#office-hours (2021-01)
Meeting password: sweetops
Public “Office Hours” are held every Wednesday at 11:30 PST via Zoom. It’s open to everyone. Ask questions related to DevOps & Cloud and get answers! https://cpco.io/slack-office-hours
Public “Office Hours” are held every Wednesday at 11:30 PST via Zoom. It’s open to everyone. Ask questions related to DevOps & Cloud and get answers! https://cpco.io/slack-office-hours
Meeting password: sweetops
2021-01-29
2021-01-28
2021-01-27
@here office hours is starting in 30 minutes! Remember to post your questions here.
Hi Erik,
I’m having trouble with companies regular meetings. I kindly suggested them to squeeze meetings into 1 or 2 days so developers can have full silent days focusing their job. I’ve found these articles to support my proposal.
Context switching and an engineer’s mile-long trail of mental notes are sworn enemies. As legendary computer scientist and entrepreneur Paul Graham says, “One reason programmers dislike meetings so much is that they’re on a different type of schedule from other people. Meetings cost them more.”
https://slack.com/intl/en-tr/blog/productivity/slack-on-slack-how-devs-reduce-distractions
https://hbr.org/2017/07/stop-the-meeting-madness
I wonder if I’m alone on this fight or not?
This is the quintessential essay by PG: http://www.paulgraham.com/makersschedule.html
This just occurred to me, so it may not quite be fully baked. This falls under psychological safety, although the context for that is usually regarding feeling safe to share opinions, ask questions, etc. But people need to feel safe to be silent and singly focused, too. The pressure to always have an opinion or answer to share or to context switch frequently creates a cognitive overload.
did this get talked about already? I joined a little late
Nope
(coming at this topic from a TPM perspective) one issue I found with daily stand ups is they are ideal for a team working towards similar goals, where the team shares responsibility on the same stories/tasks. DevOps teams usually are supporting things in silos (shared services), so stand ups become less meaningful since each person isn’t always very invested in what everyone else is doing. the opportunities for collaboration are there, but are arguably better handled over Slack as one-offs.
there’s also something to be said about expectations of availability. if your team expects you to respond to slack messages and such in a timely manner, this can pose a similar problem as the meetings where you’re in a good rhythm on your task and then you get taken out of it to context switch.
@ definitely agree.
Andy Miguel (Cloud Posse) has joined Public “Office Hours”
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
Eric Berg has joined Public “Office Hours”
Mikael Fridh has joined Public “Office Hours”
mb Branski has joined Public “Office Hours”
charles pogi has joined Public “Office Hours”
Leia Renée has joined Public “Office Hours”
Nicolás de la Torre has joined Public “Office Hours”
Vicken Simonian has joined Public “Office Hours”
Sam C has joined Public “Office Hours”
Patrick Joyce has joined Public “Office Hours”
Raghavendra V has joined Public “Office Hours”
Tarlan Isaev has joined Public “Office Hours”
Matt Calhoun has joined Public “Office Hours”
Warren Brown has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
David Lundgren has joined Public “Office Hours”
ivan pedro has joined Public “Office Hours”
Michael Martin has joined Public “Office Hours”
Mahmoud Dolah has joined Public “Office Hours”
Oskar Maria Grande has joined Public “Office Hours”
Joaquin Menchaca has joined Public “Office Hours”
mike dizon has joined Public “Office Hours”
Michael Londeen has joined Public “Office Hours”
James Chai has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Brian Stascavage has joined Public “Office Hours”
James Haughey has joined Public “Office Hours”
Andy Roth has joined Public “Office Hours”
Matt Gowie has joined Public “Office Hours”
venkata mutyala has joined Public “Office Hours”
tamsky has joined Public “Office Hours”
Evan Pitstick has joined Public “Office Hours”
What to do if something that is 0.X was inadverdently published as 1.X and we want to turn back time and go back to 0.X?
Michael Jenkins has joined Public “Office Hours”
sri has joined Public “Office Hours”
buildah
We should also discuss this sometimes, since it is a revolution https://www.hashicorp.com/blog/deploy-any-resource-with-the-new-kubernetes-provider-for-hashicorp-terraform
It provides a way to deploy kubernetes yaml description files through out TF. It solves another problem that TF kubernetes provider was following new K8s releases from the back. That latency will be part of the history after this featue.
