Live data from Hacker News

“Who Should Write the Terraform?”

zwischenzugs.com

81–90 of 137 posts

Re: “Who Should Write the Terraform?”

#81
Developers should be able to do the work.

"we aren't living in 2016 anymore, and the cloud moves fast. Platform teams are expensive and hard to do, offer a mediocre service at best, destroy velocity, and create bad incentives." [1]

[1]https://twitter.com/iamvlaaaaaaad/status/1534489514818686976...

Re: “Who Should Write the Terraform?”

#82
The answer to "Who Should?" anything in my organization is "me". I go from writing ruby, to terraform, to javascript, html, css, to bash scripts, SQL, etc. Oh, and I have to manage people, and do code reviews, and support, and meet with clients...

Help... me...

Anyway, I've got the members of my dev team writing terraform for their changes now too. It's working, more or less. They are excited to do it because it pads their resumes, because it's new. But we continue to increase demands on devs, they need to get paid for their trouble or the responsibilities must be diffused.

Re: “Who Should Write the Terraform?”

#83
post #34

Software Engineer at Spacelift[0] here - a CI/CD specialized for Infra as Code (including Terraform). A pattern we're seeing increasingly commonly are Platform Engineering teams doing the bulk of the work, including all the fundamentals, guidelines, safety railing, and conventions, while Software Engineers only use those, or write their own simple service-specific Terraform Stacks which however extensively use module…

Having a single "platform" team per company is a bottleneck as soon as the number of product teams is greater than N. > ...you'll probably start having as many approaches to your infrastructure as there are teams, complexity will explode, and implementation/verification of compliance requirements will be a chore. Just a few people responsible for handling this will yield huge benefits. Agree with the centralization o…

It also creates the unrealistic expectation that one size fits all. An architecture that works well for stateless microservices fails spectacularly when faced with monolithic session-bound legacy telecoms services.

Yet so many people insist that the one is the same as the other, when one is a duck and the other is an elephant wearing two swimming fins on its face.

Re: “Who Should Write the Terraform?”

#84

The author calls out a few reasons why DevOps fails for organizations all of which I agree with - however the one that I've never completely understood: Regulatory reasons for keeping Ops centralized. I work in healthcare which I guess should fall under this rule - but in practice I haven't really seen that impeding DevOps. Teams that have the capabilities to build the full stack get handed a subscription to a cloud…

Author here. That's interesting, as I've not worked with healthcare too much. Others here have cited segregation of duties, which is definitely a factor, but the other one less mentioned in finance is the 'one throat to choke' principle: it's simpler from a management and regulatory perspective to have the responsibility for failures in one place rather than across many teams.

Ah - that makes sense. This might be a bit easier in healthcare as I believe it's pretty common to have many different ops teams each responsible for different parts of the business.

I feel like most of the time "compliance" is blamed when really, it's your first point in that section (Absent an existential threat, the necessary organizational changes were more difficult to make) that is the real holdup.

Re: “Who Should Write the Terraform?”

#85

Earlier quoted context omitted.

Partly yes, but not fully. The idea is not to go back to the Software Engineer asking the Ops team "Hey, can you provision a Postgres database for me please?" and then waiting a week for it. It's that the Software Engineer takes a module that was prepared by the Platform team - i.e. "terraform-postgres-mycompany" - which already includes all the requirements the company has for handling databases (think backups, moni…

Sure, but early in this transition it is slow&painful. At my last org.. The old process of "Hey, can you provision a Postgres database for me please?" was managed in a web ticketing system, change managed, and had 24 hours turnaround! As was most other requests - VMs, NFS shares, FTP servers, network/FW changes, etc. The new process was "Hey is there a terraform module for Postgres?" followed by weeks/months of prior…

As an Ops, this sounds like a very overworked ops team. I can write a production worthy postgres module in less than a day, maybe a few hours. Or... just a subpar team, as much as I hate to say that.

Re: “Who Should Write the Terraform?”

#86
post #85

Earlier quoted context omitted.

