Two of my least favorite technology. I have been using pass for a while and will never go back
Terraforming 1Password
51–60 of 119 posts
Re: Terraforming 1Password
#52Here I am wishing that CloudFormation had one killer feature that would have allowed us to use it at work: the ability to adopt existing resources into a CF stack. When we were starting on the path of "hey maybe all our infra shouldn't be pointy clicky", we chose between CloudFormation, Terraform, and making something in-house. Out of those three, Terraform was the clear winner for us at the time, but it has not been…
You can move state around with `terraform state mv`. It's a bit tricky and has some gotchas but works (which applies to terraform as a whole really)
Re: Terraforming 1Password
#53Here I am wishing that CloudFormation had one killer feature that would have allowed us to use it at work: the ability to adopt existing resources into a CF stack. When we were starting on the path of "hey maybe all our infra shouldn't be pointy clicky", we chose between CloudFormation, Terraform, and making something in-house. Out of those three, Terraform was the clear winner for us at the time, but it has not been…
Terraform allows you to make modifications to the state file yourself, both with terraform commands like terraform state mv, or manually if you're brave enough to edit the JSON. It requires confidence in using the tool, of course. But it also encourages you to create your cloud resources in a way where it's safe to let Terraform destroy and re-create most of it at any time.
Re: Terraforming 1Password
#54Here I am wishing that CloudFormation had one killer feature that would have allowed us to use it at work: the ability to adopt existing resources into a CF stack. When we were starting on the path of "hey maybe all our infra shouldn't be pointy clicky", we chose between CloudFormation, Terraform, and making something in-house. Out of those three, Terraform was the clear winner for us at the time, but it has not been…
I'm not so sure about this. My experience has been limited, but so far, Terraform has been a treat to work with. I didn't think Terraform cared about where the resources were defined in a the plan step. I'd love for someone with further experience to weigh in here.
Also, Terraform state on the file system? Do you have the luxury of solo development without the need for a Terraform remote backend?
Re: Terraforming 1Password
#55Wait. People are discussing and giving accolades how marvelous it is that a company is migrating infrastructure to a favor of the month because it is using a flavor of some other month tools when the company has the audacity to say they would be down for hours ? Are you kidding?
I don't think there is any shortage of literature on the need to avoid vendor lock-in. Selecting a cloud agnostic tool like those developed by Hashicorp and the opensource community offers the folks at 1Password additional flexibility in their choice of cloud providers. AWS is great, but still... I don't see any mention of Terraform Enterprise here, either. I imagine they're perfectly capable of pursuing Terraform wi…
It is possible I was not clear:
The blog post is patting itself on a back for migration that caused downtime.
It included this gem:
> Couldn’t you’ve imported all online resources? Just > wondering.
> That is certainly possible, and it would have allowed us
> to avoid downtime. Unfortunately, it also
> requires manual mapping of all existing resources.
> Because of that, it’s hard to test, and the chance of a
> human error is high – and we know humans are pretty bad
> at this. As a wise person on Twitter said: “If you can’t
> rebuild it, you can’t rebuild it“.
Re: Terraforming 1Password
#56Earlier quoted context omitted.
This is a really important point. Our company is using Terraform in a limited way, but Puppet is our primary automated configuration management tool. Similarly in Puppet, `ensure => latest,` on package resources isn't necessarily dangerous, but it can add a lot of confusion without intentional commits against the control repositories.
Puppet rules are typically applied constantly in short intervals. The installed version should always be the same everywhere, the latest available from the repository. The risk is more that you can get updates installed at inopportune times. Of course what's right is that the version change is not reflected in the configuration management, but this isn't normally a problem for minor version changes.
I think the default settings for puppet agents are typically 30 minutes if I'm not mistaken. I've inherited a bit of a DevOps mess with some 600-700 nodes in various states of management.
In previous positions, there was a great hew and cry that the run intervals were increased from 30 minutes to 60 minutes... eventually every four hours for production resources.
In my current position, production nodes are provisioned to run puppet once daily as a rule, triggered by cron jobs at a pseudorandom minute between 0200 and 0400 defined at server provisioning time.
How do these intervals compare to what you've seen?
Re: Terraforming 1Password
#57What are your thoughts on using modules inside terraform ?
Not the op, but I have some brief thoughts. Given a bit of time with Terraform, the need for modules becomes obvious as you identify common resources for the infrastructure you're modeling. I thought writing modules first was the "right way," but starting with modules ended up being a waste.
I'll second this. I started out not using modules, but figured I'd migrate things over to using them as and when it would make things tidier. I never migrated things.
Modules are really neat but I don't think they're a sensible starting point if you're not doing a lot of repetition or don't exactly know what you need to build yet.
Re: Terraforming 1Password
#58The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous. CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format). I’ve spent a lot of time working between the two, and while Terr…
Personally I find YAML for cloudformation worse than JSON because of the whitespacing requirements. JSON isn't much better mind, especially once your template reaches to hundreds of lines with nested objects. Recently I've come around to using Troposphere [1] to write cloudformation templates, it's actually very pleasant to use. You just write your infrastructure in python, and it will generate you a template at the…
I'm sorry, what? You don't like YAML because it uses whitespace as a delimiter instead of curly braces? That is probably the least important feature that YAML adds for CF templates.
YAML, despite its warts, is much more readable and maintainable for CF templates than JSON, particularly when you are doing non-trivial things and need to use a lot of intrinsic functions and string manipulation. Or you want to put comments in your template.
I've worked on huge JSON and huge YAML CF templates (I'm talking templates that are thousands of lines long--in YAML). YAML is without a doubt easier to maintain.
I can't recommend any CF libraries for generating templates either, unless you want to wait around for new CloudFormation features to be implemented or suffer from half-broken existing implementations (or waste time hunting down bugs and submitting patches). Sometimes it makes sense to use a template engine like Jinja or ERB. But I'd stay away from libraries that generate CF templates--they're mired with missing edge cases and they're mostly an unnecessary dependency.
Re: Terraforming 1Password
#59The code comparison between CloudFormation’s abysmal JSON formatting and Terraform’s DSL is a bit disingenuous. CloudFormation has supported YAML for at least a year or two now, and it’s leagues more readable and compact, not to mention maintainable—you can even add comments to your code with YAML (something that is impossible with the old JSON format). I’ve spent a lot of time working between the two, and while Terr…
I am sorry but I just could not grasp YAML for some reason. I am always confused by its indentation and maps vs lists notation.
I am not ashamed to admit that I felt the same way for a time. I don't know when things changed, but it started to click recently, and I actually like yaml. I guess that it helps that it has become rather ubiquitous in our build tools between cloud-init, puppet hieradata, and ansible roles/playbooks.
What hasn't been helpful is what others here and elsewhere have reminded me time and time again... "JSON is a subset of yaml"
Re: Terraforming 1Password
#60Wow, I found it fascinating to read such a detailed description of the architecture of a running business! Is anyone else aware of similar blog posts from other companies?