#geodesic - October 2019

October 2019
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
@here public #office-hours starting now! join us to talk shop https://zoom.us/j/508587304
dalekurt
dalekurtabout 7 years ago
@Jeremy G Eric suggested that I speak with you regarding my current issue with the reference-architecture, as you had a similar challenge. Here is a Gist of it - https://gist.github.com/dalekurt/7c451ba3914f066bf16b42392904aca1
Jeremy G (Cloud Posse)
Jeremy G (Cloud Posse)about 7 years ago
@dalekurt I need more context to really understand what is going on here, but my guess is that generally the reference architecture scripts still require Terraform v0.11 but the make root scripts are using the default terraform which is now v0.12. @Erik Osterman (Cloud Posse) when Terraform is being bootstrapped (initial S3 buckets created and initialized) where are the scripts getting the terraform binary from?
dalekurt
dalekurtabout 7 years ago
@Jeremy G If I recall correctly, I have terraform v0.11 installed (at home) I did perform a git pull recently. The make root and make children executed successfully but make finalize failed with the error in the gist.
dalekurt
dalekurtabout 7 years ago
Those are executed in the docker container and not my local installation of terraform from my understanding.
Jeremy G (Cloud Posse)
Jeremy G (Cloud Posse)about 7 years ago(edited)
@dalekurt Geodesic has both versions of terraform (0.11 and 0.12) installed so we can use both during the current transition period, but defaults to 0.12. We use direnv to read .envrc files in directories, and in those .envrc files we (should) have either use terraform 0.11 or use terraform 0.12 to pick which version to use. That mechanism works fine, we use it in all our current projects, but we use reference-architecture only rarely and it is therefore often broken around issues like this. My guess is that the bootstrap code is missing a use terraform 0.11 somewhere.
Jeremy G (Cloud Posse)
Jeremy G (Cloud Posse)about 7 years ago
@dalekurt Looking into it some more, I can see a bunch of things that could have gone wrong. I would check which S3 buckets were created for the Terraform state files (just check root and one child account, like audit), if they were populated with state during make root and make children, and what name the Terraform module thinks the S3 bucket should have when it is erroring out. My current guess is that the buckets are being created correctly but the IAM role is lacking permissions. We recently started locking down S3 buckets by default and ref-arch might have been relying on them being open until everything was finalized. If the bucket exists but you are getting NoSuchBucket errors, that is a permissions problem. If the bucket really does not exist, either you missed an earlier error where the creation failed or the name of the bucket that was created does not match the name of the bucket TF is attempting to read, which can happen when we update one thing but forget to update another, or are using incompatible versions.
dalekurt
dalekurtabout 7 years ago
@Jeremy G Thank you, that was a pretty comprehensive response. I will have a look at this later today
chrism
chrismabout 7 years ago
joys of windows update

dirname: missing operand
Try 'dirname --help' for more information.
/usr/local/bin/prod.xx.uk: line 115: cmd.exe: command not found

docker loads; just no aws-vault 🙄
chrism
chrismabout 7 years ago
i think the windows wsl interop died; god knows
chrism
chrismabout 7 years ago
no fstab entries; using the LOCAL_HOME="C:\Users\xx\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\home\xxx" env set before calling it works for now though lol ohhhhhhh windows
chrism
chrismabout 7 years ago
seems related to the wsl conf; its not changed but its also not working :party_poop:
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
@chrism dang!!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
yea, what a PIA
chrism
chrismabout 7 years ago
its fine; its all windows fault 😄
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
is it something you think you can fix? we can review the PR
chrism
chrismabout 7 years ago
I don't think the code needs fixing tbh
chrism
chrismabout 7 years ago
The wsl process is supposed to map all the windows drives to fstab on boot; but its not working.
The bootstrap script uses the fstab to find the location
chrism
chrismabout 7 years ago
"potentially" this all magically starts to work proplerly in WSL2 as the "wsl home" is a virtual drive not just a windows folder
chrism
chrismabout 7 years ago
I just need to fix my wsl to fix it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
ok, report back on what you come up with
chrism
chrismabout 7 years ago(edited)
If im torching it I might as well try wsl 2 and see if it solves all the other issues (hopefully all the hacks made to get wsl 1 working wont break wsl 2 😆 )
chrism
chrismabout 7 years ago
i backup my user dir anyway so its just the tedium of waiting for windows to complete steps purging it all out. Not quite as good as when I could use vmware (damn hyperv) and snapshot ubuntu, but it'll do 😄
chrism
chrismabout 7 years ago
wsl2 still requires you to be on the 'goat sacrifice' branch (tech preview); reinstalled wsl and the mount issue wasnt fixed. My laptops up to the same build and is fine.
Fixed it in the end with mount -t drvfs C: /c in the /etc/wsl.conf
chrism
chrismabout 7 years ago
left the full path in my bashrc file though after testing; cuts down on the faff
loren
lorenabout 7 years ago
dang, scared to reboot now... haven't seen the mount issue yet on wsl myself...

