#geodesic - February 2019 | Slack Archive

geodesic

518 messages

Discussions related to https://github.com/cloudposse/geodesic

Archive: https://archive.sweetops.com/geodesic/

Jan 2019

February 2019

Mar 2019

Trent Schollabout 7 years ago

@Erik Osterman (Cloud Posse) - how often do you update your APK repository?

Erik Osterman (Cloud Posse)about 7 years ago

on every merge

Erik Osterman (Cloud Posse)about 7 years ago

we cut a release on every merge to master

Erik Osterman (Cloud Posse)about 7 years ago

in other words, if a PR is merged, it’s been deployed

Erik Osterman (Cloud Posse)about 7 years ago

when installing packages, recommend doing somethin glike

Erik Osterman (Cloud Posse)about 7 years ago

apk add --update terraform@cloudposse=0.11.1-r0

Erik Osterman (Cloud Posse)about 7 years ago(edited)

for strict pinning, plus updating the apk cache

Trent Schollabout 7 years ago

odd - when I'm building I'm still getting terraform 0.11.10 and i get this if I try to update

ERROR: unsatisfiable constraints:
terraform-0.11.7-r0:
breaks: world[terraform=0.11.11]

Trent Schollabout 7 years ago

Running this got it to work
apk add terraform --update-cache --repository https://apk.cloudposse.com/3.8/vendor --allow-untrusted

Erik Osterman (Cloud Posse)about 7 years ago

hrm

Erik Osterman (Cloud Posse)about 7 years ago

not good.

Trent Schollabout 7 years ago

ah i see why i still get 0.11.10 - layer caching

Erik Osterman (Cloud Posse)about 7 years ago


apk add terraform@cloudposse==0.11.11-r0
fetch <https://alpine.global.ssl.fastly.net/alpine/v3.8/main/x86_64/APKINDEX.tar.gz>
fetch <https://alpine.global.ssl.fastly.net/alpine/v3.8/community/x86_64/APKINDEX.tar.gz>
fetch <https://apk.cloudposse.com/3.8/vendor/x86_64/APKINDEX.tar.gz>
fetch <https://alpine.global.ssl.fastly.net/alpine/edge/testing/x86_64/APKINDEX.tar.gz>
fetch <https://alpine.global.ssl.fastly.net/alpine/edge/community/x86_64/APKINDEX.tar.gz>
(1/1) Upgrading terraform@cloudposse (0.11.10-r0 -> 0.11.11-r0)
Executing busybox-1.28.4-r2.trigger
OK: 702 MiB in 119 packages
-> Run 'assume-role' to login to AWS

Erik Osterman (Cloud Posse)about 7 years ago

here’s what I get in geodesic

Trent Schollabout 7 years ago

ah you need the -r0

Trent Schollabout 7 years ago

All good now, thanks 🙂

Erik Osterman (Cloud Posse)about 7 years ago

yea, I haven’t dug deeper into why the release is required

Erik Osterman (Cloud Posse)about 7 years ago

we are going to do some more work on the alpine repo over the coming month (time permitting)

Erik Osterman (Cloud Posse)about 7 years ago

among other things, improve the build process so that it only builds changed paths

Erik Osterman (Cloud Posse)about 7 years ago

also, considering rendering the APKBUILD template and committing so it’s more obvious what’s going on. currently, the APKBUILD template wraps make

Erik Osterman (Cloud Posse)about 7 years ago(edited)

Also, --allow-untrusted should not be required (we don’t use it); the packages are signed

Trent Schollabout 7 years ago

👍️

Trent Schollabout 7 years ago

Are you guys doing any authentication to private git repositories for terraform modules in geodesic? If so, how are you handling authentication?

joshmyersabout 7 years ago

@Trent Scholl yes, SSH keys

Trent Schollabout 7 years ago

how are you making the SSH keys available to the docker container?

joshmyersabout 7 years ago

When running geodesic locally your agent gets mounted in, when running via Atlantis, it is writing out an SSH key from chamber

Trent Schollabout 7 years ago

joshmyersabout 7 years ago

Which docker container exactly?

Trent Schollabout 7 years ago

I totally missed ATLANTIS_SSH_PRIVATE_KEY

Trent Schollabout 7 years ago

Thanks 🙂

Erik Osterman (Cloud Posse)about 7 years ago

@Rohit Verma I forget, are you using GitLab?

Trent Schollabout 7 years ago

Still having issues after settings ATLANTIS_SSH_PRIVATE_KEY - it seems like the atlantis user doesn't have access to the SSH auth socket - anyone come across this issue?

Erik Osterman (Cloud Posse)about 7 years ago

hrmmmm

erikabout 7 years ago

confesses, i only tested that the key got added and not I could use it

Erik Osterman (Cloud Posse)about 7 years ago

sec

Erik Osterman (Cloud Posse)about 7 years ago

https://github.com/cloudposse/geodesic/blob/master/rootfs/etc/init.d/atlantis.sh#L73

Erik Osterman (Cloud Posse)about 7 years ago

yes, we should chmod the sock as well.

Erik Osterman (Cloud Posse)about 7 years ago

on line 89, we gosu to the ATLANTIS_USER; prior to that we're root

Erik Osterman (Cloud Posse)about 7 years ago

@Trent Scholl btw, have you seen the tmate-session util we added to geodesic

Erik Osterman (Cloud Posse)about 7 years ago

if you install tmate in your container, you can call tmate-session and it will output a URL you can use for debugging

Trent Schollabout 7 years ago

Yep - no luck with chmoding the socket either 😞

Trent Schollabout 7 years ago

even tried chowning it

Trent Schollabout 7 years ago

Have to execute the ssh-agent under the atlantis user using gosu

Erik Osterman (Cloud Posse)about 7 years ago

hrmmmm

Erik Osterman (Cloud Posse)about 7 years ago

sec

Erik Osterman (Cloud Posse)about 7 years ago

what did you chown it?

Erik Osterman (Cloud Posse)about 7 years ago

what was the mode?

Erik Osterman (Cloud Posse)about 7 years ago

past experience tells me that it's not required to run the agent under atlantis.

Erik Osterman (Cloud Posse)about 7 years ago

ohh

Erik Osterman (Cloud Posse)about 7 years ago

wait

Erik Osterman (Cloud Posse)about 7 years ago

yes, the pid probably needs to be same uid

Trent Schollabout 7 years ago

So changing to
source <(gosu ${ATLANTIS_USER} ssh-agent -s)

Erik Osterman (Cloud Posse)about 7 years ago

no - that's not true, since on Linux we bind mount in the agent sock

Trent Schollabout 7 years ago

fixes the issue

Erik Osterman (Cloud Posse)about 7 years ago

that's a nice fix

Erik Osterman (Cloud Posse)about 7 years ago

however, <(...) won't work without a TTY

Erik Osterman (Cloud Posse)about 7 years ago

have you deployed that under ECS and it works?

Trent Schollabout 7 years ago

Just deploying it now

Erik Osterman (Cloud Posse)about 7 years ago

ok, lmk 😃

Erik Osterman (Cloud Posse)about 7 years ago

ohhhh we had source <(ssh-agent -s)

Erik Osterman (Cloud Posse)about 7 years ago

hrmmm odd. i had trouble with that under certain circumstances.

