- 164
- 303 172
Pablo's Spot
Australia
Приєднався 6 січ 2021
Pablo's spot is a space where learning meets doing. This channel provides series of videos that show some implementations and use of tools around (but may not be limited to) cloud technology. It is a show and tell channel tapping on experiences on the use of tools around the DevOps space.
Visit our website: pablosspot.com
We are on discord in case you want to drop a question.
discord.gg/5k8kZXMUP3
This may also be our place where we share and exchange knowledge.
Visit our website: pablosspot.com
We are on discord in case you want to drop a question.
discord.gg/5k8kZXMUP3
This may also be our place where we share and exchange knowledge.
How to configure non ROOT user on docker images
This episode covers some basic perspective to understanding why ROOT user should not be used when running docker containers. This also covers basic approach to setting up a non-ROOT user on docker configuration files.
Visit learn.pablosspot.com for more curated materials.
If you wish to support me, I have a kofi page: ko-fi.com/pablosspot
For my outdoor adventures, checkout my other youtube channel @poochesoutdoor
Visit learn.pablosspot.com for more curated materials.
If you wish to support me, I have a kofi page: ko-fi.com/pablosspot
For my outdoor adventures, checkout my other youtube channel @poochesoutdoor
Переглядів: 708
Відео
How to use chainguard docker images to create a secure and minimal python docker image
Переглядів 3516 місяців тому
This episode navigates through chainguard’s website/documentation to refactor a python docker image that is used to build the backend component of the Event Driven Architecture series. This refactoring exercises attempts to tap on chainguard’s docker images as base image to create a secure docker image with minimal size. Related video materials: Event Driven Architecture series: Event Driven Ar...
How to implement Content Security Policy on scripts - Infrastructure approach vs HTML code approach
Переглядів 30311 місяців тому
This is the first episode on a series of implementing Content Security Policy on web applications. This episode covers the implementation of script source policy. It provides a walk through of implementing the protection through infrastructure resource (e.g. AWS Cloudfront) and through META tags in HTML code. Check out learn.pablosspot.com/library for curated list of video materials. Some usefu...
How to migrate from Terraform Cloud to S3 bucket - Terraform State Management
Переглядів 32411 місяців тому
This episode covers the process of migrating terraform state management from Terraform Cloud to AWS S3 bucket. Check out learn.pablosspot.com/library for curated list of video materials. Useful references: Renaming terraform resource: ua-cam.com/video/mxDqfkfjZmw/v-deo.html Setup and use of aws-vault: ua-cam.com/video/lC0qM5bsZDI/v-deo.html Setup and use of ASDF: ua-cam.com/video/3rmAqDUsTqQ/v-...
How to integrate docker build process with Terraform
Переглядів 674Рік тому
In this episode, I cover the integration of terraform with the docker build process. This episode also covers some implementations I have done in the past to address the issue of rebuilding docker images within terraform. Check out learn.pablosspot.com/library for curated list of video materials. Docker terraform provider: registry.terraform.io/providers/kreuzwerker/docker/latest/docs github.co...
How to rename terraform resources using the worst and the best options
Переглядів 269Рік тому
In this episode, I tackle the different ways of renaming resources that are already created and managed by terraform. This episode shows the tree different options that I have used to go about renaming resources as a result of using a more meaningful resource name or converting flat single resources to index based. Check out learn.pablosspot.com/library for curated list of video materials. If y...
How to setup idempotent ingress/egress on Security Groups with Terraform
Переглядів 833Рік тому
In this episode, I look into how to setup ingress and egress properties to AWS Security Groups with Terraform that will allow for granular reporting of infrastructure changes. Embedded ingress and egress properties on AWS Security Groups sometimes enable unnecessary reporting of changes to AWS Security Group resources. On this episode, I look into how to setup these properties better than embed...
