31–35 of 35 posts
What do people use Ansible for that can't be done with Terraform and vice-versa?
It's so sad that these are the tools we have to work with. They are both so shitty, in such subtle ways, to the point that I tear my hair out once a week because of them. And the corporate IT world will never invest in development of truly free replacements just to make other people's lives easier. It's truly depressing.
Earlier quoted context omitted.
It's so sad that these are the tools we have to work with. They are both so shitty, in such subtle ways, to the point that I tear my hair out once a week because of them. And the corporate IT world will never invest in development of truly free replacements just to make other people's lives easier. It's truly depressing.
I am curious about your use case for these tools. What do you find them being so shitty at?
They are shitty at what they are designed to do. Like, Terraform is supposed to make it "safer" to make changes, right? Except tools like Terraform are not actually designed for safety. They are designed to "make changes", and then they have one or two random features added, and somebody goes "welp must be safe" and goes on with life. Later you find out, oh, this thing isn't safe at all. Like, it has no actual safety features. It just has a DAG that you can preview. That's not a safety feature.
A safety feature would be the ability to control, for example, if you always want to create some infrastructure, including blowing away anything stupid enough to have the same name as the thing you wanted to create. If you don't have that feature, you can not guarantee that your infrastructure will always apply. Often, very often, including as I write these words right now, Terraform refuses to do the one thing I want it to do: apply my changes. If it can't guarantee that it will make a best effort attempt to apply my change, I can't trust it.
Then there's just, like, useful features. Like automatically generating Terraform based on some existing infrastructure. Since version 0.0.1, people have been asking for this. Eventually Waze actually created their own project just to do this. And you know what? This feature is fucking amazing. Rather than spending hours looking up docs, crafting configs by hand, and trying to apply your Terraform in a test environment, so that you can finally have some IaC... with Terraformer, you just click some stuff in the AWS Console, and then dump it out as Terraform. It saves hours, days, even weeks, off of creating these stupid configs. But the geniuses at Hashicorp decided they just didn't like the concept of this, or that it might require some work to create, and abandoned the idea.
Then there's 1990s-level technology, like locks. Locks. It can't figure out fucking locking. Even by the late 90s, our shitty init scripts that created lock files figured out how to tell if a lock was stale and overwrite it (or prompt you to overwrite it). And modern systems have been doing all kinds of complicated distributed locking for a decade-plus. Terraform has not figured that out yet. So if you happen to work with multiple people using remote state, and there's a state that's been locked for 12 hours? Terraform has no clue what to do. And of course, the person who accidentally locked the state 12 hours ago is nowhere to be found, so after you ping a bunch of people and back up the old state by hand, you force-unlock it and pray.
Then there's just... running it. It's hard to use. Every single person who has ever used Terraform at a company has written their own wrapper just to run Terraform. Terragrunt is the most well known wrapper, and that god-awful mess just makes it more complicated without making it significantly better than a shell script.
Then there's the state file. It's practically pointless. Oh, great, it can point out when the state changed. But it can't reason about what version of the state matches what version of the code. And if something in AWS changes that Terraform didn't do? Or that Terraform did, but didn't get committed to state? Good luck to ya. You are left to clean that shit up on your own. No attempt to automatically import the existing infra, you gotta do that by hand. No ability to overwrite the existing infra, you gotta delete it by hand.
....... Oh , what's that? It's your production environment, and now it's down, and there's absolutely no way for you to fix it? So your site is now down until you can manually fix all the bullshit that Terraform needs to run correctly again? Well apparently you should have expected that!
What a fantastic tool. You only have to use it for years and run into enough brick walls to learn the "right way" to use it to minimize (but never eliminate) all these problems.
I'll start keeping a legit log of every problem I run into and publish it online. I rant into Slack like every week with another random TF problem. People need to understand that this tool is a lemon.*
The most interesting concept is "Build & Deploy" and it's a pity that it isn't described even on conceptual level. I think the "Build & Deploy" for configuration management is the right thing, but it looks like Ansible is not very good tool to implement it (and honestly, I don't know any mainstream tool that is really good at it). I was trying to implement it as follows: - part of a role is executed locally, building…
Build - running locally. After building we have an artifact that can be uploaded to S3/Azure Storage/DO Spaces.
Deploy - running remotely on the target server(s). It downloads artifacts from storage and deploys them to the server.
Looks like someone messed up that demo instance to be able to run ... bitcoin?
What does modern mean in this context?
Reading through their website ( https://ansible-semaphore.com/ ), it seems like it comes down to responsive UI with material design, and being written in Go. It's not clear what this offers over Ansible AWX ( https://github.com/ansible/awx ), which is the traditional Ansible UI.