#terraform - September 2018 | Slack Archive

787 messages

Archive: https://archive.sweetops.com/terraform/

Aug 2018

September 2018

Oct 2018

Andrew Jeffreeover 7 years ago

So I've got a weird problem that I've never encountered before
I have a module that creates a vpc
does the usual stuff. public/private subnets, nat gateways etc
I then use the data returned from this module with an ec2 module
which puts x instances in those subnets/availability zones
and evenly spreads them

In this situation I'm creating 4 instances.
the first 2 get created fine
the 3rd it attempts to create in the correct AZ but the wrong subnet
specifically a subnet that terraform hasn't created or management
it's actually one of the subnets in the default vpc
and then the 4th node also fails because it has the correct AZ but is instead using the subnet that the 3rd should which is in a different AZ

Andrew Jeffreeover 7 years ago

I've checked the state and the subnet from the default vpc doesn't show up in there at all

Erik Osterman (Cloud Posse)over 7 years ago

@Andrew Jeffree this is one of the big reasons we have our purpose built modules

Erik Osterman (Cloud Posse)over 7 years ago

are you using our subnet modules and our vpc module?

Erik Osterman (Cloud Posse)over 7 years ago

(basically, it’s easy to mess things up)

Andrew Jeffreeover 7 years ago

No I'm using mine. I wasn't after you to support these, but I was hoping someone may have encountered this weirdness in the past on the Terraform side.

Andrew Jeffreeover 7 years ago

and I've used these modules for quite a while without this problem

Erik Osterman (Cloud Posse)over 7 years ago

are you using any data providers?

Andrew Jeffreeover 7 years ago

nope

Andrew Jeffreeover 7 years ago

just passing the output from one module to another

Erik Osterman (Cloud Posse)over 7 years ago

are you extracting values from maps?

Erik Osterman (Cloud Posse)over 7 years ago

(may lead to different orders)

Erik Osterman (Cloud Posse)over 7 years ago(edited)

maybe the order of the subnets and the order of the azs is different

Andrew Jeffreeover 7 years ago

yeah so I considered the ordering issue

Erik Osterman (Cloud Posse)over 7 years ago

Andrew Jeffreeover 7 years ago

but that doesn't explain where the default vpc subnet is coming into things

Andrew Jeffreeover 7 years ago

that's the part that's doing my head in.

Andrew Jeffreeover 7 years ago

I'm aware you can manage the default vpc somewhat in terraform, but I don't do that. I just leave it be and ignore it.

Erik Osterman (Cloud Posse)over 7 years ago

yea, we never use it

Andrew Jeffreeover 7 years ago

ah I found my bug. It's a conditional that someone else added to the module.

Erik Osterman (Cloud Posse)over 7 years ago

phew! that’s a relief

Andrew Jeffreeover 7 years ago

by default in our module we put instances in private subnets, but someone wanted to put them in public subnets, so they create a variable and they were merging an empty list with the list of private subnet ids

Andrew Jeffreeover 7 years ago

which means the 3rd item in the list when computed was blank which means AWS tries to put it in the default vpc.

Erik Osterman (Cloud Posse)over 7 years ago

good sleuthing! makes sense

Andrew Jeffreeover 7 years ago

goes to have words with the author of that commit...

Andrew Jeffreeover 7 years ago

ah also thank you for acting as a sounding board @Erik Osterman (Cloud Posse) much appreciated.

Erik Osterman (Cloud Posse)over 7 years ago

np, sometimes that’s all it takes

Tobyover 7 years ago

Hi Gang,

I’ve just started using your vpc_peering terraform module and have run into an issue during the plan stage.
I’m getting

* module.vpc_peering.data.aws_route_table.requestor: data.aws_route_table.requestor: value of 'count' cannot be computed

I checked out the FAQ at
https://github.com/cloudposse/docs/blob/master/content/faq/terraform-value-of-count-cannot-be-computed.md
and it doesn’t seem to be the same issue.

I am getting it during the plan stage when the requestor_vpc_id is coming from the output of a vpc module, however that vpc hasn’t yet been created and the id is going to be computed at this stage.

Something you’ve seen before and if so is this a supported scenario?

Tobyover 7 years ago


module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "1.40.0"

  name = "hub-vpc"
  cidr = "${var.bit_mask_16}.0.0/16"
  azs             = ["${var.az_a}"]
  private_subnets = ["${var.bit_mask_16}.1.0/24"]
  public_subnets  = ["${var.bit_mask_16}.101.0/24"]

  enable_nat_gateway = true
  enable_vpn_gateway = false

  tags = {
    Terraform = "true"
    Environment = "hub"
  }
}

module "vpc_peering" {
  source           = "git::<https://github.com/cloudposse/terraform-aws-vpc-peering.git?ref=master>"
  namespace        = "hub"
  stage            = "dev"
  name             = "hub-to-mc"
  requestor_vpc_id = "${module.vpc.vpc_id}"
  acceptor_vpc_id  = "${var.mc_vpc_id}"

  tags = {
    Terraform = "true"
    Environment = "hub"
  }
}

Tobyover 7 years ago

"${var.mc_vpc_id}" is a hard coded id of an existing vpc in the same account.

Andriy Knysh (Cloud Posse)over 7 years ago

@Toby The way terraform-aws-vpc-peering currently works is to lookup both requestor and acceptor VPCs and subnets (was implemented that way to use with kops for Kubernetes, e.g. https://github.com/cloudposse/terraform-aws-kops-vpc-peering).

So when you create a VPC in the same project as terraform-aws-vpc-peering, Terraform does not wait for the VPC to be created and tries to look it up from the data sources -
that’s why it can’t calculate the count of aws_route_table because it depends on the number of subnets, which in turn depens on the VPC.

This currently can be solved (w/o redesigning the module or creating a new one, which could be done) in two diff ways:

1. Place VPC in a separate folder from `terraform-aws-vpc-peering and provision it first

2. Use multi-stage provisioning with -target (that’s how we did it for the module)


terraform plan -target=module.vpc
terraform apply -target=module.vpc

terraform plan
terraform apply

The first plan/apply provisions just the VPC.
The second plan/apply provisions evrything else (since the VPC is already provisioned, TF is able to look it up).

Tobyover 7 years ago

Thanks for your prompt reply @Andriy Knysh (Cloud Posse), I was using the -target as a workaround so I’ll carry on doing that 😄

Andriy Knysh (Cloud Posse)over 7 years ago

yea, it’s the solution for now

Andriy Knysh (Cloud Posse)over 7 years ago

we might add another module to accept the existing VPC IDs (or modify the current one)

Andriy Knysh (Cloud Posse)over 7 years ago

thanks for testing btw 🙂

Matthewover 7 years ago

Has anyone ever scripted out RDS Cross-region replication using Terraform?

Andriy Knysh (Cloud Posse)over 7 years ago

@Matthew that’s what it says about cross-region replication

with Aurora MySQL you can setup a cross-region Aurora Replica from the RDS console. The cross-region replication is based on single threaded MySQL binlog replication and the replication lag will be influenced by the change/apply rate and delays in network communication between the specific regions selected. Aurora PostgreSQL does not currently support cross-region replicas

Andriy Knysh (Cloud Posse)over 7 years ago

we did not test it with TF

Andriy Knysh (Cloud Posse)over 7 years ago

I don’t even see how it could be done here https://www.terraform.io/docs/providers/aws/r/rds_cluster_instance.html

Erik Osterman (Cloud Posse)over 7 years ago

@Andriy Knysh (Cloud Posse) there is a way to do cross region replication

Erik Osterman (Cloud Posse)over 7 years ago(edited)

@Daren does this at gladly with terraform

Andriy Knysh (Cloud Posse)over 7 years ago

nice

Matthewover 7 years ago

Thank you @Andriy Knysh (Cloud Posse) that is what i'm trying to do currently and here it has https://www.terraform.io/docs/providers/aws/r/rds_cluster.html#replication_source_identifier

Matthewover 7 years ago

but when you actually specify the DB Arn and try to run the script terraform spits out " You cannot set up replication between a DB instance and a DB cluster across regions."

Andriy Knysh (Cloud Posse)over 7 years ago

do you use MySQL?

Matthewover 7 years ago

Yes Aurora-MySQL

Rohit Vermaover 7 years ago

@Erik Osterman (Cloud Posse) or @Andriy Knysh (Cloud Posse) do we have any terraform module for setting up required vpc endpoints, this is useful in escaping some data transfer charges, as explained here https://aws.amazon.com/vpc/pricing/

Andriy Knysh (Cloud Posse)over 7 years ago

@Rohit Verma you mean this https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html?

Andriy Knysh (Cloud Posse)over 7 years ago

we don’t have modules for that, but it looks like simple enough https://www.terraform.io/docs/providers/aws/r/vpc_endpoint.html

Andriy Knysh (Cloud Posse)over 7 years ago

(we can create module(s) together 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

@Matthew we talked with @Daren, we’ll show you how to do cross region replication for MySQL (@Daren has a working example)

Matthewover 7 years ago

@Andriy Knysh (Cloud Posse) Appreciate your energy and time looking into that for me

Matthewover 7 years ago

I am open for discussion whenever i'm still currently trying it this moment

Matthewover 7 years ago

Ahh so now when i specify the cluster ARN in replication_source_identifier, it creates the cluster as a replica, but then my instance gets deployed as a WRITER rather than a Reader. Holler when you're free

Andriy Knysh (Cloud Posse)over 7 years ago

@Matthew when @Daren is online, we’ll give you the example

Rohit Vermaover 7 years ago

@Andriy Knysh (Cloud Posse) / @Erik Osterman (Cloud Posse) Thanks for response, I will try to create one module which is in sync with with geodesic. I believe mostly Gateway type endpoints are worth using, If I am right there is no cost for them. Also Bit confused about com.amazonaws.ap-south-1.logs endpoint. Since we are using fluentd-cloudwatch log forwarding, will it provide us some cost benefit ?

Andriy Knysh (Cloud Posse)over 7 years ago

did you test the latest version? @jonas haskins

Andriy Knysh (Cloud Posse)over 7 years ago

this example for example https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/examples/basic/main.tf

Andriy Knysh (Cloud Posse)over 7 years ago

was working ok

jonas haskinsover 7 years ago

@Andriy Knysh (Cloud Posse) i did, however it errored. I build some db's in may and i didn't lock down to a version and the new version breaks with this error " module.rds_cluster_aurora_mysql.output.arn: Resource 'aws_rds_cluster.default' does not have attribute 'arn' for variable 'aws_rds_cluster.default..arn' "

Andriy Knysh (Cloud Posse)over 7 years ago

@Rohit Verma I think it will provide a cost benefit since the traffic never exits the AWS internal networks

Andriy Knysh (Cloud Posse)over 7 years ago

@jonas haskins can you delete and re-create the cluster?

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

and pin down to a release

jonas haskinsover 7 years ago

so then i thought , well i'll go back to what i used before and encountered another issue. where if i build something or run plan against something already built it seems to add / remove availability_zones on it's own. even though i've defined only the two i want

jonas haskinsover 7 years ago

what is the suggested way to pin a release ?

Andriy Knysh (Cloud Posse)over 7 years ago

so yea, a lot was changed in the module since May

jonas haskinsover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

we added the required number of AZs

jonas haskinsover 7 years ago

ah , thats prob why its thrashing around on me : )

Andriy Knysh (Cloud Posse)over 7 years ago

maybe yes

Andriy Knysh (Cloud Posse)over 7 years ago

try to set the number to the same number of AZs you currently have deployed

jonas haskinsover 7 years ago

what about version pinning , is that ^^ ok

jonas haskinsover 7 years ago

thanks btw !

jonas haskinsover 7 years ago

@Andriy Knysh (Cloud Posse)

Andriy Knysh (Cloud Posse)over 7 years ago

ah, sorry, forget about the number of AZs, it’s from a diff module

Andriy Knysh (Cloud Posse)over 7 years ago

version pinning, not OK

Andriy Knysh (Cloud Posse)over 7 years ago

here’s how to do it:

jonas haskinsover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

  source             = "git::<https://github.com/cloudposse/terraform-aws-rds-cluster.git?ref=tags/0.4.3>"

jonas haskinsover 7 years ago

great.

jonas haskinsover 7 years ago

i'll give that a shot. thanks for being avail !

Andriy Knysh (Cloud Posse)over 7 years ago

remove version = "0.3.5"

jonas haskinsover 7 years ago

got it

Andriy Knysh (Cloud Posse)over 7 years ago

add cluster_family = "aurora-mysql5.7"

Andriy Knysh (Cloud Posse)over 7 years ago

https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBClusterParameterGroup.html

jonas haskinsover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/examples/with_cluster_parameters/main.tf

jonas haskinsover 7 years ago

@Andriy Knysh (Cloud Posse) I've updated to exactly whats in 'with_cluster_parameters/main.tf' & outputs.tf , but am getting this error
" module.rds_cluster_aurora_mysql.output.arn: Resource 'aws_rds_cluster.default' does not have attribute 'arn' for variable 'aws_rds_cluster.default..arn' "

jonas haskinsover 7 years ago

any ideas? and apoligies if these are basic questions. i truly appreciate your help !

