#geodesic - September 2019 | Slack Archive

geodesic

123 messages

Discussions related to https://github.com/cloudposse/geodesic

Archive: https://archive.sweetops.com/geodesic/

Aug 2019

September 2019

Oct 2019

SweetOps #geodesicabout 7 years ago

There are no events this week

Cloud Posseabout 7 years ago

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Sep 11, 2019 11:30AM.

👉️ Register for Webinar

#office-hours (our channel)

SweetOps #geodesicabout 7 years ago

There are no events this week

Cloud Posseabout 7 years ago

👉️ Register for Webinar

#office-hours (our channel)

SweetOps #geodesicabout 7 years ago

There are no events this week

Cloud Posseabout 7 years ago

👉️ Register for Webinar

#office-hours (our channel)

dalekurtabout 7 years ago

Hey guys, I’m using the reference architecture to setup my AWS landing zone and having an issue with make finalize with the following output - https://gist.github.com/dalekurt/7c451ba3914f066bf16b42392904aca1

dalekurtabout 7 years ago

I believe from the output some s3 bucket are missing from other accounts.

SweetOps #geodesicabout 7 years ago

There are no events this week

Cloud Posseabout 7 years ago

👉️ Register for Webinar

#office-hours (our channel)

oscarabout 7 years ago

I’ve placed a file in /rootfs/usr/bin with the hopes it’ll copy to bin but no luck on make build. Any guidance available please?

joshmyersabout 7 years ago(edited)

did you make install your new container? Sure you are running the newly built version?

joshmyersabout 7 years ago(edited)

Putting into rootfs/usr/local/bin/foo worked for me with a make all

oscarabout 7 years ago

This is an existing geodesic module.
I have a new script : rootfs/usr/bin/lint and run make build and then start my Geodesic module, but the script is not in the /usr/bin/ dir in the Geodesic module container

oscarabout 7 years ago

Doesn’t seem any different to my rootfs/etc/profile.d/aliases.sh script, yet doesn’t copy over

Erik Osterman (Cloud Posse)about 7 years ago

In your Dockerfile, you'll need something like COPY rootfs/ /

oscarabout 7 years ago

COPY rootfs/ / Already present

oscarabout 7 years ago

so alises.sh works just fine

Erik Osterman (Cloud Posse)about 7 years ago

I suspect it's attaching to a running container

oscarabout 7 years ago

but lint does not

oscarabout 7 years ago

ah ok

oscarabout 7 years ago

Ah yes

oscarabout 7 years ago

I did have it open in a nother window

oscarabout 7 years ago

lets see

Erik Osterman (Cloud Posse)about 7 years ago

😃

oscarabout 7 years ago

Spot on 😉

oscarabout 7 years ago(edited)

Anyway to give a /usr/bin/ file chmod +x easily?

oscarabout 7 years ago

I notice for this you don’t https://github.com/cloudposse/geodesic/blob/master/rootfs/usr/bin/s3fs

oscarabout 7 years ago

For now I’ve popped


COPY rootfs/ /
RUN chmod -R +x /usr/bin/

oscarabout 7 years ago

in Dockerfile which will do, but let me know if there’s a better solution

Erik Osterman (Cloud Posse)about 7 years ago

Hrmmm modes should be carried over from what is in git

Erik Osterman (Cloud Posse)about 7 years ago

According to that link, it’s an executable

Erik Osterman (Cloud Posse)about 7 years ago

Would need to take a deeper look

joshmyersabout 7 years ago

lol.

dalekurtabout 7 years ago

@Erik Osterman (Cloud Posse) That is correct, the mode of the file (in git) would be the same when copied to the Docker image.

oscarabout 7 years ago

Excellent thanks

oscarabout 7 years ago

Missed that part.

oscarabout 7 years ago

:doh:

oscarabout 7 years ago

We have some people using AWS Vault and other AWS auth mechanics. We’ve disabled aws-vault in the Dockerfile due to the UI prompts it causes that aren’t needed for ‘other auth’ users (90% of users).
For the 10% using AWS Vault, how can we have them use the same Geodesic/Dockerfile, but toggle AWS_VAULT_ENABLED ? I notice if you set this to true inside the container nothing happens, so it is clearly a build arg (could be wrong).

