#terraform - January 2019 | Slack Archive

1,232 messages

Archive: https://archive.sweetops.com/terraform/

Dec 2018

January 2019

Feb 2019

Wesselalmost 8 years ago

Got a question regarding the output vars of https://github.com/cloudposse/terraform-aws-elasticache-redis, it seems I am not getting the host out of it.

joshmyersalmost 8 years ago

@Wessel Were DNS records created for the elasticache cluster?

Doron Grinsteinalmost 8 years ago

When using terraform-aws-elasticache-redis, when I do not specify a value for "replication_group_id", I get the following Terraform (0.11.11) error: Error: module.example_redis.aws_elasticache_replication_group.default: "replication_group_id" must contain from 1 to 20 alphanumeric characters or hyphens

Doron Grinsteinalmost 8 years ago

Note that the example at https://github.com/cloudposse/terraform-aws-elasticache-redis/blob/master/examples/simple/main.tf does not specify "replication_group_id"

Erik Osterman (Cloud Posse)almost 8 years ago

checking

Doron Grinsteinalmost 8 years ago

thx

Erik Osterman (Cloud Posse)almost 8 years ago

hrmmmmm

Erik Osterman (Cloud Posse)almost 8 years ago

ok, so looks like if you don't specify one, we generate one

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/cloudposse/terraform-aws-elasticache-redis/blob/master/main.tf#L55

Erik Osterman (Cloud Posse)almost 8 years ago

what values do you have for namespace, stage and name?

Erik Osterman (Cloud Posse)almost 8 years ago

any chance they contain invalid characters?

Doron Grinsteinalmost 8 years ago

namespace = "general"
name = "iam2-redis"
stage = "${var.environment}" // where the value is 'dev'

Erik Osterman (Cloud Posse)almost 8 years ago

hrm... looks good

Doron Grinsteinalmost 8 years ago

I commented out the "zone" attribute

Doron Grinsteinalmost 8 years ago

maybe this is the issue?

Erik Osterman (Cloud Posse)almost 8 years ago

hrmm don't think it could be related...

Doron Grinsteinalmost 8 years ago

any words of wisdom would be appreciated 🙂

Erik Osterman (Cloud Posse)almost 8 years ago

where did you specify stage = "${var.environment}"

Doron Grinsteinalmost 8 years ago

in the module

Doron Grinsteinalmost 8 years ago

module "example_redis" {
source = "git::https://github.com/cloudposse/terraform-aws-elasticache-redis.git?ref=master"
namespace = "general"
name = "iam2-redis"
stage = "${var.environment}"
//zone_id = "${var.route53_zone_id}"
security_groups = ["${aws_security_group.rds_security_group.id}"]

auth_token = "${random_string.auth_token.result}"
vpc_id = "${aws_vpc.iam2-persistence-vpc.id}"
subnets = ["${aws_subnet.rds_subnet_1.id}", "${aws_subnet.rds_subnet_2.id}"]
maintenance_window = "wed:03:00-wed:04:00"
cluster_size = "2"
instance_type = "cache.t2.micro"
engine_version = "4.0.10"
alarm_cpu_threshold_percent = "75"
alarm_memory_threshold_bytes = "10000000"
apply_immediately = "true"
availability_zones = ["${data.aws_availability_zones.available.names[0]}", "${data.aws_availability_zones.available.names[1]}"]

automatic_failover = "false"
//replication_group_id = "a123"
}

Erik Osterman (Cloud Posse)almost 8 years ago

hrm lgtm

Erik Osterman (Cloud Posse)almost 8 years ago

any chance you have a space in var.environment?

Erik Osterman (Cloud Posse)almost 8 years ago

e.g.

Erik Osterman (Cloud Posse)almost 8 years ago


export TF_VAR_environment="dev "

Doron Grinsteinalmost 8 years ago

no.

Doron Grinsteinalmost 8 years ago

This is from the config file: environment = "dev"

Erik Osterman (Cloud Posse)almost 8 years ago

can you try this.... for debugging

Erik Osterman (Cloud Posse)almost 8 years ago

you said that if you specify a replication_group_id it works (e.g. a123)

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

what if you specify: replication_group_id = "general-dev-iam2-redis"

Erik Osterman (Cloud Posse)almost 8 years ago

do you get the same error?

Doron Grinsteinalmost 8 years ago

yes, when I uncomment the a123 it does work (I did not type 'yes' with the apply)

Doron Grinsteinalmost 8 years ago

it should work too

Doron Grinsteinalmost 8 years ago

a123 is just a random string

Erik Osterman (Cloud Posse)almost 8 years ago


eplication_group_id          = "${var.replication_group_id == "" ? module.label.id : var.replication_group_id}"

Erik Osterman (Cloud Posse)almost 8 years ago

we're setting it to module.label.id

Erik Osterman (Cloud Posse)almost 8 years ago

which should just be the concatenation of namespace, stage, name and attributes

Erik Osterman (Cloud Posse)almost 8 years ago

(with - delimiter)

Erik Osterman (Cloud Posse)almost 8 years ago

...maybe sometihng it doesn't like with this "general-dev-iam2-redis"

Erik Osterman (Cloud Posse)almost 8 years ago

the iam2-

Doron Grinsteinalmost 8 years ago

I changed it to remove the hyphen. same error

Doron Grinsteinalmost 8 years ago

module "example_redis" {
source = "git::https://github.com/cloudposse/terraform-aws-elasticache-redis.git?ref=master"
namespace = "general"
name = "iam2Redis"
stage = "dev"
//zone_id = "${var.route53_zone_id}"
security_groups = ["${aws_security_group.rds_security_group.id}"]

auth_token = "${random_string.auth_token.result}"
vpc_id = "${aws_vpc.iam2-persistence-vpc.id}"
subnets = ["${aws_subnet.rds_subnet_1.id}", "${aws_subnet.rds_subnet_2.id}"]
maintenance_window = "wed:03:00-wed:04:00"
cluster_size = "2"
instance_type = "cache.t2.micro"
engine_version = "4.0.10"
alarm_cpu_threshold_percent = "75"
alarm_memory_threshold_bytes = "10000000"
apply_immediately = "true"
availability_zones = ["${data.aws_availability_zones.available.names[0]}", "${data.aws_availability_zones.available.names[1]}"]

automatic_failover = "false"
//replication_group_id = "a123"

}

Erik Osterman (Cloud Posse)almost 8 years ago

ohhhg

Erik Osterman (Cloud Posse)almost 8 years ago

we ran into this before

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/cloudposse/terraform-aws-elasticache-redis/issues/16

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

did you try this?

Erik Osterman (Cloud Posse)almost 8 years ago

TF_LOG=DEBUG

Doron Grinsteinalmost 8 years ago

no. I will try

Erik Osterman (Cloud Posse)almost 8 years ago

then you'll get more info about the underlying API respone

Doron Grinsteinalmost 8 years ago

I should have tried it. I read about TF_LOG=DEBUG

Erik Osterman (Cloud Posse)almost 8 years ago

@stephen recently contributed the replication_group_id field

Erik Osterman (Cloud Posse)almost 8 years ago

maybe he's seen this error too and can shed some light

Doron Grinsteinalmost 8 years ago

as far as you know, is it OK to just use any ID, or does it need to correspond to a pre-provisioned real resource?

Erik Osterman (Cloud Posse)almost 8 years ago

as far as I know, it does not need to correspond to anything

Doron Grinsteinalmost 8 years ago

cool. thanks

Janalmost 8 years ago

So I am going to start the year with building a kops terraform module to spin up a kops cluster in an existing vpc from a cluster.yaml template

Igoralmost 8 years ago(edited)

Novice question. How do I manage dependencies between different state files. Example, I have a state file (A) that has Security Groups, and another state file (B) that has an instance and uses (A) as a data source to pull the security group information from. If I now update (A) with a different Security Group name, it won't be able to destroy the existing security group ( create_before_destroy only works within the same state file) because it's tied to a resource in (B), and I'll need to re-run the apply on (B) as well. Is this a typical limitation of breaking things up into different state files, or is there a better way to structure this?

Andriy Knysh (Cloud Posse)almost 8 years ago

@Igor yes, if you change the interface between the modules (and a SG name is an interface), then you need to re-apply everything. You’ll need to do it in any cases even if you use just one state file. That though should be rarely needed

joshmyersalmost 8 years ago

@Igor there is no nice way to do it AFAIK - and it is a pita

Andriy Knysh (Cloud Posse)almost 8 years ago

use naming conventions to uniquely name all the resources (e.g. terraform-null-label module)

Andriy Knysh (Cloud Posse)almost 8 years ago

then all the names will stay the same and unique

joshmyersalmost 8 years ago

If you can seed things from the same variables and avoid passing state around that maybe able to help a little

Andriy Knysh (Cloud Posse)almost 8 years ago

you can just update/change the internals of each module (e.g. add rules to the SG), which should not affect any other module

joshmyersalmost 8 years ago

Terragrunt has the idea of dependencies between state https://github.com/gruntwork-io/terragrunt#dependencies-between-modules

Andriy Knysh (Cloud Posse)almost 8 years ago(edited)

or, you can tag the resources, and then look them up by the tags (e.g. https://github.com/cloudposse/terraform-root-modules/blob/master/aws/eks-backing-services-peering/main.tf)

joshmyersalmost 8 years ago

but it is less than ideal due to the plan/apply phases of Terraform. say you have X,Y,Z that are dependant on state from A. Plan all doesn’t do what you think it will, because A hasn’t actually been applied yet, so the changes to A are not shown in the plan for X,Y,Z

joshmyersalmost 8 years ago

Passing around state is super helpful, but also problematic and should be avoided for things like @Andriy Knysh (Cloud Posse) suggestions

joshmyersalmost 8 years ago(edited)

It can also make a bootstrap process harder - ordering matters.

Igoralmost 8 years ago

Thanks @Andriy Knysh (Cloud Posse) @joshmyers. I guess there is no silver bullet. I am okay keeping track of order of applies, but not sure specifically about the case where something cannot be destroyed because it's in use by a resource in a different state file.

Igoralmost 8 years ago

Unless I can run the apply on (B) while (A) is stuck on its destroy step.. does the state of (A) get updated resource-by-resource?

Andriy Knysh (Cloud Posse)almost 8 years ago

yea, that’s not fun. try to use diff states as little as possible as @joshmyers pointed out

Andriy Knysh (Cloud Posse)almost 8 years ago

for example, you can prob put the SG into the same module because they are related

Igoralmost 8 years ago

Yeah, makes sense. I need to think about this while planning how I structure things. Thanks for the feedback.

Andriy Knysh (Cloud Posse)almost 8 years ago

is this just a one-time task you want to do (destroy the SG and create a new one), or is this in your workflow?

Igoralmost 8 years ago

I am in testing mode at the moment, thinking of the different scenarios/workflows, and just stumbled on this

Andriy Knysh (Cloud Posse)almost 8 years ago

if one time task, then just destroy and recreate everything. If it’s a workflow, don’t do it 🙂

Andriy Knysh (Cloud Posse)almost 8 years ago

select unique names for all the resources, and the issue will be reduced

btaialmost 8 years ago

anyone here ever tried to get a local-exec script output to a terraform variable?

Andriy Knysh (Cloud Posse)almost 8 years ago

you can use https://www.terraform.io/docs/providers/external/data_source.html

Andriy Knysh (Cloud Posse)almost 8 years ago

data "external" "example" {
  program = ["bash", "${path.module}/example.sh"]

  query {
    cluster_name = "my-cluster"
  }
}

Andriy Knysh (Cloud Posse)almost 8 years ago

token                  = "${data.external.example.result.token}"

Andriy Knysh (Cloud Posse)almost 8 years ago

in example.sh:

Andriy Knysh (Cloud Posse)almost 8 years ago(edited)


# Extract cluster name
eval "$(jq -r '@sh "CLUSTER_NAME=\(.cluster_name)"')"

# Output token as JSON
jq -n --arg token "$TOKEN" '{"token": $token}'

btaialmost 8 years ago

thanks

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/cloudposse/terraform-external-module-artifact/blob/master/main.tf

btaialmost 8 years ago

have you guys run into this error?

btaialmost 8 years ago

* data.template_file.galaxy_kube_config: Resource 'data.external.token' does not have attribute 'result.token' for variable 'data.external.token.result.token'

Andriy Knysh (Cloud Posse)almost 8 years ago

did you write the token from the external program to the output? (either as shown here https://github.com/cloudposse/terraform-external-module-artifact/blob/master/main.tf or here https://github.com/terraform-providers/terraform-provider-kubernetes/issues/161#issuecomment-395302615)

btaialmost 8 years ago

doing this fixed it

"${data.external.token.result["token"]}"

btaialmost 8 years ago

as opposed to

"${data.external.galaxy_token.result.token}"

btaialmost 8 years ago

anyone here use the kubernetes provider?

btaialmost 8 years ago

for some reason my kubernetes_cluster_role_binding hangs on my initial terraform apply

btaialmost 8 years ago

but if i ctrl+c and run terraform apply again it works automatically

btaialmost 8 years ago

kubernetes_cluster_role_binding.kube_system_default_role_binding: Still creating... (5m10s elapsed)
kubernetes_cluster_role_binding.kube_system_default_role_binding: Still creating... (5m20s elapsed)
kubernetes_cluster_role_binding.kube_system_default_role_binding: Still creating... (5m30s elapsed)
kubernetes_cluster_role_binding.kube_system_default_role_binding: Still creating... (5m40s elapsed)

btaialmost 8 years ago

second attempt:

kubernetes_cluster_role_binding.kube_system_default_role_binding: Creation complete after 1s (ID: kube-system-default-role-binding)

Maarten van der Hoefalmost 8 years ago

@btai maybe you can add logging with TF_LOG to get a bit more output.
@Alex Somesan

btaialmost 8 years ago

yeah ill do that right now

btaialmost 8 years ago

kubernetes_cluster_role_binding.kube_system_default_role_binding: Still creating... (1m50s elapsed)
2019/01/03 15:20:24 [TRACE] dag/walk: vertex "root", waiting for: "provider.external (close)"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "data.external.galaxy_token", waiting for: "helm_release.soxhub_cluster_chart"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "data.template_file.galaxy_kube_config", waiting for: "data.external.galaxy_token"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "output.galaxy_kube_config", waiting for: "data.template_file.galaxy_kube_config"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "provider.helm (close)", waiting for: "helm_release.soxhub_cluster_chart"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "provider.external (close)", waiting for: "data.external.galaxy_token"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "meta.count-boundary (count boundary fixup)", waiting for: "kubernetes_service.load_balancer"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "provider.kubernetes (close)", waiting for: "kubernetes_service.load_balancer"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "kubernetes_service.load_balancer", waiting for: "helm_release.soxhub_cluster_chart"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "provider.template (close)", waiting for: "data.template_file.galaxy_kube_config"
2019/01/03 15:20:28 [TRACE] dag/walk: vertex "helm_release.soxhub_cluster_chart", waiting for: "kubernetes_cluster_role_binding.kube_system_default_role_binding"
2019/01/03 15:20:29 [TRACE] dag/walk: vertex "root", waiting for: "provider.external (close)"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "data.template_file.galaxy_kube_config", waiting for: "data.external.galaxy_token"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "data.external.galaxy_token", waiting for: "helm_release.soxhub_cluster_chart"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "meta.count-boundary (count boundary fixup)", waiting for: "kubernetes_service.load_balancer"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "provider.kubernetes (close)", waiting for: "kubernetes_service.load_balancer"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "provider.external (close)", waiting for: "data.external.galaxy_token"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "output.galaxy_kube_config", waiting for: "data.template_file.galaxy_kube_config"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "provider.helm (close)", waiting for: "helm_release.soxhub_cluster_chart"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "provider.template (close)", waiting for: "data.template_file.galaxy_kube_config"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "kubernetes_service.load_balancer", waiting for: "helm_release.soxhub_cluster_chart"
2019/01/03 15:20:33 [TRACE] dag/walk: vertex "helm_release.soxhub_cluster_chart", waiting for: "kubernetes_cluster_role_binding.kube_system_default_role_binding"
kubernetes_cluster_role_binding.kube_system_default_role_binding: Still creating... (2m0s elapsed)

btaialmost 8 years ago

^ @Maarten van der Hoef

btaialmost 8 years ago

does that mean anything to you?

Maarten van der Hoefalmost 8 years ago

No but maybe to @Alex Somesan 🙂

Erik Osterman (Cloud Posse)almost 8 years ago

@Andriy Knysh (Cloud Posse) is using this kubernetes provider too - he’ll be online tormorrow

rbadilloalmost 8 years ago

Good morning team

rbadilloalmost 8 years ago

I have a question

rbadilloalmost 8 years ago

Any idea when route53 resolver resource will be available ?

rbadilloalmost 8 years ago

I saw this pull request https://github.com/terraform-providers/terraform-provider-aws/pull/6574

rbadilloalmost 8 years ago

but I’m not sure

Erik Osterman (Cloud Posse)almost 8 years ago

@rbadillo can you provide some additional context?

Erik Osterman (Cloud Posse)almost 8 years ago

we use route53 in dozens of modules

rbadilloalmost 8 years ago

I’m talking about the new route53 resolver feature

rbadilloalmost 8 years ago

they just released back in Nov 2018

Erik Osterman (Cloud Posse)almost 8 years ago

(or do you mean when the PR will be merged? )

rbadilloalmost 8 years ago

the PR with the new feature

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

ohhhhhh gotcha! no, unfortunately don’t know anyone in connection to the PR

Gonzalo Pecialmost 8 years ago

Hello! I was just looking at the updates: https://github.com/cloudposse/terraform-root-modules/pull/83/files and I believe https://github.com/cloudposse/terraform-root-modules/pull/83/files#diff-25b6b1e862ed7056e75cc43421b112c0R123 should be SecureString instead of String, but I dont konw if there is some other intention behind not making it a SecureString

Gonzalo Pecialmost 8 years ago

BTW, I thought you used chamber to manage the secrets, do you just bootstrap them via terraform?

Andriy Knysh (Cloud Posse)almost 8 years ago

nice catch @Gonzalo Peci, that should be SecureString

Andriy Knysh (Cloud Posse)almost 8 years ago

in the last releases, we added code to write secrets (and other settings) to SSM from all modules via Terraform so they could be used from other modules as needed - simplifies the bootstrap process

praveenalmost 8 years ago

I have a doubt on terraform configuration on azure platform

praveenalmost 8 years ago

can we use condition like count to make the argument extension as optional in vmss on azure platform using terraform configuration

praveenalmost 8 years ago

#terraform like the example as given below

praveenalmost 8 years ago

extension {
count = "${var.enabled == "true" ?}"
name = "setexecutionpolicy-${local.vm_name_prefix}"
publisher = "Microsoft.Compute"
type = "CustomScriptExtension"
type_handler_version = "1.9"

settings = <<SETTINGS
{
"commandToExecute": "powershell.exe Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"
}
SETTINGS
}

praveenalmost 8 years ago

#terraform can you use count to enable or disable the extension depending upon our requirement?

