Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Terraform Gotchas and How We Work Around Them

heap.engineering

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Terraform Gotchas and How We Work Around Them

#21

Post by nodesocket »

kalmar wrote: post #20
luhn wrote: post #16

> Always write your plan -out, and apply that plan I have in my dotfiles: alias tfplan='terraform plan -out=.tfplan -refresh=false' alias tffreshplan='terraform plan -out=.tfplan' alias tfapply='terraform apply .tfplan; rm .tfplan' That way I never accidentally `terraform apply` without creating a plan first. I also have it not refresh the state by default, which is mostly unnecessary and speeds up the planning signi…

Oh interesting. Note to self: see if there's an option to disable `terraform apply` without a plan. I always refresh when running the pre-apply plan, but while iterating I use that. Do you always run your `tffreshplan` command before applying?

Agree would be nice to add a new option which prevents invoking `apply` without a supplied plan argument. Create an issue in the GitHub, I'll upvote.

Re: Terraform Gotchas and How We Work Around Them

#23

Post by kalmar »

nodesocket wrote: post #21
kalmar wrote: post #20

Earlier quoted context omitted.

Oh interesting. Note to self: see if there's an option to disable `terraform apply` without a plan. I always refresh when running the pre-apply plan, but while iterating I use that. Do you always run your `tffreshplan` command before applying?

Agree would be nice to add a new option which prevents invoking `apply` without a supplied plan argument. Create an issue in the GitHub, I'll upvote.

Here's an issue: https://github.com/hashicorp/terraform/issues/15263

Re: Terraform Gotchas and How We Work Around Them

#26

Post by OhSoHumble »

nodesocket wrote: post #18
kalmar wrote: post #2

Hey author here! Happy to answer any questions etc :-)

Great post. I think the area where things start to go off the rails with Terraform is variables/modules though. There are edge cases and gotchas with modules and not a lot of best practice guides. Shameless plug, if anybody is looking for a guide on getting started with Terraform and Google Cloud Platform, I wrote a short blog post: https://blog.elasticbyte.net/getting-started-with-terraform-...

Shameless plug, if anybody wants to generate a Terraform module with a testing harness preconfigured then I hacked up a module scaffolder last night/this morning: https://github.com/howdoicomputer/terrashovel

Re: Terraform Gotchas and How We Work Around Them

#27

Post by stuff4ben »

kalmar wrote: post #2

Hey author here! Happy to answer any questions etc :-)

We're using Terraform for our AWS env and while it worked great for getting stuff out there, we're now scrambling to figure out how to get Terraform to do non-destructive updates to the environment. For instance, I need to update our base OS for the application servers we're running. How do I do this without incurring a downtime? Or I need to now interject a new reverse proxy between our ELB's and app servers, but want to do it without causing an interruption. We're doing our research and this blog post is very helpful, but if you have any pointers...

Re: Terraform Gotchas and How We Work Around Them

#28

Post by sethvargo »

luhn wrote: post #16

> Always write your plan -out, and apply that plan I have in my dotfiles: alias tfplan='terraform plan -out=.tfplan -refresh=false' alias tffreshplan='terraform plan -out=.tfplan' alias tfapply='terraform apply .tfplan; rm .tfplan' That way I never accidentally `terraform apply` without creating a plan first. I also have it not refresh the state by default, which is mostly unnecessary and speeds up the planning signi…

Hey all - Seth here from HashiCorp (the company that makes Terraform). The next version of Terraform (0.10) natively adopts very similar behavior, presenting a plan before applying as an added safety step. You can read more in the 0.10 upgrade guide. At the time of this writing, 0.10 is not yet released, but compiling Terraform from source at master will inherit this behavior.

https://github.com/hashicorp/terraform/blob/master/website/s...

Re: Terraform Gotchas and How We Work Around Them

#29

Post by Thaxll »

stuff4ben wrote: post #27
kalmar wrote: post #2

Hey author here! Happy to answer any questions etc :-)

We're using Terraform for our AWS env and while it worked great for getting stuff out there, we're now scrambling to figure out how to get Terraform to do non-destructive updates to the environment. For instance, I need to update our base OS for the application servers we're running. How do I do this without incurring a downtime? Or I need to now interject a new reverse proxy between our ELB's and app servers, but wa…

You should use 2 ASG ( blue / green ) and 1 ELB for that, then when you need to update the OS of one of the ASG you just update the launch configuration. It's easy to do in Terraform.

1) Update the launch configuration of your un-used ASG ( with the new AMI ID )

2) Apply terraform to deploy the new ASG

3) Make sure it's working ( your local app on your new instances )

4) Connect the ELB to your new ASG

5) Set the old ASG to 0 instances to drain the connections

Re: Terraform Gotchas and How We Work Around Them

#30

Post by hnov »

stuff4ben wrote: post #27
kalmar wrote: post #2

Hey author here! Happy to answer any questions etc :-)

We're using Terraform for our AWS env and while it worked great for getting stuff out there, we're now scrambling to figure out how to get Terraform to do non-destructive updates to the environment. For instance, I need to update our base OS for the application servers we're running. How do I do this without incurring a downtime? Or I need to now interject a new reverse proxy between our ELB's and app servers, but wa…

You pretty much have to take the same approach as you would outside of terraform: create the new thing (launch configuration, standalone instance) and attach it to the ELB before spinning down the old one. Terraform does have some rudimentary aid to that end in the form of the create_before_destroy[0] flag, though it doesn't work out with uniquely named things.

[0] https://www.terraform.io/docs/configuration/resources.html#c...

Post reply on HN