4 ms·

I was of the same opinion as the GP until I started using Terraform. Coming from a sysadmin background, I was always told to use default tools 'because one day

by aynsof 9y ago

I was of the same opinion as the GP until I started using Terraform. Coming from a sysadmin background, I was always told to use default tools 'because one day you'll ssh into a random server and it won't have any of your fancy tools and config'. So I started using Terraform. A lot. Day in, day out, I would type terrafrom, teraform, terrafomr. And I'm a good typist! But something about that word just makes it hard to get out right. (I have a similar issue with 'infrastructure'.) Finally replacing it with a 'tf' alias saved me a lot of frustration.

outworlder 9y ago
This is actually supporting GP's argument. Why do you have to "type" terraform? Are you running terraform from your own machine? Don't. Setup a Jenkins pipeline or what have you. Unless you happen to work alone – and I'd argue even then. Moving Terraform to Jenkins was the second best thing we have ever done – first thing was moving tfstate to remote storage. You can provide any required parameters (or jenkins can fetch for you), run terraform init, plan, ask for confirmation, apply (and even perform retries). And then run any post steps. Even managers can use terraform now (and we have a pretty complicated setup). I guess only Terraform Enterprise might beat this, but I have little experience with that.
- yebyen 9y ago
  This is a great way to go, but I think you're actually asking GP to have his cart before his horse. This is how I learned and how you learned, I'd guess... by typing the command into a terminal. Am I being luddite? I had to be dragged kicking and screaming to set up CI for my product's tests, but I see the value of it now. How many thousands of times should you type "terraform" in full before you're comfortable with all of the nuances of syntax and command-line arguments? (Or kubectl --namespace=kube-system get pods, or git pull --rebase origin master for that matter) And if these managers who couldn't use Terraform before, can use it now, but also require someone to set up a Jenkins job for them... I'd just be sorta worried that they might get the idea this tool could only be run with adult (Root-type) supervision, because I've seen it happen like this so many times. (I'm sure it's better than the alternative, which is a world in which managers can't or won't ever learn to run this tool at all, simply because it requires use of a command-line.) Just curious do you use Terragrunt or something like it? Or does the fact that Jenkins only allows a single job to run once concurrently actually obviate the need for that... I'm not using Terraform (but wish I was) although I've got a basic Jenkins setup for some CI things on my less than 10-person product team. To be fair I think you may have just convinced me that I need to be able to do this too. I actually have a Jenkins server and we use it for CI to run our product's test suite by hand, but not much else. We have a team that provisions EC2 resources, we have a team that handles security rules, and everyone is a competent professional but sometimes as a developer the appearance from the outside of that group is that a left hand does not know what the right hand is doing. I guess with Jenkins and a remote tfstate, you make it very easy to know who owns what resources, and to see who has done what, or even specifically which locks are actually open and what resource is currently in motion.
- aynsof 9y ago
  We ran Terraform in Bitbucket Pipelines builds - full testing with awspec, remote state in S3, statefile locking in DynamoDB. It might surprise you, but there are cases where you might not want to run Terraform in a pipeline.
  - yebyen 9y ago
    What is this awspec? I would like to subscribe to your blog or mailing list! :+100:
    - aynsof 9y ago
      Haha I don't have either, I'm afraid. Here's a link to the common architectures I helped out on when I was at Geoscience Australia: https://bitbucket.org/account/user/geoscienceaustralia/projects/TF https://bitbucket.org/account/user/geoscienceaustralia/proje... Here's a direct link to the awspec tests for one of the repositories: https://bitbucket.org/geoscienceaustralia/webserver/src/ab6fcfaa5926e6a2c9a15240ebefc082c47cefcf/tests/spec/?at=master https://bitbucket.org/geoscienceaustralia/webserver/src/ab6f...

by aynsof 9y ago

outworlder 9y ago

This is actually supporting GP's argument. Why do you have to "type" terraform? Are you running terraform from your own machine? Don't. Setup a Jenkins pipeline or what have you. Unless you happen to work alone – and I'd argue even then. Moving Terraform to Jenkins was the second best thing we have ever done – first thing was moving tfstate to remote storage. You can provide any required parameters (or jenkins can fetch for you), run terraform init, plan, ask for confirmation, apply (and even perform retries). And then run any post steps. Even managers can use terraform now (and we have a pretty complicated setup). I guess only Terraform Enterprise might beat this, but I have little experience with that.

yebyen 9y ago
This is a great way to go, but I think you're actually asking GP to have his cart before his horse. This is how I learned and how you learned, I'd guess... by typing the command into a terminal. Am I being luddite? I had to be dragged kicking and screaming to set up CI for my product's tests, but I see the value of it now. How many thousands of times should you type "terraform" in full before you're comfortable with all of the nuances of syntax and command-line arguments? (Or kubectl --namespace=kube-system get pods, or git pull --rebase origin master for that matter) And if these managers who couldn't use Terraform before, can use it now, but also require someone to set up a Jenkins job for them... I'd just be sorta worried that they might get the idea this tool could only be run with adult (Root-type) supervision, because I've seen it happen like this so many times. (I'm sure it's better than the alternative, which is a world in which managers can't or won't ever learn to run this tool at all, simply because it requires use of a command-line.) Just curious do you use Terragrunt or something like it? Or does the fact that Jenkins only allows a single job to run once concurrently actually obviate the need for that... I'm not using Terraform (but wish I was) although I've got a basic Jenkins setup for some CI things on my less than 10-person product team. To be fair I think you may have just convinced me that I need to be able to do this too. I actually have a Jenkins server and we use it for CI to run our product's test suite by hand, but not much else. We have a team that provisions EC2 resources, we have a team that handles security rules, and everyone is a competent professional but sometimes as a developer the appearance from the outside of that group is that a left hand does not know what the right hand is doing. I guess with Jenkins and a remote tfstate, you make it very easy to know who owns what resources, and to see who has done what, or even specifically which locks are actually open and what resource is currently in motion.
aynsof 9y ago
We ran Terraform in Bitbucket Pipelines builds - full testing with awspec, remote state in S3, statefile locking in DynamoDB. It might surprise you, but there are cases where you might not want to run Terraform in a pipeline.
- yebyen 9y ago
  What is this awspec? I would like to subscribe to your blog or mailing list! :+100:
  - aynsof 9y ago
    Haha I don't have either, I'm afraid. Here's a link to the common architectures I helped out on when I was at Geoscience Australia: https://bitbucket.org/account/user/geoscienceaustralia/projects/TF https://bitbucket.org/account/user/geoscienceaustralia/proje... Here's a direct link to the awspec tests for one of the repositories: https://bitbucket.org/geoscienceaustralia/webserver/src/ab6fcfaa5926e6a2c9a15240ebefc082c47cefcf/tests/spec/?at=master https://bitbucket.org/geoscienceaustralia/webserver/src/ab6f...