24 ms·

Terraform 1.0

691 points by cube2222 5y ago

cube2222 5y ago
An interesting document is also what is actually covered by the 1.0.0 compatibility guarantee: https://www.terraform.io/docs/language/v1-compatibility-promises.html https://www.terraform.io/docs/language/v1-compatibility-prom...
- throwawaygo 5y ago
  The v1 guarantee is they will break your code at anytime just like before v1.
  - Pet_Ant 5y ago
    That is an unfair characterisation of the policy in the link. It is not quite clear which subsets they are talking about at times, and it's definitely not complete but there is an effort there and it looks like most cases (by volume of usage) will be unaffected; > The Terraform v1.x series will be actively maintained for at least 18 months after v1.0.
xchaotic 5y ago
It’s a symbolic step but hopefully goes a long way to convince various decision makers about long term viability of hashicorp products. I remember when a colleague didn’t want to use TF from an unknown company in his saas. His company is now gone but terraform is alive and widely used.
- pizza234 5y ago
  I think it's a very meaningful step, as it signals maturity - the platform changed significantly over the last couple of years, and it's (unfortunately but necessary) a pain to perform some upgrades, or at least, to redesign according to the new features. For example, we can't make full use of the modules flexibility which I think was added to 0.15 (module.kount anybody? :)), because it's a very painful process. Had we started using TF now, we wouldn't have had this problem. But of course, nobody's at fault here.
  - darkwater 5y ago
    module.count was added in TF 0.13 [1] but yet still what you say makes totally sense, and I really welcome a 1.0 release hoping that there won't be any more disruptive changes and revolutions in the DSL, because yeah, you definitely need to invest a lot of time in refactors/rewrites to keep it up with newer Terraform versions and language features. [1] https://github.com/hashicorp/terraform/blob/v0.13/CHANGELOG.md https://github.com/hashicorp/terraform/blob/v0.13/CHANGELOG....
  - hnlmorg 5y ago
    I think the biggest problem is that the state file is a JSON blob who's hierarchy directly maps the structure of your code in Terraform. This makes refactoring a nightmare as you're continually having to fudge the state file and/or declare that a resource defined in code relates to a resource defined in state (I forget the exact CLI flag you pass to do this off hand).
    - pizza234 5y ago
      Yes, I think is reflected into our situation. For our TF codebase, specifically, it would be greate to deduplicate modules (which is something that couldn't be done some time ago), but there is no simple way of, say, creating a new module, and slowly migrate resources into it. In particular (AFAIK), there are no tools for moving stuff around, so in addition to the TF restructuring, one also need to write scripts to manually move the resources.
      - marenkay 5y ago
        terraform state mv is working for this but yeah, a migration path in some defined way would certainly be preferred.
      - 3np 5y ago
        You're looking for 'terraform state mv'. After my first handful of these it's now as natural as refactoring and moving modules in any code-base, almost. Or if it's a big mess you can 'rm' and 'import'.
mzaccari 5y ago
Congrats to Hashicorp for this milestone! We've been using terraform for a couple of years now to manage our infra for dev/qa/prod, and aside from minor HCL changes we haven't had any major problems keeping up with the latest versions. Having the ability to rebuild everything (Kubernetes, DNS, MySQL, etc.) automatically has saved us more than once!
dablweb 5y ago
Just be careful with your state file when upgrading!
- heydonovan 5y ago
  I've gotten into the habit of manually creating a backup of the state file: # to view the state file $ aws s3 cp --quiet s3://terraform/production/terraform.tfstate /dev/stdout # to backup the state file $ aws s3 cp --quiet s3://terraform/production/terraform.tfstate > terraform.tfstate.bak
  - cube2222 5y ago
    S3 automatic object versioning is useful for that.
kevincox 5y ago
I hate Terraform with a passion but it is probably the best tool out there for managing cloud infrastructure so I use it at work with no plans to replace it. The biggest downsides are the awful half-baked language and the awkwardness of modules and passing values throughout your config. Also the staticness of providers are a serious pain, for example you can't create a kubernetes cluster then add a resource to it. The work around is to use two separate Terraform stacks which brings a lot of pain for passing values across the boundary. Furthermore you can no longer effectively plan any change that affects the boundary between the two stacks. "Luckily" Terraform's performance is so bad that you need to split the stacks anyways. The biggest feature I would like to see is the ability to dump a pure representation of your evaluated configuration. This would allow reasonable diffs in CI. There are of course complications, especially if you use `data` resources but technically it is possible to do a very good job here which would make it so much easier to make changes.
- k__ 5y ago
  I never used Terraform, I started with Vagrant, then CloudFormation, CDK, and now Pulumi. I like Pulumi the most right now. It integrates with services like Cloudflare and Auth0 and I can use TypeScript to write my code.
- mwarkentin 5y ago
  The module passing got a lot better in 0.12 when you could pass full modules or resources as outputs and vars.
- sandGorgon 5y ago
  have you tried pulumi ? what's your opinion ?
  - kevincox 5y ago
    I have not.
- Hikikomori 5y ago
  Maybe try out https://www.pulumi.com/ https://www.pulumi.com/
tristor 5y ago
I've been using Terraform for years, and I'm really glad to see it reach 1.0. Congrats to the Terraform team at Hashicorp, and thanks to you and your colleagues for consistently making the tooling that makes operations at scale possible and keeping it open source.
nautilus12 5y ago
You people hating on Terraform are spoiled. My company insists on using CloudFormation, which I hate with a passion.
- papito 5y ago
  I've used both - with having to use CF to create a particularly gnarly and sprawling environment. I constantly ran into limitations hidden behind cryptic or unrelated error messages. It was infuriating. Terraform syntax is definitely not sexy, but it's a robust piece of software, and in fact, can be used to learn better Go techniques. A total aside, but people who claim Golang is easy are full of it. It's an extremely hard language to write well at scale, and Terraform is a good example to study.
  - Thaxll 5y ago
    It took me couple of hours to write a TF module years ago, it was that easy.
- rantwasp 5y ago
  your company sounds like they know what they are doing. Cloudformation will take your infrastructure from point A to point B or roll it back in case of failure. Terraform, not so much.
  - zubnix 5y ago
    So much this. If you hate cloudformation, have a look at CDK, which allows you to programmatically define a stack in a language of your choice, instead of trying to use unreadable huge yaml to write code. I really wish terraform will one day reach the same features and maturity as cloudformation.
    - rantwasp 5y ago
      to be fair to Terraform, this is hard. It's hard when you are dealing with multiple cloud providers since you have to keep state somewhere. Network failures or underlying cloud failures are gonna impair TF in the head every time. If there is one thing TF needs to learn to do is handle failure. Right now it has that rosy yolo approach leaving you to pick up the pieces when it fails.
kerng 5y ago
