6 ms·

That cloud providers provide such muddy/inadequate APIs that it is impossible to view the state they are in is a very bold claim to make. Do you have an exampl

by Jasp3r 4y ago

That cloud providers provide such muddy/inadequate APIs that it is impossible to view the state they are in is a very bold claim to make. Do you have an example to back this up?

ntoskrnl 4y ago
No DNS provider I've ever used has a way to store metadata alongside a DNS record (like an individual A record)
- paulgb 4y ago
  I was just about to give the same example. I’m more familiar with GCP’s DNS, but I don’t see a place for structured metadata in Route 53 either. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...
- georgyo 4y ago
  Why do I need metadata along with my A record? It either exists or it doesn't. That is the state required for Terraform. The article explicitly mentions OctoDNS as a stateless configuration management system for DNS as a good solution.
  - KyeRussell 4y ago
    To know if it’s managed by TF or not, to know whether or not to delete it. Exactly what’s being described.
- NateEag 4y ago
  That's what TXT records are for: https://en.m.wikipedia.org/wiki/TXT_record https://en.m.wikipedia.org/wiki/TXT_record
  - gtirloni 4y ago
    Exposed to the world?
    - NateEag 4y ago
      I guess that's not ideal, though I'm not clear what attack surface area is increased by storing creation/ deletion metadata in public. I guess it lets an attacker know that you're using Terraform, which might help them target their attacks.
      - bpicolo 4y ago
        Terraform stores secrets in state. Generated database password, etc.
        NateEag 4y ago
        Oh, gotcha. I've not used Terraform yet. Yes, if that's the case, then TXT records could easily be unsuitable. Depends exactly what metadata needs to be attached to your DNS records.
  - ntoskrnl 4y ago
    Terraform can be used to manage TXT records too. Where does it store metadata for them? Or is it TXT all the way down?
    - NateEag 4y ago
      You can have multiple TXT records for a given domain name, so it would be possible to store an arbitrary amount of metadata for whatever systems you desire, and just loop through the TXT records to figure out which ones are for the current system's purpose.
- deleted 4y ago
  [deleted]
- rwmcfa1 4y ago
  If you look through the octoDNS providers there's a number of cases where extra info is stored for "dynamic" records. The metadata is often things like the pool name or rule number. In other cases it's details about the health check config/version. The extra info is sometimes stored into a "notes" field, other times it's encoded into the ID or similar. It's true that nothing extra is needed for simple/standard records, but once you start doing GeoDNS, failover, health check, etc. it's required. In all cases thus far we've been able to find a way to store/indicate whatever we need. (maintainer of octoDNS)
orf 4y ago
You can create an s3 object in a bucket with terraform. There isn’t a way to go from “tag -> key”.
moondev 4y ago
https://github.com/nat-henderson/terraform-provider-dominos https://github.com/nat-henderson/terraform-provider-dominos terraform is more than just cloud providers https://registry.terraform.io/browse/providers https://registry.terraform.io/browse/providers
noirbot 4y ago
I'm amused that you think "cloud providers have bad APIs" is a bold claim instead of the default state of things. Things as basic as IAM Groups in AWS aren't taggable: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group https://registry.terraform.io/providers/hashicorp/aws/latest... IAM Users are taggable, but to get the tags on a given user, you must request them one user at a time from a known list of users. The "List all users" call doesn't return their tags. Obviously this is less of an issue for the TF state use case, but does add to the API call overhead for any tag-based approach.
- tedivm 4y ago
  My favorite is that you can look up some resources by tag directly, but other resources have to use the special resource tagging api. The AWS API also silently fails, on purpose, for some things- try looking up quotas for Organizations as an example and you'll end up with an empty array instead of the actual quotas. Cloud providers having bad APIs is definitely the default state.

by Jasp3r 4y ago

That cloud providers provide such muddy/inadequate APIs that it is impossible to view the state they are in is a very bold claim to make. Do you have an example to back this up?

ntoskrnl 4y ago

No DNS provider I've ever used has a way to store metadata alongside a DNS record (like an individual A record)

paulgb 4y ago
I was just about to give the same example. I’m more familiar with GCP’s DNS, but I don’t see a place for structured metadata in Route 53 either. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-route53-recordset.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...
georgyo 4y ago
Why do I need metadata along with my A record? It either exists or it doesn't. That is the state required for Terraform. The article explicitly mentions OctoDNS as a stateless configuration management system for DNS as a good solution.
- KyeRussell 4y ago
  To know if it’s managed by TF or not, to know whether or not to delete it. Exactly what’s being described.
NateEag 4y ago
That's what TXT records are for: https://en.m.wikipedia.org/wiki/TXT_record https://en.m.wikipedia.org/wiki/TXT_record
- gtirloni 4y ago
  Exposed to the world?
  - NateEag 4y ago
    I guess that's not ideal, though I'm not clear what attack surface area is increased by storing creation/ deletion metadata in public. I guess it lets an attacker know that you're using Terraform, which might help them target their attacks.
    - bpicolo 4y ago
      Terraform stores secrets in state. Generated database password, etc.
      - NateEag 4y ago
        Oh, gotcha. I've not used Terraform yet. Yes, if that's the case, then TXT records could easily be unsuitable. Depends exactly what metadata needs to be attached to your DNS records.
- ntoskrnl 4y ago
  Terraform can be used to manage TXT records too. Where does it store metadata for them? Or is it TXT all the way down?
  - NateEag 4y ago
    You can have multiple TXT records for a given domain name, so it would be possible to store an arbitrary amount of metadata for whatever systems you desire, and just loop through the TXT records to figure out which ones are for the current system's purpose.
deleted 4y ago
[deleted]
rwmcfa1 4y ago
If you look through the octoDNS providers there's a number of cases where extra info is stored for "dynamic" records. The metadata is often things like the pool name or rule number. In other cases it's details about the health check config/version. The extra info is sometimes stored into a "notes" field, other times it's encoded into the ID or similar. It's true that nothing extra is needed for simple/standard records, but once you start doing GeoDNS, failover, health check, etc. it's required. In all cases thus far we've been able to find a way to store/indicate whatever we need. (maintainer of octoDNS)

orf 4y ago

You can create an s3 object in a bucket with terraform. There isn’t a way to go from “tag -> key”.

moondev 4y ago

https://github.com/nat-henderson/terraform-provider-dominos https://github.com/nat-henderson/terraform-provider-dominos terraform is more than just cloud providers https://registry.terraform.io/browse/providers https://registry.terraform.io/browse/providers

noirbot 4y ago

I'm amused that you think "cloud providers have bad APIs" is a bold claim instead of the default state of things. Things as basic as IAM Groups in AWS aren't taggable: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_group https://registry.terraform.io/providers/hashicorp/aws/latest... IAM Users are taggable, but to get the tags on a given user, you must request them one user at a time from a known list of users. The "List all users" call doesn't return their tags. Obviously this is less of an issue for the TF state use case, but does add to the API call overhead for any tag-based approach.

tedivm 4y ago
My favorite is that you can look up some resources by tag directly, but other resources have to use the special resource tagging api. The AWS API also silently fails, on purpose, for some things- try looking up quotas for Organizations as an example and you'll end up with an empty array instead of the actual quotas. Cloud providers having bad APIs is definitely the default state.