Erik Osterman (Cloud Posse)about 7 years ago

if that doesn't work, try eval $(gosu ${ATLANTIS_USER} ssh-agent -s)

Trent Schollabout 7 years ago

It worked 🙂

Erik Osterman (Cloud Posse)about 7 years ago

woohoo!

Erik Osterman (Cloud Posse)about 7 years ago

can you open a PR for that?

Erik Osterman (Cloud Posse)about 7 years ago

we'll release that right away

Trent Schollabout 7 years ago

Sure can

Erik Osterman (Cloud Posse)about 7 years ago

thanks @Trent Scholl!!

Erik Osterman (Cloud Posse)about 7 years ago(edited)

merged and released as 0.69.1

Trent Schollabout 7 years ago

No problem 🙂

Trent Schollabout 7 years ago

Got another fix coming for you soon regarding timezones

Erik Osterman (Cloud Posse)about 7 years ago

haha, cool

Erik Osterman (Cloud Posse)about 7 years ago

https://github.com/cloudposse/geodesic/pull/378

Erik Osterman (Cloud Posse)about 7 years ago(edited)

here’s an example of using the #variant tool for exposing a clean cli UI

Erik Osterman (Cloud Posse)about 7 years ago(edited)

much more powerful than make

Trent Schollabout 7 years ago

will have to check it out

erikabout 7 years ago

Trent Schollabout 7 years ago

nice

Erik Osterman (Cloud Posse)about 7 years ago

so even if not using kops, this pattern can be extended to other things

Erik Osterman (Cloud Posse)about 7 years ago(edited)

like myorgctl

Erik Osterman (Cloud Posse)about 7 years ago

😃

Erik Osterman (Cloud Posse)about 7 years ago

that ties together all the tools “my org” uses

Trent Schollabout 7 years ago(edited)

In case anyone comes searching in here that's trying to use atlantis with tfenv and terragrunt - do not set TF_CLI_DEFAULT_NO_COLOR=true

Trent Schollabout 7 years ago

It breaks terraform init 😞

Trent Schollabout 7 years ago

terragrunt passes -no-color by default so it ends up passing it twice - terraform doesn't like that

Erik Osterman (Cloud Posse)about 7 years ago

yes, with terragrunt that causes problems

Erik Osterman (Cloud Posse)about 7 years ago

I had all kinds of problems with terragrunt and -no-color irrespective of atlantis

erikabout 7 years ago

Erik Osterman (Cloud Posse)about 7 years ago(edited)

(from our soon to be released slack archives!!)

lorenabout 7 years ago(edited)

Hmm, I don't think terragrunt itself has any internal logic for injecting -no-color... What does your terraform.tfvars file look like?

lorenabout 7 years ago

I'll look at the terragrunt code when I get to a computer to confirm...

lorenabout 7 years ago

ahh, ok, right, auto-init is the trigger... https://github.com/gruntwork-io/terragrunt/blob/master/cli/cli_app.go#L585-L591

lorenabout 7 years ago

huh. usually slack expands the code with those urls

lorenabout 7 years ago

that was done relatively recently... pretty sure related to how terragrunt checks the auto-init output for a particular error message that is not an error (to auto-init) so it knows to ignore the non-zero return code

lorenabout 7 years ago

https://github.com/gruntwork-io/terragrunt/commit/25c3b8db3b8a634a4de8393f62779f63a3f19bd1#diff-56be1e853ecf6e7ad64321692db32678R538

lorenabout 7 years ago

curious if this works: TF_CLI_ARGS_init=-no-color terragrunt ...

lorenabout 7 years ago

either way, i think you have enough here to report as a bug... terragrunt may need to be a little smarter about how/when it appends -no-color in auto-init

joshmyersabout 7 years ago

There is already an issue for it

lorenabout 7 years ago

i couldn't find one

lorenabout 7 years ago

there is one saying that -no-color is not being passed to init 😂

joshmyersabout 7 years ago

https://github.com/gruntwork-io/terragrunt/issues/390

joshmyersabout 7 years ago

yeah

lorenabout 7 years ago

that's kinda the opposite though

joshmyersabout 7 years ago

ah right, hadn’t quite followed all the convo

chrismabout 7 years ago

adding nano to the image is one of those little things that makes life less painful 😄

Erik Osterman (Cloud Posse)about 7 years ago

https://github.com/segmentio/chamber/pull/184

Erik Osterman (Cloud Posse)about 7 years ago

Chamber now supports env export suitable for eval

Trent Schollabout 7 years ago

Nice

Trent Schollabout 7 years ago

Can somebody please approve my PR 🙂 https://github.com/cloudposse/packages/pull/159

Andriy Knysh (Cloud Posse)about 7 years ago

@Trent Scholl can you please rebuild README

Andriy Knysh (Cloud Posse)about 7 years ago

make init

Andriy Knysh (Cloud Posse)about 7 years ago

make readme/deps

Andriy Knysh (Cloud Posse)about 7 years ago

make readme

Trent Schollabout 7 years ago

Done

Andriy Knysh (Cloud Posse)about 7 years ago

0.72.0 [terragrunt] upgrade to 0.17.4

Trent Schollabout 7 years ago

Thanks 🙂

Micah Martinabout 7 years ago

Is there an architectural design for how the reference architecture is setup?

joshmyersabout 7 years ago

As in a diagram?

Micah Martinabout 7 years ago

@joshmyers yes

joshmyersabout 7 years ago

Not as far as I’m aware, no.

joshmyersabout 7 years ago

Do you have any specific questions?

lorenabout 7 years ago

hmm, wonder what it would look like in cloudcraft... maybe sign up for a free trial, spin out the reference architecture, capture it in cloudcraft, and export a diagram?

joshmyersabout 7 years ago

I think that would be an excellent idea

joshmyersabout 7 years ago

Have to say I think CloudCraft diagrams look ❤️ meltingly good, but actually not that easy to follow

Erik Osterman (Cloud Posse)about 7 years ago

I struggled with cloudcraft diagrams where if what I wanted to add something which was not isomorphic

Erik Osterman (Cloud Posse)about 7 years ago

But yes, diagrams are long overdue

lorenabout 7 years ago

there are a couple other similar services i think, could try them all i imagine

Erik Osterman (Cloud Posse)about 7 years ago

We use Lucid Charts

Erik Osterman (Cloud Posse)about 7 years ago

Have a lot of diagrams that we use in our SOWs, just haven’t had the chance to open source something.

chrismabout 7 years ago

FYI The export cloudcraft from aws is a tad iffy. We're currently paying for it though, its nice to have docs that don't look arse 😄

Abel Luckabout 7 years ago

hey folks 🙂
I'm checking out the reference architecture setup. great work, it's really nice.
I can't seem to locate the code where the admin IAM users are created
The root-iam module takes a list of user names root_account_admin_user_names, but looking through all the repos, I can't find where those users are actually created before being passed to root-iam

Abel Luckabout 7 years ago

i think the module that creates the users is cloudposse/terraform-aws-iam-user, but where is this called?

joshmyersabout 7 years ago

@Abel Luck https://github.com/cloudposse/root.cloudposse.co/blob/master/conf/users/osterman.tf

Andriy Knysh (Cloud Posse)about 7 years ago

@Abel Luck https://github.com/cloudposse/reference-architectures is our latest approach. We changed how the users are provisioned. Before, we were adding users to root_account_admin_user_names, but this was not scalable (e.g. when using CI/CD and need to add a user, we’d have to update the user list)

Andriy Knysh (Cloud Posse)about 7 years ago

so now, for each new user we create a separate file in https://github.com/cloudposse/root.cloudposse.co/blob/master/conf/users

Andriy Knysh (Cloud Posse)about 7 years ago

and the user gets added to the group https://github.com/cloudposse/terraform-root-modules/blob/master/aws/users/main.tf#L36

Andriy Knysh (Cloud Posse)about 7 years ago

the group itself gets written to SSM here https://github.com/cloudposse/terraform-root-modules/blob/master/aws/iam/staging.tf#L19

Andriy Knysh (Cloud Posse)about 7 years ago

@Abel Luck welcome to the community 🙂

Abel Luckabout 7 years ago

Ah interesting.

