rohit Vermaover 8 years ago
in my dockerfile I have added just RUN s3 fstab '${TF_BUCKET}' '/' '/secrets/tf'
sarkis
sarkisover 8 years ago
@Rohit Verma do you have ENV TF_BUCKET set before somewhere in the Dockerfile?
Rohit Verma
Rohit Vermaover 8 years ago
yes
Rohit Verma
Rohit Vermaover 8 years ago
running s3 fstab '${TF_BUCKET}' '/' '/secrets/tf' directly in container gives no error
Rohit Verma
Rohit Vermaover 8 years ago
I think ideally it should mount the terraform bucket to /secrets/tf
Rohit Verma
Rohit Vermaover 8 years ago
but that is still empty
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
@sarkis Next week I'll have an ECS treat for you
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Its pending an update to the SpotFleet for allowing Launch Templates
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
A fraction of the cost of Fargate.
sarkis
sarkisover 8 years ago
Looks really interesting Jamie - are you going to have a % of spot instances or I guess spot fleet handles that? I'm thinking what happens when prices spike...
sarkis
sarkisover 8 years ago(edited)
Yep looks like it:
The Spot Fleet also attempts to maintain its target capacity fleet if your Spot Instances are interrupted due to a change in Spot prices or available capacity.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
well, the fleet will be made of a mix of instance types
sarkis
sarkisover 8 years ago
yea
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
so, if one instance type goes out of price, it boots another
sarkis
sarkisover 8 years ago
last i tried anything with spot - there was no fleet 😄
sarkis
sarkisover 8 years ago
or it was super new i forget why we didn't look into it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
yeah, its new.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and they have released autoscaling for spot fleet recently too
sarkis
sarkisover 8 years ago
it was pretty much unusable for anything mission critical for this reason
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
so, you can create a spot fleet, and scale it
sarkis
sarkisover 8 years ago
really cool - looking forward to seeing the finished product! 😄
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
when combined with a watcher script that runs on the instance (which you will see if you look in the user-data dir)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
that starts 'draining' the instance as soon as it gets a spot instance termination notice
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and setting the 'draining lifetime' of tasks to 1 min 45 seconds
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
it means that all of the containers running on the interupted instance get moved to another server before its removed
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
so you can keep your workload stable
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
its good for web sites, slightly less good for things that need to gaurentee connections for longer than 2 mins
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
i have been running spot instances for years, and they have only rotated out a few times
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
Very cool! I’d like to demo this for a company currently using spotinst.com
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I think their spend is like 800K/mo on AWS :-)
sarkis
sarkisover 8 years ago
Jamie, re: ssm param store policy docs PR, put in a comment in there - lmk if you have any Qs about the process for that stuff... I'm working on moving more of our repos to that README.yaml format
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Thank you @sarkis
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
btw, added #releases where we’ll announce releases of our projects
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: image.png
sarkis
sarkisover 8 years ago
Jamie - I know it's getting late there so not doing the @ pings 😛, do you have any prior art or tips for ECS Fargate CloudWatch monitoring - we obviously don't have/care about the ECS cluster health, but starting to look into what we can monitor in the containers themselves - basic mem, cpu ,etc.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@sarkis Yo, keep the pings coming 🙂
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I've done the README update that you suggested
sarkis
sarkisover 8 years ago
ah great - 👀
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Okay so...
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Thats a minor one...
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but when do you need it by? I'll make a fuller one
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Jamie Nelson (BitFlight) I reviewed your terraform-aws-ssm-parameter-store-policy-documents - just a few nit picks
sarkis
sarkisover 8 years ago
Also just curious Jamie - what's your thoughts on the README generation process
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
It’s annoying. A form would be good ;)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
what part of it could be improved?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago

A form would be good
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
in otherwords, an “init” process?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I’ll elaborate shortly. Just walking somewhere
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
👍️
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Hi, I'm back.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So in regards to the README.yaml it isn't very DRY
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
which parts?
Robert Tisdale
Robert Tisdaleover 8 years ago
hello all
Robert Tisdale
Robert Tisdaleover 8 years ago
Can't remember if I said hello
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)