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen i think not, count could be used only in resources count = "${var.enabled == "true" ? 1 : 0}"

Andriy Knysh (Cloud Posse)almost 8 years ago

for what you want to achieve, you can use the slice pattern (as we call it) to add different values to a setting depending on diff conditions

Andriy Knysh (Cloud Posse)almost 8 years ago

look here for some explanation https://www.reddit.com/r/Terraform/comments/99zri8/gke_regional_cluster_deployment_defining_zones/

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) got it. I am trying to create base module for windows vmss. For which I will have to include optional for enabling IIS on the base module. Is there a way I can do enable IIS optional when required

Andriy Knysh (Cloud Posse)almost 8 years ago

if you share some code, we can point you in the right direction

praveenalmost 8 years ago

I have azurerm_virtual_machine_extension which I will have to make it optional for vmss base module. As I understand I cannot use azurerm_virtual_machine_extension for azure vmss. for which I will have to use extension as an argument . Just wanted to know how can I make this configuration as optional (enable/disable)

praveenalmost 8 years ago

resource "azurerm_virtual_machine_extension" "iis" {
count = "${var.iis_enabled == "true" ? var.av_set_size : 0}"
name = "iis_${format("${var.vm_name}%02d",count.index+1)}"
location = "${var.az_location}"
resource_group_name = "${data.azurerm_resource_group.rg.name}"
virtual_machine_name = "${format("${var.vm_name}%02d",count.index+1)}"
depends_on = ["azurerm_virtual_machine.vm"]
publisher = "Microsoft.Compute"
tags = "${local.tags}"
type = "CustomScriptExtension"
type_handler_version = "1.9"

settings = <<SETTINGS
{
"commandToExecute":"PowerShell -Command \" Install-WindowsFeature -name web-server,Web-Default-Doc,Web-Http-Errors,Web-Http-Tracing,Web-Static-Content,Web-Http-Redirect,Web-Http-Logging,Web-Stat-Compression,Web-Dyn-Compression,Web-Filtering,Web-Net-Ext45,Web-Asp-Net45,Web-ISAPI-Ext,Web-ISAPI-Filter,Web-Mgmt-Console,Web-Scripting-Tools\";PowerShell -Command \" Remove-WindowsFeature -name Web-Dir-Browsing\"; PowerShell -Command \" Start-Sleep -Seconds 60; Get-Website | Remove-Website; Start-Sleep -Seconds 30; Get-IISAppPool | Remove-WebAppPool; Set-WebConfigurationProperty -Filter '/system.applicationHost/sites/siteDefaults/limits' -PSPath IIS: -Name connectionTimeout -Value (New-TimeSpan -sec 30); Set-WebConfigurationProperty -Filter '/system.applicationHost/applicationPools/applicationPoolDefaults' -PSPath IIS: -Name startMode -Value 'AlwaysRunning'; Set-WebConfigurationProperty -Filter '/system.applicationHost/applicationPools/applicationPoolDefaults/processModel' -PSPath IIS: -Name idleTimeout -Value '00:00:00'\"; exit 0"
}
SETTINGS

praveenalmost 8 years ago

here is my extension which I use in windows vm configuration making it as optional using count

Igoralmost 8 years ago

How about having an extension that has an empty commandToExecute?

praveenalmost 8 years ago

and how would I injust the command to execute while sourcing the module

praveenalmost 8 years ago

do you have any example/reference for it

Igoralmost 8 years ago(edited)

define a local commandToExecute as ${var.enabled ? 'PowerShell -Command...' : 'echo DoNothing'}. Then use settings = ${local.commandToExecute}"

praveenalmost 8 years ago

May I know if you have an example or reference of this scenario

Igoralmost 8 years ago

I'm just thinking of a possible workaround. I don't have any examples.

Igoralmost 8 years ago

Looks like the slice pattern example that @Andriy Knysh (Cloud Posse) provided is a similar idea

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen do you want to enable/disable the whole extension, or just change the command inside settings?

praveenalmost 8 years ago

whole extension

Igoralmost 8 years ago

Except as a block within https://www.terraform.io/docs/providers/azurerm/r/virtual_machine_scale_set.html, not as azurerm_virtual_machine_extension, if I understood correctly

Andriy Knysh (Cloud Posse)almost 8 years ago

in what code do you want to do it? (the second snippet above has it already resource "azurerm_virtual_machine_extension" "iis")

Stevenalmost 8 years ago(edited)

Here's something similar as an example: https://github.com/devops-workflow/terraform-aws-autoscaling/blob/master/main.tf Look at launch_configuration. It is defined inside the module, but allow it to be passed in instead.

Andriy Knysh (Cloud Posse)almost 8 years ago

yes this is a common pattern - if it’s not provided in the variables, then create a new one

Andriy Knysh (Cloud Posse)almost 8 years ago

so this is not a problem. I thought @praveen wanted to add different config to extension { in the first code snippet depending on some condition

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) "azurerm_virtual_machine_extension" is a resource which I used for creating a standalone virtual machine. I understand that we cannot use "azurerm_virtual_machine_extension" resource for vmss . for which we may have to use argument as extension to configure any vm extensions on vmss

praveenalmost 8 years ago

as I will have to create generic module for windows vmss. am not finding opportunity to make iss enable optional for windows vmss module

Andriy Knysh (Cloud Posse)almost 8 years ago(edited)

share the code where you use this block

extension {
   count                = "${var.enabled == "true" ?}"
   name                 = "setexecutionpolicy-${local.vm_name_prefix}"
   publisher            = "Microsoft.Compute"
   type                 = "CustomScriptExtension"
   type_handler_version = "1.9"

   settings = <<SETTINGS
     {
         "commandToExecute": "powershell.exe Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"
     }
   SETTINGS
 }

praveenalmost 8 years ago

can you provide me your email address so that I can share the code with you

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen DM me

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) DM the code

praveenalmost 8 years ago

if not without using extension or with any other approach can we optionally enable ISS while sourcing windows vmss module

Andriy Knysh (Cloud Posse)almost 8 years ago

i’ll take a look @praveen

praveenalmost 8 years ago

sure

Andriy Knysh (Cloud Posse)almost 8 years ago

(the slice pattern is what could be used here)

praveenalmost 8 years ago

can you give me example or snippet of slice pattern

Igoralmost 8 years ago

It's in the Reddit post above @praveen

Andriy Knysh (Cloud Posse)almost 8 years ago

Give me a few minutes, I’ll adapt it to your example

praveenalmost 8 years ago

sure @Andriy Knysh (Cloud Posse)

praveenalmost 8 years ago

checking Reddit post @Igor

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen here is a simplified version of using the slice pattern adjusted for your code

Andriy Knysh (Cloud Posse)almost 8 years ago(edited)

locals {
  extensions = [
      {
        name = "StaplesBGInfo"
      },
      {
        name = "setexecutionpolicy-${local.vm_name_prefix}"
      },
      {
        name = "IIS-${local.vm_name_prefix}"
      }
  ]

  # <https://www.terraform.io/docs/configuration/interpolation.html#slice-list-from-to->
  to_index         = "${var.iss_extention_enabled == "true" ? 3 : 2}"
  extensions_final = "${slice(local.extensions, 0, local.to_index)}"
}

resource "azurerm_virtual_machine_scale_set" "vmss" {
  extension = ["${local.extensions_final}"]
}

Andriy Knysh (Cloud Posse)almost 8 years ago(edited)

if var.iss_extention_enabled == "true", then extensions_final will contain all three extensions

Andriy Knysh (Cloud Posse)almost 8 years ago(edited)

if var.iss_extention_enabled == "false", then extensions_final will contain the first two extensions

praveenalmost 8 years ago

I didn;t understand this line # https://www.terraform.io/docs/configuration/interpolation.html#slice-list-from-to-
to_index = "${var.iss_extention_enabled == "true" ? 3 : 2}"
extensions_final = "${slice(local.extensions, 0, local.to_index)}"
}

Andriy Knysh (Cloud Posse)almost 8 years ago

it’s a comment 🙂

praveenalmost 8 years ago

Is it possible to update the code which I sent you so that I can better understand

praveenalmost 8 years ago

by making only IIS optional

praveenalmost 8 years ago

should my locals look like this?

praveenalmost 8 years ago

locals {
count = "${var.create == "0" ? 0 : 1}"
asgcount = "${length(var.asg_ids) > 0 ? 1 : 0}"
vm_name_prefix = "${replace(var.resource_prefix,"/[_]/","-")}"
extensions = [
{
name = "StaplesBGInfo"
},
{
name = "setexecutionpolicy-${local.vm_name_prefix}"
},
{
name = "IIS-${local.vm_name_prefix}"
}
]
to_index = "${var.iss_extention_enabled == "true" ? 3 : 2}"
extensions_final = "${slice(local.extensions, 0, local.to_index)}"
}
}

Robalmost 8 years ago

Hi folks. I have a question about cloudposse/terraform-aws-cloudfront-s3-cdn. Does anyone have experience with that?

Andriy Knysh (Cloud Posse)almost 8 years ago

what’s the question @Rob?

Robalmost 8 years ago

Hi @Andriy Knysh (Cloud Posse), I was successful in created an S3 bucket and a CloudFront distro using this module. However, I need to set some attributes such as making the bucket private and restricting the CF distro to only accept signed URLs. I cannot find anywhere how to do that.

Robalmost 8 years ago

And my Google searches are not helping

Igoralmost 8 years ago

@Andriy Knysh (Cloud Posse) terraform blocks are just list variables? that's so useful... and I can't believe I didn't pick up on that earlier.

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen sent you example for your code

Igoralmost 8 years ago

(you'd think tags would have given it away, ha)

Andriy Knysh (Cloud Posse)almost 8 years ago

can’t help you with Azure questions since I’m not familiar with it, so you have to take a look at the code and figure out the remaining issues (if any) by yourself

Andriy Knysh (Cloud Posse)almost 8 years ago

sorry @Rob, too much traffic here 🙂

Robalmost 8 years ago

no worries

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) Thank you very much . am going to test it now and let you know

Robalmost 8 years ago

@Andriy Knysh (Cloud Posse), I have to get lunch so I'll ping you later when I get back. Thanks for the offer of help.

Andriy Knysh (Cloud Posse)almost 8 years ago

@Rob the bucket is already private https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/blob/master/main.tf#L56 (if that’s was your question)

Andriy Knysh (Cloud Posse)almost 8 years ago

signed URLs are currently not supported by the module. I guess this needs to be added https://www.terraform.io/docs/providers/aws/r/cloudfront_distribution.html#trusted_signers

Andriy Knysh (Cloud Posse)almost 8 years ago

@Rob if you test it and open a PR, we’ll review promptly 🙂

Robalmost 8 years ago(edited)

thanks @Andriy Knysh (Cloud Posse), I'll give it try shortly.

Robalmost 8 years ago(edited)

@Andriy Knysh (Cloud Posse) I just checked the bucket that was created and the 4 permissions, including ACLs, are marked as False. Going to delete the CF distro and bucket and try again. Will let you know. Note this is in the Permissions tab and the Public access settings button.

Robalmost 8 years ago

or are you suggesting that I modify the code and submit a PR? Maybe I didn't understand.

Andriy Knysh (Cloud Posse)almost 8 years ago

@Rob yes, for trusted_signers, would be great if you could test it and open a PR

Robalmost 8 years ago

will do. thx

Robalmost 8 years ago

@Andriy Knysh (Cloud Posse), waiting for the terraform destory to complete. The CF distros take a while to complete. I'll get it done asap and if it works, submit a PR. Thanks for your help.

Erik Osterman (Cloud Posse)almost 8 years ago

Yea, CF is painfully slow.

Erik Osterman (Cloud Posse)almost 8 years ago

especially when having used things like CloudFlare or Fastly

Robalmost 8 years ago

yeah! it finished!

Robalmost 8 years ago

do I need to create a fork in order to create a PR?

Andriy Knysh (Cloud Posse)almost 8 years ago

yes, fork it, then create a new branch, add your code, open a PR

Robalmost 8 years ago

The code change worked and the distro was created with a trusted_signer of "self"

Robalmost 8 years ago

thx

joberalmost 8 years ago

Hi there! I am new to the community, is this the correct place to ask questions about the terraform modules?

Erik Osterman (Cloud Posse)almost 8 years ago

yep, mostly about the cloudposse/terraform-* modules

joberalmost 8 years ago

ok!

Erik Osterman (Cloud Posse)almost 8 years ago

we also have a #terraform-aws-modules channel for https://github.com/terraform-aws-modules

joberalmost 8 years ago

Maybe you have a quick insight for me.

joberalmost 8 years ago

I am trying to implement https://github.com/cloudposse/terraform-aws-elasticache-redis

joberalmost 8 years ago

And I keep getting:

Error: module.redis.aws_elasticache_replication_group.default: "replication_group_id" must contain from 1 to 20 alphanumeric characters or hyphens

joberalmost 8 years ago

I have tried manually applying a replication_group_id but it still throws

Erik Osterman (Cloud Posse)almost 8 years ago

hrm....

Erik Osterman (Cloud Posse)almost 8 years ago

can you share the group id you manually set?

joberalmost 8 years ago

replication_group_id = "grizzly-redis-staging"

Erik Osterman (Cloud Posse)almost 8 years ago

too long

joberalmost 8 years ago

OO man

Erik Osterman (Cloud Posse)almost 8 years ago


echo  -n grizzly-redis-staging | wc
       0       1      21

joberalmost 8 years ago

i guess reading the error would help

joberalmost 8 years ago

wow sorry

Erik Osterman (Cloud Posse)almost 8 years ago

(i know, it doesn't look that long!!!)

Erik Osterman (Cloud Posse)almost 8 years ago

honestly, this just came up for someone else last week

Erik Osterman (Cloud Posse)almost 8 years ago

so that's why it was fresh in my memory

joberalmost 8 years ago

Thank you so much!!

Erik Osterman (Cloud Posse)almost 8 years ago

https://sweetops.slack.com/archives/CB6GHNLG0/p1546489404082600?thread_ts=1546478732.079900&cid=CB6GHNLG0

joberalmost 8 years ago

Awesome thank you so much!

Erik Osterman (Cloud Posse)almost 8 years ago

np! that's what we're here for...

joberalmost 8 years ago

and thanks so much for all of the great modules!!

Robalmost 8 years ago

@Andriy Knysh (Cloud Posse) I created a PR.

Robalmost 8 years ago

thanks again for your help

Erik Osterman (Cloud Posse)almost 8 years ago

btw, if you haven't already, please give us a ★ on any of our github projects that you're using 😃 It helps us a lot!

Robalmost 8 years ago(edited)

will do. great stuff guys. Keep up the good work. Saves us a lot of time.

Erik Osterman (Cloud Posse)almost 8 years ago

🙇‍♂️thanks @Rob!

Andriy Knysh (Cloud Posse)almost 8 years ago

@Rob can you add 'self' is acceptable. to the variable description and then rebuild README by executing these commands:

Andriy Knysh (Cloud Posse)almost 8 years ago

make init
make readme/deps
make readme

Andriy Knysh (Cloud Posse)almost 8 years ago

(we don’t directly modify README.md, we modify README.yaml and varaibles.tf and outputs.tf` - then the README generator builds README.md)

Robalmost 8 years ago

sure thing

Robalmost 8 years ago

though I didn't see anything in the yaml file to update. Am i missing something?

Robalmost 8 years ago

done and pushed

Andriy Knysh (Cloud Posse)almost 8 years ago

thanks @Rob

Andriy Knysh (Cloud Posse)almost 8 years ago

if the list is empty, does it still work? 🙂

Robalmost 8 years ago

I guess I should test that. oops. shame on me 🙂 Will test and notify you when complete

Andriy Knysh (Cloud Posse)almost 8 years ago

thanks

Robalmost 8 years ago(edited)

@Andriy Knysh (Cloud Posse), yes, it works if you don't specify trusted_signers and uses the default which is []

Robalmost 8 years ago

gotta love terraform

Robalmost 8 years ago

ah, I didn't mean that as a slight against CP.

Erik Osterman (Cloud Posse)almost 8 years ago

oh haha emoji fail

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

I just mean that terraform breaks my heart sometimes

Erik Osterman (Cloud Posse)almost 8 years ago

for me, the biggest gripe is "count of cannot be computed"

Robalmost 8 years ago

hahaha. that is annoying

Robalmost 8 years ago

nothing is perfect

Erik Osterman (Cloud Posse)almost 8 years ago

yea...

Erik Osterman (Cloud Posse)almost 8 years ago

has anyone here taken a serious stab at using pulumi?

Erik Osterman (Cloud Posse)almost 8 years ago

The way I get it, Pulumi is to Terraform what SASS is to CSS.

Robalmost 8 years ago(edited)

interesting concept. First I've heard of it. I like the purple website lol

Andriy Knysh (Cloud Posse)almost 8 years ago

@Rob https://github.com/cloudposse/terraform-aws-cloudfront-s3-cdn/releases/tag/0.6.0

Robalmost 8 years ago

thanks @Andriy Knysh (Cloud Posse)

Janalmost 8 years ago

Is any one using the https://github.com/cloudposse/terraform-aws-iam-user module in combination with the https://github.com/cloudposse/terraform-aws-ses-lambda-forwarder

Janalmost 8 years ago

what is the currently supported method for creating IAM users?

joshmyersalmost 8 years ago

@Jan Don’t think I follow, supported method?

Janalmost 8 years ago

how do I add IAM users

Janalmost 8 years ago

that have keybase setup already

Janalmost 8 years ago

been a long two days and im tired so im probably missing something

Andriy Knysh (Cloud Posse)almost 8 years ago

@Jan here is our latest doc on this https://github.com/cloudposse/reference-architectures/tree/master/templates/conf/users

Janalmost 8 years ago

brilliant, thank you!

