Was the 1st feature I used from buildkit. Really happy to see it being promoted to stable

i like next

You don't really need ecs server for terraform. Exec is more than enough if you have a ttl of 8h

arent you trying to run the same profile twice, as in a loop?

Just ran into this same problem

Error: error configuring S3 Backend: no valid credential sources for S3 Backend found.

managed to get it working with https://github.com/flyinprogrammer/aws-sso-fetcher but it would be nice this supported natively

Been working fine on v6 beta

Never mind.. It's below

https://github.com/99designs/aws-vault/blob/master/USAGE.md#removing-credentials Should this bit of the docs be updated to use clear instead?

Since I use aws sso been on v6 since it was made available and got rid of the sportradar docker. I missed aws-vault ease and multi role so much

Thank you and the other contributors so much

Uhhh a full release.. Such a long time coming

I missed the two releases. Will try next week

For future clarity, I believe you wanted to use docker creds in the second template

@justin-wesley thanks for sharing your solution, just one question what happens if two threads tried to check the bucket at the same time and they both found nothing, then both will put a lock and proceed, right?

I apologize as I didn't see your question until now. To successfully continue processing, you not only have to validate the file doesn't exist, but successfully write a file to the bucket. If you happen to have two instances trying to write the file at the same time, one of them will fail. That would then be understood as the process being locked.

@justin-wesley S3 is eventually consistent. I would not trust it to be atomic

It should be pointed out that NFS does not in-fact "just work", unless I'm missing something you have to configure the host exports manually outside Docker, and then trade-off the caching, attribute sync, and other properties to achieve a reasonable performance. Perhaps (as I suspect) attribute sync disabled, plus an event forwarder is a decent approximation of a fast, reliable filesystem but it's no silver bullet.

On Wed, 26 Aug 2020 at 07:27, Michael Tibben [email protected] wrote:

Our whole team still uses docker-machine and NFS for this reason @cweagans https://github.com/cweagans. It just works

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/docker/roadmap/issues/7#issuecomment-680663908, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAEUCGZT5IUJU35NCSR32DSCSMMXANCNFSM4LC5WHNQ .

@leehambley all I had to do in the past was restart nfs on the host mac and that was it. Had a custom override docker compose for the binds to be nfs vs local binds on Linux. Was much faster than anything available at the time, with the benefit no need for initial sync like mutagen does. Worked mostly problem free for years with 30 devs. Only one would have occasional issues shifting git branches on the host and blow up the container running

I use extensively iterm2 with a hotkey window that for all purposes behaves like a background context menu.

A recent maccy feature changed the behaviour of how this sort of apps are handled.

Since I have to access maccy to find data and sometimes even tokens to paste into the terminal, losing iterm2 window can lead to the risk of pasting sensitive information into other applications.

The sheer number of times I ended up with nonsense snippets in vscode alone, shows how pertinent the support for this is.

Will do thanks clarifying

It's strange that this behaviour changed recently. I believe it was from an update of maccie (tho it could also be an iterm2 update, or even macos beta) I'll keep looking. But right now, my life is harder, and far less secure

i got this today on beta10

Having creds in clear text is what we are trying to address here. So keeping using old methods should be discourage

@stevenolen let me put the question the other way around: why/when would you want to use aws cli without aws-vault?

Thanks for clarifying

I generally like this idea. As much as repetitive patterns can be optimised and standardised, the better.

The only thing I don't feel exactly clear / comfortable is the use of labels. It's not a standard or pattern people would expect to control a build process

Also, how to deal with inheritance of labels?

it's what is called a Hotkey Window https://www.iterm2.com/documentation-highlights.html

before the window would remain open when accessing maccy history pane. now somehow it loses focus and closes, which means once i select something from macy, it is pasting on another app (imagine it ends up on slack)

what a shame

you got 5 coffees on me. thank you for your work

all data, and do its best to paste as was

also consider github donations

ahh so this is it!! this is killing my use with iterm2 with dropdown mode.... maccy steals focus and iterm closes down...