Serious question. What value does Terraform provide? Two years ago I looked into it and rather then having an abstraction from cloud providers it seemed to require to still target (and code against) each one specifically. So, I was quite disappointed as I thought the value proposition was to not have to know x cloud provider specific terminologies. Any insights much appreciated. Edit: I was a little worried asking such a naive question but the comments are super useful! Thanks everyone for sharing your insights.
- mschuster91 5y ago
  > Serious question. What value does Terraform provide? Having your cloud environment documented and reproducible in a code repository instead of stuff manually clicked together in the AWS Console.
- marcinzm 5y ago
  It's better than CloudFormation (or a bunch of home grown bash scripts) and you can also modify providers beyond just the cloud host (ie: datadog alerts, database users and permissions, etc, etc.).
  - jcims 5y ago
    Just to expand on your second point, because I think it's often missed, there are a ton of 'providers' available that extend management of their products (to varying, sometimes hilariously little extent). If you're running products from any of the vendors on this list, you might be able to use terraform to manage them as well: https://registry.terraform.io/browse/providers https://registry.terraform.io/browse/providers
- matwood 5y ago
  tf specifically or what does codifying infrastructure provide?
- Dobbs 5y ago
  It makes things repeatable, organized, and most importantly checked into source control. It is actually useable unlike cloudformation which is for a nightmare of unreadable, barely editable yaml files and fifty commands to then upload and apply the files. Lets not even get into debugging or unsticking cloudformation when it breaks, something that usually requires writing a support ticket. Additionally you can build your own modules. I can have a module that is `ServiceFoo`. Pass in a param that causes it to switch between different backends. Yea I have to write the AWS and GCP part seperately, but then anything that needs `ServiceFoo` can just call the module and have the things split across both sides. You can then also do things like have your DNS in AWS, but have nodes in both GCP and AWS. Use the settings pulled from GCP to input into Route53, etc.
samsquire 5y ago
There is a dupe Terraform post on Hacker news frontpage. I'll post my comment here too :-) I recommend breaking out your terraform code into separate folders and calling them "components". Write a wrapper around the terraform script to pass in -var-file which uses an argument called ENVIRONMENT that you pass to the wrapper. I think the built in support for modules is less useful for what you actually want to do because you end up with variables spread between variables.tf, outputs.tf files. I use a tool I wrote to layer my infrastructure with layers called components and I configure it with a Graphviz file. My tool, called mazzle (previously devops-pipeline) would run parts of the graph that can run in parallel in parallel. It can also run parts of the build on SSH workers. You bring up the workers at the beginning of the build. Here's an example of a graph generated from graphviz file: https://github.com/samsquire/mazzle-starter/blob/master/architecture.dot https://github.com/samsquire/mazzle-starter/blob/master/arch... This graph brings up a hashicorp vault server, Java application, bastion proxy, consul, kubernetes, prometheus here's the graphviz file: https://github.com/samsquire/mazzle/blob/master/docs/architecture.png https://github.com/samsquire/mazzle/blob/master/docs/archite... It describes the ordering of the infrastructure, the invocation of Ansible, packer, shell scripts to set up vault etc. The idea is to be able to bring up a new environment by changing one parameter. There's a React GUI too. https://devops-pipeline.com https://devops-pipeline.com
- ciisforsuckas 5y ago
  I've been using Terragrunt to keep my Terraform DRYU in a similar manner. It's a bit of a rethink in how you structure things but I've been happy so far. https://terragrunt.gruntwork.io/ https://terragrunt.gruntwork.io/
  - whoomp12342 5y ago
    does terragrunt work with azure and GCP or just aws?
    - leetrout 5y ago
      Terragrunt extends Terraform functionality so it works with all Terraform providers.
jansan 5y ago
Can someone explain in a few words what this is and who may be interested in this? The name does not give any hints, also the discription tells me nothing: "Terraform enables you to safely and predictably create, change, and improve infrastructure. It is an open source tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned." Is this a tool for property developers?
- type_Ben_struct 5y ago
  Seems pretty clear to me based on the description. What specifically are you unsure about?
  - jansan 5y ago
    They do not mention "cloud" or "data center" once in their description. How is someone, who is not dealing with this kind of infrastructure supposed to know what they are talking about?
- HatchedLake721 5y ago
  This is a tool to manage your infrastructure (AWS/GCP/Azure/etc) as a code. You write code, apply it, cloud providers spin up resources you declared, you commit your code (infrastructure) to git. Now your infrastructure is version controlled, can be "easily" build from ground up in minutes, instead of someone doing 3124 things manually in the UI.
- Jonnax 5y ago
  You could have read more of the site or even looked it up on Wikipedia in the time it took for you to write your comment.
- PostThisTooFast 5y ago
  Of course you got modded down for a completely civil and rational comment. This title, and all titles like it, are DOUCHEY. Learn it. Know it. Live it.
traspler 5y ago
I see everyone raving about Terraform but I always found it awkward how the DSL works. It might be an improvement over stuff like CloudFormation but feels strange to move the complexity into the language. Things like the CDK which operate on top of CF feel much more natural and more flexible to me.
myroon5 5y ago
Blog has more information: https://www.hashicorp.com/blog/announcing-hashicorp-terraform-1-0-general-availability https://www.hashicorp.com/blog/announcing-hashicorp-terrafor...
ourcat 5y ago
Interestingly, I heard that Terraform's registry is hosted via Fastly. I was wondering if there was any correlation with the timing of this release and Fastly's outage earlier.
polskibus 5y ago
Does anyone use terraform for onpremise clusters? If so, what is your setup, what hypervisor do you use it with? Are you happy with it? Or maybe you would rather replace it with a set of ansible roles?
- chousuke 5y ago
  I set up Terraform with libvirt for my local VM host; I think it's much better suited for managing infrastructure components than Ansible is. Outside personal stuff, I've done a few environments where the (mostly unchanging) infrastructure is set up with Terraform and then configuration and operations (like upgrades) are orchestrated with Ansible, and it works well. Now, I bet someone might be tempted to claim you should never even need to upgrade VM instances and immutable infrastructure solves everything, but sometimes it's just ridiculously simpler to do in-place upgrades; orchestrating image building, testing and deployment is not easier than running an Ansible playbook to do in-place upgrades unless you already have infrastructure that does it for you. If the software you're installing is properly written and provided via OS package managenment, often you just don't gain enough benefit from immutable systems considering the overhead.
- Xophmeister 5y ago
  We have an on-site OpenStack cluster and use Terraform in an ad hoc way for managing (some) infrastructure. It's by far the easiest way to do so, opposed to OpenStack's API and SDK (the latter of which is so poorly documented it beggar's belief!). Ansible is usually used in tandem with Terraform, to decouple the infrastructure and configuration management.
- BigGreenTurtle 5y ago
