Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why was Terraform created?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Ask HN: Why was Terraform created?

#51

Post by d_watt »

impoppy wrote: post #45
d_watt wrote: post #44

Earlier quoted context omitted.

> but I do have a problem with mastering a tool purpose and idea of which I do not fully understand I would suggest that the onus of learning this isn't on other people though. You can start with a baseline assumption that there is a reason these decisions are made. Assume other people are smart, rational actors, and that certain pressures and tradeoffs lead to the belief that the current strategies are the best we h…

I dunno, I have this problem all the time. I feel powerless being presented to all those enormous pieces of software I have no idea how do they work. I guess it’s a form of procrastination, as the moment I stop thinking, investigating and learning beforehand and start actually working with the input I have — the actual progress starts. Edit: Phrasing.

It makes sense, and the biggest ways to understand are to do what you're talking about and try and "do it better." As other commenters pointed out, as you make the bash script more and more complicated, you'll see why terraform is the way it is. You may even find ways to do it better, and then you can make your own project/competitor, or submit a change back to the open source project.

However, in the mean time, it's always worth coming at these things with the generosity of mind to assume that smart people made tradeoffs for real reasons, and for your "day job" work in the frameworks adopted until you understand the problemspace well enough to give truly informed feedback on why to do something differently.

Re: Ask HN: Why was Terraform created?

#52

Post by mdaniel »

dimitar wrote: post #48

The example you gave is of a wrong way to write Terraform; you should be able to query the cloud API using using data sources. In your case (getting a VNet) that would be this: https://registry.terraform.io/providers/hashicorp/azurerm/la... In case you need to get the metadata of a resource group you can use this: https://registry.terraform.io/providers/hashicorp/azurerm/la... I am a very happy Terraform user, here a…

> first you write your code, generate a plan, inspect it carefully and only then apply

Be aware that this experience differs wildly by terraform provider. I can very easily demonstrate that `terraform plan` for AWS consults absolutely zero of the AWS infrastructure, relying solely upon terraform.tfstate. So, great if everyone in the entire organization is entirely disciplined, but in a less disciplined environment terraform's aws provider does nothing to help warn the user of the demonstrably false plan. I don't know what the situation is with the other cloud providers in order to know if that's just "the terraform way" or what

Re: Ask HN: Why was Terraform created?

#54

Post by icedchai »

whoomp12342 wrote: post #31
cs_tiger4 wrote: post #29

One killer feature of Infrastructure as Code, be it terraform or any other is idempotence. You have to be careful not to run your bash script twice or you get another instance/vpc/loadbalancer or whatever. You run "terraform apply" twice and it does nothing on the second run. If you start implementing that in your shell scripts you start implementing terraform in bash.

another killer features is creating modules so you dont repeat yourself

I wound up at a shop where one of the original people involved and left clearly did not know about modules. It's all copy-paste.

Re: Ask HN: Why was Terraform created?

#55

Post by dragonwriter »

j0yb0y wrote: post #47
morsecodist wrote: post #39

> to have a unified interface with a single language for all kinds of cloud infrastructures where the machine you are deploying to can be virtually anything I don't think having a unified interface is the motivation behind Terraform. You still need to understand the underlying resources you are dealing with, Terraform doesn't abstract that at all. The big idea behind Terraform is procedural vs declarative. You can wr…

Great answer! One minor point, I agree it’s not the motivation but it _does_ provide a unified workflow across service providers, which is valuable!

> One minor point, I agree it’s not the motivation but it _does_ provide a unified workflow across service providers, which is valuable!

IIRC, it is part of the motivation for Terraform specifically, though not for the broader class of Infrastructure as Code tools, some of which are provider-specific (but also likely quicker to support new platform features.)

Re: Ask HN: Why was Terraform created?