Erik Osterman (Cloud Posse)almost 8 years ago

(Note that directory contains templates)

Erik Osterman (Cloud Posse)almost 8 years ago

There is also https://github.com/cloudposse/terraform-null-smtp-mail

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/cloudposse/root.cloudposse.co/blob/master/conf/users/osterman.tf

Gabealmost 8 years ago

anyone aware of or use any tools to allow someone to require any version of a module as long as it’s not a major breaking change for terraform? for example in node i can require a version “^1.0.0” which will give me any 1.x.x version of a package but not 2.0.0

Erik Osterman (Cloud Posse)almost 8 years ago

oh that would be nice

Erik Osterman (Cloud Posse)almost 8 years ago

I haven’t seen any tools for that.

Erik Osterman (Cloud Posse)almost 8 years ago

The other tool I want is one for vendoring modules.

antonbabenkoalmost 8 years ago

Hi guys! I’ve just published automated process to publish searchable PDFs for terraform core and all official providers, so we can work while flying and offline 🙂 Here we go - https://github.com/antonbabenko/terraform-docs-as-pdf . Tooling may contain bugs, so please let me know by opening an issue, or submit PRs.

Erik Osterman (Cloud Posse)almost 8 years ago

I’d like to do this eventually for cloudposse/docs

Erik Osterman (Cloud Posse)almost 8 years ago

it’s a nice readable format

antonbabenkoalmost 8 years ago

I can now update my linkedin profile and add ghostscript and wkhtmltopdf. Both are terribly slow and demand a lot of resources to run.

Maarten van der Hoefalmost 8 years ago

wkhtmltopdf will for sure attract another batch of automated recruiters 🙂

antonbabenkoalmost 8 years ago

I need moooore spam from recruiters 🙂

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/hashicorp/terraform/pull/19066

Erik Osterman (Cloud Posse)almost 8 years ago

Upvote 😃

Lukasz Germanalmost 8 years ago

Hi guys, I'm new here. First of all I want to say 'thanks' for such a great collection of templates that you share. 🙂
I'm building a stack for couple of small backend apps written in Django. My plan is to use this: https://github.com/cloudposse/terraform-aws-ecs-web-app but I want to reduce costs by not using public/private subnets and NAT gateways. Here are the questions:
1. Is it possible to use this template with only 1 public subnet per app (I know that it's not recommended, but in this case costs are much more important than security)?
2. What other resources should I define? Can you provide an example on how to use this template?

Andriy Knysh (Cloud Posse)almost 8 years ago

hey @Lukasz German welcome

Andriy Knysh (Cloud Posse)almost 8 years ago

you deploy ecs-web-app into your own VPC (see https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L69)

Andriy Knysh (Cloud Posse)almost 8 years ago

and into your own subnets https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L71

Andriy Knysh (Cloud Posse)almost 8 years ago

it says private_subnet_ids, but it’s just a name, you can definitely provide just one public subnet Id, for example:

Andriy Knysh (Cloud Posse)almost 8 years ago

private_subnet_ids = ["subnet-XXXXXX"]

Andriy Knysh (Cloud Posse)almost 8 years ago

to create a VPC, you can use https://github.com/cloudposse/terraform-aws-vpc

Andriy Knysh (Cloud Posse)almost 8 years ago

to create subnets, you can use any of our modules https://github.com/cloudposse?utf8=%E2%9C%93&q=-subnets&type=&language=

Andriy Knysh (Cloud Posse)almost 8 years ago

here is an example on how to use vpc and subnets https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L36

Andriy Knysh (Cloud Posse)almost 8 years ago

(it’s for EKS, but will be similar for ECS)

Andriy Knysh (Cloud Posse)almost 8 years ago

you can set this to false to disable NAT gateways and save on cost https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L58

Andriy Knysh (Cloud Posse)almost 8 years ago

to create just one subnet, specify just one AZ here https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L48

Erik Osterman (Cloud Posse)almost 8 years ago

I’m also working on an example as we speak

Andriy Knysh (Cloud Posse)almost 8 years ago

Subnets are free so you can just create them in each AZ and use as needed

Erik Osterman (Cloud Posse)almost 8 years ago

for ECS in terraform-root-modules

Erik Osterman (Cloud Posse)almost 8 years ago

(will be ready by EOW)

Andriy Knysh (Cloud Posse)almost 8 years ago

NAT gateways are not free

midactsalmost 8 years ago

Looking at your .travis.yml files, how does travis know what to do for these steps?
I am unable to find where these steps processes are defined:
make terraform/install, make terraform/get-plugins, etc

Andriy Knysh (Cloud Posse)almost 8 years ago

@midacts it’s in the Makefile https://github.com/cloudposse/terraform-aws-vpc/blob/master/Makefile

Andriy Knysh (Cloud Posse)almost 8 years ago

which uses build-harness which has all of that stuff

Andriy Knysh (Cloud Posse)almost 8 years ago

https://github.com/cloudposse/build-harness

Andriy Knysh (Cloud Posse)almost 8 years ago

https://github.com/cloudposse/build-harness/blob/master/modules/terraform/Makefile

midactsalmost 8 years ago

I see. that makes more sense.
Thanks for the information.

Gabealmost 8 years ago

something for you guys to consider for the null label, two tags that i think are useful that i added to our implementation are last_updated_by and repo so we can see who the last person to apply terraform was and which repo the code lives in that maintains a resource

CaBeTuXalmost 8 years ago

Hi All!

CaBeTuXalmost 8 years ago

I have a tfstate on a existant AWS S3 bucket created manually, and now I can implement a module used to create a S3 bucket and DynamoDB to lock state....

CaBeTuXalmost 8 years ago

the question is: how I can migrate the tfstate from the original bucket to the new bucket? Or how I can apply changes into the original bucket manually created (to enable versioning and encrypt for example) without last the tfstate (because I have a production environment running)

CaBeTuXalmost 8 years ago

I'm trying this using terraform import, but I cant have good results...

Maarten van der Hoefalmost 8 years ago

@CaBeTuX if you remove the remote state directive in your terraform file, and run terraform init, your state should be available locally again.

Maarten van der Hoefalmost 8 years ago

then you can add the directive with your new bucket configured and run init again and it should be on there.
I'm not sure if it's possible in one step, but I'm sure 2 steps will work.

Andriy Knysh (Cloud Posse)almost 8 years ago

and there is a module for that https://github.com/cloudposse/terraform-aws-tfstate-backend

CaBeTuXalmost 8 years ago

@Maarten van der Hoef If I removed the backend directive do not lost the actual state? is not necessary copy the state from the bucket to my local?

Maarten van der Hoefalmost 8 years ago(edited)

you should always make a backup of your state just in case, but if you remove the remote state directive the state should be available again as local terraform.tfstate

CaBeTuXalmost 8 years ago

perfect! Thanks @Maarten van der Hoef @Andriy Knysh (Cloud Posse) I will try the module and removing the backend directive

Andriy Knysh (Cloud Posse)almost 8 years ago

i think you do terraform init on the S3 state first, then comment out the remote state, then do terraform init again - TF should offer you to import the state

Maarten van der Hoefalmost 8 years ago

exactly

CaBeTuXalmost 8 years ago(edited)

I'm trying to import the actual s3 BUCKET to my tfstate using 'terraform import' and apply the changes if the state for these bucket was different to the config

CaBeTuXalmost 8 years ago

but I cant have good results... so I will try the module and removing the backend directive

CaBeTuXalmost 8 years ago

thanks again

Andriy Knysh (Cloud Posse)almost 8 years ago

take a look here, maybe will help https://docs.cloudposse.com/reference-architectures/cold-start/#provision-tfstate-backend-project-for-root (it’s tricky to provision the remote state and store the state in the remote state when you don’t have the remote state yet 🙂 )

Andriy Knysh (Cloud Posse)almost 8 years ago

also here https://github.com/cloudposse/terraform-root-modules/tree/master/aws/tfstate-backend

CaBeTuXalmost 8 years ago

Good! Thanks for your help

antonbabenkoalmost 8 years ago

You can use local-exec provisioner to execute sed, which will uncomment desired remote state section in tf file after null_resource is being executed for the first time, which does nothing… 🧌

antonbabenkoalmost 8 years ago

hehe, @Andriy Knysh (Cloud Posse) I see you are doing similar with just sed in the docs.

Andriy Knysh (Cloud Posse)almost 8 years ago

yea, we used sed, but now have scripts that do all the steps automatically https://github.com/cloudposse/terraform-root-modules/tree/master/aws/tfstate-backend/scripts

Nathan Smithalmost 8 years ago

i’m having trouble using terraform to upgrade the engine version of an RDS instance that has a read replica

Nathan Smithalmost 8 years ago

a straight-up terraform apply fails because the read replica needs to be updated before the primary can be updated:

Nathan Smithalmost 8 years ago


[<http://staging.gladly.qa|staging.gladly.qa>] backing-services> terraform apply
...
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  ~ module.database.aws_db_instance.default
      engine_version: "9.6.8" => "9.6.9"

  ~ module.database.aws_db_instance.read_replica
      engine_version: "9.6.8" => "9.6.9"


Plan: 0 to add, 2 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.database.aws_db_instance.default: Modifying... (ID: staging)
  engine_version: "9.6.8" => "9.6.9"

Error: Error applying plan:

1 error(s) occurred:

* module.database.aws_db_instance.default: 1 error(s) occurred:

* aws_db_instance.default: Error modifying DB Instance staging: DBUpgradeDependencyFailure: One or more of the DB Instance's read replicas need to be upgraded: staging-read-replica-1
	status code: 400, request id: f18110e4-1b27-4d1e-bb07-3e9591d1ddbf

Nathan Smithalmost 8 years ago

some googling indicated that i should target the read replica and upgrade it first before updating the primary, but when i try targetting just the read replica, it picks up the primary too:

Nathan Smithalmost 8 years ago


[<http://staging.gladly.qa|staging.gladly.qa>] backing-services> terraform apply -target=module.database.aws_db_instance.read_replica
...
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  ~ module.database.aws_db_instance.default
      engine_version: "9.6.8" => "9.6.9"

  ~ module.database.aws_db_instance.read_replica
      engine_version: "9.6.8" => "9.6.9"


Plan: 0 to add, 2 to change, 0 to destroy.

Nathan Smithalmost 8 years ago

anyone know how to get around this?

Andriy Knysh (Cloud Posse)almost 8 years ago

can use terraform plan/apply -target=...

Nikola Velkovskialmost 8 years ago(edited)

the only thing that I can think of is doing it manually via click ops. And then applying. I haven't had problems like this before so maybe it is something in the modules that is causing this ?

Nathan Smithalmost 8 years ago

thanks, @Andriy Knysh (Cloud Posse), but when i try to -target the replica, it picks up the primary too

Nathan Smithalmost 8 years ago

thanks, @Nikola Velkovski i’m probably going to end up doing click ops for this

Nikola Velkovskialmost 8 years ago

also -target sometimes decides which other resources are chained together

Nikola Velkovskialmost 8 years ago(edited)

I mean it's not -target per se but amazon's api

Nathan Smithalmost 8 years ago

also, i like the term “click ops”… have never encountered it before, TIL!

Andriy Knysh (Cloud Posse)almost 8 years ago

ClickOps is a good addition to DevOps 🙂

Andriy Knysh (Cloud Posse)almost 8 years ago

maybe try this https://www.terraform.io/docs/commands/taint.html

Nikola Velkovskialmost 8 years ago

well, my life would have been better without knowing it 🙃

Nathan Smithalmost 8 years ago

it looks like taint will result in the replica db being destroyed and recreated which frightens me

Andriy Knysh (Cloud Posse)almost 8 years ago

yea

Andriy Knysh (Cloud Posse)almost 8 years ago

but it’s just a replica, isn’t it? 🙂

Nikola Velkovskialmost 8 years ago

chaosops FTW 😛

Nathan Smithalmost 8 years ago

it’s a read replica that our application actually uses for some read-only operations unfortunately

Andriy Knysh (Cloud Posse)almost 8 years ago

why not update both as the last TF plan shows?

Nathan Smithalmost 8 years ago

updating both fails with “Error modifying DB Instance staging: DBUpgradeDependencyFailure: One or more of the DB Instance’s read replicas need to be upgraded:…”

Andriy Knysh (Cloud Posse)almost 8 years ago

ah i see sorry

Nathan Smithalmost 8 years ago

no problem - i appreciate everyone’s feedback and help!

Erik Osterman (Cloud Posse)almost 8 years ago

Hot off the press: https://github.com/cloudposse/terraform-aws-ssm-tls-ssh-key-pair/

Erik Osterman (Cloud Posse)almost 8 years ago

(this is useful for bot accounts)

Erik Osterman (Cloud Posse)almost 8 years ago

chamber read -q atlantis atlantis_ssh_key > /dev/shm/id_rsa

Erik Osterman (Cloud Posse)almost 8 years ago

easily rotate SSH secrets by just tainting the resource

jamesalmost 8 years ago

what are the options for dealing with “default” resources, like a default route table and default network ACL?

jamesalmost 8 years ago

my understanding is that the terraform module aws_default_route_table makes it explicit that the resource can’t be destroyed, but otherwise using the regular aws_route_table would be fine

jamesalmost 8 years ago

is there some trap I’m setting up for myself if I take the latter option?

Erik Osterman (Cloud Posse)almost 8 years ago

our best practice is never to use any of the default resources in an account

Erik Osterman (Cloud Posse)almost 8 years ago

are you piggy backing on an existing infrastructure or starting fresh?

jamesalmost 8 years ago

Adopting an existing infrastructure

Erik Osterman (Cloud Posse)almost 8 years ago

aha ..

Erik Osterman (Cloud Posse)almost 8 years ago

well, one option is to define the resources and use terraform import

Erik Osterman (Cloud Posse)almost 8 years ago

just make sure the setting match

Erik Osterman (Cloud Posse)almost 8 years ago

run terraform plan until they sync up perfectly. then you have a baseline to affect change.

mrwackyalmost 8 years ago

except terraform import is lossy

mrwackyalmost 8 years ago

eg - you can import EC2 instances, but it might not notice or complain if you don't set all the parameters (like terminiation_protection).. So terraform import is good, but not perfect!

jamesalmost 8 years ago

that's what we're doing, just running into this ambiguity with aws_default_route_table and its ilk. I can import it with aws_route_table and get the plans to match up, just wondering if that will come back to bite me one day

jamesalmost 8 years ago

I guess it's probably not a big deal, nothing is permanent after all

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/chanzuckerberg/terraform-provider-bless/blob/master/README.md

Erik Osterman (Cloud Posse)almost 8 years ago

This looks amazing

Erik Osterman (Cloud Posse)almost 8 years ago

Keep secrets out of terraform state store

Erik Osterman (Cloud Posse)almost 8 years ago

Oh I missed the gist of this but still cool

Erik Osterman (Cloud Posse)almost 8 years ago

This is related to Netflix bless.

Erik Osterman (Cloud Posse)almost 8 years ago

I’ve added Foqal as a test to see how it goes over the next few weeks.

Erik Osterman (Cloud Posse)almost 8 years ago

It’s only in this channel right now.

Erik Osterman (Cloud Posse)almost 8 years ago

https://www.foqal.io/oss.html

Erik Osterman (Cloud Posse)almost 8 years ago

If you have any feedback (Good/bad), do let me know.

Erik Osterman (Cloud Posse)almost 8 years ago

or ping @Vlad Shlosberg 😃

Vlad Shlosbergalmost 8 years ago

@Vlad Shlosberg has joined the channel

Vlad Shlosbergalmost 8 years ago

yup im here 😄

Andriy Knysh (Cloud Posse)almost 8 years ago

hi @Vlad Shlosberg

Vlad Shlosbergalmost 8 years ago

hey

Vlad Shlosbergalmost 8 years ago

@Andriy Knysh (Cloud Posse)

dalekurtalmost 8 years ago

@Erik Osterman (Cloud Posse) I have a question, it may seem obvious but why Terraform over CloudFormation, if you’re planning to use AWS to host your infrastructure and services. Let me give some context, our CTO has mandated that the DevOps team to design, deploy and manage the SA using CloudFormation, the DevOps team is in opposition of this in favor of Terraform. We have to justify that decision.

Stevenalmost 8 years ago

@dalekurt I've had 2 main reasons: 1) Agnostic. You'll say that you're only going to use AWS so that doesn't matter. But that is not reality. In addition to AWS you'll use a notification system, version control, monitoring, etc.. By having a single tool that can manage many of these (can be extended for the ones it doesn't), you greatly reduce the amount of tooling and learning required. I've used Terraform for Pagerduty, Datadog, InfluxDB, Grafana, Github, and have plans to use it for other services. 2) Neither Terraform or CloudFormation supports all of AWS or new features as they are released. But I've found that generally Terraform supports features sooner. Anyone can add support for a feature or request one. And if CloudFormation supports something that Terraform doesn't, Terraform can run CloudFormation

dalekurtalmost 8 years ago

Thank you @Steven you've mirrored my thoughts exactly, I appreciate that.

dalekurtalmost 8 years ago

I'm on the right track.

Janalmost 8 years ago

Terraform is extensible

Janalmost 8 years ago

https://www.terraform.io/docs/providers/

Janalmost 8 years ago

Even if yiu only plan to use a single cloud provider there are loads of options for other services

Janalmost 8 years ago

And modular

Janalmost 8 years ago

Cf has also only just added config drift management

Janalmost 8 years ago

I have converted every Cf org I worked with to terraform

Janalmost 8 years ago

Always with lengthy deep dives into the pros and cons

dalekurtalmost 8 years ago

@Jan Did you do that manually, or with the import feature?

Janalmost 8 years ago

I have used import often but almost always write the tf from scratch

Janalmost 8 years ago

Whilst building the provisioning layer you have the best perspective to find flaws

Janalmost 8 years ago

With production systems often its a case of import and then run plan

Janalmost 8 years ago

If you see a planned change yiu have either missed something or what you are meant to have had diverged from the Cf code base

dalekurtalmost 8 years ago

Nice!

Maarten van der Hoefalmost 8 years ago

@dalekurt https://www.reddit.com/r/Terraform/comments/af4lsb/why_terraform_and_not_just_shell_scripts/edvflu9 This was written for Terraform opposed to shell, but also fully captures why Terraform is such a good tool.

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

Ever wish you could initialize terraform state backends using environment variables? (and without #terragrunt or other wrappers)

Erik Osterman (Cloud Posse)almost 8 years ago

Now you can! https://github.com/cloudposse/tfenv

Erik Osterman (Cloud Posse)almost 8 years ago


export TF_CLI_INIT_BACKEND_CONFIG_BUCKET=my-bucket
source <(tfenv)
terraform init

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

Combining tfenv with direnv and a task runner (e.g. make) gives ultimate flexibility without lock-in to one particular tool.