My Personal Thoughts on Hashicorp's License Change
Переглядів 104Рік тому
My Personal Thoughts on Hashicorp's License Change
How to use variables with Terraform for Infrastructure as Code
Переглядів 171Рік тому
How to use variables with Terraform for Infrastructure as Code
How to secure DevOPS web tools (runatlantis service) with OKTA
Переглядів 388Рік тому
How to secure DevOPS web tools (runatlantis service) with OKTA
How to setup Basic Lambda Function (REHASH)
Переглядів 132Рік тому
How to setup Basic Lambda Function (REHASH)
How to secure environment variables with ECS and Parameter Store (REHASH)
Переглядів 1,6 тис.Рік тому
How to secure environment variables with ECS and Parameter Store (REHASH)
Redirect HTTP to HTTPS with AWS Load Balancer
Переглядів 6 тис.Рік тому
Redirect HTTP to HTTPS with AWS Load Balancer
How to run GitOps process with Run Atlantis
Переглядів 773Рік тому
How to run GitOps process with Run Atlantis
How to setup AWS ECS Infrastructure for Run Atlantis
Переглядів 810Рік тому
How to setup AWS ECS Infrastructure for Run Atlantis
How to use ChatGPT for quick knowledge access
Переглядів 208Рік тому
How to use ChatGPT for quick knowledge access
How to secure and manage environment variables with Parameter Store in AWS
Переглядів 3,5 тис.Рік тому
How to secure and manage environment variables with Parameter Store in AWS
How to build and publish my custom RunAtlantis docker Image with Terraform
Переглядів 638Рік тому
How to build and publish my custom RunAtlantis docker Image with Terraform
Migrating local Run Atlantis setup to AWS ECS - The Preparation
Переглядів 891Рік тому
Migrating local Run Atlantis setup to AWS ECS - The Preparation
Terraform Code - Why for_each is better than count
Переглядів 1,2 тис.Рік тому
Terraform Code - Why for_each is better than count
How to minimise Infrastructure Cost on AWS Load Balancer
Переглядів 690Рік тому
How to minimise Infrastructure Cost on AWS Load Balancer
How to integrate ECS with AWS Load Balancer
Переглядів 988Рік тому
How to integrate ECS with AWS Load Balancer
How to Setup Authentication using AWS Load Balancer and OKTA
Переглядів 1,7 тис.2 роки тому
How to Setup Authentication using AWS Load Balancer and OKTA
How to integrate AWS Load Balancer and Lambda Function
Переглядів 1,8 тис.2 роки тому
How to integrate AWS Load Balancer and Lambda Function
Fixing security flaw: Protecting app on ec2 instance with AWS Load Balancer
Переглядів 1532 роки тому
Fixing security flaw: Protecting app on ec2 instance with AWS Load Balancer
How to secure EC2 application with AWS load balancer (IaC with Terraform)
Переглядів 1,3 тис.2 роки тому
How to secure EC2 application with AWS load balancer (IaC with Terraform)
How to secure AWS Load Balancer with Listener Rules
Переглядів 7382 роки тому
How to secure AWS Load Balancer with Listener Rules
How to secure AWS Load Balancer with Terraform - Reject Requests by Default
Переглядів 2682 роки тому
How to secure AWS Load Balancer with Terraform - Reject Requests by Default
What if I created the resources using console, would terraform list resources for me?
Thank you 🎉
you're welcome :)
amazing content, thanks so much
Glad you enjoy it!
Well explained... Please make more videos on this topic.. Thanks!
Thank you, I will
it's not OSI stands for Open Systems Interconnect?
Ah yes! It stands for that too. 😊. That 7 layers - physical to application layers.
@Pablo, this is exactly what I was looking for. Now, I don't have to explain to people what needs to be modified in the user data per run. Thanks!
Thanks for explain us :)
thanks, it is very helpful
thank you so much for such an easy to follow tutorial, adding the http listener fixed my issue that I've been stuck on for hours
You’re welcome :)
Manually deploying .js in my personal linux i see the output “hello world” when i browse localhost:3000 but when I execute eb deploy and eb open I don’t see any output. Eb logs are emty no any lines. I have index.js and package.json file in my linux system and i want to deploy it but getting this issue.
This might be specific to eb cli.
@@pablosspot i could fix the issue .. Thanks for the reply though!
The "backgroundColor" seems cannot assign with "#000000"
can the templatefile accepts something like host_port = var.host_port?
Yes most definitely
i have a var.count for no. of cluster. Can I still implement for_each in this case?