Abel Luckabout 7 years ago

that clears that up!

Abel Luckabout 7 years ago

where does the local.admin_groups come from?

Andriy Knysh (Cloud Posse)about 7 years ago

share the URL where you see it

Andriy Knysh (Cloud Posse)about 7 years ago

# Fetch the OrganizationAccountAccessRole ARNs from SSM
module "admin_groups" {
  source         = "git::<https://github.com/cloudposse/terraform-aws-ssm-parameter-store?ref=tags/0.1.5>"
  parameter_read = "${formatlist("/${var.namespace}/%s/admin_group", local.accounts_enabled)}"
}

Andriy Knysh (Cloud Posse)about 7 years ago

it’s read from SSM

joshmyersabout 7 years ago

@Abel Luck it comes from https://github.com/cloudposse/terraform-root-modules/blob/master/aws/users/main.tf#L44

joshmyersabout 7 years ago

terraform-root-modules/aws/users gets merged with <http://root.cloudposse.co/aws/users|root.cloudposse.co/aws/users>

Abel Luckabout 7 years ago

gotcha

Abel Luckabout 7 years ago

nice use of the ssm

joshmyersabout 7 years ago

Logic to add users is common to all stages, so goes in your terraform-root-modules but your users maybe different per stage, so we put those per stage

Abel Luckabout 7 years ago

thanks 🙂

joshmyersabout 7 years ago

well, all users get added to the root account in our case, but that is the general idea behind your stage codebase (like <http://testing.cloudposse.co|testing.cloudposse.co>) and terraform-root-modules

lorenabout 7 years ago

took me a little bit to duplicate... the config to end up here is pretty specific

Abel Luckabout 7 years ago

What is the bootstrap module for exactly? Where is it used?

Abel Luckabout 7 years ago

the pr says " * This is needed by the [reference-architectures](https://github.com/cloudposse/references-architectures) to provision the subaccounts because it's not possible to assume-role using master account"

Abel Luckabout 7 years ago

but aren't the accounts already provisioned by the time the bootstrap module is run?

Abel Luckabout 7 years ago

(I've assumed the execution order is defined by thishttps://github.com/cloudposse/reference-architectures/blob/67afdc62ccedb6ab3dcd1f8b6deff85949a6535b/configs/root.tfvars#L71-L81)

Erik Osterman (Cloud Posse)about 7 years ago

Our reference architecture assumes you start with a brand spanning new AWS account

Erik Osterman (Cloud Posse)about 7 years ago

In fact that account is so new there are no existing IAM users

Erik Osterman (Cloud Posse)about 7 years ago

So the role of the bootstrap module is to provision a user and role which can be used by the coldstart process to assume role into the sub accounts that get created

Erik Osterman (Cloud Posse)about 7 years ago

Then at the very end we can destroy this module

Abel Luckabout 7 years ago

gotcha.

Abel Luckabout 7 years ago

i've been working through the cold start code by following https://docs.cloudposse.com/reference-architectures/cold-start/ as well as looking at the repos

Abel Luckabout 7 years ago

i've noticed that that doc page has diverged from the code, but i didn't realize it was that much

Abel Luckabout 7 years ago

Following on from my question yesterday about how users get created

Abel Luckabout 7 years ago

The user is added to the admin groups by the users root module, but later in the iam root module the organization-access-group module will REMOVE the user from the group, because the [prod|dev|...]_account_user_names list is empty

Erik Osterman (Cloud Posse)about 7 years ago

yes, so users should get created in the <http://root.org.com|root.org.com> account

Erik Osterman (Cloud Posse)about 7 years ago

and not added to root-modules directly

Erik Osterman (Cloud Posse)about 7 years ago

an old pattern we had, was (1) adding users, then (2) adding users to the group list

Erik Osterman (Cloud Posse)about 7 years ago

that didn’t work well

Abel Luckabout 7 years ago

makes sense yea

Erik Osterman (Cloud Posse)about 7 years ago

the new pattern is (1) adding users and adding them to the groups at the same time

Erik Osterman (Cloud Posse)about 7 years ago

so when you delete a user, they are deleted from the groups too

Erik Osterman (Cloud Posse)about 7 years ago

works well with atlantis

Abel Luckabout 7 years ago

indeed, yes, have the user creation also add them to the group

Abel Luckabout 7 years ago

so the iam root module is run before the users are added

Erik Osterman (Cloud Posse)about 7 years ago

i am not sure if our terraform examples in <http://root.cloudposse.co|root.cloudposse.co> are up to date; what i am describing is how we’re doing it with current customers

Abel Luckabout 7 years ago

because if i run the iam root module after adding users, it removes them

Erik Osterman (Cloud Posse)about 7 years ago

yea, so our root modules are mostly organized into separate “phases”

Erik Osterman (Cloud Posse)about 7 years ago

@Abel Luck btw, feel free to schedule some time with me next week: https://calendly.com/cloudposse

Abel Luckabout 7 years ago

It seems to me that the organization-access-group module should only create the group and apply the policy

Abel Luckabout 7 years ago

not actually manage the members of the group

Erik Osterman (Cloud Posse)about 7 years ago

yes

Erik Osterman (Cloud Posse)about 7 years ago

agreed - this is what i think we should deprecate

Abel Luckabout 7 years ago

that works better when users are decoupled from the group

Erik Osterman (Cloud Posse)about 7 years ago

💯

Erik Osterman (Cloud Posse)about 7 years ago

(btw, if you have time to submit a PR for that, we’ll promptly review)

Erik Osterman (Cloud Posse)about 7 years ago

if not, we’ll probably fix this on our next customer rollout

Abel Luckabout 7 years ago(edited)

i think the same applies to the iam-assumed-roles module

Erik Osterman (Cloud Posse)about 7 years ago

yep - indeed

Abel Luckabout 7 years ago

So i've been piecing together my own version of the reference architecture using ya'lls great building blocks

Abel Luckabout 7 years ago

Since I started with the outdated docs, I created the accounts by hand, and also created the root admin user by hand

Abel Luckabout 7 years ago

that's no problem..