Andriy Knysh (Cloud Posse)almost 8 years ago

👍️

Maarten van der Hoefalmost 8 years ago

Hi Everyone, I am trying to fix a "value of 'count' cannot be computed" but I cannot pintpoint the problem.
When the module is applied together with a new ALB, I get a "'count' cannot be computed" which doesn't make sense to me as the count condition itself is not dependent of the alb listener resource.

https://github.com/blinkist/terraform-aws-airship-ecs-service/blob/a304a850ef734c80cb96e6ebe81f0bf3e0eec912/modules/alb_handling/main.tf#L118

Everything within the count condition is not the result of another resource. It is however a parameter coming from a merged map, but that should actually just work. @Andriy Knysh (Cloud Posse)

Nikola Velkovskialmost 8 years ago

click

Nikola Velkovskialmost 8 years ago

we have it constatly

Nikola Velkovskialmost 8 years ago

weird usually this happens with locals

Nikola Velkovskialmost 8 years ago

and I all see is vars

Andriy Knysh (Cloud Posse)almost 8 years ago

@Maarten van der Hoef counts with maps are not handled correctly by TF https://docs.cloudposse.com/troubleshooting/terraform-value-of-count-cannot-be-computed/

Andriy Knysh (Cloud Posse)almost 8 years ago

in your module, you provide a lookup map of all possible record types and then provide the desired record type in var.route53_record_type)

Andriy Knysh (Cloud Posse)almost 8 years ago

a quick fix (not ideal, but should work) would be

Andriy Knysh (Cloud Posse)almost 8 years ago

  count = "${var.create && var.load_balancing_type == "application" && ! var.redirect_http_to_https && var.route53_record_type != "NONE" ? 1 : 0 }"

Andriy Knysh (Cloud Posse)almost 8 years ago

it will skip the test for allowed types, but you do it in many other places anyway

Janalmost 8 years ago

What module should I be using to deploy an atlantis setup

Janalmost 8 years ago

I am using the geodesic ref arch if that makes a difference

joshmyersalmost 8 years ago

@Jan That is being worked on at the moment

Janalmost 8 years ago

this guy? https://github.com/cloudposse/geodesic-aws-atlantis

Andriy Knysh (Cloud Posse)almost 8 years ago

ha, thanks @UFC8P2WJG

joshmyersalmost 8 years ago

@Andriy Knysh (Cloud Posse) is a Terraform ninja 😉

joshmyersalmost 8 years ago

https://github.com/cloudposse/geodesic-aws-atlantis is going to be archived to be replaced with https://github.com/cloudposse/terraform-root-modules/pull/91

joshmyersalmost 8 years ago

but still ongoing work

joshmyersalmost 8 years ago

If you have bigger fish to fry for now, I’d leave the Atlantis stuff until it properly lands (hopefully a few days)

Janalmost 8 years ago

I wanted to get the k8s stuff out

Janalmost 8 years ago

butwaiting on our parent zone to get delegated

praveenalmost 8 years ago

Hi, Just checking if we have module for creating app service environment using terraform on Azure platform

praveenalmost 8 years ago

#terraform
Hi, Is there any opportunity to create app service environment in Azure platform using terraform?

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen https://www.terraform.io/docs/providers/azurerm/r/app_service.html

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) is app service plan & app service environment both the same?

Gonzalo Pecialmost 8 years ago

anyone know what is required to get provisioner "local-exec" to output to stdout while doing the action?

Gonzalo Pecialmost 8 years ago

I saw some resources do it, but I have a python script that is not showing anything

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen i’m not familiar with Azure, but looks like they are diff resources https://www.terraform.io/docs/providers/azurerm/r/app_service.html https://www.terraform.io/docs/providers/azurerm/r/app_service_plan.html

Andriy Knysh (Cloud Posse)almost 8 years ago

@Gonzalo Peci maybe this will help https://sweetops.slack.com/archives/CB6GHNLG0/p1546543043108000

Gonzalo Pecialmost 8 years ago

Hey thanks! but not exactly what im looking for

Gonzalo Pecialmost 8 years ago

Im trying to make it so my script in a null resource outputs it output to stdout douring run

Gonzalo Pecialmost 8 years ago

so we can see the progress

Gonzalo Pecialmost 8 years ago

We dont need to capture it

Gonzalo Pecialmost 8 years ago

we are toying with the idea of a asg-roll module which basically has script to roll the instances of an ASG group

Gonzalo Pecialmost 8 years ago

but we want to see the progress

Maarten van der Hoefalmost 8 years ago

does | tee /dev/stdout work ?

Gonzalo Pecialmost 8 years ago

instead of getting it all at the end

Gonzalo Pecialmost 8 years ago

the "when" terraform shows output seems pretty random, as sometimes does only after it finishes

Gonzalo Pecialmost 8 years ago

sometimes is doing it after some minute ¯\(ツ)/¯

Maarten van der Hoefalmost 8 years ago

or | tee /dev/stderr

Gonzalo Pecialmost 8 years ago

Ill try that, seems hacky but hacky that works is always awesome 😄

Erik Osterman (Cloud Posse)almost 8 years ago

https://www.reddit.com/r/Terraform/comments/afznb2/terraform_without_wrappers_is_awesome/

Erik Osterman (Cloud Posse)almost 8 years ago

the terraform gods have heard our prayers and answered.

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/dmlittle/scenery

Erik Osterman (Cloud Posse)almost 8 years ago

“A Terraform plan output prettifier” in go

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

(goodbye terraform-landscape hello scenery)

Gabealmost 8 years ago

ya’ll ever run into issues where cloning modules is slow from github?

Erik Osterman (Cloud Posse)almost 8 years ago

yea

Erik Osterman (Cloud Posse)almost 8 years ago

especially if you have A LOT of modules

Erik Osterman (Cloud Posse)almost 8 years ago

i mean, it can take minutes

lorenalmost 8 years ago

be glad if you aren't using codecommit 😂 github is soooo much faster, just about always

Gonzalo Pecialmost 8 years ago

I wish terraform cached the modules as it does with the plugins

Gonzalo Pecialmost 8 years ago

I dont think it would be that hard to do, but had not had time to look at the codebase

Gonzalo Pecialmost 8 years ago

it would make dev a lot faster at least

Erik Osterman (Cloud Posse)almost 8 years ago

Work on terraform provider for DocumentDB is progressing nicely: https://github.com/terraform-providers/terraform-provider-aws/issues/7077

Janalmost 8 years ago

https://github.com/cloudposse/terraform-root-modules/tree/master/aws/backing-services

Janalmost 8 years ago

what are all these services used for?

Gonzalo Pecialmost 8 years ago

bootstraping the root accounts

Gonzalo Pecialmost 8 years ago

check: https://github.com/cloudposse/reference-architectures

Janalmost 8 years ago

what I am looking for is what are the services used for

Janalmost 8 years ago

rd psql + mysql + elasticache + replicas

Gonzalo Pecialmost 8 years ago

AFAIK for KOPS

Janalmost 8 years ago

nope

Janalmost 8 years ago

kops does not use rds not redis / memcache

Janalmost 8 years ago

not by itself any how

Gonzalo Pecialmost 8 years ago

but some operators or etc might

Gonzalo Pecialmost 8 years ago

EG: https://github.com/cloudposse/terraform-root-modules/blob/master/aws/backing-services/elasticsearch.tf

Janalmost 8 years ago

I think its probably more for atlantis or something

Gonzalo Pecialmost 8 years ago

has references to KOPS

Gonzalo Pecialmost 8 years ago

and AFAIK it does not use elasticsearch either

Janalmost 8 years ago

yea

Janalmost 8 years ago

hence my asking

Janalmost 8 years ago


vpc_cidr_block = "${backing_services_cidr}"
zone_name = "${domain_name}"
region = "${aws_region}"
postgres_cluster_enabled = "false"
kops_metadata_enabled = "false"
rds_cluster_replica_enabled = "false"
rds_cluster_replica_cluster_identifier = "${namespace}-${stage}-postgres"

Janalmost 8 years ago

in templates/conf/backing-services/terraform.tfvars

Janalmost 8 years ago

mmmmm

Andriy Knysh (Cloud Posse)almost 8 years ago

@Jan those backing services are for applications (running on k8s for example), they not for the infra

Andriy Knysh (Cloud Posse)almost 8 years ago

those are just examples

Andriy Knysh (Cloud Posse)almost 8 years ago

you can provision all or some of them as needed

Gonzalo Pecialmost 8 years ago

that sounds odd, as you already have CP modules for those

praveenalmost 8 years ago

#terraform In Azure am sourcing virtual machine module to create multiple windows VM's. As part of the virtual machine module I also have virtual machine extensions which does not get attach to multiple instances created while sourcing base module

praveenalmost 8 years ago

here is the virtual machine base module code resource "azurerm_virtual_machine" "vm" {
count = "${length(var.system)}"
name = "${var.app_code}_${var.app_name}_${local.az_env}_${count.index}"
location = "${var.location}"
resource_group_name = "${var.resource_group_name}"
network_interface_ids = ["${element(azurerm_network_interface.nic.*.id, count.index)}"]
vm_size = "${var.vm_type}"
delete_os_disk_on_termination = true
delete_data_disks_on_termination = true

praveenalmost 8 years ago

and the extension as follows

praveenalmost 8 years ago

resource "azurerm_virtual_machine_extension" "set_execution_policy" {
name = "setexecutionpolicy-${lookup(var.system[count.index], "hostname")}"
location = "${var.location}"
resource_group_name = "${var.resource_group_name}"
virtual_machine_name = "${element(azurerm_virtual_machine.vm.*.name, count.index)}"
depends_on = ["azurerm_virtual_machine.vm"]

publisher = "Microsoft.Compute"
type = "CustomScriptExtension"
type_handler_version = "1.9"

settings = <<SETTINGS
{
"commandToExecute": "powershell.exe Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force"
}
SETTINGS
}

praveenalmost 8 years ago

I knoew am doing something wrong with virtual_machine_name = "${element(azurerm_virtual_machine.vm.*.name, count.index)}" in extension

praveenalmost 8 years ago

is there a way we can attach extensions to multiple instances created using base virtual machine module

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen we’ll take a look at ^

Andriy Knysh (Cloud Posse)almost 8 years ago

@Jan @Gonzalo Peci to give you more details on having backing-services in the root modules:

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) should I provide you the complete code or the snippet will suffice ?

Andriy Knysh (Cloud Posse)almost 8 years ago

1. root-modules is the resource catalog - everything you deploy in your environment(s) goes in there. CloudPosse root modules is just an example. Every company gets its own copy with only the resources they need

Janalmost 8 years ago

On my side currently im building modules for private dns zones

Janalmost 8 years ago

already done as such

Janalmost 8 years ago

then a terraform rendered k8s cluster spec

Janalmost 8 years ago

changing a modul for kops backing state

Janalmost 8 years ago

as I aklready have domain

Janalmost 8 years ago

var.domain_enabled

Janalmost 8 years ago

that actually helps

Andriy Knysh (Cloud Posse)almost 8 years ago(edited)

2. Those invocations of RDS, Redis, Elasticsearch in root-modules are more than just instantiating those modules. They are connected to the other resources and networks. For example, RDS/Redis/Elasticsearch security groups are connected to the kops/EKS/ECS security groups. kops VPC is used to peer to the backing services VPC

Andriy Knysh (Cloud Posse)almost 8 years ago(edited)

and all of that (and more) is codified in the root-modules, so those backing services are not just CP modules’ invocation, it’s more about connecting them together (network, DNS, SGs, etc) and provisioning the entire infra

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen you can send the code, we’ll take a look

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) I just sent you the code

Janalmost 8 years ago


hello world

Janalmost 8 years ago

or hit the + to the left of the text input and create a code snippet

i5okiealmost 8 years ago

in https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment ..

i5okiealmost 8 years ago

which files, and pushed by what?

Andriy Knysh (Cloud Posse)almost 8 years ago

you create a log bucket, assign it to the EB environment, and then beanstalk will push all logs from all instances (including your app) to the bucket

i5okiealmost 8 years ago

doesnt work tho.

i5okiealmost 8 years ago

also https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/main.tf#L609 this is not honoured

i5okiealmost 8 years ago

terraform created all the s3 buckets for each environment. but they are empty. and ELB logs are pushed to the AWS default of elb-logs-< your aws account number>

Andriy Knysh (Cloud Posse)almost 8 years ago

i’m not sure, but maybe ELB logs get pushed just to the default bucket (don’t remember)

i5okiealmost 8 years ago

in practice that is what is hapenning. im not really concerned about that tho. lol
im just curious about that one setting.

Andriy Knysh (Cloud Posse)almost 8 years ago

if you find any issues, please open a PR 🙂

i5okiealmost 8 years ago

thats assuming that I know enough to make changes lol

i5okiealmost 8 years ago

was just digging around in cli.. eb config is showing these settings here

i5okiealmost 8 years ago

i wonder if thats related

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

(cloudposse is not actively deploying any beanstalk clusters... we wrote these in 2016 for a few customers)

SweetOpsalmost 8 years ago

Are you using some of our terraform-modules in your projects? Maybe you could leave us a testimonial! It means a lot to us to hear from people like you.

praveenalmost 8 years ago

#terraform am trying to make the following resource optional as part of azure virtual machine base module

praveenalmost 8 years ago

resource "azurerm_network_interface_backend_address_pool_association" "nic" {
count = "${var.lb_bepool_IDs == "0" ? 0 : 1}"
network_interface_id = "${element(azurerm_network_interface.nic.*.id, count.index)}"
ip_configuration_name = "${var.app_code}${var.app_name}IP${count.index}"
backend_address_pool_id = "${var.lb_bepool_IDs}"
}

praveenalmost 8 years ago

with lb_bepool_IDs is defined in end code as lb_bepool_IDs = "${module.lb.backend_address_pool_id}"

praveenalmost 8 years ago

it throws the following error value of 'count' cannot be computed

Andriy Knysh (Cloud Posse)almost 8 years ago

ah yea, the famous error 🙂 take a look here https://docs.cloudposse.com/troubleshooting/terraform-value-of-count-cannot-be-computed/

praveenalmost 8 years ago

should I change the count decision to true or false?

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen there is no easy answer to that error. You need to play with <http://module.lb|module.lb> because it’s a dependency for "azurerm_network_interface_backend_address_pool_association" "nic"

Andriy Knysh (Cloud Posse)almost 8 years ago

you can share here the code for the module so we’d take a look if anything could be resolved fast

i5okiealmost 8 years ago

oh looks like terraform-aws-rds-cluster module outputs don’t work. in envvars of a beanstalk module.. i’m trying this:

i5okiealmost 8 years ago

and in plan or apply, its not wanting to create rds_db_name because ^ module.rds_cluster_…. is empty

i5okiealmost 8 years ago

when i do terraform state show… i can see these things under “module.rds_cluster_aurora_postgres.aws_rds_cluster.default”

i5okiealmost 8 years ago

i have no idea how to troubleshoot this

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

is the enabled flag set to "true"

Erik Osterman (Cloud Posse)almost 8 years ago

for the module.rds_cluster_aurora_postgres

Andriy Knysh (Cloud Posse)almost 8 years ago

@i5okie are you using this module https://github.com/cloudposse/terraform-aws-rds-cluster?

i5okiealmost 8 years ago

yes

Andriy Knysh (Cloud Posse)almost 8 years ago

and when you apply it, it should show all these outputs https://github.com/cloudposse/terraform-aws-rds-cluster/blob/master/outputs.tf

Andriy Knysh (Cloud Posse)almost 8 years ago

you see them?

i5okiealmost 8 years ago

under module.rds_cluster_aurora_postgres.aws_rds_cluster.default yes

Andriy Knysh (Cloud Posse)almost 8 years ago

you also using this https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment?

Andriy Knysh (Cloud Posse)almost 8 years ago

setting env vars here https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/blob/master/variables.tf#L349?

i5okiealmost 8 years ago

indeed

Andriy Knysh (Cloud Posse)almost 8 years ago

Did you check the beanstalk UI under environment settings if you have those values there?

i5okiealmost 8 years ago

they didn’t get added, and deployed failed, thats how i found out.

i5okiealmost 8 years ago

i’ve been using the normal postgres rds previously. trying aurora first time here.

Andriy Knysh (Cloud Posse)almost 8 years ago

Ok so the problem is the failed deployment?

i5okiealmost 8 years ago

no the problem is that terraform doesn’t understand what “RDS_DB_NAME”, “${module.rds_cluster_aurora_postgres.name}“,
is

Andriy Knysh (Cloud Posse)almost 8 years ago

It should be a map

Andriy Knysh (Cloud Posse)almost 8 years ago

Variable

i5okiealmost 8 years ago

and @Erik Osterman (Cloud Posse) i didn’t notice your question earlier. yes. it created the environment.

i5okiealmost 8 years ago

and it is

Andriy Knysh (Cloud Posse)almost 8 years ago

Let me show an example of that

i5okiealmost 8 years ago

i just didn’t copy the []

i5okiealmost 8 years ago(edited)

i’ve got a bunch of envvars in there already. i just copied the one line as example here.

i5okiealmost 8 years ago

terraform created all the other envvars except ones referring to ${module.rds_cluster_aurora_postgres. …}

Andriy Knysh (Cloud Posse)almost 8 years ago

this was working before https://github.com/cloudposse/terraform-aws-jenkins/blob/master/main.tf#L49

i5okiealmost 8 years ago

I’ll try it again tomorrow.

i5okiealmost 8 years ago

@Andriy Knysh (Cloud Posse) i don’t think map is the problem here.

Andriy Knysh (Cloud Posse)almost 8 years ago

ok, was the RDS cluster created?

i5okiealmost 8 years ago

yes i created the cluster first, then tried to apply targetting this one beanstalk module.

i5okiealmost 8 years ago

i’ve created the environment with manually entering the envvar values.
i’ll try changing them to the module outputs now and try to see if terraform will want to change envvars or not brb

i5okiealmost 8 years ago(edited)

hmm

i5okiealmost 8 years ago

maybe its fine

i5okiealmost 8 years ago

i’ll have to try again tomorrow.

i5okiealmost 8 years ago(edited)

i just remembered that the first time i tried, when i ran into this issue.. it finished created the rds cluster, but never finished adding the aurora instance.

