#docs - April 2019

docsArchived

20 messages

Archive: https://archive.sweetops.com/docs/

April 2019

Stephen Lawrenceover 7 years ago

Hello, checking on the status of the docs for https://github.com/cloudposse/terraform-aws-kops-ecr

Stephen Lawrenceover 7 years ago

The usage section is showing an older version of the modules.

Stephen Lawrenceover 7 years ago

When I update my code to point at the latest releases of the two mentioned modules, I get this:

module.kops_ecr.module.kops_metadata.data.aws_security_group.bastion: data.aws_security_group.bastion: no matching SecurityGroup found

Erik Osterman (Cloud Posse)over 7 years ago

@Stephen Lawrence yes, ignore those version numbers.

Erik Osterman (Cloud Posse)over 7 years ago

Use the latest per the release.

Erik Osterman (Cloud Posse)over 7 years ago

here's another example: https://github.com/cloudposse/terraform-root-modules/tree/master/aws/ecr

Stephen Lawrenceover 7 years ago

I see, I am looking for a quick way to get an ECR + a user for our kubernetes cluster + ci to access.

Erik Osterman (Cloud Posse)over 7 years ago

What we do is grant the nodes' instance profile/role access to ECR

Erik Osterman (Cloud Posse)over 7 years ago

that way it's seamless

Erik Osterman (Cloud Posse)over 7 years ago

are you using kops?

Stephen Lawrenceover 7 years ago

Yes, we have kops building our VPC and k8s cluster

Erik Osterman (Cloud Posse)over 7 years ago

perfect.

Erik Osterman (Cloud Posse)over 7 years ago

this is how we do it: https://github.com/cloudposse/terraform-root-modules/blob/master/aws/ecr/kops_ecr_app.tf

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-root-modules/blob/master/aws/ecr/main.tf#L61-L65

Stephen Lawrenceover 7 years ago

@Erik Osterman (Cloud Posse) I would need to create an assumable role outside of this?

Erik Osterman (Cloud Posse)over 7 years ago

So you would provision your ECR repo like this:

Erik Osterman (Cloud Posse)over 7 years ago


module "kops_ecr_app" {
  source    = "git::<https://github.com/cloudposse/terraform-aws-ecr.git?ref=tags/0.4.0>"
  namespace = "${var.namespace}"
  stage     = "${var.stage}"
  name      = "${var.kops_ecr_app_repository_name}"

  enabled = "${var.kops_ecr_app_enabled}"

  principals_full_access     = ["${local.principals_full_access}"]
  principals_readonly_access = ["${local.principals_readonly_access}"]

  tags = "${module.label.tags}"
}

Erik Osterman (Cloud Posse)over 7 years ago(edited)

where principals_readonly_access are the principals of your kops cluster nodes & masters

Erik Osterman (Cloud Posse)over 7 years ago

that says, create a new ECR repo for an “app” (since you need one repo per app in AWS; not like in docker hub)

Erik Osterman (Cloud Posse)over 7 years ago

then allow principals_readonly_access to pull from that repo

February 2019 Browse by date October 2019