#office-hours (2021-03)
“Office Hours” are every Wednesday at 11:30 PST via Zoom. It’s open to everyone. Ask questions related to DevOps & Cloud and get answers! https://cloudposse.com/office-hours
Public “Office Hours” are held every Wednesday at 11:30 PST via Zoom. It’s open to everyone. Ask questions related to DevOps & Cloud and get answers!
https://cpco.io/slack-office-hours
Meeting password: sweetops
2021-03-01
Would be great to chat about rolling out GuardDuty using Cloud Posse tooling — I see ya’ll have some administration covered by turf and some covered by the terraform-aws-guardduty module so I’d like hear about how those two work together and what the proper Cloud Posse suggested approach is there.
CLI Tool to help with various automation tasks (mostly all that stuff we cannot accomplish with native terraform) - cloudposse/turf
Terraform module to provision AWS Guard Duty. Contribute to cloudposse/terraform-aws-guardduty development by creating an account on GitHub.
2021-03-03
@here office hours is starting in 30 minutes! Remember to post your questions here.
@Erik Osterman (Cloud Posse) How do you manage the s3state backend configuration when you have a project that uses multiple modules. I know you can use: https://github.com/cloudposse/terraform-aws-tfstate-backend for the general s3state bucket but how do you manage the seperate s3backen.tf files per submodule ? You cannot use variables in these files
Terraform module that provision an S3 bucket to store the terraform.tfstate
file and a DynamoDB table to lock the state file to prevent concurrent modifications and state corruption. - cloudposse…
Hashicorp Kubernetes Provider - is it ready for prime-time yet? Targeting mainstream cloud platforms and managed k8s, is anyone inclined to share their best practices (e.g. multiple states “Infra” vs “Service deployments”, integration into CICD, etc)?
Would like to get community feedback on this opinionated statement:
“Features are not considered done until our customers are getting value out of them”
Do you agree? Disagree? Not really care? I’m having a hard time finding something even vaguely resembling definitive either way when looking through Agile, DevOps, best practices, Medium articles, etc. There seem to be quite a few opinions out there.
@roth.andy i’d say I disagree..
-
What do we mean by value? How is value defined and measured? We would need to agree on clear and fair parameters for “value” that’s applicable across every type of story/task. E.g. “it’s not done until it’s in production” isn’t always relevant to every task. If we’re saying something is not done until it’s been validated and handed off, that can be fair.. you can build objective criteria around that. if you ship something and the customer has gripes but agrees the core of the thing is there, then those gripes can become backlog items, If you ship something and it’s way off from what was asked, then I would look at item 3 on this list. If you ship something, they accept the work but then never use it, that’s not the responsibility of the engineering team so they shouldn’t get penalized by having a never ending task/story/epic affecting their metrics.
-
Done from whose perspective? The customer likely has no stake in the game whether something is ever considered done or not, but the engineering team needs this definable because they need to measure their output, they need to know the state of things, report on KPIs like time to resolve, and so on.
-
How is the feature conceptualized in the first place? Is the feature’s representation in the tool (e.g. Jira) specific enough where it’s reasonable to agree on a definition of done?
Our general process at cloud posse is tasks are moved to done, then on status calls with customers we move them to an accepted status as they provide thumbs up. This is also after they’ve reviewed (or have been given plenty of time to review) the associated PRs and such.
If we’re saying something is not done until it’s been validated and handed off
Handed off smells to me like a dev team throwing the feature over the wall to the ops team (which is my exact problem right now). In a DevOps mindset it doesn’t feel valid to me to call something done the minute I make it someone else’s problem.
Our general process at cloud posse is tasks are moved to done, then on status calls with customers we move them to an accepted status as they provide thumbs up
Are they giving a thumbs up based on looking at their production environment? Or the pre-prod/testing environment?
