#announcements - July 2018

950 messages

This channel is for workspace-wide communication and announcements. All members are in this channel.
Archive: https://archive.sweetops.com

Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Second training repo. No step by step instruction yet. If you have ideas, or suggestions please submit issues. https://github.com/firmstep-public/trainingdaytwo
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
The example module in demo_one is a working module for a web server in an asg. Which I figured was a common desire for the first thing to template for a company.
sarkis
sarkisover 8 years ago
@Rohit Verma I was able to reproduce that s3 path issue you were experiencing when mounting the s3 bucket: https://github.com/cloudposse/geodesic/pull/167 - once we have it CR'ed and tested will have a new release with this fix in it. Will keep you posted.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Mike Crowe (and possibly @tamsky) also ran into it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
just wondering why the mount command is not honoring the PATH
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Hi Erik, we had a quick chat on Friday regarding ECS! I would love to know how you do it. The end-goal for me is to be able to use 3rd party deployment software which most likely pushes a docker image based on a GIT-SHA, meanwhile Terraform should be able to run and take the last active task definition ( this part is simple ). Harder part is when I want Terraform to be able to modify the environment variables while keeping the image of the last task definition.

The idea I now have is by taking the image variable length to decide if it's bootstrapping or keep_image:

# Initial bootstrapping with ecr/repo:tag
module "ecs_app" {
image = "ecr/repo:tag"
}

# after that, a change to keep_image
module "ecs_app" {
image = "" ( default)
}

when image=="", i create datasources to get the current image definition, use that as input for the updated task definition resource.

Not sure if that would all work, and happy to hear your input on that.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
roughly it breaks down like this:

1) deploy ecs service task with container definition. default the container to our default-backend (~ a 404 page).
2) use codebuild/pipeline to CI/CD all image deployments.
3) define one public ALB per cluster
4) use ingress rules (targets) to route traffic based on host/paths to backend services

the inspiration for the architecture comes from our experience with kubernetes and trying to make it feel more like it.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
what I describe above is captured in this module:
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
the CI/CD is here: https://github.com/cloudposse/terraform-aws-ecs-codepipeline (which swaps out the image & tag)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we programmatically generate the container definition JSON in this module: https://github.com/cloudposse/terraform-aws-ecs-container-definition
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
oh, and our "default-backend"
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Does Codebuild allow cross account ECR repos by now ?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
we have 1:1 codebuild/codepipeline/ecr/web app
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
so a different build image for your staging , as for prod ?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
aha, for now, we have not orchestrated that.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
in our case, we would promote an image to the prod repo
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but we have not done that yet
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(we're pretty early in our ECS journey as most of what we use is k8s)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
let me correct that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we currently would rebuild it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but the way I would want to solve it eventually is to promote the image between ECR repos
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
still reading through it..
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
I see this working when having an imagename like repo:latest , but not for repo:unique_id or am I missing something
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
@sarkis where is an example of our build spec?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we do set a tag
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so for example, it's possible to only deploy tagged releases
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
then it would be repo:tag
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(we never pin to latest)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
printf '[{"name":"%s","imageUri":"%s"}]' $CONTAINER_NAME $REPO_URI:$IMAGE_TAG > imagedefinitions.json
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Maarten van der Hoef I thought you were doing something similar to this
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so it all comes down to how IMAGE_TAG is computed
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
yes, but after the building, how is terraform aware of the new IMAGE_TAG, I'm not seeing that.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
oh, the lifecycle of the image:tag is not the job of terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
this is our concession
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
terraform is strictly responsible for deploying the infrastructure that powers the service
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
monitoring
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
autoscaling
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
iam permissions, etc
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so i think we ignore changes, right @sarkis?
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
I agree there, but for me ENV VARS are a sort of grey area
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
SSM
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
+chamber
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Yeah at Blinkist we're using SSM
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(it doesn't resolve how to "rollback" envs, but we've also conceded that we won't solve for that)
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
But another customer doesn't want SSM or doesn't want a wrapper inside his Docker for that..
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
So I thought, maybe I can find a way to deal with that using container def. datasources
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
i agree that I don't like the wrapper inside the container as the entrypoint, but it's become the necessary evil to reduce complexity with terraform.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
wrapper = chamber
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
would be nice to have have ENV VARS defined for the ecs service instead, problem solved
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
something else, which is beautiful, happens if you use SSM though...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
you can provision those SSM parameters from outputs of your other modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
users, passwords, hosts, etc
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
yeah I've seen that, super cool and will use it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
what's the customer's counter argument?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
...we've even started using chamber with kubernetes in place of configmaps and secrets. it makes it much, much easier to manage ACLS+IAM using IAM roles
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Another thing in the chain they don't know.. I was probably not convincing enough.. first customer after my current employer ..
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
haha, yea, understood - in the end, if you overwhelm them with all the pros, I think the cons are very minimal.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
the ECS envs are also not encrypted
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
ok, outside environment variables you still have CPU and MEMORY definitions
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
that is an actual terraform argument I think
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
maybe not for Fargate
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago

that is an actual terraform argument I think


can you elaborate
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
inside the task definition you define the cpu and memory for a task
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Of course you can set these vars during deployment
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
but is this something any developer should do in some conditions, or rather have memory/cpu centrally orchestrated
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
aha, yes, but i don't think this solution precludes that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we set some defaults
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
but the buildspec.yaml can also override them
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
printf '[{"name":"%s","imageUri":"%s"}]' $CONTAINER_NAME $REPO_URI:$IMAGE_TAG > imagedefinitions.json
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
just add memory to that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
no?
Maarten van der Hoef
Maarten van der Hoefover 8 years ago(edited)
you're right. I'm thinking from a perspective where the CI is circleci and not managed by terraform..
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
aha
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
yes, i can see that some stuff gets more complicated that way
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
But still, circleci can invoke codebuild
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
i guess
Maarten van der Hoef
Maarten van der Hoefover 8 years ago(edited)
or a lambda which does nothing but deployment, and terraform manages the parameters for the lambda.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, lambda is the ultimate escape hatch. can probably accomplish it that way.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
That also saves me distributing access keys which can stop services.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Do you a tool for remote command execution, fixing a failed migration etc ?
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Thanks anyway, I didn't find the answer to my solution, but it made it clear that when I control the deployment of ecs I can still control the container definition, be it codebuild or not.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yep! no problem. i think we went down a similar path until we resovled that it wasn't feasible at this point in time with terraform.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
hrmm... the only migrations we've done so far happen in k8s and then we're able to exec into the container to perform manual remediations.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Jamie Nelson (BitFlight) might have some tips
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
ok because the new guy replacing me is working on my old tool which does this:
- Takes current running task, properties, security groups
- Creates keypair
- Starts EC2 ECS Instance with keypair
- Starts task [same iam etc]
- SSH into EC2 instance , creates a socket forward for /var/run/docker.sock ( this is so cool)
- docker exec into task
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that sounds pretty cool
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
on-demand ssh
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i know this is a pattern promoted by Teleport SSH (gravitational)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but haven't seen it in practice yet with ECS
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
https://github.com/blinkist/skipper it's dormant now, also because my golang skills are .. 😄 but I'm sure he'll be able to make something nice of it
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Anyway, I'll keep you updated on it, for now it's focus is on regular EC2, with already SSH access.