  We use it for provisioning vsphere VMs with all of the provisioning done through cloud-init. Can't say I like cloud-init but our onprem stuff is pretty simple and almost all of the VMs can be rebuilt if a change is needed so it works well enough but I'd probably use ansible if I were starting new.
borplk 5y ago
I recently had to do a piece of AWS work that required cross-account resources (create certificate in one account with ACM, set DNS entries on Route53 in another account). Not sure about pulumi, but AWS CDK and CloudFormation can't handle that as one step (there are some horrific hacks). With Terraform it's absolutely trivial. I was liking CDK up to that point, but that limitation is a complete deal breaker for me. Had to come back to my old friend Terraform.
- ciisforsuckas 5y ago
  There are dozens of these examples. I switched a few years back after AWS released the automataic HTTP to HTTPS redirect functionality in ALBs and 6 months after release it still wasn't supported in CF. Terraform isn't perfect and it still has a ton of isues but it's rate of innovation is way a head of CF.
- Aperocky 5y ago
  Not sure if this official guidance is a 'horrific hack' but there are official AWS guidance on how to do this: https://aws.amazon.com/blogs/infrastructure-and-automation/multiple-account-multiple-region-aws-cloudformation/ https://aws.amazon.com/blogs/infrastructure-and-automation/m...
  - borplk 5y ago
    Thank you, and yes in my books that's a horrific hack and too much effort compared to the 5 lines of code I just added to Terraform to get the job done.
    - Aperocky 5y ago
      I think the root reason for this is AWS stacks have to authenticate from a single origin (i.e. user credentials) instead of Terraform which can utilize multiple auths. This makes it necessarily complicated for AWS stacks when it tries to deploy another stack in another account, as the stacks are also account based. (but I imagine terraform stacks isn't).
- 5y ago
truth_seeker 5y ago
After i was introduced to Pulumi, i felt at home ... there is no going back to Terraform.
etxm 5y ago
People tend to complain about HCL a lot, I think it’s a great language for infrastructure. I don’t want a “real programming language” for provisioning infrastructure. I feel like every time I’ve seen someone “need” a real programming language, that there is a _better_ way to do the task at hand with HCL. That being said, there are some ugly bits. 1. Remote state as a data source means your infra is broken, you just don’t know it yet. Two apply’s have to occur to get your infra in the correct state, but they are separated by an arbitrary amount of time between executions. Even if you automate it with CI/CD, your second root module could be broken until run since it depends on the output of the other module. 2. Public modules are absolute garbage. Go find the best one, it’s trash. Here is why, 10-20 orgs all come in and tweak the module to work for them. You’ll often see 1-10 resources in a module (sometimes more), but the module will end up with more _input complexity_ than the underlying resources. Sometimes even more inputs than all the original resources combined! In the end, you get a module that “works” for everyone, with a half baked “DRY abstraction” for N number of organizations. 3. Organizing code is hard, because we often don’t fully consider environments/workspaces, infrastructure ownership, change management, and other sociotechnical concerns. I think Terraform and IaC in general is the epitome of Conway’s Law and when the (changing) social structure of the organization isn’t followed, the code gets harder to work with. This point is at odds with #1 above. 4. People tend to think “terraform apply” is a magic transactional boundary around your infrastructure. If it applies, it worked!!! But in reality, if modules aren’t crafted correctly they can “apply” cleanly, but still introduce an outage while they are executing. All that said, I’m excited for the 1.0 release. I love terraform. Thanks to all (except module authors) for the hard work.
- SpencerBratman 5y ago
  hey this is super random and not related to your comment above, but I saw your comment about honey and how you worked in this space. I was wondering if you'd be open to chatting about your experience in this space. (working on something in the affiliate space). Really appreciate it! spencerbratman [@] gmail.com
- joombaga 5y ago
  I'm not sure I understand #1. Your points would still apply if a resource (e.g. aws_instance.foo) is created in one module and then referenced as a data source (e.g. data.aws_instance.foo) in another module. Are you suggesting remote state is different? Or would you also advise against referencing data source attributes from resources created in other modules?
u678u 5y ago
One afternoon with Terraform and you'll want to give up cloud and get your own datacenter again.
- basilgohar 5y ago
  I have a highly fuzzy result in my sarcasm detection here. It's because I can understand this to mean either that: 1. Terraform is so difficult managing cloud services that you'll give it all up and run for the hills of bare metal once again. - or - 2. it's so good you'll want to swear off the cloud providers and switch to running your own infra using Terraform and not the cloud services own tools. Given other comments I can easily see this going both ways.
  - u678u 5y ago
    Yeah sorry sarcasm doesn't do well via text. I did mean 1
- farisjarrah 5y ago
  Funnily enough, lots of organizations use Terraform for their own data centers!
solatic 5y ago
Terraform is such an underappreciated tool. It seems like so much of the hate surrounds HCL1 (back in Terraform before 0.12) and doesn't reflect modern Terraform. For example, after introducing `for_each` and dynamic blocks, it's possible to nearly entirely ditch variables files and local modules, and just add more infrastructure by editing a local YAML file. The only variables your Terraform code should have should be credentials / other secrets that are not loaded from environment variables by providers. A great public example of this usage pattern is supplied by https://github.com/concourse/governance https://github.com/concourse/governance to manage their GitHub repositories.
- mhitza 5y ago
  For me it's less about HCL annoyance nowadays, but more about discoverability. Using Pulumi I no longer have to memorize resource properties because I get IDE autocompletion.
  - giaour 5y ago
    Autocomplete for Terraform/HCL is available, too, though you do have to use specific tooling (e.g., VS Code with the Terraform extension) rather than the same tools you use to work on JS.
    - jen20 5y ago
      The specific tool recommended here is simply not very good - despite the language server efforts, the IntelliJ HCL plugin is worlds apart from the VS Code tooling (and has been for years). Unfortunately it's not open source - if it were it would mean the availability of an open source implementation of a production quality HCL2 parser for the JVM ecosystem, which would be very useful.
      - sverhagen 5y ago
        I have really liked the Terraform support in IntelliJ, but the "HashiCorp Terraform / HCL language support" plugin seems to have had its most-recent release on July 17, 2020[1]. And it clearly does not support a bunch of the newer constructs and properties. And that's just very unfortunate. [1] https://plugins.jetbrains.com/plugin/7808-hashicorp-terraform--hcl-language-support https://plugins.jetbrains.com/plugin/7808-hashicorp-terrafor...
nprateem 5y ago
Maybe they'll finally adopt meaningful semver now
openquery 5y ago
