#office-hours - December 2020

Oh bummer. I couldn’t make for previous office hours and today when I can it’s not on xD
Hi anyways 👋

@here office hours is starting in 30 minutes! Remember to post your questions here.

recently I needed a module that creates RDS instances to be executed only after RDS parameter groups were created. So I used depends_on, but honestly I'm surprised this works:

resource aws_db_parameter_group "rds_pg" {
  for_each = local.rds_param_groups
  ...
}

module rds_instance {
  for_each = local.rds_instances
  source   = "./rds-instance-module"
  ...
  param_group_name = aws_db_parameter_group.rds_pg[each.value.parameterGroupRef].name
  depends_on = [aws_db_parameter_group.rds_pg]
}

Is there a chance that I'm just in the "undefined behavior" zone, is there anything in the docs that says this should work, I would have thought that the depends would need specific resources (ie rds_pg[something]) not a "map" of resources. If the above is correct, it's awesome!

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

Vlad Ionescu has joined Public "Office Hours"

Andy Roth has joined Public "Office Hours"

faithful anere has joined Public "Office Hours"

Jay Zalowitz has joined Public "Office Hours"

Michael Martin has joined Public "Office Hours"

Evan Gertis has joined Public "Office Hours"

Andy Miguel has joined Public "Office Hours"

Eric Berg has joined Public "Office Hours"

Colton Wrisner has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

Sam C has joined Public "Office Hours"

Jeremy (Cloud Posse) has joined Public "Office Hours"

Tim Gourley has joined Public "Office Hours"

Matt Calhoun has joined Public "Office Hours"

Abisoye Olaomi has joined Public "Office Hours"

Natalia Woroniec has joined Public "Office Hours"

Hey what's the password again I cannot find it in the invite

15139103984 has joined Public "Office Hours"

PePe Amengual has joined Public "Office Hours"

Andrew Thompson has joined Public "Office Hours"

Patrick Joyce has joined Public "Office Hours"

Oliver Schoenborn has joined Public "Office Hours"

Ramesh Yelishala has joined Public "Office Hours"

majan paul has joined Public "Office Hours"

Arca Admin has joined Public "Office Hours"

Andrey Nazarov has joined Public "Office Hours"

PePe Amengual has joined Public "Office Hours"

Andrew Thompson has joined Public "Office Hours"

vicken has joined Public "Office Hours"

Todd Thomas has joined Public "Office Hours"

venkatamutyala has joined Public "Office Hours"

Brandon vh has joined Public "Office Hours"

David Caccavella has joined Public "Office Hours"

JJ Ferman has joined Public "Office Hours"

Matt Gowie has joined Public "Office Hours"

1. AWS Lambda Now Billed per Millisecond (ms)
2. AWS Lambda Now Supports Docker
3. AWS Supports EC2 with MacOS (Mac Minis with 32GB ram)
4. AWS EKS Distro - a hardened OS for kubernetes on Amazon and On-prem
5. AWS EKS Managed Node Groups Support Spot Instances (via @Vlad Lonescu)
AWS Proton – Automated Management for Container and Serverless Deployment

Derek Davis has joined Public "Office Hours"

Omer Sen has joined Public "Office Hours"

Jeremy Branham has joined Public "Office Hours"

Chris Dutton has joined Public "Office Hours"

Adeoye Remi has joined Public "Office Hours"

tamsky has joined Public "Office Hours"

Jim Park has joined Public "Office Hours"

So it seems we should give Atlantis another try then)

Matthew Zeemann has joined Public "Office Hours"

Derek Davis has joined Public "Office Hours"

Eric Berg has joined Public "Office Hours"

Stakater/reloader or pusher/wave or weaveworks/watch

First two is cluster level and last one is sidecar (application level)

So secret and configmap changes deployment restarts

Or use terraform for so it can detect changes and restarts deployments dependant on secret/configmap whose entries change

Kubernetes terraform provider

Deji has joined Public "Office Hours"

👉️ New Zoom Recording from our Office Hours session on 2020-12-02 is now available.

