La entrada ChatGPT: What is it and what are its implications? se publicó primero en Geko Cloud.

The convention, organized by the Cloud Native Computing Foundation, is aimed at the main open source and cloud native communities.
The celebration at Feria València of KubeCon and CloudNativeCon marks the return to face-to-face attendance at this convention.

Part of the Geko Cloud team has been present at the congress to promote networking between providers and clients.
They have also attended the most relevant conferences, with the aim of reinforcing and consolidating knowledge.

The congress has brought together more than 5,000 highly specialized professionals in the field of open source and cloud computing, mainly from Europe but also from the United States and another 10,000 who have followed the event online. In addition, more than 200 leading firms in this technology have also participated as exhibitors and sponsors.

This new edition has surprised us thanks to the great ecosystem and the great potential of the project (CNCF) related to the cloud native.

This year a wide portfolio of products oriented to Companies has been presented. It should be noted that the novelty curve is flattening to make way for the Enterprise part. For the last 4 years, the technical community has been paving the way and giving way to companies and we are not just talking about startups, but corporates or large-scale companies in sectors such as banking, pharmaceuticals, food, etc.

We share the most outstanding news and trends of the KubeCon and CloudNativeCon congress

• OpenTelemetry: Open source project incubated by the CNCF (second in number of commits), provides a single open source standard and set of technologies to capture and export traces, metrics and, in the near future, logs from your infrastructure and applications cloud native.
• GitOps: A best-practice process for managing infrastructure and app configurations using Git, an open source version control system, as the single source of truth for applications and declarative infrastructure.
• Gatekeeper: Allows you to manage policies in Kubernetes. Policies enforce what fields and values ​​are allowed to be used in a given resource. Has the ability to modify resources based on conditions.
• Cluster API: Set of APIs focused on provisioning, updating and operating multiple Kubernetes clusters. It allows managing these resources through CRDs.
• FluxCD: GitOps tool equivalent to ArgoCD, it does a lot of application in security (avoid possible privilege escalations, etc), although it does not have a GUI (all management is done through cli). There is a Terraform provider to manage your resources.
• KubeLinter: Tool that analyzes YAMLs and Helm charts against a series of best practices with a focus on security. It is highly configurable (enable/disable checks) and allows you to generate a recommendation report.
• Sigstore: Modular collection of projects that can be used independently or together, with the aim of simplifying and making software signing more transparent.

About KubeCon + CloudNativeCon 2022 Europe

Cloud-native technologies enable organizations to build and run scalable applications in modern, dynamic environments such as public, private, and hybrid clouds. Containers, service meshes, microservices, immutable infrastructure, and declarative APIs exemplify this approach.

These techniques enable loosely coupled systems that are resilient, manageable, and observable. Combined with robust automation, they enable engineers to make high-impact changes frequently and predictably with minimal effort.

The Cloud Native Computing Foundation seeks to drive adoption of this paradigm by fostering and maintaining an ecosystem of open source and vendor-independent projects. We democratize the latest generation patterns so that these innovations are accessible to everyone.

More information about KubeCon + CloudNativeCon 2022 HERE

La entrada Geko Cloud at KubeCon and CloudNativeCon 2022 se publicó primero en Geko Cloud.

From Geko Cloud we are especially excited and proud to share this important synergy/event. A new stage of growth and very significant and relevant growth for Geko.

There are not many professional occasions in which you have the opportunity to see a company grow from startup mode to its consolidation, climbing to the top of the market in such a short time.
We have transformed and adapted over the months, but the essence of our pillars has always been the same:

• Customer Centric
• Technology Freedom
• Technical Excellence

We have been chosen by Claranet to lead the Public Cloud business unit in Spain. This will basically give way to being able to participate in larger projects and take on even more complex and cutting-edge challenges.

Our mission will be to provide Claranet with our knowledge management and incorporation of DevOps methodologies, infrastructure management in public Cloud, container management and microservices, to together achieve a greater market share and be the Cloud Consulting par excellence on a national level.