LGTM

@Ressy66 if the information is not good enough to feel free to to open a PR to the readme and cli help menu. A better use of your time than complaining when the answer had already been provided in this very ticket

You know you can even run your own doh endpoint where your users connect. You can also disable it for all the users in your network. And if you read the comment above you would also know how to disable it for acme.sh

The fact that you don't seem to know any of these things is more of a sign of you being a troll than a responsible security person

@Ressy66 i use DoH/DoT just fine and never even touch cloudflare or Google for it. There are many other alternatives

I'm on 0.12 and no tfenv Tho my workspace contains a couple dozen repos

here is a gist with vscode logs https://gist.github.com/FernandoMiguel/70b814dd3a6014a058bc20ea95728317

today i too started being plagued by this, making it impossible to save or format files

$ cat main.tf | terraform fmt -
terraform {
  backend "s3" {}
}

provider "vault" {
  address = var.VAULT_ADDR
}

data "vault_aws_access_credentials" "creds" {
  backend = "aws"
  role    = "terraform"
}

provider "aws" {
  region     = var.aws_region
  access_key = data.vault_aws_access_credentials.creds.access_key
  secret_key = data.vault_aws_access_credentials.creds.secret_key
}

Terraform v0.12.29

not sure how to run

terraform-ls serve \
	-log-file=/tmp/terraform-ls-{{pid}}.log \
	-tf-log-file=/tmp/tf-exec-{{lsPid}}-{{args}}.log

since i dont have that installed globally and not sure where vscode downloads its bin to

I've honestly not touched this project in 3 years. if you didnt mention me, i wouldnt even have notice the comments.

Overview of the Issue

We have a nomad service running on windows host, with an http consul check, that doesn't seem to ever get checked. Node checks are OK. We tried to use a custom curl check, but that too was never triggered.

Reproduction Steps

Steps to reproduce this issue, eg:

      service {
        name = "{{print $service}}"
        port = "REDACTED"

        check {
          name     = "{{print $service}}-healthcheck"
          type     = "http"
          port     = "REDACTED"
          path     = "/health"
          interval = "30s"
          timeout  = "25s"
        }
        check_restart {
          limit = 5
          grace = "270s"
          ignore_warnings = false
        }
      }

Consul info for both Client and Server

<details> <summary>Client info</summary>

nomad

PS C:\nomad> .\nomad.exe version
Nomad v0.11.3 (8918fc804a0c6758b6e3e9960e4eb2e605e38552)

consul

PS C:\consul> .\consul.exe info
agent:
        check_monitors = 0
        check_ttls = 0
        checks = 0
        services = 1
build:
        prerelease =
        revision = 7f3b5f34
        version = 1.6.3
consul:
        acl = disabled
        known_servers = 3
        server = false
runtime:
        arch = amd64
        cpu_count = 2
        goroutines = 48
        max_procs = 2
        os = windows
        version = go1.12.13
serf_lan:
        coordinate_resets = 0
        encrypted = true
        event_queue = 0
        event_time = 42
        failed = 0
        health_score = 0
        intent_queue = 0
        left = 0
        member_time = 830
        members = 12
        query_queue = 0
        query_time = 1

</details>

<details> <summary>Server info</summary>

# nomad version
Nomad v0.11.2 (807cfebe90d56f9e5beec3e72936ebe86acc8ce3)

consul

agent:
	check_monitors = 0
	check_ttls = 0
	checks = 2
	services = 2
build:
	prerelease =
	revision = a42ded47
	version = 1.5.3
consul:
	acl = disabled
	bootstrap = false
	known_datacenters = 3
	leader = false
	leader_addr = REDACTED.129:8300
	server = true
raft:
	applied_index = 10154178
	commit_index = 10154178
	fsm_pending = 0
	last_contact = 3.454052ms
	last_log_index = 10154178
	last_log_term = 124
	last_snapshot_index = 10148993
	last_snapshot_term = 124
	latest_configuration = [{Suffrage:Voter ID:b1feb89a-b382-52de-6825-bd4fd5dea4cc Address:REDACTED.129:8300} {Suffrage:Voter ID:08d3e6be-e65d-dcfa-069b-84ff95732ea7 Address:REDACTED.158:8300} {Suffrage:Voter ID:24cac505-8465-913e-a9d6-7ce0e1fc224b Address:REDACTED.198:8300}]
	latest_configuration_index = 1432601
	num_peers = 2
	protocol_version = 3
	protocol_version_max = 3
	protocol_version_min = 0
	snapshot_version_max = 1
	snapshot_version_min = 0
	state = Follower
	term = 124
runtime:
	arch = amd64
	cpu_count = 4
	goroutines = 426
	max_procs = 4
	os = linux
	version = go1.12.1
serf_lan:
	coordinate_resets = 0
	encrypted = true
	event_queue = 0
	event_time = 42
	failed = 0
	health_score = 0
	intent_queue = 0
	left = 0
	member_time = 830
	members = 12
	query_queue = 0
	query_time = 1
serf_wan:
	coordinate_resets = 0
	encrypted = true
	event_queue = 0
	event_time = 1
	failed = 0
	health_score = 0
	intent_queue = 0
	left = 0
	member_time = 78
	members = 9
	query_queue = 0
	query_time = 1