@Erik Osterman (Cloud Posse) during a discussion about DevOps mentoring and stuff you articulated one thing about if you think that things are done in a wrong way and you see that it must be much better approaches here and there but nobody cares in the organisation you should think about switching a job (I hope I remembered it correctly). But what if this happens in a relationship with a client. Say, you provide solutions based on requirements and agreements and everything works smoothly until the client gets the ownership and starts doing things by himself - your solutions always get removed, substituted with crazy hacks, the least optimal, complicated monsters, etc. They might still pay for the support and stuff, but you feel that something goes completely wrong, but there is no feedback why it’s done in this way, no explanation at all. It seems they are just used to leveraging hacks and taking obsolete approaches. I’ve heard these kind of stories quite some time, not always for sure, but it happens. Have you ever faced something like this? Any tips?

By the way, this might be a good start for sharing some tips and tricks about how to deal with clients/customers if you are willing to share of course:) This seems to be an interesting topic and not that trivial, requiring skills (soft skills which are sometimes overlooked) and experience.

Don't Panic: Kubernetes and Docker | Kubernetes
https://kubernetes.io/blog/2020/12/02/dont-panic-kubernetes-and-docker/

Just a heads up, Wednesday 11/8 is a special office hours with @Lee Skillen from Cloudsmith. We're talking modern day package management and how to make it easier. Cloud Posse uses Cloudsmith, and so we're excited to have them on the show tomorrow.

@Lee Skillen has joined the channel

@here office hours is starting in 30 minutes! Remember to post your questions here.

If we have time, wondering if anyone has had success (or assessed the tradeoffs) with an implementation for multi-tenancy where the key goal is to keep data for "organizations" within the platform segmented/segregated. Some options I can think of off top:
• Single app with multiple databases - more complex to manage in the app, not fully segmented if someone were to gain access to the app instance as they would potentially have access to all the data. Easier to manage deployments
• Multiple instances of the app with their own databases - could be segmented by network/vpc or accounts. Slightly more complicated to manage deployments but I feel like once everything is in IaC and the pipeline is automated, it should be reasonable.
The app is a rails 4 backend (i dont think multiple databases were native to rails until rails 6) on a single ec2 instance with MySQL Aurora. We plan on re-arch for high availability on something like ECS or EKS.

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

Mike Drummond has joined Public "Office Hours"

Andrew Speed has joined Public "Office Hours"

Adam Watson has joined Public "Office Hours"

Greg Rynkowski has joined Public "Office Hours"

Andrew Speed has joined Public "Office Hours"

mallory mabe has joined Public "Office Hours"

venkatamutyala has joined Public "Office Hours"

James Haughey has joined Public "Office Hours"

Andy Miguel has joined Public "Office Hours"

Biswajit Das has joined Public "Office Hours"

Robert Horrox has joined Public "Office Hours"

Patrick Joyce has joined Public "Office Hours"

Ramesh Yelishala has joined Public "Office Hours"

Matt Ferris has joined Public "Office Hours"

Dan McKinney has joined Public "Office Hours"

David Test has joined Public "Office Hours"

Matt Calhoun has joined Public "Office Hours"

Chris Dutton has joined Public "Office Hours"

Kareem Shahin has joined Public "Office Hours"

Tarlan Isaev has joined Public "Office Hours"

Matthew Zeemann has joined Public "Office Hours"

Eric Berg has joined Public "Office Hours"

Tarlan Isaev has joined Public "Office Hours"

Dale-Kurt Murray has joined Public "Office Hours"

Oskar Maria Grande has joined Public "Office Hours"

Jeremy (Cloud Posse) has joined Public "Office Hours"

John Jarvis has joined Public "Office Hours"

Scott Rogers has joined Public "Office Hours"

Adam Crown has joined Public "Office Hours"

Marc Tamsky has joined Public "Office Hours"

Tarlan Isaev has joined Public "Office Hours"

Oliver Schoenborn has joined Public "Office Hours"

Ramesh Yelishala has joined Public "Office Hours"

Vicken Simonian has joined Public "Office Hours"

James Haughey has joined Public "Office Hours"

Isa Aguilar has joined Public "Office Hours"

Vicken Simonian has joined Public "Office Hours"

Vicken Simonian has joined Public "Office Hours"

