Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Creating my personal cloud with HashiCorp

cgamesplay.com

Post reply on HN
Print view View original

71–80 of 90 posts

Re: Creating my personal cloud with HashiCorp

#71

Post by mitchellh »

shell0x wrote: post #5

As a DevOps guy, I'm not a huge fan of Terraform. Often I hear from enterprises that Terraform is cloud agnostic, but that's often very wrong. Terraform modules are still specific to the cloud platform and a rewrite is required to port an app running on AWS to GCP. If you use AWS, you're probably better off to use AWS Cloudformation and for GCP Google Cloud Deployment manager. A business reason is often that the engi…

(Creator of Terraform, Co-Founder of HashiCorp)

I'm quite late to respond here, but just wanted to clarify one thing: Terraform is WORKFLOW agnostic, not TECHNOLOGY agnostic. This is a key part of our product philosophy that we make the 1st element of our Tao: https://www.hashicorp.com/tao-of-hashicorp

I've talked about this more with more references in this tweet: https://twitter.com/mitchellh/status/1078682765963350016

I don't think we've ever claimed cloud portability through "write once run anywhere;" that isn't our marketing or sales pitch and if we ever did make that claim please let me know and I'll poke some teams to correct it. Our pitch is always to just learn one workflow/tool and use it everywhere, but you explicitly WILL rewrite cloud-specific modules/code/etc.

With Terraform, the big win for folks is learning how to write and use Terraform, then knowing a fully supported official tool (to some extent) for hundreds of API-driveable systems. Instead of educating an engineer on CloudFormation, Azure ARM, etc. they learn ONE tool and ONE syntax and then adapt that to their cloud-specific knowledge.

More details are in the tweet I mentioned above, but I hope that helps. Fully respect you not being a fan of Terraform, I don't mind that, I just wanted to make sure for yourself and others reading that it is clear that we also don't believe Terraform is cloud agnostic in the sense you described.

Re: Creating my personal cloud with HashiCorp

#72

Post by ArtWomb »

mitchellh wrote: post #71
shell0x wrote: post #5

As a DevOps guy, I'm not a huge fan of Terraform. Often I hear from enterprises that Terraform is cloud agnostic, but that's often very wrong. Terraform modules are still specific to the cloud platform and a rewrite is required to port an app running on AWS to GCP. If you use AWS, you're probably better off to use AWS Cloudformation and for GCP Google Cloud Deployment manager. A business reason is often that the engi…

(Creator of Terraform, Co-Founder of HashiCorp) I'm quite late to respond here, but just wanted to clarify one thing: Terraform is WORKFLOW agnostic, not TECHNOLOGY agnostic. This is a key part of our product philosophy that we make the 1st element of our Tao: https://www.hashicorp.com/tao-of-hashicorp I've talked about this more with more references in this tweet: https://twitter.com/mitchellh/status/107868276596335…

I'm curious to see what you think of the "hash stack" for self-hosted projects: consul, nomad, vault. Honestly, seems pretty ideal to me ;)

Why not provide a cloud host tier for startups akin to CLoudflare Pages?

Re: Creating my personal cloud with HashiCorp

#73

Post by stavros »

CGamesPlay wrote: post #69
stavros wrote: post #63

Earlier quoted context omitted.

Oh, well, you can :P Can you go into a bit more detail about your setup?

Nomad has native support for periodic jobs that does not require running a cron docker image, and that was a big draw. As far as the private registry goes, I don't see why that would be particularly hard with a set of compose scripts, but I really liked the fact that Nomad has everything about them documented. Honestly, if I had stuck with Compose files then Harbormaster looks like it's a reasonable way to manage the…

I see, thanks! Maybe cron functionality is something I can add, actually... It seems useful.

Re: Creating my personal cloud with HashiCorp

#74

Post by bengale »

mitchellh wrote: post #71
shell0x wrote: post #5

As a DevOps guy, I'm not a huge fan of Terraform. Often I hear from enterprises that Terraform is cloud agnostic, but that's often very wrong. Terraform modules are still specific to the cloud platform and a rewrite is required to port an app running on AWS to GCP. If you use AWS, you're probably better off to use AWS Cloudformation and for GCP Google Cloud Deployment manager. A business reason is often that the engi…

(Creator of Terraform, Co-Founder of HashiCorp) I'm quite late to respond here, but just wanted to clarify one thing: Terraform is WORKFLOW agnostic, not TECHNOLOGY agnostic. This is a key part of our product philosophy that we make the 1st element of our Tao: https://www.hashicorp.com/tao-of-hashicorp I've talked about this more with more references in this tweet: https://twitter.com/mitchellh/status/107868276596335…

I actually much prefer this. When things try to be technology agnostic, or too generic you end up with the lowest common denominator for features.

Re: Creating my personal cloud with HashiCorp

#75

Post by Omekutio »

mitchellh wrote: post #71
shell0x wrote: post #5

As a DevOps guy, I'm not a huge fan of Terraform. Often I hear from enterprises that Terraform is cloud agnostic, but that's often very wrong. Terraform modules are still specific to the cloud platform and a rewrite is required to port an app running on AWS to GCP. If you use AWS, you're probably better off to use AWS Cloudformation and for GCP Google Cloud Deployment manager. A business reason is often that the engi…

(Creator of Terraform, Co-Founder of HashiCorp) I'm quite late to respond here, but just wanted to clarify one thing: Terraform is WORKFLOW agnostic, not TECHNOLOGY agnostic. This is a key part of our product philosophy that we make the 1st element of our Tao: https://www.hashicorp.com/tao-of-hashicorp I've talked about this more with more references in this tweet: https://twitter.com/mitchellh/status/107868276596335…

I highly appreciate what Terraform does for me and the whole industry.

