5 ms·

this is short-sighted. Terraform and CloudFormation are not even in the same league. One of them works and actually can be used for Infrastructure as Code, the

this is short-sighted. Terraform and CloudFormation are not even in the same league. One of them works and actually can be used for Infrastructure as Code, the other one does not roll back in the face of failure - it effectively craps for reasons ranging from network failure, process crash, even normal operation. One is heavy kool-aid with bugs that go unresolved for years, the other behaves as advertised. Sorry, but I have yet to meet a developer that used Terraform and willingly wants to keep using it after seeing it fail. When your tool cannot keep track of the resources it created or when it gets into situations where it doesn’t allow you to do certain things (like deleting all resources created) and you have to relearn how the underlying cloud works, it’s time to move on. Do yourselves a favor and use Cloudformation (or your favorite cloud’s equivalent and just move on with your life)

tptacek 7y ago
I mean, this is harsh, but there's a running joke that the big feature terraform is missing is a -twice flag so that it'll re-run itself on failure, since that's what you end up having to do anyways. Also, the terraform language, HCL? It's, I guess there's no better way to put this: not good. Am I misunderstanding the complexity of what Terraform is trying to do? To me, it looks like a bunch of tiny API clients tied together with a topological sort --- in other words, it's just another species of "make". It feels like it carries a whole lot more complexity than that concept warrants, but just enough simplicity to make it not a serious programming language. It's, to me, one of those frustrating uncanny valley systems. I am prepared to be totally wrong about this.
- peterwwillis 7y ago
  No, it's pretty straightforward, terraform is just intended to parse and execute random functions in a graph generated by a template language. It is absolutely a form of 'make': overcomplicated and generic to serve the needs of supporting random companies' infrastructure as versioned code, without having to write the implementation bits. It's a good idea and not a bad design, but the user experience is pretty bad and nearly all the operational aspect is an afterthought. It was not built to be sold as a product, hence it kind of sucks as a product, but it's fine as a free tool. The fact that it's the best free tool we have for this task speaks volumes about how most companies are deathly afraid to work as a community to build better solutions.
- ReidZB 7y ago
  Yeah, HCL's limitations have been an enormous thorn in my side for a long time. HCL2 (Terraform 0.12) is a big step forward, but even still I pine for a proper programming language, even if it has foot-guns. I do think you're selling Terraform short, though. Sure, the core is the toposort-create-things. But it also stores the state of its created things and (crucially) has the ability to diff the actual state of resources against what it thinks they ought to be. Being able to inspect existing resources and diff state is also what lets it import existing resources, so that they can be Terraform-managed going forward. Terraform is also capable of determining if its planned changes can be performed in-place or if they require resources to be destroyed and re-created. That boils down to a boolean flag on a field, ultimately, but it's still something a dead-simple make clone probably wouldn't do well. I've only really used Terraform seriously for AWS, so I'm not sure about the other providers, but the Terraform AWS Provider has an enormous amount of work behind it. Basically every resource API has schema validation written in the AWS provider, and depending on the resource there are often eventual-consistency issues handled by the provider. See for example [0]. In contrast, AWS CloudFormation: can't import existing resources; isn't always sure whether an update will require replacement or not; and, as of ~6 months ago, can detect configuration drift, but not correct it (!). Of course, CloudFormation wins in other areas... [0]: https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_cloudfront_distribution.go https://github.com/terraform-providers/terraform-provider-aw...
  - gnosek 7y ago
    Long-time user of Terraform here, never used CloudFormation. Where does CloudFormation beat Terraform?
    - scarface74 7y ago
      CloudFormation has an “easy button” if you are part of an organization with a business support plan from AWS. If you can’t figure out something you can submit a ticket and start a chat. Also CF is the “native” language of AWS. There are plenty of getting started examples from AWS where they give you the template. Also Elastic Beanstalk extensibility is built on top of CF. Not to mention Codestar that will set up environments for you for common use cases and exports templates and the lambda environment lets you configure everything from the console, test it and then you can export the CF definition.