Congrats to the talented people at Hashicorp. I love Terraform and have used it for years (before 0.12 I think). The workflow, meaningful diffs and reproducible 'infrastructure-as-code' gave a user experience that really was a massive step up to what I was used to (basically cloud console and scripts in CI). In fact the Terraform workflow / philosophy inspired some of the design of an OSS 'data-as-code' tool (https://www.getsynth.com/ https://www.getsynth.com/) that we're building a company around. We wanted to use HCL instead of JSON for our config to start off with, but the Rust HCL parsers when we started the project weren't really robust so we settled. Anyway, congratulations Hashicorp!
nikolay 5y ago
So, v1.0, but still no dynamic providers, resulting in piles of copypasta especially when creating Kubernetes clusters and wanting to do something initially with them using the Kubernetes provider. So sad! Secrets are still stored in the state without encryption when retrieving them from the CLI. Last, but not least - even when using their commercial products, there's no way to do phased workspace, i.e. you do something in one workspace, then in another, then you continue in the first one, etc. Last, but not least - you can't override sensitive variables when importing using Terraform Cloud or Enterprise!
spicyramen 5y ago
Our customers increasingly use Terraform modules to deploy our product. Thanks Hashicorp.
harryvederci 5y ago
Love the tool, hate the fact that they still work with a CLA [0] If anyone at HashiCorp is reading this, could you guys consider changing to a DCO? [1] [0] https://github.com/hashicorp/terraform/blob/main/.github/CONTRIBUTING.md#pr-checks https://github.com/hashicorp/terraform/blob/main/.github/CON... [1] https://drewdevault.com/2021/04/12/DCO.html https://drewdevault.com/2021/04/12/DCO.html
sylens 5y ago
I enjoy Terraform, I just wish there was a more graceful way of setting up a new module to use backend state from the get-go. Having to create the resources with local state first, then re-run terraform init after adding the backend configuration block, just gets really annoying. Small complaint in the grand scheme of things, though.
saurabhnanda 5y ago
I've been sitting on the fence wrt Terraform and other such tools for quite some time now. After being _forced_ to finally write massive k8s YAML files (and ansible YAML files) for a consulting gig, I've been wondering whether these tools should be developed as _libraries_, that you glue together using a full-fledged programming language, instead of shoe-horning a programming language in YAML. For example, could the following be library functions that you could glue together in the programming language of your choice: (a) get current state of infra, (b) calculate diff between desired state and current state, (c) perform a single step (safely) that represents a granular change in infra, (d) perform a series of steps representing infra changes with safe rollback? Does something like this already exist?
- endymi0n 5y ago
  You‘re pretty much describing the idea behind Pulumi which got a lot of traction lately. Personally, I‘m still undecided on whether the unlimited freedom of a fully fledged programming language is a good or a bad idea in terms of footgun potential. I‘m also still a bit unsure whether to play early adopter for an extremely hyped VC open core project even though it feels tempting. Experiences appreciated!
  - saurabhnanda 5y ago
    Pulumi sounds interesting. Spent 10 mins with their marketing website and I'm not very clear whether it is a standalone set of libraries, or do they only work in conjunction with their cloud services. Do you know?
    - slow_donkey 5y ago
      You can use it standalone and manage the state yourself. Looks like they actually might have added locking recently with https://github.com/pulumi/pulumi/pull/2697 https://github.com/pulumi/pulumi/pull/2697 but I haven't looked deeply
    - haolez 5y ago
      I've been using Pulumi for a new project after using Terraform for a long time. It's a little weird at first, but then it clicks and actually feels quite nice. The Input/Output logic with its async behavior is the weird part, but it works fine when you understand how it works. The only (minor) problem that I've seen in it is that the JavaScript/TypeScript support seems more mature and featureful than the other backends. So, I'll simply use that.
joe200 5y ago
IMHO something like Crossplane is the future for infra management.
juliosueiras 5y ago
I do like how most people here sort of forgot that a decent amount of people in ops(especially in bigger enterprise company) are not programmer and at most have shell scripting experience and thats about it, telling them to "use a real programming language" is going to create some "fun" issues (atleast HCL is consistent)
flippinburgers 5y ago
Please give me a vim plugin that allows me to easily move through terraform files as opposed to being forced to grep for relationships. As it stands I hate dealing with terraform because it is horrifyingly undiscoverable.
- jamesappledev 5y ago
  This has less to do with vim than with Terraforms poor LSP support. Vim/Neovim has had LSP support for some time with plugins and now built in natively. I use COC vim as it's the fastest to get started and I rarely have to do much config as it's based on VSCode and comes with sane bindings for go-to-def, refactoring and more. https://github.com/neoclide/coc.nvim https://github.com/neoclide/coc.nvim https://github.com/prabirshrestha/vim-lsp https://github.com/prabirshrestha/vim-lsp https://github.com/neovim/nvim-lspconfig https://github.com/neovim/nvim-lspconfig You can try to use either of these implementations: https://github.com/juliosueiras/terraform-lsp https://github.com/juliosueiras/terraform-lsp https://github.com/hashicorp/terraform-ls https://github.com/hashicorp/terraform-ls These are both fairly limited but you can see every editor (except intellij) uses this under the hood. I've used them at companies with 300+ terraform repos and have never had much of an issue navigating/understanding TF through Vim.
  - flippinburgers 5y ago
    By no means am I placing the blame at vim's feet. I know it is a terraform problem. Do those projects allow me to follow a user defined variable to its definition?
abriosi 5y ago
I have a love & hate relationship with terraform. It's so frustrating when you can't create a behavior. But the joy of orchestrating infrastructure at scale with code is overwhelming <3
PostThisTooFast 5y ago
Try saying WTF it is in the title. Obscurity isn't cool, but it sure is trendy on this site. It's douchey.
jamesmishra 5y ago
I believe in the Terraform way of doing things. A lot of other people dislike the Terraform language, and then they use Pulumi because it allows them to write infrastructure in Python or JavaScript. But I specifically DO NOT WANT my company's infrastructure to be written in a Turing-complete dynamically-typed language. I believe the Terraform language is safer. However, one thing I don't like about Terraform is that it provides a lot of low-level APIs for cloud providers that can take a lot of glue code to string together into a real PaaS. I solved this at my company by writing https://provose.com https://provose.com -- a Terraform module that a high-level API for configuring containers, buckets, databases, and distributed filesystems. Provose understands what you want to deploy and automatically figures out the needed VPC settings, security groups, IAM roles/policies/etc, Route 53 records, ACM certificates, and load balancer settings. Apologies for the self promotion, but if you decide to try Provose, I'd be happy to help you through any issues you face :)
- h506001 5y ago
  Wow, really impressed by all the work, website, and write up being just one contributor!
bionhoward 5y ago
I'd love to see more pass-by-reference in Terraform because it could simplify the API substantially. Right now you gotta figure out if you need to pass an id, name, or arn. forces a lot of reading docs and tight coupling. if one could instantiate a resource by passing other connected resources into it by reference, then provider APIs could pull info they need, and could be refactored without affecting devs