Handed off smells to me like a dev team throwing the feature over the wall to the ops team (which is my exact problem right now). In a DevOps mindset it doesn’t feel valid to me to call something done the minute I make it someone else’s problem.
that could happen for sure. the DevOps mindset is harder to achieve if the org structure isn’t aligned to fostering it. I don’t know your org obviously but the minute you start talking about different teams, that’s a hurdle to getting that sense of shared ownership and investment you want your devs to have. I would definitely be interested to ask more questions/dig into this deeper next week if you’re on office hours
Are they giving a thumbs up based on looking at their production environment? Or the pre-prod/testing environment?
the tasks can be environment specific so it depends
obviously the smaller the scope the easier your work moves through your board
wow, this might be a marathon session today! lots of great questions. we’ll try to get to as many of them as possible.
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
Evan Pitstick has joined Public “Office Hours”
Patrick Jahns has joined Public “Office Hours”
Eric Berg has joined Public “Office Hours”
David Lozano has joined Public “Office Hours”
Adam Crown has joined Public “Office Hours”
Andy Roth has joined Public “Office Hours”
Raymond Mazurik has joined Public “Office Hours”
Andy Miguel (Cloud Posse) has joined Public “Office Hours”
Jacob Evans has joined Public “Office Hours”
Andrew Thompson has joined Public “Office Hours”
Vlad Ionescu has joined Public “Office Hours”
mb Branski has joined Public “Office Hours”
ASIS SETHI has joined Public “Office Hours”
Jim G has joined Public “Office Hours”
James Haughey has joined Public “Office Hours”
Jeff Dyke has joined Public “Office Hours”
Matt Gowie has joined Public “Office Hours”
Matt Calhoun has joined Public “Office Hours”
Tim Gourley has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
15138278650 has joined Public “Office Hours”
During the last 5 or so minutes of 3-Feb Eric mentioned that Cloudposse views things from 4 layers; infrastructure, shared services, application and…….. I missed the 4th; Anyone know what that might be?
I’m just curious whether anybody else treats the database layer as separate. I know many folks keep databases under the ‘application’ layer, but I find that app-layers (load balancers, container clusters) move at a difference cadence than databases (rds, the SQL within).
Bart Coddens has joined Public “Office Hours”
Oskar Maria Grande has joined Public “Office Hours”
Kareem Shahin has joined Public “Office Hours”
Luis Masaya has joined Public “Office Hours”
Jonas Steinberg has joined Public “Office Hours”
test has joined Public “Office Hours”
Michael Londeen has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
links from today’s announcements: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/data-protection.html#encryption-transit https://www.uptycs.com/blog/harnessing-the-aws-nitro-architecture-to-encrypt-inter-node-traffic-in-kubernetes https://terraform-docs.io/ https://github.com/hashicorp/terraform/releases https://github.com/sponsors/cloudposse https://www.youtube.com/c/cloudposse
Install an Istio mesh across multiple Kubernetes clusters.
Patrick Joyce has joined Public “Office Hours”
Brandon vh has joined Public “Office Hours”
Mazin Ahmed has joined Public “Office Hours”
Oskar Maria Grande has joined Public “Office Hours”
Zachary Loeber has joined Public “Office Hours”
Brian Tai has joined Public “Office Hours”
Imran Hussain has joined Public “Office Hours”
Colton Wrisner has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Jonas Steinberg has joined Public “Office Hours”
https://www.artima.com/weblogs/viewpost.jsp?thread=204677
Testivus on Test Coverage
Regarding Geodesic: would you ever consider adding zsh+oh-my-zsh+powerlevel10k? I get having a container to spread around that has a bunch of tools in it but the shell itself lacks numerous convenient features of the shell combo above like sugary history lookup, command completion for kubectl, directional search through files directories, etc.. I’ve spent some time shaping this on Alpine using the geodesic image and it is somewhat a pain because alpine is not meant for such a terminal environment (natively). Nothing wrong with using alpine containers and in fact the powerlevel10k dev uses alpine to demo his stuff; but getting oh-my-zsh working on it including its plugins seems difficult via geodesic.
exceedingly underwhelming and nothing what a serious terminal environment would actually look like
I disagree with this statement. So does Google.
https://google.github.io/styleguide/shellguide.html#which-shell-to-use
Restricting all executable shell scripts to bash gives us a consistent shell language that’s installed on all our machines.