For conditions without VPN we can maybe also add a network load balancer to allow outside access to internal ssh
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, what I think could be neat is to have something like this:
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that is deployed on demand into the cluster for triaging
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
e.g. fixing failed migrations
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Well it would be nice to be able to completely log it to an S3 bucket, with the private key EC2 generation for the ec2 instance for the specific user (for which it needs MFA ) the extra MFA is probably overkill.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but is ec2 instance access necessary?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
what i like about using containers is that it's still isolated
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
I like that too, but when things brake someone wants to have access I suppose..
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
One question, how quick is codebuild now w/r booting up ?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@sarkis can maybe answer this
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
The idea I have now is this
- Have CircleCI test & build , a lot of startups here are using Circleci
- After build and push to ECR, push textfile to S3 in dev/uat/prod environment with image:tag
- Codebuild just pushes to ECS
- CircleCI loops&polls codebuild result, finishes
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yep, that sounds like a good solution to a common use case
Max Moon
Max Moonover 8 years ago
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
One question regarding terraform-aws-ecs-web-app
Have you ever had issues with the ecs_service being created before the listener_rule was added to the target_group ? I don't see this dependency being forced in terraform-aws-ecs-web-app and I had this quite a lot and caused me to trick around.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@sarkis
sarkis
sarkisover 8 years ago
@Maarten van der Hoef we do have that issue - since it's a one time problem (cold boot) - we are just running terraform apply twice for the time being. I'd like to at some point dig into the provider and see if there is something to be done there, before trying to hack this with depends_on statements
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Clarify what you mean by twice
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I think what you mean is two phases
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Not twice as retrying after failure :)
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
well it fails then 🙂
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
depends on definition of fail.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
But the hack to mitigate it is .. kind of ugly..
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
How did you get it working?
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
so the listener rules of the alb handling are outputted
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
inputted after into the ecs service module
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
then a null resource .. doing nothing
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
and aws_ecs_service with a depends_on
sarkis
sarkisover 8 years ago
clever 😄
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
but maybe the null_resource could be removed, create a local, and add the local to the count = inside the ecs_service I think now
sarkis
sarkisover 8 years ago
might be a computed count issue 😞
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
well, we don't have to count it, just evaluate it in someway
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
hm
sarkis
sarkisover 8 years ago
so @Maarten van der Hoef looking over your ecs_service/ in more depth - it looks like you need 2 tf runs as well right?
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
nope
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
where ?
sarkis
sarkisover 8 years ago
i guess i'm not seeing where lb_attached gets changed
sarkis
sarkisover 8 years ago(edited)
oh nvm i see how you make it wait with null_resource
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
lb_attached is just input for if it is a worker or a web service
sarkis
sarkisover 8 years ago
👍️
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
The ugliest hack you will find here :
https://github.com/blinkist/terraform-aws-airship-ecs-service/blob/master/modules/ecs_task_definition/main.tf
search for my_random
Module has as input key-value pairs which afterwards are turned into Name: Value: pairs for the environment variables of the task definition.. I found out that when "true" runs through a null_resource it will be casted to a 1 ..
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
I have no idea how I could fix this otherwise, input very much welcome 🙂
sarkis
sarkisover 8 years ago
yea typecast hell is real in TF 😞
sarkis
sarkisover 8 years ago
we did something similar for converting TF -> json
sarkis
sarkisover 8 years ago
i mean not similar but a similar typecast issue
sarkis
sarkisover 8 years ago
let me find it - it might make you feel better about your hack 😄
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
I think the ecs_service can be done without null_resource, add another empty item to the list, grab that item from the list, call it empty_string , and use that empty_string somewhere in ecs_service
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
lol
sarkis
sarkisover 8 years ago
i call that "cost of doing business with terraform"
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
price we have to pay 🙂
sarkis
sarkisover 8 years ago
sadly - i was reading through HCL2 didn't see anything specifically about the typecasting
sarkis
sarkisover 8 years ago
there was a vague mention that types work better or something
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Do you know if your modules will break yes/no ?
sarkis
sarkisover 8 years ago
that's also very vague rigth now - i think they are waiting for the community to do the dirty work 😛
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Wonder what is smart then, just create a new one calling it module-hc2 and go from there
sarkis
sarkisover 8 years ago
i was thinking a new branch to start out
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
for example in the ecs_service part i now have 4 x ecs_service with conditionals.. with hcl2 this can be compacted to just one
sarkis
sarkisover 8 years ago
but that might be too optimistic 😛
sarkis
sarkisover 8 years ago
ah yea i hear you though - it's going to assume you can use the new tf version everywhere too
sarkis
sarkisover 8 years ago(edited)
can prob fix this with tags though... go to a new major release for HCL2 (in your modules)
sarkis
sarkisover 8 years ago
and then a note in the readme
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
sounds like they are going to support both languages initially, no?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so that provides an upgrade path
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so modules can lay claim to the legacy provider until upgraded
sarkis
sarkisover 8 years ago(edited)
hmm how would that work? oh just depends on what provider version you lock?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
but i'm definitely nervously biting my nails right now hoping that it won't be too painful
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we have something like 70 modules
sarkis
sarkisover 8 years ago
yea and i'm certain we do some interesting workarounds / hacks that are going to be fixed/deprecated in the future
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Night ttyl
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
🍻
sarkis
sarkisover 8 years ago
goodnight!
Camilo Bravo
Camilo Bravoover 8 years ago
Good morning... new to the channel and not sure where I should / if I should be asking questions here... A while back I saw you guys do a presentation along side Codefresh...I remember being very impressed with the deployment pipeline you guys had set up and I am trying to get something of my own set up. I am curious how you guys connect git tags and pull them through to your dockerhub registry
Camilo Bravo
Camilo Bravoover 8 years ago
I just found this page .... seems like I am on the right track https://docs.cloudposse.com/release-engineering/cicd-process/semantic-versioning/
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Camilo Bravo I can share more details a little later today
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Currently afk
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yes that’s a good place to start
Camilo Bravo
Camilo Bravoover 8 years ago
@Erik Osterman (Cloud Posse) Thank you very much.... I am also scoping out this repo (https://github.com/cloudposse-demo/demo-catalogue) and the build harness repo
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we’ve also iterated a lot since that demo
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
would love to get you to try out the new stuff
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
all of our new stuff uses helmfile
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
are you familiar with that?
Camilo Bravo
Camilo Bravoover 8 years ago
I am not
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
it simplifies a lot of stuff around working with helm
Camilo Bravo
Camilo Bravoover 8 years ago
we are just getting our feet wet with helm but the particular project I am currently focused on is just a deployment image (it has aws cli in it and some other tools we use...) and I am trying to come up with a way to keep the git tag inline with the tags in docker hub without having to do a bunch of automated steps
Camilo Bravo
Camilo Bravoover 8 years ago
codefresh gives you the git hub short revision but no access to the git tags
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
aha, ok - that is a simpler use-case
Camilo Bravo
Camilo Bravoover 8 years ago
we are slowly ramping up our knowledge of help and kubernetes but we aren't there yet
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
here’s a more simple codefresh pipeline
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
this builds a docker image and tags it with the semantic version generated in a previous step
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
it’s also an example of pushing the image to multiple registries
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Any Datadog users here ?
sarkis
sarkisover 8 years ago
i think we all have a bit of experience (cloudposse org) 😛
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
I've not seen a good timeboard module yet, and with locals the population of multiple graphs can be fixed .. at least it looks like it
sarkis
sarkisover 8 years ago
i personally have less than others here with datadog - my use case was limited to monitoring kafka
Camilo Bravo
Camilo Bravoover 8 years ago(edited)
@Erik Osterman (Cloud Posse) so is the build harness something that the public should be using? like should I consider using your build harness? or is it something that could change without warning
Camilo Bravo
Camilo Bravoover 8 years ago
or really something I should just consider taking pieces of and rolling my own solution based off it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we recommend to all of our customers to use the build-harness
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
it’s well maintained and we tag all releases. so if it suits your needs, by all means, leverage it.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
especially with codefresh, the build-harness makes a lot of sense since every step runs in a container
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Camilo Bravo let me know if it would be helpful to take a look at what you have
Camilo Bravo
Camilo Bravoover 8 years ago
and if we are not currently customers?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
only share what’s not subject to an NDA
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
you can DM me
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I am 200 messages behind this chat. Sorry I’ve been afk guys.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
you snooze you lose
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
😛
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Totally!
sarkis
sarkisover 8 years ago
welcome back 😄
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
If anyone wants to take a look at the basic structure of a datadog timeboard module, feel free to comment. 🙂

https://github.com/maartenvanderhoef/terraform-datadog-timeboard/blob/master/examples/main.tf

https://www.terraform.io/docs/providers/datadog/r/timeboard.html

Problem of the datadog_timeboard was that it's set-up like the cloudfront resource.. many blocks after another inside one resource.. but now with locals it can be modularized a bit. I wanted to be able to create graphs seperatedly from creating the actualy timeboard by creating 2 modules and this seems to be working.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
@Dave Yu @Daren maybe something interesting for you guys 👆️
Dave Yu
Dave Yuover 8 years ago
cool will take a look
Daren
Darenover 8 years ago
👍️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
anyone know how to get the version of a terraform module programmatically? e.g. ${module.version}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
use-case: I want to download artifacts from github release corresponding to the version of the terraform module
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(e.g. a lambda zip file)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
this appears to work:
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago

variable "git_ref" {
  default = "tag"
}

data "external" "example" {
  count = "${var.git_ref == "tag" ? 1 : 0}"
  program = ["git", "-C", "${path.module}", "tag", "--points-at", "HEAD", "--format={\"ref\": \"%(refname:lstrip=2)\"}"]

  query = {
  }
}


output "ref" {
  value = "${join("", data.external.example.*.result.ref)}"
}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
outputs:
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago

ref = test-0.1.1
Mike Crowe
Mike Croweover 8 years ago
Hey @Erik Osterman (Cloud Posse) -- been looking at aws-cloudfront-s3-cdn. Do you guys have a strategy for a javascript bundled webapp deployed to dev/test/prod via codepipeline?
Mike Crowe
Mike Croweover 8 years ago
I'm wondering:
1) Github -> hook -> CodePipeline (builds app via webpack) and pushes to dev
2) Q/A approves, time to move to test/uat
3) (?????) push dev artifacts to uat
4) Customer approves live
5) (?????) pushes uat artifacts to prod
Mike Crowe
Mike Croweover 8 years ago
Maybe I'm over-thinking it. Maybe each one is a codepipeline task off a branch
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
So what you describe is a pretty common pattern. A few of our customers do exactly that. We haven’t packaged that up as a terraform module. Most of them use Codefresh for CI/CD, and then use
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Tom Johnson
Tom Johnsonover 8 years ago(edited)
hey folks, quick question on the prometheus-cloudwatch exporter. When i try to follow the kubernetes instructions (https://github.com/cloudposse/prometheus-to-cloudwatch) the prometheus-to-cloudwatch pod fails to deploy, saying the image is unavailable. I'm running helm install . from within the charts subdirectory so I'm not sure what to do next.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Tom Johnson thanks for the report. I will check into this a bit later today.
sarkis
sarkisover 8 years ago(edited)
Hello @Tom Johnson - do you have some more info you can share, namely helm/tiller version while we look into reproducing the issue?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Andriy Knysh (Cloud Posse) are you are around to take a look?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@sarkis probably just wrong image tag
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
It should correspond to the latest release in the repo
sarkis
sarkisover 8 years ago
ah yea
sarkis
sarkisover 8 years ago
i'll check in after i push through the few tasks i have today - if you haven't looked yet I can dig into it..
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Tom Johnson ☝️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
For our use case, it’s so we can download a zip artifact for a lambda function from the module GitHub release page.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Jamie Nelson (BitFlight) any idea how we can change this to only apply Name and Namespace on first apply?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
apparently, all applys after the first one fail if these are set
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Yo
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
just a moment ill look
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
thx
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
well, yeah
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
lifecycle { ignore_changes = ["tags"]}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
might do it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
ah, yea, I think that’s a better fix
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I'm not set up to test that it will fix it though
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
are you able to?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i’ll ask that they try it out
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
if not... then its possible to do their fix... or strip "Name" and "Namespace" tags back out
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but i think their solution is .. tidier then removing two map items from a map
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
in hcl 2, i expect you could workaround this
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
by having a data lookup the existing tags on the elb
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and only apply the extra tags
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
since you can reference resources directly
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
so you could do { if lookup(this.resource.tags, "Name", "NAME_NOT_EXISTS") != "NAME_NOT_EXISTS"} add full list of tags { else } add subset of tags {end}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
^psudocode
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Thanks for thinking of me 😄
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
i'm gonna go back to my show now 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, that will simplify so many things in complex terraform modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
thanks!
sarkis
sarkisover 8 years ago
i should start constructing a sed expression to replace "${var...}" to var.... and post to the cloudposse blog 😄
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
no need i think
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
they will have a conversion method
sarkis
sarkisover 8 years ago
oh like a HCL 1->2?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so all the standard stuff will convert as easily as something like terraform fmt .
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea
sarkis
sarkisover 8 years ago
nice
sarkis
sarkisover 8 years ago
thats true this should be a fmt change
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(also, I'm not sure if fmt is the action they will use, but I read that they will provide a means of automatically upgrading code)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Max Moon @Dave Yu heads up
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
there’s an issue with kops 1.9 where it has trouble detecting failed pod evictions
Max Moon
Max Moonover 8 years ago
Good looking out, thank you!
Daren
Darenover 8 years ago
We hit it on every node with nginx-ingress-controller
Max Moon
Max Moonover 8 years ago
Dang, I upgraded worker node size yesterday and fortunately it went smoothly
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
we're planning on merging this soon.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
it uses inline values.yaml to make it easier to maintain
Max Moon
Max Moonover 8 years ago
Thanks @Erik Osterman (Cloud Posse)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Hey i have a tip for you guys when dealing with ecs
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
in many cases the service, the containers, and the metrics all want the cluster name, not the arn
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but the resource doesn't provide a name, just the arn
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but you can do this:locals { cluster_name = "${basename(aws_ecs_cluster.default.arn)}"}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
to get the name
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that's a good one! like the use of basename(...) for this
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
I was doing

locals { cluster_name = "${element(split("/",(aws_ecs_cluster.default.arn), 1)}"}