# Name of this project
name: terraform-aws-ssm-parameter-store-policy-documents

# Logo for this project
#logo: docs/logo.png

# License of this project
license: "APACHE2"

# Canonical GitHub repo
github_repo: cloudposse/terraform-aws-ssm-parameter-store-policy-documents

# Badges to display
badges:
  - name: "Build Status"
    image: "<https://travis-ci.org/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.svg?branch=master>"
    url: "<https://travis-ci.org/cloudposse/terraform-aws-ssm-parameter-store-policy-documents>"
  - name: "Latest Release"
    image: "<https://img.shields.io/github/release/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.svg>"
    url: "<https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents/releases>"
  - name: "Slack Community"
    image: "<https://slack.cloudposse.com/badge.svg>"
    url: "<https://slack.cloudposse.com>"

related:
  - name: "terraform-aws-ssm-parameter-store"
    description: "AWS SSM Parameter Store module"
    url: "<https://github.com/cloudposse/terraform-aws-ssm-parameter-store>"



# Short description of this project
description: |-
  This module generates JSON documents for restricted permission sets for AWS SSM Parameter Store access.
  Helpful when combined with [terraform-aws-ssm-parameter-store](<https://github.com/cloudposse/terraform-aws-ssm-parameter-store>)
# How to use this project

examples: |-
  Create a policy that allows access to write all parameters
hcl
  module "ps_policy" {
    source = "git::<https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents.git?ref=master>"
  }
Robert Tisdale
Robert Tisdaleover 8 years ago
Don't want to derail
Robert Tisdale
Robert Tisdaleover 8 years ago
Holy paste batman
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
sorry Robert!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
hey @Robert Tisdale!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
bad syncronisity
Robert Tisdale
Robert Tisdaleover 8 years ago
LOL, no problem I'm just yanking your chain @Jamie Nelson (BitFlight) 🙂
Robert Tisdale
Robert Tisdaleover 8 years ago
Hey @Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
can you propose (in pseudo code) how the YAML should look instead?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
@Erik Osterman (Cloud Posse) the terraform-aws-ssm-parameter-store-policy-documents (project name) gets used over and over
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
and in the intro areas especially, it would help if it was a variable
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
unfortunately, don't see a way around that without recursion.
sarkis
sarkisover 8 years ago
ah... it might turn into a case of mutliple levels of interpolation though since we already render this - thinking something like terraforms $$
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago

-rw-r--r--    1 erik  staff  11291 Jun 20 12:50 README.md
-rw-r--r--    1 erik  staff   5429 Jun 20 12:50 README.yaml

but it's at least 50% more DRY 😃
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
yeah
sarkis
sarkisover 8 years ago
whoa didn't bother to look at that - nice
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but there's a stronger, more overwhelming reason we cannot do that
sarkis
sarkisover 8 years ago
to me the biggest bonus is to only ever have to update the legal jargon in one spot 😄
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
the purpose for the .yaml format is so we can include it in our docs portal (docs.cloudposse.com)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
if the .yaml was itself templated, we would then need to create multiple parsers
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
one for readmes and one for hugo
Robert Tisdale
Robert Tisdaleover 8 years ago
Why use YAML for that instead of just markdown?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
to enforce consistency
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so basically, in hugo (our docs CMS) we can do this:
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago

{{% include-github org="cloudposse" repo="terraform-root-modules" ref="0.1.5" file="codefresh.yml" title="Example codefresh.yml" language="yaml" type="code-block" %}}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
this allows us to pull documentation in from individual repos
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
the hardest part about writing documentation is keeping it up to date
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
by allowing individual repositories to manage the general usage/examples/inputs/outputs/etc, we can reference that in our main documentation portal via YAML and ensure it's up to date in both places
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
"documentation as code"
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
😃
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I have started to look into doing TDD with terraform.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
My current opinion is not to do it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but to do validations as part of a test process
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I would like to do a compromise
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i think writing full on tests for everything is overkill
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but running plan/apply/destroy 80% of the battle
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i want to use our <http://testing.cloudposse.co|testing.cloudposse.co> account for that
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
its also fucking horrid, terraform is not at the stage to validate that beyond plan
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
and use codebuild with codepipeline to automate that
sarkis
sarkisover 8 years ago
@Jamie Nelson (BitFlight) something i've been pondering, more than TDD is RDD (Readme Driven Development)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
yeah, well... Ive been reading on awspec, kitchen-terraform, goss, and inspec for the last 2 weks
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
weeks
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@sarkis im in to that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@antonbabenko will probably have some more insights on it <-- i know he uses kitchen-terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but @Jamie Nelson (BitFlight) what do you think about the plan/apply/destroy part?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I think that there is a portion that could be done, and i think there could be a 'minimum' that can be tested for at 'unit test' time
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Erik Osterman (Cloud Posse) i think the plan/apply/destroy part could take too long as a 'unit-test' but as a further along test it works
sarkis
sarkisover 8 years ago
you think so? i really feel like integration tests are going to be the bulk of the tests if and when we get to it
sarkis
sarkisover 8 years ago
i dont know how useful unit tests are is what im tying to say 😛
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I agree. Its what I was attempting to articulate too.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I am not from a recent dev background. The unit test part allows for testing as you create quickly.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
But Integration tests can be done... quite well with terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
our modules are breaking frequently due to terraform changes outside of our control
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
although they take longer to run, and can be a lot of work to write
sarkis
sarkisover 8 years ago
anyone check out terratest yet?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I read about terratest yesterday... did you read about it on reddit?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
they had a big announcement a couple of months ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
it's by Grunt Works (terragrunt)
sarkis
sarkisover 8 years ago
i had talked to Yevgeniy about it as I helped bug squash a bit on terragrunt... he was telling me they had it ready to release but hashicorp kept telling him to hold off because they have something they want to come out with (surprise, they are all over the place :P)
sarkis
sarkisover 8 years ago
so yea officially publicly available a couple months ago as erik said ^
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Like, Terraform's 'issues' list is huge. But i don't like them any less.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
They are the best of the crowd
sarkis
sarkisover 8 years ago
oh yea - i just mean they should just let the community run with some things - it might help them focus on the core
sarkis
sarkisover 8 years ago
but i can see the other side of that coin too
sarkis
sarkisover 8 years ago(edited)
nice to have control (enforce quality)
antonbabenko
antonbabenkoover 8 years ago
I normally don’t use kitchen-terraform and will not use terratest because it is very hard to make meaningful tests. hcl/tf files are not code, so I don’t think we need just-developer-friendly-tool. I think we need something what is more like DSL (in a form of BDD/Gherkin). Also, there will be a validation of values before apply, and a lot more…
antonbabenko
antonbabenkoover 8 years ago
sarkis
sarkisover 8 years ago
something like serverspec but for aws resources lol
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
antonbabenko
antonbabenkoover 8 years ago
I wish something more abstract.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Well, if there was a terraform for testing that was multi provider enabled...
antonbabenko
antonbabenkoover 8 years ago
For example, when I was looking for something like inspec for google provider a year and more ago I could not, and I don’t know if there is awspec for google now.
sarkis
sarkisover 8 years ago
true
antonbabenko
antonbabenkoover 8 years ago
From what I see, there is 70% of testing things for AWS, 30% for Azure, and 0% for Google. 🙂
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Google have a test system... I found it when researching this week..
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
let me find it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Its not quite right but this goes towards it https://github.com/inspec/inspec-gcp
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Are you guys using any pentest bots for testing code and infrastructure as part of the deploy pipeline?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
https://github.com/guardicore/monkey <-- I've been watching this repo
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but haven't used it yet
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
And it looks very thorough
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I actually expect very few clients to pass muster
sarkis
sarkisover 8 years ago
hmm that is nice - thanks for sharing it @Jamie Nelson (BitFlight) - starred to dig into on my free time
sarkis
sarkisover 8 years ago
the only thing that worries me with this stuff is getting an aws account suspended - i've heard some horror stories
sarkis
