Fix/update acm asm #50

dkassab · 2021-04-30T19:36:05Z

Updating documentation and fixing formatting issues.

Updating the fork

daniel-cit · 2021-05-01T00:59:32Z

Hi @dkassab Thanks for the PR
there are two lint errors:

A missing newline

Step #1 - "lint-tests": Checking for missing newline at end of file
Step #1 - "lint-tests": Error: No newline at end of file ./6-anthos-install/README.md

A missing required argument

Step #1 - "lint-tests": terraform_validate ./app-foundation/4-projects/shared 
Step #1 - "lint-tests": 
Step #1 - "lint-tests": Error: Missing required argument
Step #1 - "lint-tests": 
Step #1 - "lint-tests":   on infra_pipeline.tf line 44, in module "infra_pipelines":
Step #1 - "lint-tests":   44: module "infra_pipelines" {
Step #1 - "lint-tests": 
Step #1 - "lint-tests": The argument "impersonate_service_account" is required, but no definition was
Step #1 - "lint-tests": found

The missing required argument was fixed in PR #40
It should be fixed if you rebase with the current version of main

daniel-cit

There are some changes that need to be reverted,
which are the ones related to gcr.io/bank-of-anthos,
they are marked individually in the files.
The text gcr.io/bank-of-anthos is replaced automatically in step 7.
It would help the user if all the variables that depende in the output of previous steps
would be defined in the define-required-environment-variables
section for example these variable cloud be move to the section:

export CICD_PROJECT_ID=YOUR_CICD_PROJECT_ID

and

export SQL_PROJECT_ID=YOUR_SQL_PROJECT_ID
export SQL_INSTANCE_NAME_WEST=YOUR_SQL_INSTANCE_NAME_WEST
export SQL_INSTANCE_NAME_EAST=YOUR_SQL_INSTANCE_NAME_EAST

We have three project IDs in the README.md for step 6 and
it would help the user if they were consistentelly named in the environement variable
and in the replace tokens inside the yaml files
- the GKE project ID:
  - PROJECT_ID -> GKE_PROJECT_ID (env var)
  - PROJECT_ID -> GKE_PROJECT_ID (yaml)
- the CI/CD project ID
  - PROJECT_ID -> CICD_PROJECT_ID (env var)
  - PROJECT_ID -> CICD_PROJECT_ID (yaml
- the SQL project ID
  - SQL_PROJECT_ID -> SQL_PROJECT_ID (env var)(keep)

for example, this command at the end of the readme

gcloud iam service-accounts add-iam-policy-binding \
--role roles/iam.workloadIdentityUser \
--member "serviceAccount:$PROJECT_ID.svc.id.goog[transactions/transactions]" \
boa-gsa@$PROJECT_ID.iam.gserviceaccount.com

should be using

PROJECT_ID -> GKE_PROJECT_ID

Since the boa-gsa service account is create in the GKE project.

6-anthos-install/README.md

6-anthos-install/acm-repos/accounts/contacts.yaml

6-anthos-install/acm-repos/transactions/transactionhistory.yaml

6-anthos-install/acm-repos/transactions/ledgerwriter.yaml

6-anthos-install/acm-repos/transactions/balancereader.yaml

6-anthos-install/acm-repos/frontend/loadgenerator.yaml

6-anthos-install/acm-repos/frontend/frontend.yaml

6-anthos-install/acm-repos/accounts/userservice.yaml

…rm-example-foundation-app into fix/update-acm-asm

google-cla · 2021-05-01T11:29:05Z

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

rutalreja-deloitte · 2021-05-01T11:29:22Z

@googlebot I consent.