Note: For now, I am using https://github.com/leiarenee/terraform-kubernetes-yaml to deploy bare K8s yaml files under TF
Zadkiel has joined Public “Office Hours”
Brandon vh has joined Public “Office Hours”
Vicken Simonian has joined Public “Office Hours”
I’m using multibranch GitOps approach, every environment lives in a seperate branch
how does geodesic/atmos fit into git workflows? we are currently using tf cloud with diferent workspaces for dev, stag and prod
Dale-Kurt Murray has joined Public “Office Hours”
So is a better alternative to standup just to write what you would say into slack?
Ah interesting, thank you
Ola Ade has joined Public “Office Hours”
Just to clarify, this is what you guys are referring to with the “maker schedule” right? http://paulgraham.com/makersschedule.html
Thanks
Re: Standup bot, my team uses both.. We use Dixi, but it doesn’t really matter which tool is used.
- We believe async standup can’t replace in person standup, but does enhance it
- Our in-person standup is guided by looking at the async responses - It keeps people focused
- Async standup can still be used if someone isn’t able to attend in-person standup
- Listing your blockers as soon as you start working has the potential for people to help with the blockers before Standup even happens. I regularly will list a blocker and a teammate will reply in the Thread and offer to help with it right away
Hi Andrew, Which tools are using for async communication?
Standup bot and Dixi, am I right?
Dixi is the async bot
It DMs you in slack and asks you the typical 3 questions
/cc @Erik Osterman (Cloud Posse) @matt
Listing your blockers as soon as you start working has the potential for people to help with the blockers before Standup even happens. I regularly will list a blocker and a teammate will reply in the Thread and offer to help with it right away
Cool @roth.andy Thnks.
Hi @matt My real blocker is the meeting itself. That’s the paradox.
Anyway, next week I’d like to get the rest of Erik’s response about how CloudPosse does meetings before we got derailed on standups
Some of the problems I want to solve:
• what’s the relationship of what you’re working on and JIRA. is there a ticket? if not, why and let’s make sure there is one. JIRAs are how we “manage up”
• why has the same jira been “in progress” for 2 weeks. What’s the delta, what’s evolved?
• Is each of these issues in jira really still blocked? If so, what’s the next action. Who is that next action assigned to? How do we track that without creating even more process.
• How do we identify that the approach being taken is the right approach. Sprint planning will help identify what we need to get done. But frequently we don’t know what we don’t know; it’s not until we start working on the problem. THen we see the scope change. Assessing these changes in scope are what I think get missed in async standups. From the developer perspective, it’s very transactional: i’m assigned work, i get that work finished. From the business perspective, it’s different, not all work needs to get finished. Waiting a week or to the end of a sprint is too late. From the developer’s perspective, they are not blocked: they know what the next steps are. That’s not sufficient though.
• If the standups are just reflecting the status of what’s in jira, it’s not useful - we already get that from jira
• If the standups are not reflecting the status of what’s in jira, why not? (it’s a catch 22) I guess my point is there’s this subtle, hard to automate process in our standups.
I like the notion of what standuply does. It integrates with Jira and GitHub so it can pull in a lot of tedious data entry and reflection of “what did I do?”. What I’d like to see is how do we produce meaningful data that is not just a regurgitation of what we already know.
Yes that was me actually who was responsible for derailing.
I 
agree on you and I’m keen to listen Erik’s meeting experiences as a manager next week.
Poking fun at meetings is the stuff of Dilbert cartoons—we can all joke about how soul-sucking and painful they are. (from HBR)
I thing the problem is about multi tasking. Developers most of the time are expected to work with multiple tasks in parallel. This inevitably creates an uncertainty and disrupts the estimation. Only one task per developer should be on developmentstage at a time, so that estimations can be achieved at least approximately.
New Zoom Recording from our Office Hours session on 2021-01-27 is now available.
2021-01-21
2021-01-20
@here office hours is starting in 30 minutes! Remember to post your questions here.
Will this affect Terraform ?
<https://aws.amazon.com/about-aws/whats-new/2021/01/aws-sdk-for-go-version-2-now-generally-available/>
Does anyone follow a git flow (i.e. develop + master branches) pattern for larger Terraform repositories? How has that worked out for you?
I tried using develop and master and found it hard to manage. So, I just do PR’s off of master. I create tags for each module as well similar to this source = [email protected]<name-of-repo?ref=v1.0.0 so that when the module changes it’s not pointing to a local reference of my modules. There could be better ways to do it though. We are running terraform locally though and have a small team. I’d be interested in what others are doing as well.