Andriy Knysh (Cloud Posse)almost 8 years ago

yea, maybe there were some issues with creating the RDS instances

praveenalmost 8 years ago

#terraform , am working on creating azure virtual machine module. for which I am not able to make "azurerm_network_interface_backend_address_pool_association" optional. The intention is to make it optional is to source vm module for provisioning standalone VM, as well as for vm's behind load balancer

praveenalmost 8 years ago

resource "azurerm_network_interface_backend_address_pool_association" "nic" {
count = "${local.enabled}"
network_interface_id = "${element(azurerm_network_interface.nic.*.id, count.index)}"
ip_configuration_name = "${var.app_code}${var.app_name}IP${count.index}"
backend_address_pool_id = "${var.lb_bepool_IDs}"
}

praveenalmost 8 years ago

with locals as locals {
enabled = "${var.lb_enabled == "false" ? false : true }"

praveenalmost 8 years ago

am i doing something wrong here

Nikola Velkovskialmost 8 years ago

what's the error you are getting ?

praveenalmost 8 years ago

if am sourcing the module for deploying standalone instance the error is "module.vm.azurerm_network_interface_backend_address_pool_association.nic: Can not parse "backend_address_pool_id" as a resource id: Cannot parse Azure ID: parse : empty url"

praveenalmost 8 years ago

for instance behind lb the error is "module.vm.var.lb_bepool_IDs: variable lb_bepool_IDs in module vm should be type string, got list"

Nikola Velkovskialmost 8 years ago

can you show me the definition for the var lb_bepool_IDs ?

Nikola Velkovskialmost 8 years ago

variable "" {} etc..

praveenalmost 8 years ago

I have DM you the comeplete code

praveenalmost 8 years ago

variable "lb_bepool_IDs" {
type = "string"
}

Tacoalmost 8 years ago

Hello, I just found CloudPosse and joined the workspace. I am looking for a Terraform module for a a VPC that lets me start with a Direct Connect based VPC and Internet Gateway. Our IT department created these two assets and so I need to start with them, not a VPC of my own making and not the Default VPC. Does such a module exist?

Janalmost 8 years ago

hahaha

Janalmost 8 years ago

I just created that

Janalmost 8 years ago

Its a touch rough and I need to contribute it back

Janalmost 8 years ago

but can happily talk you through it

Tacoalmost 8 years ago

Nice! I'd like that very much

Janalmost 8 years ago

Are you on a tight deadline?

Janalmost 8 years ago

I have a few deadlines of my own to get out before I can clean that up and push it upstream

Tacoalmost 8 years ago

I have until the end of the month, so don't let me come between you and your deadlines.

Janalmost 8 years ago

oki cool

Janalmost 8 years ago(edited)

lemme talk you through it

Janalmost 8 years ago

I have a set cidr that was agreed upon with corp ITS

Tacoalmost 8 years ago(edited)

Sounds like me; I have a VPC with a CIDR block in four separate accounts, for Dev, Test, Stage and Prod

Janalmost 8 years ago

yea

Janalmost 8 years ago

so my tf module is like this

Janalmost 8 years ago


<http://vpc-accountname.division.cloud.company.com|vpc-accountname.division.cloud.company.com>
├── init.tf
├── outputs.tf
├── peering.tf
├── valiables.tf
└── vpc.tf

Janalmost 8 years ago

this is 100% the stock vpc module with the addition of a few things

Andriy Knysh (Cloud Posse)almost 8 years ago

@praveen so count = "${local.enabled}" is not working because

locals {
 enabled = "${var.lb_enabled == "false" ? false : true }" }

Andriy Knysh (Cloud Posse)almost 8 years ago

is wrong

Andriy Knysh (Cloud Posse)almost 8 years ago

should be enabled = "${var.lb_enabled == "false" ? 0 : 1 }"

praveenalmost 8 years ago

let me change it

praveenalmost 8 years ago

is it ok if I have the variable as follows

praveenalmost 8 years ago

variable "lb_enabled" {
description = "Set to false to prevent the module from creating any resources"
default = "false"
}

Tacoalmost 8 years ago

@Jan - When you say the "stock vpc module" do you mean the CloudPosse module here: https://github.com/cloudposse/terraform-aws-vpc?

Janalmost 8 years ago

https://github.com/cloudposse/terraform-aws-vpc + https://github.com/cloudposse/terraform-aws-dynamic-subnets + https://github.com/cloudposse/terraform-terraform-label

Tacoalmost 8 years ago

Ah, OK

Janalmost 8 years ago

Andriy Knysh (Cloud Posse)almost 8 years ago

welcome @Taco

Janalmost 8 years ago

then in the peering, which I still need to clean up and make redundant gw/vpn's

Tacoalmost 8 years ago

Thanks @Andriy Knysh (Cloud Posse)

Tacoalmost 8 years ago

OK, great, thanks! I look forward to the finished bits

Andriy Knysh (Cloud Posse)almost 8 years ago

we did not use Direct Connect before, so @Jan would be of much help here 🙂

Janalmost 8 years ago

Tacoalmost 8 years ago

I didn't even know about it until I came to my current position, so I'm still getting used to the idea of not creating a new VPC for each application/project

Janalmost 8 years ago

I need to extend it a bit

Janalmost 8 years ago

andf have it to redundant cgw's

Janalmost 8 years ago

and vpn's

Janalmost 8 years ago

but thats the bassics to all of it

Janalmost 8 years ago(edited)

I will make some time to commit it this week

Tacoalmost 8 years ago

Sounds like you've got your hands full

Janalmost 8 years ago

haha yea

Janalmost 8 years ago

😄

Tacoalmost 8 years ago

Thanks for your time, I'll keep checking in and I will explore your repositories; there's a lot of stuff...

Janalmost 8 years ago

just remind me

Janalmost 8 years ago

I will contribute it to cloudposse

Tacoalmost 8 years ago

Will do

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) as per your recommendations I did made the changes with no luck. Now I made the following changes but it it still not working

praveenalmost 8 years ago

resource "azurerm_network_interface_backend_address_pool_association" "nic" {
count = "${var.lb_enabled == "false" ? "${var.lb_enabled}" : "${length(azurerm_network_interface.nic.*.id)}"}"
network_interface_id = "${element(azurerm_network_interface.nic.*.id, count.index)}"
ip_configuration_name = "${var.app_code}${var.app_name}IP${count.index}"
backend_address_pool_id = "${var.lb_bepool_IDs}"
}

praveenalmost 8 years ago

variable "lb_bepool_IDs" {
type = "string"
default = ""
}

variable "lb_enabled" {
type = "string"
description = "Set to false to prevent the module from creating any resources"
default = "false"
}

praveenalmost 8 years ago

for instance without LB it throws error as " Can not parse "backend_address_pool_id" as a resource id: Cannot parse Azure ID: parse : empty url"

praveenalmost 8 years ago

for instance with LB it throws error as " module.vm.azurerm_network_interface_backend_address_pool_association.nic: azurerm_network_interface_backend_address_pool_association.nic: value of 'count' cannot be computed"

Andriy Knysh (Cloud Posse)almost 8 years ago

count                   = "${var.lb_enabled == "false" ? 0 : length(azurerm_network_interface.nic.*.id)}"

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) no luck. Same errors for both with LB & without LB as posted above

praveenalmost 8 years ago

DM you the complete code for your ref

Andriy Knysh (Cloud Posse)almost 8 years ago

will be back soon and take a look @praveen

praveenalmost 8 years ago

sure @Andriy Knysh (Cloud Posse)

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse) were you able to check my code

praveenalmost 8 years ago

@Andriy Knysh (Cloud Posse), just to be made aware that I see there is a bug with using count and making optional for resource azurerm_network_interface_backend_address_pool_association

praveenalmost 8 years ago

I got it fixed using deprecated argument load_balancer_backend_address_pool_ids

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/terraform-providers/terraform-provider-random/pull/52

Erik Osterman (Cloud Posse)almost 8 years ago

excited for this

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

(posted 1 day ago)

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

crazy how often that happens to me. when I need something, someone has already opened the pr.

Erik Osterman (Cloud Posse)almost 8 years ago

last week, I was about to go add build_timeout to our terraform-aws-codebuild module, but noticed Strech96 contributed it 2 weeks ago.

antonbabenkoalmost 8 years ago

https://github.com/terraformdns - should give some ideas how 0.12 will work in reality.

Gonzalo Pecialmost 8 years ago

Nice

joshmyersalmost 8 years ago

@antonbabenko the big question is going to be how much we all have to undo our Terraform hacks to date 🙈

antonbabenkoalmost 8 years ago(edited)

Not sure about everyone, but my hacks are usually around counts which are inside reusable modules. I don’t use complex types, or recursions in chains of modules. Users of modules will not see too many changes, because they will continue to operate with key/values in most cases, while infrastructure teams work on modules and internals. It will be pretty nice to get rid of jsonnet and finally make 100% featurefull s3 bucket resource module 🙂

joshmyersalmost 8 years ago

https://github.com/cloudposse/terraform-null-label/blob/master/main.tf 🙈

joshmyersalmost 8 years ago

It works and is super useful, but pretty sure if something is gonna break, it be that.

Erik Osterman (Cloud Posse)almost 8 years ago

🤣

Erik Osterman (Cloud Posse)almost 8 years ago

Sir @Jamie Nelson (BitFlight) will you come to our rescue once 0.12 GA?

Jamie Nelson (BitFlight)almost 8 years ago

Oui!

Jamie Nelson (BitFlight)almost 8 years ago

I tried to make it using all built in interpolation- instead of hacks that use blocks/maps etc

Jamie Nelson (BitFlight)almost 8 years ago

So I actually think it will survive the 0.12ga

Jamie Nelson (BitFlight)almost 8 years ago

But I also think I can finesse it once it is released

sarkisalmost 8 years ago

Serious question, do you ever consider not using terraform modules sometimes because they may overcomplicate the task at hand?

Gonzalo Pecialmost 8 years ago

Sure

Gonzalo Pecialmost 8 years ago(edited)

Simple stuff, sometimes is done without a module for us (the company I work at)

Erik Osterman (Cloud Posse)almost 8 years ago

@sarkis one of the things I’ve started doing more of is “localized modules”

Erik Osterman (Cloud Posse)almost 8 years ago

that is, sometimes it doesn’t make sense to have one-module-per-repo

Erik Osterman (Cloud Posse)almost 8 years ago

especially for highly esoteric business logic

Erik Osterman (Cloud Posse)almost 8 years ago

stuff that will never leave your org

Erik Osterman (Cloud Posse)almost 8 years ago

Here is an example: https://github.com/cloudposse/terraform-root-modules/tree/master/aws/root-dns

Gonzalo Pecialmost 8 years ago

We do that as well, to ensure the code is "composable" anyway or supports intrepolations for environments

Erik Osterman (Cloud Posse)almost 8 years ago

there’s a localized ns module.

Gonzalo Pecialmost 8 years ago

Similarly we have a repo of default-dns which setups SPF CNAMEs and other default stuff for all our registred domains

Gonzalo Pecialmost 8 years ago

some that are empty, but just so people dont use them to spam email

Gonzalo Pecialmost 8 years ago

it is a module so we can just easily spwan new ones (hopefully even easier on terraform 0.12) but it would not make sense to make that a "public" module outside of that repo, as it has no use

Gonzalo Pecialmost 8 years ago

I guess it really depends if you have a use for DRY or ensuring it meets some standard (interolation of environments, safe defaults, etc)

Gonzalo Pecialmost 8 years ago(edited)

we use data blocks all the time outside of modules, we try to avoid a bit more resources blocks

Ryan Rykealmost 8 years ago

hey dudes, hope you are all well. running into a weird issue that i havent seen.

resource "aws_vpc_peering_conection" "staging_peer" {
  peer_vpc_id = "vpc-7476xxx"
  vpc_id      = "${module.vpc.vpc_id}"
  auto_accept = "true"
}

gives me Error: aws_vpc_peering_conection.staging_peer: Provider doesn't support resource: aws_vpc_peering_conection

Gonzalo Pecialmost 8 years ago

Missing an N

Gonzalo Pecialmost 8 years ago

In connection

Ryan Rykealmost 8 years ago

ahhhhh hahaha 🔫

Ryan Rykealmost 8 years ago

what a putz

Gonzalo Pecialmost 8 years ago

🤣

Ryan Rykealmost 8 years ago

im not too proud...

Gonzalo Pecialmost 8 years ago

Hey sometimes we need some fresh eyes

Ryan Rykealmost 8 years ago

that was bad

johncblandiialmost 8 years ago

anyone around for some fargate chat? I can’t seem to get it to start using the cp modules

Erik Osterman (Cloud Posse)almost 8 years ago

hey!

Erik Osterman (Cloud Posse)almost 8 years ago

so oooooooo we finally have an e2e example

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/cloudposse/terraform-root-modules/tree/master/aws/ecs

giphyalmost 8 years ago

Erik Osterman (Cloud Posse)almost 8 years ago

this is deploying atlantis

Erik Osterman (Cloud Posse)almost 8 years ago

on fargate

Erik Osterman (Cloud Posse)almost 8 years ago

using our modules

johncblandiialmost 8 years ago

ok, great. checking

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

key thing.... make sure your repo has a buildspec.yaml

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

we provide one in the README.md of that example

johncblandiialmost 8 years ago

btw, a couple PRs on https://github.com/cloudposse/terraform-aws-ecs-alb-service-task are pending

johncblandiialmost 8 years ago

ah…so using terraform-aws-ecs-web-app

Erik Osterman (Cloud Posse)almost 8 years ago

yes, but terraform-aws-ecs-web-app is not required

Erik Osterman (Cloud Posse)almost 8 years ago

however, it shows you how to piece it all together

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

so if you don't want to use the ecs-web-app module, you can start with your own module

johncblandiialmost 8 years ago

i have the service integrated w/ the config generating

johncblandiialmost 8 years ago

using terraform-aws-ecs-alb-service-task

Erik Osterman (Cloud Posse)almost 8 years ago

https://github.com/cloudposse/terraform-aws-ecs-atlantis/pull/1

Erik Osterman (Cloud Posse)almost 8 years ago

here's how we are refactoring atlantis into a standalone ecs-task-as-a-module

Erik Osterman (Cloud Posse)almost 8 years ago

so a module is like a helm chart

Erik Osterman (Cloud Posse)almost 8 years ago

(also, a lot of PRs in the past week related to ECS)

Erik Osterman (Cloud Posse)almost 8 years ago

make sure you're on the latest versions

Erik Osterman (Cloud Posse)almost 8 years ago

tied up some lose ends

Erik Osterman (Cloud Posse)almost 8 years ago

added support for github webhooks

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

(also, i'm actively deploying this as we speak on a customer site! so recently "tested" 😃 )

johncblandiialmost 8 years ago

lol

johncblandiialmost 8 years ago

deploying atlantis?

Erik Osterman (Cloud Posse)almost 8 years ago

yep

Erik Osterman (Cloud Posse)almost 8 years ago

but our flavor

johncblandiialmost 8 years ago

yeah

johncblandiialmost 8 years ago

when a container definition changes, does it trigger a new deploy?

Erik Osterman (Cloud Posse)almost 8 years ago

johncblandiialmost 8 years ago

or an update?

johncblandiialmost 8 years ago

Erik Osterman (Cloud Posse)almost 8 years ago

we need to ignore changes on the container definition

johncblandiialmost 8 years ago

i changed ports and it didn’t show TF changes

johncblandiialmost 8 years ago

interesting

Erik Osterman (Cloud Posse)almost 8 years ago

so terraform is great for deploying static infrastructure

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

it is a p.o.s. for managing the SDLC of apps ontop of that infra

Erik Osterman (Cloud Posse)almost 8 years ago

our strategy is this...

Erik Osterman (Cloud Posse)almost 8 years ago

use CI/CD for all changes there after using the patch technique

Erik Osterman (Cloud Posse)almost 8 years ago

that's what the imagedefinitions.json is doing in the buildspec.yaml

Erik Osterman (Cloud Posse)almost 8 years ago

---------

Erik Osterman (Cloud Posse)almost 8 years ago

that said, before you go TOO far down this path, checkout #airship

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

they take a different approach to ours which might suit certain use-cases better

Erik Osterman (Cloud Posse)almost 8 years ago

that's run by @Maarten van der Hoef and I know @Jamie Nelson (BitFlight) is a big contributor

johncblandiialmost 8 years ago

coolio

Erik Osterman (Cloud Posse)almost 8 years ago


taint/atlantis:
        terraform taint -module atlantis_web_app.ecs_alb_service_task aws_ecs_task_definition.default

Erik Osterman (Cloud Posse)almost 8 years ago

so if I need to redeploy the definition, I have this

johncblandiialmost 8 years ago

ahh

Erik Osterman (Cloud Posse)almost 8 years ago(edited)

the constant challenge/strife with terraform and ECS is the task definition

Erik Osterman (Cloud Posse)almost 8 years ago

we can use the data provider to look up the current defintion, but then we break the cold start

Erik Osterman (Cloud Posse)almost 8 years ago

or we can ignore changes, but then we cannot easily update the task definition

Erik Osterman (Cloud Posse)almost 8 years ago

if we taint, and redeploy, we might revert the image that's current deployed.

Erik Osterman (Cloud Posse)almost 8 years ago

for our immediate use-case, this taint approach is working good enough without

Erik Osterman (Cloud Posse)almost 8 years ago

if you figure out some clever way around this, would love contributionss

Erik Osterman (Cloud Posse)almost 8 years ago

e.g. using SSM parameter store somehow

johncblandiialmost 8 years ago

well fargate is the new direction so I’ll definitely hit this wall and kick some tires on solutions

Gonzalo Pecialmost 8 years ago

But what is the challenge with the task? we have the service and task defined in terraform and it works without issues

Gonzalo Pecialmost 8 years ago

in any case, terraform is still POS for deploying this type of tasks imho

Janalmost 8 years ago

fargate is also expensive

Janalmost 8 years ago

and the sizing is somewhat inflexible (in comparison to k8s)

Gonzalo Pecialmost 8 years ago

They did that 50% price reduction not long ago

Gonzalo Pecialmost 8 years ago

I guess it has its usecase, I just dislike awsvpc from it, as it puts there some "magic" that does not exist on the docker universe and complicates things

Gonzalo Pecialmost 8 years ago

everyone was asking for overlay network support from them, and thye added awsvpc.... thanks AWS

Janalmost 8 years ago

Yea they did the same initially with aks

Janalmost 8 years ago

Was my first big issue with it

Janalmost 8 years ago

Because a very practical limit on the number of nodes and pods yiu can run

Janalmost 8 years ago

I managed to exhaust a test cluster during the aws summit when they announced it

Gonzalo Pecialmost 8 years ago

did they remove that now?

