I was doing major version update from 2.x.x to 5.x.x for velero which use terraform helm_release module

ERROR: Please make .configuration.backupStorageLocation from map to slice

ERROR: Please make .configuration.volumeSnapshotLocation from map to slice

REMOVED: .configuration.provider has been removed, instead each backupStorageLocation and volumeSnapshotLocation has a provider configured

REMOVED: deployRestic has been removed, and it is named deployNodeAgent

you code probably look like this

resource "helm_release" "velero" {
  depends_on       = [kubernetes_namespace.velero]
  name             = "velero"
  create_namespace = "false"
  namespace        = "velero"
  chart            = "velero"
  version          = "5.2.1"
  wait             = "false"
  repository       = "https://vmware-tanzu.github.io/helm-charts"

  set {
    name  = "credentials.existingSecret"
    value = "cloud-credentials"
  }
  set {
    name  = "configuration.provider"
    value = "azure"
  }
  set {
    name  = "configuration.backupStorageLocation.name"
    value = "azure"
  }
  set {
    name  = "configuration.backupStorageLocation.bucket"
    value = data.azurerm_storage_container.backup_container.name
  }
  set {
    name  = "configuration.backupStorageLocation.config.resourceGroup"
    value = data.azurerm_storage_account.velero_backups.resource_group_name
  }
  set {
    name  = "configuration.backupStorageLocation.config.storageAccount"
    value = data.azurerm_storage_account.velero_backups.name
  }
  set {
    name  = "configuration.backupStorageLocation.config.subscriptionId"
    value = data.azurerm_subscription.current.subscription_id
  }
  set {
    name  = "deployRestic"
    value = "true"
  }
  set {
    name = "configuration.volumeSnapshotLocation.name"
    #   value = data.azurerm_storage_container.backup_container.name
    value = "azure"
  }
  set {
    name  = "configuration.volumeSnapshotLocation.config.resourceGroup"
    value = data.azurerm_storage_account.velero_backups.resource_group_name
  }
  set {
    name  = "configuration.volumeSnapshotLocation.config.incremental"
    value = "true"
  }

// ...
 // REMOVED as not relevant
}

below are the quick changes done to avoid those

Remove

  set {
    name  = "configuration.provider"
    value = "azure"
  }

Change

set {
    name  = "deployRestic"
    value = "true"
  }

into

set {
    name  = "deployNodeAgent"
    value = "true"
  }

Update each backupStorageLocation & volumeSnapshotLocation with [0], something like below

set {
    name  = "configuration.backupStorageLocation[0].bucket"
    value = data.azurerm_storage_container.backup_container.name
  }

If you run terraform apply after you might have this below error as well.

│ Error: rendered manifests contain a resource that already exists. Unable to continue with update: BackupStorageLocation / volumeSnapshotLocation "azure" in namespace "velero" exists and cannot be imported into the current release: invalid ownership metadata; annotation validation error: missing key "meta.helm.sh/release-name": must be set to "velero"; annotation validation error: missing key "meta.helm.sh/release-namespace": must be set to "velero"
│ 
│   with module.velero[0].helm_release.velero,
│   on ../modules/velero/main.tf line xxx, in resource "helm_release" "velero":
│  118: resource "helm_release" "velero" {
│ 
╵
Error: Terraform exited with code 1.
Error: Process completed with exit code 1.

This is coming from Kuberntes CRDs created by velero, even it is a version update runs in helm it does not seems to detect previous configuration but think it is as old resources created manually / or other way.

I did not want to update my terraform code with annotations as it will take another approach just to update version. or delete my CRDs ( which is a another option btw ) .

I have just update my both crds annotations with

    meta.helm.sh/release-name: velero
    meta.helm.sh/release-namespace: velero

Update :

Addressing

│ Warning: Helm release "velero" was created but has a failed status. Use the `helm` command to investigate the error, correct it, then run Terraform again.
│ 
│   with module.velero[0].helm_release.velero,
│   on ../modules/velero/main.tf line XXX, in resource "helm_release" "velero":
│  124: resource "helm_release" "velero" {
│ 
╵
╷
│ Error: 2 errors occurred:
│       * BackupStorageLocation.velero.io "azure" is invalid: spec.provider: Required value
│       * VolumeSnapshotLocation.velero.io "azure" is invalid: spec.provider: Required value
│ 
│ 
│ 
│   with module.velero[0].helm_release.velero,
│   on ../modules/velero/main.tf line XXX, in resource "helm_release" "velero":
│  124: resource "helm_release" "velero" {
│

Update code with

  set {
    name  = "configuration.volumeSnapshotLocation[0].provider"
    value = "azure"
  }
  set {
    name  = "configuration.BackupStorageLocation[0].provider"
    value = "azure"
  }

Thats it . terraform apply should execute .

Presentation I did during the software Freedom Day 2021 Sri Lanka hosted by foss.lk and Mozilla.lk

Script will be added to the slidedeck.

