#geodesic (2024-05)
Discussions related to https://github.com/cloudposse/geodesic
Archive: https://archive.sweetops.com/geodesic/
2024-05-01
v2.10.0 Enhancements Initial support for dark mode terminals @Nuru (<a class=”issue-link js-issue-link” data-error-text=”Failed to load title” data-id=”2272818612” data-permission-text=”Title is private” data-url=”https://github.com/cloudposse/geodesic/issues/933“…
2024-05-04
v2.11.0 OpenTofu, Minor Breaking Changes Breaking Changes OpenTofu OK, not a breaking change, but we are excited about it: we have made it easy to install OpenTofu into Geodesic. At the command line or in your Dockerfile, just run: Debian:
# We recommend pinning the version to ensure reproducibility apt-get update && apt-get install tofu=1.6.2 Alpine:
# At this point, it seems there is only one version of OpenTofu available
# for Alpine, and a new version would be in a different…
2024-05-05
2024-05-08
v2.11.1 Enhancements
Dockerfile examples, Renovate config, color text bugfixes @Nuru (<a class=”issue-link js-issue-link” data-error-text=”Failed to load title” data-id=”2285058498” data-permission-text=”Title is private” data-url=”https://github.com/cloudposse/geodesic/issues/939“…
2024-05-11
v2.11.2 Build/Release Maintenance
PR & Release management maintenance @Nuru (<a class=”issue-link js-issue-link” data-error-text=”Failed to load title” data-id=”2290499005” data-permission-text=”Title is private” data-url=”https://github.com/cloudposse/geodesic/issues/940“…
2024-05-14
been thinking about the best way to have a portable collection of devops tooling that I can use from any machine, and my favorite approaches so far have been
• geodesic
• devcontainers
• maaaaaaybe nix any reasons I would pick one over the other? how are folks here handling multi aws assume role profiles effectively and kubeconfig ? .aws/config + kubeconfig files on the host machine? or baked into the containers?
I love this question. We have pondered and debated exactly these 3 options. So devcontainers is trying to achieve more or less the same thing that we set out to do with geodesic. That is geodesic predates devcontainers. We still use geodesic daily and have been slow to adopt devcontainers.
Devcontainers are optimized for the developer in the IDE. It’s well supported by vscode, less so by other IDEs.
Geodesic is optimized for the command line. It bind mounts volumes and configurations like the AWS config, to make it feel more natural.
Nix is used by multiple developers on our team. For a hot minute we entertained it, but while very cool and solves the things we want to achieve has a high barrier to entry and steep learning curve.
So why geodesic? It has the best of all 3, and is ultimately flexible to use how ever containers are used. It can be used as a remote shell with something like containerssh, it works seamlessly on the command line, we use it with EKS.
By bind mounting the AWS configs and using Leapp, we have seamless authentication between desktop and container.
gotcha, I do think geodesic is the front runner for me at the moment. I’ll give it a whirl this week
thanks for the info!
2024-05-15
2024-05-19
Is there any way to integrate geodesic and leapp? I want to see which session I’m currently in -_- Even the account name would be helpful.
Nothing preexisting as far as I know. We have the current AWS profile shown, but you could have any number of active Leapp sessions.
Are you familiar with the leapp-cli? You could list your current sessions like this:
leapp session list --filter="Status=^active"
leapp-cli doesn’t work with WSL, unfortunately. The only workaround suggested - is to symlink your windows .aws to your WSL .aws
I don’t use named profiles in leapp (not sure when I should use them), so my profile is always default.
I made changes to /etc/profile.d/aws.sh to have a variable AWS_LEAPP_PROMPT - and if yes, I generate a profile from the account and role name.
This works for me, but my accounts are hardcoded. Would there be interest in a generic version of this, as a PR to geodesic?
it’s cyan, to show that it is a leapp profile, not a real one
As for leapp-cli - as far as I understand, it communicates to the parent process via shared memory - and I can’t figure out a way to make that work between WSL and Windows.
