#geodesic - June 2019 | Slack Archive

geodesic

148 messages

Discussions related to https://github.com/cloudposse/geodesic

Archive: https://archive.sweetops.com/geodesic/

May 2019

June 2019

Jul 2019

SweetOps #geodesicover 7 years ago

There are no events this week

Cloud Posseover 7 years ago

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7).

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Mar 20, 2019 11:30AM.

👉️ Add it to your calendar

https://zoom.us/j/684901853

#office-hours (our channel)

JeroenKover 7 years ago

Error configuring the backend "s3": Not a valid region: eu-north-1
I get this error while trying to create tfstate-backend
Is eu-north-1 not allowed?

Erik Osterman (Cloud Posse)over 7 years ago

office hours starting now: https://zoom.us/j/684901853

mmuehlbergerover 7 years ago

Hi folks, it’s been a while! I’ve got a tiny question regarding geodesic and direnv: I’d like to automate the execution of chamber to fetch a stored GitHub token and private key after assuming a role. I thought that having a .envrc file in /conf that does that would be a good idea, but it seems, that direnv is not running after assume-role. Any pointers on how to achieve that?

Erik Osterman (Cloud Posse)over 7 years ago

Hrmmm it should definitely operate even after assume role

Erik Osterman (Cloud Posse)over 7 years ago

Are you running a current version of geodesic?

Erik Osterman (Cloud Posse)over 7 years ago

Ohhhhhhh here’s what maybe is happening. You want it to rerun after assume role, however it runs only once

mmuehlbergerover 7 years ago

Exactly!

Erik Osterman (Cloud Posse)over 7 years ago

You would need to flush the direnv cache so it triggers again

Erik Osterman (Cloud Posse)over 7 years ago

I forget how to do that

mmuehlbergerover 7 years ago(edited)

What would be the easiest way to run a post-asssume-role command? Doesn’t need to be direnv, I would just want to execute some shell commands. Is there any way?

SweetOps #geodesicover 7 years ago

There are no events this week

Cloud Posseover 7 years ago

👉️ Add it to your calendar

https://zoom.us/j/684901853

#office-hours (our channel)

joberover 7 years ago

@Erik Osterman (Cloud Posse) quick question:

Is this https://docs.cloudposse.com/reference-architectures/cold-start/ still pretty much up to date?

joberover 7 years ago

it looks like it may be out of date?

Erik Osterman (Cloud Posse)over 7 years ago

It's mstly out of date

Erik Osterman (Cloud Posse)over 7 years ago

Please use https://github.com/cloudposse/reference-architectures

JeroenKover 7 years ago

in the cold start instruction accounts are provisioned, but in the process a e-mail account like [testing@cloudposse.co] is needed. Is there a workaround because want to use our general department e-mail address.

JeroenKover 7 years ago

How can we use geodesic with for example an mgmt vpc that is connected to a staging vpc and a prod vpc. We use bitbucket server througout the organization. How does this work with the different accounts. Are the examples of custom (terraform)modules?

Erik Osterman (Cloud Posse)over 7 years ago

Think of geodesic as just a preconfigured shell with all the tools required for cloud automation

Erik Osterman (Cloud Posse)over 7 years ago

What you describe is a configuration not a tool

Erik Osterman (Cloud Posse)over 7 years ago

So you would add the configuration to geodesic and run it

Erik Osterman (Cloud Posse)over 7 years ago

This is where our root modules come in

Erik Osterman (Cloud Posse)over 7 years ago

Those provide blueprints for typical configurations like the ones you described

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

@JeroenK in https://github.com/cloudposse/terraform-root-modules, there are a few examples of VPC peering:

Andriy Knysh (Cloud Posse)over 7 years ago

Cross-account VPC peering: https://github.com/cloudposse/terraform-root-modules/tree/master/aws/vpc-peering

Andriy Knysh (Cloud Posse)over 7 years ago

Kops - legacy account (created manually) VPC peering: https://github.com/cloudposse/terraform-root-modules/tree/master/aws/kops-legacy-account-vpc-peering

Andriy Knysh (Cloud Posse)over 7 years ago

EKS - backing services (where you run things like RDS, ElastiCache etc.) VPC peering: https://github.com/cloudposse/terraform-root-modules/blob/master/aws/eks-backing-services-peering/main.tf

Andriy Knysh (Cloud Posse)over 7 years ago

as @Erik Osterman (Cloud Posse) mentioned, geodesic has nothing to do with configuration (code, data, settings), it’s a cloud automation shell with many tools inside, used to secure access to AWS (assume role or enterprise auth like Okta) and orchestration of cloud operations

