From b264a1aa95cd89632d8e24a7dab0d8f37508a10f Mon Sep 17 00:00:00 2001
From: Sharif Nassar <sharif@mrwacky.com>
Date: Tue, 15 Nov 2016 10:37:09 -0800
Subject: [PATCH 01/16] Fix nested quotes for Terraform 0.7.x

---
 terraform/aws/iam/main.tf                  | 12 ++++++------
 terraform/aws/private-cloud/main.tf        |  2 +-
 terraform/aws/public-cloud/edge-routers.tf |  6 +++---
 terraform/aws/public-cloud/masters.tf      |  6 +++---
 terraform/aws/public-cloud/workers.tf      |  6 +++---
 5 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/terraform/aws/iam/main.tf b/terraform/aws/iam/main.tf
index 64079a2..84a9fe3 100644
--- a/terraform/aws/iam/main.tf
+++ b/terraform/aws/iam/main.tf
@@ -2,13 +2,13 @@
 resource "aws_iam_role" "master_role" {
   name               = "master_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/master-role.json\")}"
+  assume_role_policy = "${file("${path.module}/master-role.json")}"
 }
 
 resource "aws_iam_role_policy" "master_policy" {
   name   = "master_policy"
   role   = "${aws_iam_role.master_role.id}"
-  policy = "${file(\"${path.module}/master-policy.json\")}"
+  policy = "${file("${path.module}/master-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "master_profile" {
@@ -20,13 +20,13 @@ resource "aws_iam_instance_profile" "master_profile" {
 resource "aws_iam_role" "worker_role" {
   name               = "worker_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/worker-role.json\")}"
+  assume_role_policy = "${file("${path.module}/worker-role.json")}"
 }
 
 resource "aws_iam_role_policy" "worker_policy" {
   name   = "worker_policy"
   role   = "${aws_iam_role.worker_role.id}"
-  policy = "${file(\"${path.module}/worker-policy.json\")}"
+  policy = "${file("${path.module}/worker-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "worker_profile" {
@@ -38,13 +38,13 @@ resource "aws_iam_instance_profile" "worker_profile" {
 resource "aws_iam_role" "edge-router_role" {
   name               = "edge-router_role"
   path               = "/"
-  assume_role_policy = "${file(\"${path.module}/edge-router-role.json\")}"
+  assume_role_policy = "${file("${path.module}/edge-router-role.json")}"
 }
 
 resource "aws_iam_role_policy" "edge-router_policy" {
   name   = "edge-router_policy"
   role   = "${aws_iam_role.edge-router_role.id}"
-  policy = "${file(\"${path.module}/edge-router-policy.json\")}"
+  policy = "${file("${path.module}/edge-router-policy.json")}"
 }
 
 resource "aws_iam_instance_profile" "edge-router_profile" {
diff --git a/terraform/aws/private-cloud/main.tf b/terraform/aws/private-cloud/main.tf
index 26ff833..2a123c4 100644
--- a/terraform/aws/private-cloud/main.tf
+++ b/terraform/aws/private-cloud/main.tf
@@ -52,7 +52,7 @@ module "elb" {
   source = "../elb"
 
   security_groups = "${module.sg-default.security_group_id}"
-  instances       = "${join(\",\", aws_instance.worker.*.id)}"
+  instances       = "${join(",", aws_instance.worker.*.id)}"
   subnets         = "${module.vpc.public_subnets}"
 }
 
diff --git a/terraform/aws/public-cloud/edge-routers.tf b/terraform/aws/public-cloud/edge-routers.tf
index 3a539d6..c9f406f 100644
--- a/terraform/aws/public-cloud/edge-routers.tf
+++ b/terraform/aws/public-cloud/edge-routers.tf
@@ -17,9 +17,9 @@ resource "template_file" "edge-router_cloud_init" {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 
diff --git a/terraform/aws/public-cloud/masters.tf b/terraform/aws/public-cloud/masters.tf
index 7f6668b..b04baf0 100644
--- a/terraform/aws/public-cloud/masters.tf
+++ b/terraform/aws/public-cloud/masters.tf
@@ -17,9 +17,9 @@ resource "template_file" "master_cloud_init" {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 
diff --git a/terraform/aws/public-cloud/workers.tf b/terraform/aws/public-cloud/workers.tf
index 69eaeef..2d801ed 100644
--- a/terraform/aws/public-cloud/workers.tf
+++ b/terraform/aws/public-cloud/workers.tf
@@ -17,9 +17,9 @@ resource "template_file" "worker_cloud_init" {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
     region             = "${var.region}"
-    etcd_ca            = "${replace(module.ca.ca_cert_pem, \"\n\", \"\\n\")}"
-    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, \"\n\", \"\\n\")}"
-    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, \"\n\", \"\\n\")}"
+    etcd_ca            = "${replace(module.ca.ca_cert_pem, "\n", "\\n")}"
+    etcd_cert          = "${replace(module.etcd_cert.etcd_cert_pem, "\n", "\\n")}"
+    etcd_key           = "${replace(module.etcd_cert.etcd_private_key, "\n", "\\n")}"
   }
 }
 

From 21439ce631efe36c4f27494bc00244b992e4dde5 Mon Sep 17 00:00:00 2001
From: Sharif Nassar <sharif@mrwacky.com>
Date: Tue, 15 Nov 2016 10:37:31 -0800
Subject: [PATCH 02/16] Use template_file as data resource for TF 0.7.x

