►
Description
This is a demo of what the next iteration of Support-Resources looks like. I'm using the Cloud Sandbox to create a Terraform projects (from predefined templates) that then automatically provisions resources within my personal GCP project.
More info about the Cloud Sandbox: https://about.gitlab.com/handbook/infrastructure-standards/realms/sandbox/
Link to the performed workarounds: https://gitlab.com/gitlab-com/business-technology/engineering/infrastructure/issue-tracker/-/issues/86#note_755209745
TIMESTAMPS
About Sandbox Cloud - 00:00
The Support-Resources-Template initial set-up - 01:28
Applying the 2 Sandbox workarounds - 06:08
The Service Account workaround - 07:29
The DNS subdomain and managed zone workaround - 09:36
Running the Terraform Dry-run stage and starting the Apply - 13:08
Successful completion of Terraform Apply and starting Terraform Destroy - 17:23
Info about the design of the Support Templates in Sandbox Cloud - 18:12
A
Hello,
this
is
vlad,
and
today
I'm
going
to
give
you
a
demo
of
how
we're
going
to
be
using
the
cloud
sandbox
to
and
specifically
how
to
provision
automatically
resources
within
your
personal
gcp
project,
just
like
we
do
now
in
support
resources,
and
in
fact
this
is
the
next
iteration
in
the
support
resources
project.
Okay,
let's
get
started
the
sandbox
cloud
log
in
with
octa.
A
And
you're
presented
with
this
landing
page
now,
if
you
don't
have
users
yet
if
this
is
your
first
time
when
you're
using
this,
you
probably
want
to
do
create
individual
account
and
it
will
show
you
this
we're
going
to
be
using
gcp.
Today
we're
going
to
choose
that
and
engineer
support,
and
it
doesn't
allow
me
because
I
already
have
one
but
you'll
probably
have
like
a
done
or
okay
or
something
once
that
is
done.
You'll
have
your
your
accounts
here.
A
A
A
And
I'll
just
take
a
few
seconds.
Okay,
so
you
see
I
I
have
a
lot
of
them,
but
the
one
that
I
just
created
is
at
the
top
of
the
list
and
if
you
want
to,
let's
click
that
this
will
take
you
to
the
actual
project
and
to
actually
see
this.
If,
if
this
is
your
first
time,
you
will
probably
get
a
login
screen
and
to
actually
see
your
credentials,
you
need
to
click
this
new
credentials.
A
A
What
you're
presented
with
is
a
project
that
is
a
separate
environment
which
you
are
free
to
use
and
it's
completely
separate
from
from
other
projects.
So,
whereas
in
support
resources,
we
kind
of
share
the
same
support,
resources,
wrap
or
project,
we're
no
longer
going
to
be
doing
that
everybody
will
get
their
own
project
and
you're
free
to
do
whatever
you
want
with
it.
And
you
know:
you're
not
you're,
not
gonna
affect
anybody
else,
blast
radius,
wise
so
yeah.
A
Basically,
this
is
the
support
resources,
template
and
it's
quite
similar
to
to
support
resources,
as
we
know
it
now.
As
of
the
8th
of
february
2022.,
the
difference
is
that
you
will
not
have
your
own
yourname.tf
or
like
blood.tf
you'll,
have
you'll
you'll
need
to
use
the
domain.tf
to
create
your
resources
and,
let's
just
change
that
obviously
you'll
need
to
add
your
own
asset,
public
ssh
key
on
here
and
change
the
names
of
the
resources.
A
In
fact,
I'm
going
to
that
right
now.
So
this
one
is
the
omnibus
instance.
So
I'm
going
to
change
that
omegas
to
say
demo,
one
omnibus,
okay,
change,
that
all
over
remove
this
as
well
then
go
into
the
elastic
search.
Let
me
remove
the
and
as
well
black
elastic
search,
I'm
gonna
change
that
to
demo
elasticsearch
so.
A
A
A
A
And
yeah
now
another
difference
is
that
in
the
way
this
was
designed,
you
get
a
dry
run
stage,
which
you
run
to
see
if
there's
any
errors
without
doing
the
terraform
applied.
Once
that
is
done,
you
have
to
manually
trigger
the
deploy
stage
which
actually
creates
the
resources
and
then,
at
the
end,
you
have
the
destroy.
Oh
right,
the
destroy
phase
that
destroys
the
the
resources,
so
you
won't
have
to
comment
them
out.
You
can
just
do
that
from
from
here.
A
A
You
need
to
apply
those
workarounds
and
you
can
find
the
workarounds
in
the
readme
and
then
there's
there's
this
link
to
it
and
what
you
need
to
do
is
create
the
service
account
and
the
dns
part.
So
we
we
can
do
those
too.
I
mean
it's,
not
it's
not
automated,
just
yet
okay.
So
what
we
need
to
do
is
go
back
and
open
the
gtp
console,
because
that's
where,
where
we're
gonna
be
doing
this
and
you
choose
your
own
project,
which
in
my
case
is
this
one.
So
you
can
see.