Andriy Knysh (Cloud Posse)over 7 years ago

sounds like you are still using some old version of the module (which did not have the arn output)

Andriy Knysh (Cloud Posse)over 7 years ago

did you use source = "git::<https://github.com/cloudposse/terraform-aws-rds-cluster.git?ref=tags/0.4.3>"?

Andriy Knysh (Cloud Posse)over 7 years ago

and also terraform init

jonas haskinsover 7 years ago

did both. and i had deleted the db i was working on and removed the old state file from s3.

Andriy Knysh (Cloud Posse)over 7 years ago

did you do terraform destroy first?

jonas haskinsover 7 years ago

if is switch to 0.4.0 and comment out of the outputs.tf ( used from examples w/c/p ) arn,endpoint,reader_endpoint everything seems fine.
and yes i did a terrafrom destroy before starting any of this

Andriy Knysh (Cloud Posse)over 7 years ago

well, you can direct message me your code; I can’t answer the question because we did provision the cluster many times in the last few days using the examples from the repo 🙂

jonas haskinsover 7 years ago

sure thing.

Andriy Knysh (Cloud Posse)over 7 years ago

@Matthew thanks to @Daren, here is a working example for RDS cross-region replication

Andriy Knysh (Cloud Posse)over 7 years ago

resource "aws_db_subnet_group" "replica" {
  name       = "replica"
  subnet_ids = ["xxxxxxx", "xxxxxxx", "xxxxxx"]
}

resource "aws_kms_key" "repica" {
  deletion_window_in_days = 10
  enable_key_rotation     = true
}

resource "aws_db_instance" "replica" {
  identifier                  = "replica"
  replicate_source_db         = "${var.source_db_identifier}"
  instance_class              = "${var.instance_class}"
  db_subnet_group_name        = "${aws_db_subnet_group.replica.name}"
  storage_type                = "io1"
  iops                        = 1000
  monitoring_interval         = "0"
  port                        = 5432
  kms_key_id                  = "${aws_kms_key.repica.arn}"
  storage_encrypted           = true
  publicly_accessible         = false
  auto_minor_version_upgrade  = true
  allow_major_version_upgrade = true
  skip_final_snapshot         = true
}

Erik Osterman (Cloud Posse)over 7 years ago

thanks @Daren

Andriy Knysh (Cloud Posse)over 7 years ago

and how to call it

provider "aws" {
  alias  = "remote"
  region = "us-west-2"
}

module "database_remote_replica" {
  source = "..."

  providers = {
    aws = "aws.remote"
  }

  namespace            = "eg"
  stage                = "prod"
  instance_class       = "..."
  source_db_identifier = "<ARN>"
}

Andriy Knysh (Cloud Posse)over 7 years ago

this is not for Aurora though, just for RDS

Andriy Knysh (Cloud Posse)over 7 years ago

regarding this:

Andriy Knysh (Cloud Posse)over 7 years ago

but when you actually specify the DB Arn and try to run the script terraform spits out ” You cannot set up replication between a DB instance and a DB cluster across regions.”

Andriy Knysh (Cloud Posse)over 7 years ago

I think it says that you need to create a remote cluster (not just an instance)

Andriy Knysh (Cloud Posse)over 7 years ago

so you need to create two clusters in two diff regions

Andriy Knysh (Cloud Posse)over 7 years ago

and use the provider pattern above to provision the remote cluster for replication

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-cloudtrail-cloudwatch-alarms/pull/7

Maarten van der Hoefover 7 years ago

https://github.com/Mastercard/terraform-provider-restapi

antonbabenkoover 7 years ago

or this one - https://github.com/dikhan/terraform-provider-openapi . They are rather similar in terms of making things for general APIs.

Maarten van der Hoefover 7 years ago

The most photogenic developer vs the company with the priceless slogan, tough one 🙂

antonbabenkoover 7 years ago

https://github.com/GoogleCloudPlatform/magic-modules - pretty cool project and reasoning.

antonbabenkoover 7 years ago

https://github.com/GoogleCloudPlatform/magic-modules/blob/master/templates/terraform/resource.erb - so easy to read! 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

yea, that’s how all code should look like 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

and then we introduce patterns on top of it

antonbabenkoover 7 years ago

I think there will be some standard for auto-generated code platforms, so that once AWS adopts it we suddenly will not have 1700+ open issues in AWS provider.

Erik Osterman (Cloud Posse)over 7 years ago

1700!? Wow.

antonbabenkoover 7 years ago

no, 1672 actually

Danover 7 years ago

Is there a way to use packer

Danover 7 years ago

in terraform

Danover 7 years ago

i want to create a windows box with some windows roles installed on it

antonbabenkoover 7 years ago

You can either use https://www.terraform.io/docs/providers/null/resource.html or https://www.terraform.io/docs/providers/external/data_source.html to call your packer script

Danover 7 years ago

thank you! ill take a look

Erik Osterman (Cloud Posse)over 7 years ago

@Jamie Nelson (BitFlight) has a module that runs packer with lambda

antonbabenkoover 7 years ago

What if it takes more than 5 minutes to run? How does module handles that?

Sylvain Rouquetteover 7 years ago

hi there, I'm trying to use cloudposse/terraform-aws-ecr, but I'm getting a ton of error during the plan:

Sylvain Rouquetteover 7 years ago


$ terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.terraform_remote_state.root: Refreshing state...
data.aws_iam_policy_document.login: Refreshing state...
data.aws_iam_policy_document.assume_role: Refreshing state...

------------------------------------------------------------------------

Error: Error running plan: 11 error(s) occurred:

* module.ecr.output.policy_write_name: Resource 'aws_iam_policy.write' not found for variable 'aws_iam_policy.write.name'
* module.ecr.output.role_arn: Resource 'aws_iam_role.default' does not have attribute 'arn' for variable 'aws_iam_role.default.*.arn'
* module.ecr.output.role_name: Resource 'aws_iam_role.default' does not have attribute 'name' for variable 'aws_iam_role.default.*.name'
* module.ecr.aws_iam_instance_profile.default: 1 error(s) occurred:

* module.ecr.aws_iam_instance_profile.default: Resource 'aws_iam_role.default' not found for variable 'aws_iam_role.default.name'
* module.ecr.output.policy_write_arn: Resource 'aws_iam_policy.write' not found for variable 'aws_iam_policy.write.arn'
* module.ecr.aws_iam_role_policy_attachment.default_ecr: 1 error(s) occurred:

* module.ecr.aws_iam_role_policy_attachment.default_ecr: Resource 'aws_iam_role.default' not found for variable 'aws_iam_role.default.name'
* module.ecr.output.policy_login_name: Resource 'aws_iam_policy.login' not found for variable 'aws_iam_policy.login.name'
* module.ecr.output.policy_read_arn: Resource 'aws_iam_policy.read' not found for variable 'aws_iam_policy.read.arn'
* module.ecr.output.policy_read_name: Resource 'aws_iam_policy.read' not found for variable 'aws_iam_policy.read.name'
* module.ecr.output.policy_login_arn: Resource 'aws_iam_policy.login' not found for variable 'aws_iam_policy.login.arn'
* module.ecr.data.aws_iam_policy_document.default_ecr: 1 error(s) occurred:

* module.ecr.data.aws_iam_policy_document.default_ecr: Resource 'aws_iam_role.default' not found for variable 'aws_iam_role.default.arn'

Sylvain Rouquetteover 7 years ago

with this TF script

Sylvain Rouquetteover 7 years ago(edited)


provider "aws" {
    alias = "assume_repo_admin"
    assume_role {
        role_arn     = "arn:aws:iam::${data.terraform_remote_state.root.account_repo_id}:role/OrganizationAccountAccessRole"
        session_name = "setup_account_repo"
    }
}

# create ECR repositories

module "ecr" {
    providers = {
        aws = "aws.assume_repo_admin"
    }
    source      = "git::<https://github.com/cloudposse/terraform-aws-ecr.git?ref=master>"
    name        = "cloud/databank_fe"
    namespace   = "repo"
    stage       = "travis"
}

Sylvain Rouquetteover 7 years ago

the provider is because I'm trying to set up the ECR in a different account, but the problem also occurs in the same account

Sylvain Rouquetteover 7 years ago

I'm using terraform 0.11.8, I noticed that your CI is using TF 0.10.7, could it be the problem?

Sylvain Rouquetteover 7 years ago

it seems like aws_iam_role.default fails to be generated automatically if I don't specify roles

Erik Osterman (Cloud Posse)over 7 years ago

@Sylvain Rouquette can you open a GitHub issue for this?

Erik Osterman (Cloud Posse)over 7 years ago

We are actively using this module with 0.11.

Erik Osterman (Cloud Posse)over 7 years ago

Here is our invocation https://github.com/cloudposse/terraform-root-modules/tree/master/aws/ecr

sarkisover 7 years ago

If you haven't already, be sure to pin down your AWS provider! https://www.terraform.io/docs/providers/aws/guides/version-2-upgrade.html#provider-version-configuration

Sylvain Rouquetteover 7 years ago

@Erik Osterman (Cloud Posse) ok I'll open a bug. Your usage is a bit different though. You use it through terraform-aws-kops-ecr, roles are already created (but even in my case with created roles, it wouldn't work)

Andriy Knysh (Cloud Posse)over 7 years ago

@Sylvain Rouquette thanks, we’ll take a look

antonbabenkoover 7 years ago

https://chrislewisdev.github.io/prettyplan/

Andriy Knysh (Cloud Posse)over 7 years ago

Gabeover 7 years ago

I like landscape because it diffs the json as well

Gabeover 7 years ago

instead of having to decipher how two big json blobs are different

lorenover 7 years ago

yep, exactly

Danover 7 years ago

anyone know how to pass a terraform variable into packer

Danover 7 years ago

such as instance type

erikover 7 years ago

Pretty sweet 😃

camurphyover 7 years ago(edited)

hey there, i'm having an issue with the Cloud Posse Elastic Beanstalk template. i'm working off this example https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/examples/complete/main.tf

the generated plan has an empty Environment tag:


  solution_stack_name:          "" => "64bit Amazon Linux 2018.03 v2.8.1 running PHP 7.2"
  tags.%:                       "" => "4"
  tags.Environment:             "" => ""

this is resulting in an error on apply:


* module.elastic_beanstalk_environment.aws_elastic_beanstalk_environment.default: 1 error(s) occurred:

* aws_elastic_beanstalk_environment.default: InvalidParameter: 1 validation error(s) found.
- minimum field size of 1, CreateEnvironmentInput.Tags[0].Value.

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

hi @camurphy, can you show your code how you invoke the module - the example above was tested 13 days ago and was working as it is

camurphyover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

do you have keypair = "123" provisioned in AWS?

Andriy Knysh (Cloud Posse)over 7 years ago

it will fail if you provide a wrong key name

Andriy Knysh (Cloud Posse)over 7 years ago

if you don’t want it, leave it as empty string

camurphyover 7 years ago

oh correct keypair is provisioned, just changed the value for the purpose of sharing

Erik Osterman (Cloud Posse)over 7 years ago

sounds like you might be passing a tag with an empty value

camurphyover 7 years ago

i hadn't removed anything from your example, perhaps i need to add something?

Erik Osterman (Cloud Posse)over 7 years ago

Can you try setting TF_LOG=DEBUG

Erik Osterman (Cloud Posse)over 7 years ago

then rerun

Erik Osterman (Cloud Posse)over 7 years ago

https://www.terraform.io/docs/internals/debugging.html

Erik Osterman (Cloud Posse)over 7 years ago

maybe some more useful output

camurphyover 7 years ago

i reverted to exactly your example with the exception of changing the region to ap-southeast-2 and adding a profile under the aws provider

camurphyover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

I’ll check

camurphyover 7 years ago

thanks guys 🙂

erikover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

@Andriy Knysh (Cloud Posse) any clue? ☝️

Erik Osterman (Cloud Posse)over 7 years ago

Environment is empty

Erik Osterman (Cloud Posse)over 7 years ago

no clue where that’s getting injected

Erik Osterman (Cloud Posse)over 7 years ago

Out of curiousity, what happens if you pass


tags = {
  "Environment" = "example"
}

Andriy Knysh (Cloud Posse)over 7 years ago

yea, that’s from terraform-null-label 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

latest changes

Erik Osterman (Cloud Posse)over 7 years ago

Ah crap

Andriy Knysh (Cloud Posse)over 7 years ago

we’ll fix that 🙂

Erik Osterman (Cloud Posse)over 7 years ago

no good deed goes unpunished

Andriy Knysh (Cloud Posse)over 7 years ago

(got the same error)

camurphyover 7 years ago

yep, adding that tags block fixes it

Erik Osterman (Cloud Posse)over 7 years ago

thanks for reporting the issue

camurphyover 7 years ago

no worries, thanks for the templates 👍️

Erik Osterman (Cloud Posse)over 7 years ago

we’ll get that fixed. glad there’s an easy workaround for now.

camurphyover 7 years ago

i had one more question about this module @Erik Osterman (Cloud Posse), is there a way to use it without creating a route 53 hosted zone? happy to use the elasticbeanstalk.com domain for staging. the readme says zone_id is not required but when omitted i get module.elastic_beanstalk_environment.module.tld.aws_route53_record.default: zone_id must not be empty

Andriy Knysh (Cloud Posse)over 7 years ago

We’ll fix that too :)

Danover 7 years ago

anyone know of a way to join a windows AWS instance to the domain using terraform?