Abel Luckabout 7 years ago

Now I have the root account bootstrapping complete as far : tfstate backend bootrap, root-iam policies, account-settings and creating users

Abel Luckabout 7 years ago

however the switch role url for the non-root accounts isn't working

Abel Luckabout 7 years ago

rather, the url works, but i get a perm denied error

Abel Luckabout 7 years ago

now given what I know about AWS roles, the sub-account (aka the trusting account) needs to be involved, but I haven't involved the root user of the sub-account at all 😕

Erik Osterman (Cloud Posse)about 7 years ago

how were the child accounts created?

Abel Luckabout 7 years ago

i created them manually and invited them to the root acount

Abel Luckabout 7 years ago

maybe the invited accounts don't have the OrganizationAccountAccessRole?

Abel Luckabout 7 years ago

ding ding

Abel Luckabout 7 years ago

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_create-cross-account-role

Erik Osterman (Cloud Posse)about 7 years ago

correct

Erik Osterman (Cloud Posse)about 7 years ago

they do not

Erik Osterman (Cloud Posse)about 7 years ago

we do have a module you can use to provision that though

Erik Osterman (Cloud Posse)about 7 years ago

https://github.com/cloudposse/terraform-aws-organization-access-role

Abel Luckabout 7 years ago

of course you do 😀

Erik Osterman (Cloud Posse)about 7 years ago

Abel Luckabout 7 years ago

the null-label module is just fantastic

joshmyersabout 7 years ago

Mind boggling.

Abel Luckabout 7 years ago

who knew string concatenation could be so great

Abel Luckabout 7 years ago

Do you all generally create one log bucket per-thing that ships logs (e.g, an ALB) or do use one bucket to receive multiple services' logs?

Abel Luckabout 7 years ago

The latter seems more user friendly, but managing multiple policies on a bucket is a PITA

joshmyersabout 7 years ago

Genercally I try and and <S3://region-account-logs-bucket/$service>

Erik Osterman (Cloud Posse)about 7 years ago

I think we should adopt this convention on our buckets for logs

Erik Osterman (Cloud Posse)about 7 years ago

isolating buckets by region is smart.

Erik Osterman (Cloud Posse)about 7 years ago

hey all!

Erik Osterman (Cloud Posse)about 7 years ago

i’m giving a talk on Geodesic in the beginning of March here in Los Angeles

Erik Osterman (Cloud Posse)about 7 years ago

I don’t have all the details yet.

Erik Osterman (Cloud Posse)about 7 years ago

I’m putting together an abstract for the meetup.

Erik Osterman (Cloud Posse)about 7 years ago(edited)

Would love to get your feedback if I’ve captured what we have with #geodesic

Erik Osterman (Cloud Posse)about 7 years ago(edited)

Title: Geodesic Cloud Automation Shell

Subtitle: The easy way to automate everything

🚀 Geodesic is a cloud automation shell. It’s the superset of all other tools including (terraform, terragrunt, chamber, aws-vault, aws-okta, kops, gomplate, helm, helmfile, aws cli, variant, etc) that we use to automate workflows. You can think of it like a swiss army knife for creating and building consistent platforms to be shared across team environments. It easily versions staging/production/dev environments in a repeatable manner that can be followed by any team member with only a single dependency: docker. Because of this, it works with Mac OSX, Linux, and Windows 10. Learn how you can use the geodesic shell to improve your DevOps workflows! There will be a live demo with Q&A.

Erik Osterman (Cloud Posse)about 7 years ago

Please add any suggestions as a thread to ☝️

Erik Osterman (Cloud Posse)about 7 years ago(edited)

@Jan @Dave Yu @Adam @joshmyers @Dombo @chrism @Trent Scholl @loren @Andriy Knysh (Cloud Posse) @Igor Rodionov

Trent Schollabout 7 years ago

👍️

Janabout 7 years ago

The easy way to automate everything

Erik Osterman (Cloud Posse)about 7 years ago

beauty is in the eye of the beholder 🐷

Dave Yuabout 7 years ago

now that I’m used to chamber exec in geodesic, I’m looking for a clean way to export secrets for developers. I’d love to put something like this in an app’s .direnvrc: aws-vault exec myco-dev-admin -- chamber exec myapp -- sh -c 'export -p'. I haven’t been able to butcher my way through bash to get this to work, I think because aws-vault needs user input

Dave Yuabout 7 years ago

is it possible?

Erik Osterman (Cloud Posse)about 7 years ago

yep, it's possible 😃

Erik Osterman (Cloud Posse)about 7 years ago

i'm on a call

Erik Osterman (Cloud Posse)about 7 years ago

we do it though

Erik Osterman (Cloud Posse)about 7 years ago

also, they just added shell export compatibility

Erik Osterman (Cloud Posse)about 7 years ago

not sure if a release has been cut

Erik Osterman (Cloud Posse)about 7 years ago

https://github.com/segmentio/chamber/pull/184

erikabout 7 years ago

set the channel description: Discussions related to https://github.com/cloudposse/geodesic
Archive: https://archive.sweetops.com/geodesic/

chrismabout 7 years ago

In the ref architecture world is it better to pump flowlogs to cloudwatch or into the audit account S3 bucket.

lorenabout 7 years ago

In case you want/need to do both: https://aws.amazon.com/blogs/security/how-to-facilitate-data-analysis-and-fulfill-security-requirements-by-using-centralized-flow-log-data/

chrismabout 7 years ago

Ta. Need logging of my loggings logging 😜

chrismabout 7 years ago

Terraform network ACLS are crap. Nothing like having to use counts because someone decided subnet CIDR should be a single entry 🙄

chrismabout 7 years ago

@Erik Osterman (Cloud Posse) not sure if you've tripped over this; https://github.com/nozaq/terraform-aws-secure-baseline

chrismabout 7 years ago

the alarm base is pretty similar to yours (bar you use loops, they've used individual entries)

Erik Osterman (Cloud Posse)about 7 years ago

Will take a look. I know ours also needs some love.

chrismabout 7 years ago(edited)

the layouts a bit shit in there but such is the joy of having to use N providers 😄

lorenabout 7 years ago

I feel like I'd prefer a module that took a single provider, and let me call it as many times as needed for each region I needed to configure

lorenabout 7 years ago

Looks alright if I use the submodules

chrismabout 7 years ago

yeah the submodules for just that 🙂

chrismabout 7 years ago

think the point is that you're supposed to configure every region (you have enabled) or someone with access via a liberally create iam key could simply spawn shit outside of the region you normally use

chrismabout 7 years ago

Can you restrict regions at the SCP level? seems to all be around feature restriction

chrismabout 7 years ago

Not sure this is baked properly in cloudposse/geodesic:0.71.0

joshmyersabout 7 years ago

@chrism do you have anything in /localhost/.aws/config ?

chrismabout 7 years ago

works fine on rel 70

Erik Osterman (Cloud Posse)about 7 years ago

I can take a look as well in a few hours

joshmyersabout 7 years ago

that’ll be https://github.com/cloudposse/geodesic/releases/tag/0.71.0 @chrism

chrismabout 7 years ago

yup; changing to 70 at least stopped me veering off down a rabbit hole to work out that one 😄

joshmyersabout 7 years ago

@chrism what does your $AWS_CONFIG_FILE look like?