Presenation :

Video :

gcpshell@cloudshell:~$ kubectl get pods
E0530 10:30:30.808396 1087 round_trippers.go:169] CancelRequest not implemented
E0530 10:31:02.809176 1087 round_trippers.go:169] CancelRequest not implemented
E0530 10:31:34.812669 1087 round_trippers.go:169] CancelRequest not implemented
NAME READY STATUS RESTARTS AGE
{product}–5mxgr 2/2 Running 0 6h
{product}-pbxrm 2/2 Running 0 6h
{product}-fdmtc 2/2 Running 0 1d
{product}-p5gk9 2/2 Running 1 23d

it looks like the slowness is caused by a Stackdriver metric on Kubernetes, seeing this on the log:

I0530 07:59:31.462689 10171 round_trippers.go:417] curl -k -v -XGET -H “User-Agent: kubectl/v1.9.0 (linux/amd64) kubernetes/925c127” -H “Accept: application/json, */*” https://{{k8s-api-server-ip}}/apis/metrics.k8s.io/v1beta1
I0530 08:00:31.476011 10171 round_trippers.go:436] GET https://{{k8s-api-server-ip}}/apis/metrics.k8s.io/v1beta1 504 Gateway Timeout in 60013 milliseconds

issue seems cause by timeout from stackdriver metric pods in the kube-system namespace.

“I0530 08:00:31.476011 10171 round_trippers.go:436] GEThttps://{{k8s-api-server-ip}}/apis/metrics.k8s.io/v1beta1 504 Gateway Timeout in 60013 milliseconds

kubectl delete pod metrics-server-vx.x.x-xxxxxx–xxxxx -n kube-system

resolved the problem. I’m trying to reproduces this issue in a test environment to understand the root cause at stackdriver level but without luck.

Ever heard of country that encourage online scammers ? . I bet not! .
It’s little secret that not published in public medias since, they don’t want to get into competition with other countries.

The Pearl of Indian Ocean, World top travel destination in year 2018, The country which have two Prime Ministers or only president,.. .. . ( Wait.. I should google more to add things here, I’ll get back later, or not.).

However, before coming to the scams, security breeches stuff, let me explain and clarify why,

I bet you have read many sci-fi stories about living in a simulator, where all things are exists same as real world and computer game call sims, watch dogs, those are just a digital era, world now moving to give real time experience to the customers. this land I’m talking about provide you even better features, such as being a under-age thug, select most popular comedy movie actor as your area leadership (who it call “politicians”) as watch daily updates from something called “UNBIASED” TV Channels , or you can be a bus lover where multiple options available such as “Dam Rajini”, “Rosa Patikki”, “Mona Reddawalda”,

And Again, if you are too bored to run around and having fun, don’t worry, they also have this thing call “social media heroship / warrior”, which I prefer most of the time where you can just create multiple fake profiles and argue yourselves and insult others anonymously, or get support to your last day dinner poop photo ( note: this highly depend on your selected character gender if you wish to play here ). Criticize others opinion with “FACTs’ from something call Internet,So much fun.

Like I said, there is no limitation with characters who you can be, “Undergraduate of Protesting (P.hD in Illan kaama[1] )” , “Monk who teach religious practices of giving up attachments while owning a super luxury vehicle collection” , “Government Employee at busy department who suffer from sloth’a-mania”.

Apart from voting to jobless people to leadership as a hobby, you could be that person who ask votes from other easily manipulated characters. but you have to maintain your thug level like “Grand Theft Auto”, your deep throat skills, and you might need to get a surgery prior to apply being a politician character. (surgery is for removing your shy nerve).

Simulate your life experience

I get it !, everyone want to see what will happen if you do certain things in your life, but rules and laws from the society bound youI know, that is not the only one, either first or last scam happening at LK cyber space.but this response from relevant parties give me confidence to do similar cyber scams from people where no department really care about.r hands. in here you can just break any laws and get the experience of questioned by police, go to jail, get ass raped or anything, but don’t get confuse yet, best part is you can just come out if you no longer wants to be there, or absolutely not go to jail or to the police station even you break laws or rules.

Requirements ?

Make sure to top up your account to get Hassle free seamless experience or you can get support within the simulation helping any of that comedy characters call “Politicians” .

No Cyber laws or prevention at all — unless you hacked president website and expose yourself volunteer.

Yes, you heard right. even you hacked Mr President website there is no issue at all as there is no one to trace you down, we at least you volunteer to expose yourself.

Week ago I saw Facebook advertisement from this company call “Extreme Electronics Limited” where they posted IPhone XS for 75000 LKR,and it’s a one to one free offer , Yey ! thank you Santa ❤ . Contact number mentioned as +44 7548 789231.

Because I really think this is a PERFECT deal and want to buy 4 iPhone XS to that price for my family ( because I’m too rich to pay that amount without checking any background ). I sent this guy a message asking details. turns out he is the one who remind me that if I pay for 4 phones, I will get 8 iPhone XS just for 300000 LKR. ❤ . and they will directly send this from UK to my door within 48 hours or money back guarantee from them. (Damn it Pizzahut, you too slow).