Before.
sarkis
sarkisover 8 years ago
really nice tip - thanks @Jamie Nelson (BitFlight) i was trying to figure out last week how to get the name with just the ARN (was looking at data source, but some sources don't have name available :()
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I thought it would be up your alley
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I have grown to dislike "terraform_remote_state" data provider
sarkis
sarkisover 8 years ago
hmmm - not good in practice?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
how come?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
It requires a lot of details to collect details from a remote state
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
It has meant that when writing code that depends on other modules
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
you have to pass in "workspace", "s3 bucket name", "state path", and use shit like:

### For looking up info from the other Terraform States
variable "state_bucket" {
  description = "The bucket name where the chared Terraform state is kept"
}

variable "state_region" {
  description = "The region for the Terraform state bucket"
}

variable "env" {
  description = "The terraform workspace name."
}

locals {
  state_path = "${var.env == "default" ? "" : "env:/${var.env}/" }"
}

### Look up remote state info

data "terraform_remote_state" "vpc" {
  backend = "s3"

  config {
    bucket = "${var.state_bucket}"
    key    = "${local.state_path}vpc/state.tfstate"
    region = "${var.state_region}"
  }
}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
That locals hack to get around the non-conformance that it has with workspaces
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
hrmm... yes... fwiw, here's what we've recently done
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)

data "terraform_remote_state" "backing_services" {
  backend = "s3"

  config {
    bucket = "${module.identity.namespace}-${module.identity.stage}-terraform-state"
    key    = "backing-services/terraform.tfstate"
  }
}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
we have a module that keep track of a lot of constants
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that can be reused
sarkis
sarkisover 8 years ago
i think just stay clear of workspaces 😛
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we don't love it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Workspaces were so good when I discovered them
sarkis
sarkisover 8 years ago
yea because you'd think it would help DRY
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
With one command I could switch from the ecs container task that has jenkins deploying, to the nginx container, to the node container
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
all the same code, but dif vars
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Yeah, but when it comes to state management and workspaces
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
there is a lot to be desired
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
If only terraform_remote_state wasn't the only data source with a default
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I'd be using parameter_store, or an api call.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
\/whinge
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
One last gripe....!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I would prefer that blocks that only have one entry in them were put all in one line when you formatted.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
haha devops therapy sessions
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
how does that make you feel?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)

resource "aws_thing" "default" {
  tags = { managedby = "Terraform"}
}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)

output "thing" { value = "the thing i mentioned" }
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
IMO, I don't like that. I agree it's concise, but in most language frameworks I've dealt with, they are strict about how braces are used. Typically, they enforce one of:


if (...) {
....
}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
or
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)

if (...)
{
...
}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but never
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
if (...) { ... }
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Its like some asshole just likes brackets and whitespace
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Where's the Terraform yaml option!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Okay... gripe done ;-D
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
heh, would be interesting to see what TF would look like in YAML
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago

data:
  template_file:
    example:
      template: '${hello} ${world}!'
      vars:
        hello: goodnight
        world: moon
output:
  rendered:
    value: '${data.template_file.example.rendered}'
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago

variable:
  count:
    default: 2
  hostnames:
    default:
      '0': <http://example1.org|example1.org>
      '1': <http://example2.net|example2.net>
data:
  template_file:
    web_init:
      count: '${var.count}'
      template: '${file("templates/web_init.tpl")}'
      vars:
        hostname: '${lookup(var.hostnames, count.index)}'
resource:
  aws_instance:
    web:
      count: '${var.count}'
      user_data: '${element(data.template_file.web_init.*.rendered, count.index)}'
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
AKA
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)

data "template_file" "example" {
  template = "${hello} ${world}!"
  vars {
    hello = "goodnight"
    world = "moon"
  }
}

output "rendered" {
  value = "${data.template_file.example.rendered}"
}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago

variable "count" {
  default = 2
}

variable "hostnames" {
  default = {
    "0" = "<http://example1.org|example1.org>"
    "1" = "<http://example2.net|example2.net>"
  }
}

data "template_file" "web_init" {
  // here we expand multiple template_files - the same number as we have instances
  count    = "${var.count}"
  template = "${file("templates/web_init.tpl")}"
  vars {
    // that gives us access to use count.index to do the lookup
    hostname = "${lookup(var.hostnames, count.index)}"
  }
}