I tried lot of approaches, let me list them first, then discuss them
• one repo - a branch per ENV
• multiple repos - a repo per env
• one repo - a folder per ENV all of these has pros and cons, but I move to something called stacks
So for any account I have stacks, one for network, others for Data, compute, app, CICD, so any account use one repo, and in that repo I have stacks each stack points to folder. then using a makefile I can have the sequence I want, and using remote state data source I can any output I want.
• one account reflect an ENV in one repo, and within multiple stacks with a makefile If I need to do any change I would create aPR on target account repo, run TF plan, approve it and merge, then run terraform apply, branch name cloud be issue-X or feat-X that match our backlog
some PR require changes on multiple stacks, and that can be easily done with this approach
Hi Mohammed, I use one repo - a branch per ENV after I tried every one of those solutions. And using seperate organizational accounts for envs. This solved a lot of problem for me like configuration differentiation.
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
David Lundgren has joined Public “Office Hours”
Phil Hershkowitz has joined Public “Office Hours”
any tips for improving global s3 upload speed? (think india, hong kong, etc) what other optimizations could I possibly make after turning on s3 transfer acceleration and using multipart uploads?
mb Branski has joined Public “Office Hours”
Sam C has joined Public “Office Hours”
Colton Wrisner has joined Public “Office Hours”
James Thalacker has joined Public “Office Hours”
Brian Tai has joined Public “Office Hours”
Jim Park has joined Public “Office Hours”
sri has joined Public “Office Hours”
Cosmin Drimba has joined Public “Office Hours”
Andy Miguel (Cloud Posse) has joined Public “Office Hours”
Patrick Jahns has joined Public “Office Hours”
Tim Gourley has joined Public “Office Hours”
Sebastian Stadil has joined Public “Office Hours”
Mansoor Ebrahim has joined Public “Office Hours”
Cosmin Drimba has joined Public “Office Hours”
James Haughey has joined Public “Office Hours”
Bill Clark has joined Public “Office Hours”
15139103984 has joined Public “Office Hours”
Matt Gowie has joined Public “Office Hours”
Srikar Ananthula has joined Public “Office Hours”
Neil Gealy has joined Public “Office Hours”
Leia Renée has joined Public “Office Hours”
Andy Roth has joined Public “Office Hours”
Mikael Fridh has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
venkatamutyala has joined Public “Office Hours”
Todd Thomas has joined Public “Office Hours”
Guelor Emanuel has joined Public “Office Hours”
Loren Gordon has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
Eric Berg has joined Public “Office Hours”
Oskar Maria Grande has joined Public “Office Hours”
mike dizon has joined Public “Office Hours”
Vicken Simonian has joined Public “Office Hours”
Petros Kolyvas has joined Public “Office Hours”
Robert Jackson has joined Public “Office Hours”
Question re: office hours. What types of internal users have you seen typically use these prebuilt stacks / catalog?
Catalogs is a general concept
Here’s our catalog of datadog monitors:
Here’s our catalog for AWS Config (with of the rules for CIS 1.2)
…so now we are extending our catalog approach to infrastructure using “Stacks”
and since we’ve abstracted the concept of a stack as YAML, now we can support that with virtually any TACOS provider.
Like scalr
Blaisep has joined Public “Office Hours”
Jose Franco has joined Public “Office Hours”
Sheldon Hull has joined Public “Office Hours”
Are you guys going to update examples in atmos? I’d love to get it going!
Whatever cloud provider, a registry for easy review and calling of modules is key. I checked and Env0 didn’t have it at this time. Scalyr i think did. Spacelift i haven’t checkout out, but will look too.
I really want to towards that curated high quality modules for teams to use this way.
Dennis Lipovsky has joined Public “Office Hours”
Miguelangel Freitas has joined Public “Office Hours”
Cloudposse modules are epic I’m always looking to leverage them. I just painfully used a new datadog monitor project that wasn’t Cloudposse as it was a bit more extensive and it felt like pulling teeth.
Much
Ah what did the DD monitor module not have that you were looking for? I was just in there, so I’m curious.
1 - preset messages already built (maybe you had that too) 2 - 10-20 prebuilt monitors for different services already ready. I wanted to convert but didn’t have time. https://registry.terraform.io/modules/claranet/monitors/datadog/latest
I would like to use cloudposse, but need to have time to convert the checks into yaml to use that.
@sheldonh did you see the catalog?
There’s a lot there, but maybe not for your services
e.g. we have 20 monitors just for EKS
We’ll gladly accept PRs for more monitors that we can add to our catalog.
If you compare our module to the one by claranet, it’s a pretty big difference. The claranet one requires a submodule for every one.