This operation also means that Geko Cloud rises to all levels of partnership with the main cloud providers, with which we will be able to offer a higher quality service to our clients, we will have the support of the country managers of all the main providers and we will provide a cost improvement in resale plans, as well as improvements in credits for pilot projects and proofs of concept.

Geko Cloud’s commitment and dedication to our customers will remain the same, as it is the core of our business. Also note that our differential value and the services we offer will continue to be based on:

• Direct and personalized treatment
• Free philosophy
• Customer centric
• Multidisciplinary technical team

The current founders, Jose Luis Sanchez and David Pujadas, will continue to exercise and develop the same skills as we have done until today.
The brand and composition of Geko Cloud will remain the same, as will its structure, work system and of course the team.

Geko Cloud to Claranet Group company

About Geko

We are a Cloud Consulting with a great capacity for adaptability in order to meet the needs of each of our clients.
At Geko Cloud we analyze your infrastructure in order to improve automation and internal processes, so that the deployment of your application is agile, efficient and secure, which leads to an improvement in time to market and your KPIs.
Unlike other companies, we do not work exclusively with any cloud service provider. We are free to adapt to the needs of our clients and introduce ourselves to their methodologies and work philosophy. Direct contact and proximity to our clients are a fundamental pillar in our service, which is why we work as one more piece of their internal team.

About Claranet

Founded in 1996, Claranet has evolved from one of the first ISPs (Internet Service Providers) to become a leading provider of technological services with a global reach.
Claranet are experts in modernizing and managing critical applications and infrastructures. They simplify IT service management so your customers can focus on their business. They offer a wide range of managed services, professional services, Cloud solutions, collaboration and connectivity, IT projects and cybersecurity.

For further information please do not hesitate to contact us!

La entrada Geko Cloud grows and joins the Claranet group se publicó primero en Geko Cloud.

Rooted, the main Spanish community that works to protect the cybersecurity of companies, people, institutions and also organizations, has wanted to have the participation of ProtAAPP, a reference community of professionals from public institutions inclined towards computer security, to be part of the most important event about cybersecurity in Spain, Rooted CON Madrid 2022.

It have been celebrated from March 10 to 12 in Kinepolis Madrid and has had more than 30 high-level speakers and more than 30,000 attendees.

Our Geko Cloud cybersecurity team have attended the most relevant conferences, with the aim of reinforcing and consolidating knowledge related to new technologies and tools in cybersecurity skills.

This edition has brought together more than 30 high-level speakers as well as an important group of experts and cybersecurity managers from public security forces and public institutions.

In addition to the international presentations, other conferences have been held by national experts of the highest level, such as Chema Alonso, José Miguel, José Miguel Esparza, Juan Garrido, David Melendez Cano, Pablo San Emeterio or Pedro Cabrera. These presentations dealt with current issues such as Blockchain security, machine learning, attacks on 5G networks, or cybersecurity in public administrations, among others.

In the different sessions, the experts discussed current cyber threats and how to deal with them, as well as practical demonstrations of security vulnerabilities and recommendations for managing real incidents.

One of the most outstanding presentations was given by Tarlogic which, taking up the one it gave at Rooted CON 2020, explained that it will release a PLCTool tool for capturing and analyzing PRIME network traffic, used in electricity supply networks. The particularity of this tool is that it allows attacks to be launched quickly and easily against electrical infrastructures.

We share the most outstanding news, in cybersecurity of Rooted CON 2022

• The cybersecurity sector will grow at a rate of 18% in the coming years.

• The ransomware market has evolved a lot in recent years. Specifically, it has pivoted its attack model away from mass attempts to take action on unselected targets, to a highly sophisticated business model that chooses its targets carefully and makes more aggressive and premeditated attacks.

• There is an increasing presence of “triple extortion” ransomware, in which in addition to encrypting the organization’s data and threatening to publish it if it refuses to pay, individual customers are also extorted with the threat of publishing their personal data.