#57

Post by dolni »

cybrexalpha wrote: post #50

The complexity of cloud deployments tends to grow wildly over time. What starts as an ECR repo with a single ECS deployment turns into Route 53 zones, S3 buckets, ELBs, multiple deployments of ECS, security policies, the odd EC2 instance (there's always one somehwere), etc, etc. Terraform gives you a commmon language to make sense of it all that can grow as your cloud infra does. When combined with git and CI/CD it's…

Is self-service Terraform as you describe actually successful? I use Terraform frequently and I have zero confidence that this process works except for the simplest changes.

For one, building out anything of complexity in Terraform often involves some trial and error to make sure all the resources are wired together correctly.

For two, there are some Terraform changes that can incur downtime if you just let Terraform destroy and create resources. The solution I employ for this is what I not-so-affectionately call "Terraform surgery". It usually entails standing up the new resource(s), cutting over to them, and then destroying the old ones. Sometimes I will manually remove some stuff from the state file and delete it once Terraform has performed the cutover.

That stuff is possible to do in CI, but it would be inefficient and painful.

To me, the biggest benefit of Terraform is managing changes to cloud resources. You know what resources are added when, why, and by whom. You have a mechanism for promoting changes between environments confidently. And if your infra ever blew up, you would be able to put stuff back.

Re: Ask HN: Why was Terraform created?

#58

Post by dimitar »

mdaniel wrote: post #52
dimitar wrote: post #48

The example you gave is of a wrong way to write Terraform; you should be able to query the cloud API using using data sources. In your case (getting a VNet) that would be this: https://registry.terraform.io/providers/hashicorp/azurerm/la... In case you need to get the metadata of a resource group you can use this: https://registry.terraform.io/providers/hashicorp/azurerm/la... I am a very happy Terraform user, here a…

> first you write your code, generate a plan, inspect it carefully and only then apply Be aware that this experience differs wildly by terraform provider. I can very easily demonstrate that `terraform plan` for AWS consults absolutely zero of the AWS infrastructure, relying solely upon terraform.tfstate. So, great if everyone in the entire organization is entirely disciplined, but in a less disciplined environment te…

It is not a good idea to have several tools managing the same resources, I don't and for relying on the state file hasn't caused me any issues.

Re: Ask HN: Why was Terraform created?

#59

Post by cybrexalpha »

dolni wrote: post #57
cybrexalpha wrote: post #50

The complexity of cloud deployments tends to grow wildly over time. What starts as an ECR repo with a single ECS deployment turns into Route 53 zones, S3 buckets, ELBs, multiple deployments of ECS, security policies, the odd EC2 instance (there's always one somehwere), etc, etc. Terraform gives you a commmon language to make sense of it all that can grow as your cloud infra does. When combined with git and CI/CD it's…

Is self-service Terraform as you describe actually successful? I use Terraform frequently and I have zero confidence that this process works except for the simplest changes. For one, building out anything of complexity in Terraform often involves some trial and error to make sure all the resources are wired together correctly. For two, there are some Terraform changes that can incur downtime if you just let Terraform…

I've seen it work best with an embedded plan.

So engineers open a PR with terraform changes, the CI runs `terraform plan`, and comments on the PR with that diff. So you can see if your terraform is valid, if you're going to be destroying things you shouldn't, etc.

Larger, more complex testing is generally done by locally invoking your terraform on a testing environment. How this is setup kind of depends, but I've seen this work well for testing out complex changes before going to the PR & Plan stage.

Re: Ask HN: Why was Terraform created?

#60

Post by thomasmcfarlane »

It's much more about standardising the approach within a team, and not needing to know your target infrastructure state. Especially at the stage of a scale up, you'll get a lot of differing views as where to write your scripts - Terraform provides tooling for a specific use case where you don't need to reinvent everything.

At Nimbus[1], we have been trialling using Terraform for template definitions as users are mostly familiar with it, and it allows them to integrate more easily with existing CI/CD processes. They can easily just add a new Nimbus Workspace to their Terraform and have it spin up a new development environment when their CI requires it.

[1]: https://usenimbus.com - Easy remote development infra for teams

Post reply on HN