Style guides for Google-originated open-source projects
@roth.andy see my edit. I specify several things which are missing from the shell that I think would make it much more convenient to use.
@roth.andy Additionally: you don’t see the logic of what I was pointing out? (That’s a question). What I’m saying is what’s the point of having a shell you want everyone to use if the shell itself is not that sugary?
So that’s the main concern I have. And if you disagree with that then I’d like to understand why.
I’m not a maintainer of Geodesic, so I can’t speak definitively on it, but I’d imagine that compatibility is more important than convenience to them.
Bash is universal. zsh is one of many options that are all considered alternatives to bash
If they add zsh, should they add ksh when someone who likes ksh better comes along and wants it?
The beauty of Docker containers is you can use Geodesic as the base container in a dockerfile and do whatever you want with it
Yea, the interactive shell, is just one piece of it. We use it as the base image for things like Atlantis, or steps in a pipeline that call helmfile
, or helm
, or kubectl
.
I’ll be honest, have serious FOMO/shell-envy of zsh/fish/etc and the power features of those. Just it’s not yet been a priority. I wouldn’t rule it out entirely, but @roth.andy is correct that bash is the most widely adopted shell. Tides are turning towards zsh
, but I want to make sure don’t make a rash decision. Also, the terminal UI/UX has become a thing these days. Very hard to make it appealing for a wide audience (the audience that cares what the prompt looks like). I know inside our company, there’s a lot of different opinions on colors, characters/utf8, etc. No one can agree.
Imran Hussain has joined Public “Office Hours”
Andrew Thompson has joined Public “Office Hours”
Robert Jackson has joined Public “Office Hours”
Michael Sew has joined Public “Office Hours”
Michael Sew has joined Public “Office Hours”
@Erik Osterman (Cloud Posse) ^^
Sadly… last commit to that alpha provider was at the beginning of December. I really hope that gets more steam — I could use that today (if it was reliable).
2021-03-04
2021-03-05
2021-03-10
@here office hours is starting in 30 minutes! Remember to post your questions here.
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
Luis Masaya has joined Public “Office Hours”
Nicolás de la Torre has joined Public “Office Hours”
Evan Pitstick has joined Public “Office Hours”
Vicken Simonian has joined Public “Office Hours”
Patrick Joyce has joined Public “Office Hours”
Andy Miguel (Cloud Posse) has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Andy Roth has joined Public “Office Hours”
Vlad Ionescu has joined Public “Office Hours”
Imran Hussain has joined Public “Office Hours”
Naiman Daniels has joined Public “Office Hours”
venkatamutyala has joined Public “Office Hours”
James Thalacker has joined Public “Office Hours”
Joaquin Menchaca has joined Public “Office Hours”
Sam C has joined Public “Office Hours”
Rahul has joined Public “Office Hours”
Anton Babenko has joined Public “Office Hours”
Andrew Thompson has joined Public “Office Hours”
links from today’s announcements: https://github.com/cloudposse/terraform-aws-rds-db-proxy https://github.com/cloudposse/terraform-aws-code-deploy/ https://github.com/cloudposse/terraform-aws-ec2-bastion-server https://github.com/cloudposse/terraform-aws-cloudtrail-cloudwatch-alarms https://docs.cloudposse.com/tutorials/geodesic-getting-started/ https://github.com/hashicorp/terraform/releases https://github.com/hashicorp/terraform/releases/tag/v0.14.8 https://cloudposse.com/jobs https://github.com/sponsors/cloudposse https://www.youtube.com/c/cloudposse
Colton Wrisner has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
Cliff Williams has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
Pavel Z has joined Public “Office Hours”
Matt Calhoun has joined Public “Office Hours”
Tim Gourley has joined Public “Office Hours”
Mahmoud Dolah has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
15138278650 has joined Public “Office Hours”
Mahmoud Dolah has joined Public “Office Hours”
Brandon vh has joined Public “Office Hours”
Mahmoud Dolah has joined Public “Office Hours”
Neil Gealy has joined Public “Office Hours”
Mahmoud Dolah has joined Public “Office Hours”
Mahmoud Dolah has joined Public “Office Hours”
Mahmoud Dolah has joined Public “Office Hours”
Kareem Shahin has joined Public “Office Hours”
Vicken Simonian has joined Public “Office Hours”
I recently learned who “The Three Amigos” are, even though I always practiced the mindset. This post explains how to bring ‘em into BDD.
