#office-hours - June 2020

Maybe this isn’t so much of an office hours question than a request so let me know if its misfiled. Does anyone have any experience with https://github.com/pomerium/pomerium?

just a reminder: today we have a special guest speaker (@Chuck Gehman) who will be answering questions related to Cloud Formation.

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

Robert Horrox has joined Public "Office Hours"

Marc Tanne has joined Public "Office Hours"

Chuck Gehman has joined Public "Office Hours"

Dan Overholt has joined Public "Office Hours"

Thomas Mundt has joined Public "Office Hours"

Alex Siegman has joined Public "Office Hours"

tamsky has joined Public "Office Hours"

zloeber has joined Public "Office Hours"

Vijay Ravi has joined Public "Office Hours"

Neil Gealy has joined Public "Office Hours"

Adam Crown has joined Public "Office Hours"

Stephanie Koerlin has joined Public "Office Hours"

Ben Wart has joined Public "Office Hours"

Marcin Branski has joined Public "Office Hours"

Igor Miltchman has joined Public "Office Hours"

Oliver Schoenborn has joined Public "Office Hours"

Brian Tai has joined Public "Office Hours"

Joe Hosteny has joined Public "Office Hours"

Not on topic of cloudformation but if you have time:

I'm creating an EKS cluster with the cloudposse EKS cluster module, and running kubectl apply from the main.tf (using a localfile with localexec). Sometimes the kubectl apply gets run before the kube api server is ready, so I'm wondering what is the recommended way to deal with that: time_sleep resource? a way to indicate dependency so the localexec does not run too early? a way to only run the kubectl exec once API responds? (actually that will work for sure if I write a bash script that loops until kubectl apply works).

Jie Chen has joined Public "Office Hours"

Blaise pabon has joined Public "Office Hours"

Question for Chuck: We have a series of CloudFormation scripts that collectively add up to our stack. Only one contains a series of nested scripts. We would like to be able to combine 20+ cloudformation scripts into one execution to create a new Dev stack and subsequently be able to destroy that when necessary. Is this an appropriate use for Service Catalog or what is the recommended approach?

^^^

Cloudformation Question: I’ve used CF extensively at past roles, but my recollection is that if a resource was not initially created with CF, you couldn’t really manage that resource with CF ever in it’s lifetime. Recreation might be fine for ephemeral stuff, but for data stores and things it’s not always practical. How does CF handle that kind of scenario where you might need to import an existing resource in to a stack?

Ola Ade has joined Public "Office Hours"

Harry Moreno has joined Public "Office Hours"

Ben Wart has joined Public "Office Hours"

Blaise pabon has joined Public "Office Hours"

HariPrasad Venkatanarayana has joined Public "Office Hours"

Alex Vorona has joined Public "Office Hours"

ola server has joined Public "Office Hours"

This message was deleted.

eddie.wizelman has joined Public "Office Hours"

Terrastack uses https://github.com/aws/jsii: "[jsii] allows code in any language to naturally interact with JavaScript classes. It is the technology that enables the AWS Cloud Development Kit to deliver polyglot libraries from a single codebase"

Maybe not first but probably in the first 3 🙂 The 2 others are:
• Learn CloudFormation came out in July 2018
• Mastering CloudFormation just came out this month

Question: when I used CloudFormation last summer on one project the most frustrating aspect was when the stack being updated had a mistake then would rollback and even the rollback failed. How do you avoid this?

@Erik Osterman (Cloud Posse) Early in this meeting you talked about the 4 layers that comprises infrastructure, did you have an article that goes over the layers and such?

Eric Berg has joined Public "Office Hours"

@Erik Osterman (Cloud Posse) definitely interested in that ebook AWS CF in Action

Peter Sbarski from ACloudGuru wrote the serverless book

This book, AWS Security is by Dylan Shields... 5 chapters in the MEAP preview program, https://www.manning.com/books/aws-security

Thanks again everyone! Thanks Erik!

