DEV Community: Vasiliy

Deploy stratagies

Vasiliy — Sun, 08 Jan 2023 21:16:59 +0000

Green/Blue deployment - PFFFFFFFFffffffffffffff 👎
Red deployment - KBG officer orders you to deploy NOW!

Docker installation NO_PUBKEY error on ubuntu focal

Vasiliy — Mon, 29 Mar 2021 08:00:53 +0000

If you try to complete official docker installation manual and get this error on ubuntu 20 focal distro:

GPG error: https://download.docker.com/linux/ubuntu focal InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 7EA0A9C3F273FCD8

You could better try Digital Ocean manual with such way of adding docker gpg key and repo:

# Add key
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
# Add repo
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu focal stable"

First steps after Hashicorp Vault production deploy

Vasiliy — Tue, 14 Jul 2020 15:54:13 +0000

For ones who happy after production Hashicorp Vault deploy and a little confused about what to do next ... because all youtube and article guides are happyending on vault deploy.

Here the plan:

Use your root token you've got after vault init to login the Vault:
```
$ vault login <root token here>
```
Create base policies with different permissions (admin, provisioner) And write them down

Generate tokens for each policy

$ vault token create -policy="admin"
$ vault token create -policy="provisioner"

Create and attach kv storage engine

$ vault secrets enable -path=secret kv-v2

$ vault login <provisioner token here>
$ vault kv put secret/foo bar=baz
Key              Value
---              -----
created_time     2020-07-14T15:41:52.080464762Z
deletion_time    n/a
destroyed        false
version          1

Now you can get the key! 💥🍾🎉

$ vault kv get secret/foo
====== Metadata ======
Key              Value
---              -----
created_time     2020-07-14T15:41:52.080464762Z
deletion_time    n/a
destroyed        false
version          1
=== Data ===
Key    Value
---    -----
bar    baz

Real Amazon ECR Repository Pull Policy

Vasiliy — Wed, 13 Nov 2019 18:46:16 +0000

Unfortunately AWS documentation doesn't give us full permission settings to pull images from ECR. And if you'll use only

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Sid": "AllowPull",
      "Effect": "Allow",
      "Principal": "*",
      "Action": [
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage",
        "ecr:BatchCheckLayerAvailability"
      ]
    }
  ]
}

... you'll get
iam-role/long-strange-number is not authorized to perform: ecr:GetAuthorizationToken on resource: * status code: 400

And what you really need is to set up ecr:GetAuthorizationToken rights to * resource. So full policy will be:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ],
            "Resource": "arn:aws:ecr:eu-central-1:*:repository/*"
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": "ecr:GetAuthorizationToken",
            "Resource": "*"
        }
    ]
}