#docs

docs

Archived

0164

Archive: https://archive.sweetops.com/docs/

erikover 3 years ago

archived the channel

Erik Osterman (Cloud Posse)over 6 years ago

Adding @U010XGY9B46 bot

Erik Osterman (Cloud Posse)over 6 years ago

https://developers.google.com/tech-writing

Erik Osterman (Cloud Posse)over 6 years ago

@UUB28NLDS help keep tabs! 😉

Mike Crowealmost 7 years ago

Nope, new accounts have 4 max sub-accounts w/o upping the limit. Spin up control tower and you immediately lose 2, leaving 2 sub-accounts. Spin up the 3rd and Control Tower shows the very helpful "Internal Error". Work UI design I've ever seen

Erik Osterman (Cloud Posse)almost 7 years ago

maybe aged accounts are different

Igoralmost 7 years ago

I haven't hit a limit yet with AWS accounts under our org

dalekurtalmost 7 years ago

@dalekurt has joined the channel

Erik Osterman (Cloud Posse)almost 7 years ago

and learned A LOT

Erik Osterman (Cloud Posse)almost 7 years ago

also, if you get stuck @dalekurt has just gone through this

Erik Osterman (Cloud Posse)almost 7 years ago

maybe they have increased the limits

Erik Osterman (Cloud Posse)almost 7 years ago

😕

Erik Osterman (Cloud Posse)almost 7 years ago

by default I think you can create 2 accounts

Mike Crowealmost 7 years ago

Was about to follow https://github.com/cloudposse/reference-architectures -- is there an explanation for why this is required? Open a support ticket to request the limit of AWS accounts be increased for your organization (the default is 1).

Erik Osterman (Cloud Posse)about 7 years ago

opened that

Erik Osterman (Cloud Posse)about 7 years ago

https://github.com/cloudposse/docs/issues/466

Erik Osterman (Cloud Posse)about 7 years ago

@Igor you are right

Erik Osterman (Cloud Posse)about 7 years ago(edited)

crap!

Igorabout 7 years ago

My understanding atm is that aws-vault is for credential management only, and chamber is for managing secrets

Igorabout 7 years ago

Is this the correct def'n for aws-vault? https://docs.cloudposse.com/glossary/aws-vault/

Erik Osterman (Cloud Posse)over 7 years ago

then allow principals_readonly_access to pull from that repo

Erik Osterman (Cloud Posse)over 7 years ago

that says, create a new ECR repo for an “app” (since you need one repo per app in AWS; not like in docker hub)

Erik Osterman (Cloud Posse)over 7 years ago(edited)

where principals_readonly_access are the principals of your kops cluster nodes & masters

Erik Osterman (Cloud Posse)over 7 years ago


module "kops_ecr_app" {
  source    = "git::<https://github.com/cloudposse/terraform-aws-ecr.git?ref=tags/0.4.0>"
  namespace = "${var.namespace}"
  stage     = "${var.stage}"
  name      = "${var.kops_ecr_app_repository_name}"

  enabled = "${var.kops_ecr_app_enabled}"

  principals_full_access     = ["${local.principals_full_access}"]
  principals_readonly_access = ["${local.principals_readonly_access}"]

  tags = "${module.label.tags}"
}

Erik Osterman (Cloud Posse)over 7 years ago

So you would provision your ECR repo like this:

Stephen Lawrenceover 7 years ago

@Erik Osterman (Cloud Posse) I would need to create an assumable role outside of this?

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-root-modules/blob/master/aws/ecr/main.tf#L61-L65

Erik Osterman (Cloud Posse)over 7 years ago

this is how we do it: https://github.com/cloudposse/terraform-root-modules/blob/master/aws/ecr/kops_ecr_app.tf

Erik Osterman (Cloud Posse)over 7 years ago

perfect.

Stephen Lawrenceover 7 years ago

Yes, we have kops building our VPC and k8s cluster

Erik Osterman (Cloud Posse)over 7 years ago

are you using kops?

Erik Osterman (Cloud Posse)over 7 years ago

that way it's seamless

Erik Osterman (Cloud Posse)over 7 years ago

What we do is grant the nodes' instance profile/role access to ECR

Stephen Lawrenceover 7 years ago

I see, I am looking for a quick way to get an ECR + a user for our kubernetes cluster + ci to access.

Erik Osterman (Cloud Posse)over 7 years ago

here's another example: https://github.com/cloudposse/terraform-root-modules/tree/master/aws/ecr

Erik Osterman (Cloud Posse)over 7 years ago

Use the latest per the release.

Erik Osterman (Cloud Posse)over 7 years ago

@Stephen Lawrence yes, ignore those version numbers.

Stephen Lawrenceover 7 years ago

When I update my code to point at the latest releases of the two mentioned modules, I get this:

module.kops_ecr.module.kops_metadata.data.aws_security_group.bastion: data.aws_security_group.bastion: no matching SecurityGroup found

Stephen Lawrenceover 7 years ago

The usage section is showing an older version of the modules.

Stephen Lawrenceover 7 years ago

Hello, checking on the status of the docs for https://github.com/cloudposse/terraform-aws-kops-ecr

erikover 7 years ago

set the channel description: Archive: https://archive.sweetops.com/docs/

Nicki Washingtonalmost 8 years ago

Hi @Igor Rodionov!

Igor Rodionovalmost 8 years ago

Hi @Nicki Washington

Erik Osterman (Cloud Posse)almost 8 years ago

(I think she just recloned and is starting from scratch this time)

Andriy Knysh (Cloud Posse)almost 8 years ago

Let us know what issues you are having so we could help

Nicki Washingtonalmost 8 years ago

Hi @Andriy Knysh (Cloud Posse)! Thanks @Erik Osterman (Cloud Posse)!

Andriy Knysh (Cloud Posse)almost 8 years ago

Hi Nicki

Erik Osterman (Cloud Posse)almost 8 years ago

(@Nicki Washington is helping with all the copy editing and will be updating the docs/faqs/etc)

Erik Osterman (Cloud Posse)almost 8 years ago

@Andriy Knysh (Cloud Posse) is CST, @joshmyers GMT, and @Igor Rodionov OMST

Nicki Washingtonalmost 8 years ago

@Nicki Washington has joined the channel