Andriy Knysh (Cloud Posse)over 7 years ago

configuration usually consists of code (terraform, helm, helmfile, etc.) and data (variables, NEV variables, other settings)

Andriy Knysh (Cloud Posse)over 7 years ago

for code, we use module hierarchy: root modules (catalog of module invocations to provision entire infrastructure) - infrastructure modules (e.g. RDS, EKS, ECS - these are usually combination of other low-level modules) - low-level modules (usually to provision one or a few AWS resources, e.g. IAM role, S3 bucket with permissions, VPC with subnets, etc.)

Andriy Knysh (Cloud Posse)over 7 years ago

all those modules are usually “identity-less”, meaning they don’t care where and how they will be provisioned, all configuration is provided from TF variables, ENV variables, SSM param store, Vault, etc.)

Andriy Knysh (Cloud Posse)over 7 years ago

to directly answer your question, what we do is this:

Andriy Knysh (Cloud Posse)over 7 years ago

1. Create low-level modules (e.g. VPC, IAM, S3, etc.)

Andriy Knysh (Cloud Posse)over 7 years ago

2. Create infrastructure modules (e.g. EKS, ECS, RDS, Aurora), using the low-level modules

Andriy Knysh (Cloud Posse)over 7 years ago

3. Create a reusable catalog of module invocations (we call it root modules) that uses all other modules from the above

Andriy Knysh (Cloud Posse)over 7 years ago

4. Provide configuration to the modules (usually using TF vars from files or Dockerfile, ENV vars, and SSM param store using chamber - depends on use case and whether the data are secrets or not)

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

5. And finally, from geodesic, login to the AWS account (by assuming IAM role), all configuration gets populated from the sources described in #4, and provision infrastructure for the particular account using the root modules invocations (which, once inside the geodesic shell for the particular AWS account, already know how and where they will be provisioned since they got all the configuration)

Josh Larsenover 7 years ago

@Erik Osterman (Cloud Posse) do you have any docs or advice for upgrading to the most recent geodesic with terraform 0.12 with the purpose of upgrading to 0.12 wholly? i just noticed when i do make deps now terraform says the directory is not totally empty (before it would just ignore the envrc tfvars). also, should i be concerned that it may distort my remote state file?

Erik Osterman (Cloud Posse)over 7 years ago

@Josh Larsen - we ran into this too

Erik Osterman (Cloud Posse)over 7 years ago

it's aggravating.

Erik Osterman (Cloud Posse)over 7 years ago

I can give you a temporary workaround (haven't tested it), but I think it hsould work

Erik Osterman (Cloud Posse)over 7 years ago(edited)

basically, run terraform init blah and it should init the files to the blah folder

Josh Larsenover 7 years ago

ok, but that might mess with the tfstate pathing... new state file would for /account-dns might change to /blah/account-dns no?

Erik Osterman (Cloud Posse)over 7 years ago

then set export TF_DATA_DIR=$(pwd)/.terraform

Erik Osterman (Cloud Posse)over 7 years ago

i see what you mean.

Josh Larsenover 7 years ago

guess i could copy it all up one folder after init, just clunky

Josh Larsenover 7 years ago

ok, then its safe to assume geodesic is not really fully in line with 0.12 quite yet?

Erik Osterman (Cloud Posse)over 7 years ago

so all the terraform commands support specifying the path

Erik Osterman (Cloud Posse)over 7 years ago

that path can be added to the TF_CLI* envs

Erik Osterman (Cloud Posse)over 7 years ago

Public #office-hours starting now! Join us on Zoom if you have any questions. https://zoom.us/j/684901853

joberover 7 years ago

is it possible to make changes and not have to rebuild the shell everytime?