Also, forgot to post @Chuck Gehman’s book!
https://www.manning.com/books/aws-cloudformation-in-action

Discount code podposse20 (40% off) or DM me for 100% off coupon.

Also, just a reminder - if you're an expert on tools like Flux, Argo, Jenkins on Kubernetes, Open Policy Agent, Pulumi, Serverless, etc - hit me up. I would love to have a deeper conversation around some of these tools and your real-world experiences on one of our upcoming office hours

👉️ New Zoom Recording from our Office Hours session on 2020-06-03 is now available.

Office Hours starting in 15 minutes

Make sure to post your questions

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

Kurt O'Connor has joined Public "Office Hours"

@here public #office-hours starting now! join us to talk shop https://cloudposse.zoom.us/j/508587304

Dan Overholt has joined Public "Office Hours"

Vijay Ravi has joined Public "Office Hours"

Robert Horrox has joined Public "Office Hours"

Andy Roth has joined Public "Office Hours"

David Medinets has joined Public "Office Hours"

HariPrasad Venkatanarayana has joined Public "Office Hours"

eddie.wizelman has joined Public "Office Hours"

Zachary Loeber has joined Public "Office Hours"

Aarat Nathwani has joined Public "Office Hours"

Adam Crown has joined Public "Office Hours"

Adam Crews has joined Public "Office Hours"

i am hearing no sound.

sri has joined Public "Office Hours"

Omer Sen has joined Public "Office Hours"

Marc Tanne has joined Public "Office Hours"

Alex Siegman has joined Public "Office Hours"

Jie Chen has joined Public "Office Hours"

Latika Wadhwani has joined Public "Office Hours"

Michael Martin has joined Public "Office Hours"

Rahul Muraleedharan has joined Public "Office Hours"

Jim Park has joined Public "Office Hours"

Bircan Bilici has joined Public "Office Hours"

Matt Gowie has joined Public "Office Hours"

Hilal Jaffan has joined Public "Office Hours"

Amin Amos has joined Public "Office Hours"

Jeremy Schuller has joined Public "Office Hours"

PePe Amengual has joined Public "Office Hours"

Andrew Elkins has joined Public "Office Hours"

Thomas Mundt has joined Public "Office Hours"

Brian Tai has joined Public "Office Hours"

Eric Berg has joined Public "Office Hours"

@Alex Siegman have a link handy to the 2-tier web architecture recommendation?

For connecting internal alb to nlb, lambda functions can be used.

you know, i've referenced it a bunch of times and i just cannot find it, they've changed how the site is with their new well-architected stuff, i'm looking though

"Before now, you had to choose either the benefits of NLB or the benefits of ALB, but you couldn't have both together. This blog post shows you how to have your cake and eat it too, by putting an Application Load Balancer behind a Network Load Balancer."

the picture at the top of this blog is what i was referring to though https://blog.stratus10.com/aws-best-practices-3-tier-infrastructure

but those used to be available directly from amazon with accompanying materials

👉️ New Zoom Recording from our Office Hours session on 2020-06-10 is now available.

is aws moving away from docker?
Aws fargate 1.4(latest version) is using containerd(https://containerd.io) instead of docker as runtime engine..
https://aws.amazon.com/blogs/containers/under-the-hood-fargate-data-plane/

Till 1.3 version of aws fargate it was using docker as it's runtime engine

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

Andy Roth has joined Public "Office Hours"

Adam Crown has joined Public "Office Hours"

@here public #office-hours starting now! join us to talk shop https://cloudposse.zoom.us/j/508587304

Brandon Wilson has joined Public "Office Hours"

Joey Freeland has joined Public "Office Hours"

Alex Vorona has joined Public "Office Hours"

Brian Tai has joined Public "Office Hours"

Marc Tanne has joined Public "Office Hours"

Matt Gowie has joined Public "Office Hours"

