8 ms·
The future of Terraform CDK
- Havoc 10mo agoAs far as corporate mercy killings goes archived under mozilla license is better than a pivot to "you now pay per core" or whatever
- vbernat 10mo agoIt's odd to always say "Hashicorp, an IBM company". Looks like they want to assign blame. I did try Pulumi a while back, but the compatibility with Terraform modules was not great, so I've switched to CDKTF, which can handle unmodified modules. Dunno if I'll switch back to Pulumi or just use OpenTofu directly.
- smithcoin 10mo agoWe use OpenTofu it’s pretty seamless
- benatkin 10mo agoNow more will be using a combination of OpenTofu and Terraform, and there will probably be some tacit endorsement of OpenTofu by Hashicorp folks in their communication with those who are using both. Good to see!
- Hamuko 10mo agoDoes it do ephemeral values yet?
- cube2222 10mo agoYep, as of yesterday’s 1.11 release it’s supported! That also includes a new “enabled” meta argument, so you don’t have to hack around conditional resources with count = 0. [0]: https://opentofu.org/blog/opentofu-1-11-0/ https://opentofu.org/blog/opentofu-1-11-0/ Disclaimer: affiliated with the project
- lijok 10mo agoHow do you migrate from count/for_each to `enabled` ?
- cube2222 10mo agoYou can just switch from `count = 1` to `enabled = true` (or vice-versa, works back-and-forth) for a resource and tofu will automatically move it next time you apply. It's pretty seamless.
- lijok 10mo agoAmazing. Good work !
- joombaga 10mo agoThat's cool! We'll still need to change all of the references to `resource[0]`, right? Or does tofu obviate that need as well?
- cube2222 10mo agoI’m not sure I understand. You refer to the conditional resource fields normally - without list indices. You just have to make sure the object isn’t null. There’s some samples in the docs[0] on safe access patterns! [0]: https://opentofu.org/docs/language/meta-arguments/enabled/ https://opentofu.org/docs/language/meta-arguments/enabled/
- darkwater 10mo agoAnd you don't get the annoying array form for the resulting resource with the `enabled` syntax, right? EDIT: Oh just realized the sibling asked the same, but the doc doesn't state that clearly, although it seems to me that the doc implies that yeah, it doesn't use the array form anymore.
- cube2222 10mo agoYes indeed! It does not use the annoying array form.
- atonse 10mo agoI was thinking the same thing about the "an IBM company". My guess is that it's a lazy find/replace.
- Pet_Ant 10mo agoI assume it's a matter of branding and making IBM look more modern by associating with the Hashicorp brand.
- cr125rider 10mo agoIt’s one thing to say it once but 3 times in the same paragraph seems weird for sure!
- jjice 10mo ago> It's odd to always say "Hashicorp, an IBM company". Looks like they want to assign blame. All their branding does this now, including the HashiCorp logo on their website [0]. There's gotta be a name for this specific branding pattern, but I don't know it. [0] https://www.hashicorp.com/en/blog/products/terraform https://www.hashicorp.com/en/blog/products/terraform
- deleted 10mo ago[deleted]
- huddo121 10mo agoMetastatized branding
- stingraycharles 10mo agoIt’s endorsed branding. Basically when a parent company “endorses” its subsidiaries’ brands, but keep their own name (as opposed to renaming everything to IBM, like eg Google would do).
- firesteelrain 10mo agoIt’s how Red Hat identifies themselves too
- viraptor 10mo agoIt's common when corps buy large enough companies that they don't want to kill the original brand. That's why you get hotels like "(something) by Hilton".
- richardfontana 10mo agoDo you mean Red Hat identifies itself using the phrase "Red Hat, an IBM Company"? Because I don't see any use of this on redhat.com (including that website's corporate "about" content) and if any Red Hatters are using this phrasing (I'm a current Red Hat employee) I haven't been aware of it.