- deleted 7y ago
  [deleted]
- ofrzeta 7y ago
  Well, judging from the release notes, with for-loops you are now one step closer to a real programming language. Looks like the beginning of the end of the "declarative" paradigma which keeps people running their heads against the wall like this https://blog.gruntwork.io/terraform-tips-tricks-loops-if-statements-and-gotchas-f739bbae55f9 https://blog.gruntwork.io/terraform-tips-tricks-loops-if-sta...
  - crucialfelix 7y ago
    Those are list / map comprehensions. So it's still declarative—you can't iterate and do anything while iterating. Only transform items in a list. https://www.hashicorp.com/blog/hashicorp-terraform-0-12-preview-for-and-for-each https://www.hashicorp.com/blog/hashicorp-terraform-0-12-prev...
- MrBuddyCasino 7y ago
  Well said. Its basically ANT for the cloud, in that its an annoyingly limited DSL with just enough power to work, but in a verbose and frustrating way. Speaking of real code (not YAML or HCL) as infrastructure, anyone have experience with Pulumi?
  - mellab2 7y ago
    I've been using Pulumi for a few weeks now and it works pretty much exactly as advertised (for AWS at least). I am yet to run into any major hurdles and for any minor issues I have had the Pulumi team have been very responsive (they have a public Slack channel available). It actually uses terraform's API's under the hood which is comforting in a way because you know it's building on a solid foundation. I would not go back to writing HCL after experiencing Pulumi if I can avoid it, using a "real" programming language just feels a whole lot more natural and allows for much more powerful abstractions.
- jordanbeiber 7y ago
  The most sensible way I’ve used TF was to create an api for others to consume, containing models of terraform modules. Users can pick and chose what modules, how many and set some params which are then validated. The components are then rendered as json, fully declarative, no counts, no fancy TF hacks. Data sources and a couple of home grown providers take care of whatever needs to be dynamic. This way a lot of foot-guns are removed for consumers, and it simplifies the whole thing. At the expense of writing some code... worth it though, in a more enterprisey setting.
- ownagefool 7y ago
  It basically depends on the formation of your team. A bunch of oldschools sysadmins who "don't code"? Terraform is ridgid and on-rails enough that it probably helps sort of keep things sensible compared to just using boto. Almost like it was a framework, specifically defined to do that sort of thing. It does sort of suck though, but what sucks less? Edit: My solution is to stick as much as possible into k8s, but obviously that comes with its own warts, and to be fair to terraform, a lot of terraforms warts are just the underlying API warts leaking through.
- mirceal 7y ago
  the complexity of Terraform does not come from the happy path. It comes from when things go wrong and now you have to understand what went wrong and how to correct it. Now you’re in a world of pain since TF just throws its hands in the air and you’re left holding the bag. i have hear several people referring to terraform as Terrafail. I have also observed good dev/devops people struggling to make it work when shit hits the fan.
doliveira 7y ago
Well, if you don't follow the obvious advice of storing your state in a S3 bucket... If the idea of storing your state somewhere is so abhorrent for you, you can also tag your resources and import them with Ansible/Bash as per the obligatory CloudFormation workflow. Then your state becomes local-only. That's a pretty useless thing to do for purely ideological reasons, though: storing your state in a cloud-agnostic way is what allows being able to manage a Gitlab repo, a Cloudflare domain and AWS or GCP instances in the same tool. That is what the "multi-cloud" means. If you are saying a nonsensical argument like "not IaC because it can't rollback" I can say CloudFormation is not IaC because it can't even import a local file to grab some values. Or run external commands
- scarface74 7y ago
  Yes it can run external commands via custom resources.
  - doliveira 7y ago
    Terraform allows you to call an arbitrary shell command in you machine, not just trigger some webhook.
    - scarface74 7y ago
      What is the practical difference between “calling an arbitrary shell command” and “calling an arbitrary lambda”?
      - doliveira 7y ago
        Honestly I don't even know how to respond to such a comment. Let's just leave it at that.
        scarface74 7y ago
        Yes because in scenario 1 your running code that you write outside of the template and in scenario two you’re calling out custom code....
alexbanks 7y ago
I was going to respond, but instead I will say: I hope that you enjoy using CF, and I will continue enjoying Terraform.
Thaxll 7y ago
CF doesn't rollback either, the rollback is not done by the client but by CF backend, very different story.