Gonzalo Peciover 7 years ago

I think that is more on the scope of Ansible or some other provisioner

Danover 7 years ago

i found this... hoping to try to understand it and have it work

Danover 7 years ago

https://aws.amazon.com/blogs/security/how-to-configure-your-ec2-instances-to-automatically-join-a-microsoft-active-directory-domain/

Andriy Knysh (Cloud Posse)over 7 years ago

@Dan that should work

Andriy Knysh (Cloud Posse)over 7 years ago

also, here is a complete solution in TF http://www.sanjeevnandam.com/blog/aws-microsoft-ad-setup-with-terraform

Danover 7 years ago

i think i got it

Danover 7 years ago

testing it rightn ow

Danover 7 years ago

oooooooooooooooo

Danover 7 years ago

let me look

Gonzalo Peciover 7 years ago

👍️

Danover 7 years ago

thank you!

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

@camurphy https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/pull/48 fixes both issues (empty tags and default DNS zone)

camurphyover 7 years ago

thanks @Andriy Knysh (Cloud Posse)!

Eric Garzaover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

@Eric Garza i wanted to ask you to open an issue for that, but I see we already have it 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/issues/23

Andriy Knysh (Cloud Posse)over 7 years ago

we’ll add it

Eric Garzaover 7 years ago

ah, thanks

Andriy Knysh (Cloud Posse)over 7 years ago

or you can open a PR for that

Eric Garzaover 7 years ago

Not sure what that is yet 😉

Eric Garzaover 7 years ago

How long until you guys add that, I could just clone this and add for my local use.

Andriy Knysh (Cloud Posse)over 7 years ago

so if you know how to add it for your local use, then you know how to implement it 🙂

Eric Garzaover 7 years ago

I do!

Andriy Knysh (Cloud Posse)over 7 years ago

i mean after you implement it and test, open a PR against our repo and we’ll review and merge it

Eric Garzaover 7 years ago

Sorry, I have not ever contributed to github projects before.

Andriy Knysh (Cloud Posse)over 7 years ago

ahh ok

Eric Garzaover 7 years ago

got it

Eric Garzaover 7 years ago

seemed the other person in issue added the PR, would that not cover this?

Andriy Knysh (Cloud Posse)over 7 years ago

so you can fork the repo, create a new branch, make the changes (and test), then open a PR against our repo

Eric Garzaover 7 years ago

gotcha

Eric Garzaover 7 years ago

how about the outstanding PR?

Andriy Knysh (Cloud Posse)over 7 years ago

he did not do it 🙂

Eric Garzaover 7 years ago

ahh, well , I will, bear with me

Eric Garzaover 7 years ago

i like your modules btw, good work

Andriy Knysh (Cloud Posse)over 7 years ago

thanks

Andriy Knysh (Cloud Posse)over 7 years ago

let us know if you need help with the PR

Eric Garzaover 7 years ago

I submitted the new input param change in PR, think I did it right, but not under the original. Tested locally, works.

Erik Osterman (Cloud Posse)over 7 years ago

thanks @Eric Garza

lorenover 7 years ago(edited)

anyone happen to know if terraform 0.12 will interpolate variables and variable files? i would find it very handy to be able to use data sources and pass data source values through a variable...

lorenover 7 years ago

looks like sortof but not really for the use case i'd want, https://github.com/gruntwork-io/terragrunt/issues/466#issuecomment-385034334

Andriy Knysh (Cloud Posse)over 7 years ago

not sure about interpolation in vars, but it says you’d be able to pass resources and modules as inputs and outputs https://www.hashicorp.com/blog/terraform-0-12-rich-value-types

lorenover 7 years ago

tks, had forgotten about that one. need to noodle it some to understand whether it really gets me there

camurphyover 7 years ago(edited)

perhaps a bit of a n00b question but how does one ensure that the terraform_state_backend module is able to run before the terraform block where the bucket and dynamo db tables are referenced? https://github.com/cloudposse/terraform-aws-tfstate-backend

most terraform directory structures i see have a variables.tf, main.tf and outputs.tf but perhaps i need a different structure to execute the plan for the creation of the backend ... then a separate plan for the rest of the stack that consumes that backend? thanks in advance

Andriy Knysh (Cloud Posse)over 7 years ago

@camurphy I believe you are asking a slightly different question: how do we provision terraform-aws-tfstate-backend to store state before we have an S3 backend to store state for terraform-aws-tfstate-backend?

Andriy Knysh (Cloud Posse)over 7 years ago

here is how …

camurphyover 7 years ago

i guess i'm asking if terraform-aws-tfstate-backend has to be part of a plan in a separate directory/project to this block:


terraform {
  required_version = ">= 0.11.3"
  
  backend "s3" {
    region         = "us-east-1"
    bucket         = "< the name of the S3 bucket >"
    key            = "terraform.tfstate"
    dynamodb_table = "< the name of the DynamoDB table >"
    encrypt        = true
  }
}

Andriy Knysh (Cloud Posse)over 7 years ago

tis is how we use it https://github.com/cloudposse/terraform-root-modules/tree/master/aws/tfstate-backend

Erik Osterman (Cloud Posse)over 7 years ago

but to answer your question - yes we do it in separate project folder

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-root-modules/tree/master/aws

camurphyover 7 years ago

ah a bootstrap process, makes sense 🙂

camurphyover 7 years ago

thanks guys, sorry should have RFTM

Erik Osterman (Cloud Posse)over 7 years ago

it's coldstart problem....

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

take a look at the docs as well https://docs.cloudposse.com/reference-architectures/cold-start/ https://docs.cloudposse.com/reference-architectures/cold-start/#provision-tfstate-backend-project-for-root

Erik Osterman (Cloud Posse)over 7 years ago

Just released our ec2 auto scale module

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-ec2-autoscale-group

Erik Osterman (Cloud Posse)over 7 years ago

This will be used for our upcoming EKS modules

Erik Osterman (Cloud Posse)over 7 years ago

(Thanks @Andriy Knysh (Cloud Posse) !)

Maarten van der Hoefover 7 years ago

@Andriy Knysh (Cloud Posse) What do you think of using aws_cloudformation_stack for the AutoScalingGroup creation to have AutoScalingRollingUpdate ?

Andriy Knysh (Cloud Posse)over 7 years ago

@Maarten van der Hoef yea TF does not support it because AWS API does not support it. Using CloudFormation for that sounds like a good idea

Andriy Knysh (Cloud Posse)over 7 years ago

https://medium.com/@endofcake/using-terraform-for-zero-downtime-updates-of-an-auto-scaling-group-in-aws-60faca582664

Andriy Knysh (Cloud Posse)over 7 years ago

we used aws_cloudformation_stack in a few modules

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-efs-backup/blob/master/cloudformation.tf

lorenover 7 years ago(edited)

i've had a lot of trouble with the cfn AutoScalingRollingUpdate feature, and failure modes that cause rollbacks resulting in unexpected states... these days i tend to prefer AutoScalingReplacingUpdate, which is more of a blue/green option. just seems that any failure/rollback is much more reliable this way.

Maarten van der Hoefover 7 years ago

@loren Ah good to know! Have you used cloudformation with create conditions? And if so, do you know how I can conditionally output, something from it. How to use Splat syntax with it is unclear to me so far.

lorenover 7 years ago

yeah, conditional outputs are pretty straightforward in cfn...


"Outputs": {
  "OutputName": {
    "Condition": //ConditionName,
    // Normal Output Arguments
  }
}

Maarten van der Hoefover 7 years ago

no i mean, something else

lorenover 7 years ago

oh 😄

Maarten van der Hoefover 7 years ago(edited)

Given you have


  resource "aws_cloudformation_stack" "autoscaling_group" {
   count = ".... create t/f
.......
    "Outputs": {
      "AsgName": {
        "Description": "The name of the auto scaling group",
         "Value": {"Ref": "${local.name}"}
      }
    }
  }
  EOF
  }

Maarten van der Hoefover 7 years ago

and you conditionally create this stack, how to conditionally reference the output of it

lorenover 7 years ago

oh oh oh, conditional outputs on the tf side lolol

lorenover 7 years ago

one sec

lorenover 7 years ago

ok, so i don't have an example where we're conditionally creating the stack, which is the complicating factor

Andriy Knysh (Cloud Posse)over 7 years ago

let’s try this 🙂

Maarten van der Hoefover 7 years ago

hehe 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

if you have this output and no count in the resource:

Andriy Knysh (Cloud Posse)over 7 years ago


output "datapipeline_ids" {
  value       = "${aws_cloudformation_stack.datapipeline.outputs["DataPipelineId"]}"
  description = "Datapipeline ids"
}

Andriy Knysh (Cloud Posse)over 7 years ago

then with count might look like this:

Andriy Knysh (Cloud Posse)over 7 years ago

output “datapipeline_ids2” {
value = “${lookup(element(concat(aws_cloudformation_stack.datapipeline.*.outputs, list(map(“DataPipelineId”, “”))), 0), “DataPipelineId”, “”)}”
description = “Datapipeline ids”
}

lorenover 7 years ago(edited)

getting a value where the output is conditional is easy, otherwise... value = "${lookup(aws_cloudformation_stack.<resource_name>.outputs, "OutputName", "")}"

Andriy Knysh (Cloud Posse)over 7 years ago

(not tested 🙂 )

Maarten van der Hoefover 7 years ago

wow, joining with a map with the key but empty value 🙂

Maarten van der Hoefover 7 years ago

hm, doesn't work

Maarten van der Hoefover 7 years ago

lookup gets a string it says.. unsure why

Andriy Knysh (Cloud Posse)over 7 years ago

ok ok I said not tested 🙂

Maarten van der Hoefover 7 years ago

i want my money back 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

let me check

Maarten van der Hoefover 7 years ago

Hi @loren I have a question about AutoScalingReplacingUpdate vs AutoScalingRollingUpdate, at what times did a rollback take place ? And would AutoScalingReplacingUpdate be something that would work for infrastructure that runs many containers ? AutoScalingRollingUpdate would allow a one by one draining and moving of the containers to the new infrastructure.

lorenover 7 years ago

Honestly, I just got fed up with failures when using AutoScalingRollingUpdate resulting in an failed rollback, or some other condition where the resulting instances were not actually exactly the way they were before the update

lorenover 7 years ago

Switched to AutoScalingReplacingUpdate and everything started working exactly the way I wanted

lorenover 7 years ago

rolling updates are subject to the min/max values of your ASG. if you're already at the max, then an instance will be terminated before launching a new one based on the new LaunchConfig. if the new instance fails, the rollback action is triggered. That's where it gets tricky, because the instance was terminated, so now new instances must be launched. Depending on what all's changed in the template and its dependencies, that new launch of the old launch config may also fail

lorenover 7 years ago

With AutoScalingReplacingUpdate, a whole new ASG is created, with its own min/max values. No instances are terminated. If any resource signal fails, the new ASG is simply deleted

lorenover 7 years ago

Only if all resource signals are received/successful is the original ASG deleted, at which point it is subject to draining policies and whatnot

Andriy Knysh (Cloud Posse)over 7 years ago

@loren nice points

Andriy Knysh (Cloud Posse)over 7 years ago

@Maarten van der Hoef this worked (for me 🙂 )

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

locals {
  list = "${coalescelist(aws_cloudformation_stack.datapipeline.*.outputs, list(map("DataPipelineId", "")))}"
  map  = "${local.list[0]}"
  item = "${lookup(local.map, "DataPipelineId", "")}"
}

output "datapipeline_ids" {
  value       = "${local.item}"
  description = "Datapipeline ids"
}

lorenover 7 years ago

you might be better off with containers and rolling updates, since they ought to be more immutable and less subject to the issues i kept running into

Ryan Smithover 7 years ago

Have you guys worked with clients that actually want API Gateway + Lambda (aka. serverless.com)?

Andriy Knysh (Cloud Posse)over 7 years ago

@Ryan Smith we use Lambda for some small tasks (e.g. IAM backup, S3 events, etc.), but I think not for deploying a microservice

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

I guess the issue with that is that you have to start developing with lambda in completely different mindset, but they usually use the standard stuff like Python, Ruby, Java, etc., which is better suited for EC2/ECS/Kubernetes deployments

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

not easy to break it into pieces for Lambda, and Lambda also has a lot of limitations (starting with a simple one: how to you connect and test all of that locally)

Ryan Smithover 7 years ago

@Andriy Knysh (Cloud Posse) From what I've seen with my friends at Lantern (@Justin King) I think they just have dev accounts for integration tests. Then they rely on unit tests before things get deployed.