resource "aws_instance" "web" {
  // ...
  count = "${var.count}"
  // here we link each web instance to the proper template_file
  user_data = "${element(data.template_file.web_init.*.rendered, count.index)}"
}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
can't help but feel like it's "cloudformation" when seeing it in YAML format
sarkis
sarkisover 8 years ago
it feels like they just "borrowed" the golang approach to { }
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
now thats a nice positive rant
sarkis
sarkisover 8 years ago
i've noticed he does these multiple tweets a lot lol
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that's cool
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I'm mid module writing for handling ecs instance draining for spot instances, but I want it to handle ASG standard istances as well...
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
so now it looks like im making another module for my module
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
how are you implementing the draining?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Good question
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
boto3
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
on asg instance termination sns alert
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
i get the instance id
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
And currently i grab the list of all ecs clusters, then in each cluster, i list all container_instances, and then i compare my instance id to the container instance id.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Once I have that i change state to draining
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I don't know how heavy those requests are when there are 100 clusters with 10000 instances on each
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but it works for mine
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I expect a faster lookup would be: tag each instance on creation with its cluster name
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
then, use the tags to get the cluster name from the id.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
But then it involves an extra step on creation.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Whereas this way, i don't need access to the ASG resource, just the asg name
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I am still in POC stage with it really
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I can see many ways to smooth it out, break it in to smaller reusable chunks and so on
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but ... maybe once I get the functions and permission sets all working
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I can split the modulerisation of it with Sarkis or something
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Well, it works
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
It now also handles draining on scale in
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Next it likely needs the lambda function rewritten to trim all of the junk off it, and set up a step function, so that a 5 or 10 second delay can be added between checking if the tasks have drained.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
at the moment it just loops with no delay, between sns -> lambda -> sns ->lambda etc
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
until it finishes draining the tasks
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Jamie Nelson (BitFlight) the upstream tf PR was merged to support the launch templates?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Not for spot fleets.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So while waiting for that, I made the template module handle both spot fleets, asg on demand, and asg spot.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
That’s just the launch template module
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
The other module which I’m making with you in mind is the auto scaling spot fleet one.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
And that requires the merge first
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I like writing modules because it makes me do less work in the long term.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Question for the ones who worked with K8S before, I have not really. How does it compare to ECS for you. I see small startups offering jobs to devops for their to-be-configured k8s cluster ( on AWS) and I really think, why not just ecs ? It's so much hype.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
feature velocity of k8s is insane. huge ecosystem of tools, much lager than for ECS. IMO, it's easier to deploy complex apps on kubernetes than on ECS. ECS needs something like Helm. Not sure if "terraform" is the answer for that. ECS has evolved leaps and bounds from when I first looked at it (e.g. DNS service discovery), but it still feels rather primitive coming from an kubernetes background. I think one big thing ECS has going for it is that it is simpler, but in being simpler lacks a lot of the cool features of kubernetes.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
There's no signficant library of apps for ECS like there is for kubernetes. That to me is a little bit of a redflag.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(that I'm aware of)
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
True, but tbh, how many of the cool features do you really need. And will some cool features like persistent storage let people make decisions which are contrary to the reason for moving to AWS, like, having AWS taking care of your stateful services.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
The idea is to represent as much of the infrastructure as possible so that i can be easily deployed without involving ops
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
with ECS, that's not really possible.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
with k8s, you can almost do everything but IAM roles/policies
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
volumes, load balancers, ingress, namespaces, secrets, configmaps, replicasets, deployments, pods, etc.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
automatic TLS
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
automatic DNS
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so basically a single helm chart is capable of provisioning a web app with a dynamic TLS certificate, automatic public DNS registration, pulling secrets and exposing them as envs, mounting configmaps as files on the filesystem, provisioning EBS volumes for scratch storage, and more...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
we use these features all the time.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
CI/CD of this is very easy with Kubernetes
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
few orgs actually do CI/CD of terraform
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
ok, but when connected to AWS in ways of networking, iam, .. then you do get terraform after all
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
persistent storage doesn't have to be "persistent"
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
but you need it for big data applications like cassandara or HDFS
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
and for staging environments, we run apps like postgres
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so having attached storage is necessary since the host machine is limited
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so kubernetes cannot exist without terraform 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that's why it's so central still to everything we do visible in our github
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
but kubernetes is headed in the right direction 😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I'd love to see a kind: Terraform in kubernetes
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
then it would truly allow everything
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
for what resources then ?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
IAM roles, policies
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
RDS databases
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
elasicache instances
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
EFS filesystems
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
etc.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
...so fully managed services
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Here's a POC presented at HashiConf: https://github.com/kris-nova/terraformctl
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
The other thing about k8s, is it's more like like a framework (like "rails") for how to do cloud automation. It provides the interfaces, scheduling, state, service discovery. Then makes it extensible to add anything else on top of it. So for more complex applications, e.g. "postgres", in order to run it in a containerized environment, you need an "application aware" controller. Something that knows instinctively how to manage postgres. How to do updates, upgrades, rollbacks, etc.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
So people are developing operators like this: https://github.com/CrunchyData/postgres-operator
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
for running complex applications that aren't just stateless webapps
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Sure, but having seen a few meetups with pains of guys running stateful inside k8s..
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Didn't we move to AWS to not have state anymore
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i agree that not dealing with state is the "ideal" situation
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
and we encourage our customers to push that off as long as possible
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
but I would rather have a platform capable of handling that in addition to all the stateless apps
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
at somepoint, someone needs to manage the state.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
aws doesn't provide state management for every application
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
thus some apps do need to handle that.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
true, although, there are so many providers who offer services through vpc peering now
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
mongo atlas for example
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, i would love to see more of that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i think that's a cool direction
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
also, we're still in the wee early days of k8s, but look how far & fast it's come?
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
totally, in the end this is about not having 24/7 shifts, and not needing a 100% devops
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
With ECS I think this is possible, with self managed k8s, maybe less
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, so back to perhaps your original question
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
but I don't know k8s enough
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
to really judge there
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
companies who don't have any dedicated devops, i would recommend considering ECS
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
smaller shops, with 1-4 people, ECS is probably better/simpler.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
also with fargate then.. just great
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
i came from 80, but also only devops .. so ECS is perfect then 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i think we're coming at this from 2 differnet backgrounds. i spent the last 3 years working with k8s and 2 months with ECS.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
😃
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so I don't yet fully appreciate perhaps ECS.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
you will, let's just wait for that one k8s update hehe
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
haha
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i really want to start working on our TF modules for EKS.
sarkis
sarkisover 8 years ago
having deployed both - i do prefer k8s - something about it just appeals to me - i think it's mostly the fact that i can do everything out of the box via command line - i.e. kubectl
sarkis
sarkisover 8 years ago
def possible for ecs i bet but aws-cli is meh
sarkis
sarkisover 8 years ago
for example - so easy to cat out the logs for ingress and describe a pod etc... for ECS i still find myself in the AWS web console - i know I am doing it wrong - but aws doesn't make it a no brainer task like k8s for cli equivalents
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
so in a 20 developer situation how many people have kubectl and can do damage ?
sarkis
sarkisover 8 years ago
yea good point - not ideal in production
sarkis
sarkisover 8 years ago
and imo kubectl is the emergency hatch - so whoever is dealt the devops card in the 20 dev group
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
ok
sarkis
sarkisover 8 years ago
i.e. knows what they are doing 😛
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
hehe
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: Pasted image at 2018-07-12, 6:49 PM
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
This is awesome, but I find the formatting awkward without additional indention
Rohit Verma
Rohit Vermaover 8 years ago
@Erik Osterman (Cloud Posse) /@sarkis Within geodesic wrapper we are publishing geodesic port and binding kubernetes_api_port to it, can you tell why we are doing this
Rohit Verma
Rohit Vermaover 8 years ago
also how can I proxy something out of container to host
Rohit Verma
Rohit Vermaover 8 years ago
say for example kubernetes-dashboard
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yep! This is for kubectl proxy
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
So you can do exactly what you want to do
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Also, for dashboard you can do something else
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
But I am on my way to bed. Can demo our portal for you tomorrow or next week
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
It uses bitly oauth2 proxy
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
kubectl proxy --port=0.0.0.0:8080
Rohit Verma
Rohit Vermaover 8 years ago
its seems not working as expected, so if I do kubectl proxy --port=$GEODESIC_PORT
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
From inside geodesic
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
No
Rohit Verma
Rohit Vermaover 8 years ago
yes thats what i am doing
Rohit Verma
Rohit Vermaover 8 years ago
okay
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
You are not binding to 0.0.0.0
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
By default it is 127.0.0.1
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Docker port forwarding does not work to local host
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Actually, arg is diff
Rohit Verma
Rohit Vermaover 8 years ago
kubectl proxy --port=0.0.0.0:8080 gives invalid port syntax exception
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
—addresss=0.0.0.0
Rohit Verma
Rohit Vermaover 8 years ago
okay
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
sorry, on phone so hard to type
Rohit Verma
Rohit Vermaover 8 years ago
thats working
Rohit Verma
Rohit Vermaover 8 years ago
thanks
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Might need to add this too
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I will document this too
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
It’s a good question
Rohit Verma
Rohit Vermaover 8 years ago
Anyways thanks a lot, it was an instant resolution, cheers 🙂
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Haha welcome! :)
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Hi, someone with spare time and wants to help me out with something. I'm passing a list with maps to a resource. This works as long as there is no interpolation happening with a variable from an external source. When I do it fails and the resource complains certain keys are missing from the map.

But when I output that structure, the structure is the same, just in a different order, I can't figure out what is wrong with it.

https://gist.github.com/maartenvanderhoef/83047f578486dce8f5995d3c728b99d3
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Can you share the precise error
Maarten van der Hoef
Maarten van der Hoefover 8 years ago(edited)
Error: datadog_timeboard.this: "graph.0.request": required field is not set

Error: datadog_timeboard.this: "graph.0.title": required field is not set

Error: datadog_timeboard.this: "graph.0.viz": required field is not set
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
This sounds familiar. @Andriy Knysh (Cloud Posse) I think ran into this in one of our other modules, but I don’t remember which one
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Have you tried not using a local?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
For the data structure
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Have you tried removing the brackets here:
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Then it does work, but that wouldn't work for my module ..
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
graph = ["${local.not_working_graph}"]
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
let me try
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
the thing is, i'm passing a list of maps there normally, not just one, so it's an actual list..
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
but let me try just a single one.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Actually, I misread your local
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Thought it was already in a list
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
What if you put the local in a list
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
I don’t have any ideas other than to try all kinds of permutations of what you are attempting to do
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(On my phone)
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
first attempt "datadog_timeboard.not_working: graph: should be a list"

the datadog_timeboard can have multiple graph { } blocks, so it must be a list.

haha, thanks , i'll try the other option
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
2nd option, same problem as initial error.
When outputted I have this:

not_working = {
  request = [map[style:map[type:solid width:normal palette:dog_classic] q:avg:aws.applicationelb.target_response_time.p95{targetgroup:targetgroup/qa-web-backend-web/123} aggregator:avg type:line]]
  title = not_working
  viz = timeseries
}
working = {
  request = [map[q:avg:aws.applicationelb.target_response_time.p95{targetgroup:targetgroup/qa-web-backend-web/123} aggregator:avg type:line style:map[palette:dog_classic type:solid width:normal]]]
  title = working
  viz = timeseries
}

I'll wait for the new terraform I think.
Rohit Verma
Rohit Vermaover 8 years ago
@Erik Osterman (Cloud Posse) I think there is some issue with git::<https://github.com/cloudposse/terraform-aws-rds-cluster.git?ref=master>
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago

What’s the problem?
Rohit Verma
Rohit Vermaover 8 years ago
I have create
module "rds_mysql" {
  source             = "git::<https://github.com/cloudposse/terraform-aws-rds-cluster.git?ref=master>"
  engine             = "aurora-mysql"
  cluster_size       = "${var.MYSQL_CLUSTER_SIZE}"
  cluster_family     = "aurora-mysql5.7"
  namespace          = "${var.namespace}"
  stage              = "${var.stage}"
  name               = "${var.MYSQL_DB_NAME}"
  admin_user         = "${var.MYSQL_ADMIN_NAME}"
  admin_password     = "${var.MYSQL_ADMIN_PASSWORD}"
  db_name            = "${var.MYSQL_DB_NAME}"
  instance_type      = "${var.MYSQL_INSTANCE_TYPE}"
  vpc_id             = "${module.vpc.vpc_id}"
  availability_zones = ["us-west-2b", "us-west-2c"]
  security_groups    = ["${aws_security_group.store_pv.id}"]
  subnets            = ["${module.subnets.private_subnet_ids}"]
  zone_id            = "${var.zone_id}"

