Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to keep your Terraform code DRY by using Terramate

blog.mineiros.io

Post reply on HN
Print view View original

11–17 of 17 posts

Re: How to keep your Terraform code DRY by using Terramate

#11

Post by cassianoleal »

davidjfelix wrote: post #8
LazyMans wrote: post #5

Earlier quoted context omitted.

How do you only deploy certain resources to certain environment this way? We don't always have matching dev/qa/prod environments.

branch or tag from main if they have different release cadences. control the creation or non-creation ENTIRELY thru env vars with either boolean or count. If you have some thing that doesn't exist in all envs it should be obvious and maybe painful. Having to define it in the vars file makes it clear what differences each env has at a glance.

> If you have some thing that doesn't exist in all envs it should be obvious and maybe painful.

Exactly this. In $previous_client we had `snowflake_*.tf` files. Anything that couldn't be specialised using Terraform variable files should go on those. One advantage was that we started finding things that should be commoditised to get rid of the snowflakes. Everything else was very obviously out of shape and seen as generally undesirable - although many times necessary.

> control the creation or non-creation ENTIRELY thru env vars with either boolean or count.

I would also highly discourage this. Counts for different scales across environments, sure. Counts or bools to decide whether or not to deploy something depending on the environment are discouraged and should become a snowflake.

Re: How to keep your Terraform code DRY by using Terramate

#12

Post by fumplethumb »

LazyMans wrote: post #5
davidjfelix wrote: post #2

I feel like teams should be using tfe workspaces and env vars to instantiate environments rather than having a folder per-environment. It's pretty easy to replicate this workflow and results in substantially less env drift and code duplication when we do it.

How do you only deploy certain resources to certain environment this way? We don't always have matching dev/qa/prod environments.

You can conditionally deploy resources by setting the count on most resources. So you can have an environment variable with something like has_cache. Then in your terraform use a ternary or something to set the count to 1 if has_cache is true and 0 if it’s false. I have done this without much fuss.

Re: How to keep your Terraform code DRY by using Terramate

#13

Post by raffraffraff »

dpifke wrote: post #7
raffraffraff wrote: post #6

I've been using Hiera (Puppet yaml data store) to source data for terraform. As a long time puppet user, when I started writing terraform code I really missed hiera. Turns out someone ported it to Go, and someone else turned that into a terraform provider. It's a game changer. No need for terragrunt or terramate. Hiera can return anything from a single value to a very complex data block that can be used to feed a mod…

Cursory Googling returns two Terraform hiera providers, borh last updated in 2020. Are you using either of these, or something else? https://github.com/ribbybibby/terraform-provider-hiera https://github.com/lyraproj/hiera_terraform

Over the weekend I plan to cut out the heart of my setup, make it generic enough to share on GitHub and do an extremely short video walkthrough of how I use it. (Except I know how my plans don't always get turned into actions)

Re: How to keep your Terraform code DRY by using Terramate

#14

Post by dolni »

tn890 wrote: post #4

I used to be obsessed with DRY. After having written tens of thousands of terraform lines in the last few years across a multitude of platforms and use cases, I say everything in moderation. Going DRY is a decision you pay for in complexity, it's the typical programming problem of genericity. Sometimes it absolutely makes sense and you're a mad man if you skip it, but in isolated cases making things DRY just for the…

I don't think it is a question of moderation. It's a question of "does this chunk of code make sense as an abstraction?"

If I change the common code, do I want all users of it to realize those changes implicitly?

Terraform provides good enough tools to allow for deviations (even significant ones) between dev, staging, and prod.

IMO one of the most valuable things Terraform can do for you is stand up _the exact same stuff_ in multiple environments. If you're applying different code, your confidence in that shrinks significantly.

Re: How to keep your Terraform code DRY by using Terramate

#15

Post by davidjfelix »

cassianoleal wrote: post #11
davidjfelix wrote: post #8

Earlier quoted context omitted.

branch or tag from main if they have different release cadences. control the creation or non-creation ENTIRELY thru env vars with either boolean or count. If you have some thing that doesn't exist in all envs it should be obvious and maybe painful. Having to define it in the vars file makes it clear what differences each env has at a glance.