</details>

Operating system and Environment details

infra is on AWS eu-west-1 nomad server is Ubuntu 16.04.6 LTS consul server is on Ubuntu 18.04.3 LTS nomad client is on Windows_Server-2019-English-Core-ContainersLatest-2020.07.15 (ami-0fc75deae31bee04f)

the changelog in the master branch has not been updated to reflect the release of 1.8.1, https://github.com/hashicorp/consul/blob/v1.8.1/CHANGELOG.md https://github.com/hashicorp/consul/blob/master/CHANGELOG.md

but the download page does point to 1.8.1 https://www.consul.io/downloads

I entirely disagree with this proposal. aws-vault was built exactly to avoid having (long lived) creds in clear text saved on disk.

any tools interacting with AWS should support AWS SDKs, which means env var creds and metadata (--server/--ecs) would work out of the box

Thanks for the keen eye for security. Keep up the awesome work!

A pull request sent from a fork of the upstream repository could be manipulated to expose environment variables. The upstream repository’s maintainer would have no protection against this attack, as pull requests can be sent by anyone who forks the repository on GitHub.

https://docs.travis-ci.com/user/pull-requests/

How do you mean?

I don't have the details on hand, but both github actions and gitlab runners have clear warning about allowing jobs to run from forks

not only devs clone this project. many people clone just to install and run

if you make the default branch dev, anyone checking out the project and not specifying a branch , will download dev, instead of a stable master .

FYI builds out of the repo can lead to security issues

one of the big changes of TF v0.13 is namespace for providers

https://github.com/hashicorp/terraform/pull/24477

As part of implementing a new decentralized namespace for providers, Terraform now requires an explicit source specification for any provider that is not in the "hashicorp" namespace in the main public registry. (More details will be added about this prior to release, including links to upgrade steps.)

i assume you did aws sso login ?

Two (stupid?) questions:

1. Is it possible to have this work with docker pull <someimage> commands too?

e.g. docker pull --pull=always nginx

2. Is it possible to have --pull=newer - to pull the latest version of an image, only if it's newer in the repo?

I don't understand your first one. The second one is the behaviour of pull.

@bendrucker maybe we are going in circles. all i want is for all outputs that are marked as sensitive to filter their values from user access screens. not to not printout outputs. i love outputs. i even asked for more of them

<!--- Please note the following potential times when an issue might be in Terraform core:

• Configuration Language or resource ordering issues
• State and State Backend issues
• Provisioner issues
• Registry issues
• Spans resources across multiple providers

If you are running into one of these scenarios, we recommend opening an issue in the Terraform core repository instead. --->

<!--- Please keep this note for the community --->

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

<!--- Thank you for keeping this note for the community --->

Terraform Version

bash-5.0# /home/atlantis/.atlantis/bin/terraform0.12.24 version Terraform v0.12.24

• provider.aws v2.56.0 and v2.57.0
• provider.vault v2.10.0

Affected Resource(s)

aws_ecr_repository_policy

Terraform Configuration Files

resource "aws_ecr_repository" "ecr" {
  for_each = toset(var.ecr_name)

  name = each.key
  tags = {
    tagTeam         = var.tagTeam
    tagBusinessUnit = var.tagBusinessUnit
  }
}

resource "aws_ecr_lifecycle_policy" "lifecycle_policy" {
  for_each = toset(var.ecr_name)

  repository = each.key
  policy     = <<EOF
{
  "rules": [
  {
    "rulePriority": 30,
    "description": "Expire untaged images older than 1 days",
    "selection": {
      "tagStatus": "untagged",
      "countType": "sinceImagePushed",
      "countUnit": "days",
      "countNumber": ${var.untag_days_countNumber}
    },
    "action": {
      "type": "expire"
    }
  }
  ]
}
EOF

  depends_on = [aws_ecr_repository.ecr]
}

resource "aws_ecr_repository_policy" "repository_policy" {
  for_each = toset(var.ecr_name)

  repository = each.key
  policy     = <<EOF
{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::0123456789:root",
          "arn:aws:iam::23456789012:root"
        ]
      },
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:DescribeImages",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer"
      ]
    }
  ]
}
EOF