tptacek 7y ago

I mean, this is harsh, but there's a running joke that the big feature terraform is missing is a -twice flag so that it'll re-run itself on failure, since that's what you end up having to do anyways. Also, the terraform language, HCL? It's, I guess there's no better way to put this: not good. Am I misunderstanding the complexity of what Terraform is trying to do? To me, it looks like a bunch of tiny API clients tied together with a topological sort --- in other words, it's just another species of "make". It feels like it carries a whole lot more complexity than that concept warrants, but just enough simplicity to make it not a serious programming language. It's, to me, one of those frustrating uncanny valley systems. I am prepared to be totally wrong about this.

peterwwillis 7y ago
No, it's pretty straightforward, terraform is just intended to parse and execute random functions in a graph generated by a template language. It is absolutely a form of 'make': overcomplicated and generic to serve the needs of supporting random companies' infrastructure as versioned code, without having to write the implementation bits. It's a good idea and not a bad design, but the user experience is pretty bad and nearly all the operational aspect is an afterthought. It was not built to be sold as a product, hence it kind of sucks as a product, but it's fine as a free tool. The fact that it's the best free tool we have for this task speaks volumes about how most companies are deathly afraid to work as a community to build better solutions.
ReidZB 7y ago
Yeah, HCL's limitations have been an enormous thorn in my side for a long time. HCL2 (Terraform 0.12) is a big step forward, but even still I pine for a proper programming language, even if it has foot-guns. I do think you're selling Terraform short, though. Sure, the core is the toposort-create-things. But it also stores the state of its created things and (crucially) has the ability to diff the actual state of resources against what it thinks they ought to be. Being able to inspect existing resources and diff state is also what lets it import existing resources, so that they can be Terraform-managed going forward. Terraform is also capable of determining if its planned changes can be performed in-place or if they require resources to be destroyed and re-created. That boils down to a boolean flag on a field, ultimately, but it's still something a dead-simple make clone probably wouldn't do well. I've only really used Terraform seriously for AWS, so I'm not sure about the other providers, but the Terraform AWS Provider has an enormous amount of work behind it. Basically every resource API has schema validation written in the AWS provider, and depending on the resource there are often eventual-consistency issues handled by the provider. See for example [0]. In contrast, AWS CloudFormation: can't import existing resources; isn't always sure whether an update will require replacement or not; and, as of ~6 months ago, can detect configuration drift, but not correct it (!). Of course, CloudFormation wins in other areas... [0]: https://github.com/terraform-providers/terraform-provider-aws/blob/master/aws/resource_aws_cloudfront_distribution.go https://github.com/terraform-providers/terraform-provider-aw...
- gnosek 7y ago
  Long-time user of Terraform here, never used CloudFormation. Where does CloudFormation beat Terraform?
  - scarface74 7y ago
    CloudFormation has an “easy button” if you are part of an organization with a business support plan from AWS. If you can’t figure out something you can submit a ticket and start a chat. Also CF is the “native” language of AWS. There are plenty of getting started examples from AWS where they give you the template. Also Elastic Beanstalk extensibility is built on top of CF. Not to mention Codestar that will set up environments for you for common use cases and exports templates and the lambda environment lets you configure everything from the console, test it and then you can export the CF definition.
deleted 7y ago
[deleted]
ofrzeta 7y ago
Well, judging from the release notes, with for-loops you are now one step closer to a real programming language. Looks like the beginning of the end of the "declarative" paradigma which keeps people running their heads against the wall like this https://blog.gruntwork.io/terraform-tips-tricks-loops-if-statements-and-gotchas-f739bbae55f9 https://blog.gruntwork.io/terraform-tips-tricks-loops-if-sta...
- crucialfelix 7y ago
  Those are list / map comprehensions. So it's still declarative—you can't iterate and do anything while iterating. Only transform items in a list. https://www.hashicorp.com/blog/hashicorp-terraform-0-12-preview-for-and-for-each https://www.hashicorp.com/blog/hashicorp-terraform-0-12-prev...
MrBuddyCasino 7y ago
Well said. Its basically ANT for the cloud, in that its an annoyingly limited DSL with just enough power to work, but in a verbose and frustrating way. Speaking of real code (not YAML or HCL) as infrastructure, anyone have experience with Pulumi?
- mellab2 7y ago
  I've been using Pulumi for a few weeks now and it works pretty much exactly as advertised (for AWS at least). I am yet to run into any major hurdles and for any minor issues I have had the Pulumi team have been very responsive (they have a public Slack channel available). It actually uses terraform's API's under the hood which is comforting in a way because you know it's building on a solid foundation. I would not go back to writing HCL after experiencing Pulumi if I can avoid it, using a "real" programming language just feels a whole lot more natural and allows for much more powerful abstractions.
jordanbeiber 7y ago
The most sensible way I’ve used TF was to create an api for others to consume, containing models of terraform modules. Users can pick and chose what modules, how many and set some params which are then validated. The components are then rendered as json, fully declarative, no counts, no fancy TF hacks. Data sources and a couple of home grown providers take care of whatever needs to be dynamic. This way a lot of foot-guns are removed for consumers, and it simplifies the whole thing. At the expense of writing some code... worth it though, in a more enterprisey setting.
ownagefool 7y ago
It basically depends on the formation of your team. A bunch of oldschools sysadmins who "don't code"? Terraform is ridgid and on-rails enough that it probably helps sort of keep things sensible compared to just using boto. Almost like it was a framework, specifically defined to do that sort of thing. It does sort of suck though, but what sucks less? Edit: My solution is to stick as much as possible into k8s, but obviously that comes with its own warts, and to be fair to terraform, a lot of terraforms warts are just the underlying API warts leaking through.
mirceal 7y ago
the complexity of Terraform does not come from the happy path. It comes from when things go wrong and now you have to understand what went wrong and how to correct it. Now you’re in a world of pain since TF just throws its hands in the air and you’re left holding the bag. i have hear several people referring to terraform as Terrafail. I have also observed good dev/devops people struggling to make it work when shit hits the fan.