$ cat /etc/wsl.conf
[automount]
enabled = true
options = "metadata,umask-22,fmask-11"
mountFsTab = true
$ cat /etc/fstab
LABEL=cloudimg-rootfs   /        ext4   defaults        0 0
C:           /mnt/c         drvfs   rw,metadata,noatime,case=off,uid=1000,gid=1000,umask=22,fmask=11     0    0
chrism
chrismabout 7 years ago
My laptops been fine; its weird af.
chrism
chrismabout 7 years ago
tbh if you just shove the fstab setting back in it works fine; It was only C that went to pot; my other shared drives worked fine.
S
SweetOps #geodesicabout 7 years ago
There are no events this week
C
Cloud Posseabout 7 years ago
:zoom: Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Oct 16, 2019 11:30AM.

👉️ Register for Webinar

:slack: #office-hours (our channel)
oscar
oscarabout 7 years ago
FYI I’ve gutted the way I use Geodesic. Instead of one module per account I now use the following structure
oscar
oscarabout 7 years ago

└── terraform
    ├── .envrc
    └── aws
        ├── .envrc
        ├── bastion
        │   ├── .envrc
        │   └── Makefile
        ├── development
        │   ├── .envrc
        │   └── account
        ├── production
        │   └── .envrc
        └── shared
            ├── .envrc
            ├── .module
            ├── .terraform
            ├── Makefile
            └── terraform.tfvars
oscar
oscarabout 7 years ago
If anyone is keen on reducing the maintenance of several modules and only holding one I can give some practices
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
that looks good - but i would also add region
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
if you want to future proof yourself some more
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago(edited)
also, I think I would do terraform/stage/cloud/region
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
e.g terraform/prod/cloudflare and terraform/prod/aws/us-east-1
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
seems natural to bundle everything for prod together.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
are you using github?
oscar
oscarabout 7 years ago
True I was thinking about this
oscar
oscarabout 7 years ago
No this is on our internal VCS
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
aha
oscar
oscarabout 7 years ago
x)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
i have some thoughts on the mono repo + geodesic + github actions
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
another thing to consider....
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
so terraform as a community seems to be going more the way of workspaces
oscar
oscarabout 7 years ago
Yes I have also shifted to workspaces
oscar
oscarabout 7 years ago
mainly to conform with terraform cloud
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
right
oscar
oscarabout 7 years ago
but I obviously have my IP Whitelist issue
oscar
oscarabout 7 years ago
but not workspaces as in terraform workspace add
oscar
oscarabout 7 years ago
just rather
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
so then i'm thinking the stage folder makes less sense - as it doesn't help you be as DRY
oscar
oscarabout 7 years ago

├── terraform-aws-app
│   ├── README.md
│   ├── eks.tf
│   ├── environments
│   │   └── development
│   ├── terraform.tf
│   ├── variables.tf
│   ├── versions.tf
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
yea, something like that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
@sarkis shared this which piqued my interest
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
using yamldecode you can now define your own configs for environments
oscar
oscarabout 7 years ago
I’ve seen that
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
then load those based on the workspace name
oscar
oscarabout 7 years ago
but I’ve got a super duper thing going on
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
😃
oscar
oscarabout 7 years ago
it’s hard to type out
oscar
oscarabout 7 years ago
but hopefully I can make office hours tomorrow
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
yes!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
i want to see it.
oscar
oscarabout 7 years ago
The gist is:

- One geodesic module for all envs.