---
 terraform/aws/private-cloud/bastion-server.tf | 4 ++--
 terraform/aws/private-cloud/main.tf           | 2 +-
 terraform/aws/private-cloud/masters.tf        | 4 ++--
 terraform/aws/private-cloud/workers.tf        | 4 ++--
 terraform/aws/public-cloud/edge-routers.tf    | 4 ++--
 terraform/aws/public-cloud/main.tf            | 2 +-
 terraform/aws/public-cloud/masters.tf         | 4 ++--
 terraform/aws/public-cloud/workers.tf         | 4 ++--
 8 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/terraform/aws/private-cloud/bastion-server.tf b/terraform/aws/private-cloud/bastion-server.tf
index 8a30e94..91cb7ab 100644
--- a/terraform/aws/private-cloud/bastion-server.tf
+++ b/terraform/aws/private-cloud/bastion-server.tf
@@ -11,7 +11,7 @@ module "bastion_ami" {
   virttype = "${module.bastion_amitype.prefer_hvm}"
 }
 
-resource "template_file" "bastion_cloud_init" {
+data "template_file" "bastion_cloud_init" {
   template   = "bastion-cloud-config.yml.tpl"
   depends_on = ["template_file.etcd_discovery_url"]
   vars {
@@ -31,7 +31,7 @@ resource "aws_instance" "bastion" {
   security_groups   = ["${module.sg-default.security_group_id}", "${aws_security_group.bastion.id}"]
   key_name          = "${module.aws-keypair.keypair_name}"
   source_dest_check = false
-  user_data         = "${template_file.bastion_cloud_init.rendered}"
+  user_data         = "${data.template_file.bastion_cloud_init.rendered}"
   tags = {
     Name = "kube-bastion"
     role = "bastion"
diff --git a/terraform/aws/private-cloud/main.tf b/terraform/aws/private-cloud/main.tf
index 2a123c4..c6cc5fb 100644
--- a/terraform/aws/private-cloud/main.tf
+++ b/terraform/aws/private-cloud/main.tf
@@ -57,7 +57,7 @@ module "elb" {
 }
 
 # Generate an etcd URL for the cluster
-resource "template_file" "etcd_discovery_url" {
+data "template_file" "etcd_discovery_url" {
   template = "/dev/null"
   provisioner "local-exec" {
     command = "curl https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
diff --git a/terraform/aws/private-cloud/masters.tf b/terraform/aws/private-cloud/masters.tf
index 139e8d8..25f6bef 100644
--- a/terraform/aws/private-cloud/masters.tf
+++ b/terraform/aws/private-cloud/masters.tf
@@ -10,7 +10,7 @@ module "master_ami" {
   virttype = "${module.master_amitype.prefer_hvm}"
 }
 
-resource "template_file" "master_cloud_init" {
+data "template_file" "master_cloud_init" {
   template   = "master-cloud-config.yml.tpl"
   depends_on = ["template_file.etcd_discovery_url"]
   vars {
@@ -29,7 +29,7 @@ resource "aws_instance" "mmaster" {
   subnet_id         = "${element(split(",", module.vpc.private_subnets), count.index)}"
   security_groups   = ["${module.sg-default.security_group_id}"]
   depends_on        = ["aws_instance.bastion"]
-  user_data         = "${template_file.master_cloud_init.rendered}"
+  user_data         = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name = "kube-master-${count.index}"
     role = "masters"
diff --git a/terraform/aws/private-cloud/workers.tf b/terraform/aws/private-cloud/workers.tf
index 10e0a2d..b3d9b26 100644
--- a/terraform/aws/private-cloud/workers.tf
+++ b/terraform/aws/private-cloud/workers.tf
@@ -10,7 +10,7 @@ module "worker_ami" {
   virttype = "${module.worker_amitype.prefer_hvm}"
 }
 
-resource "template_file" "worker_cloud_init" {
+data "template_file" "worker_cloud_init" {
   template   = "worker-cloud-config.yml.tpl"
   depends_on = ["template_file.etcd_discovery_url"]
   vars {
@@ -33,7 +33,7 @@ resource "aws_instance" "worker" {
   subnet_id         = "${element(split(",", module.vpc.private_subnets), count.index)}"
   security_groups   = ["${module.sg-default.security_group_id}"]
   depends_on        = ["aws_instance.bastion", "aws_instance.master"]
-  user_data         = "${template_file.master_cloud_init.rendered}"
+  user_data         = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name = "kube-worker-${count.index}"
     role = "workers"
diff --git a/terraform/aws/public-cloud/edge-routers.tf b/terraform/aws/public-cloud/edge-routers.tf
index c9f406f..235ba28 100644
--- a/terraform/aws/public-cloud/edge-routers.tf
+++ b/terraform/aws/public-cloud/edge-routers.tf
@@ -10,7 +10,7 @@ module "edge-router_ami" {
   virttype = "${module.edge-router_amitype.prefer_hvm}"
 }
 
-resource "template_file" "edge-router_cloud_init" {
+data "template_file" "edge-router_cloud_init" {
   template   = "${file("worker-cloud-config.yml.tpl")}"
   depends_on = ["template_file.etcd_discovery_url"]
   vars {
@@ -33,7 +33,7 @@ resource "aws_instance" "edge-router" {
   source_dest_check    = false
   security_groups      = ["${module.sg-default.security_group_id}"]
   depends_on           = ["aws_instance.master"]
-  user_data            = "${template_file.edge-router_cloud_init.rendered}"
+  user_data            = "${data.template_file.edge-router_cloud_init.rendered}"
   tags = {
     Name   = "kube-edge-router-${count.index}"
     role   = "edge-routers"
diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index fd37141..d4ad99f 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -154,7 +154,7 @@ module "iam" {
 }
 