  cluster_parameters = [
    {
      name  = "character_set_client"
      value = "utf8"
    },
    {
      name  = "character_set_connection"
      value = "utf8"
    },
    {
      name  = "character_set_database"
      value = "utf8"
    },
    {
      name  = "character_set_results"
      value = "utf8"
    },
    {
      name  = "character_set_server"
      value = "utf8"
    },
    {
      name         = "lower_case_table_names"
      value        = "1"
      apply_method = "pending-reboot"
    },
    {
      name         = "skip-character-set-client-handshake"
      value        = "1"
      apply_method = "pending-reboot"
    },
  ]
}
Rohit Verma
Rohit Vermaover 8 years ago
but if I run terraform apply , 2 nd time it recreates the instance
Rohit Verma
Rohit Vermaover 8 years ago
-/+ module.rds_mysql.aws_rds_cluster.default (new resource required)
      id:                                  "niki-dev-commerce" => <computed> (forces new resource)
      apply_immediately:                   "true" => "true"
      availability_zones.#:                "3" => "2" (forces new resource)
      availability_zones.2050015877:       "us-west-2c" => "us-west-2c"
      availability_zones.221770259:        "us-west-2b" => "us-west-2b"
      availability_zones.2487133097:       "us-west-2a" => "" (forces new resource)
      backup_retention_period:             "5" => "5"
      cluster_identifier:                  "niki-dev-commerce" => "niki-dev-commerce"
      cluster_identifier_prefix:           "" => <computed>
      cluster_members.#:                   "1" => <computed>
      cluster_resource_id:                 "cluster-PA4BVKHSGWXDI7RT72RN2JGEZQ" => <computed>
      database_name:                       "commerce" => "commerce"
      db_cluster_parameter_group_name:     "niki-dev-commerce" => "niki-dev-commerce"
      db_subnet_group_name:                "niki-dev-commerce" => "niki-dev-commerce"
      endpoint:                            "<http://niki-dev-commerce.cluster-cgxpu4rhgni7.us-west-2.rds.amazonaws.com|niki-dev-commerce.cluster-cgxpu4rhgni7.us-west-2.rds.amazonaws.com>" => <computed>
      engine:                              "aurora-mysql" => "aurora-mysql"
      engine_version:                      "5.7.12" => <computed>
      final_snapshot_identifier:           "niki-dev-commerce" => "niki-dev-commerce"
      hosted_zone_id:                      "Z1PVIF0B656C1W" => <computed>
      iam_database_authentication_enabled: "false" => "false"
      kms_key_id:                          "" => <computed>
      master_password:                     <sensitive> => <sensitive> (attribute changed)
      master_username:                     "root" => "root"
      port:                                "3306" => <computed>
      preferred_backup_window:             "07:00-09:00" => "07:00-09:00"
      preferred_maintenance_window:        "wed:03:00-wed:04:00" => "wed:03:00-wed:04:00"
      reader_endpoint:                     "<http://niki-dev-commerce.cluster-ro-cgxpu4rhgni7.us-west-2.rds.amazonaws.com|niki-dev-commerce.cluster-ro-cgxpu4rhgni7.us-west-2.rds.amazonaws.com>" => <computed>
      skip_final_snapshot:                 "true" => "true"
      storage_encrypted:                   "false" => "false"
      tags.%:                              "3" => "3"
      tags.Name:                           "niki-dev-commerce" => "niki-dev-commerce"
      tags.Namespace:                      "niki" => "niki"
      tags.Stage:                          "dev" => "dev"
      vpc_security_group_ids.#:            "1" => "1"
      vpc_security_group_ids.1052271664:   "sg-0774db77" => "sg-0774db77"
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Probably something making it not idempotent
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I cannot look at it now though - on my way out
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
The problem looks like your AZ map is not static
Rohit Verma
Rohit Vermaover 8 years ago
no problem, initially i though it can be due to either you are calculation azs or subnets counts somewhere
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Consider hardcodifnit
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Hard coding it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Or at the very least sorting it
Rohit Verma
Rohit Vermaover 8 years ago
Already did that availability_zones = ["us-west-2b", "us-west-2c"]
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Hrmm I see
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
That is the line of investigation I would pursue
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
We used this module for multiple enagagemebrs
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Probably a regression caused by a newer version of terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Show me your subnet invocation
Rohit Verma
Rohit Vermaover 8 years ago
module "subnets" {
  source              = "git::<https://github.com/cloudposse/terraform-aws-dynamic-subnets.git?ref=master>"
  availability_zones  = ["us-west-2b", "us-west-2c"]
  namespace           = "${var.namespace}"
  stage               = "${var.stage}"
  name                = "${local.name}"
  region              = "${var.kops_region}"
  vpc_id              = "${module.vpc.vpc_id}"
  igw_id              = "${module.vpc.igw_id}"
  cidr_block          = "${module.vpc.vpc_cidr_block}"
  nat_gateway_enabled = "true"
}
Rohit Verma
Rohit Vermaover 8 years ago
hardcoded here as well
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Hrmmm yea was going to be my other suggestion
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
You can try upgrading / downgrading the AWS provider
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Hrmmm can you check the status of your 2a az?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
AWS takes zones out of commission
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Though unlikely in us-west
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Also, not all services are available in all zones
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Try a different az selection and see if it makes a difference
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Also try reducing to just 2, for example
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
And don’t include the 2a
Rohit Verma
Rohit Vermaover 8 years ago
okay
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
But their weird thing is it’s saying you are going from 3 => 2
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
As an outsider, it looks like you previously provisioned the cluster in 3 az and now want to shrink it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
That will destroy the cluster
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Terraform is not a good tool for that kind of automation
Rohit Verma
Rohit Vermaover 8 years ago
it never actually happened and i verified that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Hrm odd indeed
Rohit Verma
Rohit Vermaover 8 years ago
i have actually destroy the module and recreated also
Rohit Verma
Rohit Vermaover 8 years ago
and the aws console shows 2 azs only
Rohit Verma
Rohit Vermaover 8 years ago
this looks more of an issue on terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Ya...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Mike Crowe are you using the RDS cluster module?
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
For my info, what is the reason to both specify vpc subnets and ec2 availability zones ?
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
If you leave out availability zones it will work out most likely. The subnet group defines the azs.
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
availability_zones - (Optional) A list of EC2 Availability Zones that instances in the DB cluster can be created in
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yea that’s a good suggestion @Maarten van der Hoef
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Rohit Verma 👆️
Maarten van der Hoef
Maarten van der Hoefover 8 years ago
Has there been a discussion about whether having security groups defined inside modules along the resource of purpose is OK or not, like with the rds module ? I personally dislike it a lot as I used ot create modules which did exactly that. It makes migrations extremely complex in some cases. Next to that the AWS/Terraform security group implementation is poor enough on itself, so it's something I'm extremely careful with. Having vpc_security_group_ids as list variable for a module is a lot simpler and safer I think.
Mike Crowe
Mike Croweover 8 years ago
@Rohit Verma Can you show us the output of terraform plan?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Maarten van der Hoef yes/no, but to your point, this module does not do it correctly
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: image.png
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
☝️ is bad practice. We should use security group rules for stability/interoperability with other modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i think it’s ok, so long as the module returns the security group, so that other modules or consumers can add rules.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
i am open to discussion around this. @Igor Rodionov @Jamie Nelson (BitFlight) @Mike Crowe and @Andriy Knysh (Cloud Posse) probably have more thoughts
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
let’s decide on something.
sarkis
sarkisover 8 years ago
@Erik Osterman (Cloud Posse) what module is that?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Rohit Verma
Rohit Vermaover 8 years ago
@Maarten van der Hoef @Erik Osterman (Cloud Posse) and @Mike Crowe, thanks for your suggestions. For the time being i have actually added all 3 availability zones, anyways as mentioned the instances are created in provided subnets only, so it don’t impact anything
Rohit Verma
Rohit Vermaover 8 years ago
hi team, did any one tried kube2iam with eks and got it working?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Use Kiam
Rohit Verma
Rohit Vermaover 8 years ago
kiam has master agent configuration
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Crap
Rohit Verma
Rohit Vermaover 8 years ago
i don’t understood how to schedule master
Rohit Verma
Rohit Vermaover 8 years ago
eks have no master nodes
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
You might need to have a pseudo master tier
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
On phone
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Kube2iam has a lot of serious issues
Rohit Verma
Rohit Vermaover 8 years ago
sorry didn’t got that, what is pseudo master tier on phone ?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Any interest to collaborate on our EKS modules?
Rohit Verma
Rohit Vermaover 8 years ago
sure i will
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I am on my phone - hard to type :-)
Rohit Verma
Rohit Vermaover 8 years ago
okay, no problem
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Bagel in other hand
Rohit Verma
Rohit Vermaover 8 years ago
ah ha
Rohit Verma
Rohit Vermaover 8 years ago
take your time 🙂
Rohit Verma
Rohit Vermaover 8 years ago
also to support eks, you have to make changes to your subnet module
Rohit Verma
Rohit Vermaover 8 years ago
i will send pr, small change
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Ok many thanks
Rohit Verma
Rohit Vermaover 8 years ago
just when you got time, tell me about psuedo master,
Rohit Verma
Rohit Vermaover 8 years ago
if i promote any worker to act as master, i can’t run anything on it which need role assumption
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yes, want to review the EKS modules I am working on with you
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Rohit Verma are you around?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i can share now
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(or later today - ping me)
Jonathan Olson
Jonathan Olsonover 8 years ago
Just dropped a PR for elasticache-redis, need to be able to pass the encrypt at rest / enable TLS flags. Should be backwards compatible with previous releases (e.g. defaults to false on both). No idea if this is how you prefer I contribute, but let me know: https://github.com/cloudposse/terraform-aws-elasticache-redis/pull/15
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
thanks @Jonathan Olson
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
@Evan Petrie @Max Moon @Daren @chris might be interested in this enhancement for encryption at rest and TLS
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Dave Yu also a heads up, we might need to do this: https://github.com/cloudposse/geodesic/issues/180
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(reported by @Daren)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
they are seeing memory leaks in kiam
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
(and possibly some excess network traffic)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago(edited)
We just released Cloud Posse reference architectures:

https://github.com/cloudposse/terraform-root-modules - Collection of Terraform root module invocations for provisioning reference architectures
https://github.com/cloudposse/root.cloudposse.co - Terraform Reference Architecture of a Geodesic Module for a Parent (“Root”) Organization in AWS
https://github.com/cloudposse/prod.cloudposse.co - Terraform Reference Architecture of a Geodesic Module for a Production Organization in AWS
https://github.com/cloudposse/staging.cloudposse.co - Terraform Reference Architecture of a Geodesic Module for a Staging Organization in AWS
https://github.com/cloudposse/dev.cloudposse.co - Terraform Reference Architecture of a Geodesic Module for a Development Sandbox Organization in AWS
https://github.com/cloudposse/audit.cloudposse.co - Terraform Reference Architecture of a Geodesic Module for an Audit Logs Organization in AWS
https://github.com/cloudposse/testing.cloudposse.co - Terraform Reference Architecture that implements a Geodesic Module for an Automated Testing Organization in AWS

They show how we provision AWS accounts and what Terraform modules we use.
Complete description is here https://docs.cloudposse.com/reference-architectures