Any alts?

oscarabout 7 years ago

(Or is it possible to have it enabled but disable -> Run 'assume-role' to login to AWS with aws-vault that is printed on every command 😧 )

joshmyersabout 7 years ago

@oscar Have you looked through the geodesic codebase for how to do this? It is all pretty readable. I’m sure PRs welcome if it doesn’t do what you require

joshmyersabout 7 years ago(edited)

https://github.com/cloudposse/geodesic/blob/master/rootfs/etc/profile.d/aws-vault.sh#L114

oscarabout 7 years ago

I have not. I will take a look and see if I can put a PR through

oscarabout 7 years ago

Thx

oscarabout 7 years ago

I imagine that runs at build time only?

oscarabout 7 years ago

Or rather container start

joshmyersabout 7 years ago

So, off the top of my head you could use build args here, which geodesic and build harness already supports

joshmyersabout 7 years ago(edited)

https://github.com/cloudposse/geodesic/blob/master/Makefile#L19-L20 Geodesic uses the docker:build target from https://github.com/cloudposse/build-harness/blob/master/modules/docker/Makefile.build

joshmyersabout 7 years ago(edited)

https://github.com/cloudposse/build-harness/blob/master/modules/docker/Makefile.build#L16 specifically

joshmyersabout 7 years ago

So you could an an ARG to the dockerfile, and change https://github.com/cloudposse/geodesic/blob/master/Makefile#L20 to make --no-print-directory docker:build ARGS="AWS_VAULT_ENABLED"

oscarabout 7 years ago

I’m actually leaning towards…

oscarabout 7 years ago


	PROMPT_HOOKS+=("aws_vault_prompt")
	function aws_vault_prompt() {
		if [ -z "${AWS_VAULT}" ] && [ "${AWS_VAULT_PROMPT" == "true"]; then
			echo -e "-> Run '$(green assume-role)' to login to AWS with aws-vaultdsfdsfdssf"
		fi
	}

oscarabout 7 years ago

👀

joshmyersabout 7 years ago

and add some makefile default that users can set an env var to turn off at build time

oscarabout 7 years ago

Would you accept the above?

joshmyersabout 7 years ago

It’s not me 🙂

oscarabout 7 years ago

Jeremy and Erik??

joshmyersabout 7 years ago

Not sure who atm but best open a PR and see

joshmyersabout 7 years ago

The above just turns off the prompt though, why not use the ENV var that is already there to turn the whole lot off, which is actually what you want

joshmyersabout 7 years ago

Not just the prompt.

oscarabout 7 years ago

I want AWS VAULT on, but prompt off

oscarabout 7 years ago

that way everyone can use the same Dockerfile no extra config

joshmyersabout 7 years ago

Not what you said in https://sweetops.slack.com/archives/CB84E9V54/p1569407689020100

oscarabout 7 years ago

L142


	PROMPT_HOOKS+=("aws_vault_prompt")
	function aws_vault_prompt() {
		if [[ -z "${AWS_VAULT}" ]] && [[ "${AWS_VAULT_PROMPT" != "false"]]; then
			echo -e "-> Run '$(green assume-role)' to login to AWS with aws-vault"
		fi
	}

joshmyersabout 7 years ago

The above would also allow the same Dockerfile etc to be used

oscarabout 7 years ago

Yeh think I had some development time between then and went out for a lunch

oscarabout 7 years ago

That snippet wouldn’t affect anyone else

joshmyersabout 7 years ago

but the folks who do want to use aws-vault just set some var in their bash profile or whatever which will be used when they make build

oscarabout 7 years ago

but would allow others to disable prompt

joshmyersabout 7 years ago

What you want to do is already supported with some tweaks to the dockerfile/Makefile, which wouldn’t need to effect all of you.

joshmyersabout 7 years ago

Open a PR and I’m sure someone will get to it.

