Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the real difference between Terraform and Ansible?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 67 posts

Re: Ask HN: What is the real difference between Terraform and Ansible?

#31

Post by bryogenic »

PaywallBuster wrote: post #25
styluss wrote: post #23

Terraform is a declarative way of setting up your cloud infrastructure. You specify the state you want your cloud to be in. Ansible is an imperative way of setting up your cloud. You tell it to do certain things, install this package, copy this over there. Hope it helps

Ansible is mostly declarative. by default you use Ansible modules/roles and specify the desired state. E.g. have these packages installed, have these directories created/deleted. Use cases not covered by modules can fallback to using shell commands

There are so many answers here that are incorrect about what ansible is/does. Thank you for providing one that is correct.

If I could add to your answer:

Not only is ansible declarative and idempotent but it also includes countless cloud provisioning modules to bring idempotency to cloud environments.

Terraform may be easier for basic provisioning of cloud resources but I always switch back to ansible cloud modules when I need to do anything complex. Ansible also has the added benefit of easily context switching over to configuring the compute resources after they have launched.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#32

Post by bryogenic »

oneplane wrote: post #27

If you are new to both and to IaC and DevOps as a whole: Ansible is for 'inside' virtual machines or computers, Terraform is for 'outside' virtual machines or computers. Inside a machine you might have software, configuration, assets. Outside a machine you might network connections, firewalls, disks, dns etc. This isn't a comprehensive comparison, but when you start from nothing, it doesn't really help to do a syntax…

Ansible also does 'outside' virtual machines.

See https://docs.ansible.com/ansible/2.3/list_of_cloud_modules.h...

Re: Ask HN: What is the real difference between Terraform and Ansible?

#33

Post by piroux »

PaywallBuster wrote: post #25
styluss wrote: post #23

Terraform is a declarative way of setting up your cloud infrastructure. You specify the state you want your cloud to be in. Ansible is an imperative way of setting up your cloud. You tell it to do certain things, install this package, copy this over there. Hope it helps

Ansible is mostly declarative. by default you use Ansible modules/roles and specify the desired state. E.g. have these packages installed, have these directories created/deleted. Use cases not covered by modules can fallback to using shell commands

To define something as declarative or imperative, it is important to compare the definition model to the execution model.

So I would rather say that Ansible is much less declarative than Terraform, because Ansible tasks (the different steps of an Ansible Playbook) are executed sequentially.

The tasks of Ansible are its statements, so yeah we would say that each Ansible task is declarative. And still, a requirement for that would be for the task to use a module/role which is idempotent, right? Another proof, Ansible natively offers loop, blocks, and conditional to control the execution flow throughout its tasks.

(This is not a critic of Ansible. I am happy to use it as is, as a high-level scripting mechanism.)

Re: Ask HN: What is the real difference between Terraform and Ansible?

#34

Post by 0xbadcafebee »

PaywallBuster wrote: post #25
styluss wrote: post #23

Terraform is a declarative way of setting up your cloud infrastructure. You specify the state you want your cloud to be in. Ansible is an imperative way of setting up your cloud. You tell it to do certain things, install this package, copy this over there. Hope it helps

Ansible is mostly declarative. by default you use Ansible modules/roles and specify the desired state. E.g. have these packages installed, have these directories created/deleted. Use cases not covered by modules can fallback to using shell commands

Terraform is also mostly declarative.

You write the state you would like resources to be in. When you run terraform plan, it tells you how the state might end up. You run terraform apply and then get to find out what actually happens.

Will it create the resources how I expect? What will the resource's properties be? Will it fail half way into the changes and stop in a broken state? Will it blow away changes without asking/showing me first? Will it refuse to do anything? Who knows.

It's a guessing game. The only way to be sure of what it will or won't do is to write procedural code and tests, so at least you know what decisions it will and won't make.

'Declarative' is just us fooling ourselves that we can make complexity easy to deal with.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#35

Post by 0xbadcafebee »

acd wrote: post #20

Terraform tracks and provisions cloud provider state. Ansible you need to pass and parse Ansible output around which can take considerable time. Terraform tells how your Infastructure should look like. Ansible what software should be on your infrastructure/servers. I tend to use Terraform to describe how the underlying Cloud infrastructure should look like. I use Ansible to describe and configure what software should…

Technically Terraform tracks and provisions its own state. The cloud provider's state at any given time may be different, and Terraform may find it impossible to resolve the difference, leaving you to manually fix it.

Ansible (mostly) does not refuse to do anything just because the state changed. If you need to make sure something happens, you can be more confident Ansible will do it, because it doesn't care what the state was before now.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#36

Post by [deleted] »

x0x0 wrote: post #30
jaejae wrote: post #16

There are five broad categories of IAC (Infrastructure as a Code) tools: a)Ad hoc scripts The most straightforward approach to automating anything is to write an ad hoc script. You take whatever task you were doing manually, break it down into discrete steps, use your favorite scripting language (e.g., Bash, Ruby, Python) to define each of those steps in code, and execute that script on your server b) Configuration m…

Thank you for this; it's the clearest explanation I've read.