chrismabout 7 years ago

im assuming its something in the function choose_role_interactive() { in aws-vault
but it seems sane enough (though ive no idea what the fzf bit tis)

chrismabout 7 years ago


 ✓   (test-prod-admin) vpc ⨠  echo $AWS_CONFIG_FILE
/localhost/.aws//config

chrismabout 7 years ago

thats running 70

chrismabout 7 years ago

ill give you 71 in about a minute or so when its built again 😄

joshmyersabout 7 years ago

Cool, it should be the same, works for me (tm) - see https://github.com/cloudposse/geodesic/pull/376

joshmyersabout 7 years ago

what does your config look like is what I’m asking, is it in the same format as can be seen on that PR?

chrismabout 7 years ago

` ✓ (ivendi-prod-admin) vpc ⨠ echo $AWS_CONFIG_FILE
/localhost/.aws//config`
looks the same

chrismabout 7 years ago

yeah its pretty much the same

chrismabout 7 years ago

even though i can cat out my config

chrismabout 7 years ago


 ✗   (none) ~ ⨠  ls -lsa /localhost/.aws//config4 -rwxr-xr-x 1 root root 1019 Feb  6 13:54 /localhost/.aws//config

chrismabout 7 years ago

no diff if I change the path to /localhost/.aws/config rather than double slash

chrismabout 7 years ago

Is this going to show a prompt everytime? because that kinda takes away from having N repos /org split

joshmyersabout 7 years ago

Everytime you assume a role, or you can pass in a specific role as before assume-role role_name

joshmyersabout 7 years ago

Needed a way to assume different IAM roles for k8s rbac

chrismabout 7 years ago

i just typed assume-role previously and im assuming it defaults to the one in the env

joshmyersabout 7 years ago(edited)

yeah, it did that if you didn’t give a name.

Erik Osterman (Cloud Posse)about 7 years ago

so both @joshmyers and @chrism are right

Erik Osterman (Cloud Posse)about 7 years ago

@joshmyers is alluding to the fact we support now multiple roles per account; not just one admin role

Erik Osterman (Cloud Posse)about 7 years ago

e.g. one role to become a kubernetes admin, one role for read-only, etc

Erik Osterman (Cloud Posse)about 7 years ago

however, the “one role policy” is probably going to continue to common

Erik Osterman (Cloud Posse)about 7 years ago

so maybe we should still honor AWS_DEFAULT_PROFILE if it is set

Erik Osterman (Cloud Posse)about 7 years ago

unset it for the selector

Erik Osterman (Cloud Posse)about 7 years ago

thoughts @joshmyers?

joshmyersabout 7 years ago

Seems fair, AWS_DEFAULT_PROFILE is still set

Erik Osterman (Cloud Posse)about 7 years ago

hrm

Erik Osterman (Cloud Posse)about 7 years ago

but not honored by the selector?

Erik Osterman (Cloud Posse)about 7 years ago

(i haven’t looked into the code yet)

joshmyersabout 7 years ago

https://github.com/cloudposse/geodesic/pull/376

joshmyersabout 7 years ago

AWS_DEFAULT_PROFILE is set everywhere IIRC so you will never get to selector

joshmyersabout 7 years ago

Still unsure why you don’t have that populated @chrism - crudini --get "${AWS_CONFIG_FILE}" | awk -F ' ' '{print $2}'

erikabout 7 years ago

Erik Osterman (Cloud Posse)about 7 years ago

previously it worked like this

Erik Osterman (Cloud Posse)about 7 years ago

but now, AWS_DEFAULT_PROFILE is gone

joshmyersabout 7 years ago

yes, as I alluded to

Erik Osterman (Cloud Posse)about 7 years ago(edited)

i guess what I mean, is we (cloudposse) should probably remove AWS_DEFAULT_PROFILE from our dockerfile (*.cloudposse.co)

Erik Osterman (Cloud Posse)about 7 years ago

then we get the benefit we want

Erik Osterman (Cloud Posse)about 7 years ago(edited)

but if AWS_DEFAULT_PROFILE is set, the original functionality persists that @chrism is using

chrismabout 7 years ago

crudini --get "${AWS_CONFIG_FILE}" | awk -F ' ' '{print $2}' fails with the same error but the variable is set.

chrismabout 7 years ago

and the file exists 😄

joshmyersabout 7 years ago

hah, looks like it 🙂

chrismabout 7 years ago

even giving it the direct path fails

joshmyersabout 7 years ago

crudini --version ?

chrismabout 7 years ago

0.9

joshmyersabout 7 years ago

chrismabout 7 years ago

if i copy the file it works

Erik Osterman (Cloud Posse)about 7 years ago

chrism, remind me: are you on WSL?

chrismabout 7 years ago

yerp

Erik Osterman (Cloud Posse)about 7 years ago

hrm… ok, maybe related

joshmyersabout 7 years ago

ah ha

chrismabout 7 years ago

file system permission based issue; i'd expect aws-vault to fail though

Erik Osterman (Cloud Posse)about 7 years ago

does cat ${AWS_CONFIG_FILE} >/dev/null

Erik Osterman (Cloud Posse)about 7 years ago

work?

chrismabout 7 years ago

work as in do nothing yes

chrismabout 7 years ago

😄

Erik Osterman (Cloud Posse)about 7 years ago

ok, no errors

chrismabout 7 years ago

yeah it cats out fine

Erik Osterman (Cloud Posse)about 7 years ago

i wonder if we run crudini with config from stdin instead then

joshmyersabout 7 years ago

https://github.com/cloudposse/geodesic/pull/380

keenabout 7 years ago

cloudposse/reference-architectures(master)%% make children
make: *** No rule to make target `dev/validate', needed by `children/validate'.  Stop.

so running into this, after a make root. looking at the makefiles, I'd tend to agree with make. which leads me to suspect there's a missing step somewhere to generate more makefiles?

Erik Osterman (Cloud Posse)about 7 years ago

https://github.com/cloudposse/reference-architectures/issues/10

Erik Osterman (Cloud Posse)about 7 years ago

does this fix your issue?

Erik Osterman (Cloud Posse)about 7 years ago

(sorry, we haven't had a time to open the PR for this fix albeit very simple)

erikabout 7 years ago

Erik Osterman (Cloud Posse)about 7 years ago

this should be enough to fix it

keenabout 7 years ago

 make children
tasks/Makefile.child:56: *** missing separator.  Stop.

keenabout 7 years ago

# Define a macro (`child`) for a child init & provisioner
define child

## Validate the child configuration exists

keenabout 7 years ago

that's where I removed the = (child =)

Erik Osterman (Cloud Posse)about 7 years ago

in your root.tfvars, do you have something like : https://github.com/cloudposse/reference-architectures/blob/master/configs/root.tfvars#L48-L56

keenabout 7 years ago

# List of accounts to enable
accounts_enabled = [
  "dev",
  # "staging",
  # "prod",
  # "testing",
  # "data",
  # "corp",
  # "audit",
]

keenabout 7 years ago(edited)

really odd - removing the = results in the missing sep. adding it back doesnt fit it. reverting the file does.