While using the YAML config pattern, we add monitors very easily:
k8s-deployment-replica-pod-down:
name: "(k8s) Deployment Replica Pod is down"
type: query alert
query: |
avg(last_15m):avg:kubernetes_state.deployment.replicas_desired{*} by {cluster_name,deployment} - avg:kubernetes_state.deployment.replicas_ready{*} by {cluster_name,deployment} >= 2
message: |
({{cluster_name.name}}) More than one Deployments Replica's pods are down on {{deployment.name}}
escalation_message: ""
tags: [ "ManagedBy:Terraform" ]
notify_no_data: false
notify_audit: true
require_full_window: true
enable_logs_sample: false
force_delete: true
include_tags: true
locked: false
renotify_interval: 0
timeout_h: 0
evaluation_delay: 60
new_host_delay: 300
no_data_timeframe: 5
threshold_windows: { }
thresholds:
critical: 2
Yeah I’m going to convert over today.
Here’s the catch, I need to be able to copy json from building a manual monitor then codify.
I’m thinking I copy json to use tool to flip to yaml. If the schema is the same as the datadog json then I just solved my problem . Will look I don’t like the module verbosity of the clarinet one but I did appreciate prebuilt monitors for rds etc. I can build those myself those if I can flip to yaml quickly. If that works I’ll probably ride up a quick blog post on how I did it for folks and see about adding some more monitors to the library. Thanks!
@sheldonh Cool you’ll be using it! Interested in hearing how it goes.
Building out that catalog would be really cool. I haven’t added anything myself yet as the monitors I’ve added to client projects are too narrow in scope, but I hope to do so over the coming months for sure.
yep, thanks sheldon for the update. if there’s any generic monitors (e.g. for RDS), we’d welcome those! If you’re struggling with how to do something, do reach out and we’ll probably be able to answer how we handle it (or htink about it)
I have a suggestion, not sure if makes sense, but here it goes.
Slight schema modification to the yaml structure for monitors. With a slight change you could basically take a manually created monitor and use the export json to “flip” to yaml and plug it in without many tweaks. Any extra properties not included in the default json should be optional.
Ie
{jsoncontent} | yq/cfn-flip
Now i have a formatted yaml snippet I could plug into the monitor. I had to work through problems though as “options” is used to group the settings and not in the cloudposse yaml.
What do you think? Worth a PR/open issue? Would make it easier to add monitors by doing manually, confirming they work then codifying i think.
(The schema came from https://github.com/FairwindsOps/astro)
can you share what the schema should look like?
maybe open issue for documentation purposes.
Would be glad to. It’s minor changes very minimal but would make it super easy to pull in any new monitor. I only had to make a few tweaks and make a few variables optional and it works. I’ll try to get something up there soon. Cheers
For what it’s worth I’ve read that this type of concept:
You want to simplify, that’s great! Simplifying complex systems though often is basically shifting around complexity. In this case… do you want Terragrunt to manage the complexity and it’s own flow, or do you shift it to the user, or a yaml config for example.
I think it’s a case of where do you feel the complexity should be best moved.
Food for though.
yes, strongly agree.
there’ll necessarily be complexity with time as we’re doing more. there’ll be different ways to address it that depend on our world view. we’re only shifting it around.
I want to talk more about this later this quarter, once we have more documentation on our latest strategy. I also want to compare it in matrix
Jeremy Branham has joined Public “Office Hours”
Udit Dave has joined Public “Office Hours”
Jose Franco has joined Public “Office Hours”
Hao Wang has joined Public “Office Hours”
WOOT WOOT. I didn’t see atmos. Is this built on top of variant2?
It’s a master class in atmos.
I’d like to say it was “Easy”, but it’s been quite challenging. We’ve had to work a lot with Mumoshu to get to where we are on it today.
We’re also developing a companion cli in pure-go
still deciding on name of that one. that cli is for working around limitations in terraform providers in order for us to provde SOC2 compliance for customers.
Tuning in a bit late, but is there something specifically I could review regarding the SOC 2 Compliance issues your customers are having and how that relates to TF? Very similar goals on this end so trying to head off any frustration before audits begin
Our workarounds are going into https://github.com/cloudposse/posse-cli (which will be renamed to turf)
addresses those things there’s no way to do in pure terraform
You all are amazing as usual. I’m excited to see where this project goes. Would you say I could easily replace “runner scripts” now with this tooling or a bit difficult as designed for your specific workflow?
