#geodesic - October 2019 | Slack Archive

geodesic

185 messages

Discussions related to https://github.com/cloudposse/geodesic

Archive: https://archive.sweetops.com/geodesic/

Sep 2019

October 2019

Nov 2019

Erik Osterman (Cloud Posse)over 6 years ago

@here public #office-hours starting now! join us to talk shop https://zoom.us/j/508587304

dalekurtover 6 years ago

@Jeremy G (Cloud Posse) Eric suggested that I speak with you regarding my current issue with the reference-architecture, as you had a similar challenge. Here is a Gist of it - https://gist.github.com/dalekurt/7c451ba3914f066bf16b42392904aca1

Jeremy G (Cloud Posse)over 6 years ago

@dalekurt I need more context to really understand what is going on here, but my guess is that generally the reference architecture scripts still require Terraform v0.11 but the make root scripts are using the default terraform which is now v0.12. @Erik Osterman (Cloud Posse) when Terraform is being bootstrapped (initial S3 buckets created and initialized) where are the scripts getting the terraform binary from?

dalekurtover 6 years ago

@Jeremy G (Cloud Posse) If I recall correctly, I have terraform v0.11 installed (at home) I did perform a git pull recently. The make root and make children executed successfully but make finalize failed with the error in the gist.

dalekurtover 6 years ago

Those are executed in the docker container and not my local installation of terraform from my understanding.

Jeremy G (Cloud Posse)over 6 years ago(edited)

@dalekurt Geodesic has both versions of terraform (0.11 and 0.12) installed so we can use both during the current transition period, but defaults to 0.12. We use direnv to read .envrc files in directories, and in those .envrc files we (should) have either use terraform 0.11 or use terraform 0.12 to pick which version to use. That mechanism works fine, we use it in all our current projects, but we use reference-architecture only rarely and it is therefore often broken around issues like this. My guess is that the bootstrap code is missing a use terraform 0.11 somewhere.

Jeremy G (Cloud Posse)over 6 years ago

@dalekurt Looking into it some more, I can see a bunch of things that could have gone wrong. I would check which S3 buckets were created for the Terraform state files (just check root and one child account, like audit), if they were populated with state during make root and make children, and what name the Terraform module thinks the S3 bucket should have when it is erroring out. My current guess is that the buckets are being created correctly but the IAM role is lacking permissions. We recently started locking down S3 buckets by default and ref-arch might have been relying on them being open until everything was finalized. If the bucket exists but you are getting NoSuchBucket errors, that is a permissions problem. If the bucket really does not exist, either you missed an earlier error where the creation failed or the name of the bucket that was created does not match the name of the bucket TF is attempting to read, which can happen when we update one thing but forget to update another, or are using incompatible versions.

dalekurtover 6 years ago

@Jeremy G (Cloud Posse) Thank you, that was a pretty comprehensive response. I will have a look at this later today

chrismover 6 years ago

joys of windows update


dirname: missing operand
Try 'dirname --help' for more information.
/usr/local/bin/prod.xx.uk: line 115: cmd.exe: command not found

docker loads; just no aws-vault 🙄

chrismover 6 years ago

i think the windows wsl interop died; god knows

chrismover 6 years ago

no fstab entries; using the LOCAL_HOME="C:\Users\xx\AppData\Local\Packages\CanonicalGroupLimited.Ubuntu18.04onWindows_79rhkp1fndgsc\LocalState\rootfs\home\xxx" env set before calling it works for now though lol ohhhhhhh windows

chrismover 6 years ago

seems related to the wsl conf; its not changed but its also not working

Erik Osterman (Cloud Posse)over 6 years ago

@chrism dang!!

