NixOS AWS | 64 Members | |
| 15 Servers |
| Sender | Message | Time |
|---|---|---|
| 21 Oct 2024 | ||
| I can send a PR for that | 11:30:16 | |
In reply to @arianvp:matrix.orgI see. Note that the same is also the case for eu-central-1 now (when I think it wasn't before), just to make sure you know | 15:39:12 | |
| As I said. That list is deprecated. Use https://nixos.github.io/amis instead | 16:26:20 | |
| We can't use AWS for archival. They don't allow you to make public images available forever. They disappear after max period of a year | 16:26:45 | |
| So use the docs linked to query the latest AMI. Anything else is unsupported | 16:27:01 | |
| I also have no control over that old AWS account. I only have access to the new one. | 16:27:33 | |
| * We can't use AWS for archival. They don't allow you to make public images available forever. They disappear after max period of a year | 16:27:41 | |
| I only took over maintainace for 24.05 onwards. There aren't really any guarantees I can give over the old stuff. | 16:28:17 | |
| Wouldn't be surprised all those images disappear at some point | 16:30:13 | |
| Is there a particular reason why you need a 23.05 image instead of a supported image? | 16:33:08 | |
| Arian: I see. Yes, my reason is that I need to migrate some older 23.05 NixOps deployments to newer NixOS. I understand this isn't your or any NixOS contributor's fault, especially if AWS deletes public AMIs (no idea why they would do that, what is the point?). But it also means that the way NixOps is written is completely unsuitable, and I'm not sure a lot of NixOps authors, contributors, or users are aware of this. | 23:18:38 | |
| 22 Oct 2024 | ||
| Completely independent question: When I try to use NixOps to launch any newer AMI (it uses RunInstances), AWS errors with HTTP 400:
I was puzzled by this, because I reproduced it AMIs for which this works/fails:
Does anybody know what in the AMI could cause this? | 00:03:44 | |
| I thought NixOps is unmaintained. I think they even removed the AWS plugin recently | 00:16:31 | |
| Metadata options is part of the AMI. Sec | 00:16:47 | |
| I wonder if it's related to this line: ImdsSupport="v2.0", | 00:17:47 | |
| https://github.com/NixOS/amis/blob/main/upload-ami/src/upload_ami/upload_ami.py#L173 | 00:17:53 | |
| Hmm actually I think maybe NixOps uses a very old version of the AWS SDK that is maybe incompatible with the AWS API? | 00:19:26 | |
| Can you show me the raw curl command? | 00:19:43 | |
| The only hit on google is this one stack overflow issue : https://stackoverflow.com/questions/76495875/cant-provision-ec2-instance-with-ansible | 00:23:03 | |
| You're not on EC2 classic or something weird right? (The old VPC-less EC2) | 00:25:59 | |
| So yeh because the AMI sets that option, i think that causes an implicit MetadataOptions to be passed. However IMDSv2 is new. So maybe you're using a very old SDK. The EC2 API is versioned (See the Version parameter in the curl request) | 00:36:06 | |
| So maybe if you are trying to spawn an instance with IMDSv2 enabled using the older API version you get this error | 00:36:35 | |
| Advice here is: update boto3 | 00:39:34 | |
| * Advice here is: update boto3 dependency of nixops | 00:39:44 | |
| To quote the Amazon docs: > The latest versions of the AWS CLI and AWS SDKs support IMDSv2. To use IMDSv2, make sure that your EC2 instances have the latest versions of the CLI and SDKs. | 00:44:06 | |
| It'd be interesting to look at both `aws EC2 run-instances` and nixops in debug mode to see the exact request. But I'm pretty sure it's gonna be the API version parameter that is causing issues | 00:53:28 | |
| * It'd be interesting to look at both `aws EC2 run-instances` and nixops in debug mode to see the exact request differences. But I'm pretty sure it's gonna be the API version parameter that is causing issues | 00:53:44 | |
In reply to @arianvp:matrix.org Oh sure it is. Doesn't mean that all the startups using it to manage their infra evaporate though :D I'm checking your replies now, very helpful, one moment | 00:53:45 | |
| If updating nixops is not an option I'm afraid you'll have to upload a custom AMI with that setting unset :( | 00:57:09 | |
| But that'll get you into trouble as well as the ec2 nixos modules rely on IMDSv2 these days | 00:59:38 | |