Another option is to run GUI Leapp from WSL, but for some reason it doesn’t work (but other linux gui apps, even built with electron, are working, so it’s a leapp issue)
for our use-case, we have many profiles - one for every customer. So we set the AWS Profile to best the namespace-identity, and then assume roles across the organization using that centralized identity role
Leapp has had many issues related to Windows unfortunately, with the symlink workaround being the biggest. However, considering that Noovolari announced their end last week, we have been considering alternatives. But we have no concrete plans at the moment
That said, Leapp is supposedly going to continue to be supported by beSharp, so it’s likely premature to make any rash decisions about dropping it. We’ll have to see. Maybe we’ll get some improvements for Windows users
2024-05-21
2024-05-22
v2.11.3 Enhancements
Fix colorized string in prompt @Nuru (<a class=”issue-link js-issue-link” data-error-text=”Failed to load title” data-id=”2299175728” data-permission-text=”Title is private” data-url=”https://github.com/cloudposse/geodesic/issues/942“…
2024-05-31
Here’s my solution for using aws-sso-cli as a replacement for Leapp with geodesic.
In the profile.d folder (or .bashrc), copy the aws-sso-cli profile locally, changing it to headless mode:
mkdir ~/.aws-sso
sed 's/open/print/g' /localhost/.aws-sso/config.yaml | sed '/SecureStore/d' > ~/.aws-sso/config.yaml
echo "SecureStore: json" >> ~/.aws-sso/config.yaml
This stores your interim credentials inside the docker container in plain JSON – I know this is insecure, but I struggled with a generic way of using a key-vault inside docker that would be cross platform.
I then created a login script that I run this during initialization, so startup prompts me with a URL for AWS login (which I control-click), and then I loop thru and authenticate all the profiles I need in this session.
aws-sso --no-config-check
for f in PROFILE1 PROFILE2 PROFILE3; do
SHELL=/bin/bash aws-sso -L error --no-config-check eval -p $f > /dev/null
done
aws-sso list
(NOTE: SHELL=/bin/bash is needed just in profiile.d scripts before the SHELL environment variable has been set)
When I’m complete, you can then see the expiration times by doing and aws-sso list.
My ~/.aws/config is populated like this:
[profile pinnacle-data]
credential_process = /usr/bin/aws-sso -S "pinnacle" process --arn arn:aws:iam::########:role/AWSAdministratorAccess
region = us-east-1
@Mike Crowe I’m curious, why are you not satisfied with aws sso login?
@Jeremy G (Cloud Posse) aws cli stored tokens unencrypted. aws sso login would be fine inside geodesic, but it’s not secure enough for me outside geodesic. I wanted one tool that I could use in both places.
Thanks for letting me know.
aws sso stores temporary tokens, with a configurable lifetime, but typically 4 hours and a max of 8 or 12 hours, I don’t recall. I understand if that is not secure enough for you, but I wanted to point it out for other people reading this thread.
I was following CloudPosse’s best-practice recommendation of using Leapp – which seemed (to me) to be addressing security issues related to the aws cli. I guess I would ask you why geodesic recommends Leapp and not aws sso? I didn’t even consider it because of the docs
We recommend Leapp because it handles authentication via API keys and SAML IdPs as well as AWS SSO in a consistent user interface, and uses a real browser (rather than screen scraping) to perform logins. However, we do not discourage use of aws sso. This is the first I’ve heard of aws-sso-cli.
I like it a lot – developer is very responsive
Thanks @Mike Crowe -remind me, does aws-sso-cli invoke the browser for logins, or does it use a scraping technique?
Browser. But inside geodesic, my configuration simply prints out the link which you have to click in the console to fire up the browser.
So far, I found it to be on par with leapp and I really like using it. It even has the console function to open up a browser to the AWS console for the current profile