rutalreja-deloitte · 2021-05-01T11:33:10Z

Fixes in c599738

Merged main and lint pass
Changes requested in @daniel-cit 's comment
Remove --cluster-labels not needed
Add missing instruction for frontend-sa.yaml
Instruction update that was merged in Update README to similar format as in Terraform Foundation repository #49

rutalreja-deloitte · 2021-05-01T11:51:52Z

@dkassab and @daniel-cit
Noticed missing instructions for

acm root-sync yaml in ReadME, line should also have GKE_PROJECT_ID instead of PROJECT_ID
cloud-sql-admin-secret yaml instruction to update this in ReadME
app-secret-front yaml instruction to update this in ReadME as well as the correct project env variable GKE most likely

P.S Also a lot of files in the 6-anthos-install/acm-repos/root-config-repo/namespaces/boa/ repo folders are entirely commented out, maybe some instructions in the README are required to inform user what role the files play and at what stage

dkassab · 2021-05-03T18:47:54Z

@dkassab and @daniel-cit
Noticed missing instructions for

acm root-sync yaml in ReadME, line should also have GKE_PROJECT_ID instead of PROJECT_ID

cloud-sql-admin-secret yaml instruction to update this in ReadME

app-secret-front yaml instruction to update this in ReadME as well as the correct project env variable GKE most likely

P.S Also a lot of files in the 6-anthos-install/acm-repos/root-config-repo/namespaces/boa/ repo folders are entirely commented out, maybe some instructions in the README are required to inform user what role the files play and at what stage

I fixed acm root-sync.yaml file.
cloud-sql-admin-secret is not needed anymore, I removed it.
This secret is not needed for this phase, but will need it once we implement secret manager and CSI secret driver.

rutalreja-deloitte · 2021-05-04T12:25:43Z

Fixes #51

Exposed bastion_members in 5-infra/env/main.tf and added supporting instruction in 6-README
Added missing Readme instruction for acm-repo-sync
Commented out app-secret-front

rutalreja-deloitte · 2021-05-04T12:43:01Z

LGTM
@daniel-cit and @bharathkkb please review when you get a chance

daniel-cit

This version has many improvements but there are still a few issues to fix

daniel-cit · 2021-05-11T02:51:21Z

6-anthos-install/README.md

 1. Creates a secret that grants access to the Kube API Server for cluster 1
-    ```console
+    ```
    ./istioctl x create-remote-secret \


Suggested change

./istioctl x create-remote-secret \

istioctl x create-remote-secret \

It maybe valuable to keep ./. If the user has an older version of istioctl in PATH then it may error out with these configs

daniel-cit · 2021-05-11T02:51:34Z

6-anthos-install/README.md

 1. In a similar manner, create a secret that grants access to the Kube API Server for cluster 2
-    ```console
+    ```
    ./istioctl x create-remote-secret \


Suggested change

./istioctl x create-remote-secret \

istioctl x create-remote-secret \

6-anthos-install/README.md

daniel-cit · 2021-05-11T03:00:37Z

6-anthos-install/README.md

+    -C "GIT_REPO_USERNAME"
+    -N ''
+
+Don't forget to upload the public key "~/.ssh/id_rsa.pub" to your repository. For cloud source repository, see [this link](https://cloud.google.com/source-repositories/docs/authentication)


is this repo in the CICD_PROJECT_ID ?

