Infra/networking thread

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Infra/networking thread

post hole digger: Mar 21, 2011

Kazinsal posted:

in absolute awe at this lovely bug entry

i hate to be epic office quoter guy but drat if this isnt the fuckin 'why use more word, when few word do trick?' line

# ¿ Mar 25, 2021 23:36

Adbot: ADBOT LOVES YOU

# ¿ May 8, 2024 10:04

post hole digger: Mar 21, 2011

yea we like it. works great with the "use ansible for all of your configs" model from a few posts ago.

# ¿ Jun 12, 2021 17:22

post hole digger: Mar 21, 2011

ruckus is rock solid, much better than unifi. it is also extremely expensive.

# ¿ Dec 10, 2021 22:03

post hole digger: Mar 21, 2011

bumo

# ¿ Jul 24, 2023 01:27

post hole digger: Mar 21, 2011

Jabor posted:

more like computer notworking

# ¿ Jul 25, 2023 05:51

post hole digger: Mar 21, 2011

what is there to host

# ¿ Aug 15, 2023 22:32

post hole digger: Mar 21, 2011

posting this here as a long shot -- i have a messy vpc setup in terraform that is currently using resource "aws_route_table" blocks to deploy a route table and several routes.

This is a big pile of poo poo right now and I'm working on converting things to use modules instead. So the plan is to convert that to use resource "aws_route_table" to create the route table, but use resource "aws_route" blocks to manage the actual routing. i'm aware of the caveat here https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route_table that you cant use route resources and route_table resources containing routes together, and thats fine, I plan to totally manage the routes with resource "aws_route" blocks. is it enough to write the aws_route_table block as like

code:

resource "aws_route_table" "private" {
  count = var.create_vpc && length(var.private_subnets) > 0 ? length(var.private_subnets) : 0

   vpc_id = aws_vpc.this[0].id

   route = []
  depends_on = [ aws_vpc.this, aws_subnet.private, aws_nat_gateway.private ]
}

with `route = []` to clear the existing routes, and then write my route blocks like

code:

resource "aws_route" "private_nat_gateway" {
  count = length(var.private_subnets)

  route_table_id         = aws_route_table.private[count.index].id
  destination_cidr_block = "0.0.0.0/0"
  nat_gateway_id         = aws_nat_gateway.private[count.index].id

  depends_on = [ aws_vpc.this, aws_subnet.private, aws_nat_gateway.private ]
}

Will that work without breaking all of my poo poo? I figure things might be hosed up for a second or two while the cutover happens, I assume there is no way to move the existing state to something that would be more friendly. What about removing the route tables from the state using `terraform state rm`, writing things the way I want them to be, and then doing a `terraform import` might be safer... :thunk:

sort of just thinking out loud to myself before i log off for the weekend a bit here :thunk:

# ¿ Sep 9, 2023 02:02

post hole digger: Mar 21, 2011

The Iron Rose posted:

Consider not doing this instead imo

why wouldnt i?

# ¿ Sep 9, 2023 03:18

post hole digger: Mar 21, 2011

thank you for the insight here everyone. i did not have teh mental energy to post in this thread over the weekend. i think given my use case a module is probably the way i will proceed with this, even if it is not the best way,

well-read undead posted:

i wanna say i�ve done that exact thing, state rm the route tables and then import them as district resources, but it�s been awhile and i�m already helgin� over here so don�t just take my word for it

its good to know i can do this way and will probably play around with trying it tonight. it felt like it made sense in my head.

The Iron Rose posted:

Modules are occasionally useful but often a maintenance nightmare, and it�s very easy to write footguns (modules in modules, providers in modules, singleton resource modules, etc). They are valuable when you have commonly repeatable infrastructure components that are very highly opinionated and tied to key business logic, and you have many (>3) coupled resources that depend on one another. Setting up VPCs with peering and routing is a fairly defensible usecase,

I feel like this describes my use case pretty well, create a very specifically defined VPC framework that can be repeated across various accounts.

quote:

Similarly the use of service controls or policy services for standards enforcement and controls are more effective, flexible and scalable

are you talking about these concepts with regards to vpcs and cloud networking specifically? do you have any tools i could look into for this, or more info on the topic in general if so?

12 rats tied together posted:

sure, but ec2 route objects is like the poster child for "reasons why modules are bad". you will just end up reinventing the parameter set for the route resource on top of a module's parameter set for no reason. "var.default_route_target_type = nat_gateway" and poo poo.

this does resonate with how i've been going about certain things, yes

quote:

the docs are better these days and explicitly warn you not to create a module for a thing unless you can come up with a better name than "the names of the resources inside of the thing". if you try to map every single resource dependency in AWS inside of a module subtree you will have created an infinite amount of work for yourself because an AWS account is essentially a tree itself already

the thing you want from modules can almost always be expressed as
code:
locals {
  my_bullshit = {
    private_subnet_count = 4
    private_subnet_az_set = [az1, az2]
    // etc
  }
}
and then just for_each=local.mybullshit in your routes. there are examples in the docs, and indeed, managing the treelike nature of an AWS VPC and its dependencies is the example in the docs for resource foreach.

this is interesting. I guess this is basically what I'm trying to do, but I'd be sort of abstracting the 'module' layer on top of it. I'd have to rethink how I intend to list the variables and such, but I think this makes sense. Is the idea then that you'd be doing like The Iron Rose mentioned and feed different envs of 'my_bullshit' into the parameters with something like different tfvars files?

# ¿ Sep 12, 2023 00:48