Andrew Thompson has joined Public “Office Hours”
Seriously you guys are on FIRE
tfswitch — https://tfswitch.warrensbox.com/
asdf is about the ultimate expression of lazy typing i’ve ever seen. Absolutely love it!
Go is HUGE on backward compatibility. They have a promise even on “deprecated” features to never break functionality.
I’d say even if they move to SDK v2, it’s not going to impact us overall.
Pretty sure SDK v2 has been out for years before this announcement too, so it’s not “new”. It’s been in usage from 2018 i believe. It simplifies a lot of code too.
New Zoom Recording from our Office Hours session on 2021-01-20 is now available.
2021-01-14
2021-01-13
@here office hours is starting in 30 minutes! Remember to post your questions here.
Andy Miguel has joined Public “Office Hours”
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
Michael Jenkins has joined Public “Office Hours”
Ian Groff has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
James Haughey has joined Public “Office Hours”
Hemanth Kumar has joined Public “Office Hours”
Bircan Bilici has joined Public “Office Hours”
Tim Gourley has joined Public “Office Hours”
Andy Miguel has joined Public “Office Hours”
Patrick Joyce has joined Public “Office Hours”
mb Branski has joined Public “Office Hours”
15139103984 has joined Public “Office Hours”
Patrick Jahns has joined Public “Office Hours”
Udit Dave has joined Public “Office Hours”
Mazin Ahmed has joined Public “Office Hours”
Michael Martin has joined Public “Office Hours”
Matt Gowie has joined Public “Office Hours”
Kenji Nakamura has joined Public “Office Hours”
Isa Aguilar has joined Public “Office Hours”
Bill Clark has joined Public “Office Hours”
Dave Lundgren has joined Public “Office Hours”
Working with the SSO resources - but would be great to also define at least Groups via code
PePe Amengual has joined Public “Office Hours”
Kenji Nakamura has joined Public “Office Hours”
@ You mentioned you were getting started with Terraform - this is a GREAT book for “getting up and running”. https://www.amazon.com/Terraform-Running-Writing-Infrastructure-Code/dp/1491977086
There is a second edition of this book - https://www.amazon.com/gp/aw/d/1492046906/ref=dp_ob_neva_mobile
Yes. I am reading this one!
Oskar Maria Grande has joined Public “Office Hours”
@ I think this is one of the outstanding SSO resources that’s still in draft: https://github.com/hashicorp/terraform-provider-aws/pull/15322
I’ve been following that PR and it seems like that might be what you were missing.
https://www.terraform.io/docs/configuration/types.html#experimental-optional-object-type-attributes
variable "with_optional_attribute" {
type = object({
a = string # a required attribute
b = optional(string) # an optional attribute
})
}
awesome to use
here is a use case in my ecs-cluster module https://github.com/mhmdio/terraform-aws-ecs-cluster/blob/master/variables.tf
Shouky Dan has joined Public “Office Hours”
Marc Tamsky has joined Public “Office Hours”
mb Branski has joined Public “Office Hours”
Andrew Thompson has joined Public “Office Hours”
rajiv ranjan has joined Public “Office Hours”
use this CFN templates until TF AWS SSO is ready
Looks like AWS SSO assignment resources are dropping today in v3.24.0 — https://github.com/hashicorp/terraform-provider-aws/issues/15108#issuecomment-760421304
AWSTemplateFormatVersion: 2010-09-09
Description: Configure AWS SSO
Parameters:
AwsSsoInsanceArn:
Type: String
Default: 'arn:aws:sso:::instance/ssoins-XXXXXXXXXXXXX'
Description: 'AWS SSO Instance ARN.'