> If you have some thing that doesn't exist in all envs it should be obvious and maybe painful. Exactly this. In $previous_client we had `snowflake_*.tf` files. Anything that couldn't be specialised using Terraform variable files should go on those. One advantage was that we started finding things that should be commoditised to get rid of the snowflakes. Everything else was very obviously out of shape and seen as gen…

I want to emphasize that I don't normally use counts, it's just one tool in the toolbox. Normally I try to isolate env specific apps to their own stack and I simply don't have a workspace for the env they're not deployed in. Assuming a traditional 3 tier env setup (which I don't do either -- I only have 2) it might look like:

Workspaces:

- PROD-us-east-1-All-the-VPC-stuff

  - NAT count = 3
- PROD-us-west-2-All-the-VPC-stuff

  - NAT count = 3
- PROD-us-east-1-Enterprise-Network-Tool

  - var instance count = 2
- PROD-us-west-2-Enterprise-Network-Tool

  - var instance count = 2
- STAGE-All-the-VPC-stuff (us-east-1)

  - NAT count = 3
- STAGE-Enterprise-Network-Tool (us-east-1)

  - var instance count = 1
- DEV-All-the-VPC-stuff (us-east-1)

  - NAT count = 0 (maybe since we don't have the network tool we're transit vpcing or something else in dev)
It's a little contrived but the idea is that normally workspaces align to these borders:

- Env

- Cloud region (not always -- and the cross region ones are usually called out)

- Loosely de-coupled app border

Workspaces provide really easy "manholes" for servicing your IaC quickly when there's a mistake. They don't encourage you to manually change resources, but rather work in a smaller area and reduce blast radius. The issue I see with a lot of teams is when they're not sure how to handle cross-stack references or what they should output. I think that's an area for training and leveling up in TF.

Re: How to keep your Terraform code DRY by using Terramate

#16

Post by cassianoleal »

davidjfelix wrote: post #15
cassianoleal wrote: post #11

Earlier quoted context omitted.

> If you have some thing that doesn't exist in all envs it should be obvious and maybe painful. Exactly this. In $previous_client we had `snowflake_*.tf` files. Anything that couldn't be specialised using Terraform variable files should go on those. One advantage was that we started finding things that should be commoditised to get rid of the snowflakes. Everything else was very obviously out of shape and seen as gen…

I want to emphasize that I don't normally use counts, it's just one tool in the toolbox. Normally I try to isolate env specific apps to their own stack and I simply don't have a workspace for the env they're not deployed in. Assuming a traditional 3 tier env setup (which I don't do either -- I only have 2) it might look like: Workspaces: - PROD-us-east-1-All-the-VPC-stuff - NAT count = 3 - PROD-us-west-2-All-the-VPC-…

Yep, mostly agree here.

> The issue I see with a lot of teams is when they're not sure how to handle cross-stack references or what they should output.

Very much agree. What I try to do as much as possible these days is to not cross-reference. I find terraform remote state resources a code smell. Data sources are a better way to go. No code coupling and no terraform versioning dependencies between stacks.

Re: How to keep your Terraform code DRY by using Terramate

#17

Post by davidjfelix »

cassianoleal wrote: post #16
davidjfelix wrote: post #15

Earlier quoted context omitted.

I want to emphasize that I don't normally use counts, it's just one tool in the toolbox. Normally I try to isolate env specific apps to their own stack and I simply don't have a workspace for the env they're not deployed in. Assuming a traditional 3 tier env setup (which I don't do either -- I only have 2) it might look like: Workspaces: - PROD-us-east-1-All-the-VPC-stuff - NAT count = 3 - PROD-us-west-2-All-the-VPC-…

Yep, mostly agree here. > The issue I see with a lot of teams is when they're not sure how to handle cross-stack references or what they should output. Very much agree. What I try to do as much as possible these days is to not cross-reference. I find terraform remote state resources a code smell. Data sources are a better way to go. No code coupling and no terraform versioning dependencies between stacks.

I usually do data sources to get access to the attribute I might need and output arns or unique ids (that will allow people to use the data source reliably) but not guess every output they might need.

I think outputs are fine and are only a smell if you have many "peer" stacks that rely on each-others outputs. For stacks that have dramatically different cadences (IE - your vpc stack vs app stack) I don't see any issue with outputting something like VPC arn. We use a naming scheme to locate "peer" references that might be smells and try to resolve them.

As part of our DR plan, we regularly run all tf stacks from nothing to ensure they stand up without issue and that the instructions for stack order are actionable. This helped us sort out early cyclic cross-references and develop a tree/DAG style multi-stack approach. When workspaces start to settle down, we typically adopt an init-style naming system for the workspace, eg: 000-prod-vpc or 010-dev-my-web-app which allows us to ensure that we recognize which workspaces occur before and after a workspace. These names are kinda hard to predict while you're writing them, so we defer that process until it's stable since changing names is more process than it's worth. Typically we advise: xyz numbers where z increments if it's a peer but after y, y increments when it depends on a parent, x increments when there are human involved tasks. Most of our workspaces are named with the prefixes 000, 010, 011 or 020 with very rare exceptions being 012 or 021, 030 etc. This helps us identify bottlenecks or late-recovery items in our stacks as well as dependent stacks.

We're talking about deprecating this naming system with the pulumi automation api to manage deploy order when we move to pulumi, but I think the way we have it forward loads a lot of operational helpers and I'm not sure if the team will push back on pulumi or not.

Post reply on HN