- firesteelrain 10mo agoI have seen it in several articles. (I don’t work for HashiCorp or Red Hat subsidiaries so no idea what is said or done inside those subs) 1. https://business.adobe.com/customer-success-stories/red-hat.html https://business.adobe.com/customer-success-stories/red-hat.... 2. https://www.openpr.com/news/4100338/linux-operating-system-market-growth-trends-and-competitive https://www.openpr.com/news/4100338/linux-operating-system-m...
- richardfontana 10mo agoYou said "It’s how Red Hat identifies themselves too" but those two articles are not by Red Hat. So ... it's not how Red Hat identifies themselves, though it seems to be how Hashicorp identifies themselves.
- packetlost 10mo agoI have absolutely nothing good to say about Pulumi. Stay far, far away.
- jen20 10mo agoStrange, I have a lot of good things to say about both it and Terraform. Probably some specifics might be more useful there...
- deleted 10mo ago[deleted]
- mfornasa 10mo agoplease expand on this, I am interested (for real!)
- weakfish 10mo agoWhy? I’ve had nothing but good experiences, but I don’t run it and the team that does is extremely competent
- willio58 10mo agoMy experience with Pulumi is you can write bad pulumi code and good pulumi code and just like everything else, it's easy to end up in a codebase where one poor soul was tasked with writing it all and they didn't do the best job with it.
- here2learnstuff 10mo agoPlease expand on your experiences, because I've had great luck with Pulumi at my company since October 2021. No engineer liked HCL, our demographic was engineers who were familiar with programming languages who wanted to self service basic infrastructure (AWS SecretsManager, IRSA roles, Databricks Service Principals, etc). We were pretty easily able to shim in a RunAtlantis inspired system that displayed previews that required explicit approval when a PR was raised, performed apply on merge to main, and ran drift checks periodically.
- selkin 10mo ago> It's odd to always say "Hashicorp, an IBM company". Looks like they want to assign blame. Or it's legal trying to preempt a risk. If it was the author just wanting to point at IBM, they'd mention it just once or twice, but using that awkward phrase throughout the text makes me think it was an edit mandated by a careful lawyer.
- pretext-1 10mo agoI was recently working for a company which got acquired by IBM and we had to do it too. It’s an IBM thing. I bet most people at HashiCorp hate it, at least that was the case for us.
- dandellion 10mo agoMakes IBM look really bad. Do they also force people to bow when the CEO of IBM enters the room, and address them as sir or your highness?
- miki123211 10mo agoThey used to have their employees sign songs praising the company... Granted, that was in the 1930s or something, but still.
- abhiyerra 10mo agoI remember it being a part of the movie Pirates of Silicon Valley and thought it couldn’t be true. But apparently it was. https://youtu.be/VyQEbLx6AEY?si=CwhqHQEdFGCsE33l https://youtu.be/VyQEbLx6AEY?si=CwhqHQEdFGCsE33l
- dandellion 10mo agoWow, the truth is stranger than fiction.
- nsonha 10mo ago"Hashicorp, an IBM company" Common sense would be IBM mandating that branding, as opposed to Hashicorp.
- roboben 10mo agoThey should have renamed it first to HashiCorp, an IBM Company CDK, then shut it down
- GardenLetter27 10mo agoDamn, what are the best alternatives here? For pure AWS I guess CDK directly is okay, but locks you in.
- scruff3y 10mo agoJust use Terraform?
- deleted 10mo ago[deleted]
- cholantesh 10mo agoYeah I'm struggling to see the value here.
- stackskipton 10mo agoThe value for TFCDK was Developers don't have to learn another language, they can just continue to use existing language they already know. Downsides are doing infrastructure in a programming language was always problematic unless developer was skilled at Ops which most who used TFCDK were not.
- cholantesh 10mo agoI ought to have phrased it I guess as "I don't agree with the value proposition", mainly because of the downside you point out. This seems superior to Pulumi, though, in that the abstraction is (was) at least owned by Hashicorp so there was less likelihood of it falling out of date and giving you footguns.
- coenhyde 10mo agoThat might have been the promise but never the real value. As you say in practice the engineer needs to know ops & terraform along side their language of choice. The real value of cdktf was more dynamic infrastructure provisioning while still having the plan / apply pattern.
