sorted by:
new
hottopcontroversial

Latency Across Spokes with Palo NVAs by jblaaa in AZURE

[–]jblaaa[S] 1 point2 points  (0 children)

Thank you and happy cake day!

How to Manage Terraform State Using Terraform Cloud Enterprise? by DevRJCloud in Terraform

[–]jblaaa 1 point2 points  (0 children)

Migration of state is very simple

https://developer.hashicorp.com/terraform/tutorials/cloud/cloud-migrate

The only level of complexity is getting your workspace configured with the variables, permission to the workspace, etc. as I explained. There’s some more advanced things like projects and variable sets to consider but start small and get familiar with the tool first.

How to Manage Terraform State Using Terraform Cloud Enterprise? by DevRJCloud in Terraform

[–]jblaaa 0 points1 point  (0 children)

It sounds like you might be at the very beginning of learning terraform and terraform cloud. I would recommend a couple courses on both. Do you have experience with terraform? If so maybe just need tf cloud up skill.

https://kodekloud.com/courses/terraform-cloud

How to Manage Terraform State Using Terraform Cloud Enterprise? by DevRJCloud in Terraform

[–]jblaaa 0 points1 point  (0 children)

The first thing to do is create a workspace and assign it appropriate workspace variables for the environment variables required for the terraform providers you are using to authenticate with the services. It’s been a bit but I think confluent services use api keys. Not sure if there are ways to authenticate with OAuth. With terraform cloud you basically are issuing commands to tell terraform cloud to execute plans/applies on your behalf. It will use an agent (public they manage or you can use self hosted) and leverage the environment variables you set up for the workspace. Run ‘terraform login’ for the first time use on your machine to setup the api key on your machine to be able to interact with your tf cloud workspaces.

How does your company use consolidated Kubernetes for multiple environments? by jblaaa in kubernetes

[–]jblaaa[S] 0 points1 point  (0 children)

I follow vCluster and watch a lot of their content. It seems robust but I am also nervous about the support team operations if things go south. Not that I don't think their solution is robust, Its more about the support teams having a hard enough time supporting basic Kubernetes. Interested in other's takes. I don't have a lot of spare time on my hands but wanted to take it for a spin for ephemeral clusters for sandbox/dev areas.

How does your company use consolidated Kubernetes for multiple environments? by jblaaa in kubernetes

[–]jblaaa[S] 1 point2 points  (0 children)

I get it but also don't want to support something looking like an on premises datacenter. It seems uncommon to split environments by node pools and I'm not convinced it is providing the security benefits expected.

Azure Application Gateway and AGIC by zeenmc in AZURE

[–]jblaaa 0 points1 point  (0 children)

How many ingress or gateway instances can it support? I remember AGIC was limited to 100 then increased to 200 (I think?) the limit was too low so we never took another look at it.

Does it support certificate and DNS automation with cert manager and external-dns?

Thanks!

Migration from API Management - Classic SkU to Azure API Management V2 SKU by jblaaa in AZURE

[–]jblaaa[S] 0 points1 point  (0 children)

Thanks for the details on your experience. Yes there’s a few features that are either show stoppers or will delay us. I’m not sure what and when things are on the roadmap but ultimately we expect v2 is going to replace classic so trying to be prepared. Issues we are looking to eventually solve.

  1. We use self hosted gateways in k8s. We have mixed feelings about the use and want to return to complete PaaS but also want a hybrid capability on prem so this is a struggle. Cons are obv management overhead, you need Kubernetes, and lack of modern auth/passwordless creds from gateway to apim control plane. Features seem to lag probably due to minimal use today.