• The volume of data  is increasing, and a review of indicators in the traditional way is becoming more and more complicated. The market is evolving in the direction of the use of tools that take advantage of artificial intelligence and machine learning to detect attackers that are increasingly capable of evading traditional detection.

• Even with the advancement of technology for resource protection, and incident detection and response, the weakest link in security is still the human being. A large part of the first accesses to a system go through phishing or social engineering, and emphasis should be placed on training people to avoid data leakage that facilitates the work of attackers.

• As the popularity of container orchestration platforms continues to grow, several techniques have been shown to escape the security systems offered by Kubernetes.

• Historically, organizations have always found it difficult to invest enough resources in the field of cybersecurity, and this is even more evident in public administration, as some of the speakers have shown and discussed.

• We have detected that the trend in the security area, especially with teleworking, is to implement EDRs that actively monitor the platform, being able to detect, minimize, and even stop the threats that appear.

• As a result of the entire confrontation between Russia and Ukraine (and the EU and the US), although it had already begun as a result of the pandemic, an increase in attacks on all types of administrations and services has been detected. Not necessarily from specific sides, since misinformation and false flag attacks are the order of the day.

The importance of making cybersecurity a priority

We know the importance of making cybersecurity a priority.

Data breaches and attacks can reach the level of irreversible natural disaster, often causing business disruption and damage to brand reputation, customer loyalty, and partner relationships, to name a few.

Geko Cloud Consulting Cloud and DevOps, we are specialists in cybersecurity, we help you protect and ensure the security of your company, regardless of its size, since any company is exposed to attacks and vulnerability.

For further information please do not hesitate to contact us.

La entrada Geko Cloud attends Rooted CON 2022 se publicó primero en Geko Cloud.

What does DigitalOcean offer?

DigitalOcean is a cloud provider that offers an infrastructure platform as a service (IaaS and PaaS). It simplifies the complexities of the cloud, so developers can focus their time and energy on building great software.

DigitalOcean is very popular with open source developers and competes with Amazon Web Services (AWS), Google Cloud or Azure. To deploy DigitalOcean’s Infrastructure as a Service (IaaS) environment, developers launch a private virtual machine (VM) instance, which DigitalOcean calls a “droplet”.

As DigitalOcean says, the simple UI, CLI, APIs, and documents allow you to spend time on the business, while DigitalOcean focuses on the infrastructure.

DigitalOcean purpose is to penetrate and gain market share in markets such as Spain and Spanish-speaking markets. We are proud to be one of the first partners of DigitalOcean in Spain (and speaks Spanish) being the engine and reference for new collaborations.

This provider is designed for developers and built for businesses and offers:

• A simple platform
• Predictable prices
• World class service

What product does DigitalOcean offer?

• Compute: DigitalOcen provides you with flexible server configurations sized for any application, industry-leading price-performance, and predictable pricing.

• Storage: Store and quickly access any amount of data reliably in the cloud. They offer several types of storage according to the needs of each one.
• Networking: Secure and control traffic to your apps with your own private network, traffic filtering, and load balancing.

• Databases: DigitalOcean Managed Databases is a fully managed, high-performance database cluster service. Using managed databases is a powerful alternative to installing, configuring, maintaining, and protecting databases. Clusters include daily backups with point-in-time recovery (PITR), standby nodes for high availability, and end-to-end SSL encryption. They currently offer four fully managed database engines: MongoDB, MySQL, PostgreSQL and Redis to give your application the performance it needs, without the operational demands of building and running your own database server.

• Development tools: Manage resources programmatically and integrate the entire developer ecosystem. (API, Client Libraries, CLI)
• Administrative tools: Supervision and management.

The DigitalOcean community is made up of people from all over the world (Global Community) who are driven to develop software and want to grow their business in the cloud.