Erik Osterman (Cloud Posse)over 6 years ago

yea, what a PIA

chrismover 6 years ago

its fine; its all windows fault 😄

Erik Osterman (Cloud Posse)over 6 years ago

is it something you think you can fix? we can review the PR

chrismover 6 years ago

I don't think the code needs fixing tbh

chrismover 6 years ago

The wsl process is supposed to map all the windows drives to fstab on boot; but its not working.
The bootstrap script uses the fstab to find the location

chrismover 6 years ago

"potentially" this all magically starts to work proplerly in WSL2 as the "wsl home" is a virtual drive not just a windows folder

chrismover 6 years ago

I just need to fix my wsl to fix it

Erik Osterman (Cloud Posse)over 6 years ago

ok, report back on what you come up with

chrismover 6 years ago(edited)

If im torching it I might as well try wsl 2 and see if it solves all the other issues (hopefully all the hacks made to get wsl 1 working wont break wsl 2 😆 )

chrismover 6 years ago

i backup my user dir anyway so its just the tedium of waiting for windows to complete steps purging it all out. Not quite as good as when I could use vmware (damn hyperv) and snapshot ubuntu, but it'll do 😄

chrismover 6 years ago

wsl2 still requires you to be on the 'goat sacrifice' branch (tech preview); reinstalled wsl and the mount issue wasnt fixed. My laptops up to the same build and is fine.
Fixed it in the end with mount -t drvfs C: /c in the /etc/wsl.conf

chrismover 6 years ago

left the full path in my bashrc file though after testing; cuts down on the faff

lorenover 6 years ago

dang, scared to reboot now... haven't seen the mount issue yet on wsl myself...


$ cat /etc/wsl.conf
[automount]
enabled = true
options = "metadata,umask-22,fmask-11"
mountFsTab = true
$ cat /etc/fstab
LABEL=cloudimg-rootfs   /        ext4   defaults        0 0
C:           /mnt/c         drvfs   rw,metadata,noatime,case=off,uid=1000,gid=1000,umask=22,fmask=11     0    0

chrismover 6 years ago

My laptops been fine; its weird af.

chrismover 6 years ago

tbh if you just shove the fstab setting back in it works fine; It was only C that went to pot; my other shared drives worked fine.

SweetOps #geodesicover 6 years ago

There are no events this week

Cloud Posseover 6 years ago

Join us for "Office Hours" every Wednesday 11:30AM (PST, GMT-7) via Zoom.

This is an opportunity to ask us questions about INLINECODE_0, get live demos and learn from others using it. Next one is Oct 16, 2019 11:30AM.

👉️ Register for Webinar

#office-hours (our channel)

oscarover 6 years ago

FYI I’ve gutted the way I use Geodesic. Instead of one module per account I now use the following structure

oscarover 6 years ago


└── terraform
    ├── .envrc
    └── aws
        ├── .envrc
        ├── bastion
        │   ├── .envrc
        │   └── Makefile
        ├── development
        │   ├── .envrc
        │   └── account
        ├── production
        │   └── .envrc
        └── shared
            ├── .envrc
            ├── .module
            ├── .terraform
            ├── Makefile
            └── terraform.tfvars

oscarover 6 years ago

If anyone is keen on reducing the maintenance of several modules and only holding one I can give some practices

Erik Osterman (Cloud Posse)over 6 years ago

that looks good - but i would also add region

Erik Osterman (Cloud Posse)over 6 years ago

if you want to future proof yourself some more

Erik Osterman (Cloud Posse)over 6 years ago(edited)

also, I think I would do terraform/stage/cloud/region

Erik Osterman (Cloud Posse)over 6 years ago

e.g terraform/prod/cloudflare and terraform/prod/aws/us-east-1

Erik Osterman (Cloud Posse)over 6 years ago

seems natural to bundle everything for prod together.

Erik Osterman (Cloud Posse)over 6 years ago

are you using github?

oscarover 6 years ago

True I was thinking about this

oscarover 6 years ago

No this is on our internal VCS

Erik Osterman (Cloud Posse)over 6 years ago

aha

oscarover 6 years ago

Erik Osterman (Cloud Posse)over 6 years ago

i have some thoughts on the mono repo + geodesic + github actions

Erik Osterman (Cloud Posse)over 6 years ago

another thing to consider....