I also think sometimes why i don't like it very much and how i would make it different.

How the state is handled, including potential secrets in it, is just frustrating. Having root secrets for your whole setup exposed/unsecure is bad. The state is relativly fragile and cumbersome to clean up or fix. I also can't grasp that tf even needs a state and the cloud providers can't return the current state just fast enough. Only a lightweight cache would then be needed.

And probably due to implementation details, plans show sometimes changes when there would be no changes necessary.

For me its a good tradeoff to use terraform for setting up a k8s environment and then handling everything with ArgoCD.

Google Connector is a very great thought: you create a k8s resource and the cloud provider executes it for you on their cloud. No terraform needed anymore at all.

Re: Creating my personal cloud with HashiCorp

#76

Post by nickthemagicman »

Glyptodon wrote: post #57
nickthemagicman wrote: post #53

Earlier quoted context omitted.

>> but I just think a native solution of the platform is preferable over a 3rd party tool I had a job interview where someone asked me what I would prefer Terraform or Cloudformation for AWS. I said Cloudformation because it's managed by AWS who writes the actual software as well. And they kind of smugly said Terraform is better because it's cloud agnostic. I was thinking...have you ever USED Terraform.

I wouldn't consider myself super in love with terraform, but Cloudformation has been nearly 100% unpleasant experiences for me, though I will admit to not being an expert. Mostly it seems like it's harder to know your changes don't have any mistakes and will do exactly what you expect. Is there a CF equivalent to TF plan? We've also found TF seems to apply changes faster in many cases.

I agree CF kinda blows compared to real programming lang, and is probably legitimately better as an intermediate generated template than hand crafted code.

Even AWS has come up with a CDK to avoid building CF and use real prog langs.

I've never used it though.

I just personally think that if youre going to be a part of an ecosystem, things go much more smoothly when you stay in that ecosystem as much as possible.

Also Amazon is a massive company compared to hashicorp so I feel more comfortable about my infrastructures longevity with AWS tools.

Not saying hashicorp is going anywhere anytime soon and if it did the open-source community would probably take over, but it eliminates that tiny tiny risk.

I would probably use the AWS-CDK now instead of CF.

Re: Creating my personal cloud with HashiCorp

#77

Post by Omekutio »

kosolam wrote: post #7
shell0x wrote: post #5

As a DevOps guy, I'm not a huge fan of Terraform. Often I hear from enterprises that Terraform is cloud agnostic, but that's often very wrong. Terraform modules are still specific to the cloud platform and a rewrite is required to port an app running on AWS to GCP. If you use AWS, you're probably better off to use AWS Cloudformation and for GCP Google Cloud Deployment manager. A business reason is often that the engi…

If you are saying that it’s better to run native than Terraform then to me it means that Terraform is not good enough - which is also my experience from poking it. It covers all use cases on all clouds, buy only ~80% of each use case. The rest you have to figure out by yourself. Which often means diving into CloudFormation and such - so basically losing the advantage of Terraform.

On gcp terraform works very well. But we try to keep everything in k8s.

So terraform is critical for our bootstrap procedure, for documenting our configuration.

Re: Creating my personal cloud with HashiCorp

#78

Post by nickthemagicman »

Glyptodon wrote: post #57
nickthemagicman wrote: post #53

Earlier quoted context omitted.

>> but I just think a native solution of the platform is preferable over a 3rd party tool I had a job interview where someone asked me what I would prefer Terraform or Cloudformation for AWS. I said Cloudformation because it's managed by AWS who writes the actual software as well. And they kind of smugly said Terraform is better because it's cloud agnostic. I was thinking...have you ever USED Terraform.

I wouldn't consider myself super in love with terraform, but Cloudformation has been nearly 100% unpleasant experiences for me, though I will admit to not being an expert. Mostly it seems like it's harder to know your changes don't have any mistakes and will do exactly what you expect. Is there a CF equivalent to TF plan? We've also found TF seems to apply changes faster in many cases.

Im not super familiar with terraform but think change sets may compare to terraform plan?

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...

Re: Creating my personal cloud with HashiCorp

#79

Post by humblepie »

CGamesPlay wrote: post #65
humblepie wrote: post #51

I've been using nomad for smaller setups in AWS and it's been great. The biggest issue I've encountered on it is when you move out of AWS (and you can't apply EC2-based IAM) but still have S3-hosted artifacts. Specifically it cannot receive Vault secrets for the artifact credentials because the nomad templates get applied at a much later stage.

Have you looked into levant? Seems like it would allow you to do this. Now, with levant the developer machine would be the thing retrieving the vault secrets, but it may be a useful stopgap. https://github.com/hashicorp/levant

Hmm, would the stored job data still include the AWS credentials? That is, if I change the artifact S3 credentials and I run "nomad job plan" it will show the diff of the AWS keys. That means somewhere in the nomad raft logs the keys are exposed.

Re: Creating my personal cloud with HashiCorp

#80

Post by CGamesPlay »

humblepie wrote: post #79
CGamesPlay wrote: post #65

Earlier quoted context omitted.

Have you looked into levant? Seems like it would allow you to do this. Now, with levant the developer machine would be the thing retrieving the vault secrets, but it may be a useful stopgap. https://github.com/hashicorp/levant

Hmm, would the stored job data still include the AWS credentials? That is, if I change the artifact S3 credentials and I run "nomad job plan" it will show the diff of the AWS keys. That means somewhere in the nomad raft logs the keys are exposed.

Yes, exactly. Definitely not ideal, but potentially a workaround depending on the security requirements.
Post reply on HN