5 ms·

If you like CDK, then i highly recommend pulumi

by theopsguy 5y ago

k__ 5y ago
How do they differ?
- xyzzy123 5y ago
  So regular CDK is basically a program-driven CFN generator. Pulumi has a similar model where you build a resource graph at runtime BUT it's also got the execution engine built-in to the tool. What this means in practice is that you can create resources (like a kube cluster) and then use them as providers (e.g provision state tracked resources with kube api) all in the same operation. You can also (in your infracode or an importable module) define "dynamic providers", meaning you can easily extend the execution engine to do custom things related to your workload. As an example, imagine you want to create a cluster, deploy an app, then provision (state tracked) some app resources like an admin user and group via the app's REST API. You can do that without too much fuss. Neither terraform nor CDK can really do those things very well. TF is not powerful enough language-wise, and in CDK the execution phase is locked away from you.
  - bogomipz 5y ago
    >"So regular CDK is basically a program-driven CFN generator." What is CFN here? Cloudformation?
    - count 5y ago
      Yes.
  - k__ 5y ago
    I don't think I 100% understand. Could you elaborate a bit more? Let's say I have an app with API Gateway, Lambda, and DynamoDB. I would provision them with one of those tools CDK or Pulumi. How would these tools differ in their provisioning steps?
    - xyzzy123 5y ago
      You wouldn't see much _practical_ difference between CDK and Pulumi (or Terraform!) for that use-case. The workflow would feel almost identical. Under the hood different things are happening. Your CDK program would run with all the resources you declared. That would generate CloudFormation script(s) that get submitted to the CloudFormation service for evaluation. The CloudFormation service (running inside AWS) is the "execution engine" and is responsible for creating and tracking the state of your resources. Pulumi would run your code, build an object graph, then do the "execution" itself - invoke all the required AWS API calls to create your resources (the API Gateway, the Lambda, etc etc) from where the CLI is running. The CLI would also be writing out all the resource state to somewhere. The tradeoffs are in line with what you might expect. The Pulumi approach is more powerful, but you "own" more of the complexity since it lives on your side of the responsibility boundary. Some people prefer AWS to be the execution engine; they feel it's more reliable to let AWS provision resources and keep track of state. They like it that AWS is responsible and will fix bugs. Others prefer the increased control of "owning" the execution engine. This means being able to debug it or extend it with third party or custom providers that let you provision new resource types. They're happy that they don't need to wait for AWS to fix things, they can do it themselves if they have to. This is not the only difference between the two tools but it is one of the most fundamental ones.
      - k__ 5y ago
        Ah, thanks for this explanation!
      - k__ 5y ago
        Nice. Does Pulumi support stuff like Cloudflare Workers, FaunaDB, or Auth0?
        xyzzy123 5y ago
        Workers yes, Auth0 yes, FaunaDB not built-in but you can add it (there is an experimental provider someone made).
- shree_ch 5y ago
  +1 to Pulumi. xyzzy123 already described the differences between Pulumi and terraform, but I want to add one key way in which they are similar: Pulumi uses terraform under the hood. We get all of the reliability of terraform, but with a much more powerful runtime engine.
  - ofrzeta 5y ago
    I guess it depends on what you mean by "under the hood". As far as I know it doesn't use Terraform during runtime but it uses the Terraform resources for generating language definitions. It has a lot of interoperability tools as well such as a "terraform bridge" and a tool that converts Terraform projects.
    - shree_ch 5y ago
      Thank you for clarifying -- I didn't know that!
satya71 5y ago
Can second that. Pulumi with Typescript is just absolutely awesome.
- ofrzeta 5y ago
  It's probably good when you are already using Typescripts in other parts of your day job. While I like the idea of using a real programming language in place of a declarative DSL you trade in the awkward parts of the latter with the idiosyncrasies of async programming and promises.
  - satya71 5y ago
    I specifically chose Typescript for my IAC because of the outstanding static typing among all scripting languages.
- zaphirplane 5y ago
  I don’t get why people like scripting it, declarative is fantastically simple. I don’t want to trace through loops, if statements, functions It does from these files declare my infra to these scripts when parser thru define my infer I get Logic in yaml/json is less ergonomic but templing makes us for it
  - satya71 5y ago
    I suspect you haven't tried Pulumi. It is declarative. Sometimes I just want to generate the declarations rather than type them out by hand.
    - zaphirplane 5y ago
      I was more replying to those saying these products now offer a typescript feature
turtlebits 5y ago
Pulumi needs to work on their documentation. I looked at it about 18 months ago and the Python support was barely there. Tried it again last month and it's better, but I had to do a lot of trial and error. ie. (Try to figure out how to provision an EC2 instance with a root volume. They copied part of the docs from terraform but sections are missing.)
cmclaughlin 5y ago
I tried Pulumi with Python and kept running into show stopper bugs.
- tribaal 5y ago
  I'm currently about to switch to pulumi/python (we're a python show). What showstoppers did you run into? Any insight welcome if that prevents me from hitting a wall I've not seen yet :)
  - cmclaughlin 5y ago
    My first project was trying to deploy a Redshift cluster. It flat out didn’t work. Did 2-3 calls with their tech sales before giving up on it. And then cdktf came out shortly after that.
fishnchips 5y ago
Same here. Pulumi got some things spectacularly right. Their Crosswalk for AWS [0] is magical, especially if you're building serverless apps using Lambda or Docker-based services on top of EKS/ECS. I'd suggest sticking to the TypeScript runtime and major clouds where the support is the best. _Full disclosure_ - Marcin at Spacelift here, and we chose to support Pulumi in addition to Terraform, so this opinion is necessarily biased. [0] https://www.pulumi.com/docs/guides/crosswalk/aws/ https://www.pulumi.com/docs/guides/crosswalk/aws/

