4 ms·

> Pets are just fine. They are not, if they are being configured by hand, using mouse or cli

by nuker 4y ago

grosswait 4y ago
I still say it depends on the scale of the business but if config as code is not in used, all the clicks and commands darn well better be documented
- dijksterhuis 4y ago
  $PREVIOUS_COMPANY used to have pages and pages and pages of HOWTOs in Confluence re what to click on in the AWS console for the stuff that had to be done manually. Doubled up as amazing training / onboarding material for folks that maybe hadn't worked intimately with AWS before (including myself).
r3trohack3r 4y ago
There is a lot to unpack in this statement. First, this sentiment is already covered by the article under: > Git should be your only source of truth. Discard any local files or changes, what's not pushed into the repository, does not exist. Second, don't fool yourself into thinking, just because you wrote a script or configured some provisioning service, that means you've pulled yourself out of the valley of nondeterministic unreproducible production environments. Pets can and do live in git. A majority of the systems I've worked on in both FAANG and non-FAANG in my career couldn't be reproduced from the source repo in the case of a catastrophic disaster (I.e. us-east-1 disappears) or a year of being stable enough to not deploy even though their "source of truth" lives in git. The world moves out from under your repo and many of the steps you take for granted when writing your automation aren't understood by the next engineer running the automation. Then one day you have to go upgrade this one repo and realize it's IaC is no longer compatible with the infra in the real world and you burn a day trying to figure out what's wrong with a 1000LoC YAML file.
- nuker 4y ago
  Not sure I got your point ... > Then one day you have to go upgrade this one repo and realize it's IaC is no longer compatible with the infra in the real world Thats yet another reason to avoid pets. When I say pets I mean relatively big pieces of SW, usually 3rd party, that need non-trivial configuration. Like Jenkins or Windows or some security gizmos.
  - cj 4y ago
    Can’t you accomplish “cattle” using Jenkins for automating builds, deploys, failovers, etc?
    - nuker 4y ago
      I do that all without jenkins. There are managed services for that, no need to maintain your own pet.
- mschuster91 4y ago
  > Then one day you have to go upgrade this one repo and realize it's IaC is no longer compatible with the infra in the real world and you burn a day trying to figure out what's wrong with a 1000LoC YAML file. While I'm all too familiar with this problem from the NodeJS ecosystem, it's rare to encounter it in Terraform in my experience. The only exception that needs manual intervention in a "cold boot" scenario is AWS Cloudfront using certificates provisioned from AWS ACM - the provider will assume that certificates are already valid when creating the CF distribution and error out if ACM hasn't issued the certificate yet.

> Pets are just fine. They are not, if they are being configured by hand, using mouse or cli

by nuker 4y ago

> Pets are just fine. They are not, if they are being configured by hand, using mouse or cli

I still say it depends on the scale of the business but if config as code is not in used, all the clicks and commands darn well better be documented

dijksterhuis 4y ago
$PREVIOUS_COMPANY used to have pages and pages and pages of HOWTOs in Confluence re what to click on in the AWS console for the stuff that had to be done manually. Doubled up as amazing training / onboarding material for folks that maybe hadn't worked intimately with AWS before (including myself).

r3trohack3r 4y ago

There is a lot to unpack in this statement. First, this sentiment is already covered by the article under: > Git should be your only source of truth. Discard any local files or changes, what's not pushed into the repository, does not exist. Second, don't fool yourself into thinking, just because you wrote a script or configured some provisioning service, that means you've pulled yourself out of the valley of nondeterministic unreproducible production environments. Pets can and do live in git. A majority of the systems I've worked on in both FAANG and non-FAANG in my career couldn't be reproduced from the source repo in the case of a catastrophic disaster (I.e. us-east-1 disappears) or a year of being stable enough to not deploy even though their "source of truth" lives in git. The world moves out from under your repo and many of the steps you take for granted when writing your automation aren't understood by the next engineer running the automation. Then one day you have to go upgrade this one repo and realize it's IaC is no longer compatible with the infra in the real world and you burn a day trying to figure out what's wrong with a 1000LoC YAML file.

nuker 4y ago
Not sure I got your point ... > Then one day you have to go upgrade this one repo and realize it's IaC is no longer compatible with the infra in the real world Thats yet another reason to avoid pets. When I say pets I mean relatively big pieces of SW, usually 3rd party, that need non-trivial configuration. Like Jenkins or Windows or some security gizmos.
- cj 4y ago
  Can’t you accomplish “cattle” using Jenkins for automating builds, deploys, failovers, etc?
  - nuker 4y ago
    I do that all without jenkins. There are managed services for that, no need to maintain your own pet.
mschuster91 4y ago
> Then one day you have to go upgrade this one repo and realize it's IaC is no longer compatible with the infra in the real world and you burn a day trying to figure out what's wrong with a 1000LoC YAML file. While I'm all too familiar with this problem from the NodeJS ecosystem, it's rare to encounter it in Terraform in my experience. The only exception that needs manual intervention in a "cold boot" scenario is AWS Cloudfront using certificates provisioned from AWS ACM - the provider will assume that certificates are already valid when creating the CF distribution and error out if ACM hasn't issued the certificate yet.