Patrick Joyce has joined Public "Office Hours"

Vicken Simonian has joined Public "Office Hours"

rei has joined Public "Office Hours"

Using GitLab to publish packages to Cloudsmith: https://www.youtube.com/watch?v=9WpvfegCgBY
Create a Cloudsmith repository in under 60 seconds: https://www.youtube.com/watch?v=yzBEWrgbvQQ 
Read the docs
https://help.cloudsmith.io/docs/welcome-to-cloudsmith-docs

As a special promotion for those listening, you can register to receive your exclusive Cloudsmith + Cloud Posse socks arriving January 2021: https://form.typeform.com/to/XM6QreBu 
Sign-up for a free trial of Cloudsmith before 20th December to receive an extended trial of one month! 
Sign up here: https://cloudsmith.com/signup/

Shouky Dan has joined Public "Office Hours"

also, we have a #cloudsmith channel if you have any questions for @Lee Skillen & team

PePe Amengual has joined Public "Office Hours"

Abisoye Olaomi has joined Public "Office Hours"

👉️ New Zoom Recording from our Office Hours session on 2020-12-09 is now available.

Remember to prepare your questions for our special office hours session tomorrow with Env0, Scalr, Spacelift, and Terraform Cloud.

@Erik Osterman (Cloud Posse) Hi Can you send the link I usually watch office hours after the fact on youtube but this session is particularly interesting because I am a happy atlantis user but looking to see what these offer ?

@here office hours is starting in 30 minutes! Remember to post your questions here.

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

Emile Fugulin has joined Public "Office Hours"

Zeid Derhally has joined Public "Office Hours"

Hao Wang has joined Public "Office Hours"

Jesse Cafarelli has joined Public "Office Hours"

https://stackshare.io --> nifty site that lays out various organization technical stacks. They offer some kind of service for internal teams in larger orgs to share such stuff as well

Sebastian Stadil has joined Public "Office Hours"

Leia Renée has joined Public "Office Hours"

Zachary Loeber has joined Public "Office Hours"

Shaun Ward has joined Public "Office Hours"

Jake Lundberg has joined Public "Office Hours"

ohad maislish has joined Public "Office Hours"

Adriaan Beiertz has joined Public "Office Hours"

Tim Davis has joined Public "Office Hours"

PePe Amengual has joined Public "Office Hours"

Jay Zalowitz has joined Public "Office Hours"

Jameson Welch has joined Public "Office Hours"

Eric Berg has joined Public "Office Hours"

Luis Navarro has joined Public "Office Hours"

Michael Martin has joined Public "Office Hours"

Roni Frantchi has joined Public "Office Hours"

Andy Roth has joined Public "Office Hours"

Casey Webster has joined Public "Office Hours"

Cameron Zeeb has joined Public "Office Hours"

JB Beck has joined Public "Office Hours"

Troy Taillefer has joined Public "Office Hours"

JB Beck has joined Public "Office Hours"

Ian Groff has joined Public "Office Hours"

David Lundgren has joined Public "Office Hours"

Kuba Martin has joined Public "Office Hours"

Vicken Simonian has joined Public "Office Hours"

Michiel De Wilde has joined Public "Office Hours"

Matt Gowie has joined Public "Office Hours"

Jeremy Branham has joined Public "Office Hours"

Brian Tai has joined Public "Office Hours"

Florain Drescher has joined Public "Office Hours"

Matt Calhoun has joined Public "Office Hours"

Udit Dave has joined Public "Office Hours"

Chris Dutton has joined Public "Office Hours"

Joaquin Menchaca has joined Public "Office Hours"

I love Tacos. Comin’ at ya from SoCal!

