Tag Archives: Google Cloud

Google Domains and Terraform

Two major updates recently

Firstly, as suspected, I finally got the notification saying that Google Domains’ registrations would be acquired by SquareSpace so all my registrations would be transferred over them should I not do anything. Obviously, I didn’t want that, so I transferred them over to AWS (Route 53) so now my domains are registered with AWS, but are DNS managed by Cloud DNS. I had some weirdness when trying to migrate all my domains in bulk, with respect to the auth code not being accepted on one of the domains when doing the bulk migration, but it was accepted when I did the migration on that one domain alone, so… go figure.

Next update is Terraform. In case you didn’t know, Hashicorp has changed the Terraform license and essentially made it no longer open source. This behaviour is similar to what Red Hat did with its RHEL offering and the backlash is just as bad.

Immediately I knew someone would fork it, and already, there’s the OpenTF Initiative and this is the key part:

Our request to HashiCorp: switch Terraform back to an open source license.

We ask HashiCorp to do the right thing by the community: instead of going forward with the BUSL license change, switch Terraform back to a truly open source license, and commit to keeping it that way forever going forward. That way, instead of fracturing the community, we end up with a single, impartial, reliable home for Terraform where the whole community can unite to keep building this amazing ecosystem.

Our fallback plan: fork Terraform into a foundation.

If HashiCorp is unwilling to switch Terraform back to an open source license, we propose to fork the legacy MPL-licensed Terraform and maintain the fork in the foundation. This is similar to how Linux and Kubernetes are managed by foundations (the Linux Foundation and the Cloud Native Computing Foundation, respectively), which are run by multiple companies, ensuring the tool stays truly open source and neutral, and not at the whim of any one company.

OpenTF Initiative (https://opentf.org/)

Essentially, make Terraform open source again, or a fork from the MPL version will be made and maintained separately from Hashicorp’s version. This will essentially lead to two, potentially diverging versions of Terraform, one BUSL and one MPL licensed

I’m already looking at alternatives and the two currently that I’m looking at are Ansible and Pulumi

Ansible I’ve had experience in , but there’s two main issues with it:

  • It’s underused compared to Terraform and the providers are woefully undersupported and undermaintained
  • It’s Red Hat

Pulumi I’ve heard lots of good things about, but its a new technology, and I don’t know if it is can “Import” existing infrastructure.

Guess a “spike” is worth doing for it.

Updates

It’s been quite a long time since I did any updates on this blog so a couple of updates are in order

House

I’ve now been living in the new place for just over a year. Generally everything is good, we’ve started putting in a lawn and currently letting it get its roots in before we try to cut it

Twitter

Oh, boy, what an absolute train wreck. I’ve tolerated Elon’s presence at Twitter because most of the stuff he did wasn’t far off what Jack was doing prior. But cutting off all third party clients, forcing everyone onto the new TweetDeck (which likely will be paywalled too) has literally driven users away. Twitter has been losing users and revenue constantly, and it is totally unsurprising.

I’ve disabled my two TweetDeck profiles (a professional one, and a casual one) from Ferdium. But I doubt I will be going back any time soon.

Red Hat

Another train wreck of a situation. Red Hat’s decision to first kill CentOS’s stability, then for RHEL sources to only be accessible behind a subscription has pissed of a lot of users, even if it’s not strictly speaking against license.

The only one left in its sights will be Fedora so that leads me onto the next update

Manjaro & Archlinux

I’ve been tinkering with Manjaro more and more lately, with its rolling release schedule meaning I never need to upgrade from a major version to another major version.

It’s downside I’m finding is that some packages, especially those in the AUR are essentially “compile from source” packages which does the build on your machine during the install. This can take a varying amount of time depending on the code. With my RSS reader of choice: QuiteRSS, this build takes a mind numbing 2.5 hours to do, even on a high spec machine.

That’s where I found out about setting up your own Arch repo. I’ve been tinkering with that, setting it up on GCP and fronted by a CDN. This works pretty well, but I still need to find how I can do scheduled builds to keep that up to date, but it looks like I’ll be switching to Manjaro at some point in the near future. Sound works fine, using lyncolnmd‘s work.

Another downside with Manjaro, however is that its btrfs filesystem, my home directory backup, and CloneZilla don’t seem to want to work well together

WordPress & Domains

One final update, I will likely be transferring out the blenderfox.com domain out of WordPress, while I had this registered as part of the blog, I’m finding it much harder to maintain this domain using WordPress’s very limited DNS management tools. I will likely transfer it out to Google Domains, even though there’s talk of them shuttering that service. Secondary service would be AWS.

Binding GCP Accounts to GKE Service Accounts with Terraform

Kubernetes uses Service Accounts to control who can access what within the cluster, but once a request leaves the cluster, it will use a default account. Normally this is the default Google Compute Engine account in GKE, and this has extremely high level access and could result in a lot of damage if your cluster is compromised.

In this article, I will be setting up a GKE cluster using a minimal access service account and enabling Workflow Identity.

Continue reading

Google ACE Certification

I completely forgot to post this, but yes, I did pass the certification :)

Google Cloud Certification

My next certification is complete: Google Cloud Certified Associate Cloud Engineer.

I did the exam Saturday, but only posting it now because it requires the results require verification by Google.

I passed (provisionally, at least)…

Google’s Catch-22

Not often I post on problems at Google, but this is actually an interesting situation.

https://arstechnica.com/?p=1518703

Google had an outage the other week, and it knocked out several websites GitLab, Shopify and impacted others. Gsuite, Gmail, YouTube were affected, but not down.

There are some interesting lines in this article:

for an entire afternoon and into the night, the Internet was stuck in a crippling ouroboros: Google couldn’t fix its cloud, because Google’s cloud was broken.

Google says its engineers were aware of the problem within two minutes. And yet! “Debugging the problem was significantly hampered by failure of tools competing over use of the now-congested network,”

In short, Google Cloud broke due to congestion, Google couldn’t fix the problem because their tools required using the network that was now congested

Spotify is moving its data to Google Cloud Platform

Source: Spotify is moving its data to Google Cloud Platform