Janalmost 8 years ago

they support other cni's now as I understand

Janalmost 8 years ago

Im keen to see what the k8s control plane as a service looks like in a few months

Janalmost 8 years ago

alicloud will be adding kops native support mid this year (so says a birdie I know)

Janalmost 8 years ago

at which point there are 5 large k8s control plane as a service providers that if they get to the same version / feature set it would be awesome

Gonzalo Pecialmost 8 years ago(edited)

I would love more lover for docker-swarm 😞

Erik Osterman (Cloud Posse)almost 8 years ago

hot off the press! https://registry.terraform.io/modules/cloudposse/mq-broker/aws/0.1.0

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/tfmask

Janover 7 years ago

very nice addition!

Erik Osterman (Cloud Posse)over 7 years ago

dirty little hack for now

Janover 7 years ago

still

Erik Osterman (Cloud Posse)over 7 years ago

Feel like the terraform core needs something to combat this

Erik Osterman (Cloud Posse)over 7 years ago

🙇

Janover 7 years ago

yep

erikover 7 years ago

tfmask output

joshmyersover 7 years ago

Anyone hit https://github.com/hashicorp/terraform/issues/17048 and have a working workaround ?

Erik Osterman (Cloud Posse)over 7 years ago(edited)

how do we

this?

Erik Osterman (Cloud Posse)over 7 years ago

remove enabled?

Erik Osterman (Cloud Posse)over 7 years ago(edited)

(maybe share the module you’re working on for activemq)

joshmyersover 7 years ago

@Erik Osterman (Cloud Posse) Likely as it essentially fails when disabled (on first run anyway). If it was enabled and state written, and later enabled = "false" I suspect that may work

joshmyersover 7 years ago

For context - https://github.com/cloudposse/terraform-aws-mq-broker/pull/4/commits/3b3614976b8a7c18a22e3c9d939ffc23e2603fe1

Maciek Strömichover 7 years ago

Hi Terraformers, @Erik Osterman (Cloud Posse) pointed me here because maybe someone is doing SES click tracking with custom email link tags? Long story short I’m trying to get graphed CW metrics for different links from an email using provided by aws cloudwatch destination. Had anyone any success with more fine grained configuration besides general open/click metrics? I know that I could get stats I need by running either firehose -> s3 -> athena or sns -> lambda -> cloudwatch but maybe there’s an easier way going with provided cloudwatch iintegration but the SES monitoring docs suck big time and it’s trial and error for me currently to figure that out.

lliknartover 7 years ago

Hi everyone,
I took a look on your terraform modules regarding bucket S3 for log storage, cloudtrail and cloudtrail-s3-bucket (to attach a policy to a bucket)
I wonder how I can use those modules in my case.
I would like to create a global S3 to store all events coming from other AWS accounts.
The problem I need to solve is about the Policy. To allow multiple AWS accounts to write in a bucket located on one account, we need to add resources in the aws_iam_policy_document (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-set-bucket-policy-for-multiple-accounts.html)

To do so, I would like to get a list of AWS accounts as input (variable) and add them in the policy. Do you know how I can handle this ? Maybe there is a better way to do that...

Danover 7 years ago

Is anyone using RDS database migration service to create a read replica of the main DB in another region?

Andriy Knysh (Cloud Posse)over 7 years ago

@lliknart maybe this will help, here we have a CloudTrail bucket module with policies https://github.com/cloudposse/terraform-aws-cloudtrail-s3-bucket/blob/master/main.tf

Andriy Knysh (Cloud Posse)over 7 years ago

CloudTrail module https://github.com/cloudposse/terraform-aws-cloudtrail/blob/master/main.tf

Andriy Knysh (Cloud Posse)over 7 years ago

here we create the bucket and CloudTrail in the audit account (which collects all logs from all other accounts like prod, staging, etc. https://github.com/cloudposse/terraform-root-modules/blob/master/aws/audit-cloudtrail/main.tf

Andriy Knysh (Cloud Posse)over 7 years ago

and here we create CloudTrails for all other accounts pointing to the bucket in the audit account https://github.com/cloudposse/terraform-root-modules/blob/master/aws/cloudtrail/main.tf

Andriy Knysh (Cloud Posse)over 7 years ago

@Dan for Aurora, you can create a cross-region replica https://aws.amazon.com/about-aws/whats-new/2016/06/amazon-aurora-now-supports-cross-region-replication/ https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Replication.CrossRegion.html

lliknartover 7 years ago

@Andriy Knysh (Cloud Posse) Thank you, I didn't see the terraform-root-modules repo.
I wonder how it works when you add a new trail to your audit account ? How the policy is modified ?
In the terraform-aws-cloudtrail-s3-bucket module, it takes only one resource:


    resources = [
      "arn:aws:s3:::${module.label.id}/*",
]

Andriy Knysh (Cloud Posse)over 7 years ago

you mean a new bucket?

Andriy Knysh (Cloud Posse)over 7 years ago

it takes the bucket

lliknartover 7 years ago

If I know the name of your bucket, I can write my cloudtrail events to your bucket with this policy, right ?

lliknartover 7 years ago(edited)

of course I wouldn't have access to read it

Andriy Knysh (Cloud Posse)over 7 years ago

yes, you know the bucket, you add the bucket ARN to

resources = [
      "arn:s3:::${module.label.id}/*",
]

Danover 7 years ago

Does Terraform have an issue with pulling vpc IDs from 2 different regions?

Danover 7 years ago

When I try to pull from us-west-2

Danover 7 years ago

There's no.problem

Danover 7 years ago

But eu-central-1 gives me the vpc does not exist

Stevenover 7 years ago(edited)

@Dan You need to setup 2 providers. Since AWS providers are region specific

Danover 7 years ago

@Steven so do I then pull that data within that Terraform file?

Stevenover 7 years ago

@Dan You setup 2 aws providers (default one and an alias) for the 2 regions, then you can do 2 VPC data lookups (1 with each provider). Then use the results however you want

Danover 7 years ago

Yeah I got the first part. Not sure how to do the data lookup for the second vpc

Stevenover 7 years ago

@Dan This is assuming you need info from both regions in a single terraform run. Many times you don't and can just have separate terraform runs with different provider definitions

Danover 7 years ago

Yeah I'm trying to set up database migration service

Danover 7 years ago

And what to do it all in one

Danover 7 years ago

And just pull the subnets and vpc id

Danover 7 years ago

Even though I'm passing it as bsrs

Danover 7 years ago

Vara

Danover 7 years ago

Vars

Stevenover 7 years ago

Example VPC lookup specifing provider

Stevenover 7 years ago

data "aws_vpc" "vpc" {
provider = "aws.member"

filter {
name = "tag:Name"
values = ["${var.account_name}-mgmt"]
}

Stevenover 7 years ago

In this case there is an AWS provider with the alias 'member'

Danover 7 years ago

That's what I was missing! Now I have the provider alias must he defined by module

Danover 7 years ago

I got it

Danover 7 years ago

Provider = AWS.alias

Stevenover 7 years ago(edited)

If this is inside a module, then You define a provider construct in the module and have resources reference that. When the module is called you pass a a fully defined provider to the alias defined in the module

Stevenover 7 years ago

Time to head to work. There is a doc page on this, if you need more details

joshmyersover 7 years ago

If you are using Organizations, you can now have a master cloudtail for the whole org

joshmyersover 7 years ago

https://aws.amazon.com/about-aws/whats-new/2018/11/aws-cloudtrail-adds-support-for-aws-organizations/

joshmyersover 7 years ago(edited)

@lliknart sorry a bit late there

Danover 7 years ago

@Steven thank you so much for your help!

Danover 7 years ago

If I'm doing multiple resource s3 bucket objects writing to the same bucket... Do they overwrite?

Danover 7 years ago

I want 3 different files stored in s3 in the same bucket

johncblandiiover 7 years ago

same “path” to the file? yes, it’ll overwrite

Danover 7 years ago

Same bucket

Samuliover 7 years ago

@Erik Osterman (Cloud Posse) could you merge https://github.com/cloudposse/terraform-aws-ecs-alb-service-task/pull/17 if its ok and you have the time.

joshmyersover 7 years ago(edited)

@Samuli That could be squashed into a single commit IMO

nutellinoitover 7 years ago

joshmyersover 7 years ago

Sorry wrong person!

nutellinoitover 7 years ago

😄

praveenover 7 years ago

#terraform , am trying to add a user group using terraform config and it does not accept backslash

praveenover 7 years ago

variable "accessgroup" {
default = "domain\user1"
}

Erik Osterman (Cloud Posse)over 7 years ago

did you try \\

Erik Osterman (Cloud Posse)over 7 years ago

the \u says to escape the u

praveenover 7 years ago

yes, I tried 4 back slashes, 2,3 and also 1 forward slashes

praveenover 7 years ago

with no luck

praveenover 7 years ago

just trued it once again with no luck

Erik Osterman (Cloud Posse)over 7 years ago

what’s the error message?

praveenover 7 years ago

* azurerm_virtual_machine_scale_set.vmss: Code="VMExtensionProvisioningError" Message="VM has reported a failure when processing extension 'dsc-wqwdwebfe'. Error message: \"The DSC Extension received an incorrect input: Compilation errors occurred while processing configuration 'WindowsStaplesDefault'. Please review the errors reported in error stream and modify your configuration code appropriately. A Using variable cannot be retrieved. A Using variable can be used only with Invoke-Command, Start-Job, or InlineScript in the script workflow. When it is used with Invoke-Command, the Using variable is valid only if the script block is invoked on a remote computer. Exception calling \"InvokeWithContext\" with \"2\" argument(s): \"A Using variable cannot be retrieved. A Using variable can be used only with Invoke-Command, Start-Job, or InlineScript in the script workflow. When it is used with Invoke-Command, the Using variable is valid only if the script block is invoked on a remote computer.\" A Using variable cannot be retrieved. A Using variable can be used only with Invoke-Command, Start-Job, or InlineScript in the script workflow. When it is used with Invoke-Command, the Using variable is valid only if the script block is invoked on a remote computer.\n\nAnother common error is to specify parameters of type PSCredential without an explicit type. Please be sure to use a typed parameter in DSC Configuration, for example:\n\n configuration Example {\n param([PSCredential] $UserAccount)\n ...\n }.\nPlease correct the input and retry executing the extension.\"."

joshmyersover 7 years ago(edited)

Please use code blocks when posting things like this into Slack, helpful for organisation

praveenover 7 years ago

sure, can you give me link to code blocks

joshmyersover 7 years ago

praveenover 7 years ago

do we have an example for allowing backslash in terraform

johncblandiiover 7 years ago

Does this help, @praveen? https://www.terraform.io/docs/configuration/interpolation.html#built-in-functions

johncblandiiover 7 years ago

See the yellow box

Samuliover 7 years ago

Could someone enlighten me on what's the difference between terraform-terraform-label and terraform-null-label?

Andriy Knysh (Cloud Posse)over 7 years ago

@Samuli for simple use-cases, there are no real difference, they will do the same things… except for:

Andriy Knysh (Cloud Posse)over 7 years ago

1. terraform-null-label uses null_data_source to do additional things like additional tags and context (if you need those)

Andriy Knysh (Cloud Posse)over 7 years ago

2. terraform-terraform-label is much simpler implementation (terraform-terraform-label was forked from terraform-null-label before a lot of additional functionality was added to -null-label)

Andriy Knysh (Cloud Posse)over 7 years ago

so if you use basic label to uniquely name resources, both will do the same

Andriy Knysh (Cloud Posse)over 7 years ago

if you want context, additional params like environment, additional tags (needed for tagging some AWS resources like Autoscaling Groups, which have diff tag format), then use null-label

johncblandiiover 7 years ago

@Erik Osterman (Cloud Posse) can we get your blessing on @wbrown43’s PR? https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/pull/73

We need it released for some other work

wbrown43over 7 years ago

@wbrown43 has joined the channel

Erik Osterman (Cloud Posse)over 7 years ago

one sec

Erik Osterman (Cloud Posse)over 7 years ago

✅️

Erik Osterman (Cloud Posse)over 7 years ago

released 0.9.0

johncblandiiover 7 years ago

💥

Erik Osterman (Cloud Posse)over 7 years ago

sorry for the delay! always ping me here if blocked

giphyover 7 years ago

Andriy Knysh (Cloud Posse)over 7 years ago

@Erik Osterman (Cloud Posse) there is another PR https://github.com/cloudposse/terraform-aws-elastic-beanstalk-environment/pull/72

johncblandiiover 7 years ago(edited)

I’ve increased the vpc limit and the interface endpoints. Any ideas what else I need to increase to get things rolling?


Error: Error applying plan:
2 error(s) occurred:
* module.stack.module.vpc.module.vpc.aws_vpc_endpoint.dynamodb: 1 error(s) occurred:
* aws_vpc_endpoint.dynamodb: Error creating VPC Endpoint: VpcEndpointLimitExceeded: The maximum number of VPC endpoints has been reached.

* module.stack.module.vpc.module.vpc.aws_vpc_endpoint.s3: 1 error(s) occurred:
* aws_vpc_endpoint.s3: Error creating VPC Endpoint: VpcEndpointLimitExceeded: The maximum number of VPC endpoints has been reached.

Nehaover 7 years ago

Hello all. question : does terraform allow enabling aws cloudtrail in another sub account while being in the main billing account?

Andriy Knysh (Cloud Posse)over 7 years ago

Hey @Neha

Andriy Knysh (Cloud Posse)over 7 years ago

yes it’s possible, here is an example

Andriy Knysh (Cloud Posse)over 7 years ago

provision cloudtrail and the bucket in audit account https://github.com/cloudposse/terraform-root-modules/blob/master/aws/audit-cloudtrail/main.tf

Andriy Knysh (Cloud Posse)over 7 years ago

thanks @UFC8P2WJG

Andriy Knysh (Cloud Posse)over 7 years ago

then in other accounts (prod, staging, etc.) provision cloudtrails and point them to the bucket in audit https://github.com/cloudposse/terraform-root-modules/blob/master/aws/cloudtrail/main.tf#L33

Andriy Knysh (Cloud Posse)over 7 years ago

we separate audit from the main billing account (to allow only a few people to access it), but they could be the same

Nehaover 7 years ago(edited)

gotcha. audit is the other subaccount where we want to enable cloudtrail

Andriy Knysh (Cloud Posse)over 7 years ago

where we store all the logs in the bucket

Andriy Knysh (Cloud Posse)over 7 years ago

for security and compliance reasons

Nehaover 7 years ago

that reminds me- can we do the same with GuardDuty? enabling it in another account while being in the billing account?

Andriy Knysh (Cloud Posse)over 7 years ago

we did not work with GuardDuty. What resources does it require?

Nehaover 7 years ago

I guess what I'm asking is, is that process only for cloudtrail? or it could be applied to other aws resources?

Andriy Knysh (Cloud Posse)over 7 years ago

so, we usually separate ALL resources into different AWS account per environment -> prod, staging, dev, testing are in separate acccounts

Andriy Knysh (Cloud Posse)over 7 years ago

look here https://docs.cloudposse.com/reference-architectures/notes-on-multiple-aws-accounts/, useful videos at the end

Nehaover 7 years ago

GuardDuty just requires enabling it. but we have cloudwatch set up that is targetted to an sns rule and we're forwarded any/all alerts that come in to guardDuty

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

sounds like you want just one GuardDuty and all alerts coming to it from different accounts

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

not sure how it (GuardDuty) works, but probably will require setting some cross-account permissions

johncblandiiover 7 years ago

looks like the EFS module is borked.


* module.efs.output.mount_target_ids: At column 3, line 1: conditional operator cannot be used with list values in:

${local.enabled ? aws_efs_mount_target.default.*.id : list("") }
* module.efs.output.mount_target_dns_names: At column 3, line 1: conditional operator cannot be used with list values in:

${local.enabled ? aws_efs_mount_target.default.*.dns_name : list("") }
* module.efs.output.network_interface_ids: At column 3, line 1: conditional operator cannot be used with list values in:

${local.enabled ? aws_efs_mount_target.default.*.network_interface_id : list("") }
* module.efs.output.mount_target_ips: At column 3, line 1: conditional operator cannot be used with list values in:

${local.enabled ? aws_efs_mount_target.default.*.ip_address : list("") }

Erik Osterman (Cloud Posse)over 7 years ago

crap 😃 use the previous release

Erik Osterman (Cloud Posse)over 7 years ago

@joshmyers was just adding some things

johncblandiiover 7 years ago

yup

Erik Osterman (Cloud Posse)over 7 years ago

we'll get that fixed tonight

johncblandiiover 7 years ago

0.7.1 works

Andriy Knysh (Cloud Posse)over 7 years ago

there are some comments about it https://github.com/cloudposse/terraform-aws-efs/pull/21#issuecomment-456954156

Andriy Knysh (Cloud Posse)over 7 years ago

(easy fix)

btaiover 7 years ago

looking at this module: https://github.com/cloudposse/terraform-aws-multi-az-subnets/blob/master/public.tf

btaiover 7 years ago

is there a benefit to having a route table per az subnet?

Erik Osterman (Cloud Posse)over 7 years ago

I cannot recall if there was a technical reason or just trying to keep it symmetrical

Erik Osterman (Cloud Posse)over 7 years ago

looking at it right now, it seems like we could get by with a single route table for public and a single route table for private

Erik Osterman (Cloud Posse)over 7 years ago

the key thing is we need to have one NGW per AZ

btaiover 7 years ago

why is that @Erik Osterman (Cloud Posse)

Erik Osterman (Cloud Posse)over 7 years ago

for HA

btaiover 7 years ago

how does that work?

Erik Osterman (Cloud Posse)over 7 years ago

let's say we deploy one NGW

btaiover 7 years ago

theres a possibility a nat gateway can become unavailable?

Erik Osterman (Cloud Posse)over 7 years ago

we have instances in us-west-2a, us-west-2b and us-west-2c

Erik Osterman (Cloud Posse)over 7 years ago

and we have one ngw in us-west-2a

Erik Osterman (Cloud Posse)over 7 years ago

all azs can use that ngw

Erik Osterman (Cloud Posse)over 7 years ago

but if 2a goes off line, then 2b and 2c are all affected

Erik Osterman (Cloud Posse)over 7 years ago

so from a networking perspective, we want to maintain HA.

btaiover 7 years ago

i see

btaiover 7 years ago

that makes sense

btaiover 7 years ago

since the nat gateway lives inside the subnet?

Erik Osterman (Cloud Posse)over 7 years ago

yea, sorta. So a subnet cannot span AZs. and then the NGW is attached to a subnet.

btaiover 7 years ago

do you need a nat gateway for public subnets?

Erik Osterman (Cloud Posse)over 7 years ago

only private ones need to do NAT

btaiover 7 years ago

why does your tf have it for public subnets?

