Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What is the real difference between Terraform and Ansible?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 67 posts

Re: Ask HN: What is the real difference between Terraform and Ansible?

#41

Post by lukevp »

eusebius wrote: post #10
speedgoose wrote: post #3

You can use Ansible to provision servers, it works, but if you do that a lot it's better to use Terraform. With Ansible you are a bit at a lower level and you need to manage the state of your system yourself. It's fine for 4 permanent VMs but not for more complicated infrastructures.

I'm not very familiar with Ansible but consider it to be somewhat interchangeable with Puppet (which I use extensively at work). You can certainly use Puppet to manage thousands of hosts but it entirely depends on other practices and technologies (an external node classifier in Puppet's case) to keep things manageable. I assume the same is true for Ansible.

Ansible is agentless, so the management of endpoints is entirely based on your server doing the scripting. It can use a static inventory file (text) or a dynamic one which can be served from anywhere (eg, sql query). Whenever you write playbooks you target groups of hosts based on tagging that’s done through inventory.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#42

Post by PaywallBuster »

scoot_718 wrote: post #40
bryogenic wrote: post #32

Earlier quoted context omitted.

Ansible also does 'outside' virtual machines. See https://docs.ansible.com/ansible/2.3/list_of_cloud_modules.h...

My advice would be to avoid Ansible for that sort of thing like the plague. All the nice things like idempotency and having the same script for setting things up and tearing them down no longer function when using those modules. Essentially you need to 1. do the checks to ensure your playbook won't just create a new set of VMs every time it's run if they already exist 2. maintain a teardown playbook alongside your se…

I think you're exagerating.

I use Ansible to provision dev environments on each PR, it works fine, every time a deployment occurs Ansible will deploy if required, otherwise proceeded with the deployment.

Destroying the environment is done separate, triggered by a webhook once the PR is closed.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#43

Post by user5994461 »

zaphar wrote: post #38
user5994461 wrote: post #13

Earlier quoted context omitted.

Ansible has full integration with cloud providers API. It's actually better for managing instances and highly dynamic resources because it has much better state management than Terraform. If you (re)create some EC2 instances with Terraform. Terraform save the ID the first time they are created (in a state file that needs to be shared and keep in sync). It goes mental the next time it runs if any of the instances are…

Ansible doesn't handle the delete case. It has no way to "notice" that a resource is no longer in the playbook and therefore should be removed. This is why terraform keeps it's state file so it can do that sort of operation.

Ansible handles deletion just fine. Provisioning instances for example takes a number of instances, set to 0 to delete them. The more stable resources have a separate command to delete like ec2_vpc vs ec2_vpc_delete.

IMO The way terraform automatically/accidentally delete stuff is a major design flaw, not a feature to emulate. It's madness that it tries to auto nuke potentially a whole company just because it lost track of one resource identifier.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#44

Post by gazoakley »

akvadrako wrote: post #29
lawik wrote: post #21

Earlier quoted context omitted.

How does the coverage of APIs compare. Just AWS is a gigantic set of APIs. I see most of what I'd need in the Ansible Module Index but it doesn't seem like it covers all that is available.

Terraform has way more coverage. I used ansible for aws a couple years ago and needed to rewrite many of the modules myself. Tracking AWS apis is a fulltime job and ansible for clouds just isn’t popular enough.

Unfortunately this is true - the Terraform AWS provider has thousands of PRs closed (and hundreds still open) as proof. Nevertheless, things seem to get support quicker in Terraform than in CloudFormation.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#45

Post by gazoakley »

user5994461 wrote: post #43
zaphar wrote: post #38

Earlier quoted context omitted.

Ansible doesn't handle the delete case. It has no way to "notice" that a resource is no longer in the playbook and therefore should be removed. This is why terraform keeps it's state file so it can do that sort of operation.

Ansible handles deletion just fine. Provisioning instances for example takes a number of instances, set to 0 to delete them. The more stable resources have a separate command to delete like ec2_vpc vs ec2_vpc_delete. IMO The way terraform automatically/accidentally delete stuff is a major design flaw, not a feature to emulate. It's madness that it tries to auto nuke potentially a whole company just because it lost tr…

I'm not sure why you've had problems with Terraform trying to nuke things - I'd say the planning capability was one of its strong points. A quick glance at the plan will tell you what it needs to remove to put an environment in the expected state (and it's called out again in the destroy count summary at the end of then plan). Terraform doesn't "accidentally" delete things - it's doing it because you've told it they're not needed anymore.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#46

Post by digitalsushi »

Terraform is for building infrastructure, you know foundations, skyscrapers, streets. Build an empty restaurant with a giant yellow excavator (Terraform)

Ansible, Chef are for building configuration, you know menus, staff schedules, grocery lists. Ensure a restaurant is configured correctly to serve customers with its wait staff (Ansible)

You can use an excavator to configure the stuff inside the restaurant. People do it. It's just not generally the most efficient way to do it. And you could have the wait staff at a restaurant pouring concrete for their second place a town over. You could do that too, but a lot of people would use the excavator.