 # Generate an etcd URL for the cluster
-resource "template_file" "etcd_discovery_url" {
+data "template_file" "etcd_discovery_url" {
   template = "${file("/dev/null")}"
   provisioner "local-exec" {
     command = "curl https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
diff --git a/terraform/aws/public-cloud/masters.tf b/terraform/aws/public-cloud/masters.tf
index b04baf0..b9aac2b 100644
--- a/terraform/aws/public-cloud/masters.tf
+++ b/terraform/aws/public-cloud/masters.tf
@@ -10,7 +10,7 @@ module "master_ami" {
   virttype = "${module.master_amitype.prefer_hvm}"
 }
 
-resource "template_file" "master_cloud_init" {
+data "template_file" "master_cloud_init" {
   template   = "${file("master-cloud-config.yml.tpl")}"
   depends_on = ["template_file.etcd_discovery_url"]
   vars {
@@ -32,7 +32,7 @@ resource "aws_instance" "master" {
   subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
   source_dest_check    = false
   security_groups      = ["${module.sg-default.security_group_id}"]
-  user_data            = "${template_file.master_cloud_init.rendered}"
+  user_data            = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name   = "kube-master-${count.index}"
     role   = "masters"
diff --git a/terraform/aws/public-cloud/workers.tf b/terraform/aws/public-cloud/workers.tf
index 2d801ed..7d6eab3 100644
--- a/terraform/aws/public-cloud/workers.tf
+++ b/terraform/aws/public-cloud/workers.tf
@@ -10,7 +10,7 @@ module "worker_ami" {
   virttype = "${module.worker_amitype.prefer_hvm}"
 }
 
-resource "template_file" "worker_cloud_init" {
+data "template_file" "worker_cloud_init" {
   template   = "${file("worker-cloud-config.yml.tpl")}"
   depends_on = ["template_file.etcd_discovery_url"]
   vars {
@@ -33,7 +33,7 @@ resource "aws_instance" "worker" {
   source_dest_check    = false
   security_groups      = ["${module.sg-default.security_group_id}"]
   depends_on           = ["aws_instance.master"]
-  user_data            = "${template_file.worker_cloud_init.rendered}"
+  user_data            = "${data.template_file.worker_cloud_init.rendered}"
   tags = {
     Name   = "kube-worker-${count.index}"
     role   = "workers"

From f9aa33439642b8cd3be4f0b39c59683f0d114b85 Mon Sep 17 00:00:00 2001
From: Sharif Nassar <sharif@mrwacky.com>
Date: Tue, 15 Nov 2016 11:42:26 -0800
Subject: [PATCH 03/16] Remove etcd_discovery_url.txt

---
 terraform/aws/private-cloud/etcd_discovery_url.txt | 1 -
 terraform/aws/public-cloud/etcd_discovery_url.txt  | 1 -
 2 files changed, 2 deletions(-)
 delete mode 100644 terraform/aws/private-cloud/etcd_discovery_url.txt
 delete mode 100644 terraform/aws/public-cloud/etcd_discovery_url.txt

diff --git a/terraform/aws/private-cloud/etcd_discovery_url.txt b/terraform/aws/private-cloud/etcd_discovery_url.txt
deleted file mode 100644
index 8b13789..0000000
--- a/terraform/aws/private-cloud/etcd_discovery_url.txt
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/terraform/aws/public-cloud/etcd_discovery_url.txt b/terraform/aws/public-cloud/etcd_discovery_url.txt
deleted file mode 100644
index 6fe5f6a..0000000
--- a/terraform/aws/public-cloud/etcd_discovery_url.txt
+++ /dev/null
@@ -1 +0,0 @@
-https://discovery.etcd.io/5a6cb41d2a91517447cb738d7e2cf898
\ No newline at end of file

From 337e104d0704f5e0a5bae72628f4645572543ca3 Mon Sep 17 00:00:00 2001
From: Sharif Nassar <sharif@mrwacky.com>
Date: Tue, 15 Nov 2016 12:01:12 -0800
Subject: [PATCH 04/16] Convert etcd_discovery_url to null_resource

In Terraform 0.7.x, template file data sources do not support the
'provisioner' parameter. So instead, we must now use a null_resource to
get the discovery URL.

And, unfortunately, depending on a null_resource does not mean that you
can read the file before it exists.
---
 docs/getting-started-guides/aws/public.md     |  1 +
 terraform/aws/private-cloud/bastion-server.tf |  2 +-
 terraform/aws/private-cloud/main.tf           | 18 +++++++++---------
 terraform/aws/private-cloud/masters.tf        |  2 +-
 terraform/aws/private-cloud/workers.tf        |  2 +-
 terraform/aws/public-cloud/edge-routers.tf    |  2 +-
 terraform/aws/public-cloud/main.tf            | 18 +++++++++---------
 terraform/aws/public-cloud/masters.tf         |  2 +-
 terraform/aws/public-cloud/workers.tf         |  2 +-
 9 files changed, 25 insertions(+), 24 deletions(-)