Thanks everybody for your contributions.
We will be improving the repos and the docs. Your input and PRs are very welcome.
Rohit Verma
Rohit Vermaover 8 years ago
Awesome team, thanks for open sourcing
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Hi Team, I'm writing a naming/tagging strategy document. I would love another set of eyes on it and suggestions. As far as I can I'm using the cloudposse terraform naming convention, but I needed to extend it to cover a larger number of scenarios.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Sorry, just fixed the access
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
try and click again now
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Permission to comment in the doc is enabled.
krogebry
krogebryover 8 years ago
wow, great document
krogebry
krogebryover 8 years ago
very detailed
krogebry
krogebryover 8 years ago
I think you have everything covered there
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Hah, well, thats kind of you. But critical feedback will help me improve it 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
nice doc @Jamie Nelson (BitFlight)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
here is some feedback 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
1) we usually use namespace as a company name or abbreviation so we can distinguish the company’s resources from other companies resources (but it’s your choice to expand its usage as you described in the doc)

2) the third part in our naming (label) pattern is name, not role. The difference is what it does vs. what it is. Those could be just small differences, but we usually try not to use the resource types in resource names, e.g. we don’t use cp-prod-subnet-xxx-yyy-zzz but instead cp-prod-app1-xxx-yyy-zzz to name a subnet. But I think your doc has described both cases
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I wanted to disambiguate the Name input from the Name output (id) that the label module does, but as a convention document.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Which is why i changed from name to role.
krogebry
krogebryover 8 years ago
Well, I can tell you from years of field experience that most people don't even have the document for the tags, but plenty of tags they want to use
krogebry
krogebryover 8 years ago
So you end up with a giant cluster f*$! of mismatched tags with very little direction, and plenty of weird dependancies and gotchas baked into the system.
krogebry
krogebryover 8 years ago
So, touch somethign and watch the dumpster start burning 😉
krogebry
krogebryover 8 years ago
Having a document like that to start with is a solid way of moving, good footing from the start is a powerful position for sure
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
what it is vs what it does is a very valid point.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Haha, well thats good news @krogebry - its for a transformation project one of my clients have. They have a monolith of aws EC2 instances, and are moving to serverless and docker microservices. And they have hired new teams and such, so before the big work starts on the transform i'm wanting to get a a few standards in place for consistancy
krogebry
krogebryover 8 years ago
nice
krogebry
krogebryover 8 years ago
yeah, that's solid, I've done that work to transform, doing that work now
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
if you use role as a name, it should be role from the business point of view, not resource types point of view. Although in some cases it’s difficult to assign names (yes, naming is hard)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
i'm wanting to get a a few standards in place for consistency - very valid point @Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Whats that saying you have about naming?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
krogebry
krogebryover 8 years ago
Love that
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I may put that as a footnote. 😄
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Jamie this is awesome. I will take a closer look later today. At first glance love the selection of tags.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Access controls via tags is only sometimes supported
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Ha, thanks Erik. Yeah, I have the list
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Maybe add a note in regards to that. It should be used as a last resort IMO
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
For stage segregation, tags are not well suited since there are resources which do not even support tags
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I'm gonna do a policy that means that anyone in the 'developer' group that wants to create new resources from that list, must apply tags at creation.
As well as to 'start' a resource.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
That way the greenfields stuff has to have tags, even if they are not awesome.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
That is cool. Enforcing tags at some level would be a nice account level module!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Maybe i can see if I can just make a cloudtrail metric alert that looks for missing tags on creation, and notifys slack, or a dashboard via sns
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Btw love the font in your doc
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Oh thanks 🙂
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
More of a 'soft' way to enforce it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and implement the hard enforcement if required.
krogebry
krogebryover 8 years ago
Can I offer an idea on that front?
krogebry
krogebryover 8 years ago
I just did something with the tags on this client wrt missing tags
krogebry
krogebryover 8 years ago
It's an idea that Intuit implemented, but geared for tags.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Sure!
krogebry
krogebryover 8 years ago
Alright, so Intuit started this with an "up and to the right" progress over perfection initiative with regards to the overall security of any given account that ran a service ( mobile stuff, mint, etc... ). I've implemented the same idea with various different things including pager duty noise levels.
krogebry
krogebryover 8 years ago
Start with a simple code base ( lambda could work, or ruby+docker+jenkins, whatever ), analyze tags, then create a grading metric. So, A for >90% compliance, B for compliance of >80% >90%, C,D,F etc.
krogebry
krogebryover 8 years ago
Or just go with the numeric, but i think there's almost a cognitive hook on the grades.
krogebry
krogebryover 8 years ago
I usually end up representing these as graphs in Jira
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
A config rule, to do the checks
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago

@krogebry So this is in terms of bringing an account into compliance?
krogebry
krogebryover 8 years ago
krogebry
krogebryover 8 years ago
Yeah, so forcing compliance from resource creation can work, but does get in the way.
krogebry
krogebryover 8 years ago
However, a stance of "progress over perfection" usually works better in the transformation world of things.
krogebry
krogebryover 8 years ago
Like, the reality is that you're probably not going to get people to conform to tags right away, and in some cases you can't enforce things because enforcing the standard might actually break things.
krogebry
krogebryover 8 years ago
So the idea is the Riot sort of mindset where we're just trying to move things up and to the right, or progress over time.
krogebry
krogebryover 8 years ago
Usually more effictive when dealing with people who are maybe a little timid around big changes.
krogebry
krogebryover 8 years ago
</rant cents="2">
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago(edited)
@krogebry agree. But how do you do it from the automation point of view? E.g. we create and provision TF resources without tags (or with some tags), and then use the process to validate the tags and then update all the resources from TF?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Andriy Knysh (Cloud Posse) with aws config rules you can have it provide a compliance report based on your terraform resources https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_manage-rules.html
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
nice
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So instead of hard enforicing it, it can just be dashboard
krogebry
krogebryover 8 years ago
Okay, I can tell you a tale of woe as to how not to do it 😉
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and its something that could be a TF module easily
krogebry
krogebryover 8 years ago
Yeah, so you're on the right track, basically you have two good options: either enforce it from the creation of things, or enforce it later with some kind of dashboard/report'y thingie
krogebry
krogebryover 8 years ago
If you enforce at creation the only real risk is the timing with things, so in many cases the tag creation is a secondary action after the resource is created
krogebry
krogebryover 8 years ago
So you just have to be aware of that, if you do something like "kill instance if tags are missing" with an ASG, you're going to have a bad time because of the timing stuff.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
yea, that’s why naming is hard 🙂
krogebry
krogebryover 8 years ago
It would be neat to have some kind of way to have TF actually enforce the naming conventions with if conditionals
krogebry
krogebryover 8 years ago
Might be an option in 0.12?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Its an option now
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
using my nifty hack
krogebry
krogebryover 8 years ago
ohh, with config rules?
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago(edited)
so I think it’s good to combine the two strategies: 1) enforce some rules at creation; 2) check it after creation and alert/dashboard
krogebry
krogebryover 8 years ago
yeah, okay, I can see how that would be pretty awesome with config rules
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)

variable "failure_text" {
  default = "The values didn't have the values needed"
}
variable "conditional" { default = true }

resource "null_resource" "ASSERTION_TEST_FAILED" {
  count = "${var.conditional ? 1 : 0}"
  "${var.failure_text}" = true
}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Thats the entire assert module I have
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
you would use it like

module "assert_name_length" {
source = "thatmodulepath"
failure_text = "Your name is too long"
conditional = "${length(var.name) < 63}"
}
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
nice hack @Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Although @Andriy Knysh (Cloud Posse) actually won't touch it, because he hates hacks
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So its just for my own compliance checks for now
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
for a few reasons 🙂 :
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
understandable
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
breaking changes and all
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago(edited)
1. As a user of the module, you instantiate the module in TF and you add/change the assertion code - looks like you just control yourself
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
2. Little bit difficult to read 🙂
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago(edited)
But that module has worked since at least version 0.9
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I added it because I had a client just filling in tf vars files
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So they wouldn;t have tf access, and it would go through a pipeline
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
but i agree something like that is needed
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
so, i was using it to cause a TF error and message when their vars were flakey
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Since there are real conditionals in 0.12, we can make it an official module
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
for 0.12
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Error: Error running plan: 2 error(s) occurred:

* module.elasticache_redis.module.dns.var.records: Resource 'aws_elasticache_replication_group.default' does not have attribute 'primary_endpoint_address' for variable 'aws_elasticache_replication_group.default.*.primary_endpoint_address'
* module.elasticache_redis.output.id: Resource 'aws_elasticache_replication_group.default' does not have attribute 'id' for variable 'aws_elasticache_replication_group.default.*.id'
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Daren have you seen this with yours/our TF module for redis
Daren
Darenover 8 years ago
Yes 😞
Daren
Darenover 8 years ago
We are using auth_tokens and if the token is not valid for AWS this happens
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
ok, i think that could be related to our issue
Daren
Darenover 8 years ago
We used:
Daren
Darenover 8 years ago
resource "random_string" "redis_auth_token" {
  length           = 16
  override_special = "!&#$^<>-"
}
tamsky
tamskyover 8 years ago
@Jamie Nelson (BitFlight)
I have grown to dislike "terraform_remote_state" data provider


I love the data provider.

In directories (origin) where another directory (client) is expected to read the state, I create a lib/remote_state.tf in the origin directory.
The (client) directory has a symlink to the lib/remote_directory.tf file, and leaves all the implementation details up to the (origin).

example:
https://github.com/tamsky/terrabase/blob/master/aws-blueprints/core/lib/remote-state.tf
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
that’s nice @tamsky
Sebastian Nemeth
Sebastian Nemethover 8 years ago
Hey everybody! Proud to join the SweetOps crowd... this is a great initiative, seems like a real missing piece.
Sebastian Nemeth
Sebastian Nemethover 8 years ago
I have a quick q regarding the reference architectures, which operate under root.company.com, staging.company.com and prod.company.com etc. Where/how, in this setup, would I set up top-level DNS mappings, e.g. CNAME record referencing company.com -> prod.company.com, app.company.com -> app.prod.company.com etc? Would this be in the root module?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Sebastian Nemeth I can help answer in a few hours.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Andriy Knysh (Cloud Posse) might be around to answer some questions related to this.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Sorry for the messed up css
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
We are still refining that doc to make it more clear
Sebastian Nemeth
Sebastian Nemethover 8 years ago
I'm following it now, but it's taking some cross-referencing. e.g. it tells me to install aws-vault, but then I read that it's included in geodesic, so trying to figure out best way to use geodesic and where to keep the credentials store.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Great of feedback. Agree. Credentials will be stored in an encrypted key chain file
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Inevitably you will want to use AWS vault natively as well. E.g. docker compose
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
But you don’t need to install to get started, so we should not make that a step so early on
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Actually, @Andriy Knysh (Cloud Posse) and I were talking about just this yesterday.
Sebastian Nemeth
Sebastian Nemethover 8 years ago
I don't mind installing aws-vault, but if its already installed in geodesic maybe it's better to just run geodesic while mounting a local volume to store credentials for our developers.
sarkis
sarkisover 8 years ago
@tamsky thanks for the bug report on https://github.com/cloudposse/terraform-aws-alb-target-group-cloudwatch-sns-alarms! Just addressed the arn_suffix issue with a PR - just waiting on an approval and should be merged in...