Erik Osterman (Cloud Posse)over 6 years ago

so terraform as a community seems to be going more the way of workspaces

oscarover 6 years ago

Yes I have also shifted to workspaces

oscarover 6 years ago

mainly to conform with terraform cloud

Erik Osterman (Cloud Posse)over 6 years ago

right

oscarover 6 years ago

but I obviously have my IP Whitelist issue

oscarover 6 years ago

but not workspaces as in terraform workspace add

oscarover 6 years ago

just rather

Erik Osterman (Cloud Posse)over 6 years ago

so then i'm thinking the stage folder makes less sense - as it doesn't help you be as DRY

oscarover 6 years ago


├── terraform-aws-app
│   ├── README.md
│   ├── eks.tf
│   ├── environments
│   │   └── development
│   ├── terraform.tf
│   ├── variables.tf
│   ├── versions.tf

Erik Osterman (Cloud Posse)over 6 years ago

yea, something like that

Erik Osterman (Cloud Posse)over 6 years ago

https://github.com/hashicorp/terraform/issues/15966#issuecomment-520102463

Erik Osterman (Cloud Posse)over 6 years ago

@sarkis shared this which piqued my interest

Erik Osterman (Cloud Posse)over 6 years ago

using yamldecode you can now define your own configs for environments

oscarover 6 years ago

I’ve seen that

Erik Osterman (Cloud Posse)over 6 years ago

then load those based on the workspace name

oscarover 6 years ago

but I’ve got a super duper thing going on

Erik Osterman (Cloud Posse)over 6 years ago

😃

oscarover 6 years ago

it’s hard to type out

oscarover 6 years ago

but hopefully I can make office hours tomorrow

Erik Osterman (Cloud Posse)over 6 years ago

yes!

Erik Osterman (Cloud Posse)over 6 years ago

i want to see it.

oscarover 6 years ago

The gist is:

- One geodesic module for all envs.


└── terraform
    ├── .envrc
    └── aws
        ├── .envrc
        ├── bastion
        │   ├── .envrc
        │   └── Makefile
        ├── development
        │   ├── .envrc
        │   └── account
        ├── production
        │   └── .envrc
        └── shared
            ├── .envrc
            ├── .module
            ├── .terraform
            ├── Makefile
            └── terraform.tfvars

- Terraform infra definitions (root modules that uses child modules) has ‘workspace’-like configs


├── terraform-aws-app
│   ├── README.md
│   ├── eks.tf
│   ├── environments
│   │   └── development
│   ├── terraform.tf
│   ├── variables.tf
│   ├── versions.tf

- Important files like Makefiles to operate Terraform & terraform.tfvars are loaded at ‘terraform init’ run time

oscarover 6 years ago

so this means that you don’t have to keep rebuilding the geodesic shell

oscarover 6 years ago

it just pulls them from git at use-time meaning you always get the latest

oscarover 6 years ago

And any variables set in Geodesic are extremely static and very unlikely to change (e.g. Account ID, VPC ID)

oscarover 6 years ago

arguably VPC ID isn’t even needed anymore as I get that from DATA, that’s just a legacy variable

oscarover 6 years ago

Could we bump https://github.com/cloudposse/packages/blob/master/vendor/terraform-0.12/VERSION to 0.12.10 🙂 ?

oscarover 6 years ago

https://github.com/cloudposse/packages/pull/238

joshmyersover 6 years ago

I have a suspicion, but what is the reason behind the layers of indirection to clone the build-harness? i.e. https://github.com/cloudposse/geodesic/blob/master/Makefile#L7 => https://github.com/cloudposse/build-harness/blob/master/templates/Makefile.build-harness => https://github.com/cloudposse/build-harness/blob/master/bin/install.sh

joshmyersover 6 years ago

to essentially clone the build-harness and include the targets?

joshmyersover 6 years ago

If this isn’t in a public Github repo, it is going to require a token to clone the https repo, as well as already having an ssh key…