doliveira 7y ago

Well, if you don't follow the obvious advice of storing your state in a S3 bucket... If the idea of storing your state somewhere is so abhorrent for you, you can also tag your resources and import them with Ansible/Bash as per the obligatory CloudFormation workflow. Then your state becomes local-only. That's a pretty useless thing to do for purely ideological reasons, though: storing your state in a cloud-agnostic way is what allows being able to manage a Gitlab repo, a Cloudflare domain and AWS or GCP instances in the same tool. That is what the "multi-cloud" means. If you are saying a nonsensical argument like "not IaC because it can't rollback" I can say CloudFormation is not IaC because it can't even import a local file to grab some values. Or run external commands

scarface74 7y ago
Yes it can run external commands via custom resources.
- doliveira 7y ago
  Terraform allows you to call an arbitrary shell command in you machine, not just trigger some webhook.
  - scarface74 7y ago
    What is the practical difference between “calling an arbitrary shell command” and “calling an arbitrary lambda”?
    - doliveira 7y ago
      Honestly I don't even know how to respond to such a comment. Let's just leave it at that.
      - scarface74 7y ago
        Yes because in scenario 1 your running code that you write outside of the template and in scenario two you’re calling out custom code....

alexbanks 7y ago

I was going to respond, but instead I will say: I hope that you enjoy using CF, and I will continue enjoying Terraform.

Thaxll 7y ago

CF doesn't rollback either, the rollback is not done by the client but by CF backend, very different story.