  depends_on = [aws_ecr_repository.ecr]
}

a root module with ~1000 resources calls this module

Debug Output

  ------
2020/04/14 14:07:21 [TRACE] Executing graph transform *terraform.OrphanResourceCountTransformer
2020/04/14 14:07:21 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:21 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:21 [TRACE] EvalWriteOutput: Saving value for module.ecr.output.ecr in state
2020/04/14 14:07:21 [TRACE] Completed graph transform *terraform.OrphanResourceCountTransformer (no changes)
2020/04/14 14:07:21 [TRACE] Executing graph transform *terraform.AttachStateTransformer
2020/04/14 14:07:23 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:07:26 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:27 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:29 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:07:32 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:33 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:34 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:07:38 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:38 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:39 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:07:44 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:45 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:07:45 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020-04-14T14:07:45.183Z [DEBUG] plugin: plugin process exited: path=/home/atlantis/.atlantis/repos/SRE/terraform/853/default/ecr/.terraform/plugins/linux_amd64/terraform-provider-aws_v2.56.0_x4 pid=9079 error="signal: killed"
2020/04/14 14:07:50 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:50 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:07:50 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:55 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:07:55 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:07:55 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:00 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:00 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:08:00 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:05 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:05 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:08:06 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:10 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:11 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:08:11 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
<2020/04/14 14:08:16 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:08:16 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:16 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:21 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:08:22 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:22 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:26 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
2020/04/14 14:08:27 [TRACE] dag/walk: vertex "output.ecr" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:27 [TRACE] dag/walk: vertex "provider.aws (close)" is waiting for "module.ecr.aws_ecr_lifecycle_policy.lifecycle_policy"
2020/04/14 14:08:32 [TRACE] dag/walk: vertex "root" is waiting for "provider.aws (close)"
Killed

from atlantis

module.ecr.aws_ecr_repository.ecr["vs-index-manager-service"]: Refreshing state... [id=vs-index-manager-service]
2020/04/14 14:01:40 [INFO] Terraform version: 0.12.24  
2020/04/14 14:01:40 [INFO] Go runtime version: go1.12.13
2020/04/14 14:01:40 [INFO] CLI args: []string{"terraform0.12.24", "plan", "-var", "env=dev", "-var-file=/home/atlantis/.atlantis/repos/SRE/terraform/853/default/global-dev.tfvars", "-var-file=dev.tfvars", "-input=false", "-refresh", "-no-color", "-out", "/home/atlantis/.atlantis/repos/SRE/terraform/853/default/ecr/ecr-dev-default.tfplan"}
2020/04/14 14:01:40 [DEBUG] Attempting to open CLI config file: /home/atlantis/.terraformrc
2020/04/14 14:01:40 [DEBUG] File doesn't exist, but doesn't need to. Ignoring.
2020/04/14 14:01:40 [DEBUG] checking for credentials in "/home/atlantis/.terraform.d/plugins"
2020/04/14 14:01:40 [ERR] Checkpoint error: open /home/atlantis/.terraform.d/checkpoint_signature: permission denied
2020/04/14 14:01:40 [INFO] CLI command args: []string{"plan", "-var", "env=dev", "-var-file=/home/atlantis/.atlantis/repos/SRE/terraform/853/default/global-dev.tfvars", "-var-file=dev.tfvars", "-input=false", "-refresh", "-no-color", "-out", "/home/atlantis/.atlantis/repos/SRE/terraform/853/default/ecr/ecr-dev-default.tfplan"}
2020/04/14 14:01:40 [TRACE] Meta.Backend: built configuration for "s3" backend with hash value 704415183
2020/04/14 14:01:40 [TRACE] Preserving existing state lineage "612ba042-4733"
2020/04/14 14:01:40 [TRACE] Preserving existing state lineage "612ba042-4733"
2020/04/14 14:01:40 [TRACE] Meta.Backend: working directory was previously initialized for "s3" backend
2020/04/14 14:01:40 [TRACE] Meta.Backend: using already-initialized, unchanged "s3" backend configuration
2020/04/14 14:01:40 [INFO] Setting AWS metadata API timeout to 100ms
2020/04/14 14:01:41 [INFO] Ignoring AWS metadata API endpoint at default location as it doesn't return any instance-id
2020/04/14 14:01:41 [INFO] AWS Auth provider used: "StaticProvider"
2020/04/14 14:01:41 [DEBUG] Trying to get account information via sts:GetCallerIdentity
2020/04/14 14:01:41 [TRACE] Meta.Backend: instantiated backend of type *s3.Backend
2020/04/14 14:01:41 [DEBUG] checking for provider in "."
2020/04/14 14:01:41 [DEBUG] checking for provider in "/home/atlantis/.atlantis/bin"
2020/04/14 14:01:41 [DEBUG] checking for provider in ".terraform/plugins/linux_amd64"
2020/04/14 14:01:41 [DEBUG] found provider "terraform-provider-aws_v2.56.0_x4"
2020/04/14 14:01:41 [DEBUG] found provider "terraform-provider-vault_v2.10.0_x4"
2020/04/14 14:01:41 [DEBUG] checking for provider in "/home/atlantis/.terraform.d/plugins"
2020/04/14 14:01:41 [DEBUG] found valid plugin: "aws", "2.56.0", "/home/atlantis/.atlantis/repos/SRE/terraform/853/default/ecr/.terraform/plugins/linux_amd64/terraform-provider-aws_v2.56.0_x4"
2020/04/14 14:01:41 [DEBUG] found valid plugin: "vault", "2.10.0", "/home/atlantis/.atlantis/repos/SRE/terraform/853/default/ecr/.terraform/plugins/linux_amd64/terraform-provider-vault_v2.10.0_x4"
2020/04/14 14:01:41 [DEBUG] checking for provisioner in "."
2020/04/14 14:01:41 [DEBUG] checking for provisioner in "/home/atlantis/.atlantis/bin"
2020/04/14 14:01:41 [DEBUG] checking for provisioner in ".terraform/plugins/linux_amd64"
2020/04/14 14:01:41 [DEBUG] checking for provisioner in "/home/atlantis/.terraform.d/plugins"
2020/04/14 14:01:41 [TRACE] Meta.Backend: backend *s3.Backend does not support operations, so wrapping it in a local backend
2020/04/14 14:01:41 [INFO] backend/local: starting Plan operation
2020/04/14 14:01:41 [TRACE] backend/local: requesting state manager for workspace "default"
2020/04/14 14:01:42 [TRACE] backend/local: requesting state lock for workspace "default"
e:
Error: Error locking state: Error acquiring the state lock: ConditionalCheckFailedException: The conditional request failed
	status code: 400, request id: NSGOLSJ35N4K4HVM8KQ6CIH9MBVV4KQNSO5AEMVJF66Q9ASUAAJG
Lock Info:
  ID:        26d4c5b0-f824-8809-cd59-2d94d3f17fbd
  Path:      terraform/dev/ecr/terraform.tfstate
  Operation: OperationTypePlan
  Who:       atlantis@93b9975b9bf8
  Version:   0.12.24
  Created:   2020-04-14 13:59:11.915128358 +0000 UTC
  Info:      