└── terraform
    ├── .envrc
    └── aws
        ├── .envrc
        ├── bastion
        │   ├── .envrc
        │   └── Makefile
        ├── development
        │   ├── .envrc
        │   └── account
        ├── production
        │   └── .envrc
        └── shared
            ├── .envrc
            ├── .module
            ├── .terraform
            ├── Makefile
            └── terraform.tfvars

- Terraform infra definitions (root modules that uses child modules) has ‘workspace’-like configs

├── terraform-aws-app
│   ├── README.md
│   ├── eks.tf
│   ├── environments
│   │   └── development
│   ├── terraform.tf
│   ├── variables.tf
│   ├── versions.tf

- Important files like Makefiles to operate Terraform & terraform.tfvars are loaded at ‘terraform init’ run time
oscar
oscarabout 7 years ago
so this means that you don’t have to keep rebuilding the geodesic shell
oscar
oscarabout 7 years ago
it just pulls them from git at use-time meaning you always get the latest
oscar
oscarabout 7 years ago
And any variables set in Geodesic are extremely static and very unlikely to change (e.g. Account ID, VPC ID)
oscar
oscarabout 7 years ago
arguably VPC ID isn’t even needed anymore as I get that from DATA, that’s just a legacy variable
oscar
oscarabout 7 years ago
joshmyers
joshmyersabout 7 years ago
to essentially clone the build-harness and include the targets?
joshmyers
joshmyersabout 7 years ago
If this isn’t in a public Github repo, it is going to require a token to clone the https repo, as well as already having an ssh key…
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
No token needed to clone public repos over https
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
But yes if you wanted to make it private it would require a token
joshmyers
joshmyersabout 7 years ago(edited)
Yup, wondered how much work to do this all over ssh rather than https
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Guess you could do this instead of curl
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
git archive --remote=git@gitserver.example.com:myrepo master path/to/file1 | tar -xOf -
joshmyers
joshmyersabout 7 years ago
ah, that maybe the magic I’m after
Jeremy G (Cloud Posse)
Jeremy G (Cloud Posse)about 7 years ago
@oscar If you want to have Geodesic install the latest APKs during the build process, first run make geodesic_apkindex.md5 to invalidate the Docker cache layer that caches the old APK indexes.
oscar
oscarabout 7 years ago
Thanks!
oscar
oscarabout 7 years ago
@Jeremy G - I’ve updated to the latest Geodesic (0.123.1), and tried both terraform@cloudposse and terraform-0.12@cloudposse and still end up with TF v0.12.7 any thoughts?

FROM cloudposse/geodesic:0.123.1

RUN apk add --update --no-cache \
  terraform@cloudposse
oscar
oscarabout 7 years ago
No existing containers running either
oscar
oscarabout 7 years ago
N’aaww I got it. Don’t worry. User error to do with changing the docker image name and not adding it to the bin, meaning make run was still using the old image.,
S
SweetOps #geodesicabout 7 years ago
There are no events this week
C
Cloud Posseabout 7 years ago
:zoom: Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Oct 23, 2019 11:30AM.

👉️ Register for Webinar

:slack: #office-hours (our channel)
oscar
oscarabout 7 years ago
I did try the make *.md5 command though and that came up with no target found.
oscar
oscarabout 7 years ago
As of my upgrade to 0.123.1 from 0.122.4 I’m no longer able to run terraform init using the TF_MODULE_CACHE setting (as per logic in Geodesic’s terraform script.. below…)

	# Starting with Terraform 0.12, you can no longer initialize a directory that contains any files (not even dot files)
	# To mitigate this, define the `TF_MODULE_CACHE` variable with an empty directory.
	# This directory will be used for `terraform init -from-module=...`, `terraform plan`, `terraform apply`, and `terraform destroy`
	if [ -n "${TF_MODULE_CACHE}" ]; then
		export TF_CLI_PLAN="${TF_MODULE_CACHE}"
		export TF_CLI_APPLY="${TF_MODULE_CACHE}"
		export TF_CLI_INIT="${TF_MODULE_CACHE}"
		export TF_CLI_DESTROY="${TF_MODULE_CACHE}"
	fi
}
oscar
oscarabout 7 years ago
The only thing changed is package versions of terraform#
oscar
oscarabout 7 years ago
I’ve also reviewed terraform releases and can’t see what could have done this between 0.12.4 and 0.12.10
oscar
oscarabout 7 years ago