draistrick-mini:~/.../terraform-prototypes/cloudposse/reference-architectures(master)%% cat -ev tasks/Makefile.child |grep "define child"
define child =$
draistrick-mini:~/.../terraform-prototypes/cloudposse/reference-architectures(master)%% make clean
rm -rf //build-harness
rm -rf repos accounts .terraform *.tfstate* artifacts/*
draistrick-mini:~/.../terraform-prototypes/cloudposse/reference-architectures(master)%% make clean
tasks/Makefile.child:61: *** missing separator.  Stop.
draistrick-mini:~/.../terraform-prototypes/cloudposse/reference-architectures(master)%% cat -ev tasks/Makefile.child |grep "define child"
define child$
draistrick-mini:~/.../terraform-prototypes/cloudposse/reference-architectures(master)%% make clean
tasks/Makefile.child:61: *** missing separator.  Stop.
draistrick-mini:~/.../terraform-prototypes/cloudposse/reference-architectures(master)%% cat -ev tasks/Makefile.child |grep "define child"
define child =$
draistrick-mini:~/.../terraform-prototypes/cloudposse/reference-architectures(master)%% gco tasks/Makefile.child
draistrick-mini:~/.../terraform-prototypes/cloudposse/reference-architectures(master)%% make clean
rm -rf //build-harness

keenabout 7 years ago

ah, something sublime is doing on save...

keenabout 7 years ago(edited)

why dont I remember that make is tab sensitive? only change I see is tab > space

keenabout 7 years ago

nope, same thing if I edit with nano. odd.

keenabout 7 years ago(edited)

(and much smaller diff. aka, none)

keenabout 7 years ago

oh, no, it's reading my copy dammit

Erik Osterman (Cloud Posse)about 7 years ago

haha 😃 yea, whitespace issues suck

keenabout 7 years ago

ok let me reset everything and try again

keenabout 7 years ago

a make root/reset would be useful. 😉 (though the world still breaks if a sub account already exists, so I also have to bump my email prefix)

Erik Osterman (Cloud Posse)about 7 years ago

keep in mind, each time yuo do that, you create a new AWS subaccount

Erik Osterman (Cloud Posse)about 7 years ago

subaccounts cannot be easily deleted

keenabout 7 years ago

yep

keenabout 7 years ago

that's why I have a 1k account limit

Erik Osterman (Cloud Posse)about 7 years ago

HAHHA

Erik Osterman (Cloud Posse)about 7 years ago

wow, didn't even know that was possible

Erik Osterman (Cloud Posse)about 7 years ago

"Accounts as Cattle"

Thibaultabout 7 years ago

hey everyone, is there any way to import the aws_zone53_zone.parent_dns_zone and aws_zone53_record.parent_dns_zone_soa when using reference-architectures and/or root.cloudposse.co repository directly?

keenabout 7 years ago

yeah, it took a few weeks to get approved, but my justification of "working on automation tooling to manage creation of accounts" didnt result in any followup questions

keenabout 7 years ago

at some point, I'd like to have a better idea of how to add new accounts to an existing structure - is there a sane way to do that with what exists now?

Erik Osterman (Cloud Posse)about 7 years ago

yes, and no

Erik Osterman (Cloud Posse)about 7 years ago

@Jan has done this and I know others as well

Erik Osterman (Cloud Posse)about 7 years ago

But before doing that, best to get familiar with the overall strategy

Janabout 7 years ago

Heya

Erik Osterman (Cloud Posse)about 7 years ago

If you have existing accounts, I suggest just using the base images and writing your own dockerfiles from hand.

Erik Osterman (Cloud Posse)about 7 years ago

<http://testing.cloudposse.co|testing.cloudposse.co> is a good place to look for inspiration

Janabout 7 years ago

Yea I can give you loads of advice on that

Janabout 7 years ago

Can also tell you where I would like to start from if I had time

Janabout 7 years ago

Coming to grips with the reference architecture was a great way to learn

Janabout 7 years ago

But ultimately it would ha e been better to start with empty dockerfile

Janabout 7 years ago

And add

Janabout 7 years ago

Rather than adapt

Janabout 7 years ago

Once you understand the pattern it's trivial

keenabout 7 years ago

in this case, the plan is to start from scratch - but new products, teams, environments, will roll in and out all the time - so a straightforward way to provision a base new sub account is important

Janabout 7 years ago

Yep

Janabout 7 years ago

Optimize for change!

keenabout 7 years ago

indeed. 🙂

Janabout 7 years ago

We have done loads of things that are custom

Janabout 7 years ago

Busy on a few cool ones

Janabout 7 years ago

We have heavy deadlines for end of April so have not been able to contribute much back yet

Janabout 7 years ago

But plan is to do so

keenabout 7 years ago

in general, the overall framework is not far off from what I would build if I were scratch building again (and using tf as the basis, instead of as a component tool like I built last time.)

Janabout 7 years ago

If you have more specific sorta constraints / ideas / needs I am happy to help

keenabout 7 years ago

ok, make children is running! (minus equal)

Janabout 7 years ago

For example on ours we had existing aws accounts, in an existing org where we setup our "root" in a sub aws org account

Janabout 7 years ago

With totally different network cidr schemes

Janabout 7 years ago

On premise vpn, hashicorp vault

Janabout 7 years ago

We are a gitlab / Jenkins shop

Janabout 7 years ago

In the end it's just terraform

keenabout 7 years ago

fun. did you try to import the existing accounts into the scheme, or migrate away from them? (the only thing I hate more than manually fixing tfstate is trying to craft it for existing resources)

Janabout 7 years ago

With a nice layer of convention on top

Janabout 7 years ago

They were empty accounts

Janabout 7 years ago

Just crated already

keenabout 7 years ago

ah cool

keenabout 7 years ago

easier there

Janabout 7 years ago

Well to an extent

Janabout 7 years ago

Honestly the virvana state would have been starting a full aws org from scratch

Janabout 7 years ago

My biggest pain so far with taking the geodesic reference architecture and adapting it has been the env names

Janabout 7 years ago

Try do a search and replace on "data" in terraform

Janabout 7 years ago

I dare you

keenabout 7 years ago

hahahaha

Erik Osterman (Cloud Posse)about 7 years ago

haha

Erik Osterman (Cloud Posse)about 7 years ago

so for the record, the point there is you do not renmae

Erik Osterman (Cloud Posse)about 7 years ago

you create additional ones

Erik Osterman (Cloud Posse)about 7 years ago

since we have accounts_enabled, you can then choose the flavors you want

keenabout 7 years ago

so make children failed out with auth problems - a number of similar errors scattered through the log


panic: SharedConfigAssumeRoleError: failed to load assume role for arn:aws:iam::894200800587:role/OrganizationAccountAccessRole, source profile has no shared credentials
...
The source_profile "brasstack" must specify either static credentials or an assume role configuration
....
Error: Error running plan: 1 error(s) occurred:

* provider.aws: No valid credential sources found for AWS Provider.
	Please see <https://terraform.io/docs/providers/aws/index.html> for more information on
	providing credentials for the AWS Provider

Erik Osterman (Cloud Posse)about 7 years ago

did you enable the bootstrap module?