Erik Osterman (Cloud Posse)over 7 years ago

Use /localhost

Erik Osterman (Cloud Posse)over 7 years ago

Also, we have this PR pending for docs: https://github.com/cloudposse/docs/pull/460

joberover 7 years ago

Amazing 🙏

joberover 7 years ago

Thanks so much, that provided a ton of clarity

Erik Osterman (Cloud Posse)over 7 years ago(edited)

(@Jeremy G ☝️)

joberover 7 years ago

When I follow these instructions I get an error:


Error copying source module: error downloading `file:///Users/justin/infrastructure/terraform-root-modules/aws/vpc` : source path error: stat /Users/justin/infrastructure/terraform-root-modules/aws/vpc: no such file or directory

joberover 7 years ago

I followed the exact folder structures and everything

Erik Osterman (Cloud Posse)over 7 years ago

But the users folder is not mounted - not by us

Erik Osterman (Cloud Posse)over 7 years ago

Somewhere that is referenced

joberover 7 years ago


As a convenience, Geodesic mounts your home directory into the Geodesic container and creates a symbolic link so that you can reach your home directory using the same absolute path inside Geodesic that you would use on your workstation. This means that as long as you do your development in directories under your home directory (and on the same disk device), your workstation's absolute paths to your development files will work inside Geodesic just as well as outside it.

joberover 7 years ago

Sorry I must be missing something

Erik Osterman (Cloud Posse)over 7 years ago

Aha, that was some thing new Jeremy added

Erik Osterman (Cloud Posse)over 7 years ago

Haven’t tested that myself

Erik Osterman (Cloud Posse)over 7 years ago

I would verify that you have a current version of geodesic

Erik Osterman (Cloud Posse)over 7 years ago

And that you see the symlinks in your shell

joberover 7 years ago

👍️

Jeremy G (Cloud Posse)over 7 years ago

Mapping of Home directory was added in Geodesic 0.94.0 https://github.com/cloudposse/geodesic/releases/tag/0.94.0

joberover 7 years ago

Sorry another noob question:

How do I get domain resolutions to work for the member accounts, lets say <http://app.dev.example.com|app.dev.example.com> in the dev account just being a static s3 site

joberover 7 years ago

I have been digging around the root modules trying to figure this out and so far no luck

Erik Osterman (Cloud Posse)over 7 years ago

so a few things are going on

Erik Osterman (Cloud Posse)over 7 years ago

first you need to delegate <http://dev.example.com|dev.example.com> to the dev account

Erik Osterman (Cloud Posse)over 7 years ago(edited)

the account-dns root module handles creating the zone and is invoked in each child account

Erik Osterman (Cloud Posse)over 7 years ago

then the root-dns module delegates the DNS to each child account

joberover 7 years ago

So I went through the setup of the reference architectures, I have the root account with the NS records set for the dev account. In the dev account the NS records are setup as well and then I created an A record in the dev account to point to the bucket

joberover 7 years ago(edited)

@Erik Osterman (Cloud Posse) would the original hosted zone I had setup for the root domain be interfering with it?

Erik Osterman (Cloud Posse)over 7 years ago

@jober are you using https://github.com/cloudposse/reference-architectures

Erik Osterman (Cloud Posse)over 7 years ago

joberover 7 years ago(edited)

@Erik Osterman (Cloud Posse) yes

joberover 7 years ago

Everything is working as far as the account shells and such. Just having the issue with Route53. I have a suspicion that the original hosted zone setup on the root account is affecting the reference-architecture setup

joberover 7 years ago(edited)

I moved the registrar to point to the new name servers, and move over any legacy record sets, still no luck

joberover 7 years ago

Got it to work 🎉

Erik Osterman (Cloud Posse)over 7 years ago

Great job!

Erik Osterman (Cloud Posse)over 7 years ago

What was it in the end?

joberover 7 years ago

Forgot to update the registrar to the new nameservers 🤦‍♂️

joberover 7 years ago

knew it was going to be a noob mistake, thanks for the patience

Cloud Posseover 7 years ago

👉️ Add it to your calendar

https://zoom.us/j/684901853

#office-hours (our channel)

chrismover 7 years ago

was there something specific to fix this assume-role (win10/wsl/ubuntu18lts) ?

chrismover 7 years ago

🤔

chrismover 7 years ago

all good; found the file from the last time I updated geodesic 😆
ENV ASSUME_ROLE_INTERACTIVE=false ftw

chrismover 7 years ago

How are you supposed to use the legacy s3 storage?
https://github.com/cloudposse/geodesic/commit/4170a58766fa925800c4293886b32da8d254bff9

I tried adding the following to docker


ENV TF_BUCKET_PREFIX=
ENV TF_BUCKET_PREFIX_FORMAT="basename-pwd"

getting the feeling I'll have to clear the TF_BUCKET_PREFIX in the .envrc every folder as it still populates it with path depth I dont want

Erik Osterman (Cloud Posse)over 7 years ago

ENV TF_BUCKET_PREFIX_FORMAT="basename-pwd"