DigitalOcean offers several solutions for every need: It offers from Easy and Reliable Web Hosting, Reliable Web and Mobile App Building, Game Development, Fast, Reliable and Easy to Use Cloud VPN, Run Big Data Batch and Streaming Workloads, SaaS Development, Agency Stores and Web Developers and Managed Cloud Hosting, simple and cost-effective.

Industry Leading Bandwidth Pricing

Do more with less complexity

How do I know if it is the ideal provider for me?

If you meet the following characteristics, it means that DigitalOcean is for you.

About Geko Cloud

We currently work with more than 40 clients internationally, and a team of professionals certified in different cloud providers and DevOps technologies, offering a range of services to adapt to the needs of our customers and help transform their businesses. At Geko Cloud we analyse your infrastructure to improve the automation and internal processes, so that the deployment of your application is agile, efficient, and secure.These improvements accelerate time to market and result in achieving your KPIs.

Unlike other companies, we do not work exclusively with any cloud service provider. We are free to adapt to the needs of our clients and we introduce ourselves to their methodologies and work philosophy. Direct contact and proximity to our clients is a fundamental pillar of our service, which is why we work as a part of their internal team.

We want to help you achieve your goals! Shall we talk?

La entrada Geko Cloud official partners of DigitalOcean se publicó primero en Geko Cloud.

This issue consists on that clients will wrongly identify correct, valid certificates as invalid, because the CA they are based on is now invalid and the client software was not updated to trust the new CA, so it is now giving these authentication problems. We have identified that this is a problem with older software clients like curl, or older versions of programming languages like php that do not have this CA installed in them and thus fail to access clients with letsencrypt certificates. 

Scope

Affected software versions

– OpenSSL <= 1.0.2

– Windows < XP SP3

– macOS < 10.12.1

– iOS < 10 (iPhone 5 is the lowest model that can get to iOS 10)

– Android < 7.1.1 (but >= 2.3.6 will work if served ISRG Root X1 cross-sign)

– Mozilla Firefox < 50

– Ubuntu < 16.04

– Debian < 8

– Java 8 < 8u141

– Java 7 < 7u151

– NSS < 3.26
-CDN like Cloudflare

– Amazon FireOS (Silk Browser)

This is an effect that can not only be felt by users or client applications, but by the application itself. For example, if your application is running on a system using a version lower than the detailed above, like a webserver with openssl 1.0.1, requests to any letsencrypt-backed service will fail. 

Remediation

Solution to this problem is to upgrade the client version of the software stack so it trusts the new root CA as a full solution. You can also patch the issue by modifying your software so it doesn’t check the validity of the CA, although keep in mind that this should be a temporary solution as it is an insecure software practice and should not be left applied in a production environment more time than necessary.

Here’s more technical information about this issue:

https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/

La entrada SSL Root Certificates Let’s encrypt Issue se publicó primero en Geko Cloud.

What happened?

Last 8th, from about 10 AM UTC, we started to receive different error reports from our customers: one couldn’t access his Github pages, another couldn’t manage his infrastructure with terraform, the one over there couldn’t build his python application …

When we posted these errors on our shared channels we realized that something big was going on because, as they say: one is an accident, two is a coincidence, three is a pattern. So we started digging around and soon discovered that one of the world’s leading CDNs was having problems.

What is a CDN?

A CDN (Content Delivery Network) is a globally distributed network of points of presence (PoPs) designed to get content to customers faster and more reliably. Whether we are aware of it or not, we all interact with a CDN on a daily basis: when we read the news on our favorite portal, when we make an online purchase, when we watch our favorite series on Netflix or when we take a look at our social media feeds. The CDN is the “invisible helper” behind that, in the vast majority of cases, excellent experience, because it helps minimize load times and latency in content delivery by physically reducing the distance between the content provider and its users.

How to react?

So what can you do when a provider through which a very significant percentage of the world’s web traffic passes is down?

TL;DR: Well, not much, really.

