►
Description
For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/
Managing Accounts Across AWS Partitions - David Byron, Salesforce
Leveraging Spinnaker to manage web-scale application deployments on AWS can present many challenges. One challenge is supporting multiple AWS partitions such as Gov Cloud and Commercial whilst maintaining sub-linear growth in Spinnaker operations and cost. In AWS, it's not possible to assume roles across partitions. Open-source spinnaker only supports one AWS managing account, which means managed accounts must all be in the same partition. Salesforce has added support for multiple managing accounts, making it possible to support managed accounts in multiple partitions in one spinnaker instance.
A
A
So
here
goes
what
is
an
AWS
partition
if
you're
like
me,
you
may
have
worked
with
AWS
for
a
long
time
and
had
no
idea
that
there
was
a
thing
called
an
AWS
partition,
but
it
turns
out
that
there
is
really
more
than
one
Cloud
out
there
in
AWS,
they're,
really
totally
separate,
physically
and
logically
isolated,
and
so
it's
hard
to
talk
across
them.
You
sort
of
can't
which
ends
up
being
kind
of
the
fundamental
problem
that
I'm
trying
to
solve
here.
A
So
we
maybe
most
of
us,
spend
most
of
our
Lives
running
in
the
standard
partition,
which
we
also
call
the
commercial
partition
and
then
one
day
somebody
calls
and
says:
oh,
we
want
to
run
some
stuff
in
another
partition
like
govcloud
or
there's
a
separate
partition
for
China
and
some
other
ones,
and
then
you
have
to
figure
out
what
to
do
so.
The
other
basic
concept
to
talk
about
is
managing
accounts.
A
What
are
managing
accounts
and
Spinnaker
most
of
the
time
when
people
talk
about
accounts
in
Spinnaker,
they're
talking
about
Target
accounts
or
managed
accounts,
I
may
say:
Target
accounts
because
it's
easier
to
distinguish
from
managing
accounts,
but
you'll
see
some
documentation
on
the
web
that
talks
about
managed.
You
know
if
you
want
to
deploy
an
auto
scaling
group
in
an
account.
That's
a
Target
account.
If
you
want
to
operate
on
a
kubernetes
cluster,
you
want
Spinnaker
to
to
have
a
deploy,
manifest
stage.
A
That's
operating
on
a
Target
account,
but
that's
not
what
this
talk
is
about.
This
talk
is
about
managing
accounts
on
how
you
end
up
getting
those
it's
sort
of
the
starting
point
for
how
you
get
those
credentials
to
do
the
work
that
we
were
just
talking
about
so
yeah
managing
accounts
are
used
to
do
that.
Assume,
role,
operation
and
they're
also
used
to
do
some
querying
of
like
region
and
availability,
Zone
information.
So,
let's
see,
let's
see
some
more.
This
is.
This
is
really
very
simply
what
Spinnaker
is
doing.
A
It
starts
with
some
managing
account
credentials
and
does
an
assume
role,
and
that's
it.
It's
it's
very
simple,
those
credentials,
though
those
managing
account
credentials
have
to
come
from
somewhere.
So,
let's
see,
excuse
me,
I'll
put
this
down,
let's
see
where
they
come
from.
We
are
about
to
dive
dive
into
some
code,
so
so
get
ready.
A
This
is
actually
some
code
inside
the
AWS
SDK
that
cork,
which
is
a
sort
of
a
shared
library
and
all
the
Spinnaker
components.
Cork
ends
up
using
it
and
it
turns
out
that
Cloud
driver
uses
this
thing
from
Cork
to
do
all
its
work.
These
are
all
the
places
that
Spinnaker
and
really
specifically
Cloud
driver,
looks
for
managing
account
credentials.
It
can
get
them
from
environment
variables
or
system
properties
or
web
identities,
and
this
profile
credentials
provider
is
the
maybe
the
most
interesting
one.
From
this
talk.