Sure, but early in this transition it is slow&painful. At my last org.. The old process of "Hey, can you provision a Postgres database for me please?" was managed in a web ticketing system, change managed, and had 24 hours turnaround! As was most other requests - VMs, NFS shares, FTP servers, network/FW changes, etc. The new process was "Hey is there a terraform module for Postgres?" followed by weeks/months of prior…

As an Ops, this sounds like a very overworked ops team. I can write a production worthy postgres module in less than a day, maybe a few hours. Or... just a subpar team, as much as I hate to say that.

Mostly overworked but also not a team of veterans who knew what they were doing already. Platform Ops:Product App Devs ratio was like 1:30, and they had very little implemented yet so just completely overscheduled and understaffed.

Re: “Who Should Write the Terraform?”

#87
post #5

> But despite a lot of effort, the vast majority of organisations couldn’t make this ideal work in practice, even if they tried. This matches my on-the-ground experience. The teams who lived the dream of DevOps were teams which built their software as cloud native (instead of later trying to migrate to the cloud). This is purely because the PaaS tooling let them efficiently be both Devs and Admins. When you involve m…

Indeed. I think the other big elephant in the room not mentioned in the article is architecture. If you've built your project as cloud-native from day one, you'll have a lot less DevOps work to do. You're basically just writing code or templates that apply cloud-based configuration. That's not to say there's no complexity, but it's not unreasonable. If your org has already gone all-in on microservices and Kubernetes,…

If the team building the application is designing the infrastructure, then that's almost the DevOps ideal that orgs dream about. It's really the stuff that happens once you've been launched for a few months that things start to drift. It might start with a redirect rule that isn't in code, an ask to do cost optimization, a security audit. Maybe one dev raises their hand and a few months later they're the DevOps lead with a DevOps team who become the dumping ground for all the non-coding task, on-call, budgeting. Even if your platform is all PaaS and SaaS and serverless, stuff will still break and someone needs to answer the pages.

Re: “Who Should Write the Terraform?”

#88
post #85

Earlier quoted context omitted.

As an Ops, this sounds like a very overworked ops team. I can write a production worthy postgres module in less than a day, maybe a few hours. Or... just a subpar team, as much as I hate to say that.

Mostly overworked but also not a team of veterans who knew what they were doing already. Platform Ops:Product App Devs ratio was like 1:30, and they had very little implemented yet so just completely overscheduled and understaffed.

I've been ops for about 15 years and understaffing us is such a huge problem. I just joined a company with 2 other Ops for 80 developers over 8-10 teams, my previous had 7 for 70 and was one of the few places I felt like I could take a breath and relax, easily take days off, etc. I felt more like a SWE than ops with regard to work-life balance/on-call rotations/ability to do creative & research work, etc.

I'm glad those 2 ops at my current spot finally have help but they were alone for years while the company was generating a ton of revenue which bothers me but seemingly was their own decision; nobody told them they were overworked until us more SR ops people arrived and went out of our way to pull work away from them.

Having all sorts of different teams (style, culture, language) relying on you to not gate-keep is.. stressful at times. I try to context switch as little as possible but sometimes it just can't be avoided.

Re: “Who Should Write the Terraform?”

#89

Earlier quoted context omitted.

But, as the article points out, centralized ops teams many times do not have the capacity to handle all the requests coming from the dev teams.

So fix that by hiring more ops folks...? Ops should scale with the dev teams, if they aren't you're burning them out and will have even more problems.

Scaling ops teams is a lot like scaling dev teams - stick with the two pizza plan. That's where you get start finding the need for enablement teams (cross cutting) to ensure compliance, standardization, etc.

Re: “Who Should Write the Terraform?”

#90

The author calls out a few reasons why DevOps fails for organizations all of which I agree with - however the one that I've never completely understood: Regulatory reasons for keeping Ops centralized. I work in healthcare which I guess should fall under this rule - but in practice I haven't really seen that impeding DevOps. Teams that have the capabilities to build the full stack get handed a subscription to a cloud…

PCI doesn't _stop_ us from distributing these duties, but it sure does make it harder. Having change management processes in place puts in place all sorts of additional controls. Sharing code with this system and the main system creates either friction, or a lack of DRY code.
Post reply on HN