Mappings:
Groups:
Admins:
Id: 'XXXXXXX-xxxxx-xxxx-xxxx-xxxx-XXXXX'
Developers:
Id: 'XXXXXXX-xxxxx-xxxx-xxxx-xxxx-XXXXX'
Developers-CodeCommit:
Id: 'XXXXXXX-xxxxx-xxxx-xxxx-xxxx-XXXXX'
Accounts:
master:
Id: '111111111111'
shared:
Id: '222222222222'
dev:
Id: '333333333333'
prod:
Id: '444444444444'
Resources:
adminsPermissionSet:
Type: AWS::SSO::PermissionSet
Properties:
Description: Admins Group Administrator Access Permission Set
InstanceArn: !Ref AwsSsoInsanceArn
ManagedPolicies:
- arn:aws:iam::aws:policy/AdministratorAccess
Name: Admins
Tags:
- Key: 'CFN'
Value: 'Yes'
- Key: 'Project'
Value: 'Awesome'
developersPermissionSet:
Type: AWS::SSO::PermissionSet
Properties:
Description: Developers Group Read Only Access Permission Set
InstanceArn: !Ref AwsSsoInsanceArn
ManagedPolicies:
- arn:aws:iam::aws:policy/ReadOnlyAccess
Name: Developers
Tags:
- Key: 'CFN'
Value: 'Yes'
- Key: 'Project'
Value: 'Awesome'
developersCodeCommitPermissionSet:
Type: AWS::SSO::PermissionSet
Properties:
Description: Developers Group CodeCommit Access Permission Set
InstanceArn: !Ref AwsSsoInsanceArn
ManagedPolicies:
- arn:aws:iam::aws:policy/AWSCodeCommitPowerUser
Name: Developers-CodeCommit
Tags:
- Key: 'CFN'
Value: 'Yes'
- Key: 'Project'
Value: 'Awesome'
# masterAssignmentAdmins:
# Type: AWS::SSO::Assignment
# Properties:
# InstanceArn: !Ref AwsSsoInsanceArn
# PermissionSetArn: !GetAtt adminsPermissionSet.PermissionSetArn
# TargetId: !FindInMap [ Accounts, master, Id ]
# TargetType: 'AWS_ACCOUNT'
# PrincipalType: 'GROUP'
# PrincipalId: !FindInMap [ Groups, Admins, Id ]
sharedAssignmentAdmins:
Type: AWS::SSO::Assignment
Properties:
InstanceArn: !Ref AwsSsoInsanceArn
PermissionSetArn: !GetAtt adminsPermissionSet.PermissionSetArn
TargetId: !FindInMap [ Accounts, shared, Id ]
TargetType: 'AWS_ACCOUNT'
PrincipalType: 'GROUP'
PrincipalId: !FindInMap [ Groups, Admins, Id ]
prodAssignmentAdmins:
Type: AWS::SSO::Assignment
Properties:
InstanceArn: !Ref AwsSsoInsanceArn
PermissionSetArn: !GetAtt adminsPermissionSet.PermissionSetArn
TargetId: !FindInMap [ Accounts, prod, Id ]
TargetType: 'AWS_ACCOUNT'
PrincipalType: 'GROUP'
PrincipalId: !FindInMap [ Groups, Admins, Id ]
devAssignmentAdmins:
Type: AWS::SSO::Assignment
Properties:
InstanceArn: !Ref AwsSsoInsanceArn
PermissionSetArn: !GetAtt adminsPermissionSet.PermissionSetArn
TargetId: !FindInMap [ Accounts, dev, Id ]
TargetType: 'AWS_ACCOUNT'
PrincipalType: 'GROUP'
PrincipalId: !FindInMap [ Groups, Admins, Id ]
devAssignmentDevelopers:
Type: AWS::SSO::Assignment
Properties:
InstanceArn: !Ref AwsSsoInsanceArn
PermissionSetArn: !GetAtt developersPermissionSet.PermissionSetArn
TargetId: !FindInMap [ Accounts, dev, Id ]
TargetType: 'AWS_ACCOUNT'
PrincipalType: 'GROUP'
PrincipalId: !FindInMap [ Groups, Developers, Id ]
prodAssignmentDevelopers:
Type: AWS::SSO::Assignment
Properties:
InstanceArn: !Ref AwsSsoInsanceArn
PermissionSetArn: !GetAtt developersPermissionSet.PermissionSetArn
TargetId: !FindInMap [ Accounts, prod, Id ]
TargetType: 'AWS_ACCOUNT'
PrincipalType: 'GROUP'
PrincipalId: !FindInMap [ Groups, Developers, Id ]
sharedAssignmentDevelopers:
Type: AWS::SSO::Assignment
Properties:
InstanceArn: !Ref AwsSsoInsanceArn
PermissionSetArn: !GetAtt developersPermissionSet.PermissionSetArn
TargetId: !FindInMap [ Accounts, shared, Id ]
TargetType: 'AWS_ACCOUNT'
PrincipalType: 'GROUP'
PrincipalId: !FindInMap [ Groups, Developers, Id ]
sharedAssignmentDevelopersCodeCommit:
Type: AWS::SSO::Assignment
Properties:
InstanceArn: !Ref AwsSsoInsanceArn
PermissionSetArn: !GetAtt developersCodeCommitPermissionSet.PermissionSetArn
TargetId: !FindInMap [ Accounts, shared, Id ]
TargetType: 'AWS_ACCOUNT'
PrincipalType: 'GROUP'
PrincipalId: !FindInMap [ Groups, Developers-CodeCommit, Id ]
If you have time and interest talk about your Codefresh GitOps method. And did you look and consider the Gitlab terraform automation? Pros and Cons
Not using it, recommending it or promoting it any more for the same reasons we don’t recommend github actions
use a purpose built platform. don’t roll your own using a general purpose CI/CD solution.