A
There
is
a
way
to
configure
the
credentials
directly
in
your
cloudriverlocal.yaml,
or
you
know,
directly
in
Cloud
driver
properties,
and
then
they
end
up
getting
stuck
in
environment
variables.
People
do
this
lots
of
different
ways.
The
way
that
we
ended
up,
extending
this
to
work
for
multiple,
multiple
managing
account
credentials
is
with
profiles.
A
So
we'll
see
more
about
that
in
a
minute,
but
no
matter
where
they
come
from
the
key
here
is
that
you
get
one
set
one
set
of
managing
account
credentials,
which
means
they
are
only
going
to
be
for
an
account
in
one
partition
or
the
or
another,
but
there's
only
going
to
be
one.
So,
let's
hang
on
to
that
for
a
minute
and
see
see
where
we
get.
If
you
turns
out,
you
do
want
to
have
Target
accounts
and
multiple
partitions.
A
What
what
do
you
do-
and
this
is
one
way
to
solve
the
problem-
you
can
run
two
instances
of
Spinnaker.
So
this
is
why
we're
talking
about
saving
piles
of
cash,
because
nobody
really
wants
this
you'd.
Much
rather
have
Target
accounts
in
multiple
partitions
and
one
Spinnaker
instance.
So
that's
what
we're
going
to
try
tried
to
get
to
yeah
there's
a
link
to
a
webpage
where
Amazon
actually
says
it
out
loud
that
you
can't
assume
roles
across
partitions,
but
but
you
can't
so
this
is
our
solution.
A
A
If
you
want
them
come
and
talk
to
me,
it
will
help
me
get
them
up
faster,
so
we're
going
to
look
at
some
more
code
in
a
second
there's,
some
code
to
like
I,
said
get
get
region.
Information
turns
out
that
every
time
you
make
an
AWS
SDK
call,
you
need
to
give
it
a
region
and
regions
are
partition.
Specific,
like
Usos
2
works
in
the
commercial
partition,
but
it
doesn't
work
in
the
gov
Cloud
partition.
A
You
need
to
be
able
to
give
a
gov
Cloud
specific
region,
so
we
ended
up
figuring
out
how
to
do
that
by
extending
this
code
here.
The
stuff
in
bold
is
the
stuff.
We
ended
up,
adding
the
Spinnaker
AWS
region
provider.
Is
this
sort
of
gnarly
down
deep
class
that
you
wish
you
never
found,
but
it's
in
Cloud
driver
and
it's
part
of
part
of
this
very
early
bootstrappy
thing
it
turns
out.
A
If
you,
when
you're
configuring
accounts
in
Cloud
driver,
you
can
give
some
amount
of
region
information
with
each
account
it
can
either
it
can
be
a
list
of
regions
or
it
can
be
even
as
detailed
as
availability
zones
within
those
regions
that
you
want
an
account
to
to
sort
of
operate
in,
and
if
you
don't
provide
that
information.
Well,
then
Spinnaker
will
try
to
query
it
for
you
using
a
managing
account.
A
But
again
the
region
needs
to
be
provided
so
this,
in
addition
to
using
the
profile,
credentials
provider
with
different
profile
names
or
the
way
that
that
we
ended
up
enabling
multiple
profiles.
So
let's
see
how
to
configure
it
with
a
with
a
caveat
here
that
people
are
free
to
get
secret
information
into
their
Cloud
driver.
However,
they
want
I'm
not
really
trying
to
cover
that
here.
That
first
set
of
Secrets
is
not
very
secret
because
it
comes
straight
from
an
AWS
website
feel
free
to
copy
it
and
try
it
out.
A
I
have
no
idea
what
will
happen
but
yeah.
How,
however,
you
do
it
with
some
kind
of
Vault
and
a
knit
container
and
injecting
your
secrets
into
a
pot
or
whatever
your
story
of
the
day
is
you're
welcome
to
do
that,
but
but
the
key
here
is
that
you
get
to
define
a
second
profile
without
these
changes,
Spinnaker
and
Cloud
driver
would
just
read
the
default
one.