TF_VAR_tf_module_cache=.module
TF_CLI_ARGS_init=-backend-config=region=eu-west-1 -backend-config=bucket=development-terraform-state -backend-config=dynamodb_table=development-terraform-state-lock -from-module=git::git@bitbucket.org:xcv.git?ref=master
TF_MODULE_CACHE=.module
oscar
oscarabout 7 years ago
Ok appears to be because I lost my use terraform along the way in my .envrc
oscar
oscarabout 7 years ago(edited)
Yarp. Re-added

use terraform
use tfenv

and all gucci on latest geodesic and just cloudposse@terraform instead of cloudposse@terraform_0.12
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
excellent!
oscar
oscarabout 7 years ago
---

I’m trying to ssh-add /path/to/private/key inside of BitBucket pipelines however I get:


> ssh-add /opt/atlassian/pipelines/agent/ssh/id_rsa
Could not open a connection to your authentication agent.
oscar
oscarabout 7 years ago
Am I missing something? Is this BB P thing e.g. non exposed service etc
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
looks like your ssh agent is not started
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
we only start it by default in interactive sessions
oscar
oscarabout 7 years ago
ahhh
oscar
oscarabout 7 years ago
gotcha
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
here's how we do it for atlantis
oscar
oscarabout 7 years ago
just run

# Otherwise launch a new agent
if [ -z "${SSH_AUTH_SOCK}" ] || ! [ -e "${SSH_AUTH_SOCK}" ]; then
	ssh-agent | grep -v '^echo' >"${SSH_AGENT_CONFIG}"
	. "${SSH_AGENT_CONFIG}"

	# Add keys (if any) to the agent
	if [ -n "${SSH_KEY}" ] && [ -f "${SSH_KEY}" ]; then
		echo "Add your local private SSH key to the key chain. Hit ^C to skip."
		ssh-add "${SSH_KEY}"
	fi
oscar
oscarabout 7 years ago
ah nice
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
you could maybe do sometihng similar
oscar
oscarabout 7 years ago
thanks 🙂
oscar
oscarabout 7 years ago
what’s gosu
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
very easy utility to drop permissions to a user
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
easier than using sudo or su
oscar
oscarabout 7 years ago
super thx
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
you may not need it
dalekurt
dalekurtabout 7 years ago
I’m having some trouble decrypting the IAM user password created. Using the decrypt command echo "MY_PGP_MESSAGE" | base64 --decode | keybase pgp decrypt I get the error message “ERROR decrypt error: unable to find a PGP decryption key for this message”
dalekurt
dalekurtabout 7 years ago
Am I missing something here?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Are you running that natively on your Mac?
dalekurt
dalekurtabout 7 years ago
Yes, on my mac.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Sounds like something wrong with keybase install
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Or using wrong keybase username
dalekurt
dalekurtabout 7 years ago(edited)
That latter was my assumption.
S
SweetOps #geodesicabout 7 years ago
There are no events this week
C
Cloud Posseabout 7 years ago
:zoom: Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Oct 30, 2019 11:30AM.