If you are a direct client of a CDN and you cannot afford to be offline in a similar circumstance, you have no choice but to implement a multi-CDN strategy (i.e. distribute your traffic across 2 or more networks to achieve redundancy and high availability). But this option is not affordable for everyone, besides adding extra configuration and complexity to your platform.

But if you are an indirect client (i.e. you use a service accessed through a CDN), your alternatives are rather null: wait for the service you use to implement a workaround or for the source of the problem to be solved (fortunately, in this case the incident was solved in less than 1 hour). The best thing to do is to realize as soon as possible that the problem is someone else’s problem so as not to waste time investigating what you have broken on your side …

Can it happen again?

Well, assuming that it is not the first time it happens and taking into account the nature of today’s internet, we can take it for sure.

So if you want to be prepared for the occasion and plan the necessary steps to mitigate the impact (either through a multi-CDN strategy or looking for alternatives to services that may be affected), do not hesitate to contact us.

See you on the next fall … I mean… on the next post.

La entrada Is internet as robust as they say? se publicó primero en Geko Cloud.

It’s very likely you have been running a GKE cluster at the version v1.15 for many months without issues and then -suddenly- the logs stopped being received. You are using the default logging system the system provides, so you then check the GCP status website but everything is running fine. You also know you have not modified anything on the cluster before the log stop, but at the same time you guess it has to be something on your side (on our case because it’s not happening on some other projects we manage).

If the above story is familiar to you continue reading as this article will cover from how to detect it, to the solution that will make your cluster logs being received again.

1. Symptoms

1. 1. – The very first symptom you may notice is the sudden, complete absence of logs in Stackdriver, which should be coming -as usual- from your cluster’s pods.

1. – Beside the previous fact, you will additionally find out you have no Fluentd agents anymore in your cluster.

   $ kubectl get daemonset -n kube-system | grep -i fluentd
   
   

2. – On the other hand, all the nodes of your cluster have the label beta.kubernetes.io/fluentd-ds-ready=true, which is required for the Fluentd agents to know to which nodes should be deployed.

   $ kubectl get nodes
   NAME                           STATUS   ROLES    AGE     VERSION
   gke-cluster-node-93c020-7rjq   Ready    none     14h     v1.15.11-gke.15
   gke-cluster-node-93c020-9w22   Ready    none     23h     v1.15.11-gke.15
   gke-cluster-node-93c020-jdbt   Ready    none     47h     v1.15.11-gke.15
   gke-cluster-node-93c020-jvcl   Ready    none     3h17m   v1.15.11-gke.15
   
   $ kubectl describe node gke-cluster-node-93c020-7rjq | grep -i fluentd-ds-ready
          beta.kubernetes.io/fluentd-ds-ready=true
   
   $ # Do the same for the remaining nodes in order to ensure all of them are properly labeled

3. – Your GKE cluster is currently at the version v1.15 or greater.

2. Diagnose

What is currently happening is GCP forcibly deprecating the legacy monitoring/logging system. The replacement is called Cloud Operations for GKE which (for our use case) does basically the same. Once said that, keep in mind there are a few differences you should take care about when searching (such as metric names changes), and that you will find them all on the migration guide.

3. Treatment

Label the cluster nodes

If you found on previous steps that your cluster nodes were not labeled, do it now!

$ kubectl label node $NODE_NAME beta.kubernetes.io/fluentd-ds-ready=true

Get your cluster’s name

List the available clusters.

$ gcloud container clusters list
NAME        LOCATION        MASTER_VERSION  MASTER_IP    MACHINE_TYPE   NODE_VERSION    NUM_NODES  STATUS
my-cluster  europe-east1-a  1.15.12-gke.2   34.35.36.37  n1-standard-2  1.15.11-gke.15  4          RUNNING

Disable the logging service for your cluster

Update your cluster’s config in order to set the logging service to none.

$ gcloud container clusters update my-cluster --logging-service none

Enable again the logging service for your cluster

Update your cluster’s config in order to set the logging service to the default one.