Erik Osterman (Cloud Posse)over 7 years ago

I think this is what yoou want

Erik Osterman (Cloud Posse)over 7 years ago

we have that in many dockerfiles

Erik Osterman (Cloud Posse)over 7 years ago

#office-hours starting now! https://zoom.us/j/684901853

Have a demo of using Codefresh for ETL

Mat Geistover 7 years ago

question regarding geodesic in CICD / automated environments. looking at https://github.com/cloudposse/testing.cloudposse.co/blob/master/codefresh/terraform/pipeline.yml i think im missing how the assume-role actually gets executed. as far as i can tell, theres no way to setup aws-vault to be completely non interactive (it always asks for the passphrase prompt). so, in a sentence: how are roles getting assumed in CICD environments

dustinvbover 7 years ago

@dustinvb has joined the channel

SweetOps #geodesicover 7 years ago

There are no events this week

Cloud Posseover 7 years ago

👉️ Add it to your calendar

https://zoom.us/j/684901853

#office-hours (our channel)

Brandon Wilsonover 7 years ago

Hey everyone, following the quick start docs at https://docs.cloudposse.com/geodesic/module/quickstart/ and i'm running into:

Brandon Wilsonover 7 years ago(edited)

docker run -e CLUSTER_NAME \ -e DOCKER_IMAGE=cloudposse/${CLUSTER_NAME} \ -e DOCKER_TAG=dev \ cloudposse/geodesic:latest -c new-project | tar -xv -C .
docker: invalid reference format.
See 'docker run --help'.

Erik Osterman (Cloud Posse)over 7 years ago

@Brandon Wilson the quick start docs are out of date and not functional. Use the github.com/cloudposse/reference-architectures instead

Brandon Wilsonover 7 years ago

ah okay. thanks Erik!

Erik Osterman (Cloud Posse)over 7 years ago

Also, archives are here: https://archive.sweetops.com/geodesic/

Erik Osterman (Cloud Posse)over 7 years ago

If you get stuck, maybe some nuggets in there.

Erik Osterman (Cloud Posse)over 7 years ago

@dalekurt has been recently working through these

Brandon Wilsonover 7 years ago

So, I pulled the repo, edited configs/root.tfvars, and exported the aws account's root master keys to ENV vars, I'm getting:

Brandon Wilsonover 7 years ago(edited)

terraform init -from-module=modules/root accounts/root
Copying configuration from "modules/root"...
Error: Target directory does not exist
Cannot initialize non-existent directory accounts/root.
make: *** [root/init] Error 1

Erik Osterman (Cloud Posse)over 7 years ago

Not sure. @Jeremy G provisioned these this week. Any ideas?

Brandon Wilsonover 7 years ago

oh, i was running tf 0.12

Erik Osterman (Cloud Posse)over 7 years ago

aha, yes, not updated for 0.12

Brandon Wilsonover 7 years ago

yeah, that's my bad haha

Jeremy G (Cloud Posse)over 7 years ago

Yes, you need to have terraform version 0.11 installed on your workstation.

Jeremy G (Cloud Posse)over 7 years ago

I will be pushing some updates to the Reference Architecture sometime in the next few days.

Jeremy G (Cloud Posse)over 7 years ago(edited)

The main thing is updating the baseline version of Geodesic, and fixing the race condition in making the Docker images. Currently, Terraform often tries to build the Docker images before all the files are in place.

The other big things are to update Kubernetes to 1.12.9, switch from kube-dns to coredns, and to pin the versions of terraform and helm installed in the Docker images.

Brandon Wilsonover 7 years ago

@Jeremy G I'm guessing this is the race condition you mentioned?

Brandon Wilsonover 7 years ago

Error: Error applying plan:

1 error occurred:
	* module.account.module.docker_build.null_resource.docker_build: Error running command 'docker build -t <http://root.blvd.co|root.blvd.co> -f Dockerfile .': exit status 1. Output:
#2 [internal] load .dockerignore
#2       digest: sha256:c8c62ec01c2e58b7ca35e6a8231270186f80ab4c83633dace3b2a61f6e9dc939
#2         name: "[internal] load .dockerignore"
#2      started: 2019-06-25 19:16:05.8271816 +0000 UTC
#2    completed: 2019-06-25 19:16:05.8272689 +0000 UTC
#2     duration: 87.3µs
#2      started: 2019-06-25 19:16:05.8274642 +0000 UTC
#2    completed: 2019-06-25 19:16:05.8712445 +0000 UTC
#2     duration: 43.7803ms
#2 transferring context: 2B 0.0s done


