Updating Circle CI ECS Runner Image

[swb-buildarchetype]

Hello all. Working with an outdated refarch that is running a three year old ecr image for builds. Trying to figure out best way to update the container image so that it runs on latest terragrunt and terraform versions. Since we don't have a version-controlled version of the image itself with Dockerfile is there a recommended way to update this?

https://github.com/gruntwork-io/terraform-aws-ci/blob/main/modules/ecs-deploy-runner/docker/deploy-runner/Dockerfile

---

Tracked in ticket #110702

[swb-buildarchetype]

For context this Quick Start for deploying ECS runner image manually does not match the functionality of the build_kaniko_image.sh and build_deploy_runner_image.sh files. Having a hard time locating the relevant documentation for those.

[gitsstewart]

@swbmindcycle did you already try following the steps in the docs here https://docs.gruntwork.io/refarch/usage/maintain-your-refarch/staying-up-to-date#upgrading-terraform-across-your-modules ?

[swb-buildarchetype]

Yes. ECR Runner image is extremely outdated so I cannot update any modules since the locked version of terraform is pre 1.2.0 and it doesn't recognize the include_in_copy to allow me to set diff version of TF. I need to update the ECS Runner Image. Figured that out.

Now running into an issue referencing the new image tag:

WARNING: A configuration in the repository root has changed. Because this could potentially impact many configurations, an operator must run a plan-all or apply-all manually in each account.

Does this mean you all would expect us to run a manual terragrunt apply-all in each acount in order to propigate this configuration? I am a bit confused by this.

[swb-buildarchetype]

@gitsstewart for context. Attempting to unwind several years of dependency updates required. Issue we are having:

• Most of the latest dependencies require updated Terraform version
• ECS Runner is locked in to original terraform version
• The early service catalog and terragrunt modules didn't allow you to pass the terraform version as an input to the runner fargate task. The whole allow copy flag didn't exist.
• We can't build new modules bc our terraform version is locked in
• We built a new ECR image, but we can't reference it because we can't successfully build the new ECR runner module in the common file -- since we are working with outdated terragrunt

Unless I am misunderstanding something it seems we're stuck in a circular dependency spiral. Any suggestions on how to handle this. Should we be considering just destroying the existing ECR runner module in our dev environment and trying to run again?

[yhakbar]

@swbmindcycle I'm trying to follow the situation that you're in, but it's difficult without some code samples to look at, etc.

Once you update the image in ECR, why aren't you able to reference it for your runner?

From what I understand, at least part of the issue you're experiencing is that you can't get Terragrunt to run to update your ECS runner image to run the updated version of Terragrunt in your image. Why isn't it feasible to run Terragrunt locally from your cli?

[swb-buildarchetype]

Figured it out by fiddling with latest versions of dependencies. Eventually got it to work, it seems. Now unlocked from not being able to manage TF version.

It would be helpful to explain that when updating dependencies through copy/paste in service catalog modules you also probably need to update your ECS runner. Even better would be to use Github Actions to manage that update so that it is a less cumbersome and manual task to update the image.