Honestly, it's because I devoted a lot of time to this project and just kind of curious what adoption could look like: https://github.com/rms1000watt/serverless-tf And if I should rewrite it when 0.12 is released

Justin Kingover 7 years ago

@Justin King has joined the channel

Andriy Knysh (Cloud Posse)over 7 years ago

@Ryan Smith https://github.com/rms1000watt/serverless-tf looks very interesting, thanks for sharing

Andriy Knysh (Cloud Posse)over 7 years ago

and yea, please rewrite in 0.12 so we all see a real example (somebody needs to be first 🙂 )

Ryan Smithover 7 years ago

Haha, yeah, the rewrite would be so it could mirror serverless.com serverless.yml as much as possible

Andriy Knysh (Cloud Posse)over 7 years ago

interesting idea with generating TF files

Ryan Smithover 7 years ago

Had to do it that way since TF was so strict.. I have to allot all potential lambda slots

Ryan Smithover 7 years ago

like, currently, it has a limit of 10 lambda functions

Ryan Smithover 7 years ago

but it can be regenerated to support X

lorenover 7 years ago

is there yet a library that reliably writes hcl? or would you just write json (and rely on 0.12's improved json roundtrip support)?

Ryan Smithover 7 years ago

hmm, not sure off the top of my head. With 0.12 I don't really want to rely on any libraries or json stuff. I'd prefer to just maintain it as HCL but with nested objects in arrays in objects in arrays, lolol--however serverless.yml does it already

Ryan Smithover 7 years ago

then maaaaaaybe write a tool to convert serverless.yml to this module definition. But that would be an entirely different repo/thing.. just separation of concerns

Ryan Smithover 7 years ago

shrugs

lorenover 7 years ago

i think converting serverless.yml could be pretty tough, they are very linked to cloudformation

Andriy Knysh (Cloud Posse)over 7 years ago

as @Ryan Smith mentioned, write everything in Go, problem solved 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

https://sweetops.slack.com/archives/CB3579ZM3/p1536909968000100

Ryan Smithover 7 years ago

@loren just depends how close the HCL spec matches the serverless.yml


functions:
  index:
    handler: handler.hello
    events:
      - http: GET hello

Ryan Smithover 7 years ago

No clue yet until I start jumping in.. or if anyone even wants it.. haha

lorenover 7 years ago

yeah, the most basic serverless.yml stuff would be easy, but it gets more complicated pretty quick. such as native CFN in the resources section

lorenover 7 years ago

and references specific to cfn resource names in the serverless generated template

lorenover 7 years ago

plus the whole plugin system

Ryan Smithover 7 years ago

hehe yeah, serverless has done a good job with all it's features and functionality

Ryan Smithover 7 years ago

I mean, some stuff would just be "do it proper in terraform, then reference the role arn in the module input"

lorenover 7 years ago

not knocking the work so far, i'm pretty excited by a terraform-native project for making serverless-like stuff easier

Ryan Smithover 7 years ago

No worries! 🙂 Yeah, it's been fun so far

Erik Osterman (Cloud Posse)over 7 years ago

yea, excited to see someone making serverless easier in terraform

Erik Osterman (Cloud Posse)over 7 years ago(edited)

we haven't done too much serverless at cloudposse. we have a few little helpers here and there.

lorenover 7 years ago

does the file argument also support directories? or is it assumed that a function is a single file module? or is file just pointing to the file with the handler, and the whole directory with that file is packaged?

stobiewankenobiover 7 years ago

file supports modules, and should zip up the entire directory.

lorenover 7 years ago

gotcha tks

stobiewankenobiover 7 years ago

I didn't write this, but I think I know how Ryan did it

stobiewankenobiover 7 years ago

@Ryan Smith correct me if wrong

stobiewankenobiover 7 years ago

data "archive_file" "lambda_py_0" {
  type        = "zip"
  source_file = "${local.lambda_py_0_source_file}"
  output_path = "${local.lambda_py_0_zip}"

  depends_on = ["null_resource.py_0_build"]
  count      = "${local.lambda_py_0_count}"
}

stobiewankenobiover 7 years ago

Since this is the source file, if you give it a dir, it'll zip up the entire dir, and pass the zip file back to the lambda func to create it from the zip.

Erik Osterman (Cloud Posse)over 7 years ago

yea, that's how we do it here https://github.com/cloudposse/terraform-aws-ses-lambda-forwarder/

stobiewankenobiover 7 years ago

Yeah that's how I do it as well 🙂

Erik Osterman (Cloud Posse)over 7 years ago

😃

stobiewankenobiover 7 years ago

If Ryan didn't do it that way FOR SHAMMEEE and should fix.

lorenover 7 years ago

yeah, was poking around to trace it out, but i do see archive_file takes both source_file and source_dir... https://www.terraform.io/docs/providers/archive/d/archive_file.html#argument-reference

lorenover 7 years ago

source_file works on directories though?

stobiewankenobiover 7 years ago

Ah yea, but if you do the archive file bit

stobiewankenobiover 7 years ago

You want the archive bit to ensure it catches hashed changes.

stobiewankenobiover 7 years ago

so it takes a dir, zips it up, and get's a hash of it it persists to state, for later comparison

stobiewankenobiover 7 years ago

This picks up code changes and updates lambda

Erik Osterman (Cloud Posse)over 7 years ago

So as it relates to our modules, I don't like that the zip creation is done by the user. More advanced lambdas will require deps. For example, the SES module uses npm. Having npm installed shouldn't be a requirement. Thus, here's how I'm proposing we change it for our ses module: https://github.com/cloudposse/terraform-aws-ses-lambda-forwarder/issues/2

lorenover 7 years ago

heh, and i'm ok with requiring that our users have npm... i like the vendor_cmd approach that Ryan took... the user specifies the command, they kinda ought to know that they'll actually need that command

lorenover 7 years ago

i'd wrap the execution in a script or make target anyway, and test/install whatever command was actually needed

Maarten van der Hoefover 7 years ago

Random thought, would it be possible to use codebuild inside the module, and use it's artifact in the same cycle ?

Erik Osterman (Cloud Posse)over 7 years ago(edited)

@loren the problem is also ensuring that different users have the same versions of dependencies. also, for example, sometimes building deps locally (e.g. on a mac) will lead to binary artifacts which are CPU architecture specific. safer to build in a uniform environment.

Ryan Smithover 7 years ago

lololololol sorry, was on a call

Ryan Smithover 7 years ago(edited)

@loren it handles relative paths: https://github.com/rms1000watt/serverless-tf/blob/master/local.tf#L40

Ryan Smithover 7 years ago

some examples use relatives paths

Ryan Smithover 7 years ago(edited)

https://github.com/rms1000watt/serverless-tf/blob/master/examples/http-authorizer-go/main.tf

Andriy Knysh (Cloud Posse)over 7 years ago

@Maarten van der Hoef you question was about if we can build an artifact with CodeBuild and then use it in other TF resources?

Andriy Knysh (Cloud Posse)over 7 years ago

it says you can store the build artifact in an S3 bucket https://www.terraform.io/docs/providers/aws/r/codebuild_project.html#location

Andriy Knysh (Cloud Posse)over 7 years ago

and then use this to read it https://www.terraform.io/docs/providers/aws/d/s3_bucket_object.html

Maarten van der Hoefover 7 years ago

@Andriy Knysh (Cloud Posse) yeah but related to lambda deployments. So instead of npm locally, using codebuild to create the actual artifact, which after is used again by the module to deploy to aws lambda.

Maarten van der Hoefover 7 years ago

was more a hypothetical question..

Ryan Smithover 7 years ago

https://github.com/rms1000watt/notejam/blob/master/buildspec.yml
https://github.com/rms1000watt/notejam/blob/master/testspec.yml

You can define whatever steps you need in the *.yml that's used in the CodeBuild + CodePipeline

Ryan Smithover 7 years ago

i have a codepipeline thats
Source > Codebuild (build) > Deploy (ecs) > Codebuild (Integration test)

Ryan Smithover 7 years ago

so it could be like
Source > Codebuild (compile?) > Codebuild (deploy to lambda?) > Codebuild (integration test)

Ryan Smithover 7 years ago(edited)

https://github.com/rms1000watt/terraform-aws-codepipeline-ecs
inspired by
https://github.com/cloudposse/terraform-aws-ecs-codepipeline

Andriy Knysh (Cloud Posse)over 7 years ago

yea you can run any commands in buildpec.yml

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/jenkins/blob/master/buildspec.yml

Ryan Rykeover 7 years ago(edited)

hello everyone 👋

Andriy Knysh (Cloud Posse)over 7 years ago

hey @Ryan Ryke

Ryan Rykeover 7 years ago

actually if you guys have a second... ive been playing with the ecs-web-app module... looks like its needs listener arns, i used the aws-alb module to build the alb, then took the outputs listener_arns from there and fed them into the web-app module. but its erroring while trying to create the target group, says that its missing an elb

Ryan Rykeover 7 years ago

* aws_ecs_service.default: InvalidParameterException: The target group with targetGroupArn arn:aws:elasticloadbalancing:us-west-2:629113624323:targetgroup/bv-staging-hw/c0cd39cd95d47b66 does not have an associated load balancer.
	status code: 400, request id: bb3f68be-b905-11e8-a342-17f3363522bb "bv-staging-hw"

Ryan Rykeover 7 years ago

is the web-app known to be working?

Erik Osterman (Cloud Posse)over 7 years ago

@Andriy Knysh (Cloud Posse) can probably find a reference architecture

Andriy Knysh (Cloud Posse)over 7 years ago

i can 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

1 sec

Ryan Rykeover 7 years ago

it looks like the alb module creates a target group with default at the end of it

Andriy Knysh (Cloud Posse)over 7 years ago

this is how we used it

Andriy Knysh (Cloud Posse)over 7 years ago

module "alb" {
source             = "git::<https://github.com/cloudposse/terraform-aws-alb.git?ref=tags/0.2.5>"
name               = "cluster"
namespace          = "${var.namespace}"
stage              = "${var.stage}"
attributes         = "${var.attributes}"
vpc_id             = "${module.vpc.vpc_id}"
ip_address_type    = "ipv4"
subnet_ids         = ["${module.subnets.public_subnet_ids}"]
security_group_ids = ["${module.vpc.vpc_default_security_group_id}"]
access_logs_region = "${var.region}"

https_enabled = "true"
http_ingress_cidr_blocks = "${var.ingress_cidr_blocks_http}"
https_ingress_cidr_blocks = "${var.ingress_cidr_blocks_https}"
certificate_arn    = "${var.default_cert_arn}"
}


module "ecs_cluster_label" {
source    = "git::<https://github.com/cloudposse/terraform-terraform-label.git?ref=tags/0.1.6>"
name      = "cluster"
namespace = "${var.namespace}"
stage     = "${var.stage}"
}

# ECS Cluster (needed even if using FARGATE launch type)
resource "aws_ecs_cluster" "default" {
name = "${module.ecs_cluster_label.id}"
}

# default backend app
module "default_backend_web_app" {
source    = "git::<https://github.com/cloudposse/terraform-aws-ecs-web-app.git?ref=tags/0.8.0>"
name      = "backend"
namespace = "${var.namespace}"
stage     = "${var.stage}"
vpc_id    = "${module.vpc.vpc_id}"

container_image  = "${var.default_container_image}"
container_cpu    = "256"
container_memory = "512"
container_port   = "80"

#launch_type                 = "FARGATE"
listener_arns                = "${module.alb.listener_arns}"
listener_arns_count          = "1"
aws_logs_region              = "${var.region}"
ecs_cluster_arn              = "${aws_ecs_cluster.default.arn}"
ecs_cluster_name             = "${aws_ecs_cluster.default.name}"
ecs_security_group_ids       = ["${module.vpc.vpc_default_security_group_id}"]
ecs_private_subnet_ids       = ["${module.subnets.private_subnet_ids}"]
alb_ingress_healthcheck_path = "/healthz"
alb_ingress_paths            = ["/*"]

codepipeline_enabled = "false"
ecs_alarms_enabled   = "true"
autoscaling_enabled  = "false"

alb_name                                        = "${module.alb.alb_name}"
alb_arn_suffix                                  = "${module.alb.alb_arn_suffix}"
alb_target_group_alarms_enabled                 = "true"
alb_target_group_alarms_3xx_threshold           = "25"
alb_target_group_alarms_4xx_threshold           = "25"
alb_target_group_alarms_5xx_threshold           = "25"
alb_target_group_alarms_response_time_threshold = "0.5"
alb_target_group_alarms_period                  = "300"
alb_target_group_alarms_evaluation_periods      = "1"
}

Andriy Knysh (Cloud Posse)over 7 years ago

# web app
module "web_app" {
source    = "git::<https://github.com/cloudposse/terraform-aws-ecs-web-app.git?ref=tags/0.8.0>"
name      = "app"
namespace = "${var.namespace}"
stage     = "${var.stage}"
vpc_id    = "${module.vpc.vpc_id}"

container_image  = "${var.default_container_image}"
container_cpu    = "4096"
container_memory = "8192"

#container_memory_reservation = ""
container_port = "80"
desired_count  = "${var.desired}"

autoscaling_enabled               = "true"
autoscaling_dimension             = "cpu"
autoscaling_min_capacity          = "${var.min}"
autoscaling_max_capacity          = "${var.max}"
autoscaling_scale_up_adjustment   = "1"
autoscaling_scale_up_cooldown     = "60"
autoscaling_scale_down_adjustment = "-1"
autoscaling_scale_down_cooldown   = "300"

