https://cloudposse.com logo
Join Slack
Powered by
Hello, I am attempting to testing with newest vers...
# atmos
s
Hello, I am attempting to testing with newest version 
1.207
. Are these fixes still in progress ?
a
@Sean fixes/improvements for 
locals
did not make into 
1.207.0
- we are working on it and it will be in the next release next week
👍 1
s
Hello, I see 
1.208.0
was released last week but I dont see 
locals
mentioned in the notes. Are the fixes included or still pending ?
a
still pending, apologies for the delay (we had to test and release other functionality), it will be in 1.210.0
👍 1
s
Hello, I have some changes to make today which could greatly benefit from this & see 
1.210
is available. Did the fixes make it into the release ?
e
@Andriy Knysh (Cloud Posse) ☝️
a
the updates for locals are in the release 1.210.0
🙌 1
and 1.210.1
s
that is great news, thank you!
a
please validate and let us know if any issues
👍 1
s
Did some testing, we have our git action runners normally configured with:
Copy code
resources:
              limits:
                cpu: 1000m
                memory: 3Gi
              requests:
                cpu: 500m
                memory: 2Gi
I've attempted to use 1 local var in a small stack and it keeps getting OOMKilled even after updating 
resources.limits.memory: 6Gi
with 
v1.210.1
going to revert our stack and find another way for now
a
are you suing this config?
Copy code
locals:
  my_var: !terraform.state example/componentZero '.attr["key"]'

components:
  terraform:
    example/componentOne:
      settings:
        depends_on:
          1:
            component: example/componentZero
      vars:
        someAttr: "{{ .locals.my_var }}@12345"
what error are you getting? (
OOMKilled
is not what you described before, it looks like a new issue)
can you please create a GH issue?
s
there is no error because it gets OOMKilled & terminates abruptly The code used in this test is:
Copy code
locals:
  trusted_store_arn: !terraform.state aws-mtls-bucket ".trusted_store.arn // ""arn:aws:elasticloadbalancing:us-east-1:000000000000:truststore/mtls-bucket-name/0000000000000000"""

components:
  terraform:
    eks/alb-controller-ingress-group:
      vars:
        additional_annotations:
          <http://alb.ingress.kubernetes.io/mutual-authentication|alb.ingress.kubernetes.io/mutual-authentication>: "[{port:443,mode:verify,trustStore:{{.locals.trusted_store_arn}},ignoreClientCertificateExpiry:true},{port:80,mode:passthrough}]"
^due to the format of annotation value and that 
!terraform.state
evaluates yq with 
'.{user_provided_expression}'
using single quotes and not double, it becomes impossible to return a json formatted string. It always returns an object unless you triple escape which becomes invalid syntax for the value needed which is why having local vars would be a great solution I am giving up on this & going to reuse the workaround from last time because I need to get the resources deployed. I can open a GH issue if I end up in this position again & have time then but will not be doing so today sorry
a
ok, sorry that it's still not working for you. don't want to waste your time, but will ask a few questions to understand the original issue
this config throws OOMKilled? On CI, or locally, or both?
Copy code
locals:
  trusted_store_arn: !terraform.state aws-mtls-bucket ".trusted_store.arn // ""arn:aws:elasticloadbalancing:us-east-1:000000000000:truststore/mtls-bucket-name/0000000000000000"""

components:
  terraform:
    eks/alb-controller-ingress-group:
      vars:
        additional_annotations:
          <http://alb.ingress.kubernetes.io/mutual-authentication|alb.ingress.kubernetes.io/mutual-authentication>: "[{port:443,mode:verify,trustStore:{{.locals.trusted_store_arn}},ignoreClientCertificateExpiry:true},{port:80,mode:passthrough}]"
this describes a diff config? Can you provide it so we could compare?
Copy code
^due to the format of annotation value and that !terraform.state evaluates yq with '.{user_provided_expression}' using single quotes and not double, it becomes impossible to return a json formatted string. It always returns an object unless you triple escape which becomes invalid syntax for the value needed which is why having local vars would be a great solution
in particular:
Copy code
it becomes impossible to return a json formatted string
but 
trusted_store_arn: !terraform.state aws-mtls-bucket .trusted_store.arn
should return a string, not an object?
s
this config throws OOMKilled? On CI, or locally, or both?
Github Actions. I don't have it run locally
trusted_store_arn: !terraform.state aws-mtls-bucket .trusted_store.arn
should return a string, not an object?
yeah it would be an arn without the local var feature it would need to be something like:
Copy code
additional_annotations:
          <http://alb.ingress.kubernetes.io/mutual-authentication|alb.ingress.kubernetes.io/mutual-authentication>: !terraform.state aws-mtls-bucket "trusted_store.arn |'[{port:443,mode:verify,trustStore:'+ . +',ignoreClientCertificateExpiry:true},{port:80,mode:passthrough}]'"
I spent an entire day running variations & from results was able to determine the way 
!terraform.state
works is as described above so it can't be done & I had to overwrite the components to workaround the limitation
a
ok, that definitely looks ugly. this was a long thread, and I want to get to the bottom of it. we have many tests for this
Copy code
locals:
  trusted_store_arn: !terraform.state aws-mtls-bucket ".trusted_store.arn // ""arn:aws:elasticloadbalancing:us-east-1:000000000000:truststore/mtls-bucket-name/0000000000000000"""
but something is still not working for you
I'll take a look at this
can I ask you one more question? since you can test it on CI only, what the 
utils
proider version are you using on CI? (
cloudposse/utils
version) (
terraform init
installs all the providers, please check the utils provider version)
s
looks like its mostly been configured to 
version = ">= 0.1.0"
and somehow a part of the account-map migration troubles another engineer has been working through for the last few weeks
to correct my adhoc example above, I left this in the comments the last time: _`alb.ingress.kubernetes.io/mutual-authentication: !terraform.state cloudflare-aws-mtls "trusted_store.arn as $arn | ""'[{port443,modeverify,trustStore:"" + $arn + "",ignoreClientCertificateExpirytrue},{port80,mode:passthrough}]'"""`_
Open in Slack
PreviousNext
Powered by