#1 [internal] load build definition from Dockerfile
#1       digest: sha256:045540caaa44e0ec4d861b43e9328ac90843e9d94c485db1703c3e559ed7dc07
#1         name: "[internal] load build definition from Dockerfile"
#1      started: 2019-06-25 19:16:05.8264853 +0000 UTC
#1    completed: 2019-06-25 19:16:05.8265771 +0000 UTC
#1     duration: 91.8µs
#1      started: 2019-06-25 19:16:05.8272773 +0000 UTC
#1    completed: 2019-06-25 19:16:05.8602995 +0000 UTC
#1     duration: 33.0222ms
#1 transferring dockerfile: 2B 0.0s done

failed to read dockerfile: open /var/lib/docker/tmp/buildkit-mount930443153/Dockerfile: no such file or directory

Jeremy G (Cloud Posse)over 7 years ago(edited)

@Brandon Wilson Yes, that is the race condition. You can just run make root again. When it comes time to make the children, the make children command is safe to run multiple times, but to save time, I recommend you make each child one at a time. Or you can wait a couple of days for the next release of the reference architecture.

Brandon Wilsonover 7 years ago

Okay. I've still got some conceptual work to do on my end so I'll probably just hold.

Jeremy G (Cloud Posse)over 7 years ago

Since you are waiting on it, I will make an effort to get the release out today.

Brandon Wilsonover 7 years ago

oh, cool. I mean, no rush really, I don't want to divert your focus for your day haha.

Jeremy G (Cloud Posse)over 7 years ago

No worries, it's one of the things I'm currently working on for a new client.

Brandon Wilsonover 7 years ago

awesome. I appreciate the help.

Brandon Wilsonover 7 years ago

@Jeremy G Question for you, When spinning these accounts up, I want to rename the dev account to sandbox. Is that as simple as s/dev/sandbox/ in accounts_enabled[] in root.tfvars, renaming dev.tfvars and then stage=sandbox in that file?

Jeremy G (Cloud Posse)over 7 years ago

@Brandon Wilson We have pushed out a new reference-architecture release for you. Skimped a tiny bit on the testing, so please let me know if you find any issues. https://github.com/cloudposse/reference-architectures/releases/tag/0.14.0

Brandon Wilsonover 7 years ago

oh awesome. pulling now

Brandon Wilsonover 7 years ago

Ran into some terraform errors

Jeremy G (Cloud Posse)over 7 years ago(edited)

Not Terraform. You need to set environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY to static (not sesson) keys with a lot of privileges. Typically they are the root keys of the root account.

Brandon Wilsonover 7 years ago

yeah, this new aws root account was in the 'waiting period', I fixed that now

Brandon Wilsonover 7 years ago(edited)

should have checked that after I spun the account up heh

Brandon Wilsonover 7 years ago(edited)

so, will failing where it did cause any problems, or will make root pick up where it left off?

Jeremy G (Cloud Posse)over 7 years ago

It is safe to run make root again, but I added a make root/init-resume just for this sort of thing.

Brandon Wilsonover 7 years ago

okay, I'll give make root/init-resume a go then

Jeremy G (Cloud Posse)over 7 years ago

After make root/init-resume (but not after make root) you need to run make root/provision

Brandon Wilsonover 7 years ago

okay, init-resume finished super fast

Jeremy G (Cloud Posse)over 7 years ago

Yes, it's mainly to get you to a viable docker image. I now realize you were already past that. So make root/provision

Brandon Wilsonover 7 years ago

okay

Brandon Wilsonover 7 years ago

running root/provision

Jeremy G (Cloud Posse)over 7 years ago

When that finishes, that will be the equivalent of having run make root successfully and you can proceed from there.

Cloud Posseover 7 years ago

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Jun 26, 2019 11:30AM.

👉️ Register for Webinar

#office-hours (our channel)

Brandon Wilsonover 7 years ago

Erik, Jeremy, thanks for the help yesterday getting the reference architecture up and running. I was able to finish things up this morning and have it all built. Really impressive stuff. Going through it all this morning trying to get a firm grasp on how it all works.

Erik Osterman (Cloud Posse)over 7 years ago

#office-hours starting now https://zoom.us/j/508587304

Erik Osterman (Cloud Posse)over 7 years ago

Aha, for that we have https://github.com/cloudposse/packages/tree/master/vendor/assume-role

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/remind101/assume-role

Erik Osterman (Cloud Posse)over 7 years ago

probably about the same.

May 2019 Browse by date July 2019