Ola Ade has joined Public “Office Hours”
Cliff Williams has joined Public “Office Hours”
2021-03-11
2021-03-12
2021-03-16
Can we please discuss this during office hours this week? I’ve been waiting on this functionality for a while and I’m kicking the tires on it today. I’m trying it on an existing cluster and having some configuration issues. Might try the walkthrough the article gives just to see this working.
Sad part is they implemented this on the v1 AWS CLI instead of the v2 CLI which i already have installed. Why AWS? WHY!? Anyway, I’m able to run the v1 CLI in a virtualenv so that works.
Looking forward to hearing about the experience folks are having with this! https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/
Today, we are announcing the ability for all Amazon ECS users including developers and operators to “exec” into a container running inside a task deployed on either Amazon EC2 or AWS Fargate. This new functionality, dubbed ECS Exec, allows users to either run an interactive shell or a single command against a container. This was one of […]
2021-03-17
@here office hours is starting in 30 minutes! Remember to post your questions here.
Another question for the office hour today: how do you manage iam user login profiles (console passwords) with a team. The keybase key cannot and should not be shared among members in the team. What do you do if the original creator of the login profile leaves the company and the keybase key is deleted ? Do you taint the resource and recreate it ?
Terraform module to configure AWS Single Sign-On (SSO) - cloudposse/terraform-aws-sso
I’m light on prepared questions today
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
Oliver Schoenborn has joined Public “Office Hours”
Michael Martin has joined Public “Office Hours”
Eric Berg has joined Public “Office Hours”
Cliff Williams has joined Public “Office Hours”
Michael Jenkins has joined Public “Office Hours”
Brandon vh has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
Andy Miguel (Cloud Posse) has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
sri has joined Public “Office Hours”
Tim Gourley has joined Public “Office Hours”
Michael Holt has joined Public “Office Hours”
Matt Gowie has joined Public “Office Hours”
mb Branski has joined Public “Office Hours”
Hao Wang has joined Public “Office Hours”
15138278650 has joined Public “Office Hours”
Matt Calhoun has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Nathaniel Selzer has joined Public “Office Hours”
uwaila adams has joined Public “Office Hours”
Mauricio Hernandez has joined Public “Office Hours”
Vlad Ionescu has joined Public “Office Hours”
Neil Gealy has joined Public “Office Hours”
Vicken Simonian has joined Public “Office Hours”
links from today’s announcements: https://goteleport.com/blog/introducing-database-access/ https://aws.amazon.com/blogs/containers/new-using-amazon-ecs-exec-access-your-containers-fargate-ec2/ https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html https://github.com/hashicorp/terraform/releases/tag/v0.15.0-beta2 https://cloudposse.com/jobs https://github.com/sponsors/cloudposse https://www.youtube.com/c/cloudposse
David Lozano has joined Public “Office Hours”
Easily run one-off tasks against a ECS Task Definition - masterpointio/ecsrun
Obi Anyaoku has joined Public “Office Hours”
Luis Masaya has joined Public “Office Hours”
Mazin Ahmed has joined Public “Office Hours”
Makefile example for Michael:
decrypt-user-password:
@if [[ "$(USER)" == "" ]]; then \
echo "Please set USER to first_name.last_name prior to running 'make decrypt-user-password'" && exit 1; \
fi;
@PGP_KEY_JSON=$$(aws secretsmanager get-secret-value --secret-id terraform_iam_users_pgp_key | jq -r ".SecretString"); \
export GPG_TTY=$(tty); \
echo $$PGP_KEY_JSON | jq -r ".terraform_users_pgp_private_key" | gpg --import; \
export PGP_PASSPHRASE=$$(echo $$PGP_KEY_JSON | jq -r ".terraform_users_pgp_passphrase"); \