Erik Osterman (Cloud Posse)over 6 years ago

No token needed to clone public repos over https

Erik Osterman (Cloud Posse)over 6 years ago

But yes if you wanted to make it private it would require a token

joshmyersover 6 years ago(edited)

Yup, wondered how much work to do this all over ssh rather than https

Erik Osterman (Cloud Posse)over 6 years ago

Guess you could do this instead of curl

Erik Osterman (Cloud Posse)over 6 years ago

git archive --remote=git@gitserver.example.com:myrepo master path/to/file1 | tar -xOf -

joshmyersover 6 years ago

ah, that maybe the magic I’m after

Jeremy G (Cloud Posse)over 6 years ago

@oscar If you want to have Geodesic install the latest APKs during the build process, first run make geodesic_apkindex.md5 to invalidate the Docker cache layer that caches the old APK indexes.

oscarover 6 years ago

Thanks!

oscarover 6 years ago

@Jeremy G (Cloud Posse) - I’ve updated to the latest Geodesic (0.123.1), and tried both terraform@cloudposse and terraform-0.12@cloudposse and still end up with TF v0.12.7 any thoughts?


FROM cloudposse/geodesic:0.123.1

RUN apk add --update --no-cache \
  terraform@cloudposse

oscarover 6 years ago

No existing containers running either

oscarover 6 years ago

N’aaww I got it. Don’t worry. User error to do with changing the docker image name and not adding it to the bin, meaning make run was still using the old image.,

SweetOps #geodesicover 6 years ago

There are no events this week

Cloud Posseover 6 years ago

👉️ Register for Webinar

#office-hours (our channel)

oscarover 6 years ago

I did try the make *.md5 command though and that came up with no target found.

oscarover 6 years ago

As of my upgrade to 0.123.1 from 0.122.4 I’m no longer able to run terraform init using the TF_MODULE_CACHE setting (as per logic in Geodesic’s terraform script.. below…)


	# Starting with Terraform 0.12, you can no longer initialize a directory that contains any files (not even dot files)
	# To mitigate this, define the `TF_MODULE_CACHE` variable with an empty directory.
	# This directory will be used for `terraform init -from-module=...`, `terraform plan`, `terraform apply`, and `terraform destroy`
	if [ -n "${TF_MODULE_CACHE}" ]; then
		export TF_CLI_PLAN="${TF_MODULE_CACHE}"
		export TF_CLI_APPLY="${TF_MODULE_CACHE}"
		export TF_CLI_INIT="${TF_MODULE_CACHE}"
		export TF_CLI_DESTROY="${TF_MODULE_CACHE}"
	fi
}

oscarover 6 years ago

The only thing changed is package versions of terraform#

oscarover 6 years ago

I’ve also reviewed terraform releases and can’t see what could have done this between 0.12.4 and 0.12.10

oscarover 6 years ago


TF_VAR_tf_module_cache=.module
TF_CLI_ARGS_init=-backend-config=region=eu-west-1 -backend-config=bucket=development-terraform-state -backend-config=dynamodb_table=development-terraform-state-lock -from-module=git::git@bitbucket.org:xcv.git?ref=master
TF_MODULE_CACHE=.module

oscarover 6 years ago

Ok appears to be because I lost my use terraform along the way in my .envrc

oscarover 6 years ago(edited)

Yarp. Re-added


use terraform
use tfenv

and all gucci on latest geodesic and just cloudposse@terraform instead of cloudposse@terraform_0.12

Erik Osterman (Cloud Posse)over 6 years ago

excellent!

oscarover 6 years ago

---

I’m trying to ssh-add /path/to/private/key inside of BitBucket pipelines however I get:


> ssh-add /opt/atlassian/pipelines/agent/ssh/id_rsa
Could not open a connection to your authentication agent.