Also just a heads up that I found and fixed an edge case here, would love a quick review and any comments/suggestions on the solution: https://github.com/cloudposse/terraform-aws-alb-target-group-cloudwatch-sns-alarms/issues/8
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
❤️
sarkis
sarkisover 8 years ago
didn't think it was worth it's own PR for that since it is just cosmetic
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
maybe target_response_time_alarm_enabled = "${floor(var.target_response_time_threshold) < 0 ? 0 : 1 * local.enabled}"
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
should be the one without a floor
sarkis
sarkisover 8 years ago
ah yea its confusing
Yoann
Yoannover 8 years ago
Hi there! I am evaluating using geodesic for my organization and curious to discuss some kubernetes cluster related patterns.
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
since it is actually float
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
@Yoann hi, welcome 🙂
sarkis
sarkisover 8 years ago
i think you mean the other way around right @Jamie Nelson (BitFlight) since reponse time is the one that is a float?
sarkis
sarkisover 8 years ago
so only wrap floor() for var.target_response_time_threshold so it converts that to an int and can compare to 0 safely
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Lets try it in terraform console
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
where var.target_response_time_threshold is 0.5
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago

> floor(0.5) < 0
false
> 0.5 < 0
false
>
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So it evaluates fine
sarkis
sarkisover 8 years ago
hmm
sarkis
sarkisover 8 years ago
ah right
sarkis
sarkisover 8 years ago
string
sarkis
sarkisover 8 years ago
try "0.5" < 0
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago

> floor(0.5)
0
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago

> floor("0.5") < 0
false
sarkis
sarkisover 8 years ago(edited)

> "0.5" < 0
__builtin_StringToInt: strconv.ParseInt: parsing "0.5": invalid syntax in:

${"0.5" < 0}
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago

> floor("1") < 0
false
> floor("-1") < 0
true
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
but when you do the extrapolation
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
it shouldn't be a string
sarkis
sarkisover 8 years ago
thats the exact error you get currenly in latest stable when trying to set response time to 0.X:
__builtin_StringToInt: strconv.ParseInt: parsing "0.5": invalid syntax in:
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
ah
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
well then.... floor it is!
sarkis
sarkisover 8 years ago
haha
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Although this should change in 0.12
sarkis
sarkisover 8 years ago(edited)
i wrapped the others to be safe - but obviously we should not expect a count to be a float
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
What if you took the quotes off the variable?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
defaults
sarkis
sarkisover 8 years ago
@Erik Osterman (Cloud Posse) will kill me 😄
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
nah.. don;t worry about that
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
just floor it
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
😄
sarkis
sarkisover 8 years ago
i agree with erik there too - < 0.12 this is the most sane way to work with terraform i.e. strings, maps, lists
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Yeah
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I have a really large stack of metric alarm notes
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
For things like, containers per instance alarm
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and 'lambda max concurrent execution alarms'
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
and 'rds database level custom metrics -> alarms'
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Which im looking forward to adding to our arsenal
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Oh and billing alerts
sarkis
sarkisover 8 years ago
i copied some already for the module we were talking about 😄
sarkis
sarkisover 8 years ago(edited)
def good stuff - thanks for sharing it!
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
haha
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
I hope you plastered my face across the footer
sarkis
sarkisover 8 years ago
of course
sarkis
sarkisover 8 years ago
😄
sarkis
sarkisover 8 years ago
@Jamie Nelson (BitFlight) if you got a sec: https://github.com/cloudposse/terraform-aws-alb-target-group-cloudwatch-sns-alarms/pull/7 - CR please and I'll owe you a 🍺
sarkis
sarkisover 8 years ago
or a CR whichever
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Checked
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Verified
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
lgtm
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
etc
sarkis
sarkisover 8 years ago(edited)
ty ty
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Issue 6 was mixing case because the cloudwatch metric names are in 🐫
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
So that there was a 1:1 for name recognition
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Originally
sarkis
sarkisover 8 years ago(edited)
Since we have to use modules with terraform and really don't have a desire to buy TF Enterprise just to get a "registry", I was thinking of writing a little utility that will:
• parse through your TF project
• find any modules, then grab the source repo
• compare what version you have to the latest available in the source repo and then output if there is a new revision/tag compared the one being used
sarkis
sarkisover 8 years ago
curious if anyone will find it useful here 😄
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I think @Mike Crowe did wrote something similar
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
would like something like this though
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
sarkis
sarkisover 8 years ago
hmm nice i'd love to see it 😄 - i might just write one on my free time anyway so i have an excuse to write a go utility with cobra
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
yea, go would be my pref!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
this example is a bash script
sarkis
sarkisover 8 years ago
ah cool!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
i also think it would be a popular utility for the community
sarkis
sarkisover 8 years ago(edited)
yea i feel like can benefit from concurrency here - but of course already thinking about github api limits 😛
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
there's some way also to convert HCL to json
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
also, what's nice with mike's script is it can generate the composite outputs from all module deps
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: image.png
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@sarkis you can start with something like this https://github.com/kvz/json2hcl. It shows what terraform packages to use for parsing, or you can convert hcl to json which is easier to analyze
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
hey all, just want to invite those interested to #geodesic and #terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
it might help organize information and get questions better answered if we distribute the traffic
erik
erikover 8 years ago
set the channel topic: Cloud Posse Open Source Community #geodesic #terraform #random #releases #docs
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
We will send people to those channels where it keeps the info categorized:)
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Hey guys, can you give me some idea why the term 'stage' was chosen over 'environment'? In the label module?
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: Image from iOS
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
See #2
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
There are multiple stages
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
It’s where software performs
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
The term environment is also overloaded and often abbreviated as env
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Which from my subjective experience more confusing. Stage imo is misused inside many organizations and I guess I made it our personal mission to correct its usage
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
However I could maybe consider adding environment after stage as another (optional) dimension of disambiguation
krogebry
krogebryover 8 years ago
So what's the name for the env between dev and prod?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that might be staging. note, that staging is not the same word as stage.
erik
erikover 8 years ago
@Erik Osterman (Cloud Posse) uploaded a file: image.png
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
could be QA, UAT, preproduction
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
so "dev" is a stage
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
production is a stage
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
it's a stage in a lifecycle
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
stage 1, stage 2, .... stage n.
U
Unknown Userover 8 years ago
A file, which can't be shown because your team is past the free storage limit, was commented on.
krogebry
krogebryover 8 years ago
I think I like UAT
krogebry
krogebryover 8 years ago
It's descriptive as to what it actually does
krogebry
krogebryover 8 years ago
"Stage" is like you say, it's a part of the rocket, but it doesn't actually define what it's doing
krogebry
krogebryover 8 years ago
I like y'all in this group, really makes me think about the important questions 😉
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
🚀
pmuller
pmullerover 8 years ago
hi
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Suggestions on additional sections, or technologies to cover, or core concepts are very welcomed!
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@Jamie Nelson (BitFlight) as always, very nice doc, thanks for initiating these conversations
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
Thank you @Andriy Knysh (Cloud Posse) :-)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@pmuller hi and welcome
Rohit Verma
Rohit Vermaover 8 years ago
i have exposed kubernetes dashboard with bitly oauth proxy as we do with cloudposse portal
Rohit Verma
Rohit Vermaover 8 years ago
can we pass the dashboard token
Rohit Verma
Rohit Vermaover 8 years ago
somewhere within bitly redirect etc..
Rohit Verma
Rohit Vermaover 8 years ago
or for that kind of login we have to use dex
pmuller
pmullerover 8 years ago
thanks!
pmuller
pmullerover 8 years ago
funny how nice slack channel mostly live... during the night
pmuller
pmullerover 8 years ago
(UTC+8 here)
pmuller
pmullerover 8 years ago
i discovered your github a few days ago, and i love it
pmuller
pmullerover 8 years ago
i am learning so much thanks to you guys !
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(Cloud Posse is based in Los Angeles, CA)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Awesome! Glad to hear your getting some mileage out of it.
pmuller
pmullerover 8 years ago
since when all of this is on GH ?
pmuller
pmullerover 8 years ago
i thought i had a lot of not-that-nice patterns in my code base.. now i know for sure 😛
erik
erikover 8 years ago
set the channel topic: Cloud Posse Open Source Community #geodesic #terraform #release-engineering #random #releases #docs
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@tpagden welcome
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
correct, the module does not support multi-container beanstalk
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
you can open an issue for that and we’ll review
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
or use ECS instead
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
We use containers instead
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
So we package all of our terraform invocations in one repo. Then we use docker Multi Stage builds to copy them. Have a look a look at our reference architectures
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
The Dockerfile shows our strategy
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
You could say we deploy infrastructure as code the same way we deploy applications.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
So we don’t have our apps broken out into production and staging folders. We have then containerized. Then we deploy those containers. We think infrastructure code should be treated the same way.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
This is how we deploy those modules for a staging account.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
it’s wrapper approach (such as Terragrunt) vs. container + ENV vars approach. We use the second one
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yea that’s a succinct way of putting it. @Andriy Knysh (Cloud Posse) I should probably add that to the geodesic readme.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
yep, naming is important, not only for TF resources 🙂
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
but also for patterns and approaches
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
next time somebody asks what approach we use, we can say container + ENV vars (or something like that maybe with a better name)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
I added a #jobs channel where people can post if they are looking for work or are hiring (FTE or contractors).
sarkis
sarkisover 8 years ago
rajcheval
rajchevalover 8 years ago
@Erik Osterman (Cloud Posse) I am working on updating the aws cloud front module to allow me to disable alias creation. https://github.com/cloudposse/terraform-aws-cloudfront-cdn/issues/14. I want to add a boolean dns_aliases_enabled. If the value is false no alias will be create. I see that DNS records are created using module "dns". If DNS was created with resource I can set the count = "${var.dns_aliases_enabled}". False is 0 so no record will be created. As far as I know I cannot pass in "count" to a module. Only option I see is to modify the module that creates DNS to take in count parameter. I am wondering if you have any suggestion for me.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Correct, first we need to update the dns module to add that flag
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Then we can do this module.
rajcheval
rajchevalover 8 years ago
It is great to be here. Thanks for creating these modules. I have a consulting company and one of our clients is using terraform. They told me that cloudposse writes excellent modules.
rajcheval
rajchevalover 8 years ago
I will also add web_acl_id parameter to the cloud front module.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Thanks @rajcheval !!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Can we add the web acl id as a separate PR? Just so we can be more pedantic about how we introduce changes.
rajcheval
rajchevalover 8 years ago
yes this makes sense. adding web acl id is an easier change and I will keep it separate.
rajcheval
rajchevalover 8 years ago
I am looking at the https://github.com/cloudposse/terraform-aws-route53-alias/blob/master/main.tf. It currently calculates the count based on number of elements in the aliases array. I am wondering how I will pass in a count parameter and still keep the current module usable. Current users are not setting count and relying on count being calculated by number of elements in array. Is there a way to not invoke the module that creates dns at all. There is a new beta for terraform and they are making a bunch of enhancements. Perhaps I need to see the language enhancements that may help us.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@rajcheval hi, give me 1 min I’ll show you how to do it
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
first, it will work now w/o any modifications if you provide var.aliases as an empty list, count will be 0 and nothing will be created
resource "aws_route53_record" "default" {
  count   = "${length(compact(var.aliases))}"
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
if we want to introduce var.enabled to be more specific (as we have in other modules), we do this:
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
  count = "${var.enabled == "true" ? length(compact(var.aliases)) : 0}"
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
variable "enabled" {
  type        = "string"
  default     = "true"
  description = "Set to false to prevent the module from creating any resources"
}
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
For <https://github.com/cloudposse/terraform-aws-cloudfront-cdn>, it will work now w/o any modifications if you specify an empty var.aliases
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
module "dns" {
  source           = "git::<https://github.com/cloudposse/terraform-aws-route53-alias.git?ref=tags/0.2.2>"
  aliases          = []
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
if we add var.enabled to route53-alias, then we can add var.dns_aliases_enabled to cloudfront-cdn and use it like this:
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
module "dns" {
  source           = "git::<https://github.com/cloudposse/terraform-aws-route53-alias.git?ref=tags/0.2.2>"
  enabled          = "${var.dns_aliases_enabled}"
  aliases          = "${var.aliases}"
  parent_zone_id   = "${var.parent_zone_id}"
  parent_zone_name = "${var.parent_zone_name}"
  target_dns_name  = "${aws_cloudfront_distribution.default.domain_name}"
  target_zone_id   = "${aws_cloudfront_distribution.default.hosted_zone_id}"
}
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@rajcheval does it answer your questions?
rajcheval
rajchevalover 8 years ago
@Andriy Knysh (Cloud Posse) passing in empty aliases is not an option because cloudfront distribution still needs aliases. However your other suggestion will work. Thank you so much for taking the time to help me. I am going to learn a lot from you.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
(sorry, yes var.aliases is needed in any case, so we need to modify the modules to add enabled and dns_aliases_enabled)
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@rajcheval after you make modifications and before opening a PR, run these three commands to regenerate README:
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
make init
make readme/deps
make readme
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago(edited)
(not terraform-aws-cloudfront-cdn yet, this was not converted to the new README format yet. Just update README.md)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
@Andriy Knysh (Cloud Posse) please merge for me
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Afk
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
100% have been updated
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
working on it now (it needs terraform fmt)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Just not all yet merged
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@rajcheval we merged readme changes to master for https://github.com/cloudposse/terraform-aws-cloudfront-cdn
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
if you open a PR, please run the three commands above to update README
rajcheval
rajchevalover 8 years ago
@Andriy Knysh (Cloud Posse) I did run make commands to update readme. I have submitted PR's for route53 and cloudfront. Once these are approved I will be making my final change on cloudfront resource to allow me to disable DNS record creation.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@rajcheval thanks, will review
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@Jamie Nelson (BitFlight) want to review ^ and maybe add to your doc?
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
sure do!
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@rajcheval reviewed the PRs, look good, just a few comments
krogebry
krogebryover 8 years ago
I've been thinking lately that we should be training the interview skills like we train anything else
krogebry
krogebryover 8 years ago
"How do you adapt when things don't go as planned?" This question has nothing to do with devops per se, but is probably 90% of the actual job.
krogebry
krogebryover 8 years ago
Nice
krogebry
krogebryover 8 years ago
I have a friend that I'm going to try to convince to start up a consulting company that would specialize in training for the interview process
rajcheval
rajchevalover 8 years ago
@Andriy Knysh (Cloud Posse) Thanks for merging my changes. I have one more PR for cloudfront resource ready for review.
Andriy Knysh (Cloud Posse)
Andriy Knysh (Cloud Posse)over 8 years ago
@rajcheval thanks for the PR, looks good, merged to master
Max Moon
Max Moonover 8 years ago
@Erik Osterman (Cloud Posse) if you want we can go over the specs you guys want for https://github.com/cloudposse/terraform-aws-ec2-autoscale-group and i can try to jam it out this week in my spare time
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
that would be awesome.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
When's good for you?
Max Moon
Max Moonover 8 years ago(edited)
my general thoughts are that it should include:
- launch config
- autoscaling group
- basic security group (ingress + egress)
- min/max size vars
- enabled var
- volume size var
- vpc id
- user data script var (this would need to be a path using ${path.module} syntax in local module)
- elb enabled/disabled
- eip enabled/disabled
- dns record pointing to elb/eip?
- dns_zone_id var
Max Moon
Max Moonover 8 years ago
maybe some basic security group ingress/egress rules for things like ssh/http/https
Max Moon
Max Moonover 8 years ago
really any morning works for me
Max Moon
Max Moonover 8 years ago
above is a broad stroke, but that'd be the general idea
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Cool, tomorrow I'll be busy until ~11:30. But free after that.
Max Moon
Max Moonover 8 years ago
cool, just DM me
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yea, let's move this to an issue under that repo
Max Moon
Max Moonover 8 years ago
👍️
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I know @Maarten van der Hoef and @Jamie Nelson (BitFlight) will probably have some valuable input.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Ok, I've commented on it with some additional resources
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
A lot of the work has already been done by @Jamie Nelson (BitFlight) - we just need to modularize it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I link to it in the GH issue
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
This is massively appreciated. We need this module as one of the building-blocks for us to rollout EKS support later, as well 😃
Max Moon
Max Moonover 8 years ago
Nice! Okay cool, I'll take a look at it in a bit
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Also, we can roll it out in phases, if you don't want to bite off too much at once.
Max Moon
Max Moonover 8 years ago
That is a good idea haha
Jamie Nelson (BitFlight)
Jamie Nelson (BitFlight)over 8 years ago
👍️🔥
pmuller
pmullerover 8 years ago
hi
pmuller
pmullerover 8 years ago
I am in the process of migrating terraform modules to codecommit. However, as i already use codecommit on other AWS accounts, I cannot rely on ~/.ssh/config to define a default username; but I want to keep my terraform code generic. I do not want to put my IAM user ssh key id in all module statements, otherwise my coworkers and the CI won't be able to use them. So I tried to use interpolation in the module source to optionally define a SSH username. I ended up reading a bunch of GH wont-fix issues, then found https://github.com/hashicorp/terraform/issues/15614 which tracks precisely what I would need. So, how can I handle my use case? Any suggestion?
pmuller
pmullerover 8 years ago
(and yeah, I would also like to avoid relying on a wrapper which would rewrite all module sources)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
As far as I can tell, @loren’s suggestion is not a wrapper to git. It adds an auth mechanism to the git config
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
You still interact directly with the git command
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Moving from one git repo such as GitHub to CodeCommit will necessarily require updating your module sources, no?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Also, using AWS services for open source implementations will often require some hacks. Just like ECR which requires also using the AWS cli to first generate credentials to docker login.
loren
lorenover 8 years ago
if you really want to use ssh auth to codecommit, another option is to use override.tf and define just the source field for the module
loren
lorenover 8 years ago(edited)
add override.tf to .gitignore to avoid committing it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Wow, didn’t know about that feature :-)
loren
lorenover 8 years ago
very handy if you need to move the modules around between git remotes 🙂
loren
lorenover 8 years ago
i need to test it with nested modules though... not too sure off the top of my head exactly how i'd specify the module name
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Yea don’t see how it could work recursively
loren
lorenover 8 years ago(edited)
maybe nest things inside the override?

module "foo" {
  module "bar" {
    source = "..."
  }
}
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
perhaps terragrunt has something to help write sources on-the-fly
loren
lorenover 8 years ago
i use terragrunt pretty extensively.... i think you can interpolate the top level source in the terragrunt block, but the source in any nested modules would not be interpolated... you'd have to get creative i think, with a terragrunt hook to edit the .tf file in place, after retrieving the modules...
loren
lorenover 8 years ago(edited)
no, that's too late, the modules have already been cloned... hmm...
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
I think it's an interesting use-case
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
Currently, our customers rely entirely on our git repo hosted modules
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago(edited)
but I could see a case where they'd want to replicate them in-house, and then rewrite the base URL and pull locally
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
One way would be to use a HTTP proxy with url rewriting
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
(would only work with HTTP sources)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)over 8 years ago
since we run terraform in a container (geodesic), it would be pretty easy to introduce a proxy in the mix
loren
lorenover 8 years ago
oh, good point, nice