- zer0-c00l 10mo agoThis is a bummer. I don't particularly like Pulumi but use it anyways because for my use cases being able to write actual code is really impactful. Sucks to see fewer options in that space
- leetrout 10mo agoThe often excluded option is dynamically generating JSON and feeding that to TF instead of HCL. You can combine it with tools like Dhall or my personal preference Jsonnet instead of imperative languages for an interesting experience for reusable pieces outside of module concepts.
- Duologic 10mo agoAny particular libraries you use to generate TF-JSON from jsonnet? I wrote a generator a little while ago that can create jsonnet libraries from the TF schemas: https://github.com/Duologic/soysonnet https://github.com/Duologic/soysonnet Example lib here: https://github.com/Duologic/soysonnet-aws https://github.com/Duologic/soysonnet-aws I only needed it for AWS so I didn't spend more time on it.
- joeduffy 10mo ago[Pulumi founder here] Sorry to hear you don't particularly like Pulumi---any/all feedback welcome. If nothing else, we do listen and we do try to get better. -Joe
- here2learnstuff 10mo ago
- vanschelven 10mo ago"Will be sunset on Dec 10"... commit date: Dec 10. That seems like rather short notice.
- HashiCorps 10mo agoAs I said here [0] there's more of this coming. [0] - https://news.ycombinator.com/item?id=46192130#46198058 https://news.ycombinator.com/item?id=46192130#46198058
- yearolinuxdsktp 10mo agoThat’s a real shame. It seems like Pulumi is the only alternative for internal DSLs for IaaC? I always found HCL to be quite terrible, slowly becoming less painful, but not really refactoring-friendly. Terraform CDK had promise as a blessed infrastructure-as-actual-code solution from the official maintainer of Terraform, so easier to sell internally rather than something from a new vendor like Pulumi. I feel sorry for those teams who have migrated to TF CDK. Internal vs external DSLs explained in the middle of this page: https://martinfowler.com/bliki/DslQandA.html https://martinfowler.com/bliki/DslQandA.html
- chuckadams 10mo agoKubernetes has a few things, including cdk8s. Yoke looks promising too.
- jeroensoeters 10mo ago[dead]
- mfornasa 10mo agoRug pulls on infrastructure components seem even worse than other rug pulls as they can hit your entire infra codebase at once
- lillecarl 10mo agoThis is why infrastructure people are conservative by nature, it's so damn much gruntwork to migrate without downtime
- mfornasa 10mo agoAnd it happens while we are all very enthusiastically dedicated to migrating off Kubernetes ingress-nginx. Just as planned.
- preisschild 10mo agoAs an Infrastructure Engineer who used it: I blame people who didnt help fund/maintain it (including ourselves)
- deadfece 10mo agoAt least they gave us some notice, that’s much appreciated.
- breakingcups 10mo agoDefine "some"
- deadfece 10mo agoOh I don't know, 2? or 3?
- paulddraper 10mo ago2 or 3 what?
- dev_l1x_be 10mo agoIt would be great to have an alternative to Terraform that uses a bit more advanced provider (at last for AWS). Does OpenTofu use that same provider?
- lijok 10mo agoIt does. What are you looking for in a more advanced AWS provider?
- dev_l1x_be 10mo agoHave you ever debugged what goes on with lets say the aws provider during a tf apply?
- jpitz 10mo agoThe providers for tofu are by design the same as for terraform. Also, for large providers like AWS, GCP, Azure, etc - these are often largely authored by the hyperscaler themselves, for better or worse.
- NeckBeardPrince 10mo agoHashicorp, an IBM company
- tonnydourado 10mo agoHashicorp,an IBM company
- chickensong 10mo agoHashicorp, an IBM company
- egorfine 10mo agoHashicorp, an IBM company
- lloydatkinson 10mo agoWhat was the point of it? Terraform supports AWS anyway.
- crimsonnoodle58 10mo agoThis is particularly frustrating as I've spent the last year writing many thousands of lines of CDKTF Python. HCL just does not have the modularity and expressiveness that Python, or other languages CDKTF supports. I guess I'll spend another year migrating to Pulumi now..