$ gcloud container clusters update my-cluster --logging-service logging.googleapis.com

WARNING: You will get an error telling you that enabling it is not possible due to the deprecation. This is the way we finally realized where the problem was. Just move on, you are on the right way.

Ensure the migration status is the expected one

Open the monitoring site at the GCP GUI and then go to Settings. You will find a tab named “Kubernetes Migration Status” which should look as follows.

Fully enable the logging&monitoring service for your cluster

Open the GKE clusters list and then click on the name of the cluster where you want to setup the new logging system. Once you see the cluster config, click on the EDIT button as is shown below.

Scroll down until finding the Kubernetes Engine Monitoring setting and then select the System and workload logging and monitoring option.

IMPORTANT: Don’t forget to save your changes at the bottom.

And that’s it! Your cluster will receive logs again as expected!

Conclusion

As you may probably know Google Cloud Platform is still in beta, so you will often find some changes breaking your already-working systems. You have two options at this point: On the one hand you could keep yourself up to date with all the future changes and deprecations. On the other hand you could just limit yourself to fix them as soon as they appear, but keep in mind you will always be blindly fighting against them.

There is a third option (which should be the first one), consisting on regularly coming to the Geko’s blog and check out if we have already dealt with the problem you are encountering. The Geko team will be always glad to see you here

Contact us for further information!

La entrada GCP/GKE – New logging system se publicó primero en Geko Cloud.

From time to time Google introduces new features and changes that sometimes also force the Terraform modules to upgrade themselves. It was our case at Geko, where we were using the GKE module for public-cluster deployment&management at version 5.x. A few days ago, when we planned to update some parameters it came that Google had removed the support for the Kubernetes dashboard. It was completely deprecated and the module was failing because of it, so we were forced to upgrade the module in order to meet the new conditions. There were up to 3 major version upgrades available, so we decided to go for it and use the latest one. However, it was not a standalone solution as it required to handle Terraform state’s incoherences.

The aim of this lab is to learn how to upgrade the official Terraform module intended to deploy&manage a public GKE cluster. We will specially deal with module’s (kubernetes-engine.beta-public-cluster) breaking changes, and we will manage to obtain the consistent status we previously had before the failure which preceded the upgrade.

Estimated time to finish this lab: ~20 minutes

1. Remove the previous resources

It’s strongly encouraged to perform a tfstate file backup before continue!

It’s especially important to remove all the conflicting resources from the Terraform state as soon as they are bounded between them using dependencies. The goal here is to remove any deprecated binding prior to importing them again from the current “picture” there’s already deployed.

The main components on a Kubernetes cluster are the networks (and subnetworks), the node pool and the cluster itself. Let’s focus on them.

terraform state rm module.gke.google_container_cluster.primary
terraform state rm module.gke.google_container_node_pool.pools[0]
terraform state rm module.vpc.google_compute_network.network
terraform state rm module.vpc.google_compute_subnetwork.subnetwork[0]
terraform state rm module.vpc.google_compute_subnetwork.subnetwork[1]

2. Upgrade versions

Once removed the previous states the next step is to set the version for the required modules to the current latest version. For the GKE module the latest now it’s 8.1.0, but it will be allowed to automatically adopt minor upgrades (“~>”).

Upgrade the GKE cluster module

 module "gke" {
   source  = "terraform-google-modules/kubernetes-engine/google//modules/beta-public-cluster"
-  version = "~> 5.0"
+  version = "~> 8.1"

Upgrade the VPC module

 module "vpc" {
-  source  = "github.com/terraform-google-modules/terraform-google-network?ref=v1.1.0"
+  source  = "github.com/terraform-google-modules/terraform-google-network?ref=v2.3.0"

Check the new resources

In order to find out if the new resources have experienced a name change (due to the modules upgrade), a Terraform plan is strongly encouraged.

