3 ms·

At my workplace, managing terraform state has caused outages. It is so very easy to refactor the terraform code and then find yourself deleting a network load b

At my workplace, managing terraform state has caused outages. It is so very easy to refactor the terraform code and then find yourself deleting a network load balancer and recreating one. Recent versions of terraform have come out with a `moved`[1] block, but it is really unintelligent. It is a step in the right direction, but I can't use variables with it or string interpolation or anything. Trying to get the state to be happy has been very difficult. I prefer ansible for this because it doesn't use state[2], but as my company uses terraform I am left with the unfortunate need to manage state. The best thing that I've been able to find to help in this fight is a little script I created to help automatically make moved blocks[3]. In a refactor you typically want to take resource blocks from the main.tf file and move them into their own module. You first moved the blocks into the module, and then before you edit anything you run that script and it matches up the blocks that were moved using Levenshtein distance. This approach may seem hacky but it works very well. Then I just take the output of the script and append it to my tf file. I found the article refreshing and poignant. I will definitely be hoping for innovations like this to finally improve The state of the art because now that OpenToFu[4] is on the scene features like this that might chew into the bottom line of HashiCorp will start finally start being looked at seriously. 1: https://developer.hashicorp.com/terraform/language/modules/develop/refactoring https://developer.hashicorp.com/terraform/language/modules/d... 2: https://blog.djha.skin/blog/that-does-it-ansible-wins/ https://blog.djha.skin/blog/that-does-it-ansible-wins/ 3: https://gist.github.com/djhaskin987/b856c157bcfce6d2e4ee19f9732e5194 https://gist.github.com/djhaskin987/b856c157bcfce6d2e4ee19f9... 4: https://opentf.org/ https://opentf.org/

ljm 3y ago
I've had similar difficulties and it seems like Terraform is basically a content-addressable system, where the directory tree is part of the addressable content. The addition of `moved` is welcome but I feel like it was a huge mistake to use the FS as the module system such that moving a directory or renaming it is a breaking change, despite the fact that the name of your resource never changed. That design decision has shot even the most experienced engineers in the foot once they see a renamed directory killing a database and spinning a new one up.
amazingman 3y ago
>At my workplace, managing terraform state has caused outages. It is so very easy to refactor the terraform code and then find yourself deleting a network load balancer and recreating one. This is why we read the `plan` output before approving an `apply`. Terraform is not causing this outage, humans are.

ljm 3y ago

I've had similar difficulties and it seems like Terraform is basically a content-addressable system, where the directory tree is part of the addressable content. The addition of `moved` is welcome but I feel like it was a huge mistake to use the FS as the module system such that moving a directory or renaming it is a breaking change, despite the fact that the name of your resource never changed. That design decision has shot even the most experienced engineers in the foot once they see a renamed directory killing a database and spinning a new one up.

amazingman 3y ago

>At my workplace, managing terraform state has caused outages. It is so very easy to refactor the terraform code and then find yourself deleting a network load balancer and recreating one. This is why we read the `plan` output before approving an `apply`. Terraform is not causing this outage, humans are.