A
A
We
need
to
go
to
create
service
account
and
do
give
it
the
name
workaround,
something
something:
okay
and
this
environment
id
you
can.
You
can
grab
from
from
here.
It
doesn't
necessarily
have
to
be
that
I
mean
you
can
put
whatever,
but
you
need
to
have
a
unique
identifier.
So
when
you
do
more
environments
they
don't
overlap
and
use
errors
and
stuff.
So
I'm
just
going
to
do
that
here.
A
A
A
And
it
has
to
be
a
file
and
I'll
uncheck
the
variables,
because
you
need
that
if
you,
if
you're
doing
branches
but
yeah
okay,
so
that's
that's
workaround
number
one,
I'm
just
and
then
let's
go
to
work
on
number
two,
which
is
going
to
cloud
dns
and
creating
a
dns
zone:
okay,
create
zone
and
then
what
I'll
do
is
I'm
just
gonna
grab
the
name
from
here
dns
zone
is
called
demo
one.
Okay,.
A
A
A
And
by
the
way,
this
goes
for
the
other
templates
as
well.
We
have
a
couple
of
others.
One
is
the
implementation
of
get
which
works
with
get
to
o
and
the
other
one
is
for
interview
instances
for
those
of
us
who
are
doing
interesting
instances.
I've
also
implemented
that,
because
the
the
original
gcp
project
is
going
away,
so
we
just
wanna
yeah.
So
this
one
went
through
so
validate
is
successful.
A
It
says
what
what
it's
going
to
create
plan
20
to
add,
and
these
are
the
resources,
so
the
ones
that
we
find
in
the
main
tf
file
and
yeah
now
to
just
to
actually
spin
them
up.
We
need
to
click
play
on
everything
like
bring
up
everything,
so
I'm
gonna
do
that
and
I'm
probably
gonna
skip
forward
because
it's
gonna
take
like
10-15
minutes.
A
So
if
you
just
need
the
omnibus
instance,
you
would
comment
this
out
and
the
rest
would
be
just
fine.
Obviously,
as
I've
mentioned
before,
you
need
to
change
the
ssh
key
and
any
reference
of
vlogs.
You
would
change
to
your
name
or
whatever,
or
you
can
leave
blood.
You
can
leave
it
as
it
is
because,
since
this
is
your
own
gcp
project,
there
will
not
not
be
any
resource
conflicts.
You
will
just
have
your
your
instances
named
blood,
something.
A
So
that's
that's
fine,
too,
and
by
the
way
we
can
see
where
those
resources
are
being
spun
up.
If
we
check
our
well,
not
hacky
sac,
but
your
individual
gcp
project
and
then
bm
instances
and
as
you
can
see
already
there's
a
couple
of
things
going
on
so
the
basic
instance
and
elasticsearch
instance,
we
don't
see
an
omnibus
instance
just
yet
because
it
has
to
wait
for
elasticsearch
to
be
available,
it's
elasticsearch,
gitlab
and
then
runner.
A
So
that's
why
we're
not
seeing
them
just
yet,
but
this
is
where
things
will
get
created
and
obviously
you
can
check
networks
and
stuff.
Let's
see,
we
should
see
some
networking
activity
on
here,
so
not
the
default,
but
some
other
network,
that's
something
that
I
did
before.
So
I
guess
this.
This
is
the
one
that
is
being
created
now
sr,
and
this
is
the
identifier
which
you
see
here
in
cicd.
A
A
A
A
One
other
thing
that
I
wanted
to
show.
You
was
now
that
you
have
your
resources
and
are
satisfied
and
you
you
want
to
get
rid
of
them.
You
don't
need
to
comment
them
out
and
run
another
pipeline.
You
can
just
blow
up
everything,
so
that
would
be
done
here.
You
just
hit
this
and
it
will
start
deleting.
I
mean
it
will
run
a
terraform
destroy
and
it
will
kill
all
your
all
your
instances
which
you'll
find.
A
It
should
be
under
compute
engine
and
so
on
and
so
forth
in
your
gcp
project,
so
yeah
they're
currently
being
destroyed.
We
still
got
them
in
the
console
and
yeah.
That's
that's
kind
of
it.
The
only
other
thing
that
I
would
like
to
point
out
is
how
we're
changing
from
the
old
support
resources
to
the
cloud
sandbox
support
resources,
in
that
in
the
old
support
resources
we
had
like
a
wrapper
project,
which
was
support,
resources
that
use
modules
to
spin
up
instances
and
resources
in
gcd.
A
Now
we
have
templates
instead
of
the
the
wrapper
project
which
can
differ.
So
you
see
we
already
have
three
and
I'm
planning
to
do
a
fourth
for
for
kubernetes.
So
what
I
mean
is
these
ones
so
create
individual?
Oh
sorry,
creator
form
gcp,
and
then
you
can
choose
from
any
of
the
of
the
three
and
it
will
be
for
templates.
So
that
means
that
we're
no
longer
having
a
giant
project
that
needs
to
cover
all
the
co:
the
code
paths,
omnibus
kubernetes,
the
gitlab
environment,
toolkit
code.