diff --git a/docs/getting-started-guides/aws/public.md b/docs/getting-started-guides/aws/public.md
index 57c0ffa..6f2aeab 100644
--- a/docs/getting-started-guides/aws/public.md
+++ b/docs/getting-started-guides/aws/public.md
@@ -59,6 +59,7 @@ for i in $(ls .terraform/modules/*/Makefile); do i=$(dirname $i); make -C $i; do
 ### Provision the cluster infrastructure
 
 ```
+rm -f etcd_discovery_url.txt && terraform apply -target=null_resource.etcd_discovery_url
 terraform apply
 ```
 
diff --git a/terraform/aws/private-cloud/bastion-server.tf b/terraform/aws/private-cloud/bastion-server.tf
index 91cb7ab..d672fa8 100644
--- a/terraform/aws/private-cloud/bastion-server.tf
+++ b/terraform/aws/private-cloud/bastion-server.tf
@@ -13,7 +13,7 @@ module "bastion_ami" {
 
 data "template_file" "bastion_cloud_init" {
   template   = "bastion-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
diff --git a/terraform/aws/private-cloud/main.tf b/terraform/aws/private-cloud/main.tf
index c6cc5fb..8678909 100644
--- a/terraform/aws/private-cloud/main.tf
+++ b/terraform/aws/private-cloud/main.tf
@@ -57,15 +57,15 @@ module "elb" {
 }
 
 # Generate an etcd URL for the cluster
-data "template_file" "etcd_discovery_url" {
-  template = "/dev/null"
-  provisioner "local-exec" {
-    command = "curl https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
-  }
-  # This will regenerate the discovery URL if the cluster size changes, we include the bastion here
-  vars {
-    size = "${var.masters}"
-  }
+resource "null_resource" "etcd_discovery_url" {
+    provisioner "local-exec" {
+        command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
+    }
+
+    # This will regenerate the discovery URL if the cluster size changes
+    triggers {
+        size = "${var.masters}"
+    }
 }
 
 # outputs
diff --git a/terraform/aws/private-cloud/masters.tf b/terraform/aws/private-cloud/masters.tf
index 25f6bef..cffda24 100644
--- a/terraform/aws/private-cloud/masters.tf
+++ b/terraform/aws/private-cloud/masters.tf
@@ -12,7 +12,7 @@ module "master_ami" {
 
 data "template_file" "master_cloud_init" {
   template   = "master-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
diff --git a/terraform/aws/private-cloud/workers.tf b/terraform/aws/private-cloud/workers.tf
index b3d9b26..f3b135e 100644
--- a/terraform/aws/private-cloud/workers.tf
+++ b/terraform/aws/private-cloud/workers.tf
@@ -12,7 +12,7 @@ module "worker_ami" {
 
 data "template_file" "worker_cloud_init" {
   template   = "worker-cloud-config.yml.tpl"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
diff --git a/terraform/aws/public-cloud/edge-routers.tf b/terraform/aws/public-cloud/edge-routers.tf
index 235ba28..9fd8600 100644
--- a/terraform/aws/public-cloud/edge-routers.tf
+++ b/terraform/aws/public-cloud/edge-routers.tf
@@ -12,7 +12,7 @@ module "edge-router_ami" {
 
 data "template_file" "edge-router_cloud_init" {
   template   = "${file("worker-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index d4ad99f..58408a1 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -154,13 +154,13 @@ module "iam" {
 }
 
 # Generate an etcd URL for the cluster
-data "template_file" "etcd_discovery_url" {
-  template = "${file("/dev/null")}"
-  provisioner "local-exec" {
-    command = "curl https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
-  }
-  # This will regenerate the discovery URL if the cluster size changes
-  vars {
-    size = "${var.masters}"
-  }
+resource "null_resource" "etcd_discovery_url" {
+    provisioner "local-exec" {
+        command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
+    }
+
+    # This will regenerate the discovery URL if the cluster size changes
+    triggers {
+        size = "${var.masters}"
+    }
 }
diff --git a/terraform/aws/public-cloud/masters.tf b/terraform/aws/public-cloud/masters.tf
index b9aac2b..75bb442 100644
--- a/terraform/aws/public-cloud/masters.tf
+++ b/terraform/aws/public-cloud/masters.tf
@@ -12,7 +12,7 @@ module "master_ami" {
 
 data "template_file" "master_cloud_init" {
   template   = "${file("master-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"
diff --git a/terraform/aws/public-cloud/workers.tf b/terraform/aws/public-cloud/workers.tf
index 7d6eab3..234f834 100644
--- a/terraform/aws/public-cloud/workers.tf
+++ b/terraform/aws/public-cloud/workers.tf
@@ -12,7 +12,7 @@ module "worker_ami" {
 
 data "template_file" "worker_cloud_init" {
   template   = "${file("worker-cloud-config.yml.tpl")}"
-  depends_on = ["template_file.etcd_discovery_url"]
+  depends_on = ["null_resource.etcd_discovery_url"]
   vars {
     etcd_discovery_url = "${file(var.etcd_discovery_url_file)}"
     size               = "${var.masters}"

From fd852bb8ec67d1a12f2932be687c585e734f4dbb Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Tue, 15 Nov 2016 18:49:41 -0800
Subject: [PATCH 05/16] switch regions