Expected Behavior

for tf to plan

Actual Behavior

able to apply on mac, fails on linux, with both version 2.56 and 2.57

Steps to Reproduce

<!--- Please list the steps required to reproduce the issue. --->

1. /home/atlantis/.atlantis/bin/terraform0.12.24 plan -var env=dev -var-file=../global-dev.tfvars -var-file=dev.tfvars -parallelism=400

we worked around the issue by splitting this ECR module into multiple smaller ones.... sorry we dont have the crash logs available @bflad

@bendrucker i was seeing this on the output , after an apply

it's inside a folder .terragrunt-cache similar to .terraform

breaking change, so v3.0?

bump ?

Client: Docker Engine - Community
 Azure integration  0.1.4
 Version:           19.03.12
 API version:       1.40
 Go version:        go1.13.10
 Git commit:        48a66213fe
 Built:             Mon Jun 22 15:41:33 2020
 OS/Arch:           darwin/amd64
 Experimental:      true

Server: Docker Engine - Community
 Engine:
  Version:          19.03.12
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.13.10
  Git commit:       48a66213fe
  Built:            Mon Jun 22 15:49:27 2020
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          v1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

Client:
 Debug Mode: false
 Plugins:
  app: Docker Application (Docker Inc., v0.8.0)
  buildx: Build with BuildKit (Docker Inc., v0.3.1-tp-docker)

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 5
 Server Version: 19.03.12
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc version: dc9208a3303feef5b3839f4323d9beb36df0a9dd
 init version: fec3683
 Security Options:
  seccomp
   Profile: default
 Kernel Version: 4.19.76-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: x86_64
 CPUs: 2
 Total Memory: 1.453GiB
 Name: docker-desktop
 ID: RZWF:CQX4:UJEU:SU6Z:3V2G:YT4A:FMQV:742L:GOY5:HU4L:KKAS:QXQJ
 Docker Root Dir: /var/lib/docker
 Debug Mode: true
  File Descriptors: 41
  Goroutines: 48
  System Time: 2020-07-03T12:03:28.3182982Z
  EventsListeners: 3
 HTTP Proxy: gateway.docker.internal:3128
 HTTPS Proxy: gateway.docker.internal:3129
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: true
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false
 Product License: Community Engine

So does anyone else have an example with no containers running, no containers having run since Docker was started, and Kubernetes turned off?