👉️ Register for Webinar

:slack: #office-hours (our channel)
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
@oscar you have this problem too? https://github.com/hashicorp/terraform/issues/17300
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Looks like there's no way to elegantly work around it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
other than creating a symlink in the .module/.terraform to -> .terraform
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
the -state=... argument is useless
oscar
oscarabout 7 years ago
Yep!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
=(
joshmyers
joshmyersabout 7 years ago
Starting to feel like TF init from module is going to be made harder and harder
oscar
oscarabout 7 years ago
I have moved to Terraform Cloud to avoid these issues
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Yes, I feel that way too
joshmyers
joshmyersabout 7 years ago
What would be another option if not using tf init from module...
oscar
oscarabout 7 years ago
git clone X && cd X
oscar
oscarabout 7 years ago
but direnv doesn’t support cd
joshmyers
joshmyersabout 7 years ago
Move a terraform-root-modules style module into the env containers?
oscar
oscarabout 7 years ago
I tried that the other day, perhaps I didn’t do it right though
dalekurt
dalekurtabout 7 years ago
here is a question for the channel, after successfully completing the deployment of the reference-architecture and I’m on to the next steps to commit the /repos for the accounts created. Should I be committing each to their individual git repository, for example /repos/audit.mycompany.com to a <http://github.com/mycompany/audit.mycompany.com|github.com/mycompany/audit.mycompany.com>?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
yep!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
that's how we do it
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
we treat each account as an application
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
no 2 accounts are ever the same
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
They may run the same software pinned at versions
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
But usually many things vary
dalekurt
dalekurtabout 7 years ago
@Erik Osterman (Cloud Posse) Today’s office hours really opened my eyes on this. I was just talking about it to my girlfriend. I know she has not idea what I am talking or even cares LOL
dalekurt
dalekurtabout 7 years ago
I have so many questions!
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Haha, probably not a "captive" audience
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
lol
dalekurt
dalekurtabout 7 years ago
She does a pretty good job listening to me ramble on. 🙂 So get this, I am looking at creating some policies at the org level (SCP) and I started writing a few using the aggregator module, but you blew that our of the water after today. As now, I think it can be done much easier. So I’m going to start playing around geodesic, the documentations and that video you shared in the office-hours channel to do just that. I know the reference architecture does not yet support identity account but I still went ahead and created it because it is a great idea to separate the user authN and authZ there.
dalekurt
dalekurtabout 7 years ago
Then i want to start writing other policies for the IAM groups, etc.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
@tamsky perhaps, but i'm personally more interested in optimizing for terraform cloud
dalekurt
dalekurtabout 7 years ago
I’m getting started with Geodesic and I created my CLUSTER_NAME env var

export CLUSTER_NAME=<http://identity.mycompany.co|identity.mycompany.co>
cd $CLUSTER_NAME
make init
make docker/build

After the make docker/build I got a build error trying to copy the rootfs


Removing intermediate container 9a31e8a4ae01
 ---> e926f71ba169
Step 25/26 : COPY rootfs/ /
COPY failed: stat /var/lib/docker/tmp/docker-builder620832852/rootfs: no such file or directory
make: *** [docker/build] Error 1
dalekurt
dalekurtabout 7 years ago(edited)
I created the rootfs directory in my /path/to/identity.mycompany.co/ dir path and executed make docker/build and moved on to run

docker run cloudposse/identity.mycompany.co | bash -s latest

Then I was able to execute <http://identity.mycompany.co|identity.mycompany.co> from the CLI and got into the Geodesic.

My question is what should be in the rootfs dir path
dalekurt
dalekurtabout 7 years ago
💡Figured it out from the history.
dalekurt
dalekurtabout 7 years ago
On to the next, I’m trying to get aws-vault setup
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Just run “aws-setup”
dalekurt
dalekurtabout 7 years ago
@Erik Osterman (Cloud Posse) Should aws-setup be done in the geodesic shell or on the local
Alex Siegman
Alex Siegmanabout 7 years ago
in the shell
Alex Siegman
Alex Siegmanabout 7 years ago
aws-vault inside the shell actually stores the file store in /localhost/ which will map to your home directory. i use the same aws-vault on my localhost for legacy stuff that's not run inside geodesic yet. works well
Andrew Roth
Andrew Rothabout 7 years ago
My team is currently talking about building a container similar to Geodesic. Starting out it will just be a toolbox of the tools we need for dev and CI. It will likely be used by other teams within my company eventually. I am arguing for giving it a fun name, a la Geodesic, but they want something descriptive, and admittedly boring, like "devsecops-build-tools".