---
 terraform/aws/public-cloud/main.tf                     |  6 ++++--
 .../manual-steps/generate-etd-discovery-url.tf         | 10 ++++++++++
 terraform/aws/public-cloud/manual-steps/variables.tf   |  5 +++++
 3 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 terraform/aws/public-cloud/manual-steps/generate-etd-discovery-url.tf
 create mode 100644 terraform/aws/public-cloud/manual-steps/variables.tf

diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index 58408a1..abcb617 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -1,8 +1,10 @@
 variable "access_key" {}
 variable "secret_key" {}
 variable "organization" { default = "kubeform" }
-variable "region" { default = "eu-west-1" }
-variable "availability_zones" { default = "eu-west-1a,eu-west-1b,eu-west-1c" }
+#variable "region" { default = "eu-west-1" }
+#variable "availability_zones" { default = "eu-west-1a,eu-west-1b,eu-west-1c" }
+variable "region" { default = "us-west-2" }
+variable "availability_zones" { default = "us-west-2a,us-west-2b" }
 variable "coreos_channel" { default = "alpha" }
 variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
 variable "masters" { default = "3" }
diff --git a/terraform/aws/public-cloud/manual-steps/generate-etd-discovery-url.tf b/terraform/aws/public-cloud/manual-steps/generate-etd-discovery-url.tf
new file mode 100644
index 0000000..e3c7cc9
--- /dev/null
+++ b/terraform/aws/public-cloud/manual-steps/generate-etd-discovery-url.tf
@@ -0,0 +1,10 @@
+resource "null_resource" "etcd_discovery_url" {
+    provisioner "local-exec" {
+        command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
+    }
+
+    # This will regenerate the discovery URL if the cluster size changes
+    triggers {
+        size = "${var.masters}"
+    }
+}
diff --git a/terraform/aws/public-cloud/manual-steps/variables.tf b/terraform/aws/public-cloud/manual-steps/variables.tf
new file mode 100644
index 0000000..d8994a2
--- /dev/null
+++ b/terraform/aws/public-cloud/manual-steps/variables.tf
@@ -0,0 +1,5 @@
+# these files should be symlinked and pulled out into a separate file from ../main.tf
+
+variable "masters" { default = "3" }
+variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
+

From 11010dc88efb28e150e3ba2e715cc8b8fdf2501a Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Wed, 16 Nov 2016 15:40:49 -0800
Subject: [PATCH 06/16] include changes from
 https://github.com/Capgemini/kubeform/pull/86

---
 terraform/aws/elb/main.tf             |  4 +-
 terraform/aws/public-cloud/main.tf    | 59 +++++++++++++++------------
 terraform/aws/public-cloud/masters.tf |  4 +-
 3 files changed, 37 insertions(+), 30 deletions(-)

diff --git a/terraform/aws/elb/main.tf b/terraform/aws/elb/main.tf
index d0c3c52..a3a83b1 100644
--- a/terraform/aws/elb/main.tf
+++ b/terraform/aws/elb/main.tf
@@ -1,7 +1,7 @@
 variable "elb_name" { default = "kube-master" }
 variable "health_check_target" { default = "HTTP:8080/healthz" }
-variable "instances" {}
-variable "subnets" {}
+variable "instances" { type = "list" }
+variable "subnets" { type = "list" }
 variable "security_groups" {}
 
 resource "aws_elb" "kube_master" {
diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index abcb617..a9a1bb5 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -4,7 +4,10 @@ variable "organization" { default = "kubeform" }
 #variable "region" { default = "eu-west-1" }
 #variable "availability_zones" { default = "eu-west-1a,eu-west-1b,eu-west-1c" }
 variable "region" { default = "us-west-2" }
-variable "availability_zones" { default = "us-west-2a,us-west-2b" }
+variable "availability_zones" {
+    type = "list"
+    default = [ "us-west-2a", "us-west-2b" ]
+}
 variable "coreos_channel" { default = "alpha" }
 variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
 variable "masters" { default = "3" }
@@ -16,6 +19,10 @@ variable "edge-routers" { default = "1" }
 variable "edge-router_instance_type" { default = "m3.medium" }
 variable "edge-router_ebs_volume_size" { default = "30" }
 variable "vpc_cidr_block" { default = "10.0.0.0/16" }
+variable "vpc_public_cidrs_list" {
+    type = "list"
+    default = [ "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24" ]
+}
 
 provider "aws" {
   access_key = "${var.access_key}"
@@ -53,27 +60,27 @@ module "aws-keypair" {
 
 # certificates
 module "ca" {
-  source            = "github.com/Capgemini/tf_tls/ca"
+  source            = "github.com/tamsky/tf_tls/ca"
   organization      = "${var.organization}"
   ca_count          = "${var.masters + var.workers + var.edge-routers}"
-  deploy_ssh_hosts  = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  deploy_ssh_hosts  = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   ssh_user          = "core"
   ssh_private_key   = "${tls_private_key.ssh.private_key_pem}"
 }
 
 module "etcd_cert" {
-  source             = "github.com/Capgemini/tf_tls/etcd"
+  source             = "github.com/tamsky/tf_tls/etcd"
   ca_cert_pem        = "${module.ca.ca_cert_pem}"
   ca_private_key_pem = "${module.ca.ca_private_key_pem}"
 }
 
 module "kube_master_certs" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/master"
+  source                = "github.com/tamsky/tf_tls/kubernetes/master"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses          = "${concat(aws_instance.master.*.private_ip, aws_instance.master.*.public_ip)}"
-  dns_names             = "${compact(module.master_elb.elb_dns_name)}"
-  deploy_ssh_hosts      = "${compact(aws_instance.master.*.public_ip)}"
+  ip_addresses          = [ "${concat(aws_instance.master.*.private_ip, aws_instance.master.*.public_ip)}" ]
+  dns_names             = [ "${module.master_elb.elb_dns_name}" ]
+  deploy_ssh_hosts      = [ "${aws_instance.master.*.public_ip}" ]
   master_count          = "${var.masters}"
   validity_period_hours = "8760"
   early_renewal_hours   = "720"
@@ -82,11 +89,11 @@ module "kube_master_certs" {
 }
 