#launch_type           = "FARGATE"
listener_arns          = "${module.alb.listener_arns}"
listener_arns_count    = "1"
aws_logs_region        = "${var.region}"
ecs_cluster_arn        = "${aws_ecs_cluster.default.arn}"
ecs_cluster_name       = "${aws_ecs_cluster.default.name}"
ecs_security_group_ids = ["${module.vpc.vpc_default_security_group_id}"]
ecs_private_subnet_ids = ["${module.subnets.private_subnet_ids}"]

alb_ingress_healthcheck_path  = "/"
alb_ingress_paths             = ["/*"]
alb_ingress_listener_priority = "100"

codepipeline_enabled = "true"
github_oauth_token   = "${var.GITHUB_OAUTH_TOKEN}"
repo_owner           = "XXXXX"
repo_name            = "XXXXX"
branch               = "${var.WEB_APP_BRANCH}"
ecs_alarms_enabled   = "true"

alb_target_group_alarms_enabled                 = "true"
alb_target_group_alarms_3xx_threshold           = "25"
alb_target_group_alarms_4xx_threshold           = "25"
alb_target_group_alarms_5xx_threshold           = "25"
alb_target_group_alarms_response_time_threshold = "0.5"
alb_target_group_alarms_period                  = "300"
alb_target_group_alarms_evaluation_periods      = "1"
alb_name                                        = "${module.alb.alb_name}"
alb_arn_suffix                                  = "${module.alb.alb_arn_suffix}"
}

Andriy Knysh (Cloud Posse)over 7 years ago

i need to go now, will be back in a few hours and will be able to answer qs if you have any

Ryan Rykeover 7 years ago

hmm im setup almost the exact same, will make it exact

Ryan Rykeover 7 years ago

worked, must be something in there that is required for the apply to work. ill have to dig in a little bit more, ty for the full sample

Erik Osterman (Cloud Posse)over 7 years ago

Thanks @Andriy Knysh (Cloud Posse)

Ryan Rykeover 7 years ago

yes thanks so much @Andriy Knysh (Cloud Posse)

Andriy Knysh (Cloud Posse)over 7 years ago

no problem, glad it worked for you

Andriy Knysh (Cloud Posse)over 7 years ago

we need to add the example to https://github.com/cloudposse/terraform-root-modules

Ryan Rykeover 7 years ago(edited)

hi guys, it looks like the host_port variable is unused in main.tf. https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/variables.tf#L76 am i missing something?

Maarten van der Hoefover 7 years ago(edited)

@Ryan Ryke I'm working on another ECS module. the empty string host_port will be rendered as null. When using ECS together with an ALB the host port will be dynamically allocated. It's explained here :

https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_PortMapping.html

If using containers in a task with the bridge network mode, you can specify a non-reserved host port for your container port mapping, or you can omit the hostPort (or set it to 0) while specifying a containerPort and your container automatically receives a port in the ephemeral port range for your container instance operating system and Docker version.

Ryan Smithover 7 years ago

@Ryan Ryke ^^^ meant for you 😉

Maarten van der Hoefover 7 years ago

Fixed 🙂

Erik Osterman (Cloud Posse)over 7 years ago(edited)

@Maarten van der Hoef @Jamie Nelson (BitFlight) @antonbabenko I might be coming around to using Atlantis as I’ve resolved in my mind how we would do it within the “geodesic” model of operations. The current blocker for us is running it in different accounts. I’d prefer to run one instance per account to limit blast radius.

Erik Osterman (Cloud Posse)over 7 years ago

I put my 2c here: https://github.com/runatlantis/atlantis/issues/249#issuecomment-422240279

Pierreover 7 years ago(edited)

Hi guys. First, thanks for your awesome modules ! I am using this one https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment .
I have a question. This module creates a load balancer which has a default security group. Am I correct ? This ELB security group allow ingress 443/tcp or 80/tcp from 0.0.0.0 . I would like change 0.0.0.0 to a custom cidr. Is it possible ?

Erik Osterman (Cloud Posse)over 7 years ago

@Pierre good question

Erik Osterman (Cloud Posse)over 7 years ago

looks like we don’t support it at this time

Erik Osterman (Cloud Posse)over 7 years ago

The fix would be to add a section like this:

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/main.tf

erikover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

and pass the SecurityGroups parameter

Erik Osterman (Cloud Posse)over 7 years ago

If you want to open a PR, we’ll promptly review it

Pierreover 7 years ago

thanks @Erik Osterman (Cloud Posse). I will look at it

Gabeover 7 years ago

do you guys know of or have any tools to test terraform modules? I was thinking something along the lines of it imports the module, you specify the input variables you want to test, and you make sure the plan is as you expect

Gabeover 7 years ago

i saw this https://github.com/gruntwork-io/terratest but it actually creates resources and you have to then write api calls to validate and destroy resources which takes time

Andriy Knysh (Cloud Posse)over 7 years ago

@Gabe we’ve been thinking about testing and CI/CD for terraform modules and even have some POCs, but all of that is in initial stage. @Erik Osterman (Cloud Posse) can give you more info on that

Erik Osterman (Cloud Posse)over 7 years ago

yea, we're taking a different, perhaps "easier" approach. while terratest is awesome for writing tests at that level of complexity, we're currently content with testing that modules create/destroy and are idempotent.

Erik Osterman (Cloud Posse)over 7 years ago

Here is some very early work: https://github.com/cloudposse/test-harness/tree/master/tests/terraform

Andriy Knysh (Cloud Posse)over 7 years ago

and here is a small example on using that https://github.com/cloudposse/terraform-null-label/blob/add-tests/codefresh.yml

Andriy Knysh (Cloud Posse)over 7 years ago

using https://github.com/bats-core/bats-core

Gabeover 7 years ago

oh cool i’ll check it out

Gabeover 7 years ago

i guess as pretty simple example of something i would like to be able to test is if the module has a flag to turn on/off certain resources ensuring it works as expected

Erik Osterman (Cloud Posse)over 7 years ago

one consideration for that is to create multiple terraform.tfvars files with all the different permutations

Erik Osterman (Cloud Posse)over 7 years ago

so in addition to testing successful create/destroy/idempotency for each permutation, you would also test that a specific state is achieved

Erik Osterman (Cloud Posse)over 7 years ago

i know some are using test kitchen for terraform. we're holding off on introducing the ruby dependency as long as possible

Erik Osterman (Cloud Posse)over 7 years ago

it's amazing what can be accomplished just using jq

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/test-harness/blob/master/tests/terraform/00.input-descriptions.bats#L5

Erik Osterman (Cloud Posse)over 7 years ago

so since the entire terraform state is json, jq will address a lot

Gabeover 7 years ago

i found this https://github.com/palantir/tfjson so you can output the plan in json… so theoretically you wouldn’t even have to create the resources

Erik Osterman (Cloud Posse)over 7 years ago

is that necessary?

Erik Osterman (Cloud Posse)over 7 years ago

maybe it's a more concise representation

Erik Osterman (Cloud Posse)over 7 years ago

there is an -out parameter which will emit the plan in json

Erik Osterman (Cloud Posse)over 7 years ago

oh, i guess the .tfplan is not json

Erik Osterman (Cloud Posse)over 7 years ago

i thought it was

Gabeover 7 years ago

https://github.com/hashicorp/terraform/issues/11883

Gabeover 7 years ago

doesn’t look like it’s coming out in terraform 0.12 either

Erik Osterman (Cloud Posse)over 7 years ago

bummed there's no binary release

Erik Osterman (Cloud Posse)over 7 years ago

i'd add it to our packages distro

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/packages

Ivan Pinattiover 7 years ago

Hi everyone!

I have a Jenkins deployment that I did a few months ago using https://github.com/cloudposse/terraform-aws-jenkins , and since last week my automated backup (AWS DataPipeline) started breaking and it is not completing anymore.

It is not throwing any errors, it looks like the backup job simply hangs. Anyone could shed some light on it ?

Andriy Knysh (Cloud Posse)over 7 years ago

hi @Ivan Pinatti

Andriy Knysh (Cloud Posse)over 7 years ago

looks like https://github.com/cloudposse/terraform-aws-jenkins is a popular repo 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

anyway, since EFS backup is done by a CloudFormation template https://github.com/cloudposse/terraform-aws-efs-backup/blob/master/templates/datapipeline.yml

Andriy Knysh (Cloud Posse)over 7 years ago

please make sure the CF stack is green

Andriy Knysh (Cloud Posse)over 7 years ago

also, not sure what’s the limits are on S3 bucket versioning. It might has been reached, please check (https://github.com/cloudposse/terraform-aws-efs-backup/blob/master/s3.tf)

Ivan Pinattiover 7 years ago

On my AWS console it shows like this;

Ivan Pinattiover 7 years ago

Ryan Rykeover 7 years ago

re:testing, we've been using kitchen terraform for a customer recently and it seems to fit the bill on a lot of different items

Ryan Rykeover 7 years ago

i can chat in greater detail should someone want to hear about it

Ryan Rykeover 7 years ago

also still working on the ecs-web-app module... i've gotten to the point now where the codepipeline is erroring on s3 permissions :

Insufficient permissions
Unable to access the artifact with Amazon S3 object key 'bv-staging-hw-xxxxx/task/kN9HAdK' located in the Amazon S3 artifact bucket 'bv-staging-hw-xxxxx'. The provided role does not have sufficient permissions.

Erik Osterman (Cloud Posse)over 7 years ago

really odd

Erik Osterman (Cloud Posse)over 7 years ago(edited)

no tweaks to the modules?

Ryan Rykeover 7 years ago

nope

Ryan Rykeover 7 years ago

i had the issue with the module this morning, so this evening i ripped them all into separate modules, still the same issue

Erik Osterman (Cloud Posse)over 7 years ago

@Ryan Ryke are you up and running?

Ryan Rykeover 7 years ago

checking now

Ryan Rykeover 7 years ago

looks good

Ryan Rykeover 7 years ago

👍️

Danover 7 years ago

ssm_document isn't applying even though the instance has the correct role? Any ideas why?

Andriy Knysh (Cloud Posse)over 7 years ago

@Dan did you implement everything from http://www.sanjeevnandam.com/blog/aws-microsoft-ad-setup-with-terraform ?

Danover 7 years ago

yea i followedd that

Danover 7 years ago

right now

Danover 7 years ago

i notcied that when i go to run command

Danover 7 years ago

that I dont see the instances I want in there

Danover 7 years ago

i think it has somthing to do with the ami

Danover 7 years ago

but not sure

endofcakeover 7 years ago

If you can't see the instances, this may mean that either the ssm agent is not running or is having trouble connecting to the mothership. Easiest to take a look at its logs to see what's what.

Danover 7 years ago

Thank you Sir

Danover 7 years ago

I have built AMIs with packer

Danover 7 years ago

So I'm wondering if I'm missing something

endofcakeover 7 years ago

When I had problems with instances not showing up in SSM panel, normally I'd go into an instance and check the agent. So, at the very least, it needs to be
1) installed
2) running
3) able to connect to AWS API

Danover 7 years ago

it cant hit hte aws api

Danover 7 years ago

got it working by setting up NAT GW

Andriy Knysh (Cloud Posse)over 7 years ago

ohh, so you deployed it into private subnets w/o a NAT gateway and the instances could not connect to AWS

Danover 7 years ago

yes sir

Danover 7 years ago

for some reason i figured that it would be able to anyways and that it was all internal

Danover 7 years ago

cause it seems like for most services its able to reach it without hitting tghe internet

Danover 7 years ago

but not this =[

Andriy Knysh (Cloud Posse)over 7 years ago

hmm, what “most services”?

Andriy Knysh (Cloud Posse)over 7 years ago

if it’s in a private subnet w/o a NAT gateway, the traffic can’t leave the VPC at all (except for VPC Private Links)

Andriy Knysh (Cloud Posse)over 7 years ago

glad you solved the issue @Dan

Danover 7 years ago

sorry

Danover 7 years ago

anyone set the computername of a windows instance based on instance tags

Andriy Knysh (Cloud Posse)over 7 years ago

@Dan take a look at this https://forums.aws.amazon.com/thread.jspa?threadID=181520

Andriy Knysh (Cloud Posse)over 7 years ago

https://bam.miranda.org/renaming-an-ec2-windows-instance-and-customizing-its-wallpaper-with-tags-using-powershell/

Danover 7 years ago

thank oyu!

Andriy Knysh (Cloud Posse)over 7 years ago

https://www.reddit.com/r/aws/comments/8rdkxl/changing_ec2_hostname_on_creation/

Danover 7 years ago

do you need to create template files

Danover 7 years ago

or can oyu just add user data to the resource you want to use it for

Danover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

you can use both HEEDOCS and template files, but we prefer to use https://www.terraform.io/docs/providers/template/d/file.html

Danover 7 years ago

in that example am I creating a .tpl file that contains what I have above and then referencing that under the resource im crreating or can I just leave it there as a a data type

Andriy Knysh (Cloud Posse)over 7 years ago

let me show an example

Danover 7 years ago

yay i love examples

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-eks-cluster/blob/init/kubeconfig.tpl

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-eks-cluster/blob/init/main.tf#L102

Danover 7 years ago

cool! so for vars.. the only var I would have is the ${var.tag_box}

Andriy Knysh (Cloud Posse)over 7 years ago

Use as many as you need :)

Andriy Knysh (Cloud Posse)over 7 years ago

Update them in the template and in the terraform module

Danover 7 years ago

is there a way to check if it ran into an error?

