Live data from Hacker News

Terraform Gotchas and How We Work Around Them

heap.engineering

81–82 of 82 posts

Re: Terraform Gotchas and How We Work Around Them

#81
post #33

Terraform has interested me for a while, and I've been meaning to give it a try, but haven't had a chance just yet. From what I have seen so far though, there isn't really that much difference/benefit over CloudFormation. We currently have 95% of our resources in AWS with about 4% in Azure, and 1% in Google Cloud. It's great that Terraform is 'mulit-cloud' but it still seems like you have to write .tf's catered to ea…

Isn't Cloudformation limited to 100 items? That's not even enough for our Network ACLs. How do you work around that?

You are limited to 200 resources per stack. You are limited to 200 stacks (but AWS will increase this for you if you ask them nicely). http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuid...

Nesting stacks allows one to bypass the 200 resource limit. https://aws.amazon.com/blogs/devops/use-nested-stacks-to-cre...

Re: Terraform Gotchas and How We Work Around Them

#82

Earlier quoted context omitted.

Cloud Formation has good support for use from Python, Ruby, Node and the JVM (with template generators, to help out). If you're writing JSON directly, yes, some of the points above -- the first four, and the seventh -- are an issue; but if you use Python you get all the benefits of it being "real code" and "just a library" (unlike Terraform).

This is a situation where I think not being "real code" is a feature of terraform. You declaratively represent your infrastructure rather than generate it with real code.

Over time, I have come to view "declarative infrastructure" as unrealistic. It's right 90% of the time, but not 100% of the time -- kind of like using only CSS and HTML. One should use markup whenever possible; but not everything on a page is truly "declarative". Occasionally one needs to script an input field or a transition.

One example of this is scripting the handoff process that's part of a blue/green deploy. In practice you'll want to look at organization defined metrics. There are libraries to do this -- either internal to your organization, or provided by a metrics vendor -- and scripting the process looks like this:

    (1) Setup new environment.
    (2) Divert some traffic.
    (3) Check metrics.
    (4) If metrics are okay:
        (4.1) Post message internally (IRC/Slack).
        (4.2) Divert all traffic.
        (4.3) Set up timed task to tear down old environment (in a day, hour, &c.).
    (5) If metrics are okay:
        (5.1) Post message internally (IRC/Slack), maybe to different people.
        (5.2) Stop diverting traffic.
        (5.3) Tear down new environment.
A large part of the work here is declarative: (1) by itself is a big piece of it, and is fully declarative, as is the teardown in (4.3) and (5.3). However, the need for control flow in this and many other cases means that, without a library, one must drive Terraform by templating and shelling out. Not being "real code" pushes one in the direction, not of greater declarativeness (libraries can certainly have declarative interfaces, like Troposphere does), but of worse code.

Many complex and powerful features are exposed to a modern business through libraries -- AI, payments, telephony -- and software defined infrastructure can be, too. The benefits of "infrastructure as code" won't be realized until that happens.

Post reply on HN