cd ./components/iam_infra; \
export ENCRYPTED_PASSWORD=$$(terraform output --json | jq -r '.user_encrypted_passwords.value | .["$(USER)"]'); \
export RAW_PASSWORD=$$(echo $$ENCRYPTED_PASSWORD | base64 --decode | gpg --decrypt --batch --passphrase $$PGP_PASSPHRASE); \
printf "\nPrivate message $(USER) in Slack with the following:\n\n"; \
echo "Hey, you got a fancy new AWS Login :cool-doge: Check out the info and guide below to get everything setup:"; \
echo ""; \
echo "AWS Account Setup Guide: REDACTED"; \
echo "Console Login URL: REDACTED"; \
echo "username: $(USER)"; \
echo "password: $$RAW_PASSWORD";
@Mike Martin
Antoine TAILLEFER has joined Public “Office Hours”
Hao Wang has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
Andrew Thompson has joined Public “Office Hours”
Mike Martin has joined Public “Office Hours”
Patrick Joyce has joined Public “Office Hours”
ASIS SETHI has joined Public “Office Hours”
Joaquin Menchaca has joined Public “Office Hours”
would you pick teleport over strongdm now the teleport supports mysql and postgres?
from AWS API Gateway:
When private DNS is enabled, you’re able to access your API via private or public DNS. (This setting doesn’t affect who can access your API, only which DNS addresses they can use.) However, you cannot access public APIs from a VPC by using an API Gateway VPC endpoint with private DNS enabled. Note that these DNS settings don’t affect the ability to call these public APIs from the VPC if you’re using an edge-optimized custom domain name to access the public API. Using an edge-optimized custom domain name to access your public API (while using private DNS to access your private API) is one way to access both public and private APIs from a VPC where the endpoint has been created with private DNS enabled.
this is key statement :
However, you cannot access public APIs from a VPC by using an API Gateway VPC endpoint with private DNS enabled
sorry that I interrupted you in the call
no worries!
but what about this part?
Using an edge-optimized custom domain name to access your public API (while using private DNS to access your private API) is one way to access both public and private APIs from a VPC where the endpoint has been created with private DNS enabled.
private DNS should work in this case?
is you api endpoint, public or private?
when i hopefully get it working, the endpoint would be private
if the endpoint is private AFAIK you are forced to use the huge long name of the vpc endpoint
I think the problem is that they somehow check the host header so if it does not match then it fails
got it
In my case I was using a private endpoint with and API policy to check which VPC the request was coming from
yeah a vanity URL would be nice for this project so i keep pressing that way. if we have to use the machine named URL so be it
and that combination did not work even when I used a cname to point to the vpc endpoint
you could try to setup the private endpoint nd then cname a dns and see if it works
I think it might work if you do not have custom policies
ok. i will just try to get it working and then will hack on any improvements. something is better than nothing at this point
i’ll circle back with the final implementation
awesome
Antoine TAILLEFER has joined Public “Office Hours”
2021-03-24
Reposting my question from a few weeks back in #kubernetes as I’m striking out on this one. We don’t need to talk about this in depth at all, but if anybody is managing a larger TCP service in production then I’d like to chat with you!
https://sweetops.slack.com/archives/CBW699XE0/p1614790261014800
Not exactly a Kubernetes question, but figured folks in this channel would know what I’m talking about exists — Does anyone know if there is a Network / TCP proxy tool out there that will do a manage-and-forward pattern (my own made up term for describing this) for long lived TCP connections?