If you are creating clusters based on the value of var.count, I think implementing for_each is not necessary since var.count will always force the traversal to be a counter e.q. it will start from 0, then 1, then 2 ...etc. So this will ensure your infrastructure will be idempotent. But if you are still keen to use for_each, you will have to convert your var.count into a list then convert it to a set: for_each = toset(range(var.count)) That in itself is already an unnecessary calculation in the code.
Thank you friend! This was super useful and it will make me save LOT of time. Also the task extension is great. Thanks again! 🍀
It's a good and clean solution but there is a downside, in case there are multiple rules and multiple sub nets, each new sub net could exceed the rules limit on the security group
This one is very true. You may not know outright when you exceed the rule limit although i would imagine this could be trapped when updating the infrastructure. If you deal with multiple subnets, 60 CIDR blocks can easily creep up on you which I suppose can be adjusted by requesting a limit change.
docker scan --login is not working
Hi @pikachu3686. What error are you getting? If you run docker scan and it says command not found, you will need to install the docker-scan-plugin package to make it work.
Crisp and too the point! Thanks!
Literally the only vid on YT I could find on this.
i am installing things on my own VM will I be needing ngrok?
If you have github and atlantis running on your own VM on the same network, you just have to make sure your github server is reachable from your atlantis instance.
@@pablosspot thank you but I am getting another error: atlantis plan throws below error: running "/usr/bin/terraform init -input=false -upgrade" in "/home/ubuntu/.atlantis/repos/Tranzub/devopstf/6/default/oracle-infrastructure": exit status 1 Initializing the backend... ╷ │ Error: Can't ask approval for state migration when interactive input is disabled. │ │ Please remove the "-input=false" option and try again.
@@aayushmohta592 Have you tried removing the "-input=false"?
The message "approval for state migration" suggests that you are changing terraform backend. I suggest you migrate your state first before you start integrating with atlantis.
Very useful! Thanks a lot! And a big greeting for your Puppy!
You're welcome 🐕
spot on, thanks a lot
You're very welcome :)
Really well explained, thanks!
Thank you!
Awesome channel , excellent job !
Can it work with smtp service ?
I have not tried it but i think it does. If you have a local SMTP service that you need to expose to the internet and you know which port it is running on (e.g. generic smtp ports are 25 and 465), you can start ngrok for that port.
Would it be better to use a response headers policy?
You are correct. This video came about before AWS introduced the separate response and cache policies on their cloudfront resource. I might have to look into creating a video for that.
Option 2 seems better than having to write a moved block
100%!
@@pablosspot i was manually editing the state in a text editor before i watched this 😂
@@omirrrr oooh! I did that before and made a mistake and it was a nightmare to recover. I ended up bailing out of my state file and re-importing all my resources.
where does the result come from in data.external.git.result.value ?
It is the console output when you run the program defined in data.external which in this case is running a script to get the git sha with the echo command: ua-cam.com/video/22MVpDArIhg/v-deo.html&lc=UgxAyyT7ub8HQPuESxR4AaABAg#t=4m13s
If the link works when the app is terminated
The ngrok link will not work if the app is not running.
thanks for the video. why do you have to pass to snyk/action/docker@master the full path image in the CR and also de Dockerfile..? why does it need the Dockerfile if the image is already builded?
Hi @raffaelloringue. Thanks for this question. My understanding is that the Dockerfile contains all the explicit instructions used to build the docker image. This allows snyk to perform a more efficient and effective scan because the Dockerfile provides exactly what steps are done, what layers are setup and what base images are used. I suppose snyk can do an introspection of docker images to derive the instructions but it may not be exactly the same as the actual Dockerfile.
Thanks. An excellent video!
I am stuck in one problem - have alb with ip instance type and my ecs fargate ip get change dynamic how ican configure ecs fargate ip to target group as type ip
You are better off setting up ECS Service which will then get associated with your target group.