 module "kube_kubelet_certs" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/kubelet"
+  source                = "github.com/tamsky/tf_tls/kubernetes/kubelet"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses          = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses          = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   kubelet_count         = "${var.masters + var.workers + var.edge-routers}"
   validity_period_hours = "8760"
   early_renewal_hours   = "720"
@@ -95,35 +102,35 @@ module "kube_kubelet_certs" {
 }
 
 module "kube_admin_cert" {
-  source                = "github.com/Capgemini/tf_tls/kubernetes/admin"
+  source                = "github.com/tamsky/tf_tls/kubernetes/admin"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  kubectl_server_ip     = "${module.master_elb.elb_dns_name}"
+  kubectl_server_ip     = [ "${module.master_elb.elb_dns_name}" ]
 }
 
 module "docker_daemon_certs" {
-  source                = "github.com/Capgemini/tf_tls/docker/daemon"
+  source                = "github.com/tamsky/tf_tls/docker/daemon"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses_list     = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses_list     = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   docker_daemon_count   = "${var.masters + var.workers + var.edge-routers}"
   private_key           = "${tls_private_key.ssh.private_key_pem}"
-  validity_period_hours = 8760
-  early_renewal_hours   = 720
+  validity_period_hours = "8760"
+  early_renewal_hours   = "720"
   user                  = "core"
 }
 
 module "docker_client_certs" {
-  source                = "github.com/Capgemini/tf_tls/docker/client"
+  source                = "github.com/tamsky/tf_tls/docker/client"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  ip_addresses_list     = "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}"
-  deploy_ssh_hosts      = "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}"
+  ip_addresses_list     = [ "${concat(aws_instance.edge-router.*.private_ip, concat(aws_instance.master.*.private_ip, aws_instance.worker.*.private_ip))}" ]
+  deploy_ssh_hosts      = [ "${concat(aws_instance.edge-router.*.public_ip, concat(aws_instance.master.*.public_ip, aws_instance.worker.*.public_ip))}" ]
   docker_client_count   = "${var.masters + var.workers + var.edge-routers}"
   private_key           = "${tls_private_key.ssh.private_key_pem}"
-  validity_period_hours = 8760
-  early_renewal_hours   = 720
+  validity_period_hours = "8760"
+  early_renewal_hours   = "720"
   user                  = "core"
 }
 
@@ -136,10 +143,10 @@ module "igw" {
 
 # public subnets
 module "public_subnet" {
-  source = "github.com/terraform-community-modules/tf_aws_public_subnet?ref=b7659c06cba6a545b83f569bc73560b266e6c9c1"
+  source = "github.com/terraform-community-modules/tf_aws_public_subnet"
   name   = "public"
-  cidrs  = "10.0.1.0/24,10.0.2.0/24,10.0.3.0/24"
-  azs    = "${var.availability_zones}"
+  cidrs  = [ "${var.vpc_public_cidrs_list}" ]
+  azs    = [ "${var.availability_zones}" ]
   vpc_id = "${aws_vpc.default.id}"
   igw_id = "${module.igw.igw_id}"
 }
diff --git a/terraform/aws/public-cloud/masters.tf b/terraform/aws/public-cloud/masters.tf
index 75bb442..cdbf49c 100644
--- a/terraform/aws/public-cloud/masters.tf
+++ b/terraform/aws/public-cloud/masters.tf
@@ -60,8 +60,8 @@ resource "aws_instance" "master" {
 module "master_elb" {
   source             = "../elb"
   security_groups    = "${module.sg-default.security_group_id}"
-  instances          = "${compact(aws_instance.master.*.id)}"
-  subnets            = "${compact(split(",", module.public_subnet.subnet_ids))}"
+  instances          = [ "${aws_instance.master.*.id}" ]
+  subnets            = [ "${module.public_subnet.subnet_ids}" ]
 }
 
 output "master_ips" {

From 754750a7ed74ee8256f7b074584afc4853e9790a Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Wed, 16 Nov 2016 16:03:49 -0800
Subject: [PATCH 07/16] separate out vpc_public_cidrs_list and move it next to
 dependent list of AZs

---
 terraform/aws/public-cloud/main.tf | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index a9a1bb5..c0d038a 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -4,10 +4,16 @@ variable "organization" { default = "kubeform" }
 #variable "region" { default = "eu-west-1" }
 #variable "availability_zones" { default = "eu-west-1a,eu-west-1b,eu-west-1c" }
 variable "region" { default = "us-west-2" }
+
+# length(availability_zones) must == length(vpc_public_cidrs_list)
 variable "availability_zones" {
     type = "list"
     default = [ "us-west-2a", "us-west-2b" ]
 }
+variable "vpc_public_cidrs_list" {
+    type = "list"
+    default = [ "10.0.1.0/24", "10.0.2.0/24" ]
+}
 variable "coreos_channel" { default = "alpha" }
 variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
 variable "masters" { default = "3" }
@@ -19,10 +25,6 @@ variable "edge-routers" { default = "1" }
 variable "edge-router_instance_type" { default = "m3.medium" }
 variable "edge-router_ebs_volume_size" { default = "30" }
 variable "vpc_cidr_block" { default = "10.0.0.0/16" }
-variable "vpc_public_cidrs_list" {
-    type = "list"
-    default = [ "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24" ]
-}
 
 provider "aws" {
   access_key = "${var.access_key}"