I used to be plagged with high CPU with no kube ever setup , very few number of images locally, and never building one. i would only run a couple of them daily. but since i've moved to edge i have not seen the issue.

can you expose the settings in vscode settings, instead of having to do it all in the json?

also, what are the default and available options?

"files.associations": {
	"terragrunt.hcl": "terraform",
	"*.tfvars": "terraform",
	"*.tf": "terraform",
	"*.tf.override": "terraform",
},
"files.watcherExclude": {
	"**/.terraform/**": true,
	"**/.terragrunt-cache/**": true
},
"[terraform]": {
	"editor.formatOnSave": true
},
"terraform.languageServer": {
	"enabled": true,
	// "external": true,
	// "args": [
	//     "serve"
	// ]
},

and then there's this https://github.com/wholroyd/vscode-hcl which is so old, i assume doesnt support HCL2

i load outputs of terraform runs into vscode to read them, and those are HCL highlighted

how would it handle --no-cache ? and would we purge it with builder cache or docker cache?

Terraform Version

Terraform v0.12.27

• provider.gitlab v2.10.0

Affected Resource(s)

Please list the resources as a list, for example:

• gitlab_project_push_rules

Terraform Configuration Files

resource "gitlab_project_push_rules" "project_push_rules" {
  project                       = gitlab_project.project.id
  commit_message_regex          = var.PROJECT_PUSH_RULES_COMMIT_MESSAGE_REGEX
  branch_name_regex             = var.PROJECT_PUSH_RULES_BRANCH_NAME_REGEX
  author_email_regex            = var.PROJECT_PUSH_RULES_AUTHOR_EMAIL_REGEX
  file_name_regex               = var.PROJECT_PUSH_RULES_FILE_NAME_REGEX
  deny_delete_tag               = var.PROJECT_PUSH_RULES_DENY_DELETE_TAG
  member_check                  = var.PROJECT_PUSH_RULES_MEMBER_CHECK
  prevent_secrets               = var.PROJECT_PUSH_RULES_PREVENT_SECRETS
  max_file_size                 = var.PROJECT_PUSH_RULES_MAX_FILE_SIZE
  # commit_committer_check        = var.PROJECT_PUSH_RULES_COMMIT_COMMITTER_CHECK
  # commit_message_negative_regex = var.PROJECT_PUSH_RULES_COMMIT_MESSAGE_NEGATIVE_REGEX
}

output project_push_rules {
  value = gitlab_project_push_rules.project_push_rules
}

variable "PROJECT_PUSH_RULES_COMMIT_MESSAGE_REGEX" {
  description = "(Optional, string) All commit messages must match this regex"
  type        = string
  default     = null
}

variable "PROJECT_PUSH_RULES_COMMIT_MESSAGE_NEGATIVE_REGEX" {
  type    = string
  default = null
}

variable "PROJECT_PUSH_RULES_BRANCH_NAME_REGEX" {
  description = "(Optional, string) All branch names must match this regex"
  type        = string
  default     = null
}

variable "PROJECT_PUSH_RULES_AUTHOR_EMAIL_REGEX" {
  description = "(Optional, string) All commit author emails must match this regex"
  type        = string
  default     = null
}

variable "PROJECT_PUSH_RULES_FILE_NAME_REGEX" {
  description = "(Optional, string) All commited filenames must not match this regex"
  type        = string
  default     = null
}

variable "PROJECT_PUSH_RULES_DENY_DELETE_TAG" {
  description = "(Optional, bool) Deny deleting a tag"
  type        = bool
  default     = false
}

variable "PROJECT_PUSH_RULES_MEMBER_CHECK" {
  description = "(Optional, bool) Restrict commits by author (email) to existing GitLab users"
  type        = bool
  default     = false
}

variable "PROJECT_PUSH_RULES_PREVENT_SECRETS" {
  description = "(Optional, bool) GitLab will reject any files that are likely to contain secrets"
  type        = bool
  default     = true
}

variable "PROJECT_PUSH_RULES_MAX_FILE_SIZE" {
  description = "(Optional, int) Maximum file size (MB)"
  type        = number
  default     = "0"
}

variable "PROJECT_PUSH_RULES_COMMIT_COMMITTER_CHECK" {
  description = "(Optional, bool) Users can only push commits to this repository that were committed with one of their own verified emails"
  type        = bool
  default     = false
}