daniel-cit · 2021-05-11T03:29:38Z

6-anthos-install/README.md

 #### root config repo
 This repository is the root repository that host cluster-scoped and namespace-scoped configs for the bank of anthos application, such as resource policies, network polices and security policies.
+1. Clone the `root-config-repo` that was created through the infrastructure pipeline
+    ```
+    gcloud source repos clone root-config-repo --project ${CICD_PROJECT_ID}


I got:

gcloud source repos clone root-config-repo --project ${CICD_PROJECT_ID} WARNING: You are using a Google-hosted repository with a git version 1.8.3.1 which is older than 2.0.1. If you upgrade to 2.0.1 or later, gcloud can handle authentication to this repository. Otherwise, to authenticate, use your Google account and the password found by running the following command. $ gcloud auth print-access-token

and I had to use as user boa-gce-bastion-d-sa@prj-bu1-d-boa-gke-04d8.iam.gserviceaccount.com
and the password generated by gcloud auth print-access-token

daniel-cit · 2021-05-11T04:18:51Z

6-anthos-install/README.md

+    # On Cluster 2
+    kubectl create secret generic git-creds --namespace=transactions --context ${CTX_2} --from-file=ssh="${HOME}/.ssh/id_rsa"
+
+    kubectl create secret generic git-creds --namespace=accounts --context ${CTX_2} --from-file=ssh="${HOME}/.ssh/id_rsa"


failed with

error: failed to create secret namespaces "accounts" not found

It works after fixing

kubectl apply --context=${CTX_2} -f ${HOME}/terraform-example-foundation-app/6-anthos-install/acm-configs/config-management-west.yaml

daniel-cit · 2021-05-11T04:19:25Z

6-anthos-install/README.md

+
+    kubectl create secret generic git-creds --namespace=accounts --context ${CTX_2} --from-file=ssh="${HOME}/.ssh/id_rsa"
+
+    kubectl create secret generic git-creds --namespace=frontend --context ${CTX_2} --from-file=ssh="${HOME}/.ssh/id_rsa"


failed with

error: failed to create secret namespaces "frontend" not found

It works after fixing

kubectl apply --context=${CTX_2} -f ${HOME}/terraform-example-foundation-app/6-anthos-install/acm-configs/config-management-west.yaml

6-anthos-install/README.md

daniel-cit · 2021-05-11T04:40:49Z

6-anthos-install/README.md

+
+1. Run script to populate database ledger
+    ```
+    kubectl apply -n transactions --context ${CTX_1} -f ${HOME}/terraform-example-foundation-app/6-anthos-install/db-scripts/populate-ledger-db.yaml


The file ${HOME}/terraform-example-foundation-app/6-anthos-install/db-scripts/populate-ledger-db.yaml does not exist

daniel-cit · 2021-05-11T04:40:59Z

6-anthos-install/README.md


-    kubectl apply --context=${CTX_2} -f ${HOME}/terraform-example-foundation-app/acm-config/root-sync.yaml
+    kubectl apply -n transactions --context ${CTX_2} -f ${HOME}/terraform-example-foundation-app/6-anthos-install/db-scripts/populate-ledger-db.yaml


The file ${HOME}/terraform-example-foundation-app/6-anthos-install/db-scripts/populate-ledger-db.yaml does not exist

daniel-cit · 2021-05-11T18:31:44Z

the populate script is in the Bank of Anthos repo

cd ${HOME}

git clone https://github.com/GoogleCloudPlatform/bank-of-anthos.git

kubectl apply -n transactions --context ${CTX_1} -f ${HOME}/bank-of-anthos/extras/cloudsql/populate-jobs/populate-ledger-db.yaml

kubectl apply -n transactions --context ${CTX_2} -f ${HOME}/bank-of-anthos/extras/cloudsql/populate-jobs/populate-ledger-db.yaml

6-anthos-install/README.md

Co-authored-by: Daniel Andrade <dandrade@ciandt.com>

dkassab and others added 18 commits April 22, 2021 16:09

Merge pull request #1 from GoogleCloudPlatform/main

0fafc0d

Updating the fork

fixing the flow

0b297d1

add instructions to update project id

ffd726f

additional fixes

401caa7

additional fixes

34d5de4

additional fixes

0111761

additional fixes

c93774b

updating resource qouta

24b4087

correct file location

966655d

updating docs

543d5fd

documentation update

aa80ad4

fixing additional spaces

04978a9

documentation update

627eedb

fixing formatting

f097f35

fixing formatting

c0731f3

fixing formatting

f6f0aa4

fixing formatting

fe354f4

fixing formatting

78636bb

daniel-cit suggested changes May 1, 2021

View reviewed changes

rutalreja-deloitte added 2 commits May 1, 2021 03:16

Merge branch 'main' of https://github.com/GoogleCloudPlatform/terrafo…

3a97f8b

…rm-example-foundation-app into fix/update-acm-asm

requested changes + extra

c599738

dkassab and others added 3 commits May 3, 2021 14:49

removing cloud sql secret, and fixing reference to root-config-repo

53e0748

fixing root-sync and uncommenting resource qouta

c75b7c7

add readme instruction and comment out file

dd7ed59

PR-51-fix

14b214b

rutalreja-deloitte mentioned this pull request May 4, 2021

Update README.md adding instructions to help the user to connect on bastion host #51