A
A
The
other
side
of
this
is
the
sort
of
region
side
which,
after
all,
the
code
juggling
turns
out
to
be
pretty
easy
to
configure
you
just
add
a
region,
and
now
Spinnaker
knows
how
to
pick
it
up
so
pretty
straightforward,
and
then,
let's
see
what
happens
on
the
Spinnaker
side
of
things,
I
don't
know
how
many
of
you
spend
your
lives
looking
at
these
kinds
of
configuration
files,
but
this
is
this-
is
a
cloud
driver
set
of
cloud
driver
configuration
we
added
a
feature
flag?
That's
that
use
managing
account
profile
at
the
top.
A
You
can
see
sort
of
the
the
original
account,
a
commercial
account,
the
first
one,
my
AWS
account
and
then
there's
the
new
one
that
at
the
bottom,
my
other
AWS
account
that
specifies
the
managing
account
profile
as
other
which
connects
back
to
the
other
here
and
the
other
here,
and
you
do
these
things
and
you
get
that
picture
with
one
Spinnaker
instance
and
Target
accounts
and
multiple
partitions.
A
couple
of
things
to
note
and
I
guess
really.
A
The
most
specific
thing
to
note
is
that
that
assume
role
field-
maybe
you
can
see
in
the
commercial
account
it's
just
a
role
and
in
the
in
the
govcloud
account
it's
the
whole
Arn
Spinnaker
has
some
code
to
help.
You
do
the
assume
role
so
under
the
covers,
it
builds
out
an
entire
arm
for
you,
because
it
hard
codes,
iron
and
it
hard
codes.
The
the
partition
identifier
for
the
standard
or
commercial
partition,
which
is
just
AWS
and
IAM,
and
it
grabs
the
account
ID
and
grabs
the
roll
and
builds
you
a
whole
arm.
A
But
if
you
go
down
this
road,
like
we
did
you'll
figure
out
very
quickly
that
those
don't
work
so
make
sure
that
the
assume
role
is
a
whole
iron.
Take
a
deep
breath
here
and
pause.
This
is
really.
This
is
really
the
guts
of
the
new
feature.
However,
when
you
kind
of
go
down
this
road
and
people,
ask
you
to
support
Target
accounts
in
govcloud.
A
They
typically
ask
you
to
do
at
least
one
more
thing
and
that
one
more
thing
is
to
make
sure
that
you're
using
fips
endpoints
when
you
talk
to
things
in
govcloud,
has
a
bit
of
background.
Spinnaker
uses
V1
of
the
Java
AWS
SDK
anybody
who's.
Looking
for
a
good
contribution
to
the
community,
who'd
like
to
upgrade
that
to
V2,
please
come
talk
to
me.
We
would
love
for
that
to
happen.
It
would
have
made
this
part
of
this
job
a
whole
lot
easier
as
it
is
now
that
the
work
is
done.
A
This
is
all
you
have
to
do.
You
set
a
couple
of
config
flags
and
you
get
the
do
what
I
want
button.
However,
the
do
it
I
want.
Button
is
limited,
although
the
notion
of
fips,
endpoints
and
I
guess
maybe
I
should
talk
about
what
those
are
federal
information
processing
standard.
It's
basically
a
way
of
making
sure
that
you're
using
the
right,
cryptographic,
algorithms
and
you
can
be
blessed
to
I,
don't
know
address
whatever
kinds
of
compliance
concerns.
A
Some
people
might
have
and
AWS
provides
fips
compliant
endpoints,
sometimes,
but
not
all
the
time,
and
there
isn't
in
in
V1
of
the
SDK
there
isn't
like
an
easy
flag.
You
flip
that
just
says,
give
me
the
Phipps
compliant
ones.