sarkisover 8 years ago
not specifically about this but just in general
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Well, yeah... if you are doing anything that is DOS related
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
you have to inform AWS
sarkis
sarkisover 8 years ago
right
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
its on their TOS
sarkis
sarkisover 8 years ago
like i know security firms need to have a special deal with AWS and follow some standards, etc
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So, if you are running this bot and doing any DDOS or DOS features you have to fill in the AWS Support request first
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and say that is what you are doing
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
But this bot, doesn't just brute force
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So, its likely it will be outside of the AWS security remit
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
sarkis
sarkisover 8 years ago
yea it looks more like discovery
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
aws marketplace even allows it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
lol
antonbabenko
antonbabenkoover 8 years ago
Thanks @Jamie Nelson (BitFlight) for sharing links. inspec-gcp is just 3 months old project.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
🤙
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Have any of you made a metadata index for s3 in terraform? like this? https://github.com/aws-samples/aws-big-data-blog/tree/master/aws-blog-s3-index-with-lambda-ddb
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
If no one has, @Erik Osterman (Cloud Posse) can you add it to me on your project board?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Also: An aws alarm terraform module for detecting root account logins.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
And: An aws alarm terraform module for alerting on unauthorized aws api access.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
These are part of the aws CIS best practices.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
And should be small and easy to add
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
And a module to deploy this task to a cluster. https://github.com/ExpediaDotCom/c3vis/blob/master/README.md
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I will track those in the project later today
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
@Daren anything you can share for the root account logins?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Thanks!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
No rush I just don’t want to forget them
Daren
Darenover 8 years ago
@Erik Osterman (Cloud Posse) Sure. Id prefer to touch it up before open sourcing it, it was hacked together to meet the pci deadline
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
ok, understandable 😃
Daren
Darenover 8 years ago(edited)
It does the following:
- alert when a public is made public
- alert on root login
- alert on modification of cloudtrails
- auto re-enable disabled cloudtrails
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
a bucket is made public?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Daren would really appreciate you publishing it, i'm working through this doc https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(we could also probably help with "clean up" if you want - PM)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
those are great anton
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
may I use them?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@antonbabenko i just spotted something that may cause a headache for you...
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
You use aws_iam_policy_attachment
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
instead of aws_iam_role_policy_attachment
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Incase it wasn't intentional
antonbabenko
antonbabenkoover 8 years ago
Absolutely, use anything from there. I quit from that company today 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
no way!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
what are you going to focus on now?
antonbabenko
antonbabenkoover 8 years ago
there are some modules which I want to move to open-source under terraform-aws-modules umbrella
antonbabenko
antonbabenkoover 8 years ago
long vacation first, and then find something related to Terraform & AWS. Have nothing settled yet
antonbabenko
antonbabenkoover 8 years ago
Thanks for pointing to aws_iam_policy_attachment - I didn’t know that
antonbabenko
antonbabenkoover 8 years ago
Guys who are from Russia or Europe, will you consider going to https://devoops.ru/en/ ? I am going there and will be talking about Terraform there.
sarkis
sarkisover 8 years ago
man I wanna goto St Petersburg 😐️ if it wasn't a 20+ hr flight i'd be buying a ticket lol
antonbabenko
antonbabenkoover 8 years ago
Yeah, it is far from you. Will anyone go to HashiConf? 🙂
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
If I was looking for work I would
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
Alarm module made, with working example.... with some README
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I added a thanks, a reference, and the MIT licence+copyright under the Apache2 license.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Is that correct?
antonbabenko
antonbabenkoover 8 years ago
Looks good, but I would not use locals (in alarms.tf), but rather create a bunch of resources aws_cloudwatch_metric_alarm manually. This way, you can easily delete something in the middle of the list without recreating the rest of the list. This will be fixed in HCL2 and Terraform 0.12, but for now it is still an issue with ordered lists.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
@antonbabenko I've updated it to use the pretty readme, added dashboards, and added screenshots
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
Although I'm going to keep the lists in locals because I find the compact layout easier to read. And the lists are static.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Joost Saanen
Joost Saanenover 8 years ago
👋
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Hey Joost!
Joost Saanen
Joost Saanenover 8 years ago(edited)
Is there a way sending cloudtrail logs (from several customer aws accounts – all regions) to a specific cloudwatch log group at my security aws account?
Joost Saanen
Joost Saanenover 8 years ago(edited)
I want to use the module terraform-aws-cloudtrail-cloudwatch-alarms at my security aws account
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Hrmm.. we do something very similar, but ship them to an encrypted s3 bucket. What you propose sounds nice though.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I think @Jamie Nelson (BitFlight) might have recently done what you want
Joost Saanen
Joost Saanenover 8 years ago
Cool. When you ship them to s3, what do you use for notifications? S3 events to lambda?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
With the s3 bucket, we are not doing any no notifications. :( just storing logs.