Erik Osterman (Cloud Posse)over 7 years ago

I think we have an IGW for public ones

btaiover 7 years ago

https://github.com/cloudposse/terraform-aws-multi-az-subnets/blob/master/public.tf#L85

btaiover 7 years ago

fyi

Erik Osterman (Cloud Posse)over 7 years ago

aha, so you provision the NGW on a public subnet

Erik Osterman (Cloud Posse)over 7 years ago

then private subnets route through it

btaiover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

if the NGW was on a private network, it would make no difference

Erik Osterman (Cloud Posse)over 7 years ago

I was going to say, you could use a NGW on a private subnet if you wanted traffic from that subnet to egress to a particular network on a specific IP

Erik Osterman (Cloud Posse)over 7 years ago(edited)

but I am not sure if that's techncially possible since NGWs require an EIP.

btaiover 7 years ago

i see

btaiover 7 years ago

yeah

btaiover 7 years ago

thanks, that helps alot

Erik Osterman (Cloud Posse)over 7 years ago

There are a lot of subnet strategies. Especially as the organization gets larger, there will be stricter subnet allocations

Erik Osterman (Cloud Posse)over 7 years ago

Our modules are great in a "cold start" scenario where there aren't a lot of other conflicting subnets.

Erik Osterman (Cloud Posse)over 7 years ago

I know @Jan is working on a different subnet module strategy.

Erik Osterman (Cloud Posse)over 7 years ago

Also, we have a few subnet modules for different kinds of allocations.

btaiover 7 years ago

im actually going single k8s cluster in a vpc

Erik Osterman (Cloud Posse)over 7 years ago

What we're missing is a preallocated/manual subnet strategy, where users specify their own subnet CIDRs.

btaiover 7 years ago

so the vpc i just have split out to half public/half private subnets

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-root-modules/tree/master/aws/eks

btaiover 7 years ago

pretty simple, and dependent services will just vpc peer

Erik Osterman (Cloud Posse)over 7 years ago

Have you seen the example by @Andriy Knysh (Cloud Posse) ?

btaiover 7 years ago

pretty nice actually

btaiover 7 years ago

have you guys not had any problems

btaiover 7 years ago

with module dependencies?

Erik Osterman (Cloud Posse)over 7 years ago

I think this works well from a cold-start

Erik Osterman (Cloud Posse)over 7 years ago

no "count of" issues

Erik Osterman (Cloud Posse)over 7 years ago

but I could be mistaken. 😃

btaiover 7 years ago

meaning

btaiover 7 years ago

module "eks_cluster" {
  source                  = "git::<https://github.com/cloudposse/terraform-aws-eks-cluster.git?ref=tags/0.1.1>"
  namespace               = "${var.namespace}"
  stage                   = "${var.stage}"
  name                    = "${var.name}"
  attributes              = "${var.attributes}"
  tags                    = "${var.tags}"
  vpc_id                  = "${module.vpc.vpc_id}"
  subnet_ids              = ["${module.subnets.public_subnet_ids}"]
  allowed_security_groups = ["${distinct(compact(concat(var.allowed_security_groups_cluster, list(module.eks_workers.security_group_id))))}"]
  allowed_cidr_blocks     = ["${var.allowed_cidr_blocks_cluster}"]
  enabled                 = "${var.enabled}"
}

btaiover 7 years ago

if we take a look at this module

btaiover 7 years ago

it uses module.vpc.vpc_id

btaiover 7 years ago

so on initial terraform apply

btaiover 7 years ago

have you guys not ran into the problem where the eks_cluster module will spin up concurrently with the vpc module

Erik Osterman (Cloud Posse)over 7 years ago

I haven't used this one personally

btaiover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

We mostly using kops

Erik Osterman (Cloud Posse)over 7 years ago

some gke

btaiover 7 years ago

because i know you can’t use depends_on within a module

Erik Osterman (Cloud Posse)over 7 years ago

yea... we know all too well

Erik Osterman (Cloud Posse)over 7 years ago

haha

Erik Osterman (Cloud Posse)over 7 years ago

https://docs.cloudposse.com/troubleshooting/terraform-value-of-count-cannot-be-computed/

btaiover 7 years ago

ill give this a shot though

Erik Osterman (Cloud Posse)over 7 years ago

@Andriy Knysh (Cloud Posse) knows it very well. ping him if you get stuck.

johncblandiiover 7 years ago

man

johncblandiiover 7 years ago

that depends_on is on my last nerve

johncblandiiover 7 years ago

so wish .12 would drop!

btaiover 7 years ago

soon i think

johncblandiiover 7 years ago

so they keep saying 🙂

btaiover 7 years ago

i know

johncblandiiover 7 years ago

I’ve resigned to “eventual” 😄

btaiover 7 years ago

https://twitter.com/hashicorp/status/1013799656999006209?lang=en

johncblandiiover 7 years ago

right

btaiover 7 years ago

yeah so like i was saying, this is as clean as it gets when writing terraform: https://github.com/cloudposse/terraform-root-modules/blob/master/aws/eks/eks.tf

Erik Osterman (Cloud Posse)over 7 years ago

🙇

btaiover 7 years ago

but my first thought is if it will provision everything in the correct order without depends_on working for modules

johncblandiiover 7 years ago

literally using that one right now

johncblandiiover 7 years ago

so long as it isn’t computing, references to other modules seem to work decently

Erik Osterman (Cloud Posse)over 7 years ago

sooooo terraform seems to infer order pretty well

Erik Osterman (Cloud Posse)over 7 years ago

yea

johncblandiiover 7 years ago


  cluster_name                       = "${module.eks_cluster.eks_cluster_id}"

johncblandiiover 7 years ago

^ that

johncblandiiover 7 years ago

toss something in a count and 💥

Erik Osterman (Cloud Posse)over 7 years ago

haha

johncblandiiover 7 years ago

because it does count before generating resources

btaiover 7 years ago

yeah

Erik Osterman (Cloud Posse)over 7 years ago

@johncblandii did you end up using our our EKS modules?

johncblandiiover 7 years ago

sure did

johncblandiiover 7 years ago

editing the cluster right now 🙂

Erik Osterman (Cloud Posse)over 7 years ago

💪

johncblandiiover 7 years ago

tied efs into it too

Erik Osterman (Cloud Posse)over 7 years ago

cool (we'll get that EFS bug fixed soon)

johncblandiiover 7 years ago

vpc -> subnets -> eks -> workers

^ cp stack ftw 😉

johncblandiiover 7 years ago

< np

btaiover 7 years ago

nested modules havent been an issue?

btaiover 7 years ago

for you guys?

Erik Osterman (Cloud Posse)over 7 years ago(edited)

what I love about our EKS module is how easily you can create multiple types of node pools with full customization

btaiover 7 years ago

you just output output

btaiover 7 years ago

when you says multiple node pools

johncblandiiover 7 years ago

yeah

johncblandiiover 7 years ago

gets verbose until .12 where you can output the module itself

btaiover 7 years ago

you mean private subnet instances , public subnet instances?

Erik Osterman (Cloud Posse)over 7 years ago

no, so you could create a GPU node pool, a high compute node pool, high memory node pool, spot instance node pool, etc

btaiover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

all part of the same cluster

btaiover 7 years ago

can i do public/private too?

Erik Osterman (Cloud Posse)over 7 years ago

yea, i don't see why not (but haven't tested that)

Erik Osterman (Cloud Posse)over 7 years ago

....and generally wouldn't recommend public anything except for ALBs 😃

Erik Osterman (Cloud Posse)over 7 years ago

AWS supports NLBs now

Erik Osterman (Cloud Posse)over 7 years ago

and k8s as well

Andriy Knysh (Cloud Posse)over 7 years ago

@btai the EKS example works good

Andriy Knysh (Cloud Posse)over 7 years ago

No explicit depends on

Andriy Knysh (Cloud Posse)over 7 years ago

Terraform does it automatically

btaiover 7 years ago

@Andriy Knysh (Cloud Posse) i figured 😛

btaiover 7 years ago

how would you do multiple node pools?

btaiover 7 years ago

just multiple module eks workers?

Andriy Knysh (Cloud Posse)over 7 years ago

Yes

Andriy Knysh (Cloud Posse)over 7 years ago

And add its security groups to the cluster security group

johncblandiiover 7 years ago

good example https://github.com/cloudposse/terraform-aws-eks-workers/blob/master/examples/complete/main.tf

johncblandiiover 7 years ago

just imagine that configured differently for different types

btaiover 7 years ago

how do you deploy your pods to the correct node pools?

Andriy Knysh (Cloud Posse)over 7 years ago

🧐

btaiover 7 years ago

say a pod needs to go on a GPU instance?

johncblandiiover 7 years ago

(disappear)

johncblandiiover 7 years ago

I’m a k8s noob; struggling this minute to be exact, lol

btaiover 7 years ago

i am as well, just a few months

johncblandiiover 7 years ago

weeks for me

johncblandiiover 7 years ago

definitely dazed; (maybe a month)

johncblandiiover 7 years ago(edited)

trying to rebuild jenkins in here now 🙂 (for efs vs ebs)

Andriy Knysh (Cloud Posse)over 7 years ago

Probably by tagging the nodes, then k8s has labels and annotations to select the required nodes for pods

johncblandiiover 7 years ago

ahhhh…yes. I forgot about tagging

btaiover 7 years ago

thats right

btaiover 7 years ago

@Andriy Knysh (Cloud Posse) is there a list of resources that need to have the <http://kubernetes.io/cluster/cluster_name|kubernetes.io/cluster/cluster_name> tag?

erikover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

this is freaking amazing. lets give 👏 to @Andriy Knysh (Cloud Posse)

Erik Osterman (Cloud Posse)over 7 years ago

246 code reviews i the past 90 days

giphyover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

with an average 1 hour turnaround!!

johncblandiiover 7 years ago

ridiculous!

Erik Osterman (Cloud Posse)over 7 years ago(edited)

and that's well over 500 CRs in the past 90 days

Erik Osterman (Cloud Posse)over 7 years ago

we're a small company. this astounds me.

johncblandiiover 7 years ago

indeed

Andriy Knysh (Cloud Posse)over 7 years ago

thanks guys 🙂

Andriy Knysh (Cloud Posse)over 7 years ago

@btai as far as I know, these two tags are required for EKS:

Andriy Knysh (Cloud Posse)over 7 years ago

for workers https://github.com/cloudposse/terraform-aws-eks-workers/blob/master/main.tf#L2

Andriy Knysh (Cloud Posse)over 7 years ago

for cluster https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L33

Andriy Knysh (Cloud Posse)over 7 years ago

as was described in the docs

Andriy Knysh (Cloud Posse)over 7 years ago

@johncblandii https://github.com/cloudposse/terraform-aws-efs/releases/tag/0.8.1

giphyover 7 years ago

Erik Osterman (Cloud Posse)over 7 years ago

Latest module: https://github.com/cloudposse/terraform-aws-vpn-connection

Erik Osterman (Cloud Posse)over 7 years ago

Create site-to-site VPN connections

btaiover 7 years ago

https://github.com/cloudposse/terraform-aws-eks-workers/blob/master/main.tf

btaiover 7 years ago

what is the purpose of the join in role = "${join("", aws_iam_role.default.*.name)}"

Erik Osterman (Cloud Posse)over 7 years ago

that’s when dealing with counts for enablement/disablement of a resource

Erik Osterman (Cloud Posse)over 7 years ago

if a count=0, aws_iam_role.default.0.name would error

Erik Osterman (Cloud Posse)over 7 years ago

the splat operator * is required

Erik Osterman (Cloud Posse)over 7 years ago

we call this the “join-splat” pattern

Erik Osterman (Cloud Posse)over 7 years ago

https://www.google.com/search?q=join-splat+cloudposse&oq=join-splat+cloudposse&aqs=chrome..69i57j69i60l3.6109j0j1&sourceid=chrome&ie=UTF-8

btaiover 7 years ago

yeah i realized you guys are putting count enables everywhere

btaiover 7 years ago

makes sense

Erik Osterman (Cloud Posse)over 7 years ago

yea, makes it easier to enable/disable functionality

Erik Osterman (Cloud Posse)over 7 years ago(edited)

when composing modules in other modules

Igor Rodionovover 7 years ago

Check this up. @antonbabenko created a list with terraform best practice.
https://www.terraform-best-practices.com/

Gonzalo Peciover 7 years ago

sidetracking but nice find gitbooks

Gonzalo Peciover 7 years ago

Any tips for a tool to generate docs out of markdown? We want to have a website for our terraform modules repo markdown and other tools

Gonzalo Peciover 7 years ago

looking for something simpel

Stevenover 7 years ago(edited)

@Gonzalo Peci There are programs to convert markdown to other formats. But are you looking for something that would collect the doc for all your modules?

Gonzalo Peciover 7 years ago

Yeah, more like live collect from a branch

Gonzalo Peciover 7 years ago

I guess, similar to what gitbooks does

Gonzalo Peciover 7 years ago

or github pages

lorenover 7 years ago

i've used both mkdocs and sphinx, both are pretty simple

lorenover 7 years ago

well, calling sphinx "simple" is probably not accurate i guess. but once past the initial learning curve, to where you have CI generating the html for the static site, actually maintaining the docs is quite simple

lorenover 7 years ago

there are all sorts of static site generators, many have plugins for IDEs, so you can see right in your editor how it will render

lorenover 7 years ago

mkdocs, sphinx, hugo, jekyll, etc etc

lorenover 7 years ago

pelican

Erik Osterman (Cloud Posse)over 7 years ago(edited)

we use hugo for docs.cloudposse.com

Gonzalo Peciover 7 years ago

Ill give them a look, thanks for the suggestions

joshmyersover 7 years ago

mkdocs is great for general kinda runbook/index sites

Erik Osterman (Cloud Posse)over 7 years ago(edited)

@Maarten van der Hoef ❤️ vuepress for static sites… checkout airship.tf

btaiover 7 years ago

@Andriy Knysh (Cloud Posse) have you seen this before?

* module.eks_workers.data.aws_ami.eks_worker: data.aws_ami.eks_worker: UnauthorizedOperation: You are not authorized to perform this operation.

btaiover 7 years ago

Trying to get the latest EKS ami from the Amazon account

Andriy Knysh (Cloud Posse)over 7 years ago

no, i did not

Andriy Knysh (Cloud Posse)over 7 years ago

are you using our example?

btaiover 7 years ago

data "aws_ami" "eks_worker" {
  filter {
    name   = "name"
    values = ["${var.eks_worker_ami_name_filter}"]
  }

  most_recent = true
  owners      = ["602401143452"] # Amazon
}

Andriy Knysh (Cloud Posse)over 7 years ago

under what user are you provisioning the cluster?

btaiover 7 years ago

an admin user

Andriy Knysh (Cloud Posse)over 7 years ago

hmm, maybe something changed on AWS side

Andriy Knysh (Cloud Posse)over 7 years ago

if you don’t resolve it, I’ll take a look later today

btaiover 7 years ago

so I’m assuming a role (to switch AWS accounts) and im wondering if thats the reason why?

Andriy Knysh (Cloud Posse)over 7 years ago

What permissions does the role have?

btaiover 7 years ago

so the master account has no permissions

btaiover 7 years ago

but im assuming a role into another account (where the provisioning actually takes place)

btaiover 7 years ago

and that role has admin

btaiover 7 years ago

I set the profile for the backend

btaiover 7 years ago

hmm

btaiover 7 years ago

i wonder if i need to set hte profile for the provider too

btaiover 7 years ago

@Andriy Knysh (Cloud Posse) that was it

johncblandiiover 7 years ago

how hard would it be to override the label format with cp modules?

johncblandiiover 7 years ago

Note to self: do not delete your state when testing TF before destroying resources. 🤦‍♂️🏽

btaiover 7 years ago

@Erik Osterman (Cloud Posse) we need a route table per nat gateway correct?

Erik Osterman (Cloud Posse)over 7 years ago

So looking at the code yesterday, I couldn't see where that requirement was implied or required. The underlying requirement is one subnet per AZ and therefore one NGW per AZ.

johncblandiiover 7 years ago(edited)

anyone hit this when starting up a Fargate container? (using cp modules)

CannotStartContainerError: API error (500): failed to initialize logging driver: failed to create Cloudwatch log stream: ResourceNotFoundException: The specified log group does not exist. status code:

Erik Osterman (Cloud Posse)over 7 years ago

hrm

Erik Osterman (Cloud Posse)over 7 years ago

and you create the log group?

johncblandiiover 7 years ago

nah. thought the module would, but guess i should add that into the TF?

Erik Osterman (Cloud Posse)over 7 years ago

it depends which modules you use

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-ecs-web-app/blob/master/main.tf#L17-L19

johncblandiiover 7 years ago

makes sense

Erik Osterman (Cloud Posse)over 7 years ago

our "web app" module is more opinionated and creates it

Erik Osterman (Cloud Posse)over 7 years ago

many people choose not to use the web app module and go around it

johncblandiiover 7 years ago

yeah…going around it and seemed to have left that part out. 🙂

johncblandiiover 7 years ago

but it tries to connect to one which i didn’t provide so that was odd

johncblandiiover 7 years ago

thought it’d just ignore it

johncblandiiover 7 years ago(edited)

ahh….i see.


variable "log_options" {
  type        = "map"
  description = "The configuration options to send to the `log_driver`"

  default = {
    "awslogs-region" = "us-west-2"

    "awslogs-group" = "default"

    "awslogs-stream-prefix" = "default"
  }
}

btaiover 7 years ago

@Andriy Knysh (Cloud Posse) how are you installing aws-iam-authenticator on your EKS masters?

btaiover 7 years ago

using the terraform kubernetes provider ?

jeffreyover 7 years ago(edited)

hey guys, i'm running into an issue where my backend seems like it's being executed after another role has been assumed. i have a setup where an admin account can assume roles into multiple environment accounts. while setting up dynamodb locking for the remote state file, i came across this:


terraform {
  required_version = ">= 0.11.3"
  backend "s3" {
    bucket                  = "<redacted>"
    dynamodb_table          = "terraform_locks"
    encrypt                 = true
    key                     = "infra/dev/vpc/terraform.tfstate"
    region                  = "us-east-1"
    shared_credentials_file = "~/.aws/admin-credentials"
  }
}

provider "aws" {
  region                  = "us-east-1"
  shared_credentials_file = "~/.aws/admin-credentials"
  assume_role {
    role_arn     = "<redacted>"
    session_name = "Terraform"
  }
}

i have a dynamodb table existing in the admin account, but NOT the dev account (this is the environment in my example). however i get an error about required resources not being found, but once i create the same dynamodb table in the dev account, everything works fine and i see the lock being created. anyone have an idea what's going on here?

jeffreyover 7 years ago

the terraform docs state:

Due to the assume_role setting in the AWS provider configuration, any management operations for AWS resources will be performed via the configured role in the appropriate environment AWS account. The backend operations, such as reading and writing the state from S3, will be performed directly as the administrator's own user within the administrative account.