Company Registration Number : SC465234
SUITE 16, 78 MONTGOMERY STREET,
EDINBURGH,
LOTHIAN,
EH7 5JA,
UNITED KINGDOM.

But the wonderful news is I don’t have to pay any of this money from “Western Union” , “Paypal” or even “BitCoin”, but to Commercial Bank account in Sri Lanka. ( too much legit ). he is the account manager for this UK company in Sri Lanka.

Account name : EABS FERNANDO
NUMBER : 83******82

Unfortunately, because of he is keeping so much money, customers won’t be able to contact him with personal details :( .

Purchasing and Payment

I’m ready to pay now and just to get the confirmation I called SL CERT. ( http://www.slcert.gov.lk/ ).

from their about page

“Q: What is Sri Lanka CERT|CC?
Sri Lanka Computer Emergency Readiness Team | Coordination Centre (Sri Lanka CERT) is the single trusted source of advice about the latest threats and vulnerabilities affecting computer systems and networks, and a source of expertise to assist the nation and member organizations, in responding to and recovering from Cyber attacks. It was set up in June 2006, in collaboration with the Information and Communication Technology Agency (ICTA) of Sri Lanka.”

However they were too shy to take the responsibility of “RESPONDING TO CYBER SCAM” and ask me to fill cyber scam report from police.lk. instead I called the police head office, just to tell him story and get the contact number of CID. Police said “since information are not enough you need to work with CID (Criminal Investigation Department) to obtain more info from the scammer” .

“Thank you very much sir about this, you see, we already published about this kind of scams from all the medias, and what we can do if people still fall for this. However if you want to make this go further can you send us a letter addressing our chef at CID , and do it quickly because more innocents will pay money until it stop”

similar to “We post about don’t kill people with vehicles, but what we do if drivers don’t stop at the road crossing and still people try to cross it”

WoW ! , I was never encouraged like that in my life while trying to make this Island better as a small individual. CERT, Police , CID . none of them really don’t want to get into that mess even I said “I will come personally to complain and support until you get necessary info from this scammer”.

Conclusion

I know, that is not the only one, either first or last scam happening at LK cyber space.but this response from relevant parties gave me confidence to do similar cyber scams to innocent people, because no department really care about.

Anyone from anywhere, this is a perfect place to get rich, start your scams today ! ❤ . our laws fully supports you.

Justification : this is not a intentional post, someone asked a question at https://security.stackexchange.com that he’s following BA as a undergrad and is it possible to change his career to InfoSec after graduation.below is my reply.

IT field including InfoSec mostly care about your knowledge, understanding, and willingness to keep learning and act upon it, All most all IT companies looking for the passionate people instead of your paper qualification. in-fact they understand fresh graduates know nothing about the industry, Here what I’m suggesting,

Work on Side projects

while you are doing your BA Degree. Assuming you have at least a little IT background, you’ll need to work o projects that give you visibility in the path you are willing to follow.

Contribute to Open-Source Projects.

• Start from the basics,

Projects like https://whatcanidoformozilla.org , https://github.com/explore gives you some insights to start your journey.

check what are the project you can contribute, doesn’t matter it’s localization, add a fewer line of space to the project in first place .even that will helpful for someone in the world,and growing your branding.

Start your own projects,

Doesn’t Matter it’s basic C program, or forked PHP GitHub project at first , keep work on it until you are familiar with stuff, then you’ll figure out your own way occasionally. also, check for open-source InfoSec tools and try to contribute it with Testing, commenting, if possible with feature suggestions and developments,

IT Security-Based Certification.

While you are undergraduate,try to do some certification which gives you visibility and understanding, C|EH, Comptia++ , CISSP, OCSP or talk to professionals and find out what matters at current time, (try not to mix everything over your interest), first read about every possible ones and understand what you want to do, most people will disagree with me here, because certifications are not really getting into place where you want to be with knowledge , but for the visibility I believe that’s something you’ll value, (take these certifications as your ticket to company interviews)

Network with Right People.

This should be the most important thing, Connect with the like-minded and people who work in the tech community, attend to meetups and events where Techies gather, sites such as meetup.com are the places you can find related meetups near you.

work with communities

Mozilla Campus Clubs :(maybe you can start one if your university: https://campus.mozilla.community/ ) ,
Bsides — http://www.securitybsides.com/ ,
https://www.owasp.org ( you can also engage or initiate OWASP student Chapter:https://www.owasp.org/index.php/OWASP_Student_Chapters_Program.
Google Developer Group, Local Tech Groups and Communities.

Work with the people that engage with certain activities, contribute to projects, read stuff related to infoSec/Techs, keep yourself update, test your abilities with demonstration frameworks, talk to industrial people from the certain organization and ask them what requirement you need to fulfill.

Doing BA/or any other degree won’t be a big problem to work in InfoSec/Tech field unless you let it be, working in the right way you can make your BA/Tech as extra advantage gets into the field.

Except the second point (related to infoSec Certifications) other points are also valid for the undergraduates who are in the IT background.