691 points by cube2222 5y ago

An interesting document is also what is actually covered by the 1.0.0 compatibility guarantee: https://www.terraform.io/docs/language/v1-compatibility-promises.html https://www.terraform.io/docs/language/v1-compatibility-prom...

throwawaygo 5y ago
The v1 guarantee is they will break your code at anytime just like before v1.
- Pet_Ant 5y ago
  That is an unfair characterisation of the policy in the link. It is not quite clear which subsets they are talking about at times, and it's definitely not complete but there is an effort there and it looks like most cases (by volume of usage) will be unaffected; > The Terraform v1.x series will be actively maintained for at least 18 months after v1.0.

xchaotic 5y ago

It’s a symbolic step but hopefully goes a long way to convince various decision makers about long term viability of hashicorp products. I remember when a colleague didn’t want to use TF from an unknown company in his saas. His company is now gone but terraform is alive and widely used.

pizza234 5y ago
I think it's a very meaningful step, as it signals maturity - the platform changed significantly over the last couple of years, and it's (unfortunately but necessary) a pain to perform some upgrades, or at least, to redesign according to the new features. For example, we can't make full use of the modules flexibility which I think was added to 0.15 (module.kount anybody? :)), because it's a very painful process. Had we started using TF now, we wouldn't have had this problem. But of course, nobody's at fault here.
- darkwater 5y ago
  module.count was added in TF 0.13 [1] but yet still what you say makes totally sense, and I really welcome a 1.0 release hoping that there won't be any more disruptive changes and revolutions in the DSL, because yeah, you definitely need to invest a lot of time in refactors/rewrites to keep it up with newer Terraform versions and language features. [1] https://github.com/hashicorp/terraform/blob/v0.13/CHANGELOG.md https://github.com/hashicorp/terraform/blob/v0.13/CHANGELOG....
- hnlmorg 5y ago
  I think the biggest problem is that the state file is a JSON blob who's hierarchy directly maps the structure of your code in Terraform. This makes refactoring a nightmare as you're continually having to fudge the state file and/or declare that a resource defined in code relates to a resource defined in state (I forget the exact CLI flag you pass to do this off hand).
  - pizza234 5y ago
    Yes, I think is reflected into our situation. For our TF codebase, specifically, it would be greate to deduplicate modules (which is something that couldn't be done some time ago), but there is no simple way of, say, creating a new module, and slowly migrate resources into it. In particular (AFAIK), there are no tools for moving stuff around, so in addition to the TF restructuring, one also need to write scripts to manually move the resources.
    - marenkay 5y ago
      terraform state mv is working for this but yeah, a migration path in some defined way would certainly be preferred.
    - 3np 5y ago
      You're looking for 'terraform state mv'. After my first handful of these it's now as natural as refactoring and moving modules in any code-base, almost. Or if it's a big mess you can 'rm' and 'import'.

mzaccari 5y ago

Congrats to Hashicorp for this milestone! We've been using terraform for a couple of years now to manage our infra for dev/qa/prod, and aside from minor HCL changes we haven't had any major problems keeping up with the latest versions. Having the ability to rebuild everything (Kubernetes, DNS, MySQL, etc.) automatically has saved us more than once!

dablweb 5y ago

Just be careful with your state file when upgrading!

heydonovan 5y ago
I've gotten into the habit of manually creating a backup of the state file: # to view the state file $ aws s3 cp --quiet s3://terraform/production/terraform.tfstate /dev/stdout # to backup the state file $ aws s3 cp --quiet s3://terraform/production/terraform.tfstate > terraform.tfstate.bak
- cube2222 5y ago
  S3 automatic object versioning is useful for that.

kevincox 5y ago

I hate Terraform with a passion but it is probably the best tool out there for managing cloud infrastructure so I use it at work with no plans to replace it. The biggest downsides are the awful half-baked language and the awkwardness of modules and passing values throughout your config. Also the staticness of providers are a serious pain, for example you can't create a kubernetes cluster then add a resource to it. The work around is to use two separate Terraform stacks which brings a lot of pain for passing values across the boundary. Furthermore you can no longer effectively plan any change that affects the boundary between the two stacks. "Luckily" Terraform's performance is so bad that you need to split the stacks anyways. The biggest feature I would like to see is the ability to dump a pure representation of your evaluated configuration. This would allow reasonable diffs in CI. There are of course complications, especially if you use `data` resources but technically it is possible to do a very good job here which would make it so much easier to make changes.

k__ 5y ago
I never used Terraform, I started with Vagrant, then CloudFormation, CDK, and now Pulumi. I like Pulumi the most right now. It integrates with services like Cloudflare and Auth0 and I can use TypeScript to write my code.
mwarkentin 5y ago
The module passing got a lot better in 0.12 when you could pass full modules or resources as outputs and vars.
sandGorgon 5y ago
have you tried pulumi ? what's your opinion ?
- kevincox 5y ago
  I have not.
Hikikomori 5y ago
Maybe try out https://www.pulumi.com/ https://www.pulumi.com/

tristor 5y ago

I've been using Terraform for years, and I'm really glad to see it reach 1.0. Congrats to the Terraform team at Hashicorp, and thanks to you and your colleagues for consistently making the tooling that makes operations at scale possible and keeping it open source.

nautilus12 5y ago

You people hating on Terraform are spoiled. My company insists on using CloudFormation, which I hate with a passion.

papito 5y ago
I've used both - with having to use CF to create a particularly gnarly and sprawling environment. I constantly ran into limitations hidden behind cryptic or unrelated error messages. It was infuriating. Terraform syntax is definitely not sexy, but it's a robust piece of software, and in fact, can be used to learn better Go techniques. A total aside, but people who claim Golang is easy are full of it. It's an extremely hard language to write well at scale, and Terraform is a good example to study.
- Thaxll 5y ago
  It took me couple of hours to write a TF module years ago, it was that easy.
rantwasp 5y ago
your company sounds like they know what they are doing. Cloudformation will take your infrastructure from point A to point B or roll it back in case of failure. Terraform, not so much.
- zubnix 5y ago
  So much this. If you hate cloudformation, have a look at CDK, which allows you to programmatically define a stack in a language of your choice, instead of trying to use unreadable huge yaml to write code. I really wish terraform will one day reach the same features and maturity as cloudformation.
  - rantwasp 5y ago
    to be fair to Terraform, this is hard. It's hard when you are dealing with multiple cloud providers since you have to keep state somewhere. Network failures or underlying cloud failures are gonna impair TF in the head every time. If there is one thing TF needs to learn to do is handle failure. Right now it has that rosy yolo approach leaving you to pick up the pieces when it fails.

