Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Terraforming 1Password

blog.agilebits.com

Post reply on HN
Print view View original

21–30 of 119 posts

Re: Terraforming 1Password

#21

Post by roustem »

geerlingguy wrote: post #7

The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous. CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format). I’ve spent a lot of time working between the two, and while Terr…

I am sorry but I just could not grasp YAML for some reason. I am always confused by its indentation and maps vs lists notation.

Re: Terraforming 1Password

#22

Post by roustem »

moltar wrote: post #4
chatmasta wrote: post #2

I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog. Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.

I imagine the examples are probably fictional. The only thing you know is that they are using AWS.

No, these are real code snippets. I only masked the account identifiers.

Re: Terraforming 1Password

#23

Post by kuschku »

merb wrote: post #10

would've been easier to just migrate to k8s and used some kind of ignition/managed k8s (and maybe ansible, if things still needs some manual tweaking).

Let's make one thing very clear here - k8s is never easy. I've been running a cluster since it became usable, and it definitely is the opposite of easy.

Kubernetes is powerful, it is modular, and it makes everything a lot more efficient, but setting it up - especially in such large deployments as 1Password would have here - is never easy.

Re: Terraforming 1Password

#24

Post by roustem »

chatmasta wrote: post #2

I’ve always wondered — from a security perspective, is this kind of an in-depth engineering blogpost a good idea? You’re basically handing a map of your internal infrastructure to any potential attacker who reads the blog. Of course obscurity is not security blah blah blah. Still I can’t help feeling that writeups like this could backfire down the line.

If our security depended on this information being private then we would be in big trouble.

I would love to go into more details about the environment and some of the things we did to build on top of the default AWS security settings. It was too much information for this post, maybe we will do another one that focuses on security.

Re: Terraforming 1Password

#25

Post by casey_lang »

rgoodwintx wrote: post #17

Side note, for anyone wondering like I was, the visualization tool is Cloudcraft: https://cloudcraft.co/ . I'd love to have something similar for doing isometric views of any kind of diagramming.

Every time I see Cloudcraft, I wish it was available for GCP. I think it's a fantastic way to visualize interconnected systems

Re: Terraforming 1Password

#26

Post by roustem »

curun1r wrote: post #16

Their AWS bill seems like it would be a lot higher than it needs to be. They're spinning up always-on staging, testing and development environments in 3 different regions. I know they've got autoscaling configured, so their production environment should be significantly larger than the others, but it still should be possible to be much more economical while accomplishing all of those non-production workloads. The who…

You are right. Our AWS bill could certainly be lower and we will have to start optimizing it at some point.

It is does require extra time/effort though. We deployed 1password.ca and 1password.eu just a few months ago and never really got to that.

The only thing we "optimize" at the moment is the smaller number and size of EC2 instances in non-production environments.

Re: Terraforming 1Password

#27

Post by user5994461 »

casey_lang wrote: post #25
rgoodwintx wrote: post #17

Side note, for anyone wondering like I was, the visualization tool is Cloudcraft: https://cloudcraft.co/ . I'd love to have something similar for doing isometric views of any kind of diagramming.

Every time I see Cloudcraft, I wish it was available for GCP. I think it's a fantastic way to visualize interconnected systems

Ah. I wondered what made these terrible diagrams. They look cute but the text and the symbols are incomprehensible.

Re: Terraforming 1Password

#28

Post by roustem »

mterwill wrote: post #14

Interesting blog post, but AgileBits should have communicated planned downtime to their customers via email, which they did not. I’ve been a 1Password user for years and recently switched to their hosted offering. I know a massive infrastructure migration is rare, but that’s all the more reason to be transparent ahead of time.

I am sorry if the downtime affected you in any way.

Sending several million emails could be a challenge considering that most of our customers depend on 1Password apps and usually not affected by the downtime.

We do have a status page and Twitter feed where we make announcements:

https://status.1password.com

https://twitter.com/1passwordstatus

Re: Terraforming 1Password

#29

Post by roustem »

merb wrote: post #10

would've been easier to just migrate to k8s and used some kind of ignition/managed k8s (and maybe ansible, if things still needs some manual tweaking).

I would love to migrate to k8s at some point. It would make some things easier. We still need to figure out how to do that without downgrading our existing security configuration -- a lot of it depends on running different services in their own subnets and AWS security roles.

It might be easier now that AWS is starting to support Kubernetes.

Re: Terraforming 1Password

#30

Post by roustem »

geerlingguy wrote: post #7

The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous. CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format). I’ve spent a lot of time working between the two, and while Terr…

I believe there was a case last year when one of the new AWS features was available in Terraform before it made it to CloudFormation :)
Post reply on HN