- lijok 10mo agoThe lack of expressiveness of HCL is the point and what makes it so good
- crimsonnoodle58 10mo agoBeing able to inherit from Ingress and add a parameter of say public=True/False and then it change annotations, middleware, etc and then being able to re-use that across 100s of stacks is very powerful. DRY is not something HCL is good at.
- lijok 10mo agoGetting too clever with an imperative language in what is inherently a declarative domain, is an idea bad enough that they invented a whole new language to avoid you doing it. But some lessons have to be learned the hard way I guess
- crimsonnoodle58 10mo agoYet said language continues to add imperative-inspired constructs to make up for its limitations.. The end result is still declarative, your just using an imperative language to keep your IaC DRY.
- lijok 10mo agoIf you have the expertise and restraint to not go off the rails, I agree, imperative is more powerful. That plan does not survive teams of sizes over 2 in the majority of cases.
- lijok 10mo agoGood move. They clearly didn't have the resources they needed. The design of the CDKs was atrocious.
- kbar13 10mo agowe're using cdk since 100% of our stuff is in aws but will soon need to hook up some external resources like cloudflare. looked at tfcdk a while back but didn't think it was a good idea (glad). still trying to figure out a good way forward and hoping it's not to rip the bandaid and migrate everything to terraform / pulumi
- callumgare 10mo agoAs an alternative is anyone considering https://sst.dev/ https://sst.dev/ (which uses Pulumi under the hood)? We use it at work and I’ve been quite happy with it
- moltar 10mo agoThis is so sad. It’s a great project. Needs to be forked and maintained. If anyone forks please email me I’ll contribute.
- rubenvanwyk 10mo agoOpenTofu is already the de facto fork.
- thayne 10mo agoOpenTofu is a fork of terraform, not CDKTF. Although, I would hope a fork of cdktf would target opentofu instead of terraform.
- DangitBobby 10mo agoWell that sucks for me.
- borisbanjo 10mo agoCDKTF works beautifully, all the complains here seem to be from salty devops who got pissed the developers wanted something more powerful than the garbage HCL with its even more garbage module system. CDKTF stacks are great and the construct pattern gives you modularization without all the baggage.
- nijave 10mo agoI kind of like it but I always found it kind of clunky how it's ultimately just generating JSON/HCL anyway. For instance, you can't data source then use code to transform and send it to a resource since it has to transpile first. That also means you end up with things like the language's native JSON not doing what you expect and having to use a special Terraform function call.
- nevon 10mo agoNot stated in the most diplomatic way, but I do agree. Having used CDK (not cdktf) and now being forced back to Terraform feels like going back to the stone age. It is absolutely obvious to me that generating infrastructure definitions from a regular, testable language using all the same tools, techniques and distribution mechanisms that you use for all your other software development is the superior way. Being able to piggyback off of the vast ecosystem of Terraform providers was a really clever move, although I understand it led to some rough edges.
- kennu 10mo agoSad to see it go. The philosophy of CDK has been to offer a shared ecosystem between IaC, backend code and frontend code, allowing to share configuration, data structures and libraries between all of them. It has made development more unified and have less redundancy and manual work. Personally I don't want to repeat some stuff in a special Terraform language, if I can find a way to manage the whole application in TypeScript.
- so0k3311 10mo ago[dead]
- an-engineer 10mo agoThere are active discussions in the https://cdk.dev/ https://cdk.dev/ Slack channel #terraform-cdk about building community-driven forks of the existing Hashicorp/IBM CDKTF repositories. A number of developers who work at organizations that are heavily reliant on CDKTF have offered to pitch in. There is currently a live proof of concept fork of the main cdktf repository that one developer made: https://github.com/TerraConstructs/terraform-cdk https://github.com/TerraConstructs/terraform-cdk And one Open Tofu developer said he and some other Open Tofu developers would be happy to collaborate with that community-driven effort to keep CDKTF alive: "The OpenTofu maintainers are happy to collaborate with that project once it's up and running, but we will not be directly involved." https://github.com/opentofu/opentofu/issues/3585 https://github.com/opentofu/opentofu/issues/3585