kerng 5y ago

Serious question. What value does Terraform provide? Two years ago I looked into it and rather then having an abstraction from cloud providers it seemed to require to still target (and code against) each one specifically. So, I was quite disappointed as I thought the value proposition was to not have to know x cloud provider specific terminologies. Any insights much appreciated. Edit: I was a little worried asking such a naive question but the comments are super useful! Thanks everyone for sharing your insights.

mschuster91 5y ago
> Serious question. What value does Terraform provide? Having your cloud environment documented and reproducible in a code repository instead of stuff manually clicked together in the AWS Console.
marcinzm 5y ago
It's better than CloudFormation (or a bunch of home grown bash scripts) and you can also modify providers beyond just the cloud host (ie: datadog alerts, database users and permissions, etc, etc.).
- jcims 5y ago
  Just to expand on your second point, because I think it's often missed, there are a ton of 'providers' available that extend management of their products (to varying, sometimes hilariously little extent). If you're running products from any of the vendors on this list, you might be able to use terraform to manage them as well: https://registry.terraform.io/browse/providers https://registry.terraform.io/browse/providers
matwood 5y ago
tf specifically or what does codifying infrastructure provide?
Dobbs 5y ago
It makes things repeatable, organized, and most importantly checked into source control. It is actually useable unlike cloudformation which is for a nightmare of unreadable, barely editable yaml files and fifty commands to then upload and apply the files. Lets not even get into debugging or unsticking cloudformation when it breaks, something that usually requires writing a support ticket. Additionally you can build your own modules. I can have a module that is `ServiceFoo`. Pass in a param that causes it to switch between different backends. Yea I have to write the AWS and GCP part seperately, but then anything that needs `ServiceFoo` can just call the module and have the things split across both sides. You can then also do things like have your DNS in AWS, but have nodes in both GCP and AWS. Use the settings pulled from GCP to input into Route53, etc.

samsquire 5y ago

There is a dupe Terraform post on Hacker news frontpage. I'll post my comment here too :-) I recommend breaking out your terraform code into separate folders and calling them "components". Write a wrapper around the terraform script to pass in -var-file which uses an argument called ENVIRONMENT that you pass to the wrapper. I think the built in support for modules is less useful for what you actually want to do because you end up with variables spread between variables.tf, outputs.tf files. I use a tool I wrote to layer my infrastructure with layers called components and I configure it with a Graphviz file. My tool, called mazzle (previously devops-pipeline) would run parts of the graph that can run in parallel in parallel. It can also run parts of the build on SSH workers. You bring up the workers at the beginning of the build. Here's an example of a graph generated from graphviz file: https://github.com/samsquire/mazzle-starter/blob/master/architecture.dot https://github.com/samsquire/mazzle-starter/blob/master/arch... This graph brings up a hashicorp vault server, Java application, bastion proxy, consul, kubernetes, prometheus here's the graphviz file: https://github.com/samsquire/mazzle/blob/master/docs/architecture.png https://github.com/samsquire/mazzle/blob/master/docs/archite... It describes the ordering of the infrastructure, the invocation of Ansible, packer, shell scripts to set up vault etc. The idea is to be able to bring up a new environment by changing one parameter. There's a React GUI too. https://devops-pipeline.com https://devops-pipeline.com

ciisforsuckas 5y ago
I've been using Terragrunt to keep my Terraform DRYU in a similar manner. It's a bit of a rethink in how you structure things but I've been happy so far. https://terragrunt.gruntwork.io/ https://terragrunt.gruntwork.io/
- whoomp12342 5y ago
  does terragrunt work with azure and GCP or just aws?
  - leetrout 5y ago
    Terragrunt extends Terraform functionality so it works with all Terraform providers.

jansan 5y ago

Can someone explain in a few words what this is and who may be interested in this? The name does not give any hints, also the discription tells me nothing: "Terraform enables you to safely and predictably create, change, and improve infrastructure. It is an open source tool that codifies APIs into declarative configuration files that can be shared amongst team members, treated as code, edited, reviewed, and versioned." Is this a tool for property developers?

type_Ben_struct 5y ago
Seems pretty clear to me based on the description. What specifically are you unsure about?
- jansan 5y ago
  They do not mention "cloud" or "data center" once in their description. How is someone, who is not dealing with this kind of infrastructure supposed to know what they are talking about?
HatchedLake721 5y ago
This is a tool to manage your infrastructure (AWS/GCP/Azure/etc) as a code. You write code, apply it, cloud providers spin up resources you declared, you commit your code (infrastructure) to git. Now your infrastructure is version controlled, can be "easily" build from ground up in minutes, instead of someone doing 3124 things manually in the UI.
Jonnax 5y ago
You could have read more of the site or even looked it up on Wikipedia in the time it took for you to write your comment.
PostThisTooFast 5y ago
Of course you got modded down for a completely civil and rational comment. This title, and all titles like it, are DOUCHEY. Learn it. Know it. Live it.

traspler 5y ago

I see everyone raving about Terraform but I always found it awkward how the DSL works. It might be an improvement over stuff like CloudFormation but feels strange to move the complexity into the language. Things like the CDK which operate on top of CF feel much more natural and more flexible to me.

myroon5 5y ago

Blog has more information: https://www.hashicorp.com/blog/announcing-hashicorp-terraform-1-0-general-availability https://www.hashicorp.com/blog/announcing-hashicorp-terrafor...

ourcat 5y ago

Interestingly, I heard that Terraform's registry is hosted via Fastly. I was wondering if there was any correlation with the timing of this release and Fastly's outage earlier.

polskibus 5y ago

Does anyone use terraform for onpremise clusters? If so, what is your setup, what hypervisor do you use it with? Are you happy with it? Or maybe you would rather replace it with a set of ansible roles?

chousuke 5y ago
I set up Terraform with libvirt for my local VM host; I think it's much better suited for managing infrastructure components than Ansible is. Outside personal stuff, I've done a few environments where the (mostly unchanging) infrastructure is set up with Terraform and then configuration and operations (like upgrades) are orchestrated with Ansible, and it works well. Now, I bet someone might be tempted to claim you should never even need to upgrade VM instances and immutable infrastructure solves everything, but sometimes it's just ridiculously simpler to do in-place upgrades; orchestrating image building, testing and deployment is not easier than running an Ansible playbook to do in-place upgrades unless you already have infrastructure that does it for you. If the software you're installing is properly written and provided via OS package managenment, often you just don't gain enough benefit from immutable systems considering the overhead.
Xophmeister 5y ago
We have an on-site OpenStack cluster and use Terraform in an ad hoc way for managing (some) infrastructure. It's by far the easiest way to do so, opposed to OpenStack's API and SDK (the latter of which is so poorly documented it beggar's belief!). Ansible is usually used in tandem with Terraform, to decouple the infrastructure and configuration management.
BigGreenTurtle 5y ago
We use it for provisioning vsphere VMs with all of the provisioning done through cloud-init. Can't say I like cloud-init but our onprem stuff is pretty simple and almost all of the VMs can be rebuilt if a change is needed so it works well enough but I'd probably use ansible if I were starting new.