This is something I’d need to defer to @Jamie Nelson (BitFlight) who has been working on all the alarm modules and probably has done what you are trying to achieve.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
This a an area we just started investing in - so it will be a little bit before we have everything fully baked.
Joost Saanen
Joost Saanenover 8 years ago
Ok, I understand. Thx!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Jamie is working on implementing modules to address as much of this as possible.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Aws KB has published the Iam policies, guidelines and such for centralizing the cloudwatch logs. I can pull the policies into the module as an option. And put the guide in the readme. So you can use the alerts on one account, but have it track and alert for all accounts.
Joost Saanen
Joost Saanenover 8 years ago
That would be awesome
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Joost Saanen another good item for you to read through this [WIP] [ETA: 30.6.2018] Terraform best practices https://github.com/antonbabenko/terraform-best-practices by @antonbabenko it links to examples of organizing code for multiple aws accounts such as you may need
antonbabenko
antonbabenkoover 8 years ago
“WIP” will have to be remaining for that repo until I am back from my vacation. I want to make it complete in September before I speak about it at conferences.
Joost Saanen
Joost Saanenover 8 years ago
Thx @antonbabenko for the great link
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Daren did you guys get kiam working? We started on this: https://github.com/cloudposse/geodesic/pull/163
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
ran into some issues
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I wish i liked writing READMEs
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
It works. But is pending readme creation
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Ok - we can help with that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Really not fond of heredocs. Can we move that to template files?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Perhaps named query should be a separate module that reads queries from a template file
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
Whats wrong with heredocs?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Legibility of code
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Can not properly indent
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
okay
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I can split it into its own sql folder
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
That would be perfect
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Jamie Nelson (BitFlight) @Andriy Knysh (Cloud Posse) @Igor Rodionov - can we schedule some time to talk about standardizing how we use IAM permissions?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Igor Rodionov has some problems with one of our older modules on ecr and before he makes any changes, we thought it a good idea to come up with a standard
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
@Jamie Nelson (BitFlight) - I know you're working a lot with locking down IAM permissions these days
Igor Rodionov
Igor Rodionovover 8 years ago
I can provide an example of my vision on ecr module
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, that would be a good start
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
we can CR that <--- as a proposal
Igor Rodionov
Igor Rodionovover 8 years ago
and bring it to the table for meeting
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Sure. In brief:
the iam_policy_documents can be overwritten, or appended to depending on if the statement has a SID.
Combining that, with the concept of a per project 'policy module' such as https://github.com/cloudposse/terraform-aws-ssm-parameter-store-policy-documents
Or an integrated policy module, so that as part of the current module, it outputs the json policy documents json, and sids, so they can be seen. And includes an option for including json documents that can be passed through for appending.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
It will be more work, but allows the lowest possible permissions to be added by the developer. But still allows additional permissions to be included in the module for custom needs.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago

source_json (Optional) - An IAM policy document to import as a base for the current policy document. Statements with non-blank sids in the current policy document will overwrite statements with the same sid in the source json. Statements without an sid cannot be overwritten.
override_json (Optional) - An IAM policy document to import and override the current policy document. Statements with non-blank sids in the override document will overwrite statements with the same sid in the current document. Statements without an sid cannot be overwritten.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I added an example and such to the terraform-aws-ecs-service-cloudwatch-sns-alarms init
sarkis
sarkisover 8 years ago
@Jamie Nelson (BitFlight) you are on a roll today - i need to know what brand/bean of coffee you having 😄
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
thank you 🙂
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Did you see the null label one?
sarkis
sarkisover 8 years ago
yes 🎉
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
hehe
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
It was very heavily refactored
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
just to get consistency on the data types, and then outputs them in the old output style
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, that was a clever trick. hadn't considered it, but i think it's a necessary evil.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Interesting
sarkis
sarkisover 8 years ago(edited)
so i was doing the whole compact concat dance before.. but i think this works in tf now...


alarm_actions       = ["${local.sns_topic_arn}", "${var.additional_notify_arns}"]
ok_actions          = ["${local.sns_topic_arn}", "${var.additional_notify_arns}"]
sarkis
sarkisover 8 years ago
where local.sns_topic_arn is a string and var.additional_notify_arns is a list
sarkis
sarkisover 8 years ago
hmm yea just tested it and it does work as expected... reference: https://github.com/hashicorp/terraform/issues/5682#issuecomment-278483475
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I saw that it was working
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
like magic
sarkis
sarkisover 8 years ago
so much nicer than the old way 😛
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
is that for you? 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(via: @Max Moon)
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: image.png
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
have you guys seen or worked with https://github.com/blinkist
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
some very thorough modules built by him (almost to @sarkis completeness grade)
sarkis
sarkisover 8 years ago
hmmm looks interesting - thanks for sharing @Jamie Nelson (BitFlight)
sarkis
sarkisover 8 years ago
at the very least - I need some diagrams for the ecs-web-app module ... it's getting huge 😐️
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Diagrams are annoying and always appreciated
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Hi fellas, I'm the Blinkist guy
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Welcome :)
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Few small bugs still here and there, but slowly getting there. I was discussing earlier with Jamie I think if it's possible to have Terraform manage the ECS container definitions except for the image parameter.. Where Terraform runs would extract the image:tag from aws_ecs_container_definition. Only solution I can think of is by creating a bootstrap=true for the module which would turn on/off a datasource for the first run, and other logic on the second run.. Would need to play around with that..
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Guys, I invited that guy from the links I shared
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Thanks for the invite 🚀
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Welcome to the channel!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Nice work on those modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I am afk, but will share how we are doing it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Maarten van der Hoef it’s Friday night for like most of the crew, and it’s quieter here over the weekend. But core group of @sarkis @Erik Osterman (Cloud Posse) sand @Andriy Knysh (Cloud Posse) are keeping an eye on it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
As seen
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Yeah sure.. Normally I'm not around on a Friday either ... I'll introduce myself quickly.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yes, things are pretty quiet now as it’s the end of the week
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
I'm the founder of the Terraform User Group in Berlin, started it when I didn't know where to start with Terraform roughly 2 years ago. Worked for 2.5 years at Blinkist where we went for AWS with ECS, coming from Heroku. Was always a dream to be self-employed, Blinkist fully supported that and made me a contractor with as first assignment open sourcing the ECS stuff I did earlier. Anothing thing I made is a golang tool called skipper which does some magic regarding task execution through a docker tunnel etc.etc. but that project is on hold until I get a bit of golang help.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
🤙
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
@Erik Osterman (Cloud Posse) Yeah, happy to see some of that 🙂 Have a good weekend.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Welcome! Its 11:30pm for me too so I’m going offline as well. But we will chat soon.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Sure, again, thanks for the invite.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yea let’s sync up on Monday !
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Also, maybe it would be interesting to have a weekly standing “round table” where we get together in a zoom room
sarkis
sarkisover 8 years ago
Welcome Maarten 👋
Max Moon
Max Moonover 8 years ago
https://github.com/cloudposse/terraform-aws-elasticache-redis/pull/12 if anyone has time for a one line code review
Max Moon
Max Moonover 8 years ago
Thanks in advance!
sarkis
sarkisover 8 years ago
@Max Moon thanks for the PR. Looks like the variables.tf entry was there but just wasn't being passed?
Max Moon
Max Moonover 8 years ago
aha
sarkis
sarkisover 8 years ago
I'll wait for 1 more approval and can merge. Is this blocking you right now?
Max Moon
Max Moonover 8 years ago
if i missed that then no big deal on this PR. No it's not blocking me, i just referenced my branch.
Max Moon
Max Moonover 8 years ago
After reviewing variables.tf I think that despite being referenced in variables.tf it wasn't being picked up because the reference wasn't made in the module, but i could be wrong
sarkis
sarkisover 8 years ago
Yea - I think CI would catch this (maybe) either way put a to-do for myself to get that PRed up
Max Moon
Max Moonover 8 years ago
it certainly was not working this morning, at least. So I think the PR for this is still relevant, pending review from others
sarkis
sarkisover 8 years ago
Oh absolutely your PR is necessary. Sorry should have gave context. I was confused why you didn't have a variables.tf change - made sense when I looked at master. It has the unref variable on there.
Max Moon
Max Moonover 8 years ago
ah yes okay, i gotchya now
sarkis
sarkisover 8 years ago
So one last thing. Now I'm thinking if we default to 4.0
Max Moon
Max Moonover 8 years ago
i was thinking the same.
sarkis
sarkisover 8 years ago
Since that was the previous behavior it seems from your testing
sarkis
sarkisover 8 years ago
Let's do that so it's less of a backwards incompatible risk
sarkis
sarkisover 8 years ago
If you don't mind pushing that to your PR I'll grab my laptop so I can merge and release
Max Moon
Max Moonover 8 years ago
yeah sure one sec
Max Moon
Max Moonover 8 years ago
already done and done
Max Moon
Max Moonover 8 years ago
im headed out for the afternoon but updated default family and engine version to latest available via AWS documentation (family: redis4.0 and engine_version: 4.0.10) in variables.tf on the PR. Thanks again @sarkis
sarkis
sarkisover 8 years ago
thanks @Max Moon! pushing out 0.5.0 now
Max Moon
Max Moonover 8 years ago
thanks!!!
sarkis
sarkisover 8 years ago
i thought it was a change that warranted a minor version++
Max Moon
Max Moonover 8 years ago
agreed, thanks again!
No earlier messagesBrowse by dateJuly 2018