Danover 7 years ago

i have it looking at the tpl file

Danover 7 years ago

but doesnt do a rename or anything

Danover 7 years ago

hmm

Andriy Knysh (Cloud Posse)over 7 years ago

i suggest you test the renaming PowerShell script locally before deploying to make sure it does actually work

johncblandiiover 7 years ago(edited)

I’m running the vpc peering module and hitting this error continuously:


data.aws_vpc_endpoint_service.dynamodb: Refreshing state...
data.aws_vpc.acceptor: Refreshing state...
data.aws_vpc_endpoint_service.s3: Refreshing state...
data.aws_subnet_ids.acceptor: Refreshing state...
data.aws_route_table.acceptor[2]: Refreshing state...
data.aws_route_table.acceptor[4]: Refreshing state...
data.aws_route_table.acceptor[8]: Refreshing state...
data.aws_route_table.acceptor[5]: Refreshing state...
data.aws_route_table.acceptor[6]: Refreshing state...
data.aws_route_table.acceptor[0]: Refreshing state...
data.aws_route_table.acceptor[7]: Refreshing state...
data.aws_route_table.acceptor[3]: Refreshing state...
data.aws_route_table.acceptor[1]: Refreshing state...

Error: Error refreshing state: 1 error(s) occurred:

* module.vpc_peering.module.vpc_peering.data.aws_route_table.requestor: data.aws_route_table.requestor: value of 'count' cannot be computed

Andriy Knysh (Cloud Posse)over 7 years ago

Ahh the count issue again :)

johncblandiiover 7 years ago

hehe

Andriy Knysh (Cloud Posse)over 7 years ago

We’ll take a look

Erik Osterman (Cloud Posse)over 7 years ago

https://docs.cloudposse.com/faq/terraform-value-of-count-cannot-be-computed/ 😃

johncblandiiover 7 years ago

my guess is the subnet count differs or the referenced vpc is different

johncblandiiover 7 years ago

ahh…checking 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

Apply in stages using -target

Andriy Knysh (Cloud Posse)over 7 years ago

First provision VPC and subnets

johncblandiiover 7 years ago

yeah, i saw that on https://github.com/hashicorp/terraform/issues/14432#issuecomment-301128718

Andriy Knysh (Cloud Posse)over 7 years ago

We saw that issue before

johncblandiiover 7 years ago

it wasn’t being too kind

Andriy Knysh (Cloud Posse)over 7 years ago

In that module

johncblandiiover 7 years ago

i can try again

Andriy Knysh (Cloud Posse)over 7 years ago

Do you know how to use -target?

johncblandiiover 7 years ago

could’ve been PEBKAC 🙂

johncblandiiover 7 years ago

yes

johncblandiiover 7 years ago

so how far down the “tree” do I have to plan individually?

johncblandiiover 7 years ago

to the resource level?

Andriy Knysh (Cloud Posse)over 7 years ago

the module does lookup of the requestor VPC https://github.com/cloudposse/terraform-aws-vpc-peering/blob/master/main.tf#L31

Andriy Knysh (Cloud Posse)over 7 years ago

so the VPC needs to be provisioned first using terraform apply -target=

Andriy Knysh (Cloud Posse)over 7 years ago

after it’s provisioned, run apply on terraform-aws-vpc-peering

Andriy Knysh (Cloud Posse)over 7 years ago

if you have the VPC code in a separate folder, no need to use -target, just apply it

Andriy Knysh (Cloud Posse)over 7 years ago

terraform-aws-vpc-peering is created in such a way so it does the data source lookup

Andriy Knysh (Cloud Posse)over 7 years ago

mostly for kops deployments

johncblandiiover 7 years ago

ok…let me give that a whirl

Andriy Knysh (Cloud Posse)over 7 years ago

could be done differently

johncblandiiover 7 years ago

i did the plan and not the apply itself

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-kops-vpc-peering/blob/master/main.tf

johncblandiiover 7 years ago

started a custom one for our internal module repo but figure no need to recreate it

johncblandiiover 7 years ago

saw that one too

Andriy Knysh (Cloud Posse)over 7 years ago

you need to apply it 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

for the VPC to be created first

johncblandiiover 7 years ago

got it. that’s what i missed

johncblandiiover 7 years ago

so guess i partially knew how to use -target 😄

Andriy Knysh (Cloud Posse)over 7 years ago

yea, need to use it if the VPC code and peering code are in the same folder

johncblandiiover 7 years ago

they’re not. two modules used in one file

johncblandiiover 7 years ago


module "vpc" {
  source = "../../modules/application-vpc"

  application_name = "vpc-peering-test"
  cidr             = "172.100.0.0/16"
  namespace        = "tf"
  private_subnets  = ["172.100.1.0/24", "172.100.2.0/24", "172.100.3.0/24"]
  public_subnets   = ["172.100.5.0/24", "172.100.6.0/24", "172.100.7.0/24"]
  stage            = "DEV"
}

module "vpc_peering" {
  source = "../../modules/application-vpc-peering"

  application_name = "vpc-peering-test"
  namespace        = "tf"
  stage            = "DEV"

  acceptor_vpc_id  = "vpc-xxx"
  requestor_vpc_id = "${module.vpc.vpc_id}"
}

Andriy Knysh (Cloud Posse)over 7 years ago

one file is the same as in one folder 🙂

johncblandiiover 7 years ago

i meant the core code was in separate folders, but i gotcha

Andriy Knysh (Cloud Posse)over 7 years ago

terraform apply -target=module.vpc.aws_vpc.application-vpc

johncblandiiover 7 years ago

thx a ton for the help

johncblandiiover 7 years ago

and for the modules. 🙂 they’re quite useful. 😉

Ryan Rykeover 7 years ago

hey dudes exposed some variables in the terraform-aws-web-app

Ryan Rykeover 7 years ago

https://github.com/cloudposse/terraform-aws-ecs-web-app/pull/17

Ryan Rykeover 7 years ago

not sure its up to cp standards, but it works 🙂

Erik Osterman (Cloud Posse)over 7 years ago

Thanks @Ryan Ryke !

Erik Osterman (Cloud Posse)over 7 years ago

LGTM

Ryan Rykeover 7 years ago

cool 🙂

Ryan Rykeover 7 years ago

glad i could contribute back at least a little bit

Erik Osterman (Cloud Posse)over 7 years ago

GitHub doesn’t let me tag releases on iOS

Erik Osterman (Cloud Posse)over 7 years ago

Even if I request desktop site so we can merge as soon as I get to a desk or @Andriy Knysh (Cloud Posse) online

Danover 7 years ago

@Andriy Knysh (Cloud Posse) my issue was that the tag I had set.. had a forward slash in it. And you cant name servers with a / in it lol

Ryan Rykeover 7 years ago(edited)

another quick, potentially stupid question. the multi-az-subnets. i'm trying to build a 3 tier vpc. public - app - db. the non-public subnets are all building as expected with one exception. only one of the private subnets is mapping to a nat gateway. the other two subnets dont have a nat in their routes in both tiers...

Andriy Knysh (Cloud Posse)over 7 years ago

@Ryan Ryke can you show the code?

Andriy Knysh (Cloud Posse)over 7 years ago

we usually use this module to create public and private subnets https://github.com/cloudposse/terraform-aws-dynamic-subnets (more usage, fewer bugs 🙂 )

Andriy Knysh (Cloud Posse)over 7 years ago

i also commented on your PR, thanks, LGTM just a few nitpicks

Erik Osterman (Cloud Posse)over 7 years ago

We’ve released our EKS terraform modules for Kubernetes this week.
- https://github.com/cloudposse/terraform-aws-eks-cluster
- https://github.com/cloudposse/terraform-aws-eks-workers

Welcome feedback

Erik Osterman (Cloud Posse)over 7 years ago

I created #chatops for those interested

Ryan Rykeover 7 years ago

updated that pr @Andriy Knysh (Cloud Posse)

Andriy Knysh (Cloud Posse)over 7 years ago

thanks @Ryan Ryke, merged the PR

Ryan Rykeover 7 years ago

cool thanks dude

Ryan Rykeover 7 years ago

you have a chance to take a peek at those subnets ?

Ryan Rykeover 7 years ago

or do you have samples for the dynamic subnets that i could peek at

Andriy Knysh (Cloud Posse)over 7 years ago

for dynamic subnets I posted a few examples https://sweetops.slack.com/archives/CB6GHNLG0/p1537558581000100?thread_ts=1537542352.000100&cid=CB6GHNLG0

Andriy Knysh (Cloud Posse)over 7 years ago

did not look at your code yet

Ryan Rykeover 7 years ago

right i saw those samples was tough to tell exactly what that is creating

Andriy Knysh (Cloud Posse)over 7 years ago

oh, it creates one public subnet and one private subnet in each AZ you provide

Andriy Knysh (Cloud Posse)over 7 years ago

and you can control NAT gateway creation for private subnet (enable or disable them)

Ryan Rykeover 7 years ago(edited)

right so im guessing that is your guys standard vpc config

Andriy Knysh (Cloud Posse)over 7 years ago

we have three diff subnets modules

Andriy Knysh (Cloud Posse)over 7 years ago

but yes we mostly use dynamic-subnets for its simplicity

Andriy Knysh (Cloud Posse)over 7 years ago

@Ryan Ryke I lost track in what channel did you post your code 😞 can you repost it?

Andriy Knysh (Cloud Posse)over 7 years ago

thanks @Ryan Ryke, your PR with the fix was merged

Ryan Rykeover 7 years ago

cool thanks

Ryan Rykeover 7 years ago

oy, so looking at the ecs-web-app some more, with the new buildspec.yml that @Erik Osterman (Cloud Posse) graciously showed me. im having a slight issue. essentially the command

printf '[{"name":"%s","imageUri":"%s"}]' "$CONTAINER_NAME" "$REPO_URI:latest" | tee imagedefinitions.json

essentially overwrites the environment variables that are set by the container_definition module. So at this point, we have to set the app environment variables in the codebuild job so that we can use them.

Ryan Rykeover 7 years ago

im wondering if there is a way to not use the imagedef file from codebuild and just stick with the env variables from the container_definition module

Ryan Rykeover 7 years ago

right so i think i figured this issue out ☝️ essentially if the task def built by tf isnt the current running one when codepipeline runs, it removes the env vars

Ryan Rykeover 7 years ago

on another note, i created another pr. i need the security group id out of the ecs module https://github.com/cloudposse/terraform-aws-ecs-alb-service-task/pulls

Ryan Rykeover 7 years ago

there will be another one for the web-app once the service-task is released

Erik Osterman (Cloud Posse)over 7 years ago

Thanks for the PR! Commented

Ryan Rykeover 7 years ago

updated @Erik Osterman (Cloud Posse)

Ryan Rykeover 7 years ago

morning

Ryan Rykeover 7 years ago

so poking around a little bit more, im using the alb module to pass the listener arns into the web-app module. but i believe the alb module creates that default target group with hard coded port 80 and attaches it to the port 80 listener. which precludes me from attaching to that listener in the web app module

Ryan Rykeover 7 years ago

ie the aws-alb module creates this


  + module.hw_alb.aws_lb_listener.http
      id:                                        <computed>
      arn:                                       <computed>
      default_action.#:                          "1"
      default_action.0.target_group_arn:         "${aws_lb_target_group.default.arn}"
      default_action.0.type:                     "forward"
      load_balancer_arn:                         "arn:aws:elasticloadbalancing:us-west-2:6xxxxxxx:loadbalancer/app/bv-staging-hw-alb/00bf512a3bba527e"
      port:                                      "80"
      protocol:                                  "HTTP"
      ssl_policy:                                <computed>

  + module.hw_alb.aws_lb_target_group.default
      id:                                        <computed>
      arn:                                       <computed>
      arn_suffix:                                <computed>
      deregistration_delay:                      "15"
      health_check.#:                            "1"
      health_check.0.healthy_threshold:          "2"
      health_check.0.interval:                   "15"
      health_check.0.matcher:                    "200-399"
      health_check.0.path:                       "/"
      health_check.0.port:                       "traffic-port"
      health_check.0.protocol:                   "HTTP"
      health_check.0.timeout:                    "10"
      health_check.0.unhealthy_threshold:        "2"
      name:                                      "bv-staging-hw-alb-default"
      port:                                      "80"
      protocol:                                  "HTTP"
      proxy_protocol_v2:                         "false"
      slow_start:                                "0"
      stickiness.#:                              <computed>
      target_type:                               "ip"
      vpc_id:                                    "vpc-xxxxxxxx"

Ryan Rykeover 7 years ago

am i missing something here?

Erik Osterman (Cloud Posse)over 7 years ago

I am afk. Not quite sure I follow. We have a default target group act like a 404 handler. It matches only when nothing else matches with a higher priority.

Erik Osterman (Cloud Posse)over 7 years ago

This is similar to the kubernetes ingress module where there is a default backend

Erik Osterman (Cloud Posse)over 7 years ago

I can dig up somewhere an example, but won’t be able to get to it for a few hours

Erik Osterman (Cloud Posse)over 7 years ago

Can you rephrase what you are trying to accomplish even higher level?

Danover 7 years ago

Whats wrong with this?