From 683f56ce23242842fe85bb2be5a1773eac1a3b12 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Wed, 16 Nov 2016 16:04:44 -0800
Subject: [PATCH 08/16] aws_instance: fix subnet_id convert security_groups ->
 vpc_security_group_ids

---
 terraform/aws/public-cloud/edge-routers.tf | 4 ++--
 terraform/aws/public-cloud/masters.tf      | 4 ++--
 terraform/aws/public-cloud/workers.tf      | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/terraform/aws/public-cloud/edge-routers.tf b/terraform/aws/public-cloud/edge-routers.tf
index 9fd8600..46d8d19 100644
--- a/terraform/aws/public-cloud/edge-routers.tf
+++ b/terraform/aws/public-cloud/edge-routers.tf
@@ -29,9 +29,9 @@ resource "aws_instance" "edge-router" {
   iam_instance_profile = "${module.iam.edge-router_profile_name}"
   count                = "${var.edge-routers}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
   depends_on           = ["aws_instance.master"]
   user_data            = "${data.template_file.edge-router_cloud_init.rendered}"
   tags = {
diff --git a/terraform/aws/public-cloud/masters.tf b/terraform/aws/public-cloud/masters.tf
index cdbf49c..e2cb6f0 100644
--- a/terraform/aws/public-cloud/masters.tf
+++ b/terraform/aws/public-cloud/masters.tf
@@ -29,9 +29,9 @@ resource "aws_instance" "master" {
   iam_instance_profile = "${module.iam.master_profile_name}"
   count                = "${var.masters}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
   user_data            = "${data.template_file.master_cloud_init.rendered}"
   tags = {
     Name   = "kube-master-${count.index}"
diff --git a/terraform/aws/public-cloud/workers.tf b/terraform/aws/public-cloud/workers.tf
index 234f834..1cef81f 100644
--- a/terraform/aws/public-cloud/workers.tf
+++ b/terraform/aws/public-cloud/workers.tf
@@ -29,9 +29,9 @@ resource "aws_instance" "worker" {
   iam_instance_profile = "${module.iam.worker_profile_name}"
   count                = "${var.workers}"
   key_name             = "${module.aws-keypair.keypair_name}"
-  subnet_id            = "${element(split(",", module.public_subnet.subnet_ids), count.index)}"
+  subnet_id            = "${element(module.public_subnet.subnet_ids, count.index)}"
   source_dest_check    = false
-  security_groups      = ["${module.sg-default.security_group_id}"]
+  vpc_security_group_ids = ["${module.sg-default.security_group_id}"]
   depends_on           = ["aws_instance.master"]
   user_data            = "${data.template_file.worker_cloud_init.rendered}"
   tags = {

From 0dfaaba46fcef218aa742ada92d76eb8d16fe074 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Wed, 16 Nov 2016 16:25:31 -0800
Subject: [PATCH 09/16] tag aws_vpc with org Name

---
 terraform/aws/public-cloud/main.tf | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index c0d038a..185a428 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -36,6 +36,9 @@ resource "aws_vpc" "default" {
   cidr_block           = "${var.vpc_cidr_block}"
   enable_dns_support   = true
   enable_dns_hostnames = true
+  tags {
+      Name = "${var.organization} VPC"
+  }
   lifecycle {
     create_before_destroy = true
   }

From 9dea01b606b8d3c225acb8d63c8388ae1354f677 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Wed, 16 Nov 2016 16:42:13 -0800
Subject: [PATCH 10/16] un-fix kubectl_server_ip in module.kube_admin_cert

---
 terraform/aws/public-cloud/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index 185a428..d9886ae 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -110,7 +110,7 @@ module "kube_admin_cert" {
   source                = "github.com/tamsky/tf_tls/kubernetes/admin"
   ca_cert_pem           = "${module.ca.ca_cert_pem}"
   ca_private_key_pem    = "${module.ca.ca_private_key_pem}"
-  kubectl_server_ip     = [ "${module.master_elb.elb_dns_name}" ]
+  kubectl_server_ip     = "${module.master_elb.elb_dns_name}"
 }
 
 module "docker_daemon_certs" {

From b9fac4981168cfda1e80ad4e1667beea105f6b13 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Tue, 29 Nov 2016 10:37:59 -0800
Subject: [PATCH 11/16] docs/aws/public: remove manual steps re:
 etcd_discovery_url

---
 docs/getting-started-guides/aws/public.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docs/getting-started-guides/aws/public.md b/docs/getting-started-guides/aws/public.md
index 6f2aeab..57c0ffa 100644
--- a/docs/getting-started-guides/aws/public.md
+++ b/docs/getting-started-guides/aws/public.md
@@ -59,7 +59,6 @@ for i in $(ls .terraform/modules/*/Makefile); do i=$(dirname $i); make -C $i; do
 ### Provision the cluster infrastructure
 
 ```
-rm -f etcd_discovery_url.txt && terraform apply -target=null_resource.etcd_discovery_url
 terraform apply
 ```
 

From 4f7724090678f2a8329a1350518919a63ecf4d5d Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Tue, 29 Nov 2016 10:45:14 -0800
Subject: [PATCH 12/16] remove manual steps