Thoughts? Any ammunition I can take back and say, see; here is why we should give it a good name.
dalekurt
dalekurtabout 7 years ago
FYI: The issue I experienced with Keybase not being able to decrypt the IAM user password which resulted in “ERROR decrypt error: unable to find a PGP decryption key for this message”. I was able to fix this from the initial Macbook Pro by copying the files from one MacBook Pro to the other. The executing a restart of Keybase keybase ctl restart

    ~/Library/Application Support/Keybase/secretkeys.<username>.mpack
    ~/Library/Application Support/Keybase/config.json
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
Thanks for reporting
dalekurt
dalekurtabout 7 years ago
I just realized that working with the geodesic shell, I created files and directories in the /conf dir path are not persistent. Did I miss a step?
Alex Siegman
Alex Siegmanabout 7 years ago(edited)
No, /conf is meant not to be persistent. It should match the git repo for itself, and it stays built and up to date for use in your CI/CD stuff. I assume you're trying to figure out local development?
dalekurt
dalekurtabout 7 years ago
@Alex Siegman Yes, I am.
joshmyers
joshmyersabout 7 years ago
Your host home dir is mounted into geodesic at /localhost/
dalekurt
dalekurtabout 7 years ago
Yes. So, I should work within the geodesic shell within that dir path.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
For local development
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
But not as a workflow with staging and production, for example
dalekurt
dalekurtabout 7 years ago
@Erik Osterman (Cloud Posse) so all my development would be done via the geodesic shell within the dir path /localhost then I can commit those tf files to git for the automated workflow?
dalekurt
dalekurtabout 7 years ago
So say I have my local development in dir path ~/Workspace/my-company/identity.my-company.com/ from within the geodesic shell I could just work within dir path /localhost/Workspace/my-company/identityt.my-company.com/conf/, make sense?
S
SweetOps #geodesicabout 7 years ago
There are no events this week
C
Cloud Posseabout 7 years ago
:zoom: Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Nov 06, 2019 11:30AM.

👉️ Register for Webinar

:slack: #office-hours (our channel)
tamsky
tamskyabout 7 years ago
@Erik Osterman (Cloud Posse) -- fyi - yesterday I built geodesic without any python2.
Admittedly I had to chop out support for crudini in a few places, but other than that it looks good.
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
was this to reduce the size?
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
(i wish there was a robust go alternative to crudini)
tamsky
tamskyabout 7 years ago
&& this quirk

FROM python:3.7-alpine as python
[stuff}
RUN pip install -r /requirements.txt --install-option="--prefix=/dist" --no-build-isolation --no-cache-dir

# For some reason dateutil/python_dateutil ignores our --prefix and gets
# installed into /usr/local/lib/python3.7/site-packages.
RUN mv /usr/local/lib/python3.7/site-packages/dateutil/ /dist/lib/python3.7/site-packages/
RUN mv /usr/local/lib/python3.7/site-packages/python_dateutil-*.dist-info/ /dist/lib/python3.7/site-packages/
Erik Osterman (Cloud Posse)
Erik Osterman (Cloud Posse)about 7 years ago
what about the aws cli?
tamsky
tamskyabout 7 years ago
I think I unpinned awscli and boto in requirements.txt
tamsky
tamskyabout 7 years ago
I did it for sanity... one python should be enough for anyone 😃
tamsky
tamskyabout 7 years ago(edited)
oh yes, one more later on

COPY --from=python /dist/ /usr/local/
RUN ln -s ../../bin/python3 /usr/local/bin/python
Hasan
Hasanabout 7 years ago
Has anyone gotten SAML auth with google apps working?
Hasan
Hasanabout 7 years ago
i've tried and failed. When testing to see if the role is assumed, it succeeds, but when running a terraform plan, it says that it can not find the credentials.
I added saml2aws by adding this to rootfs/etc/profile.d/aws-saml2aws.sh
Hasan
Hasanabout 7 years ago
I've also added this to the dockerfile to provide the binary.

Not sure how to completely un-rig aws-vault successfully, as it doesn't work with saml.
tamsky
tamskyabout 7 years ago
@Erik Osterman (Cloud Posse) quick question about https://github.com/cloudposse/geodesic/blob/master/rootfs/etc/make.conf
After poking at it for a bit, I've come to believe the file is 100% unused -- The installed gnu-make does not use it.