Erik Osterman (Cloud Posse)about 7 years ago

the children will only be accessible via the bootstrap role

keenabout 7 years ago

it's in root.tfvars yes

keenabout 7 years ago

only thing I removed was cloudtrail

keenabout 7 years ago

arn:aws:iam::665716774983:role/brasstack-root-bootstrap

Erik Osterman (Cloud Posse)about 7 years ago

in the artifacts/ folder you should see the temp aws config

keenabout 7 years ago

yeah

keenabout 7 years ago

# Temporary configuration for AWS bootstrapping
[profile brasstack-root-admin]
region = us-west-2
role_arn = arn:aws:iam::665716774983:role/brasstack-root-bootstrap
source_profile = brasstack


# Temporary configuration for AWS bootstrapping
[profile brasstack-dev-admin]
region = us-west-2
role_arn = arn:aws:iam::894200800587:role/OrganizationAccountAccessRole
source_profile = brasstack

Erik Osterman (Cloud Posse)about 7 years ago

and [profile brasstack]

Erik Osterman (Cloud Posse)about 7 years ago

i don't see that in that output

Erik Osterman (Cloud Posse)about 7 years ago

(jumping on a call)

keenabout 7 years ago

that's in credentials with keys

Erik Osterman (Cloud Posse)about 7 years ago

it should exist in the config file

keenabout 7 years ago

but no `[profile brasstack]'

Erik Osterman (Cloud Posse)about 7 years ago

just an empty def

keenabout 7 years ago

mm, something didnt put it there. 🙂

keenabout 7 years ago

oh no

keenabout 7 years ago

it's at the top

keenabout 7 years ago

first line blindness

keenabout 7 years ago

the full config/credentials stack looks correct - keys, iam roles, policies, between the two accounts. I can assume the role on the dev account (using a root account user not created by tf. guess I can try using the tf user)

keenabout 7 years ago

yep, no issues there either.

keenabout 7 years ago(edited)

failed to load assume role for arn:aws:iam::894200800587:role/OrganizationAccountAccessRole, source profile has no shared credentials

seems to be from the go sdk, so I'm presuming tf

keenabout 7 years ago

this seems to be the origin of the failure (and unhandled)

keenabout 7 years ago

fetch <https://alpine.global.ssl.fastly.net/alpine/edge/community/x86_64/APKINDEX.tar.gz>
(1/1) Installing assume-role@cloudposse (0.3.2-r1)
Executing busybox-1.28.4-r2.trigger
OK: 709 MiB in 120 packages
panic: SharedConfigAssumeRoleError: failed to load assume role for arn:aws:iam::894200800587:role/OrganizationAccountAccessRole, source profile has no shared credentials

goroutine 1 [running]:
<http://github.com/remind101/assume-role/vendor/github.com/aws/aws-sdk-go/aws/session.Must(0x0|github.com/remind101/assume-role/vendor/github.com/aws/aws-sdk-go/aws/session.Must(0x0>, 0x8e8d80, 0xc420019c90, 0x0)
	/Users/ejholmes/src/github.com/remind101/assume-role/vendor/github.com/aws/aws-sdk-go/aws/session/session.go:265 +0x54
main.assumeProfile(0x7ffd32d66db9, 0x13, 0x0, 0x0, 0x8e8340)
	/Users/ejholmes/src/github.com/remind101/assume-role/main.go:148 +0xf7
main.main()
	/Users/ejholmes/src/github.com/remind101/assume-role/main.go:77 +0x178
Handling [--apply-modules]...
Processing tfstate-backend...

keenabout 7 years ago

then it keeps going until tf fails

keenabout 7 years ago

ah https://github.com/cloudposse/reference-architectures/issues/8

keenabout 7 years ago(edited)

That looks like the right fix. Basically, when using the bootstrap user we need to use `AWS_SHARED_CREDENTIALS_FILE=/artifacts/.aws/credentials

keenabout 7 years ago

looking much happier. I'm gonna PR that

keenabout 7 years ago(edited)

well, next... Failed to save state: truncate terraform.tfstate: read-only file system

Erik Osterman (Cloud Posse)about 7 years ago

that one is new! haven't seen that

keenabout 7 years ago

race condition on s3 create maybe?

module.tfstate_backend.aws_s3_bucket.default: Creation complete after 10s (ID: brasstack-dev-terraform-state)
module.tfstate_backend.aws_dynamodb_table.with_server_side_encryption: Still creating... (10s elapsed)
module.tfstate_backend.aws_dynamodb_table.with_server_side_encryption: Still creating... (20s elapsed)
module.tfstate_backend.aws_dynamodb_table.with_server_side_encryption: Still creating... (30s elapsed)
module.tfstate_backend.aws_dynamodb_table.with_server_side_encryption: Still creating... (40s elapsed)
module.tfstate_backend.aws_dynamodb_table.with_server_side_encryption: Still creating... (50s elapsed)
module.tfstate_backend.aws_dynamodb_table.with_server_side_encryption: Creation complete after 59s (ID: brasstack-dev-terraform-state-lock)
Failed to save state: truncate terraform.tfstate: read-only file system

keenabout 7 years ago

though I'm speculating - actually that's probably still saving to local state, not to remote

Erik Osterman (Cloud Posse)about 7 years ago

so tfstate backend initialization is tricky

Erik Osterman (Cloud Posse)about 7 years ago

it first initializes locally

Erik Osterman (Cloud Posse)about 7 years ago

then imports it

Erik Osterman (Cloud Posse)about 7 years ago

https://github.com/cloudposse/terraform-root-modules/blob/master/aws/tfstate-backend/scripts/init.sh

keenabout 7 years ago

appearance is this was terraform apply -auto-approve -input=false not the import (first tf run in the container)

keenabout 7 years ago

so, then, why would the container be read-only. hrm

lorenabout 7 years ago

Which channel we're we talking about test frameworks? https://opensource.com/article/19/2/testing-bash-bats

Erik Osterman (Cloud Posse)about 7 years ago

Hrmmmmmm can't recall.

Erik Osterman (Cloud Posse)about 7 years ago

Think it recently was in #terraform

keenabout 7 years ago

maybe my docker has taken a dive. removed the s3/ddb, reran...and docker error.

module.account.module.docker_build.null_resource.docker_build (local-exec): Sending build context to Docker daemon  27.65kB
module.account.module.docker_build.null_resource.docker_build (local-exec): Error response from daemon: mkdir /mnt/sda1/var/lib/docker/tmp/docker-builder348479862: input/output error

Erik Osterman (Cloud Posse)about 7 years ago

yea, looks like it totally crapped out

Erik Osterman (Cloud Posse)about 7 years ago

@loren are you using bats?

lorenabout 7 years ago

i'm not no, pytest/testinfra, exploring go test some with terratest

lorenabout 7 years ago

but i knew you were, and thought it would be a good read for other folks here...

Erik Osterman (Cloud Posse)about 7 years ago

yep, thanks for the heads up

Erik Osterman (Cloud Posse)about 7 years ago

looks like a good read

keenabout 7 years ago(edited)

I've used bats before (in something I PRed. forget what. heard about it a few years before that. then later experimented with it for another project. also forget what)....it wasn't bad. like anything, it has it's own concepts

keenabout 7 years ago

restarted docker-machine, and now children ran ok. so $chaos

Erik Osterman (Cloud Posse)about 7 years ago

are you not using docker for mac?

keenabout 7 years ago(edited)

nope, docker for mac panics 9 out of 10 startups (after 5-10m of complete resource sucking - the clock slows down...), the 10th just sucks all resources until I give up and kill it

keenabout 7 years ago

go mohave.

keenabout 7 years ago

so, back to ref-arch - after the first pass through - make root make children make finalize with a defined set of children in accounts_enabled - is there a way to reuse the tooling to create a new child? (I may have asked before, but it's been a really long last few weeks) I've tried a few things (adding a new entry to accounts_enabled, subing out the list to just a new acct, etc), but there's apparently enough state retained to keep that from happening. using the root generated repo, I can make the tooling create a new account, but that doesnt generate a new repo framework.....

keenabout 7 years ago(edited)

pointers to places that might lead me to a path to be able to do that are similarly welcome... (since there's pretty much no way to know what sub accounts we'd need right now - I've got 3 prods and their required test/dev/stage envs on the books so far...)