So what really makes these tools effective is when you start using them at scale. They start to become helpful once you realize how much you can do with how little, and they each have this same strength solving different levels, and their strengths become weaknesses at the other end.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#47

Post by specialist »

jake_morrison wrote: post #15

The fundamental model behind Terraform is declarative. You use the Terraform language to define resources for your target system, e.g. a load balancer in AWS. You then run Terraform and it checks the desired configuration vs the running configuration, and it shows the differences. If the new config is what you want, you apply the changes, and it updates the production system. Ansible is much more of an imperative sys…

Your description of Ansible makes me think of the Apache Ant build system. James Duncan Davidson's post mortem was illuminating. He never intended to create executable XML scripting.

Am noob. Have done a wee bit of CloudFormation, Docker, k8s. And once completed a Terraform howto. I've never touched Ansible, Chef, Puppet, etc.

I'd love a feature comparison matrix. Or maybe a decision flowchart on how to choose which tool for which job.

--

Update: This comparison was linked upthread. It's pretty good.

https://blog.gruntwork.io/why-we-use-terraform-and-not-chef-...

Re: Ask HN: What is the real difference between Terraform and Ansible?

#48

Post by user5994461 »

gazoakley wrote: post #45
user5994461 wrote: post #43

Earlier quoted context omitted.

Ansible handles deletion just fine. Provisioning instances for example takes a number of instances, set to 0 to delete them. The more stable resources have a separate command to delete like ec2_vpc vs ec2_vpc_delete. IMO The way terraform automatically/accidentally delete stuff is a major design flaw, not a feature to emulate. It's madness that it tries to auto nuke potentially a whole company just because it lost tr…

I'm not sure why you've had problems with Terraform trying to nuke things - I'd say the planning capability was one of its strong points. A quick glance at the plan will tell you what it needs to remove to put an environment in the expected state (and it's called out again in the destroy count summary at the end of then plan). Terraform doesn't "accidentally" delete things - it's doing it because you've told it they'…

>> Terraform doesn't "accidentally" delete things - it's doing it because you've told it they're not needed anymore.

That's putting it backward to say the least. One never tells terraform that something is not needed anymore. One declares what is needed and terraform will find a way to get there by altering/creating/deleting stuff.

There is a review phase of course and it's very important because it might do anything. Anybody who's had to use terraform can attest that it is scary to run. Any slight error in configuration or state can be tremendously destructive.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#49

Post by ForHackernews »

jaejae wrote: post #16

There are five broad categories of IAC (Infrastructure as a Code) tools: a)Ad hoc scripts The most straightforward approach to automating anything is to write an ad hoc script. You take whatever task you were doing manually, break it down into discrete steps, use your favorite scripting language (e.g., Bash, Ruby, Python) to define each of those steps in code, and execute that script on your server b) Configuration m…

This is a good overview, but notice how hazy these different categories are around the edges.

> not only create servers, but also databases, caches, load balancers, queues

These things are, I would say unquestionably "infrastructure".

> firewall settings, routing rules, Secure Sockets Layer (SSL) certificates

These things are more or less configuration, basically files that exist on the above.

And yet, as you say, it's common to manage them using provisioning tools like terraform.

Re: Ask HN: What is the real difference between Terraform and Ansible?

#50

Post by jake_morrison »

specialist wrote: post #47
jake_morrison wrote: post #15

The fundamental model behind Terraform is declarative. You use the Terraform language to define resources for your target system, e.g. a load balancer in AWS. You then run Terraform and it checks the desired configuration vs the running configuration, and it shows the differences. If the new config is what you want, you apply the changes, and it updates the production system. Ansible is much more of an imperative sys…

Your description of Ansible makes me think of the Apache Ant build system. James Duncan Davidson's post mortem was illuminating. He never intended to create executable XML scripting. Am noob. Have done a wee bit of CloudFormation, Docker, k8s. And once completed a Terraform howto. I've never touched Ansible, Chef, Puppet, etc. I'd love a feature comparison matrix. Or maybe a decision flowchart on how to choose which…

Big fan of terragrunt.
Post reply on HN