oscarabout 7 years ago

https://github.com/cloudposse/geodesic/pull/525

joshmyersabout 7 years ago

@oscar How will you set AWS_VAULT_PROMPT ?

oscarabout 7 years ago

Geodesic Dockerfile

joshmyersabout 7 years ago

Right, so you still need to add something to the Dockerfile

oscarabout 7 years ago

Yep, I am ok with that, is that a problem generally?

oscarabout 7 years ago

Seems like an OK thing. It’s a per geodesic module config

joshmyersabout 7 years ago(edited)

No but I don’t see how it differs from the suggestion above which doesn’t involve a PR as it is already supported. Also still not sure why you want AWS_VAULT_ENABLED true, but no prompt….

oscarabout 7 years ago

Other people can benefit 🤷‍♂️

oscarabout 7 years ago

Ok I can explain

oscarabout 7 years ago

Maybe context will help understand my rationale

joshmyersabout 7 years ago

Maybe best off to add that to the PR.

oscarabout 7 years ago

We have 9 users on Azure AD authing with AWS

oscarabout 7 years ago

we have to use this NPM package called aws-azure-login

oscarabout 7 years ago

we don’t need aws-vault

oscarabout 7 years ago

but we have 1 user using IAM users with keypair

oscarabout 7 years ago

they need aws-vault

oscarabout 7 years ago

We all use the same geodesic repo + module + files

oscarabout 7 years ago

I understand the geodesic local config

oscarabout 7 years ago

that is fine in principle

oscarabout 7 years ago

but I don’t want to have to ask people to do such things

joshmyersabout 7 years ago

So how can all users use the same dockerfile now if passing AWS_VAULT_PROMPT = false ?

oscarabout 7 years ago

Because we don’t use aws-vault, but now the prompt is gone

oscarabout 7 years ago

So it’s there

oscarabout 7 years ago

just not in our faces

joshmyersabout 7 years ago

sigh

joshmyersabout 7 years ago

nvm

oscarabout 7 years ago

Plus even when using aws-vault it’s annoying

oscarabout 7 years ago

You don’t need the prompt to use vault

oscarabout 7 years ago

or am I misunderstanding

joshmyersabout 7 years ago

You don’t need the prompt no.

oscarabout 7 years ago

I am missing why you are frustrated then

oscarabout 7 years ago

Your solution is good. Have a .bashrc variable and pass it in the build target, but I don’t want to have to ask people to modify their .bashrc

joshmyersabout 7 years ago

From experience working with devs who may not be used to AWS or geodesic, telling them to assume-role is useful. Rather than not, expecting people to know to run the thing before anything else

joshmyersabout 7 years ago

and what you actually want to do is not enable AWS_VAULT for those users, not just hide the prompt for all…

joshmyersabout 7 years ago

anyway, nvm, I see your use case.

Erik Osterman (Cloud Posse)about 7 years ago

public #office-hours starting now! join us to talk shop https://zoom.us/j/508587304

Fred Lightabout 7 years ago

hi guys ! tnaks for the SweetWorks ! I don't really understand how you can override the policy or roles attributes using terraform-aws-ecr (0.6.1 tag) module. The documentation seems a bit outdated because the provided samples raise error in geodesic shell. Do you have an up to date usage sample ?

oscarabout 7 years ago

You would want to extend it (fork and PR) so that it can default to a policy doc that has CP’s default but also support taking from a users input https://github.com/cloudposse/terraform-aws-ecr/blob/master/main.tf#L28

Fred Lightabout 7 years ago

thxs @oscar

oscarabout 7 years ago

(but as of yet doesn’t look like you can hence why you’d need to develop it yourself)

Fred Lightabout 7 years ago

ok got it clear. i was wondering this because of the error but in the meantime i understood it was linked to the IAM role not being specified as data. So no need to PR at the end but good to know it work this way.

oscarabout 7 years ago

What’s the error?

oscarabout 7 years ago

FYI

oscarabout 7 years ago

0.6.1 is TF 11

oscarabout 7 years ago

0.7.0 is TF 12

oscarabout 7 years ago

So you want TF 11? Okie that’s fine. Is your Geodesic using TF 11?