Danover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

what's the error?

Erik Osterman (Cloud Posse)over 7 years ago

😃

Danover 7 years ago

Basically cant find it

Danover 7 years ago

='[

lorenover 7 years ago

your filter name is off, probably

Danover 7 years ago

yea im trying to figure out what the value for name should be

Andriy Knysh (Cloud Posse)over 7 years ago

is it your AMI?

Andriy Knysh (Cloud Posse)over 7 years ago

executable_users - (Optional) Limit search to users with explicit launch permission on the image. Valid items are the numeric account ID or self.

Danover 7 years ago

its a public windows AMI

lorenover 7 years ago

what i usually do for amazon amis is grab the ami id from the launch wizard, then look it up in the amis console, then work out the pattern from there

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

so it should not be self

Danover 7 years ago

should be amazon

lorenover 7 years ago

the current ami id from the launch wizard in us-east-1 is ami-01945499792201081

lorenover 7 years ago

here's a console link to that ami, https://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Images:visibility=public-images;search=ami-01945499792201081;sort=desc:creationDate

Danover 7 years ago

AMI Name
Windows_Server-2016-English-Full-Base-2018.09.15

lorenover 7 years ago

yep, so use Windows_Server-2016-English-Full-Base-* as the filter value pattern...

Danover 7 years ago

when I changed self to Amazon I got

Danover 7 years ago

* data.aws_ami.ami: 1 error(s) occurred:

* data.aws_ami.ami: data.aws_ami.ami: InvalidUserID.Malformed: Invalid user id: "amazon"
status code: 400, request id: 4decb292-f8a6-4c54-bcc3-f70942a20516

Andriy Knysh (Cloud Posse)over 7 years ago

amazon is not a valid value

Andriy Knysh (Cloud Posse)over 7 years ago

https://www.terraform.io/docs/providers/aws/d/ami.html#executable_users

Andriy Knysh (Cloud Posse)over 7 years ago

just remove that field

Danover 7 years ago

deletining it saved the day

Andriy Knysh (Cloud Posse)over 7 years ago

https://www.terraform.io/docs/providers/aws/d/ami.html#owners

Danover 7 years ago

lol

Andriy Knysh (Cloud Posse)over 7 years ago

you meant owners

Erik Osterman (Cloud Posse)over 7 years ago

fwiw, here's how @Andriy Knysh (Cloud Posse) does it in our EKS workers module https://github.com/cloudposse/terraform-aws-eks-workers/blob/master/main.tf#L150-L160

Andriy Knysh (Cloud Posse)over 7 years ago

(just wanted to post the same)

Danover 7 years ago

thisi s what i have

Danover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

so in general, if the filter name is specific (as in your case), you might skip adding owners b/c it will find the AMI in any case

Andriy Knysh (Cloud Posse)over 7 years ago

if you think it could collide with another AMI with similar name pattern, set owners to amazon

lorenover 7 years ago

do others consider it a "best practice" to specify owners regardless? i'm always concerned with getting hijacked

lorenover 7 years ago

thought i saw somewhere that packer and terraform were moving to make it a required field

Andriy Knysh (Cloud Posse)over 7 years ago

i think if you know you want an AMI from Amazon, why not specify it?

johncblandiiover 7 years ago

Anyone using TF Enterprise w/ Sentinel have any thoughts?

Erik Osterman (Cloud Posse)over 7 years ago

(hrm... it hasn't come up before in this channel - but would be curious if anyone is using it)

johncblandiiover 7 years ago

for anyone interested https://www.hashicorp.com/sentinel

Erik Osterman (Cloud Posse)over 7 years ago

are you using TF enterprise for CD?

Ryan Rykeover 7 years ago

@Erik Osterman (Cloud Posse) ☝️

johncblandiiover 7 years ago

evaluating it @Erik Osterman (Cloud Posse)

Ryan Rykeover 7 years ago

has anyone seen the web app module re creating the container definition every apply ?

Erik Osterman (Cloud Posse)over 7 years ago

hrm

Erik Osterman (Cloud Posse)over 7 years ago

sounds vaguely familiar

Erik Osterman (Cloud Posse)over 7 years ago

checking

Erik Osterman (Cloud Posse)over 7 years ago(edited)

so here’s the problem from recollection (a bit fuzzy)

Erik Osterman (Cloud Posse)over 7 years ago

- because codepipeline is constantly pushing a new image defintion for every release, the container definition diverges quickly

Erik Osterman (Cloud Posse)over 7 years ago

- we could use a data source to query the current definition, but then we introduce a cold start problem since the datasources always fail on a new task

Erik Osterman (Cloud Posse)over 7 years ago

so i think we decide the best fix was to ignore_changes on the container definition, but doesn’t look like we carried that out.

Erik Osterman (Cloud Posse)over 7 years ago

@sarkis sound familiar?

Maarten van der Hoefover 7 years ago(edited)

I've always used ignore_changes, but I have a new branch which needs testing which works by looking up the datasource after bootstrapping when the container_image == ""

https://github.com/blinkist/terraform-aws-airship-ecs-service/tree/cicd_agnostic_ecs_service

The "ecs_task_definition_selector" compares the created task definition, with the current live one, if no changes are found, the live task will be set for the ecs_service hence no update to ecs_service will be made.

Ryan Rykeover 7 years ago

awesome thanks guys, so heres the weird thing, the module has ignore in it but the high level one does not

Ryan Rykeover 7 years ago

further, it was working before. and something i changed is now causing it to not work and change on every run

Erik Osterman (Cloud Posse)over 7 years ago

Container definition change?

Erik Osterman (Cloud Posse)over 7 years ago

I mean the port mapping change

Ryan Rykeover 7 years ago

yeah i think it might be the port mapping

Ryan Rykeover 7 years ago

thats really the only thing ive changed from the original web-app module with the exception of adding port to ecs task

lorenover 7 years ago

anyone have tips for dealing with data that is a list of lists in terraform? i need to create multiple iam users, and attach one or more iam policies to each user...

lorenover 7 years ago

aws_iam_user_policy_attachment only works for a single policy arn, so i need to count over both the number of users, and for each user count over the number of policies to attach to that user

Maarten van der Hoefover 7 years ago

@loren I moved away from creating users from a list. There was a terraform issue regarding that, especially when removing a user at the beginning of the list Terraform couldn't deal with that. Let me look that up, not sure if that is still actual.

I'm actually creating groups with policies and attaching users to those that.

lorenover 7 years ago

yeah, i'm familiar with what happens with the resources when you modify the list...

Erik Osterman (Cloud Posse)over 7 years ago

Agree with @Maarten van der Hoef

lorenover 7 years ago

more interested in how to deal with the data structure

Erik Osterman (Cloud Posse)over 7 years ago

What about a module that represents one user

lorenover 7 years ago

i would still end up with a list of groups, and a list of policies to attach to each group

Erik Osterman (Cloud Posse)over 7 years ago

Then code generation that generates one tf file per user that invokes the module

Maarten van der Hoefover 7 years ago


module "user_matheus" {
  source    = "../../modules/terraform-aws-user"
  username  = "matheus"
  namespace = "${var.namespace}"
  belongs_to_groups = ["${local.default_staging_qa_user_groups}"]
}

Erik Osterman (Cloud Posse)over 7 years ago

Yea like that

lorenover 7 years ago

per user resources then. blech.

lorenover 7 years ago

alright

Maarten van der Hoefover 7 years ago

still much better than not knowing what happens when you modify that list 🙂

lorenover 7 years ago

i'm ok with the consequence for this use case is all

lorenover 7 years ago

just can't figure out how to deal with the data structure

Maarten van der Hoefover 7 years ago

i'll pm you

lorenover 7 years ago

"simpler" is probably the wrong word, considering terraform's limited support for this kind of logic. maybe, fewer steps?

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/sethvargo/terraform-provider-filesystem/blob/master/README.md

Erik Osterman (Cloud Posse)over 7 years ago

Use terraform to generate the terraform code :P

Erik Osterman (Cloud Posse)over 7 years ago

Then use terraform to apply it

lorenover 7 years ago

i take it back, please make it stop

Erik Osterman (Cloud Posse)over 7 years ago

🤦‍♂️

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

@loren what about something like this (just an idea)

Andriy Knysh (Cloud Posse)over 7 years ago

locals {
  users           = []
  users_lenght    = "${lenght(local.users)}"
  policies        = []
  policies_lenght = "${lenght(local.policies)}"
}

# element(list, index) - Returns a single element from a list at the given index
# If the index is greater than the number of elements, this function will wrap using a standard mod algorithm
resource "aws_iam_user_policy_attachment" "test-attach" {
  count      = "${local.users_lenght * local.policies_lenght}"
  user       = "${element(local.users, count.index)}"
  policy_arn = "${element(local.policies, count.index)}"
}

Maarten van der Hoefover 7 years ago

What is really miss in IAM btw is an attachable assume_role_policy.

lorenover 7 years ago

ok, thanks to @Maarten van der Hoef, this module gets me to a working config...


variable "users" {
  type = "list"
  description = "List of maps of IAM user names and a comma-separated-string of their IAM group memberships by group name"
}

variable "groups" {
  type = "map"
  description = "Map of IAM group names to a policy arn"
}

resource "aws_iam_user" "this" {
  count = "${length(var.users)}"

  name = "${lookup(var.users[count.index], "name")}"
}

resource "aws_iam_group" "this" {
  count = "${length(var.groups)}"

  name = "${element(keys(var.groups), count.index)}"
}

resource "aws_iam_group_policy_attachment" "this" {
  count = "${length(aws_iam_group.this.*.name)}"

  group      = "${aws_iam_group.this.*.name[count.index]}"
  policy_arn = "${lookup(var.groups, aws_iam_group.this.*.name[count.index])}"
}

resource "aws_iam_user_group_membership" "this" {
  count = "${length(var.users)}"

  user   = "${lookup(var.users[count.index], "name")}"
  groups = "${split(",", lookup(var.users[count.index], "groups"))}"

  depends_on = [
    "aws_iam_group_policy_attachment.this",
    "aws_iam_user.this"
  ]
}

lorenover 7 years ago

this take a list of users and each user's groups, and a map of group names to policy arns. creates a group per policy, attaches the policy to the group, and makes each user a member of their groups

lorenover 7 years ago

pretty much the trick ends up being that aws_iam_user_group_membership takes a list of groups, so no need to iterate over a nested list

lorenover 7 years ago

takes inputs of the form:


  users = [
    {
      name = "..."
      groups = "abc,def",
    },
    {
      name = "..."
      groups = "123,456",
    },
  ]

  groups = {
    "abc" = "arn:..."
    "def" = "arn:..."
    "123" = "arn:..."
    "456" = "arn:..."
  }

jonboulleover 7 years ago

@jonboulle has joined the channel

Maarten van der Hoefover 7 years ago(edited)

Anyone seeing this a lot lately ?


Error: Error loading state: RequestError: send request failed
caused by: Get <https://xx-tf-state.s3.eu-central-1.amazonaws.com/?prefix=env%3A%2F>: EOF

mrwackyover 7 years ago

Not a lot, but we did get that the other day, yes

Erik Osterman (Cloud Posse)over 7 years ago

@Ryan Ryke if you get a chance, can you open an issue for that problem? https://github.com/cloudposse/terraform-aws-ecs-container-definition/issues

Erik Osterman (Cloud Posse)over 7 years ago

so I can try to reproduce and fix it

Ryan Rykeover 7 years ago

hey yeah, been heads down today

Ryan Rykeover 7 years ago

still ahving the issue

Ryan Rykeover 7 years ago

havent looked at it

Ryan Rykeover 7 years ago

@Erik Osterman (Cloud Posse) https://github.com/cloudposse/terraform-aws-ecs-alb-service-task/issues/13

Ryan Rykeover 7 years ago

anyone able to recreate this?

Ryan Rykeover 7 years ago

anyone around ?

Andriy Knysh (Cloud Posse)over 7 years ago

@Ryan Ryke are you saying that container_definition_json = "${module.container_definition.json}" gets changed on each terraform plan and TF wants to update it?

Ryan Rykeover 7 years ago

to add some context im using the web-app module

Ryan Rykeover 7 years ago

i forked it

Ryan Rykeover 7 years ago

and updated the container def source to the newer module with port mappings

Ryan Rykeover 7 years ago

this is updating everytime

-/+ module.hw_pipeline.module.ecs_alb_service_task.aws_ecs_task_definition.default (new resource required)
      id:                                        "bv-staging-hw" => <computed> (forces new resource)

Ryan Rykeover 7 years ago

so its the ecs_service_task that is updating everytime

Ryan Rykeover 7 years ago

when i roll back the container def module back to the older one

Ryan Rykeover 7 years ago(edited)

it doesnt want to update every time

Erik Osterman (Cloud Posse)over 7 years ago

@Andriy Knysh (Cloud Posse) i think it could be related to https://sweetops.slack.com/archives/CB6GHNLG0/p1537932417000200?thread_ts=1537889592.000100&cid=CB6GHNLG0

Erik Osterman (Cloud Posse)over 7 years ago

the regex changed

Erik Osterman (Cloud Posse)over 7 years ago

i haven’t had a chance to take a look

Erik Osterman (Cloud Posse)over 7 years ago

@fernando is in the slack, but didn’t get a response

Andriy Knysh (Cloud Posse)over 7 years ago

ok so you are saying that before the update everything was ok?