So neg on the Gitlab and GitHub. But you still like and use Codefresh right? I ask as we have enterprise Bitbucket which has CI/CD capabilities. Im not sure I like it for more than a repo though.
Yes we still use a lot of Codefresh.
But based on some of our engagements last year, I just don’t recommend building your own terraform CD solution. The problem I think is that teams who want to do it are solving the wrong problem and haven’t yet practiced gitops enough to know the challenges. If after having used TACOS, the team still believes it can do a better job, then they can try it.
We also use a lot of GitHub actions. Love them. But we don’t use them for terraform .
(Other than for automated testing)
Rohit Koimattur has joined Public “Office Hours”
Phil Hersh has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
hari b has joined Public “Office Hours”
New Zoom Recording from our Office Hours session on 2021-01-13 is now available.
2021-01-11
2021-01-09
I know y’all explained the CloudPosse way of defining envs and propagating changes many times, but for the life of me I can’t find that recording. Anybody know where I can find it? That part of Office Hours where @Erik Osterman (Cloud Posse) explained the base Terraform infra, and then the DBs, and then the apps thing. With a flowchart with arrows and nice diagram of things building on top of the previous stages
AHA!
The 4 layers of infrastructure! They’re explained starting here: https://youtu.be/fVRy3qpTxME?t=2249
Yes! that was it.
I’ve also added the lucid chart here: https://cloudposse.com/big-picture/
but I think i’ll change it to a image so it’s easier to share
Updated diagram:
Love it, and an awesome visualisation, but no package management? Possibly with increasing awareness, as more orgs adopt protection against things like the package name squatting fiasco, or utilising isolation to protect from third-parties.
2021-01-07
2021-01-06
Question for today’s discussion: When deploying via helm, do you use hacked versions of the full values.yaml files or a file with just diffs? Which is better for managing upgrades of things like the datadog agent, going forward?
@here office hours is starting in 30 minutes! Remember to post your questions here.
Thank you for announcing these! I totally forgot what day it was
@Erik Osterman (Cloud Posse) Q : In https://github.com/cloudposse/reference-architectures#3-delegate-dns Can some one explains An available domain we can use for DNS-base service discovery (E.g. [ourcompany.co](http://ourcompany.co)). This domain must not be in use elsewhere as the master account will need to be the authoritative name server (SOA).
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
Tarlan Isaev has joined Public “Office Hours”
charles pogi has joined Public “Office Hours”
Weston Platter has joined Public “Office Hours”
Vlad Ionescu has joined Public “Office Hours”
Jesse Cafarelli has joined Public “Office Hours”
uri unger has joined Public “Office Hours”
Ken Y.y has joined Public “Office Hours”
Raymond Mazurik has joined Public “Office Hours”
Andy Miguel has joined Public “Office Hours”
Shouky Dan has joined Public “Office Hours”
Adam Crown has joined Public “Office Hours”
Julian Severino has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
Brian Tai has joined Public “Office Hours”
Shouky Dan has joined Public “Office Hours”
Mikael Fridh has joined Public “Office Hours”
Randy Bridges has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Matt Calhoun has joined Public “Office Hours”
Bill Clark has joined Public “Office Hours”
Michael Jenkins has joined Public “Office Hours”
Neil Gealy has joined Public “Office Hours”
Matt Gowie has joined Public “Office Hours”
Brandon vh has joined Public “Office Hours”
Tim Gourley has joined Public “Office Hours”
15139103984 has joined Public “Office Hours”
Hyejin Song has joined Public “Office Hours”
Eric Berg has joined Public “Office Hours”
Is this per field?
or is this total?
Troy Taillefer has joined Public “Office Hours”
@Erik Osterman (Cloud Posse) how to preserve most significant digit being at the end of the id?
James Haughey has joined Public “Office Hours”
yes, thanks!