borplk 5y ago

I recently had to do a piece of AWS work that required cross-account resources (create certificate in one account with ACM, set DNS entries on Route53 in another account). Not sure about pulumi, but AWS CDK and CloudFormation can't handle that as one step (there are some horrific hacks). With Terraform it's absolutely trivial. I was liking CDK up to that point, but that limitation is a complete deal breaker for me. Had to come back to my old friend Terraform.

ciisforsuckas 5y ago
There are dozens of these examples. I switched a few years back after AWS released the automataic HTTP to HTTPS redirect functionality in ALBs and 6 months after release it still wasn't supported in CF. Terraform isn't perfect and it still has a ton of isues but it's rate of innovation is way a head of CF.
Aperocky 5y ago
Not sure if this official guidance is a 'horrific hack' but there are official AWS guidance on how to do this: https://aws.amazon.com/blogs/infrastructure-and-automation/multiple-account-multiple-region-aws-cloudformation/ https://aws.amazon.com/blogs/infrastructure-and-automation/m...
- borplk 5y ago
  Thank you, and yes in my books that's a horrific hack and too much effort compared to the 5 lines of code I just added to Terraform to get the job done.
  - Aperocky 5y ago
    I think the root reason for this is AWS stacks have to authenticate from a single origin (i.e. user credentials) instead of Terraform which can utilize multiple auths. This makes it necessarily complicated for AWS stacks when it tries to deploy another stack in another account, as the stacks are also account based. (but I imagine terraform stacks isn't).
5y ago

truth_seeker 5y ago

After i was introduced to Pulumi, i felt at home ... there is no going back to Terraform.

etxm 5y ago

People tend to complain about HCL a lot, I think it’s a great language for infrastructure. I don’t want a “real programming language” for provisioning infrastructure. I feel like every time I’ve seen someone “need” a real programming language, that there is a _better_ way to do the task at hand with HCL. That being said, there are some ugly bits. 1. Remote state as a data source means your infra is broken, you just don’t know it yet. Two apply’s have to occur to get your infra in the correct state, but they are separated by an arbitrary amount of time between executions. Even if you automate it with CI/CD, your second root module could be broken until run since it depends on the output of the other module. 2. Public modules are absolute garbage. Go find the best one, it’s trash. Here is why, 10-20 orgs all come in and tweak the module to work for them. You’ll often see 1-10 resources in a module (sometimes more), but the module will end up with more _input complexity_ than the underlying resources. Sometimes even more inputs than all the original resources combined! In the end, you get a module that “works” for everyone, with a half baked “DRY abstraction” for N number of organizations. 3. Organizing code is hard, because we often don’t fully consider environments/workspaces, infrastructure ownership, change management, and other sociotechnical concerns. I think Terraform and IaC in general is the epitome of Conway’s Law and when the (changing) social structure of the organization isn’t followed, the code gets harder to work with. This point is at odds with #1 above. 4. People tend to think “terraform apply” is a magic transactional boundary around your infrastructure. If it applies, it worked!!! But in reality, if modules aren’t crafted correctly they can “apply” cleanly, but still introduce an outage while they are executing. All that said, I’m excited for the 1.0 release. I love terraform. Thanks to all (except module authors) for the hard work.

SpencerBratman 5y ago
hey this is super random and not related to your comment above, but I saw your comment about honey and how you worked in this space. I was wondering if you'd be open to chatting about your experience in this space. (working on something in the affiliate space). Really appreciate it! spencerbratman [@] gmail.com
joombaga 5y ago
I'm not sure I understand #1. Your points would still apply if a resource (e.g. aws_instance.foo) is created in one module and then referenced as a data source (e.g. data.aws_instance.foo) in another module. Are you suggesting remote state is different? Or would you also advise against referencing data source attributes from resources created in other modules?

u678u 5y ago

One afternoon with Terraform and you'll want to give up cloud and get your own datacenter again.

basilgohar 5y ago
I have a highly fuzzy result in my sarcasm detection here. It's because I can understand this to mean either that: 1. Terraform is so difficult managing cloud services that you'll give it all up and run for the hills of bare metal once again. - or - 2. it's so good you'll want to swear off the cloud providers and switch to running your own infra using Terraform and not the cloud services own tools. Given other comments I can easily see this going both ways.
- u678u 5y ago
  Yeah sorry sarcasm doesn't do well via text. I did mean 1
farisjarrah 5y ago
Funnily enough, lots of organizations use Terraform for their own data centers!

solatic 5y ago

Terraform is such an underappreciated tool. It seems like so much of the hate surrounds HCL1 (back in Terraform before 0.12) and doesn't reflect modern Terraform. For example, after introducing `for_each` and dynamic blocks, it's possible to nearly entirely ditch variables files and local modules, and just add more infrastructure by editing a local YAML file. The only variables your Terraform code should have should be credentials / other secrets that are not loaded from environment variables by providers. A great public example of this usage pattern is supplied by https://github.com/concourse/governance https://github.com/concourse/governance to manage their GitHub repositories.

mhitza 5y ago
For me it's less about HCL annoyance nowadays, but more about discoverability. Using Pulumi I no longer have to memorize resource properties because I get IDE autocompletion.
- giaour 5y ago
  Autocomplete for Terraform/HCL is available, too, though you do have to use specific tooling (e.g., VS Code with the Terraform extension) rather than the same tools you use to work on JS.
  - jen20 5y ago
    The specific tool recommended here is simply not very good - despite the language server efforts, the IntelliJ HCL plugin is worlds apart from the VS Code tooling (and has been for years). Unfortunately it's not open source - if it were it would mean the availability of an open source implementation of a production quality HCL2 parser for the JVM ecosystem, which would be very useful.
    - sverhagen 5y ago
      I have really liked the Terraform support in IntelliJ, but the "HashiCorp Terraform / HCL language support" plugin seems to have had its most-recent release on July 17, 2020[1]. And it clearly does not support a bunch of the newer constructs and properties. And that's just very unfortunate. [1] https://plugins.jetbrains.com/plugin/7808-hashicorp-terraform--hcl-language-support https://plugins.jetbrains.com/plugin/7808-hashicorp-terrafor...

nprateem 5y ago

Maybe they'll finally adopt meaningful semver now

openquery 5y ago

Congrats to the talented people at Hashicorp. I love Terraform and have used it for years (before 0.12 I think). The workflow, meaningful diffs and reproducible 'infrastructure-as-code' gave a user experience that really was a massive step up to what I was used to (basically cloud console and scripts in CI). In fact the Terraform workflow / philosophy inspired some of the design of an OSS 'data-as-code' tool (https://www.getsynth.com/ https://www.getsynth.com/) that we're building a company around. We wanted to use HCL instead of JSON for our config to start off with, but the Rust HCL parsers when we started the project weren't really robust so we settled. Anyway, congratulations Hashicorp!