You
actually
have
to
hand
configure
the
the
endpoint
that
you
want
based
on
some
other
magic
which
I'm
sure
I'll
apologize
for
once
you
guys
see
the
PRS
going
up
into
the
world
and
then
to
have
a
chance
of
knowing
whether
you
did
it
right.
A
We
added
some
logging
functionality,
which
also
turns
out
to
be
harder
than
you
thought
it
would
be
so
that
that's
really
that's
really
it
I
do
want
to
mention
some
some
notes
here.
I
guess
I
talked
about
the
first
one,
a
little
bit
about
providing
the
full
iron
there's
another
field
in
the
Spinnaker
config.
It's
called
default
regions
which
is
again
supposed
to
help
you
so
that
you
don't
have
to
populate
regions.
If
you
know
that
you
have
Target
accounts
that
are
all
in
US,
West
2
are
all
in
Us
East
one.
A
You
can
say
that
and
then
that's
that'll
sort
of
constrain
where
Cloud
driver
does
its
caching
work,
and
you
know
a
bunch
of
other
things
that
that
it
does,
but
those
default
regions
can
only
be
right
in
one
partition.
They
can't
be
right
in
multiple
partitions,
so
we
didn't
try
to
extend
that
in
any
way.
Basically,
what
it
means
is
you
have
to
specify
the
regions
that
you
want
in
your
govcloud
accounts
or
in
your
in
your
non-commercial
partition,
accounts
or
set
up
default
regions
to
work
in
govcloud
and
vice
versa.
A
Then
you
have
the
burden
to
configure
them
in
your
other
partition
accounts
and
other
partitions,
and
maybe
the
one
the
one
other
little
key
here,
and
this
is
something
that
actually
works
today
with
with
none
of
the
code
changes
that
we've
made.
If
you
have
kubernetes
clusters,
I
guess
specifically
eks
clusters,
the
Amazon
managed
kubernetes
service.
A
If
you
have
those
running
in
govcloud,
you
can
do
the
same
dance
and
configure
additional
managing
account
credentials
in
your
dot,
AWS
home
directory
and
mention
them
in
the
cubeconfig
file
and
then
you'll
magically
get
cross
partition,
control
of
the
eks
Clusters.
So
the
next
slide
is
a
bit
of
a
is
a
bit
of
a
topic
change.
A
It's
really
about
part
of
the
conversation
about
us,
getting
our
sales
force,
getting
our
changes
Upstream,
so
you
guys
can
benefit
from
all
this,
but
I
wanted
to
take
a
snapshot
few
days
ago
now,
but
I
think
it's
still
pretty
legit
of
contributions
to
Spinnaker
for
the
last
year
and
we've
been
doing
a
bunch
and
we're
going
to
continue
to
do
a
bunch
so
have
no
fear
we're,
definitely
not
going
anywhere
we're
going
to
keep
making
changes
and
keep
trying
to
get
our
changes.
Upstream.
A
To
that
end,
one
I
have
a
colleague
giving
a
talk
at
kubecon
about
using
Argo,
workflows
and
Argo.
Workflow
is
great
and
Argo
workflows
are
great
and
I
I
just
want
to
let
everybody
know
that
we're
using
Argo
workflows
in
addition
to
Spinnaker
they're,
certainly
not
replacing
Spinnaker
we're
actually
using
Spinnaker
to
deploy
the
Argo
workflows.
So
yeah,
Salesforce
and
Spinnaker
will
be
together
for
for
quite
some
time,
I
like
to
take
some
questions
and
see
if
anybody
any
about
about
this
or
or
other
Spinnaker
topics.
A
Are
you
talking
about
getting
the
changes
we've
made
upstream
or
making
the
changes
in
the
first
place?
It's
it's
there's
a
tension.
Sorry,
the
question
for
people
who
are
not
here
listening
online
is
about
what
do
I
mean
about
the
challenge
of
getting
changes.
Upstream,
there's
attention
so
I'm
very
grateful
that
Salesforce
pays
my
full
salary
to
work
on
Spinnaker.