I have a client running on K8s and one of their primary microservices holds long lived TCP socket connections with many thousands of clients through an AWS NLB. The problem is that whenever we do a deployment and update those pods the TCP connections require a re-connection which results in problems on the client side. So to provide an better experience for the clients we’re looking at what we can do to have those TCP connections always stay alive. My first thought is for a proxy layer that manages the socket connections with the client and then forwards socket connections to the actual service pods. That way even if the pods are swapped out behind the scenes, the original socket connection is still up and has no adverse affects on the clients.
https://github.com/yannh/kubeconform <– cool little tool for validating kube manifests in pipelines worth a quick once over
A FAST Kubernetes manifests validator, with support for Custom Resources! - yannh/kubeconform
Hi everyone, would like to hear what are the key points you consider when deciding to deploy your workloads on ECS EC2 or ECS Fargate. What would make you to pick Fargate even though it’s more expensive when running the tasks 24/7. Is the simplicity of scaling out/in the only factor influencing this decision?
not having to care about AMI/OS patching
(scanning the container image is still necessary, but that’s true either way)
IMO that pays for itself in regards to the straight up difference when comparing EC2
also, now that Fargate has Spot Pricing the gap is being closed
very valid points @Darren Cunningham
great job on the video @Vlad Ionescu (he/him) – really appreciate the callout about people costs and fully agree that a lot of teams overlook this and end up sinking hours in effort and opportunity loss in order to save on their monthly bill
Thank you!
@here office hours is starting in 30 minutes! Remember to post your questions here.
Built-in Pod Security Policies vs OPA? OPA is more work, but way more flexible. How to choose between them?
aren’t pod security policies deprecated?
Didn’t know that, thanks. That makes that decision easy
yeah, we choose OPA with Gatekeeper.
The Kubernetes Policy (PSP) will soon get deprecated, replaced with a Pod Security Standards (PSS). Learn how it affects your K8s security & why using an OPA-based admission controller is better.
thanks for the suggestion to go for amazon sso, how do you manage the users and passwords inside amazon sso ? Via terraform as well ?
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
tyler stilwagne has joined Public “Office Hours”
uwaila adams has joined Public “Office Hours”
David Lozano has joined Public “Office Hours”
Zachary Loeber has joined Public “Office Hours”
Mahmoud Dolah has joined Public “Office Hours”
Brian Stascavage has joined Public “Office Hours”
Yuri Lima has joined Public “Office Hours”
mb Branski has joined Public “Office Hours”
James Thalacker has joined Public “Office Hours”
Michael Jenkins has joined Public “Office Hours”
Mike Martin has joined Public “Office Hours”
Matt Gowie has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
Matt Calhoun has joined Public “Office Hours”
Kristopher Flint has joined Public “Office Hours”
Sam C has joined Public “Office Hours”
O A has joined Public “Office Hours”
Andy Roth has joined Public “Office Hours”
Hugo Oliveira has joined Public “Office Hours”
Luis Masaya has joined Public “Office Hours”
Tim Gourley has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
Brian Tai has joined Public “Office Hours”
15138278650 has joined Public “Office Hours”
Jaime S has joined Public “Office Hours”
Vlad Ionescu has joined Public “Office Hours”
Cliff Williams has joined Public “Office Hours”
If you want to learn more about Geodesic — we’ve got our first tutorial up on the docs site: https://docs.cloudposse.com/tutorials/geodesic-getting-started/
Akshay Jain has joined Public “Office Hours”
Brandon vh has joined Public “Office Hours”
Michael Sew has joined Public “Office Hours”
Andy Miguel (Cloud Posse) has joined Public “Office Hours”
Vicken Simonian has joined Public “Office Hours”
Naiman Daniels has joined Public “Office Hours”
Michael Holt has joined Public “Office Hours”
Automated Terraform code reviews for velocity: https://www.hashicorp.com/resources/terraform-code-reviews-supercharged-with-conftest
Learn how Doordash automated away some mundane code review tasks for infrastructure code.