Closed

daniel-cit suggested changes May 11, 2021

View reviewed changes

daniel-cit reviewed May 11, 2021

View reviewed changes

6-anthos-install/README.md Outdated Show resolved Hide resolved

Apply suggestions from code review

ab41e18

Co-authored-by: Daniel Andrade <dandrade@ciandt.com>

bharathkkb approved these changes May 12, 2021

View reviewed changes

bharathkkb merged commit 5b02673 into GoogleCloudPlatform:main May 12, 2021

markmacmahon mentioned this pull request Jan 3, 2022

terraform-example-foundation-app/6-anthos-install/db-scripts/populate-ledger-db.yaml" does not exist #96

Closed

release-please bot mentioned this pull request Jan 12, 2022

chore(main): release 0.1.0 #99

Closed

release-please bot mentioned this pull request Aug 22, 2023

chore(main): release 0.1.0 #106

Closed

release-please bot mentioned this pull request Dec 20, 2023

chore(main): release 0.1.0 #114

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix/update acm asm #50

Fix/update acm asm #50

dkassab commented Apr 30, 2021

daniel-cit commented May 1, 2021

daniel-cit left a comment

google-cla bot commented May 1, 2021

rutalreja-deloitte commented May 1, 2021

rutalreja-deloitte commented May 1, 2021 •

edited

Loading

rutalreja-deloitte commented May 1, 2021 •

edited

Loading

dkassab commented May 3, 2021

rutalreja-deloitte commented May 4, 2021

rutalreja-deloitte commented May 4, 2021

daniel-cit left a comment

daniel-cit May 11, 2021

bharathkkb May 12, 2021

daniel-cit May 11, 2021

daniel-cit May 11, 2021

daniel-cit May 11, 2021

daniel-cit May 11, 2021

daniel-cit May 11, 2021

daniel-cit May 11, 2021

daniel-cit May 11, 2021

daniel-cit commented May 11, 2021

	./istioctl x create-remote-secret \
	istioctl x create-remote-secret \


		kubectl create secret generic git-creds --namespace=accounts --context ${CTX_2} --from-file=ssh="${HOME}/.ssh/id_rsa"

		kubectl create secret generic git-creds --namespace=frontend --context ${CTX_2} --from-file=ssh="${HOME}/.ssh/id_rsa"


		kubectl apply --context=${CTX_2} -f ${HOME}/terraform-example-foundation-app/acm-config/root-sync.yaml
		kubectl apply -n transactions --context ${CTX_2} -f ${HOME}/terraform-example-foundation-app/6-anthos-install/db-scripts/populate-ledger-db.yaml

Fix/update acm asm #50

Fix/update acm asm #50

Conversation

dkassab commented Apr 30, 2021

daniel-cit commented May 1, 2021

daniel-cit left a comment

Choose a reason for hiding this comment

google-cla bot commented May 1, 2021

rutalreja-deloitte commented May 1, 2021

rutalreja-deloitte commented May 1, 2021 • edited Loading

rutalreja-deloitte commented May 1, 2021 • edited Loading

dkassab commented May 3, 2021

rutalreja-deloitte commented May 4, 2021

rutalreja-deloitte commented May 4, 2021

daniel-cit left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

daniel-cit commented May 11, 2021

rutalreja-deloitte commented May 1, 2021 •

edited

Loading

rutalreja-deloitte commented May 1, 2021 •

edited

Loading