Robert Horrox has joined Public "Office Hours"

Alex Siegman has joined Public "Office Hours"

sri has joined Public "Office Hours"

Stuart King has joined Public "Office Hours"

Michael Martin has joined Public "Office Hours"

Neil Gealy has joined Public "Office Hours"

Rahul Muraleedharan has joined Public "Office Hours"

Adam Watson has joined Public "Office Hours"

Muhammed Soyer has joined Public "Office Hours"

Joe Hosteny has joined Public "Office Hours"

Mythreyee Sammeta has joined Public "Office Hours"

Am I supposed to know the password already?

Omer Sen has joined Public "Office Hours"

Andrew Elkins has joined Public "Office Hours"

Mythreyee Sammeta has joined Public "Office Hours"

cho has joined Public "Office Hours"

Mikael Fridh has joined Public "Office Hours"

eddie.wizelman has joined Public "Office Hours"

Can use Kensis to make scaling Database driven so that Lambda step functions can perform customized health checks and update the DB, which then can forward the WAL logs (using WAL2JSON plugin) into another Lambda to trigger scaling actions based on the data being updated?
https://aws.amazon.com/blogs/database/stream-changes-from-amazon-rds-for-postgresql-using-amazon-kinesis-data-streams-and-aws-lambda/

PePe Amengual has joined Public "Office Hours"

Potential talking point: https://codefresh.io/codefresh-news/announcing-codefresh-runner/

Marcin Branski has joined Public "Office Hours"

not so much a question as much as a statement/comment of "whoa, where have i been" ... but i started playing with localstack recently and am setting up a local development environment and ci/cd. pretty impressive stuff.

does anyone know if there are similar things for gcp and azure?

Amin Amos has joined Public "Office Hours"

Anyone using ECR image scanning as part of the CI/CD ?

James Huffman has joined Public "Office Hours"

Bircan Bilici has joined Public "Office Hours"

Bastille linux (http://bastille-linux.sourceforge.net/) not active anymore

Cisecurity hardening

Openscap

Michael Martin has joined Public "Office Hours"

Opensource docker image scanning: trivy

From aquasec

Docker cache: My ideal is probably Nginx pull through cache in each cluster, upstreaming to ECR and possibly https://goharbor.io/ for the nifty management of things.

in-cluster Storage - anyone used https://github.com/longhorn/longhorn ?

Something new, AWS lambda can now use EFS ..
https://aws.amazon.com/about-aws/whats-new/2020/06/aws-lambda-support-for-amazon-elastic-file-system-now-generally-/

Network latency test: https://www.solarwinds.com/network-performance-monitor/use-cases/network-latency

any folks here with significant experience with DynamoDB?

👉️ New Zoom Recording from our Office Hours session on 2020-06-17 is now available.

Guys?
I am looking for some tool ( nonexistant ) that is able to define projects in git monorepo ( similar to workflows in atlantis ) by fs path for example in yaml, json, etc ( I am using Gitlab CI, btw)
Tool should be able:
• to detect changes in projects ( this will help to determine specific project to change in CI pipeline triggered by MR/PR ) via git diff
• run commands/tasks on changed projects
• to do basic conditions, like if multiple projects change detected ; then exit ; fi
• to do retries if error code of command/task != 0
• to timeout if command/taks is taking more than X seconds
• validate projects -> if contains specific files
Of course it does not exist, currently I am using bunch of scripts, buts its not so good.
1. i am using json file to define projects
2. tests and looping are done via jq ( validating json schema )
3. everything is bash ( a lot of non standard tools )
4. changes are detected with git diff
5. a lot of binaries needed, terraform,terragrunt
What I found so far:
https://github.com/mumoshu/variant
https://github.com/go-task/task
, but these are more like only task runners.

Unfortunately monorepos are not ready yet, like if you dont want recursively find all projects, which is very inefficient...

Anybody have experience building a Unity3D project in CI?