Andriy Knysh (Cloud Posse)over 7 years ago

(I did not test it so can’t give an answer right now before I test)

Andriy Knysh (Cloud Posse)over 7 years ago

@Ryan Ryke ^

Ryan Rykeover 7 years ago

right

Ryan Rykeover 7 years ago

and while i have you guys

Ryan Rykeover 7 years ago

if you have the time i have one other question on the intended usage of the alb_ingress module

Erik Osterman (Cloud Posse)over 7 years ago

Ryan Rykeover 7 years ago

so in my app im working on listening on both 80 and 443

Ryan Rykeover 7 years ago

i used the alb module to set up both listener_arns

Ryan Rykeover 7 years ago

feed them into the web_app module

Ryan Rykeover 7 years ago

Error: module.hw_pipeline.module.alb_ingress.aws_lb_listener_rule.paths: 1 error(s) occurred:

* module.hw_pipeline.module.alb_ingress.aws_lb_listener_rule.paths[1]: index 1 out of range for list var.listener_arns (max 1) in:

${var.listener_arns[count.index]}

Ryan Rykeover 7 years ago

should only be for one listener at a time and should i just call the alb_ingress module again outside the web_app_module

Ryan Rykeover 7 years ago(edited)

i guess im confused with this logic here

  count        = "${length(var.hosts) > 0 && length(var.paths) == 0 ? var.listener_arns_count : 0}"

Ryan Rykeover 7 years ago

guessing something in here

esource "aws_lb_listener_rule" "paths" {
  count        = "${length(var.paths) > 0 && length(var.hosts) == 0 ? var.listener_arns_count : 0}"
  listener_arn = "${var.listener_arns[count.index]}"
  priority     = "${var.priority + count.index}"

  action {
    type             = "forward"
    target_group_arn = "${local.target_group_arn}"
  }

  condition {
    field  = "path-pattern"
    values = ["${var.paths}"]
  }
}

Ryan Rykeover 7 years ago

trying to understand how to either fix this or this is intended

Erik Osterman (Cloud Posse)over 7 years ago

so the aws_lb_listener_rule.paths resource is created if you want to use path based routing

Erik Osterman (Cloud Posse)over 7 years ago

e.g. send /api to service A

Erik Osterman (Cloud Posse)over 7 years ago

so the aws_lb_listener_rule.hosts resource is created if you want to use host based routing.

Erik Osterman (Cloud Posse)over 7 years ago

e.g. send <http://api.example.com|api.example.com> to service A

Andriy Knysh (Cloud Posse)over 7 years ago

regarding this PR https://github.com/cloudposse/terraform-aws-ecs-container-definition/pull/9

Andriy Knysh (Cloud Posse)over 7 years ago

i don’t see here https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_definition_parameters.html#container_definition_environment where it’s required to have integers and booleans as strings for ENV vars

Andriy Knysh (Cloud Posse)over 7 years ago

so what’s probably happening is that we send strings to AWS, but they get converted to the original types

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

then TF reads them and compares to what it has and sees that they are different

Andriy Knysh (Cloud Posse)over 7 years ago

similar to what was going on with Elastic Beanstalk https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/issues/43

Andriy Knysh (Cloud Posse)over 7 years ago

or actually what’s going on is that the PR keeps the strings for all values, but it was supposed to do it only for ENV vars

Andriy Knysh (Cloud Posse)over 7 years ago

that needs to be fixed

Erik Osterman (Cloud Posse)over 7 years ago

@Andriy Knysh (Cloud Posse) do you think you can take a stab at the container definition fix tomorrow?

Andriy Knysh (Cloud Posse)over 7 years ago

Ryan Rykeover 7 years ago

https://github.com/cloudposse/terraform-aws-alb/pull/13

Ryan Rykeover 7 years ago

ill put a pr in for an update ecs-web-app with these related changes, along with port mapping, and any updates you might be able to muster with the container_definition

Erik Osterman (Cloud Posse)over 7 years ago

tagged a release

Erik Osterman (Cloud Posse)over 7 years ago

0.2.6

Andriy Knysh (Cloud Posse)over 7 years ago

@Ryan Ryke regarding this PR https://github.com/cloudposse/terraform-aws-ecs-alb-service-task/issues/13

Andriy Knysh (Cloud Posse)over 7 years ago

the latest release of https://github.com/cloudposse/terraform-aws-ecs-container-definition correctly handles environment when converting to JSON (preserves strings)

Andriy Knysh (Cloud Posse)over 7 years ago

what version of https://github.com/cloudposse/terraform-aws-ecs-web-app are you using?

Andriy Knysh (Cloud Posse)over 7 years ago

(if, as you mentioned in the PR, you are using 0.6.0, it’s a very old version. Can you try the latest?)

Ryan Rykeover 7 years ago

yep i am

Ryan Rykeover 7 years ago

when i revert the port mapping and use container port it works fine

Andriy Knysh (Cloud Posse)over 7 years ago

can you show the difference (when it works and when it does not)

Ryan Rykeover 7 years ago

also if i revert to 0.5.0 it works fine

Andriy Knysh (Cloud Posse)over 7 years ago

the code difference

Ryan Rykeover 7 years ago

its pretty basic, swap out portmapping with container port and adjust the version

Ryan Rykeover 7 years ago

the part thats recreating it is the ecs_task_def

Ryan Rykeover 7 years ago

but when i revert container def it stops doing it

Ryan Rykeover 7 years ago

current container def is 0.3.0

Ryan Rykeover 7 years ago

current ecs_alb_service_task is 0.6.0

Ryan Rykeover 7 years ago


module "container_definition" {
  source                       = "git::<https://github.com/cloudposse/terraform-aws-ecs-container-definition.git?ref=tags/0.3.0>"
  container_name               = "${module.default_label.id}"
  container_image              = "${var.container_image}"
  container_memory             = "${var.container_memory}"
  container_memory_reservation = "${var.container_memory_reservation}"
  container_cpu                = "${var.container_cpu}"
  healthcheck                  = "${var.healthcheck}"
  environment                  = "${var.environment}"
  port_mappings                = "${var.port_mappings}"
  log_options = {
    "awslogs-region"        = "${var.aws_logs_region}"
    "awslogs-group"         = "${aws_cloudwatch_log_group.app.name}"
    "awslogs-stream-prefix" = "${var.name}"
  }
}

module "ecs_alb_service_task" {
  source                    = "git::<https://github.com/cloudposse/terraform-aws-ecs-alb-service-task.git?ref=tags/0.6.0>"
  name                      = "${var.name}"
  namespace                 = "${var.namespace}"
  stage                     = "${var.stage}"
  alb_target_group_arn      = "${module.alb_ingress.target_group_arn}"
  container_definition_json = "${module.container_definition.json}"
  container_name            = "${module.default_label.id}"
  desired_count             = "${var.desired_count}"
  task_cpu                  = "${var.container_cpu}"
  task_memory               = "${var.container_memory}"
  ecr_repository_name       = "${module.ecr.repository_name}"
  ecs_cluster_arn           = "${var.ecs_cluster_arn}"
  launch_type               = "${var.launch_type}"
  vpc_id                    = "${var.vpc_id}"
  security_group_ids        = ["${var.ecs_security_group_ids}"]
  private_subnet_ids        = ["${var.ecs_private_subnet_ids}"]
  container_port            = "${var.container_port}"
}

Andriy Knysh (Cloud Posse)over 7 years ago

the code above is not working (updates every time)?

Andriy Knysh (Cloud Posse)over 7 years ago

what’s your var.port_mappings?

Ryan Rykeover 7 years ago

port_mappings                                   = [
      {
        containerPort                               = "4000"
        protocol                                    = "tcp"
      }
    ]

Ryan Rykeover 7 years ago

@Andriy Knysh (Cloud Posse)

Ryan Rykeover 7 years ago

oops sorry

Andriy Knysh (Cloud Posse)over 7 years ago

ok so i know the issue

Ryan Rykeover 7 years ago

nice

Andriy Knysh (Cloud Posse)over 7 years ago

add hostPort the same as containerPort

Ryan Rykeover 7 years ago

tried thast

Andriy Knysh (Cloud Posse)over 7 years ago

and read this https://github.com/hashicorp/terraform/issues/16769

Ryan Rykeover 7 years ago

let me try again

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/terraform-providers/terraform-provider-aws/issues/3401

Andriy Knysh (Cloud Posse)over 7 years ago

also, what version of TF aws provider are you using?

Ryan Rykeover 7 years ago

latest

Andriy Knysh (Cloud Posse)over 7 years ago

ok so please check the hostPort and then the healthcheck as described here https://github.com/terraform-providers/terraform-provider-aws/issues/3401#issuecomment-420830007

Ryan Rykeover 7 years ago

will check

Ryan Rykeover 7 years ago

that did it

Ryan Rykeover 7 years ago

👍️

Andriy Knysh (Cloud Posse)over 7 years ago

which one?

Ryan Rykeover 7 years ago

host port

Ryan Rykeover 7 years ago

almost 💯 that i tried that before

Andriy Knysh (Cloud Posse)over 7 years ago

so well, they said they fixed the port issue in aws provider 1.36.0 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

which one do you have?

Ryan Rykeover 7 years ago

1.32

Ryan Rykeover 7 years ago

let me re init

Andriy Knysh (Cloud Posse)over 7 years ago

that’s not the latest 🙂

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

ok anyway, thank you for testing and finding the issues. We’ll add a description to README that if you have TF provider < 1.36.0 AND use network_mode = "awsvpc" then you have to add hostPort to the port mappings

Ryan Rykeover 7 years ago

updated the web-app module https://github.com/cloudposse/terraform-aws-ecs-web-app/pull/18/

Ryan Rykeover 7 years ago

feel free to comment so we can get it merged plz 🙂

Ryan Rykeover 7 years ago

hi @Erik Osterman (Cloud Posse) im not sure what that error means

Erik Osterman (Cloud Posse)over 7 years ago

@Ryan Ryke it’s complaining that it needs to be properly formatted

Erik Osterman (Cloud Posse)over 7 years ago

just run terraform fmt .

erikover 7 years ago

Ryan Rykeover 7 years ago

| => terraform fmt
outputs.tf
variables.tf
________________________________________________________________________________________________________________
| ~/chef/terraform-aws-ecs-web-app @ RR-PRO (ryanryke)
| => terraform fmt .
__________________________________________

Ryan Rykeover 7 years ago

¯\(ツ)/¯

Erik Osterman (Cloud Posse)over 7 years ago

perfect

Erik Osterman (Cloud Posse)over 7 years ago

now git diff

Erik Osterman (Cloud Posse)over 7 years ago

you should see the changes

Erik Osterman (Cloud Posse)over 7 years ago

terraform fmt == terraform fmt .

Erik Osterman (Cloud Posse)over 7 years ago

so the first time you ran it, it formatted the code

Erik Osterman (Cloud Posse)over 7 years ago

second time no more formatting necessary

Erik Osterman (Cloud Posse)over 7 years ago

@Ryan Ryke bump

Erik Osterman (Cloud Posse)over 7 years ago

want to commit & push that?

Ryan Rykeover 7 years ago

sure thing

Ryan Rykeover 7 years ago(edited)

there you go

Erik Osterman (Cloud Posse)over 7 years ago(edited)

merged & released

praveenover 7 years ago

Hi, am trying to created azure services using terraform. I have base modules with Azure availability set, load balancers, and couple of azurerm_virtual_machine_extension's in the base DRY module

praveenover 7 years ago

i want to condition as a option to create only few extensions while deploying azure VM's while referring to base DRY base modules

praveenover 7 years ago

am trying to use count = "${var.enabled == "true" ? 1 : 0}" in base azurerm_virtual_machine_extension tf file to see if I can use the extension as an option

praveenover 7 years ago

but its not working while an using the count option

praveenover 7 years ago

can you please let me know if am using the right approach by using count in base .tf file(resource) as an option

Andriy Knysh (Cloud Posse)over 7 years ago

@praveen count = "${var.enabled == "true" ? 1 : 0}" is a correct way to enable/disable a resource

Andriy Knysh (Cloud Posse)over 7 years ago

we use what we call splat+join pattern for resources with counts

Andriy Knysh (Cloud Posse)over 7 years ago

for example:

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-ec2-autoscale-group/blob/master/main.tf#L72

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-ec2-autoscale-group/blob/master/outputs.tf#L13

Andriy Knysh (Cloud Posse)over 7 years ago

if you put count into a resource, then it becomes a list (not a single resource)

Andriy Knysh (Cloud Posse)over 7 years ago

so anywhere you use any of the resource’s attribute, you have to get the item from the list

Andriy Knysh (Cloud Posse)over 7 years ago

splat+join pattern does this:

Andriy Knysh (Cloud Posse)over 7 years ago

if enabled = "true", it gets the first item

Andriy Knysh (Cloud Posse)over 7 years ago

if enabled = "false", it gets an empty string (and TF does not complain)

Andriy Knysh (Cloud Posse)over 7 years ago

hope that helps. let us know if you need more help

August 2018 Browse by date October 2018