oscarover 6 years ago

Am I missing something? Is this BB P thing e.g. non exposed service etc

Erik Osterman (Cloud Posse)over 6 years ago

looks like your ssh agent is not started

Erik Osterman (Cloud Posse)over 6 years ago

we only start it by default in interactive sessions

oscarover 6 years ago

ahhh

oscarover 6 years ago

gotcha

Erik Osterman (Cloud Posse)over 6 years ago

https://github.com/cloudposse/geodesic/blob/master/rootfs/etc/init.d/atlantis.sh#L70-L75

Erik Osterman (Cloud Posse)over 6 years ago

here's how we do it for atlantis

oscarover 6 years ago

just run


# Otherwise launch a new agent
if [ -z "${SSH_AUTH_SOCK}" ] || ! [ -e "${SSH_AUTH_SOCK}" ]; then
	ssh-agent | grep -v '^echo' >"${SSH_AGENT_CONFIG}"
	. "${SSH_AGENT_CONFIG}"

	# Add keys (if any) to the agent
	if [ -n "${SSH_KEY}" ] && [ -f "${SSH_KEY}" ]; then
		echo "Add your local private SSH key to the key chain. Hit ^C to skip."
		ssh-add "${SSH_KEY}"
	fi

oscarover 6 years ago

ah nice

Erik Osterman (Cloud Posse)over 6 years ago

you could maybe do sometihng similar

oscarover 6 years ago

thanks 🙂

oscarover 6 years ago

what’s gosu

Erik Osterman (Cloud Posse)over 6 years ago

very easy utility to drop permissions to a user

Erik Osterman (Cloud Posse)over 6 years ago

easier than using sudo or su

oscarover 6 years ago

super thx

Erik Osterman (Cloud Posse)over 6 years ago

you may not need it

dalekurtover 6 years ago

I’m having some trouble decrypting the IAM user password created. Using the decrypt command echo "MY_PGP_MESSAGE" | base64 --decode | keybase pgp decrypt I get the error message “ERROR decrypt error: unable to find a PGP decryption key for this message”

dalekurtover 6 years ago

Am I missing something here?

Erik Osterman (Cloud Posse)over 6 years ago

Are you running that natively on your Mac?

dalekurtover 6 years ago

Yes, on my mac.

Erik Osterman (Cloud Posse)over 6 years ago

Sounds like something wrong with keybase install

Erik Osterman (Cloud Posse)over 6 years ago

Or using wrong keybase username

dalekurtover 6 years ago(edited)

That latter was my assumption.

SweetOps #geodesicover 6 years ago

There are no events this week

Cloud Posseover 6 years ago

👉️ Register for Webinar

#office-hours (our channel)

Erik Osterman (Cloud Posse)over 6 years ago

@oscar you have this problem too? https://github.com/hashicorp/terraform/issues/17300

Erik Osterman (Cloud Posse)over 6 years ago

Looks like there's no way to elegantly work around it

Erik Osterman (Cloud Posse)over 6 years ago

other than creating a symlink in the .module/.terraform to -> .terraform

Erik Osterman (Cloud Posse)over 6 years ago

the -state=... argument is useless

oscarover 6 years ago

Yep!

Erik Osterman (Cloud Posse)over 6 years ago

joshmyersover 6 years ago

Starting to feel like TF init from module is going to be made harder and harder

oscarover 6 years ago

I have moved to Terraform Cloud to avoid these issues

Erik Osterman (Cloud Posse)over 6 years ago

Yes, I feel that way too

joshmyersover 6 years ago

What would be another option if not using tf init from module...

oscarover 6 years ago

git clone X && cd X

oscarover 6 years ago

but direnv doesn’t support cd

joshmyersover 6 years ago

Move a terraform-root-modules style module into the env containers?

oscarover 6 years ago

I tried that the other day, perhaps I didn’t do it right though

dalekurtover 6 years ago

here is a question for the channel, after successfully completing the deployment of the reference-architecture and I’m on to the next steps to commit the /repos for the accounts created. Should I be committing each to their individual git repository, for example /repos/audit.mycompany.com to a <http://github.com/mycompany/audit.mycompany.com|github.com/mycompany/audit.mycompany.com>?