ASIS SETHI has joined Public “Office Hours”
Colton Wrisner has joined Public “Office Hours”
Mike Martin has joined Public “Office Hours”
~I know https://pullreminders.com was a thing for PR reminders/analytics~
Seems gone now
Oh god. I did not see the banner
Patrick Joyce has joined Public “Office Hours”
Antoine TAILLEFER has joined Public “Office Hours”
Isa Aguilar has joined Public “Office Hours”
https://github.com/kubernetes/enhancements/issues/5#issuecomment-776043765:
For anyone following this ticket, PSPs will be deprecated in 1.21 with removal targeted for 1.25.
This is correct. We moved deprecation from 1.22 to 1.21 because we know that existing PSP API will not be losslessly backward compatible with a future replacement. PSP removal is staying at the previously planned 1.25.
Feature Description Define policy objects that limit what security-related features pods and containers can use Primary contact (assignee): @tallclair Responsible SIGs: @kubernetes/sig-auth-feature…
The Kubernetes Policy (PSP) will soon get deprecated, replaced with a Pod Security Standards (PSS). Learn how it affects your K8s security & why using an OPA-based admission controller is better.
When you store data in Amazon Simple Storage Service (S3), you can easily share it for use by multiple applications. However, each application has its own requirements and may need a different view of the data. For example, a dataset created by an e-commerce application may include personally identifiable information (PII) that is not needed […]
Regarding the ECS AutoScaling + Capacity Providers question in chat: https://aws.amazon.com/blogs/containers/deep-dive-on-amazon-ecs-cluster-auto-scaling/ will answer the question! It goes super-in-depth on the topic, including how they talk to the ASG and why
Introduction Up until recently, ensuring that the number of EC2 instances in your ECS cluster would scale as needed to accommodate your tasks and services could be challenging. ECS clusters could not always scale out when needed, and scaling in could impact availability unless handled carefully. Sometimes, customers would resort to custom tooling such as […]
2021-03-30
2021-03-31
Hi everyone, would like to hear you opinion / experience using GitHub and GH actions vs AWS codeBuild, codePipeline and codeDeploy for CI/CD pipelines when source code is in Github and want to deploy to ECS.
Using AWS products for cicd is nightmare. You can do it though and they do work but if you can choose then look for other solutions first.
@here office hours is starting in 30 minutes! Remember to post your questions here.
one question Erik, I will join the call as well. Howto migrate existing terraform configurations to a modular configuration, for example based on the cloudposse modules
Andy Miguel (Cloud Posse) has joined Public “Office Hours”
Bart Coddens has joined Public “Office Hours”
James Thalacker has joined Public “Office Hours”
Michael Martin has joined Public “Office Hours”
Erik Osterman (Cloud Posse) has joined Public “Office Hours”
Neil Gealy has joined Public “Office Hours”
Vlad Ionescu has joined Public “Office Hours”
David Lozano has joined Public “Office Hours”
Yonatan Koren has joined Public “Office Hours”
Sam C has joined Public “Office Hours”
mb Branski has joined Public “Office Hours”
ASIS SETHI has joined Public “Office Hours”
Stan M has joined Public “Office Hours”
Andy Roth has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Matt Calhoun has joined Public “Office Hours”
Luis Masaya has joined Public “Office Hours”
Andrey Nazarov has joined Public “Office Hours”
Michael Jenkins has joined Public “Office Hours”
imran.hussain has joined Public “Office Hours”
Kristopher Flint has joined Public “Office Hours”
Mohammed Yahya has joined Public “Office Hours”
Soham Dutta has joined Public “Office Hours”
PePe Amengual has joined Public “Office Hours”
Hugo Oliveira has joined Public “Office Hours”
Please share the link here)
all those “Public “Office Hours” are the links
It was about atmos docs, sorry for such a fuzzy request). Andy has already shared:)
ok
links from today’s announcements: https://docs.cloudposse.com/tutorials/atmos-getting-started/ https://github.com/cloudposse/terraform-cloudflare-zone https://github.com/cloudposse/terraform-cloudflare-waf-rulesets/ https://github.com/hashicorp/terraform/releases/tag/v0.15.0-rc1 https://github.com/sponsors/cloudposse
Contribute to cloudposse/terraform-cloudflare-zone development by creating an account on GitHub.
