Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Digger – Open Source Terraform automation and collaboration tool

github.com

Post reply on HN
Print view View original

21–24 of 24 posts

Re: Show HN: Digger – Open Source Terraform automation and collaboration tool

#21

Post by oneplane »

izalutski wrote: post #20
oneplane wrote: post #15

I'm surprised nobody has mentioned Atlantis yet. Running bare terraform in CI is a bad idea (to the extent that running an 'expect' script for an interactive tool is a bad idea), and when you consider the impact it can have (both on resources and on escalation) it should be out-of-band anyway.

Atlantis was a great tool back in the day and still works well in most scenarios. The main issue with it is that it also takes on running the jobs (as in Terraform binary runs on the same VM it runs). Which makes it similar to Jenkins and other first-generation CI systems. Companies that use Atlantis at scale (eg Lyft) felt the need to fork it and use a scalable compute backend instead, eg Temporal. At which point yo…

I think in my case (and almost everyone else's case) we'll never go Lyft-scale, but with about 100 AWS accounts (and a bunch of Cloudflare, On-Prem [Compute, Networking], GitHub and other providers) and 300 terraform environments we haven't had the problem you described yet.

To us, CI is about integration while Terraform is about reconciliation. Technically both could be categorised as 'jobs', but by that metric, a CD event is also just a job, and so is a migration for an RDBMS and adding and removing products from inventory. But we don't call them jobs, because their specialisation warrants specialised handling. To be fair, we aren't based in the US so perhaps it's more of a localised thing.

Re: Show HN: Digger – Open Source Terraform automation and collaboration tool

#22

Post by oneplane »

thinkmassive wrote: post #3

One of the major security issues with running terraform in your CI/CD pipeline is that it usually needs admin permissions to your entire cloud environment. To avoid this you need the pipeline to pass parameters to an internal process that actually applies the changes. Digger makes it sound like it might address this: > Digger runs terraform natively in your CI. This is: Secure, because cloud access secrets aren't sha…

The only IAM-safe way is to run context-aware terraform plans so the environments cannot ever CRUD out of scope. For example, an application-centric approach might use an ABAC constraint and temporary credentials (perhaps via OIDC, but most OIDC integrations lack local privilege separation; instance roles are far more secure) and making sure events are bound to the environment they are allowed to be executed in.

This does require something that should essentially be embedded in your environment or account vending machine, otherwise it becomes very cumbersome to maintain.

Re: Show HN: Digger – Open Source Terraform automation and collaboration tool

#24

Post by iKlsR »

_0xdd wrote: post #23

I saw Digger and got excited for a second... https://en.wikipedia.org/wiki/Digger_(video_game)

I don't know how but in the seconds it took me to read the title and click the link my brain went down this crazy hole of a 3d tool that could take some point cloud data or image scans and allow you to "dig" thru virtual earth and shape the land or something.. oh boy.
Post reply on HN