mastodon.world is one of the many independent Mastodon servers you can use to participate in the fediverse.
Generic Mastodon server for anyone to use.

Server stats:

8.5K
active users

#Terraform

14 posts12 participants0 posts today

Looking to simplify your cloud setup?

In this video, we walk through the basics of using AWS and Terraform to quickly deploy systems—including FreeBSD, in a scalable, test-friendly environment.

What you'll need:

- An active AWS account
- Terraform installed (Homebrew works well on Mac)
- Your AWS credentials
- This is a great starting point for trying out FreeBSD in the cloud.

🎥 Click here to watch the full video:
youtube.com/watch?v=V9-5QC6vLHY

The joys of being a #CLI guy in a world full of (web) #GUI users…

So, I'm now working on a newish (to me) project that's based on
#AWS. Customer's dev-to-prod topology is set up through a few dozen accounts. Each of the accounts is its own authentication-domain. Each account's webUI has a 1-hour timeout for login credentials. Each account's CLI credentials have a multi-hour timeout.

I'm a CLI-first kind of guy, and the AWS webUI's session-management is kind of ass: if you're logged in to one account, you can't really be logged into another in the same browser profile. By itself, not a problem, since I mostly use the CLI utilities and each terminal session can maintain a wholly-separate login session to AWS.

One of the customer's programs that I wrote some
#terraform for was having issues connecting directly to their RDS from their remote-desktop hosts. I got pinged on Slack to take a look and try to figure out what's wrong.

I do a quick query of the RDS's security group and see no rules indicating that the security group
should allow access. The PM who pinged me to help the customer-user, is barking that he sees the access-exception in the GUI. "Cool: I'm not seeing what you're seeing in the CLI".

Ultimately, it turns out that the customer-user had attached a security-group to the RDS and added her ingress rule
there. As designed, the RDS was only supposed to have a single RDS attached to it and any modifications should have happened there. PM gets cranky that I'm making too many assumptions and that I should ignore my automation …never mind that the automation was supposed to be how people deploy/modify RDSes and associated objects. I point out to the PM that, at no time in the conversation, did anyone say "I added a security group and made my changes there", just "I made changes". I further point out that the webUI's view on things can often be the result of a compound query and that I can make a similar query, but only if someone provides me enough information that I know to do so. Ultimately, I was able to see what the customer-user had done by executing:

aws ec2 describe-security-groups \
  --query 'SecurityGroups[].IpPermissions[].{
    CIDRS:IpRanges[].CidrIp,
    Groups:UserIdGroupPairs[].GroupId
  }' \
  --group-id $(
    aws rds describe-db-instances \
      --query 'DBInstances[].VpcSecurityGroups[].VpcSecurityGroupId' \
      --filters 'Name=db-instance-id,Values=' \
      --output text
  ) --output text

Ultimately, it turned out that the customer-user had added invalid CIDRs to her ingress rules. I wouldn't have been able to help with that, any way, since I have no idea what CIDRs were correct for where she was attempting to connect from. However, once the PM provided the updated CIDRs and she updated her ingress-rules, all was good to go.

Still: exceedingly frustrating getting yelled at for, essentially, not being a fucking mind-reader.

I've been using #saltstack for years, but slowly coming to the realization it might be time to move on. Not really a fan of #ansible or #terraform so I'm not sure I would migrate to that. Reluctantly thinking it might be time to bite the bullet and properly give #k8s a chance. Not a huge fan of verbose yaml everywhere, so there's a part of me that is tempted to write something higher level, that outputs to yaml (I know #helm exists, but it also looks quite wordy (yamly?)) 🤔

DevOps Trio: Terraform, Kubernetes & Helm leanpub.com/b/terraform-kubern by Kirshi Yin | Curious Devs Corner is the featured bundle of ebooks 📚 on the Leanpub homepage! leanpub.com #Terraform #Devops #CloudComputing #ComputerProgramming #InfrastructureAsCode #Docker #Go #books #ebooks

This bundle includes three beginner-friendly ebooks with real examples and step-by-step guidance.

Learn the fundamentals of Helm, Kubernetes, and Terraform from scratch!

Find it on Leanpub!

LeanpubDevOps Trio: Terraform, Kubernetes & HelmThis bundle includes three beginner-friendly ebooks with real examples and step-by-step guidance. Learn the fundamentals of Helm, Kubernetes, and Terraform from scratch!

#Terraform really needs a better way to show "minimum set of permissions required to do the apply/destroy than "parse a TRACE/DEBUG log".

I should be able to extract what I need with just a
grep and not have to ass around with cobbling together a whole sed, cut, sort and awk pipeline. Fortunately, because I was using #BASH, I was at least able to avoid a tr.