Live data from Hacker News

Rethinking Infrastructure as Code from Scratch

nathanpeck.com

121–124 of 124 posts

Re: Rethinking Infrastructure as Code from Scratch

#121
post #96

The split between parameterized classes and logic sounds a bit like the split between Puppet and Hiera. The idea was probably a good one, but something about the implementation made people go overboard with it. I feel IaC really peaked around Puppet 3 and Chef 1. IaC should be simple enough that people use it, and trivial to write providers for. People tend to glue much too large libraries to their IaC platforms and…

Chef and Puppet are configuration management systems, not really Infrastructure as Code.

IaC is a silly term. Infra is mostly hardware, which by definition is something else than software.

But hardware needs to be configured. And load balancers, firewalls, clusters etc. are perfectly suited for the declarative style of the Ansible/Puppet/Chef type of tools. That is what people usually mean by "IaC", as silly as it may be.

Those tools really shine when used end-to-end. The defintion of an application can contain which ports need to be open towards backends, database users, and health check parameters for the load balancer. The system can then declaratively sort out the respective templates, and configuration really lives in one place. Shared secrets are defined exactly once, and rotation is deterministic across the entire environment.

Re: Rethinking Infrastructure as Code from Scratch

#122

Earlier quoted context omitted.

> With great power comes great responsibility. And in an environment where staff are a cost optimization and not everyone is a 10x coder or engineer, there will be individuals in power who are not as responsible as you would like. So it's better to have a system where you limit one individual's ability to cause harm rather than amplify it.

Automated validation has always seemed to catch that sort of risk just fine.

In an environment where staff are a cost optimization, tech debt and things like CI/CD are luxuries. Much of it will be half baked or poorly implemented. Automation of unit tests and validation are going to be afterthoughts at best.

Re: Rethinking Infrastructure as Code from Scratch

#123
post #107

Earlier quoted context omitted.

With Terraform you can statically analyze the infrastructure definition with some guarantees of determinism etc. Arbitrary execution is allowed, as you say, but only in well-contained places, such as local_exec. How can this work if, say, TypeScript is used as the definition language?

What degree of determinism do you actually have if provisioners can execute Turing complete code?

It's a bit like how Rust limits dangerous operations to unsafe blocks
Post reply on HN