On this case it has been found that some module’s internal hierarchy and also list’s indexes have changed.

  module.gke.google_container_cluster.primary
  
- module.gke.google_container_node_pool.pools[0]
+ module.gke.google_container_node_pool.pools["default-node-pool"]

  module.vpc.google_compute_network.network
  
- module.vpc.google_compute_subnetwork.subnetwork[0]
+ module.vpc.module.subnets.google_compute_subnetwork.subnetwork["southamerica-east1/my-cluster-public"]

- module.vpc.google_compute_subnetwork.subnetwork[1]
+ module.vpc.module.subnets.google_compute_subnetwork.subnetwork["southamerica-east1/my-cluster-private"]

3. Import fresh resources

Keep in mind that the zone/region depends on your kind of cluster. If it’s zonal you must use the master zone (e.g. southamerica-east1-a). On the other hand, if it’s a regional cluster you must use the region (e.g. southamerica-east1). The following example assumes a regional cluster located at southamerica-east1, in the project “my-project“, and with a cluster name “my-cluster“. The network names were set accordingly to the cluster’s name, just adding the suffixes “private” and “public” to the subnets to properly differentiate them.

Note also the new module hierarchy and indexing.

# Global vars
REGION="southamerica-east1"
PROJECT="my-project"
CLUSTER="my-cluster"

# Cluster
CLUSTER_LOCAL="module.gke.google_container_cluster.primary"
CLUSTER_REMOTE="${PROJECT}/${REGION}/${CLUSTER}"
terraform import $CLUSTER_LOCAL $CLUSTER_REMOTE

# Node pool
POOL_LOCAL="module.gke.google_container_node_pool.pools["default-node-pool"]"
POOL_REMOTE="${CLUSTER_REMOTE}/default-node-pool"
terraform import $POOL_LOCAL $POOL_REMOTE

# Subnetworks
BASE_SUBNET_LOCAL="module.vpc.module.subnets.google_compute_subnetwork.subnetwork"

## Public
PUBLIC_SUBNET_LOCAL="${BASE_SUBNET_LOCAL}["${REGION}/${CLUSTER}-public"]"
PUBLIC_SUBNET_REMOTE="${CLUSTER_REMOTE}-public"
terraform import $PUBLIC_SUBNET_LOCAL $PUBLIC_SUBNET_REMOTE

## Private
PRIVATE_SUBNET_LOCAL="${BASE_SUBNET_LOCAL}["${REGION}/${CLUSTER}-private"]"
PRIVATE_SUBNET_REMOTE="${CLUSTER_REMOTE}-private"
terraform import $PRIVATE_SUBNET_LOCAL $PRIVATE_SUBNET_REMOTE

# Network
NETWORK_LOCAL="module.vpc.module.vpc.google_compute_network.network"
NETWORK_REMOTE="${PROJECT}/${CLUSTER}"
terraform import $NETWORK_LOCAL $NETWORK_REMOTE

 4. Update parameters

It’s very likely you will encounter that after a Terraform plan the google_container_cluster resource still needs to be updated due to a subnetwork parameter change. The new subnet keys have made the indexes to change their order. Just edit your GKE module to replace the subnetwork parameter as below.

- subnetwork = module.vpc.subnets_names[0]
+ subnetwork = module.vpc.subnets_names[1]

Conclusion

As you may have read above, sometimes -when relying on third parties- could happen that a breaking change is introduced and you get yourself into troubles to get the service back again. Beside this, the solution could introduce collateral damages which will require additional sub-solutions. On this particular case regarding Terraform, dealing with inconsistent states is not really common nor recommended, but it comes that is the only method you have available to solve them on your tool-set.

I hope you’ve enjoyed this post and I encourage you to check our blog for other posts that you might find helpful. Do not hesitate to contact us if you would like us to help you on your projects.

See you on the next post!

La entrada Upgrade GKE public-cluster’s Terraform module se publicó primero en Geko Cloud.