Erik Osterman (Cloud Posse)about 7 years ago

So you will want to fork the terraform root modules

Erik Osterman (Cloud Posse)about 7 years ago

Then define all the different account types there

keenabout 7 years ago

yeah saw that

Erik Osterman (Cloud Posse)about 7 years ago

You can truly have any number of accounts

Erik Osterman (Cloud Posse)about 7 years ago

I think best would be to do a quick call to see if I can help unblock you

Erik Osterman (Cloud Posse)about 7 years ago

https://calendly.com/cloudposse

Erik Osterman (Cloud Posse)about 7 years ago

Sometime later this week..

keenabout 7 years ago(edited)

just hoping to find a way to generate them, config them, and build the repo for each new account as it comes along (it seems like the ref-arch as it sits now is more focused on onetime use than long term generation)

Erik Osterman (Cloud Posse)about 7 years ago

Yes totally correct

keenabout 7 years ago

ok cool - I was hoping I was missing something. 🙂 I can work with that.

Erik Osterman (Cloud Posse)about 7 years ago

The current use-case solved was a one time cold start

Erik Osterman (Cloud Posse)about 7 years ago

We don’t try to maintain terraform state for the generation

Erik Osterman (Cloud Posse)about 7 years ago

I think it’s doable, but the dns zone delegation or interaccount linking is complicated

keenabout 7 years ago

are the discovery dns zones used for anything outside of k8s and friends?

Erik Osterman (Cloud Posse)about 7 years ago

It’s used for discovery things like RDS, elastic ache, elastic search etc

keenabout 7 years ago

gotcha

keenabout 7 years ago

I'll have to look a bit further at how you're using it with rds in that case

Erik Osterman (Cloud Posse)about 7 years ago

Check out our RDS module

keenabout 7 years ago

will do

keenabout 7 years ago

one other clarification - in the current setup, for each repo - root straight out of the ref-arch for example - there's no converge the entire repo's state right? just cd dir init-t t plan t apply yes; cd ../dir repeat ?

keenabout 7 years ago

(noting that I completely and totally understand why you're splitting tfstate.)

keenabout 7 years ago

I built a chef-solo framework around tf for similar reasons 🙂

joshmyersabout 7 years ago

@keen no converge all.

keenabout 7 years ago

thanks

Erik Osterman (Cloud Posse)about 7 years ago

yes, which (as you mention) is by design. it's very easy to manage across accounts in terraform.

Erik Osterman (Cloud Posse)about 7 years ago

however, we made the conscious design decision to not use that pattern. instead, enforcing due process on how changes are introduced to environments using git workflow.

keenabout 7 years ago

yep

Erik Osterman (Cloud Posse)about 7 years ago

i think that the approaches aren't mutually exclusive

Erik Osterman (Cloud Posse)about 7 years ago

so for example, a certain set of accounts can be delegated out to BUs

Erik Osterman (Cloud Posse)about 7 years ago

then BUs can have their own accounts that they converge

keenabout 7 years ago

would be nice to be able to have a single converge prod option (vs manual workflow steps in test, for example)

keenabout 7 years ago

but that's easy enough to achieve

keenabout 7 years ago

(eventually)

Erik Osterman (Cloud Posse)about 7 years ago

btw, see this: https://sweetops.slack.com/archives/CB2PXUHLL/p1551115877045700

Erik Osterman (Cloud Posse)about 7 years ago

(and I know there are others like this)

joshmyersabout 7 years ago

Not really, you have no idea what you are going to get via a plan if there are dependencies between the states. which almost all places will have.

Erik Osterman (Cloud Posse)about 7 years ago

but this is a small precompiled go binary which is nice

Erik Osterman (Cloud Posse)about 7 years ago

and could be an interesting notion to leverage with geodesic

keenabout 7 years ago(edited)

yeah - looks like it might be slightly saner than some of the other generators I've worked with. (at quick glance)

Chrisabout 7 years ago

howdy

Chrisabout 7 years ago

@Erik Osterman (Cloud Posse) was asked to join the channel, unable to get the make docker/build to do anything other than error out: DOCKER not defined in docker/build
make: *** [docker/build] Error 1

Chrisabout 7 years ago

https://docs.cloudposse.com/reference-architectures/cold-start/ <-- trying to follow this

Chrisabout 7 years ago

am I doing something wrong here?

Andriy Knysh (Cloud Posse)about 7 years ago

hey @Chris

Andriy Knysh (Cloud Posse)about 7 years ago

can you run make init first and then make docker/build

Chrisabout 7 years ago

did

Chrisabout 7 years ago

make init runs fine

Chrisabout 7 years ago

Andriy Knysh (Cloud Posse)about 7 years ago

can you try to use the latest geodesic https://github.com/cloudposse/geodesic/tree/0.71.3

Chrisabout 7 years ago

clone the repo, make init, make?

Andriy Knysh (Cloud Posse)about 7 years ago

do you have Docker installed ?

Andriy Knysh (Cloud Posse)about 7 years ago

https://github.com/cloudposse/build-harness/blob/master/modules/docker/Makefile#L1

Chrisabout 7 years ago

docker desktop wasn't running

Chrisabout 7 years ago

workingnow

Andriy Knysh (Cloud Posse)about 7 years ago

good

Andriy Knysh (Cloud Posse)about 7 years ago

you also need to update https://github.com/cloudposse/testing.cloudposse.co/blob/master/Makefile with your settings

Andriy Knysh (Cloud Posse)about 7 years ago

(and the Dockerfile)

Andriy Knysh (Cloud Posse)about 7 years ago

then

Andriy Knysh (Cloud Posse)about 7 years ago

make init

Andriy Knysh (Cloud Posse)about 7 years ago

make docker/build

Andriy Knysh (Cloud Posse)about 7 years ago

make install

Andriy Knysh (Cloud Posse)about 7 years ago

<http://root.cloudvirga.com|root.cloudvirga.com>

Chrisabout 7 years ago

Was able to build the image, now trying to login and assume-role but getting AccessDenied: MultiFactorAuthentication failed, unable to validate MFA code. Please verify your MFA serial number is valid and associated with this user. Status code 403

Chrisabout 7 years ago

I'll try a few more times

Andriy Knysh (Cloud Posse)about 7 years ago

Did you enable and configure MFA on the account for the user you are trying to login with?

Erik Osterman (Cloud Posse)about 7 years ago

for those of you in Los Angeles (#lax), I'll be presenting on Geodesic at this meetup: https://www.meetup.com/Los-Angeles-Kubernetes-Meetup/events/258976627/

January 2019 Browse by date March 2019