Erik Osterman (Cloud Posse)over 6 years ago

yep!

Erik Osterman (Cloud Posse)over 6 years ago

that's how we do it

Erik Osterman (Cloud Posse)over 6 years ago

we treat each account as an application

Erik Osterman (Cloud Posse)over 6 years ago

no 2 accounts are ever the same

Erik Osterman (Cloud Posse)over 6 years ago

They may run the same software pinned at versions

Erik Osterman (Cloud Posse)over 6 years ago

But usually many things vary

dalekurtover 6 years ago

@Erik Osterman (Cloud Posse) Today’s office hours really opened my eyes on this. I was just talking about it to my girlfriend. I know she has not idea what I am talking or even cares LOL

dalekurtover 6 years ago

I have so many questions!

Erik Osterman (Cloud Posse)over 6 years ago

Haha, probably not a "captive" audience

Erik Osterman (Cloud Posse)over 6 years ago

lol

dalekurtover 6 years ago

She does a pretty good job listening to me ramble on. 🙂 So get this, I am looking at creating some policies at the org level (SCP) and I started writing a few using the aggregator module, but you blew that our of the water after today. As now, I think it can be done much easier. So I’m going to start playing around geodesic, the documentations and that video you shared in the office-hours channel to do just that. I know the reference architecture does not yet support identity account but I still went ahead and created it because it is a great idea to separate the user authN and authZ there.

dalekurtover 6 years ago

Then i want to start writing other policies for the IAM groups, etc.

Erik Osterman (Cloud Posse)over 6 years ago

@tamsky perhaps, but i'm personally more interested in optimizing for terraform cloud

dalekurtover 6 years ago

I’m getting started with Geodesic and I created my CLUSTER_NAME env var


export CLUSTER_NAME=<http://identity.mycompany.co|identity.mycompany.co>
cd $CLUSTER_NAME
make init
make docker/build

After the make docker/build I got a build error trying to copy the rootfs


Removing intermediate container 9a31e8a4ae01
 ---> e926f71ba169
Step 25/26 : COPY rootfs/ /
COPY failed: stat /var/lib/docker/tmp/docker-builder620832852/rootfs: no such file or directory
make: *** [docker/build] Error 1

dalekurtover 6 years ago(edited)

I created the rootfs directory in my /path/to/identity.mycompany.co/ dir path and executed make docker/build and moved on to run


docker run cloudposse/identity.mycompany.co | bash -s latest

Then I was able to execute <http://identity.mycompany.co|identity.mycompany.co> from the CLI and got into the Geodesic.

My question is what should be in the rootfs dir path

dalekurtover 6 years ago

💡Figured it out from the history.

dalekurtover 6 years ago

On to the next, I’m trying to get aws-vault setup

Erik Osterman (Cloud Posse)over 6 years ago

Just run “aws-setup”

dalekurtover 6 years ago

@Erik Osterman (Cloud Posse) Should aws-setup be done in the geodesic shell or on the local

Alex Siegmanover 6 years ago

in the shell

Alex Siegmanover 6 years ago

aws-vault inside the shell actually stores the file store in /localhost/ which will map to your home directory. i use the same aws-vault on my localhost for legacy stuff that's not run inside geodesic yet. works well

Andrew Rothover 6 years ago

My team is currently talking about building a container similar to Geodesic. Starting out it will just be a toolbox of the tools we need for dev and CI. It will likely be used by other teams within my company eventually. I am arguing for giving it a fun name, a la Geodesic, but they want something descriptive, and admittedly boring, like "devsecops-build-tools".

