Writing an IaC Rosetta Stone

https://briancaffey.github.io/2023/01/07/i-deployed-the-same-containerized-serverless-django-app-with-aws-cdk-terraform-and-pulumi/

by zacharycohn • 4 years ago

34 38 4 years ago

briancaffey.github.io

juliangamble• 4 years ago

I feel like Pulumi takes the best of the two tools and has a really great developer experience. There is a little bit of a learning curve with Pulumi, and you give up some of the simplicity of Terraform.

I'm familiar with Terraform, and generally like it compared to AWS Cloudformation, but do have some gripes. I'm not familiar with Pulumi - what have other people experienced with it? Do you like it better?

verdverm11• 4 years ago

They introduced a Yaml interface last year, because, as I suspect, programming configuration in multiple languages sounds nice up front but does not scale. When you program IaC, you stop being declarative in the same way TF is.

zmgsabst4• 4 years ago

That hasn’t been my experience; quite the reverse.

Programmatic IaC made it a lot easier to:

- turn our inventory DB into a IaC deployment for a hybrid cloud that needed IOT shadows per datacenter device

- shard our data processing pipelines to localized data centers so we can respect data protection laws

- automatically compiling infrastructure definitions directly from programs, to run as “cloud binaries”

What do you imagine the challenges at scale are?

jen205• 4 years ago

you stop being declarative

Pulumi uses a declarative model - actually the same model as Terraform.

msla• 4 years ago

This would be both more honest and more comprehensible if it used the original title, instead of "Writing an IaC Rosetta Stone"

zacharycohn• 4 years ago

Sorry - the original title was a bit long!

samcat116• 4 years ago

On a similar but slightly different topic, I've long wondered why someone hasn't created a "Universal Terraform Provider" that can work across the major cloud services. Resources such as "instance" and network are pretty general, an while there would definitely be gotchas, it would probably be helpful in the same way that cross platform GUI frameworks have seen a rise in popularity.

MuffinFlavored5• 4 years ago

On a similar but slightly different topic, I used to think Terraform was the be-all end-all until I realized you don't manage Kubernetes with it.

To my knowledge, https://registry.terraform.io/providers/hashicorp/kubernetes... less people use this than use Helm charts, Kustomize, or some other Kubernetes-.yaml formatter

Then I get confused on where Vagrant provisioning fits into all of this.

Or Ansible/Chef/Puppet.

I just spin up a DigitalOcean droplet (I think I usually do it in the GUI to be honest, lol). Then I SSH into it, git clone a repo, docker compose up or (sometimes terraform apply) and I'm done.

Where does it grow from there?

I feel like based on the comments here, some people would even argue Docker is overkill there, or anything that isn't a monolith (small services glued together) is overkill.

joseph5• 4 years ago

I do manage Kubernetes with Terraform. I'm not a fan of Helm, however it is useful due to the community of available charts. Since I use Terraform to manage most everything else, I typically wrap the chart in a Terraform module too. This lets me do other things I usually need, such as creating IAM roles or other associated resources that the chart requires. Sometimes this means using the Kubernetes provider to add something needed by the chart, for example pulling a password from SSM or somewhere and creating a Kubernetes Secret from it.

The benefit is being able to build full stacks with only Terraform without needing to orchestrate multiple tools together. Building the cluster itself is done with Terraform, as is deploying the charts and other resources I need to build a "base system", all from a single root module. This also simplifies CI/CD as I only need a simple template to run IaC jobs and they all follow the same pattern of just running Terraform and not much else.

redeux• 4 years ago

While it’s true that the cloud providers offer the same primitives, storage/network/compute, their implementations are different enough that it matters when you’re building any complex system. A Terraform provider that attempted to provide an abstraction layer over the major could services would end up having to either encode assumptions about how the user wants their infrastructure or it would have to be overly verbose in its configuration. In practice users want neither of those.

Terraform also aim to create a single workflow for all clouds, rather than provide a common abstraction over the clouds.

So, it’s a combination of that’s not what the tool was designed to do, and that’s not what people want in practice, given the current state of the major clouds.

jerf• 4 years ago

If you want to take the time to deeply understand the answer to your question, grab one of those resources and set the Azure, Google, and AWS versions to each other. The VM instance equivalent is a reasonable starting point. The S3 equivalent isn't too bad either. Start lining up their similarities. Figure out what you would do to harmonize them. At least glance at the transitive dependencies, like networking... you don't need to fully work them out but you need to at least think about how that would be harmonized too.

If you do this honestly, and with some experience of having to tweak this semi-obscure setting and fiddle with that semi-obscure setting a few times, and you look at them honestly and realize that this is one of those "Microsoft Word" cases ("everyone uses 10% of Microsoft Word but no one uses the same 10%"), and all those settings are there for a reason and there isn't hardly one you can just drop without consequence, you'll understand.

At a 10,000 foot view it looks incredibly easy. When you actually try, you discover the lowest common denominator is so low that it would barely function. I'm pretty sure you can put an instance on "the internet" and probably load it with a common OS (though your harmonization layer is probably already doing some modestly heavy lifting just trying to have a coherent view of OS distributions) and get it to serve something, probably get some very simple port blocking done, but you're going to start being in serious trouble the moment you need more than that. The details will explode in your face, repeatedly.

But, I don't just mean this rhetorically. I'm serious. If you're really interested in this, this is a good exercise and you will learn something from the experience worth the time. Good for tuning the intuition.

BaconPackets• 4 years ago

There is already a couple of options

https://github.com/multycloud/multy

But a multicloud wrapper creates a lot of abstractions.

Writing an IaC Rosetta Stone

Related Stories