Mikael Fridh has joined Public "Office Hours"

Matt Zeemann has joined Public "Office Hours"

Gareth Frost has joined Public "Office Hours"

Sam C has joined Public "Office Hours"

Marcin Wyszynski has joined Public "Office Hours"

Michael Jenkins has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

James Thalacker has joined Public "Office Hours"

Jonathan Le has joined Public "Office Hours"

Igor Bronovskyi has joined Public "Office Hours"

Patrick Joyce has joined Public "Office Hours"

Adam Crown has joined Public "Office Hours"

gkhan khan has joined Public "Office Hours"

John Mitchell has joined Public "Office Hours"

David Hayes has joined Public "Office Hours"

Kareem Shahin has joined Public "Office Hours"

Mazin Ahmed has joined Public "Office Hours"

Jeremy (Cloud Posse) has joined Public "Office Hours"

Hi Eric, Sebastian, Jake, Ohad and Everybody, 😀

I’m working as SRE in an online education platform. I ’m about to migrate current on-prem infrastructure into AWS Cloud. I work with Terraform since 0.12 along with Terragrunt.
I like the way how Terragrunt organizes TF in a more structured way.

I’m about to present a automatic deployment pipeline solution to the company based on TF, TG along with Atlantis pull request automation. I’ve already implemented EKS managed K8s as IAC and deployments will be on that. What do you think? I’m I on the right path? What do you suggest?

After TF 0.13 is published, I started to question if TG is still necessary. Thank you very much. What are other alternatives to use TF as a CI/CD tool.

Leia

Andrew Thompson has joined Public "Office Hours"

Shouky Dan has joined Public "Office Hours"

Isa Aguilar has joined Public "Office Hours"

David Knell has joined Public "Office Hours"

Loren Gordon has joined Public "Office Hours"

Shawn Rushefsky has joined Public "Office Hours"

Fernando Castillo has joined Public "Office Hours"

Phred Lane has joined Public "Office Hours"

David Lozano has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

❓️Does env0 support bitbucket cloud well ?

@Jake Lundberg (HashiCorp) is there any public roadmap for Terraform Cloud?

Jesse Cafarelli has joined Public "Office Hours"

Michiel De Wilde has joined Public "Office Hours"

@Jake Lundberg (HashiCorp) Moved to terraform cloud last year and ran into this issue as a big user of Terraform CLI Workspaces: https://github.com/hashicorp/terraform/issues/22802 As you can read from the issues thread, many decided to go with a workaround which I also ended up doing. It’s been roughly a year since I’ve moved and I’m starting to wonder if I should wait for Hashicorp to provide a fix/update on how to proceed or migrate off TF CLI workspaces. Also, do you have a particular best practice that we should follow if we were to move off Terraform CLI workspaces?

Also, is there any work in TFC on shared env vars across TFC Workspaces?

Todd Thomas has joined Public "Office Hours"

Useful links for Terraform Cloud
• Get Started with Terraform Cloud
• HashiCorp Events - Free Training for All
• Instruqt Platform
• Sentinel Policy Library

Great to hear Spacelift now supports Pulumi, congrats!

Oliver Schoenborn has joined Public "Office Hours"

Question: How difficult is it to create a new resource type for AWS provider? There is a new type needed due to recent AWS "key group" resource in cloudfront, it is not represented in TF so prevents use of the key-based trusted signers. There is a ticket open with lots of votes (over 50), but no indication that work is happening, wondering if it's something I could volunteer to do.

Spacelift — Can you cover your pricing details? I don’t see them on your site.

Terraform config for each workpsace is pretty annoying

thats pretty much the only thing left in terragrunt

Christos Pashcalidis has joined Public "Office Hours"

Terraform Cloud — Tough questions, but they’re out of love ❤️
1. Will we see the SSO Tax come down (i.e. can we get SSO support at the team level instead of biz level)?
2. Will we see TF Agents outside of Biz Level? This is a big limiting factor for automating internal network resources (Data tier layer), which is behind a paywall.

Not TFC, but Scalr has no SSO tax and TF Agents coming soon and affordable (like the rest of Scalr)

What is it looking like for getting these tools to be certified with use by the various GovClouds?

Hey guys, I've tested out the https://registry.terraform.io/modules/cloudposse/rds/aws/latest module; it has issues. I've tested/documented everything - there are some easy fixes in here. The only problem is there are a lot of issues; when would you have time to go over it?

Which of the 4 can

a) be run On-Premise?
b) be run On-Premise in a disconnected environment?

Nadtakan Jones has joined Public "Office Hours"

❓️If i understand scalr works with terraform cli ? If that is the case since terragrunt wraps terraform cli can scalr work with terragrunt ?