Debug Output

  # gitlab_project_push_rules.project_push_rules will be created
  + resource "gitlab_project_push_rules" "project_push_rules" {
      + deny_delete_tag = false
      + id              = (known after apply)
      + max_file_size   = 0
      + member_check    = false
      + prevent_secrets = true
      + project         = "REDACTED"
    }

Error: POST https://gitlab.com/api/v4/projects/REDACTED/push_rule: 422 {error: Project push rule exists}

  on main.tf line 62, in resource "gitlab_project_push_rules" "project_push_rules":
  62: resource "gitlab_project_push_rules" "project_push_rules" {

Expected Behavior

for a rule to be created

Actual Behavior

error: Project push rule exists

Steps to Reproduce

1. terraform apply

not related, but i'm seeing

An argument named "commit_committer_check" is not expected here.

while that element exists in the documentation

Affected Resource(s)

Please list the resources as a list, for example:

• pages_access_level
• forking_access_level

ideally keeping in sync with https://docs.gitlab.com/ee/api/projects.html#create-project

i'm going with

variable "PROJECT_INITIALIZE_WITH_README" {
  description = "(Optional) Create master branch with first commit containing a README.md file."
  type        = bool
  default     = false 
  ## making this true will create a branch called master, not the one in default_branch
}

@abitrolly how do you purpose i run terraform twice on CI? it's state based... once applied you expect the infra represents what your code was codified with

so what do you purpose @abitrolly ? it's not like i can create two resources gitlab_project and have the default branch and read me run only there. I could not init the repo, but that would leave it without a default branch anyway

@abitrolly the bug is that it doesn't use that element on creation of the project. seems that the branch created is called master. and when you try to apply tf again, it tries to apply properties to a branch called main, that doesn't exist .... it was never created ~ default_branch = "master" -> "main"

not sure if related https://github.com/terraform-providers/terraform-provider-gitlab/issues/349

Terraform Version

Terraform v0.12.26

• provider.gitlab v2.10.0

Affected Resource(s)

resource "gitlab_project"

Terraform Configuration Files

resource "gitlab_project" "project" {
  name                                             = var.PROJECT_NAME
  description                                      = var.PROJECT_DESCRIPTION
  path                                             = var.PROJECT_PATH
  approvals_before_merge                           = var.PROJECT_APPROVALS_BEFORE_MERGE
  archived                                         = var.PROJECT_ARCHIVED
  container_registry_enabled                       = var.PROJECT_CONTAINER_REGISTRY_ENABLED
  default_branch                                   = var.PROJECT_DEFAULT_BRANCH
  initialize_with_readme                           = var.PROJECT_INITIALIZE_WITH_README
  issues_enabled                                   = var.PROJECT_ISSUES_ENABLED
  lfs_enabled                                      = var.PROJECT_LFS_ENABLED
  merge_method                                     = var.PROJECT_MERGE_METHOD
  merge_requests_enabled                           = var.PROJECT_MERGE_REQUESTS_ENABLED
  namespace_id                                     = local.GITLAB_GROUP_NAMESPACE_ID
  only_allow_merge_if_all_discussions_are_resolved = var.PROJECT_ONLY_ALLOW_MERGE_IF_ALL_DISCUSSIONS_ARE_RESOLVED
  only_allow_merge_if_pipeline_succeeds            = var.PROJECT_ONLY_ALLOW_MERGE_IF_PIPELINE_SUCCEEDS
  pipelines_enabled                                = var.PROJECT_PIPELINES_ENABLED
  request_access_enabled                           = var.PROJECT_REQUEST_ACCESS_ENABLED
  shared_runners_enabled                           = var.PROJECT_SHARED_RUNNERS_ENABLED
  snippets_enabled                                 = var.PROJECT_SNIPPETS_ENABLED
  tags                                             = var.PROJECT_TAGS
  visibility_level                                 = var.PROJECT_VISIBILITY_LEVEL
  wiki_enabled                                     = var.PROJECT_WIKI_ENABLED
  remove_source_branch_after_merge                 = var.PROJECT_REMOVE_SOURCE_BRANCH_AFTER_MERGE
  # shared_with_groups                               = var.PROJECT_SHARED_WITH_GROUPS
}

variable "PROJECT_DEFAULT_BRANCH" {
  description = "(Optional) The default branch for the project."
  type        = string
  default     = "main"
}

Debug Output

Terraform will perform the following actions:

  # gitlab_project.project will be created
  + resource "gitlab_project" "project" {
      + approvals_before_merge                           = 1
      + archived                                         = false
      + container_registry_enabled                       = true
      + http_url_to_repo                                 = (known after apply)
      + id                                               = (known after apply)
      + initialize_with_readme                           = true
      + issues_enabled                                   = false
      + lfs_enabled                                      = true
      + merge_method                                     = "rebase_merge"
      + merge_requests_enabled                           = true
      + name                                             = "foobar"
      + namespace_id                                     = REDACTED
      + only_allow_merge_if_all_discussions_are_resolved = true
      + only_allow_merge_if_pipeline_succeeds            = true
      + pipelines_enabled                                = true
      + remove_source_branch_after_merge                 = true
      + request_access_enabled                           = false
      + runners_token                                    = (known after apply)
      + shared_runners_enabled                           = false
      + snippets_enabled                                 = true
      + ssh_url_to_repo                                  = (known after apply)
      + visibility_level                                 = "private"
      + web_url                                          = (known after apply)
      + wiki_enabled                                     = false
    }

Plan: 1 to add, 0 to change, 0 to destroy.

and on a second run

  ~ update in-place

Terraform will perform the following actions:

  # gitlab_project.project will be updated in-place
  ~ resource "gitlab_project" "project" {
        approvals_before_merge                           = 1
        archived                                         = false
        container_registry_enabled                       = true
      ~ default_branch                                   = "master" -> "main"
        http_url_to_repo                                 = "https://gitlab.com/REDACTED/foobar.git"
        id                                               = REDACTED
        initialize_with_readme                           = true
        issues_enabled                                   = false
        lfs_enabled                                      = true
        merge_method                                     = "rebase_merge"
        merge_requests_enabled                           = true
        name                                             = "foobar"
        namespace_id                                     = REDACTED
        only_allow_merge_if_all_discussions_are_resolved = true
        only_allow_merge_if_pipeline_succeeds            = true
        path                                             = "foobar"
        pipelines_enabled                                = true
        request_access_enabled                           = false
        runners_token                                    = REDACTED
        shared_runners_enabled                           = false
        snippets_enabled                                 = true
        ssh_url_to_repo                                  = "[email protected]:REDACTED/foobar.git"
        tags                                             = []
        visibility_level                                 = "private"
        web_url                                          = "https://gitlab.com/REDACTED/foobar"
        wiki_enabled                                     = false
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Expected Behavior

for the repo to be created with a main default branch

Actual Behavior

default branch was master and on second apply of tf, it tried to recreate it and failed

Error: PUT https://gitlab.com/api/v4/projects/REDACTED: 400 {message: {base: [Could not change HEAD: branch 'main' does not exist]}}

  on main.tf line 18, in resource "gitlab_project" "project":
  18: resource "gitlab_project" "project" {

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply

First, NEVER send a PR to master branch, it will NEVER be accepted. Please send to the dev branch instead. If this is a PR to support new DNS API or new notification API, please read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide Please check the guide items one by one. Then add your usage here: https://github.com/acmesh-official/acme.sh/wiki/dnsapi

Or some other wiki pages: https://github.com/acmesh-official/acme.sh/wiki/deployhooks https://github.com/acmesh-official/acme.sh/wiki/notify

oh the irony @Neilpang :D

Maybe release a dot 1 version to bump the CDN issue? Re-releasing same version with different hash is a big no no and we already had similar issues in the past with hashi

not all my projects have a main.tf file. but any tf project will have

terraform {
  backend "s3" {}
}

block

Hi,

I'm trying to start the fogos.pt project using the provided docker-compose files and i'm getting the following errors:

With this command: docker-compose -f docker-compose.dev.yml up

I got this error when i've executed this outside of WSL:

WARNING: The PWD variable is not set. Defaulting to a blank string. ERROR: The Compose file is invalid because: Service php has neither an image nor a build context specified. At least one must be provided.

When i run the same command inside the WSL i got this: ERROR: The Compose file is invalid because: Service php has neither an image nor a build context specified. At least one must be provided.

The php service error happens with the default docker-compose file too. Relative to the PWD variable i can understand the cause, i'm more curious about the service php error.

At this moment i'm trying to run this using Windows 10 with release 2004 and WSL 2 enabled.

seems to be an issue with windows CMD. if you use gitbash, powershell or Windows Terminal, works as expected https://blog.codewithdan.com/docker-volumes-and-print-working-directory-pwd/ https://stackoverflow.com/questions/41485217/mount-current-directory-as-a-volume-in-docker-on-windows-10

years ago I remember reading windows doesnt really fill in env vars like $PWD, but again, not something i personally use, so cant say.

PRs welcome

I have no experience with docker on windows (wsl1 or wsl2)

oh please default this to off!!!