Martin Mazurik has joined Public “Office Hours”
Rashid Boyko has joined Public “Office Hours”
Abisoye Olaomi has joined Public “Office Hours”
Kareem Shahin has joined Public “Office Hours”
Related thread: https://sweetops.slack.com/archives/CCT1E7JJY/p1609797027221600
Vicken Simonian has joined Public “Office Hours”
Petros K has joined Public “Office Hours”
Anere Faithful has joined Public “Office Hours”
Question for me: We are adopting the terraform-aws-jenkins infra and are pretty impressed with it. I have noticed some issues with the use of EFS though which I wanted to ask about. I am not sure if we’re somehow doing it wrong or if this is a genuine issue. 1- throughput in terms of single file operations: dsl jobs (as well as master startup time) are quite longer compared to what we experienced with using local store (which we have done in the past). benchmarking on the master node indeed shows a round trip for a single operation is 5-10ms. 2- normal “nfs pain”- network “hickups” results with locked threads in jenkins master that never unlocks.
Rohit Koimattur has joined Public “Office Hours”
Has anyone looked at and/or considered Terraspaces as a framework for terraform? I have setup a quick and dirty environment in a Cloud9 instance and so far am loving it.
Michael Jenkins has joined Public “Office Hours”
hello, what do you guys use for something like constant configuration changes? i was leaning towards ansible but just wanted to see if there is anything out there that works ok too
I am still on bit.y/oauth2_proxy … it seems like maybe the project itself has moved on and is active still… (I’m on a very old version on the “legacy” services I front with oauth2 proxy still) – https://github.com/oauth2-proxy/oauth2-proxy
f5 BIG-IP 3DNS?
Abisoye Olaomi has joined Public “Office Hours”
Abisoye Olaomi has joined Public “Office Hours”
Abisoye Olaomi has joined Public “Office Hours”
I have not heard of anyone using a dedicated DNS account before
Would you talk a little about your thoughts limits around multi-account setup. I think a limit of 10 or perhaps up 20 is manageable, but beyond that I think you should think of creating a new org for more member accounts
This is a good question. Will pin it for next week.
Excellent. I have been wrestling with this for a while. Obviously there are exceptions. But I like the multi-account member account approach to help isolate and demarc things, but I also worry about sprawl and have seen for some plans of a 100 or more accounts under an org. Myself I see it being more approachable somewhere in the 10 - 25 range.
It certainly helps because spreading the zones out is horrible. You might end up needing to use the “prod” DNS from a non-prod account etc…
ruby gem
Any good news about Waypoint?)
I don’t have any news yet on this. We’re waiting probably until > Q2 before taking a serious look at it.
Very excited about what it is aspiring to do.
I am too.. but… it’s always tricky with projects which try to do “allthethings”. If you start on a clean slate it can be absolutely wonderful.
Going all-in on something, regardless of what it is though… can be amazing.
Oh you’re already talking about)
No such thing as “Best Practice.” There are only tendrils of innovation that become increasingly adopted.
I wasn’t in office hours. Is this in reference to a particular tool, or the DevOps world in general?
Overall I totally agree, but I think there have been a couple of things that should be considered a best practice and used by all/almost all
- Use Git
- Use a modern Git-based VCS like GitHub/GitLab/BitBucket/etc
- Do CI, with an automated testing pipeline
- Containerize
Other more controversial ones that are, in my opinion, best practices
- Kubernetes in all but the most basic of use cases
- Throw out your style guide and automate it with hooks/CI/etc
- …I’ll think about some more. I really like going over stuff like this
IaC, probably in the top list…
This was a general statement. The point I was trying to make is that “Best Practice” today feels less like “use drbd, pacemaker, corosync and this my.cnf” and more like the following picture:
But I agree, there are definitely some practices that are mature and broadly adopted, like your list above.
What I like about Terraspaces is that you can still go an do it with Terraform, but gives some better structure and easier safeties for a small group.
I think one of the most important questions to ask is where on the adoption curve does my organization want to be?
Thanks all! I appreciate the insights.
New Zoom Recording from our Office Hours session on 2021-01-06 is now available.
2021-01-04
A question I have about https://github.com/cloudposse/terraform-aws-ecs-cloudwatch-sns-alarms … I’m using it to scale up/down the number of Fargate Tasks for an ECS Service. My issue is that it the scale down action continues to scale the task count below the min desired count. What I’m trying to achieve is for the scale down process to not scale below the min desired count.
@jose.amengual have you run into this?
not exactly
We enabled a capacity provider which caused and issue similar
maybe you have a capacity provider at the cluster level @?
Checking ….
I don’t have a capacity provider configured. Do I need that?
no no you do not
Capacity providers are a completely different animal
Asking this here so I can ask this during this week’s office hours.