@Erik Osterman (Cloud Posse) afterward can you collect and share technical and/or sales POCs for each? I know each of them had it in their presentations but I didn’t get them written down

Ohad's got that true IaC focus! ❤️

Ohad got the CEO lobotomy 😂

LOL

RBAC was pretty tough, lots of ways to do it wrong, only a few to do it right

Same for the inheritance model Ryan is talking about now

For us one of the biggest engineering challenges was building the whole backend (sampling, simulations) for the policy IDE.

Thanks to the presenters and the organizer for this great session. Need to drop have a great day.

Also, getting the self-hosted agent flow and boundary right.

Env0 Resources:
• Website: https://www.env0.com/
• Documentation: https://docs.env0.com/
• Terratag OSS on Github: https://github.com/env0/terratag
• Twitter: https://twitter.com/envZero
• IaC Automation Demo Video (3 min): https://youtu.be/AKBJMO-G4sQ

🚀 Spacelift Resources:
• Website: https://spacelift.io/
• Docs: https://docs.spacelift.io
• Quickstart Repo: https://github.com/spacelift-io/terraform-starter

I agree with Erik, policies are hard

especially for smaller startups

OPA samples to help you get started: https://github.com/Scalr/sample-tf-opa-policies

Thanks everyone !

Great session y’all. Love to see the creativity and love for the infrastructure community.

Thank you very much for having us!

feel free to check out our blog at Rancher labs from today:
https://rancher.com/blog/2020/speed-development-automated-kubernetes-deployments

So much for airgapped networks: https://arxiv.org/abs/2012.06884

that team has been busy the past few years on airgap exfiltration research - here's their paper and demo video roundup: https://cyber.bgu.ac.il/advanced-cyber/airgap , see also https://www.wired.com/story/air-gap-researcher-mordechai-guri/

👉️ New Zoom Recording from our Office Hours session on 2020-12-16 is now available.

Any recommendations on a tool for release notes? Right now our developers/product team update a confluence page whenever they remember. This feels a bit error prone and ends up being an after thought since the code is already deployed. So to make it part of the process I am thinking about... having everyone just add a CHANGELOG.MD to their repo and when a new git tag gets dropped a webhook gets fired and a centralized service just aggregates all the CHANGELOG.MD's. I have a feeling I shouldn't be building anything to do this and that someone else may have solved this problem and/or solved it a different way. Any recommendations/suggestions?

@here office hours is starting in 30 minutes! Remember to post your questions here.

Andy Miguel has joined Public "Office Hours"

Oskar Maria Grande has joined Public "Office Hours"

Raghavendra V has joined Public "Office Hours"

Phil Hershkowitz has joined Public "Office Hours"

Aarat Nathwani has joined Public "Office Hours"

Patrick Joyce has joined Public "Office Hours"

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

venkatamutyala has joined Public "Office Hours"

Tom Dugan has joined Public "Office Hours"

Mikael Fridh has joined Public "Office Hours"

majan paul has joined Public "Office Hours"

PePe Amengual has joined Public "Office Hours"

Andrew Thompson has joined Public "Office Hours"

Brian Tai has joined Public "Office Hours"

Troy Taillefer has joined Public "Office Hours"

Michael Jenkins has joined Public "Office Hours"

Juan Soto has joined Public "Office Hours"

David Lundgren has joined Public "Office Hours"

Kareem Shahin has joined Public "Office Hours"

Michael York has joined Public "Office Hours"

Chris Ferrer has joined Public "Office Hours"

Ola Ade has joined Public "Office Hours"

Adriaan Beiertz has joined Public "Office Hours"

Ola Ade has joined Public "Office Hours"

Mikael Fridh has joined Public "Office Hours"

Omer Sen has joined Public "Office Hours"

Neil Gealy has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

just tried getting docker installed in CloudShell without success. Anyone here do it successfully before?

