My problem with the current IAS systems is the state storage. It should not be needed! Instead, the IAS tool should introspect the systems it's managing and build the necessary state on the fly.
Rethinking Infrastructure as Code from Scratch
11–20 of 124 posts
Re: Rethinking Infrastructure as Code from Scratch
#12this is great, but I would argue the biggest issue with infrastructure as code is this:
the structure and syntax for AWS is entirely different from Azure is entirely different from GCP.
Instead of abstracting to CSS, I would argue modeling what Bytecode did in java for multi-operating system, we should do for infrastructure of code.
That way, you could easily replicate in different environments, free yourself from vendor lock, and have readability/re-usability all in one.
This is what I want from infrastructure as code and I have yet to see it.
Re: Rethinking Infrastructure as Code from Scratch
#13this is great, but I would argue the biggest issue with infrastructure as code is this: the structure and syntax for AWS is entirely different from Azure is entirely different from GCP. Instead of abstracting to CSS, I would argue modeling what Bytecode did in java for multi-operating system, we should do for infrastructure of code. That way, you could easily replicate in different environments, free yourself from ve…
You can do that through abstraction. You “include” your Terraform Azure Provider or Terraform AWS Provider. At the end of the day, your module needs to know what it’s interacting with but not the higher level of abstraction. We have done it at my work to make it cloud agnostic just in case we need to go to another CSP
Re: Rethinking Infrastructure as Code from Scratch
#14What the author appears to miss is that many existing IAC tools permit exactly this. CDK, CDKTF and Pulumi all use general purpose programming languages, so reusing parameter objects in the way that is described is trivial - indeed it is so close to second nature that I would not even think to write it down. Indeed, it's not uncommon to share functions that make such parameter objects via libraries in the package eco…
Adding a "real" programming language makes certain things easier, such as abstraction, but IMO they are too powerful for the task at hand. Do we really want an infrastructure description to be able to execute arbitrary code?
Well, it depends on the language. Some are quite good at restricting programs so that it is not possible to execute arbitrary code.
Take a look at https://propellor.branchable.com to see how Haskell might be used.
Idris might be a good candidate as well.
https://dhall-lang.org is quite interesting for these purposes as well (although it is not general purpose)
Re: Rethinking Infrastructure as Code from Scratch
#15My problem with the current IAS systems is the state storage. It should not be needed! Instead, the IAS tool should introspect the systems it's managing and build the necessary state on the fly.
This does not work.
Say I have resource A with property X=1 I define in IAC. Someone comes along and modifies X=2 outside of state. With your way, the IAC tool would see that change and think it was naturally part of the desired state, whereas stored state will catch the drift. And before anyone says “well dont modify outside of IAC” I say 1) that’s often impractical and 2) sometimes automation can modify resources outside of IAC beyond your control.
Also, dynamically creating state creates all sorts of concurrency issues, which is another nice thing about stored state, you can put a lock on it.
Re: Rethinking Infrastructure as Code from Scratch
#16this is great, but I would argue the biggest issue with infrastructure as code is this: the structure and syntax for AWS is entirely different from Azure is entirely different from GCP. Instead of abstracting to CSS, I would argue modeling what Bytecode did in java for multi-operating system, we should do for infrastructure of code. That way, you could easily replicate in different environments, free yourself from ve…
You can do that through abstraction. You “include” your Terraform Azure Provider or Terraform AWS Provider. At the end of the day, your module needs to know what it’s interacting with but not the higher level of abstraction. We have done it at my work to make it cloud agnostic just in case we need to go to another CSP
Meaning we made our own wrapper for the terraform azure provider. The higher level does not expose those technical details. It just says virtual machine.
Re: Rethinking Infrastructure as Code from Scratch
#17I use Azure.
When I need to provision anything I have a powershell script that interacts with Azure CLI.
My script sets up a new resource group for every service we create, logging, key vault, webapp/functions, and if needed some kind of data storage or queuing.
In my powershell script I can via a variable indicate which environment I want to spin up: dev, staging, prod.
I have one yaml file which is for my build and a build trigger which points to the above powershell script with the given environment.
All environments: dev, staging or prod are setup manually with manual user assignments for deployment access etc.
It's really lightweight but I also believe it's lightweight because we run a small services setup where each service takes care of its own provisioning.
Terraform and Yaml are so verbose but that's not the most problematic. You can't execute those files from your local machine.
Re: Rethinking Infrastructure as Code from Scratch
#18I don't think the author has tried Pulumi, which can do exactly this kind of thing.
Re: Rethinking Infrastructure as Code from Scratch
#19I use Azure. When I need to provision anything I have a powershell script that interacts with Azure CLI. My script sets up a new resource group for every service we create, logging, key vault, webapp/functions, and if needed some kind of data storage or queuing. In my powershell script I can via a variable indicate which environment I want to spin up: dev, staging, prod. I have one yaml file which is for my build and…
Why not Bicep?
https://learn.microsoft.com/en-us/azure/azure-resource-manag...
I have found it quite joyful to use with Azure.
Re: Rethinking Infrastructure as Code from Scratch
#20I use Azure. When I need to provision anything I have a powershell script that interacts with Azure CLI. My script sets up a new resource group for every service we create, logging, key vault, webapp/functions, and if needed some kind of data storage or queuing. In my powershell script I can via a variable indicate which environment I want to spin up: dev, staging, prod. I have one yaml file which is for my build and…
> You can't execute those files from your local machine.
You can execute terraform from local machine just as easily as a powershell script. I dare say you could even make it work a shebang if you wanted (though I’ve never tried that).