---
 .../manual-steps/generate-etd-discovery-url.tf         | 10 ----------
 terraform/aws/public-cloud/manual-steps/variables.tf   |  5 -----
 2 files changed, 15 deletions(-)
 delete mode 100644 terraform/aws/public-cloud/manual-steps/generate-etd-discovery-url.tf
 delete mode 100644 terraform/aws/public-cloud/manual-steps/variables.tf

diff --git a/terraform/aws/public-cloud/manual-steps/generate-etd-discovery-url.tf b/terraform/aws/public-cloud/manual-steps/generate-etd-discovery-url.tf
deleted file mode 100644
index e3c7cc9..0000000
--- a/terraform/aws/public-cloud/manual-steps/generate-etd-discovery-url.tf
+++ /dev/null
@@ -1,10 +0,0 @@
-resource "null_resource" "etcd_discovery_url" {
-    provisioner "local-exec" {
-        command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
-    }
-
-    # This will regenerate the discovery URL if the cluster size changes
-    triggers {
-        size = "${var.masters}"
-    }
-}
diff --git a/terraform/aws/public-cloud/manual-steps/variables.tf b/terraform/aws/public-cloud/manual-steps/variables.tf
deleted file mode 100644
index d8994a2..0000000
--- a/terraform/aws/public-cloud/manual-steps/variables.tf
+++ /dev/null
@@ -1,5 +0,0 @@
-# these files should be symlinked and pulled out into a separate file from ../main.tf
-
-variable "masters" { default = "3" }
-variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
-

From 8968b0290ca1866bdc38fb9e5c0df162852d5fc7 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Tue, 29 Nov 2016 10:45:35 -0800
Subject: [PATCH 13/16] restore eu-west regions and AZs

---
 terraform/aws/public-cloud/main.tf | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index d9886ae..0cd3bfa 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -1,19 +1,18 @@
 variable "access_key" {}
 variable "secret_key" {}
 variable "organization" { default = "kubeform" }
-#variable "region" { default = "eu-west-1" }
-#variable "availability_zones" { default = "eu-west-1a,eu-west-1b,eu-west-1c" }
-variable "region" { default = "us-west-2" }
+variable "region" { default = "eu-west-1" }
 
 # length(availability_zones) must == length(vpc_public_cidrs_list)
 variable "availability_zones" {
     type = "list"
-    default = [ "us-west-2a", "us-west-2b" ]
+    default = [ "eu-west-1a", "eu-west-1b", "eu-west-1c" ]
 }
 variable "vpc_public_cidrs_list" {
     type = "list"
-    default = [ "10.0.1.0/24", "10.0.2.0/24" ]
+    default = [ "10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24" ]
 }
+
 variable "coreos_channel" { default = "alpha" }
 variable "etcd_discovery_url_file" { default = "etcd_discovery_url.txt" }
 variable "masters" { default = "3" }

From a54a491e408f7c79ef5b88087b2403cab85c95d0 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Tue, 29 Nov 2016 11:20:38 -0800
Subject: [PATCH 14/16] docs/aws/public: re-add manual provisioning step for
 etcd_discovery_url

---
 docs/getting-started-guides/aws/public.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/getting-started-guides/aws/public.md b/docs/getting-started-guides/aws/public.md
index 57c0ffa..69b2e34 100644
--- a/docs/getting-started-guides/aws/public.md
+++ b/docs/getting-started-guides/aws/public.md
@@ -59,6 +59,8 @@ for i in $(ls .terraform/modules/*/Makefile); do i=$(dirname $i); make -C $i; do
 ### Provision the cluster infrastructure
 
 ```
+cd /tmp/kubeform/terraform/aws/public-cloud
+terraform apply -target=null_resource.etcd_discovery_url
 terraform apply
 ```
 

From 9a1fae479d06b88166b93641c7275ba0f2b07169 Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Thu, 1 Dec 2016 12:47:17 -0800
Subject: [PATCH 15/16] remove null_resource etcd_discovery_url trigger

---
 terraform/aws/public-cloud/main.tf | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/terraform/aws/public-cloud/main.tf b/terraform/aws/public-cloud/main.tf
index 0cd3bfa..c4bf846 100644
--- a/terraform/aws/public-cloud/main.tf
+++ b/terraform/aws/public-cloud/main.tf
@@ -172,8 +172,6 @@ resource "null_resource" "etcd_discovery_url" {
         command = "curl -s https://discovery.etcd.io/new?size=${var.masters} > ${var.etcd_discovery_url_file}"
     }
 
-    # This will regenerate the discovery URL if the cluster size changes
-    triggers {
-        size = "${var.masters}"
-    }
+    # To change the cluster size of an existing live cluster, please read:
+    # https://coreos.com/etcd/docs/latest/etcd-live-cluster-reconfiguration.html
 }

From 99dd8aef0e7dc093ce7fef5ec573caa608a04b0e Mon Sep 17 00:00:00 2001
From: Marc Tamsky <tamsky@users.noreply.github.com>
Date: Thu, 1 Dec 2016 12:51:03 -0800
Subject: [PATCH 16/16] add empty etcd_discovery_url.txt

---
 terraform/aws/public-cloud/etcd_discovery_url.txt | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 terraform/aws/public-cloud/etcd_discovery_url.txt

diff --git a/terraform/aws/public-cloud/etcd_discovery_url.txt b/terraform/aws/public-cloud/etcd_discovery_url.txt
new file mode 100644
index 0000000..e69de29