nikolay 5y ago

So, v1.0, but still no dynamic providers, resulting in piles of copypasta especially when creating Kubernetes clusters and wanting to do something initially with them using the Kubernetes provider. So sad! Secrets are still stored in the state without encryption when retrieving them from the CLI. Last, but not least - even when using their commercial products, there's no way to do phased workspace, i.e. you do something in one workspace, then in another, then you continue in the first one, etc. Last, but not least - you can't override sensitive variables when importing using Terraform Cloud or Enterprise!

spicyramen 5y ago

Our customers increasingly use Terraform modules to deploy our product. Thanks Hashicorp.

harryvederci 5y ago

Love the tool, hate the fact that they still work with a CLA [0] If anyone at HashiCorp is reading this, could you guys consider changing to a DCO? [1] [0] https://github.com/hashicorp/terraform/blob/main/.github/CONTRIBUTING.md#pr-checks https://github.com/hashicorp/terraform/blob/main/.github/CON... [1] https://drewdevault.com/2021/04/12/DCO.html https://drewdevault.com/2021/04/12/DCO.html

sylens 5y ago

I enjoy Terraform, I just wish there was a more graceful way of setting up a new module to use backend state from the get-go. Having to create the resources with local state first, then re-run terraform init after adding the backend configuration block, just gets really annoying. Small complaint in the grand scheme of things, though.

saurabhnanda 5y ago

I've been sitting on the fence wrt Terraform and other such tools for quite some time now. After being _forced_ to finally write massive k8s YAML files (and ansible YAML files) for a consulting gig, I've been wondering whether these tools should be developed as _libraries_, that you glue together using a full-fledged programming language, instead of shoe-horning a programming language in YAML. For example, could the following be library functions that you could glue together in the programming language of your choice: (a) get current state of infra, (b) calculate diff between desired state and current state, (c) perform a single step (safely) that represents a granular change in infra, (d) perform a series of steps representing infra changes with safe rollback? Does something like this already exist?

endymi0n 5y ago
You‘re pretty much describing the idea behind Pulumi which got a lot of traction lately. Personally, I‘m still undecided on whether the unlimited freedom of a fully fledged programming language is a good or a bad idea in terms of footgun potential. I‘m also still a bit unsure whether to play early adopter for an extremely hyped VC open core project even though it feels tempting. Experiences appreciated!
- saurabhnanda 5y ago
  Pulumi sounds interesting. Spent 10 mins with their marketing website and I'm not very clear whether it is a standalone set of libraries, or do they only work in conjunction with their cloud services. Do you know?
  - slow_donkey 5y ago
    You can use it standalone and manage the state yourself. Looks like they actually might have added locking recently with https://github.com/pulumi/pulumi/pull/2697 https://github.com/pulumi/pulumi/pull/2697 but I haven't looked deeply
  - haolez 5y ago
    I've been using Pulumi for a new project after using Terraform for a long time. It's a little weird at first, but then it clicks and actually feels quite nice. The Input/Output logic with its async behavior is the weird part, but it works fine when you understand how it works. The only (minor) problem that I've seen in it is that the JavaScript/TypeScript support seems more mature and featureful than the other backends. So, I'll simply use that.

joe200 5y ago

IMHO something like Crossplane is the future for infra management.

juliosueiras 5y ago

I do like how most people here sort of forgot that a decent amount of people in ops(especially in bigger enterprise company) are not programmer and at most have shell scripting experience and thats about it, telling them to "use a real programming language" is going to create some "fun" issues (atleast HCL is consistent)

flippinburgers 5y ago

Please give me a vim plugin that allows me to easily move through terraform files as opposed to being forced to grep for relationships. As it stands I hate dealing with terraform because it is horrifyingly undiscoverable.

jamesappledev 5y ago
This has less to do with vim than with Terraforms poor LSP support. Vim/Neovim has had LSP support for some time with plugins and now built in natively. I use COC vim as it's the fastest to get started and I rarely have to do much config as it's based on VSCode and comes with sane bindings for go-to-def, refactoring and more. https://github.com/neoclide/coc.nvim https://github.com/neoclide/coc.nvim https://github.com/prabirshrestha/vim-lsp https://github.com/prabirshrestha/vim-lsp https://github.com/neovim/nvim-lspconfig https://github.com/neovim/nvim-lspconfig You can try to use either of these implementations: https://github.com/juliosueiras/terraform-lsp https://github.com/juliosueiras/terraform-lsp https://github.com/hashicorp/terraform-ls https://github.com/hashicorp/terraform-ls These are both fairly limited but you can see every editor (except intellij) uses this under the hood. I've used them at companies with 300+ terraform repos and have never had much of an issue navigating/understanding TF through Vim.
- flippinburgers 5y ago
  By no means am I placing the blame at vim's feet. I know it is a terraform problem. Do those projects allow me to follow a user defined variable to its definition?

abriosi 5y ago

I have a love & hate relationship with terraform. It's so frustrating when you can't create a behavior. But the joy of orchestrating infrastructure at scale with code is overwhelming <3

PostThisTooFast 5y ago

Try saying WTF it is in the title. Obscurity isn't cool, but it sure is trendy on this site. It's douchey.

jamesmishra 5y ago

I believe in the Terraform way of doing things. A lot of other people dislike the Terraform language, and then they use Pulumi because it allows them to write infrastructure in Python or JavaScript. But I specifically DO NOT WANT my company's infrastructure to be written in a Turing-complete dynamically-typed language. I believe the Terraform language is safer. However, one thing I don't like about Terraform is that it provides a lot of low-level APIs for cloud providers that can take a lot of glue code to string together into a real PaaS. I solved this at my company by writing https://provose.com https://provose.com -- a Terraform module that a high-level API for configuring containers, buckets, databases, and distributed filesystems. Provose understands what you want to deploy and automatically figures out the needed VPC settings, security groups, IAM roles/policies/etc, Route 53 records, ACM certificates, and load balancer settings. Apologies for the self promotion, but if you decide to try Provose, I'd be happy to help you through any issues you face :)

h506001 5y ago
Wow, really impressed by all the work, website, and write up being just one contributor!

bionhoward 5y ago

I'd love to see more pass-by-reference in Terraform because it could simplify the API substantially. Right now you gotta figure out if you need to pass an id, name, or arn. forces a lot of reading docs and tight coupling. if one could instantiate a resource by passing other connected resources into it by reference, then provider APIs could pull info they need, and could be refactored without affecting devs