[deleted]

Re: Ask HN: What is the real difference between Terraform and Ansible?

#37

Post by dynamite-ready »

user5994461 wrote: post #9

Ansible is really SSH on steroid across multiple hosts, with extra commands that bash never added. It can configure servers and services. It can also configure cloud products and it's a better choice than Terraform for many things because it's more flexible. Terraform can only provision cloud resources on AWS/GCP/Azure/other. Usually it gets support first for new products they release. Terraform is very static (see i…

This is not a bad high level description. I asked myself almost the exact same question as the OP a year ago, though I had prior experience with Ansible, so knew what I was getting into.

My advice to the OP, as it's all new to you, is to learn Ansible. It will require more work than Terraform, but Ansible can be made to perform the same functions as Terraform, and a heck of a lot more stuff that will prove useful to you, if you're looking into how to provision cloud instances.

That makes Ansible sound like it's hard work, but it's actually quite the opposite. It's surprisingly easy to do something useful with it.

Ansible is probably best described as a scripting environment / DSL combination to help you control multiple machines remotely for build and provisioning purposes.

You have 2 separate remote machines, and want to install Postgres on both of them? Use Ansible.

Want to install GIT and then pull your project repo onto two machines? Use Ansible.

Perhaps you have 3 machines, want git on all 3, but Postgres on only one of them? Ansible again.

Where there is an overlap with Terraform, is that Ansible can also be used as an interface to control AWS/Google cloud/Whatever services, which is Terraform's sole purpose. Terraform provides a cloud platform agnostic interface to allow you to spin up new cloud instances, and perform some provisioning tasks, but it will only skim the surface of what you can do with dedicated Ansible scripts.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#38

Post by zaphar »

user5994461 wrote: post #13
busser wrote: post #2

Ansible connects to remote servers to configure them, while Terraform calls cloud provider API’s to provision resources. For example, you can use Terraform to provision virtual machines, database instances, or Kubernetes clusters on AWS. Terraform does this via the AWS API. In my opinion, Terraform is better for provisioning because of the way it manages its own state. Terraform remembers what resources it created th…

Ansible has full integration with cloud providers API. It's actually better for managing instances and highly dynamic resources because it has much better state management than Terraform. If you (re)create some EC2 instances with Terraform. Terraform save the ID the first time they are created (in a state file that needs to be shared and keep in sync). It goes mental the next time it runs if any of the instances are…

Ansible doesn't handle the delete case. It has no way to "notice" that a resource is no longer in the playbook and therefore should be removed. This is why terraform keeps it's state file so it can do that sort of operation.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#39

Post by user5994461 »

lawik wrote: post #21
user5994461 wrote: post #13

Earlier quoted context omitted.

Ansible has full integration with cloud providers API. It's actually better for managing instances and highly dynamic resources because it has much better state management than Terraform. If you (re)create some EC2 instances with Terraform. Terraform save the ID the first time they are created (in a state file that needs to be shared and keep in sync). It goes mental the next time it runs if any of the instances are…

How does the coverage of APIs compare. Just AWS is a gigantic set of APIs. I see most of what I'd need in the Ansible Module Index but it doesn't seem like it covers all that is available.

Ansible has everything that's needed to automate instances, security groups, ELB, S3, RDS and few more things. I automated all the infra for a startup mainly with ansible (tens of services and a hundred hosts).

Terraform has better support for some static things, mostly VPC, routing tables, gateways. I've had infra retrofitted in terraform but honestly it's more for the show and as a documentation. Low level needs only be setup once and it's always been done manually forever ago.

If you were working around 2014-2017, both tools and many AWS services were new. There were significant gaps in support as well as a few bugs. Had to run from the beta build regularly. It is much better nowadays.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#40

Post by scoot_718 »

bryogenic wrote: post #32
oneplane wrote: post #27

If you are new to both and to IaC and DevOps as a whole: Ansible is for 'inside' virtual machines or computers, Terraform is for 'outside' virtual machines or computers. Inside a machine you might have software, configuration, assets. Outside a machine you might network connections, firewalls, disks, dns etc. This isn't a comprehensive comparison, but when you start from nothing, it doesn't really help to do a syntax…

Ansible also does 'outside' virtual machines. See https://docs.ansible.com/ansible/2.3/list_of_cloud_modules.h...

My advice would be to avoid Ansible for that sort of thing like the plague. All the nice things like idempotency and having the same script for setting things up and tearing them down no longer function when using those modules.

Essentially you need to 1. do the checks to ensure your playbook won't just create a new set of VMs every time it's run if they already exist 2. maintain a teardown playbook alongside your setup one because Ansible is entirely procedural and the steps would be reversed in that case and 3. do queries first to determine what actually exists in the cloud and do lots of jinja manipulations to work on the right things. Did you know EC2 has default subnets and routing tables? Did you know that the Ansible module will error out if you try to delete those objects?

If only there was a thing like Terraform that could just rely on a single description of the setup you'd like. Seriously. There's an Ansible module that will run a Terraform .tf file, and there's a provider for terraform that will run Ansible on the servers it provisions.

Post reply on HN