Check this one out ua-cam.com/video/_0AiP1SC4Mo/v-deo.html And look at 13:08
Pablo , there is great effort in creating such content , but i see it is so fast that we need to pause the videos n number of times to see what you are doing as well getting all the commands what you are typing , the question here is why have made it in faster mode, i know you need to keep the video length shorter , but what is the use if the audience or viewer are facing this issue, let the videos be 30 mins or 1 hours, people are there to watch the full content and the way you have presented it is just awesome
Thank you for your feedback. I'm actually in the process of recreating some of these videos. The only challenge I have at the moment is that I also need to make sure this captures some latest stuff. I very very much appreciate the feedback though. Thank you!
what if we have dont teraform to do such activity , is there way to do from UI
Hi @nishantpanchal24. Sorry for the very late response. This can be done via the UI most definitely. But the problem with doing it this way is that this does not assure 100% repeatability. The reason we put all infrastructure changes in a code is so that we can save them in version control so the knowledge can be shared very readily with other people and automation process can be implemented against the code. I suggest look into/explore terraform (or opentofu).
That's a very good lesson! Thank you!
You're very welcome!
thank you
You're welcome
Hello, I appreciate your videos. What to do with the `imports` statements after `terraform init` using the s3 bucket for the state files ?
After you have run terraform apply, you can get rid of those import statements
Awesome video I have query regarding create private module it is what about provider version like required providers for transform AWS ..
I think it is best to keep the providers out of terraform modules. You will need to set this up inside your IaC repo which will then be used inside the tf module
@@pablosspot thank you got it.
One of the rare tutorial out there, most of them I see is using fargate. Thank you!
Thank you, appreciate those nice words :) . The EC2 instance type is set as part of the auto scaling which is the next video in the playlist here ua-cam.com/play/PLiF-Vmkmf3EnQVTPXRRpHtyEgN9L-SSwX.html&si=OT3BzgZ3iHIBWCsc
Hi. Thank you for the great explanation. I have just one doubt tho. I have a template that I'm trying to pass with the templatefile but those variable values are not simple string but these are more complex data structures, list of maps for instance. And these are also defined as variables in variables.tf but I see a problem trying to put them into a template. Would you be able he help me there please?
Sure. Please let me know what the problem is and I will try to help. :)
Have you tried doing a jsonencode? You can define 1 variable in the template file and try to assign the value from jsonencode.
Thank you very much
Thanks Pablo. I am not sure, how many of you tried this method. But, i ran into some issues. When i added "ReadOnlyAccess" Group in your terragrunt.hcl variable file. It is looping me to 2 AWS Accounts (All the AWS Accounts).
When you added "PS-Administrator" in your terragrunt.hcl variable file, May i know, why is it showing, you got access to 2 AWS Accounts ends with 499, 966. Eventhough, you added PS-Administrator into Administrator Group. Terraform code is looping in all the aws_accounts that, you mentioned.
how do you feel the TF change to BSL license? maybe time to move away from Hashicorp
Not happy. Most if not all of my terraform backend are in terraform cloud. I have finished moving them to S3 but that means I will have to pay minimal amount for storage. I'm slowly moving away from them but not with Terraform. I have stopped using vault. Im also slowly getting myself familiar with opentofu. So far the move is seamless (Im working on a very very short show and tell about the move).
Really great content. Your example problem and what is needed to fix it then your technical explanation of how to implement the solution via terraform A++ #terraform #awslb
awesome very clear explanation appreciate efforts !
Really great info!
thanks, as always very interesting. At my place we still use TF ver 0.11.5 so I have no choice but to do manual state changes and imports :/
That’s very very old. Any reason why you are not upgrading. I mean there’s things to be done before getting to version one but there’s also so much things that will make tf easier with any of the version 1 releases.
@@pablosspot it's just too large. I think they made a team which is responsible for creating mirror infrastructure for different traffic flows with the latest versions of everything. The traffic would be then redirected into that. Upgrading everything wouldn't work as there are too many dependencies and the code is old
@@flesz_ that’s what I thought. I went through that painful process from 0.12 to 1.1. Extra difficult if you have inherited the code. But if there’s a way you can gradually upgrade, I highly recommend. There’s a number of security related features like masking secret values in state that you can benefit from at least version 1. My words are prescriptive and not imperative :)
Awesome Video..
even i know this things, i watch your videos for entertaiment and for a way i can explain to others this knowleage
Thanks. Its great 👍 👌