Thoughts? Any ammunition I can take back and say, see; here is why we should give it a good name.

dalekurtover 6 years ago

FYI: The issue I experienced with Keybase not being able to decrypt the IAM user password which resulted in “ERROR decrypt error: unable to find a PGP decryption key for this message”. I was able to fix this from the initial Macbook Pro by copying the files from one MacBook Pro to the other. The executing a restart of Keybase keybase ctl restart


    ~/Library/Application Support/Keybase/secretkeys.<username>.mpack
    ~/Library/Application Support/Keybase/config.json

Erik Osterman (Cloud Posse)over 6 years ago

Thanks for reporting

dalekurtover 6 years ago

I just realized that working with the geodesic shell, I created files and directories in the /conf dir path are not persistent. Did I miss a step?

Alex Siegmanover 6 years ago(edited)

No, /conf is meant not to be persistent. It should match the git repo for itself, and it stays built and up to date for use in your CI/CD stuff. I assume you're trying to figure out local development?

dalekurtover 6 years ago

@Alex Siegman Yes, I am.

joshmyersover 6 years ago

Your host home dir is mounted into geodesic at /localhost/

dalekurtover 6 years ago

Yes. So, I should work within the geodesic shell within that dir path.

Erik Osterman (Cloud Posse)over 6 years ago

For local development

Erik Osterman (Cloud Posse)over 6 years ago

But not as a workflow with staging and production, for example

dalekurtover 6 years ago

@Erik Osterman (Cloud Posse) so all my development would be done via the geodesic shell within the dir path /localhost then I can commit those tf files to git for the automated workflow?

dalekurtover 6 years ago

So say I have my local development in dir path ~/Workspace/my-company/identity.my-company.com/ from within the geodesic shell I could just work within dir path /localhost/Workspace/my-company/identityt.my-company.com/conf/, make sense?

SweetOps #geodesicover 6 years ago

There are no events this week

Cloud Posseover 6 years ago

👉️ Register for Webinar

#office-hours (our channel)

tamskyover 6 years ago

@Erik Osterman (Cloud Posse) -- fyi - yesterday I built geodesic without any python2.
Admittedly I had to chop out support for crudini in a few places, but other than that it looks good.

Erik Osterman (Cloud Posse)over 6 years ago

was this to reduce the size?

Erik Osterman (Cloud Posse)over 6 years ago

(i wish there was a robust go alternative to crudini)

tamskyover 6 years ago

&& this quirk


FROM python:3.7-alpine as python
[stuff}
RUN pip install -r /requirements.txt --install-option="--prefix=/dist" --no-build-isolation --no-cache-dir

# For some reason dateutil/python_dateutil ignores our --prefix and gets
# installed into /usr/local/lib/python3.7/site-packages.
RUN mv /usr/local/lib/python3.7/site-packages/dateutil/ /dist/lib/python3.7/site-packages/
RUN mv /usr/local/lib/python3.7/site-packages/python_dateutil-*.dist-info/ /dist/lib/python3.7/site-packages/

Erik Osterman (Cloud Posse)over 6 years ago

what about the aws cli?

tamskyover 6 years ago

I think I unpinned awscli and boto in requirements.txt

tamskyover 6 years ago

I did it for sanity... one python should be enough for anyone 😃

tamskyover 6 years ago(edited)

oh yes, one more later on


COPY --from=python /dist/ /usr/local/
RUN ln -s ../../bin/python3 /usr/local/bin/python

Hasanover 6 years ago

Has anyone gotten SAML auth with google apps working?

Hasanover 6 years ago

i've tried and failed. When testing to see if the role is assumed, it succeeds, but when running a terraform plan, it says that it can not find the credentials.
I added saml2aws by adding this to rootfs/etc/profile.d/aws-saml2aws.sh

Hasanover 6 years ago

I've also added this to the dockerfile to provide the binary.

Not sure how to completely un-rig aws-vault successfully, as it doesn't work with saml.

tamskyover 6 years ago

@Erik Osterman (Cloud Posse) quick question about https://github.com/cloudposse/geodesic/blob/master/rootfs/etc/make.conf
After poking at it for a bit, I've come to believe the file is 100% unused -- The installed gnu-make does not use it.

September 2019 Browse by date November 2019