Erik Osterman (Cloud Posse)over 7 years ago

so fwiw, there's a role_arn supported by the backend configuration

Erik Osterman (Cloud Posse)over 7 years ago

that's what we use

Erik Osterman (Cloud Posse)over 7 years ago

we explicitly specify the role_arn for both the provider and for the backend

jeffreyover 7 years ago

So if you plan on executing the backend in the admin account where you're running terraform from, you should specify that account as the role?

jeffreyover 7 years ago

Appreciate the quick response!

Erik Osterman (Cloud Posse)over 7 years ago

in our case, we have one bucket per account ("share nothing")

Erik Osterman (Cloud Posse)over 7 years ago

we sometimes do cross-account to lookup outputs from other modules

Andriy Knysh (Cloud Posse)over 7 years ago

@btai re: how are you installing aws-iam-authenticator on your EKS masters?

Andriy Knysh (Cloud Posse)over 7 years ago

you don’t

btaiover 7 years ago

Oh?

Andriy Knysh (Cloud Posse)over 7 years ago

EKS comes with it already installed

Andriy Knysh (Cloud Posse)over 7 years ago

you need to do two things:

btaiover 7 years ago

I installed it on my local machine

Andriy Knysh (Cloud Posse)over 7 years ago

1. Install it locally to be able to use kubectl with it

Andriy Knysh (Cloud Posse)over 7 years ago

2. Update kubecfg to use it

btaiover 7 years ago

Ohh I think I need to do #2

btaiover 7 years ago

Thanks

Andriy Knysh (Cloud Posse)over 7 years ago

for #1, if you use geodesic, you are good to go (https://github.com/cloudposse/geodesic/blob/master/packages.txt#L3, https://github.com/cloudposse/packages/tree/master/vendor/aws-iam-authenticator)

Andriy Knysh (Cloud Posse)over 7 years ago

for #2, kubeconfig gets generated here https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/kubeconfig.tpl#L24

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/outputs.tf#L1

btaiover 7 years ago

Thanks!

integratorzover 7 years ago

Hello Everyone! I am currently using terraform to launch infrastructure into an already existing vpc.

integratorzover 7 years ago

I am having trouble figuring out how to use an existing vpc id to deploy a resource. Any suggestions?

Stevenover 7 years ago

You can do a data lookup for the VPC id

Andriy Knysh (Cloud Posse)over 7 years ago

@integratorz if you deploy into an existing VPC, you should know its ID, or at least some tags to do data lookup as @Steven mentioned

Andriy Knysh (Cloud Posse)over 7 years ago

then use the ID in all other modules, e.g. https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L68

Andriy Knysh (Cloud Posse)over 7 years ago

lookup VPC by tags https://github.com/cloudposse/terraform-root-modules/blob/master/aws/eks-backing-services-peering/main.tf

integratorzover 7 years ago

If I know the vpc id how would I go about specifying it in the config?

integratorzover 7 years ago(edited)

for instance I can't just put vpc_id = "vpc-xxxxxx"

Kritover 7 years ago

@integratorz What’s the context? What are you trying to do exactly?

integratorzover 7 years ago

@Krit I am working on automating deployments of new servers into an existing VPC. I was actually able to get that working but am now having trouble getting the host to join to the AWS Hosted AD Domain.

Kritover 7 years ago

@integratorz Good stuff. Are you getting any errors?

integratorzover 7 years ago

Well when I

terraform apply

integratorzover 7 years ago

Everything gets provisioned then I get a timeout error at the end after about 5 minutes

integratorzover 7 years ago

Wow wouldn't you know it

integratorzover 7 years ago(edited)

I had a file prevision that was causing terraform to hang

integratorzover 7 years ago

so wasn't actually "not" joining the domain

integratorzover 7 years ago

was just never getting to that point

giphyover 7 years ago

integratorzover 7 years ago

me right now^

Kritover 7 years ago

I’m looking into your iam-user module and I was wondering if there’s a way to loop this and create a batch of users from a list. As far as I can understand I cant use count with a TF module, and for/for each loops are not available until TF 0.12.. Any advice is welcome!

Erik Osterman (Cloud Posse)over 7 years ago

You can technically use count, but we don’t recommend it.

Erik Osterman (Cloud Posse)over 7 years ago

If the count changes, terraform will destroy/create all resources which is ugly.

Erik Osterman (Cloud Posse)over 7 years ago

Our strategy is to invoke the module once for each user. We create a file per user.

Erik Osterman (Cloud Posse)over 7 years ago(edited)

This strategy works really well with #atlantis. Since each user add is a PR.

Erik Osterman (Cloud Posse)over 7 years ago

Then to remove a user from the environment, we just revert the PR.

Erik Osterman (Cloud Posse)over 7 years ago

Here’s a demo: https://github.com/cloudposse/root.cloudposse.co/tree/master/conf/users

Kritover 7 years ago

Got it, this is probably what I’m doing as well, as a list would indeed be risky in case of an error.
Great, and you’re sending out an email with the output.

Erik Osterman (Cloud Posse)over 7 years ago

Yea, that sends a transactional email. Though I think there’s a bug with that whereby it runs during plan as well because it uses the external data provider.

Kritover 7 years ago(edited)

So count can be used with modules as well? I stumbled upon a years old TF ticket requesting this very thing, and it’s still open

Erik Osterman (Cloud Posse)over 7 years ago

No, count cannot be used with modules

Erik Osterman (Cloud Posse)over 7 years ago

but you can pass a list of users to a module and have the iam resource generate N of them

Erik Osterman (Cloud Posse)over 7 years ago

we didn’t implement that in the module for the aforementioned reasons 😃

Kritover 7 years ago

Got it, I misinterpreted what you initially said. Thanks for the help!

Erik Osterman (Cloud Posse)over 7 years ago

No prob! We’re here to unblock you.

btaiover 7 years ago

hey my eks pods (aws-node-*) are constantly in a crashloopbackoff state and when I try to get the logs, I get

Error from server: Get https://<private_ip>:10250/containerLogs/kube-system/aws-node-tp9jn/aws-node?follow=true: dial tcp <private_ip>:10250: i/o timeout

btaiover 7 years ago

any ideas?

btaiover 7 years ago

i suppose i can add a bastion node

sarkisover 7 years ago(edited)

@btai without more context to me that looks like a port not accepting traffic - not too comfortable with EKS yet but i'd assume some security group issue

btaiover 7 years ago(edited)

i’ve gotten into the EKS worker node w/ a bastion server

btaiover 7 years ago(edited)

this is the error log im getting for aws-node pods

{"log":"ERROR: logging before flag.Parse: W0128 21:05:18.233802      13 client_config.go:533] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.\n","stream":"stderr","time":"2019-01-28T21:05:18.23463547Z"}
{"log":"Failed to communicate with K8S Server. Please check instance security groups or http proxy setting","stream":"stdout","time":"2019-01-28T21:05:48.268072298Z"}

btaiover 7 years ago

@Andriy Knysh (Cloud Posse) i noticed in your eks example you’re spinning up your eks workers in public subnets, I’ve spun them up in private subnets im wondering if thats causing the issue

Erik Osterman (Cloud Posse)over 7 years ago

-------

Erik Osterman (Cloud Posse)over 7 years ago(edited)

any suggestions here on how we should handle this? https://github.com/cloudposse/terraform-aws-dynamic-subnets/pull/31

lorenover 7 years ago(edited)

Use aws_route instead of the inline route schema, make the route optional, be sure to output the route table ids, let the user add routes in a separate module?

Erik Osterman (Cloud Posse)over 7 years ago

🤦

Erik Osterman (Cloud Posse)over 7 years ago

good suggestion. we'll try that.

lorenover 7 years ago

The inline route is in public.tf, but not present in private

Erik Osterman (Cloud Posse)over 7 years ago

yea, we try to never do this, but this one slipped by.

lorenover 7 years ago

The issue with deleting the route might be related to this, https://github.com/terraform-providers/terraform-provider-aws/issues/5631

lorenover 7 years ago

We've submitted the linked pr to fix that one, but it's blocked pending the 2.0 release, due to a change in behavior (for backwards compatibility in 1.x)

Erik Osterman (Cloud Posse)over 7 years ago

@squidfunk have you met @Maarten van der Hoef? He’s the author behind #airship , another well “terraform module as a product”

Erik Osterman (Cloud Posse)over 7 years ago

@squidfunk is maintaining this module: https://github.com/squidfunk/terraform-aws-cognito-auth

antonbabenkoover 7 years ago

@squidfunk Your module looks like very solid piece of code! Maybe I will need it in the future.

squidfunkover 7 years ago

Thanks, glad to hear!

squidfunkover 7 years ago

Haven't met @Maarten van der Hoef yet though 🙂 I've just started abstracting services into Terraform modules. @antonbabenko feel free to drop me a note if you run into any problems or have feedback!

Maciek Strömichover 7 years ago

@squidfunk props for the additional headers in web app tightening security

squidfunkover 7 years ago

@Maciek Strömich thanks - absolutely necessary in my opinion, otherwise the door to XSS/CSRF is wide open.

Maarten van der Hoefover 7 years ago

Hi @squidfunk I'm in the tropics and not touching code by rule of law here. Happy to take a look at your stuff when I'm back, I currently have a simple Cognito implementation with the ALB here: https://airship.tf/guide/ecs_service/load_balancing.html#application-lb-cognito-authentication

squidfunkover 7 years ago

@Maarten van der Hoef I'll also take a look at your stuff 🙂 Maybe I can draw some inspiration. Enjoy your vacation!

joshmyersover 7 years ago

hey @squidfunk I note that you aren’t using a aws_cognito_identity_provider in your module. You pass a name around for one. Is it assumed you have already set on up?

btaiover 7 years ago

anyone using EKS with the kubernetes provider by providing the necessary config from your EKS resource?

btaiover 7 years ago

i believe the EKS resource is missing client_cert and client_key as outputs?

provider "kubernetes" {
  host = "<https://104.196.242.174>"

  client_certificate     = "${file("~/.kube/client-cert.pem")}"
  client_key             = "${file("~/.kube/client-key.pem")}"
  cluster_ca_certificate = "${file("~/.kube/cluster-ca-cert.pem")}"
}

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

we did not use kubernetes provider for the EKS module, used these resources https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/kubectl.tf

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

all those attributes for kubernetes provider are optional (client_certificate, client_key, etc.)

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

instead, you can provide kubeconfig, e.g. https://github.com/cloudposse/terraform-aws-kops-iam-authenticator-config/blob/master/main.tf#L17

Andriy Knysh (Cloud Posse)over 7 years ago(edited)

which for the EKS cluster gets generated here https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/outputs.tf#L1

btaiover 7 years ago

@Andriy Knysh (Cloud Posse) i wanted to avoid using config_path because it would require exporting the kubeconfig to my local path for the new cluster

btaiover 7 years ago(edited)

I guess i want it to work independently of whats running in my local (someone who doesnt have kubectl can still run terraform apply)

Andriy Knysh (Cloud Posse)over 7 years ago

if you use aws-iam-authenticator, the kubeconfig still needs to include this command https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/kubeconfig.tpl#L24

Andriy Knysh (Cloud Posse)over 7 years ago

also, the resource does not export anything else for auth except certificate_authority https://www.terraform.io/docs/providers/aws/r/eks_cluster.html#attributes-reference

btaiover 7 years ago

i see, so ill need to use a null_resource to export the cluster config

Andriy Knysh (Cloud Posse)over 7 years ago

yes

Andriy Knysh (Cloud Posse)over 7 years ago

once you export kubeconfig, then you can use either kubernetes provider or https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/kubectl.tf#L30 to apply the config map

btaiover 7 years ago(edited)

annoying thing is when I run aws eks update-kubeconfig --name {cluster_name} --profile {aws_profile}, that kube config user needs

env:
- name: AWS_PROFILE
  value: {aws_profile}

appended to it

btaiover 7 years ago

ah one of the newest aws cli versions have the fix 😎

btaiover 7 years ago

https://github.com/aws/aws-cli/commit/1a391a295d680e972b231633b2440dfc1ef79b20

johncblandiiover 7 years ago

anyone use the ecs cli to deploy via docker-compose files? I’m just curious if it is worth exploring

praveenover 7 years ago

Hi, am working on adding windows domain administrator group to a server using DSC as an extension for terraform config. As part of terraform DSC config I am passing the argument as following

praveenover 7 years ago

"access_group": "${local.accessgroup}"

praveenover 7 years ago

with local as accessgroup = "${replace(var.accessgroup, "_", "\\\\")}"

praveenover 7 years ago

and passing the value as accessgroup = "domain_groupname"

praveenover 7 years ago

but it fails with the following error

praveenover 7 years ago

\"DSC Configuration 'WindowsStaplesDefault' completed with error(s). Following are the first few: PowerShell DSC resource MSFT_GroupResource failed to execute Test-TargetResource functionality with error message: Could not find a principal with the provided name [quilldevecomweb\\sg-quillecmweb-quilldotcom-support] The SendConfigurationApply function did not succeed. LCM failed to start desired state configuration manually.\"."

Andriy Knysh (Cloud Posse)over 7 years ago

@praveen is it for Azure?

praveenover 7 years ago

yes @Andriy Knysh (Cloud Posse)

praveenover 7 years ago

it is for Azure platform

integratorzover 7 years ago

Hello, I am currently working on spinning up ec2 instances in AWS. I am wondering if there is a good way to attach an encrypted EBS volume to windows server's C drive?

Tobias Hoellrichover 7 years ago

Good evening. My tf uses the terraform-aws-modules/security-group/aws module to setup a default security group. Right after I cloudposse/elasticsearch/aws:0.2.0 to define an Elasticsearch cluster and make use of the security group. Roughly it looks like this:

module "securitygroup" {
  source = "terraform-aws-modules/security-group/aws//modules/elasticsearch"

  name                = "${var.aws_env}_elasticsearch_default"
  vpc_id              = "${local.opsworks_vpc_id}"
  ingress_cidr_blocks = ["${local.opsworks_vpc_cidr_block}"]
}

module "elasticsearch" {
  source  = "cloudposse/elasticsearch/aws"
  version = "0.2.0"

  security_groups = ["${module.securitygroup.this_security_group_id}"]

Tobias Hoellrichover 7 years ago

During plan/apply I get the error:

Error: Error running plan: 1 error(s) occurred: * module.elasticsearch.aws_security_group_rule.ingress_security_groups: aws_security_group_rule.ingress_security_groups: value of 'count' cannot be computed

Tobias Hoellrichover 7 years ago

Somehow the ES module does not detect the dependency and does not know it has to wait for the outcome of the SG creation.
I used the same sequence in other places without issues.
Do you know a way around?

Tobias Hoellrichover 7 years ago

I can use the terraform ... -target module.securitygroup option to create the SG in a first run and then call apply a 2nd time, which creates Elasticsearch without issues.
And alternatively I can put the SG creation in a separate module, but I like the idea of keeping these together.
Thanks for any ideas.

Erik Osterman (Cloud Posse)over 7 years ago(edited)

Yes, 2-phased apply is basically your only option

Andriy Knysh (Cloud Posse)over 7 years ago

@Tobias Hoellrich TF has troubles calculating counts between modules. Try to just create a SG using https://www.terraform.io/docs/providers/aws/r/security_group.html and provide it to module "elasticsearch" - it could work

Andriy Knysh (Cloud Posse)over 7 years ago

another approach, if you use a consistent naming (e.g. by using https://github.com/cloudposse/terraform-null-label), you know the names and IDs of all resources in advance. So instead of providing the ID of the SG to the elasticsearch module, you can provide the same ID from the label module (e.g. https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L97)

Andriy Knysh (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-eks-cluster/blob/master/examples/complete/main.tf#L17

Kritover 7 years ago

@Tobias Hoellrich Look into TF’s overrides, I believe this might give you the most elegant solution. Just put the ES module part into a separate file and name it override.tf or postfix it with _override.tf so that it’s merged last, after everything else is created.
https://www.terraform.io/docs/configuration/override.html

Tobias Hoellrichover 7 years ago

Excellent - thanks for the replies, gentlemen. 👍️

Tobias Hoellrichover 7 years ago(edited)

And for the records:
- using a plain resource "aws_security_group" did not work and caused the same 'count' cannot be computed error
- override.tf also did not work and caused the same error

Tobias Hoellrichover 7 years ago

I ended up moving a bunch of security groups into a separate module which was applied before the ES module. Tks again.

Alecover 7 years ago

Morning! I was trying to use terraform-aws-alb-target-group-cloudwatch-sns-alarms and got a bunch of errors that were due to me copy/pasting the example straight from the page, which defaulted to an older release with issues, do you normally update examples with versions?

joshmyersover 7 years ago

@Alec We strive to keep the examples up to date but alas, there are too many modules to keep on top of

joshmyersover 7 years ago

PRs welcome, or open an issue and we can have a look

Erik Osterman (Cloud Posse)over 7 years ago

https://github.com/cloudposse/terraform-aws-ecs-web-app

Erik Osterman (Cloud Posse)over 7 years ago

Here’s a working example

Alecover 7 years ago

Thanks @Erik Osterman (Cloud Posse) -- I'm actually going to use that for another project, and I did successfully get it working once I noticed the 0.1.0 tag in the git ref -- I'll submit a PR shortly. I'm still learning how this is all structured, but it's becoming much more familiar. Appreciate all your guys work.

Erik Osterman (Cloud Posse)over 7 years ago

thanks @Alec

Erik Osterman (Cloud Posse)over 7 years ago(edited)

Also, here’s a complete example from our “Service Catalog” that we actively maintain and deploy: https://github.com/cloudposse/terraform-root-modules/tree/master/aws/ecs

Bogdanover 7 years ago

rbadilloover 7 years ago

team, any idea if this is coming soon ?
https://github.com/terraform-providers/terraform-provider-aws/labels/service%2Froute53resolver

lorenover 7 years ago

pr's been open for a while, they haven't been merging much in the way of new features lately, https://github.com/terraform-providers/terraform-provider-aws/pull/6574

lorenover 7 years ago

just docs, bugs, cleanup, and 0.12 prep mostly

rbadilloover 7 years ago

make sense

rbadilloover 7 years ago

thanks @loren

December 2018 Browse by date February 2019