@here - remember to post your questions. office hours starting in 30 minutes

I would like to resurface old question since we have some updates:

we have some async tasks. maybe around 20+ or so. Some of them run at odd hours in the middle of the night and some of them can take up to 20 min to run. I want to get super alerted if something doesn’t run or fail to run. Looking for advice on dashboarding versus alerting. Currently, the team has been trained to keep a close eye on Sentry alerts that comes in thr Slack. We had email alerts from AWS in the past but the team got tuned out.

We are trying a few things to get basic monitoring setup. Looking for general validation.
1. The async tasks are running on celery. Set up the APM for Celery then create monitors in DD for that.
2. Use DD custom metrics. Basically a version of statsd
3. DD Support staff recommended building a lambda function and crawling the log
4. Build a custom agent through datadog

I’m interested in discussing best practices around running terraform destroy in CI and any exception handling that may be used. Right now I just have terraform destroy in a after(always)) block. If terraform destroy fails the Jenkins build will fail, but I want to do something more to handle possible failure cases

And the thing about building a Unity3D project in CI

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

Robert Horrox has joined Public "Office Hours"

Andy Roth has joined Public "Office Hours"

Bircan Bilici has joined Public "Office Hours"

David Scott has joined Public "Office Hours"

Terraform currently does not support re-creation of resources if dependent object is changed or re-created. I’m talking about trigger like behaviour, but considering all other resources in general. It’s discussed here https://github.com/hashicorp/terraform/issues/8099
Do you know any other way to handle this in more elegant way, without using taint?

Amin Amos has joined Public "Office Hours"

Thomas Mundt has joined Public "Office Hours"

Michael Holt has joined Public "Office Hours"

cho has joined Public "Office Hours"

David Medinets has joined Public "Office Hours"

Ryan Moore has joined Public "Office Hours"

Brian Tai has joined Public "Office Hours"

sri has joined Public "Office Hours"

Matt Gowie has joined Public "Office Hours"

I have a question about cloudposse bastion and its integration to ping slack when someone connects. Its not working when its used just to directly tunnel through to another server. Also what's the password for zoom?

Kurt O'Connor has joined Public "Office Hours"

Latika Wadhwani has joined Public "Office Hours"

CHONAN TSAI has joined Public "Office Hours"

CHONAN TSAI has joined Public "Office Hours"

Rahul Muraleedharan has joined Public "Office Hours"

Paul has joined Public "Office Hours"

Andrew Elkins has joined Public "Office Hours"

Neil Gealy has joined Public "Office Hours"

Eddie Wizelman has joined Public "Office Hours"

Andrea Bolandrina has joined Public "Office Hours"

PePe Amengual has joined Public "Office Hours"

Btw:
https://smallstep.com/blog/diy-single-sign-on-for-ssh/

Primoz Cankar has joined Public "Office Hours"

I just realized I do have an ansible question. How can I name a resource like "centos-<timestamp>"?

babajide hassan has joined Public "Office Hours"

Neil Gealy has joined Public "Office Hours"

My question is actually a terraform question.

resource "aws_eip" "centos" {
  instance = aws_instance.centos.id
  vpc      = true
  tags = {
    Name = "centos-<TIMESTAMP>"
  }
}

Primoz Cankar has joined Public "Office Hours"

Santiago Campuzano has joined Public "Office Hours"

https://github.com/gravitational/teleport / https://gravitational.com/teleport

Name = “centos-${timestamp()}”

Neil Gealy has joined Public "Office Hours"

👉️ New Zoom Recording from our Office Hours session on 2020-06-24 is now available.

question for next office hours. upgrading a docker image in an ecs service with zero downtime with pokayoke in mind.

original thread from #aws: https://sweetops.slack.com/archives/CCT1E7JJY/p1593017494348900

Any idea for opensource cloud native p2s vpn (oidc, saml integration would be nice) ?