   30  sudo amazon-linux-extras install docker
   31  sudo service docker start
   32  docker
   33  docker run -it nodejs
   34* service 
   35  systemctl
   36  systemctl status docker
   37  sudo systemctl docker
   38  sudo systemctl status docker
   39  sudo systemctl docker
   40  sudo systemctl status docker
   41  sudo service docker start
   42  docker --version
   43  history

[cloudshell-user@ip-10-1-17-184 ~]$ docker run -it nodejs
docker: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?.
See 'docker run --help'.
[cloudshell-user@ip-10-1-17-184 ~]$ service
bash: service: command not found
[cloudshell-user@ip-10-1-17-184 ~]$ systemctl
Failed to get D-Bus connection: Operation not permitted
[cloudshell-user@ip-10-1-17-184 ~]$ systemctl status docker
Failed to get D-Bus connection: Operation not permitted
[cloudshell-user@ip-10-1-17-184 ~]$ sudo systemctl docker
Unknown operation 'docker'.
[cloudshell-user@ip-10-1-17-184 ~]$ sudo systemctl status docker
Failed to get D-Bus connection: Operation not permitted
[cloudshell-user@ip-10-1-17-184 ~]$ sudo systemctl docker
Unknown operation 'docker'.
[cloudshell-user@ip-10-1-17-184 ~]$ sudo systemctl status docker
Failed to get D-Bus connection: Operation not permitted
[cloudshell-user@ip-10-1-17-184 ~]$ sudo service docker start
sudo: service: command not found
[cloudshell-user@ip-10-1-17-184 ~]$ docker --version
Docker version 19.03.13-ce, build 4484c46

👉️ New Zoom Recording from our Office Hours session on 2020-12-23 is now available.

@here office hours is starting in 30 minutes! Remember to post your questions here.

Any recommendations on a pen test vendor? Or perhaps a better question, what should i be looking for before I pick a vendor?

Erik Osterman (Cloud Posse) has joined Public "Office Hours"

venkatamutyala has joined Public "Office Hours"

charles pogi has joined Public "Office Hours"

Jesse Cafarelli has joined Public "Office Hours"

Jesse Cafarelli has joined Public "Office Hours"

Vicken Simonian has joined Public "Office Hours"

Neil Gealy has joined Public "Office Hours"

Mohammed Yahya has joined Public "Office Hours"

Shouky Dan has joined Public "Office Hours"

Andrew Thompson has joined Public "Office Hours"

Mikael Fridh has joined Public "Office Hours"

Chris Brooks has joined Public "Office Hours"

Hao Wang has joined Public "Office Hours"

Joey Freeland has joined Public "Office Hours"

Andy Miguel has joined Public "Office Hours"

Russell Sherman has joined Public "Office Hours"

Troy Taillefer has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

Vlad Ionescu has joined Public "Office Hours"

Adam Crown has joined Public "Office Hours"

Matt Gowie has joined Public "Office Hours"

Tarlan Isaev has joined Public "Office Hours"

Hari Prasad has joined Public "Office Hours"

Phil Hershkowitz has joined Public "Office Hours"

Abisoye Olaomi has joined Public "Office Hours"

Todd Thomas has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

Martin Mazurik has joined Public "Office Hours"

Andrew Elkins has joined Public "Office Hours"

Rashid Boyko has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

Kareem Shahin has joined Public "Office Hours"

Rashid Boyko has joined Public "Office Hours"

Ray Mazurik has joined Public "Office Hours"

emem umoh has joined Public "Office Hours"

Tochukwu Nwoko has joined Public "Office Hours"

anyone try "werf" yet? https://github.com/werf/werf

A tilt review: https://bitsofinfo.wordpress.com/2020/06/01/local-ci-cd-kubernetes-tilt/

anyone played with codefresh's argocd integration?

re: the serverless vs. kubernetes discussion, i listened to https://softwareengineeringdaily.com/2020/12/29/kubernetes-vs-serverless-with-matt-ward-repeat/ yesterday and it's a bit old, but it's still very relevant and a pretty good discussion

@Erik Osterman (Cloud Posse) It never came up an opportunity to ask. Your dig at either gatekeeper or keycloak or the combination of both -
Could you elaborate why you opt to nix them? (I’m looking at replacing or complementing Cognito with Keycloak at the moment)

👉️ New Zoom Recording from our Office Hours session on 2020-12-30 is now available.