If you like CDK, then i highly recommend pulumi

k__ 5y ago

How do they differ?

xyzzy123 5y ago
So regular CDK is basically a program-driven CFN generator. Pulumi has a similar model where you build a resource graph at runtime BUT it's also got the execution engine built-in to the tool. What this means in practice is that you can create resources (like a kube cluster) and then use them as providers (e.g provision state tracked resources with kube api) all in the same operation. You can also (in your infracode or an importable module) define "dynamic providers", meaning you can easily extend the execution engine to do custom things related to your workload. As an example, imagine you want to create a cluster, deploy an app, then provision (state tracked) some app resources like an admin user and group via the app's REST API. You can do that without too much fuss. Neither terraform nor CDK can really do those things very well. TF is not powerful enough language-wise, and in CDK the execution phase is locked away from you.
- bogomipz 5y ago
  >"So regular CDK is basically a program-driven CFN generator." What is CFN here? Cloudformation?
  - count 5y ago
    Yes.
- k__ 5y ago
  I don't think I 100% understand. Could you elaborate a bit more? Let's say I have an app with API Gateway, Lambda, and DynamoDB. I would provision them with one of those tools CDK or Pulumi. How would these tools differ in their provisioning steps?
  - xyzzy123 5y ago
    You wouldn't see much _practical_ difference between CDK and Pulumi (or Terraform!) for that use-case. The workflow would feel almost identical. Under the hood different things are happening. Your CDK program would run with all the resources you declared. That would generate CloudFormation script(s) that get submitted to the CloudFormation service for evaluation. The CloudFormation service (running inside AWS) is the "execution engine" and is responsible for creating and tracking the state of your resources. Pulumi would run your code, build an object graph, then do the "execution" itself - invoke all the required AWS API calls to create your resources (the API Gateway, the Lambda, etc etc) from where the CLI is running. The CLI would also be writing out all the resource state to somewhere. The tradeoffs are in line with what you might expect. The Pulumi approach is more powerful, but you "own" more of the complexity since it lives on your side of the responsibility boundary. Some people prefer AWS to be the execution engine; they feel it's more reliable to let AWS provision resources and keep track of state. They like it that AWS is responsible and will fix bugs. Others prefer the increased control of "owning" the execution engine. This means being able to debug it or extend it with third party or custom providers that let you provision new resource types. They're happy that they don't need to wait for AWS to fix things, they can do it themselves if they have to. This is not the only difference between the two tools but it is one of the most fundamental ones.
    - k__ 5y ago
      Ah, thanks for this explanation!
    - k__ 5y ago
      Nice. Does Pulumi support stuff like Cloudflare Workers, FaunaDB, or Auth0?
      - xyzzy123 5y ago
        Workers yes, Auth0 yes, FaunaDB not built-in but you can add it (there is an experimental provider someone made).
shree_ch 5y ago
+1 to Pulumi. xyzzy123 already described the differences between Pulumi and terraform, but I want to add one key way in which they are similar: Pulumi uses terraform under the hood. We get all of the reliability of terraform, but with a much more powerful runtime engine.
- ofrzeta 5y ago
  I guess it depends on what you mean by "under the hood". As far as I know it doesn't use Terraform during runtime but it uses the Terraform resources for generating language definitions. It has a lot of interoperability tools as well such as a "terraform bridge" and a tool that converts Terraform projects.
  - shree_ch 5y ago
    Thank you for clarifying -- I didn't know that!

satya71 5y ago

Can second that. Pulumi with Typescript is just absolutely awesome.

ofrzeta 5y ago
It's probably good when you are already using Typescripts in other parts of your day job. While I like the idea of using a real programming language in place of a declarative DSL you trade in the awkward parts of the latter with the idiosyncrasies of async programming and promises.
- satya71 5y ago
  I specifically chose Typescript for my IAC because of the outstanding static typing among all scripting languages.
zaphirplane 5y ago
I don’t get why people like scripting it, declarative is fantastically simple. I don’t want to trace through loops, if statements, functions It does from these files declare my infra to these scripts when parser thru define my infer I get Logic in yaml/json is less ergonomic but templing makes us for it
- satya71 5y ago
  I suspect you haven't tried Pulumi. It is declarative. Sometimes I just want to generate the declarations rather than type them out by hand.
  - zaphirplane 5y ago
    I was more replying to those saying these products now offer a typescript feature

turtlebits 5y ago

Pulumi needs to work on their documentation. I looked at it about 18 months ago and the Python support was barely there. Tried it again last month and it's better, but I had to do a lot of trial and error. ie. (Try to figure out how to provision an EC2 instance with a root volume. They copied part of the docs from terraform but sections are missing.)

cmclaughlin 5y ago

I tried Pulumi with Python and kept running into show stopper bugs.

tribaal 5y ago
I'm currently about to switch to pulumi/python (we're a python show). What showstoppers did you run into? Any insight welcome if that prevents me from hitting a wall I've not seen yet :)
- cmclaughlin 5y ago
  My first project was trying to deploy a Redshift cluster. It flat out didn’t work. Did 2-3 calls with their tech sales before giving up on it. And then cdktf came out shortly after that.

fishnchips 5y ago

Same here. Pulumi got some things spectacularly right. Their Crosswalk for AWS [0] is magical, especially if you're building serverless apps using Lambda or Docker-based services on top of EKS/ECS. I'd suggest sticking to the TypeScript runtime and major clouds where the support is the best. _Full disclosure_ - Marcin at Spacelift here, and we chose to support Pulumi in addition to Terraform, so this opinion is necessarily biased. [0] https://www.pulumi.com/docs/guides/crosswalk/aws/ https://www.pulumi.com/docs/guides/crosswalk/aws/