Contribute to cloudposse/terraform-cloudflare-waf-rulesets development by creating an account on GitHub.
0.15.0-rc1 (Unreleased) ENHANCEMENTS: backend/azurerm: Dependency Update and Fixes (#28181) BUG FIXES: core: Fix crash when referencing resources with sensitive fields that may be unknown (#2818…
Cloud Posse is a DevOps Accelerator that helps companies own their infrastructure in record time by building it with you and then showing you the ropes. Everything we do is 100% Open Source under A…
Zachary Loeber has joined Public “Office Hours”
mb Branski has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Eric Berg has joined Public “Office Hours”
Sony Francis has joined Public “Office Hours”
Andrew Thompson has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Gilberto Junior has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Blaisep has joined Public “Office Hours”
rizky ramadhan has joined Public “Office Hours”
Fernando Sanz has joined Public “Office Hours”
AWS for GitHub Actions has 13 repositories available. Follow their code on GitHub.
Run a AWS CodeBuild project as a step in a GitHub Actions workflow job. - aws-actions/aws-codebuild-run-build
Florain Drescher has joined Public “Office Hours”
Phil Sautter has joined Public “Office Hours”
Example of logs in GitHub Checks, something that CirlceCI could do but doesn’t: https://github.com/brigadecore/brigade/pull/914/checks?check_run_id=130703731
closes #913 What this PR does / why we need it: This PR logs the error message when an error is thrown but not handled. One area I'd like to dig a bit deeper is around the different log levels,…
Mohammed Yahya has joined Public “Office Hours”
Hao Wang has joined Public “Office Hours”
Registers an Amazon ECS task definition and deploys it to an ECS service. - aws-actions/amazon-ecs-deploy-task-definition
uwaila adams has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Jailson Silva has joined Public “Office Hours”
Joaquin Menchaca has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
a quick question, is terraform import
similar to google’s terraformer
?
no. terraformer
actually generates terraform code, terraform import
just imports existing resources into terraform state
got it, hmm, interesting
CLI tool to generate terraform files from existing infrastructure (reverse Terraform). Infrastructure to Code - GoogleCloudPlatform/terraformer
Florain Drescher has joined Public “Office Hours”
Michael Londeen has joined Public “Office Hours”
In addition to terraformer if you are on GCP now you can do something like
gcloud alpha resource-config bulk-export --project my-project --resource-format=terraform
to export your resources in TF format
https://cloud.google.com/sdk/gcloud/reference/alpha/resource-config/bulk-export
Florain Drescher has joined Public “Office Hours”
clickops, it is an innovation lol
Florain Drescher has joined Public “Office Hours”
Terraform module that provision an S3 bucket to store the terraform.tfstate
file and a DynamoDB table to lock the state file to prevent concurrent modifications and state corruption. - cloudposse…
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
Florain Drescher has joined Public “Office Hours”
What was the tool? Stitch?
Found. https://www.stitchdata.com/
All your data. Where you want it. In minutes. Stitch is a cloud-first, developer-focused platform for rapidly moving data. Hundreds of data teams rely on Stitch to securely and reliably move their data from SaaS tools and databases into their data warehouses and data lakes.