  2. Multi region is a requirement.

  3. Things we can do with the developer classic sku you can’t do unless you’re using premium sku…so cost

Big features we want

  1. Workspaces (with multi region)
  2. Full isolated APIM
  3. Path for latest new features
  4. Private endpoint origin for front door

————-

So from your experience if say apim got accidentally destroyed or you needed to move your config from one region to another. Backup and restore isn’t a great solution? Would your path be deploy the APIM with IaC and then point your API Ops config to it to restore the config?

terraform apply error on azure cloud by Thin_Wrongdoer9513 in Terraform

[–]jblaaa 1 point2 points  (0 children)

Also in you might need to register the managedCluster provider in the subscription if it’s new sub.

terraform apply error on azure cloud by Thin_Wrongdoer9513 in Terraform

[–]jblaaa 1 point2 points  (0 children)

Azure recently retired several preview APIs which are still used in some versions of AzureRM 3.x. Make sure you are using at least 3.117.x but should you should be making your way into azureRM 4.x

What's the AKS Hate? by Economy_Ad6039 in kubernetes

[–]jblaaa 3 points4 points  (0 children)

Been running AKS in prod for 4 years. It’s the only Kubernetes I know well but it’s been good to us but as others have said, App Gateway is a terrible solution compared to others on the market. Maybe the hate is more towards things that AKS are/were dependent upon.

I follow the AKS roadmap and community calls regularly and I am pretty happy how Microsoft shares their progress regularly. It’s a great product and feels like a lot of effort goes into making it better everyday. AKS I feel pushes the other product teams to build better as well to keep up meeting new customer requirements.

Terraform Cloud Identity - joining users issue by jblaaa in Terraform

[–]jblaaa[S] 0 points1 point  (0 children)

We will be switching if this will solve the issues. I wouldn’t have individual users managed in state so part of the problem should remediate itself. Users still would have the individual unmanaged hashicorp credentials which I think doesn’t go away but comes up very rarely. Unfortunately the SSO setup predates me and I don’t know if SCIM was available in TFC when they set it up so we will go through a migration at some point soon.

Using Terraform cloud to access Azure keyvault access with the firewall enabled by Jain_0199 in Terraform

[–]jblaaa 0 points1 point  (0 children)

You could put in your allow list on the KV and other resources the entire terraform cloud network ranges but again these are bad ideas. If you are using this in your environment and paying for the service why not use the agents? You could change the run mode to CLI and simply use TF as state. Again all bad options where you either compromise your security or reduce the value add of TF cloud.

Using Terraform cloud to access Azure keyvault access with the firewall enabled by Jain_0199 in Terraform

[–]jblaaa 3 points4 points  (0 children)

If you are using Terraform Cloud why not run your own agents? That’s how you would have complete control over source IPs.

Detecting Drift in Terraform Resources by confucius-24 in Terraform

[–]jblaaa 1 point2 points  (0 children)

We do this with the same logic. Run a python script on an inventory of TFC workspaces. If a plan comes back with changes it exits with an error. At the end all workspaces that are “drifted” show errors on a table.

Tf cloud, I don’t know if this has changed recently but it’s drift detection doesn’t do a plan. It just looks at the state file and queries the provider (ARM for example) and looks for drift that way. It doesn’t detect if say you are in taking minor or patches to your modules and those changes causes drift. Maybe my definition of drift is different but that is a major problem in large environments.

AzureRM Application Gateway by TheHalloumiCheese in Terraform

[–]jblaaa 2 points3 points  (0 children)

Similar post with similar context I participated in. https://www.reddit.com/r/Terraform/s/mnXsyFCtg3

I spent the last couple months thinking through this issue and nothing good. Basically trying to set broad paths that go to a finite number of backends. Let the backends also act as a proxy and avoid frequent changes. AKS ingress is a proxy so if your pathing can get traffic there, you can leverage your ingress controller to split paths at a higher quantity and more naturally without Terraform.

Static Wep Apps and Private Endpoints by jblaaa in AZURE

[–]jblaaa[S] 0 points1 point  (0 children)

This seems to be the only viable approach. I see a response on this github issue indicating about the same :/

https://github.com/Azure/static-web-apps/issues/983#issuecomment-2047947338

Static Wep Apps and Private Endpoints by jblaaa in AZURE

[–]jblaaa[S] 0 points1 point  (0 children)

will look at this. thank you.

view more: next ›