search

input-output-hk / bitte

Nix Ops for Terraform, Consul, Vault, Nomad
Apache License 2.0
155 stars 15 forks source link

Revert "Add `core-` prefix to clients iam role name" #173

Closed blaggacao closed 2 years ago

blaggacao commented 2 years ago

This reverts commit 65ab1117a75af3cf979bf806b972b5f57dc3224c.

This commit seems to cause the vault-agent to fail:

Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]: 2022-07-27T06:36:22.248Z [INFO]  auth.handler: authenticating
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]: 2022-07-27T06:36:22.635Z [ERROR] auth.handler: error authenticating:
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]:   error=
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]:   | Error making API request.
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]:   |
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]:   | URL: PUT https://vault.lw.iog.io/v1/auth/aws/login
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]:   | Code: 400. Errors:
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]:   |
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]:   | * IAM Principal "arn:aws:sts::926093910549:assumed-role/core-lw-client/i-0023c9f46d55772b2" does not belong to the role "lw-client"
Jul 27 06:36:22 ip-10-24-155-251.eu-central-1.compute.internal vault[736002]:    backoff=40.67s
blaggacao commented 2 years ago

to apply:

core.[plan/apply] # destruction of old will fail
clients.[plan/apply]
core.[plan/apply] # to clean up again
blaggacao commented 2 years ago

Closing in favor of a more path-dependent #172