I am wondering what would be the best way to manage big set of zones in route53.
The things i wanna benefit here are:
have zones under version control
manage zones via code like for example tool Terraform or maybe developing some cli tool for this.
no manual changes to zones
my problem starts that I have big number of zones in route53 and is hard to track changes and who did what when things start breaking, and i am not sure how i could migrate all into Terraform.
Is there a way to dump current setup into TF ?
Or maybe there is some other better idea how to mange this ?
Related
I am pretty new to Terraform and Terraform Cloud and I'm looking at the best way to structure my Terraform Cloud Workspaces.
Use Case: Relatively simple webapp, RDS, ECS/Fargate etc
I am currently evaluating with the following workspaces:
ECR
Database
AppCore (ECS Cluster, ALB, etc etc)
ECS Service/Tasks
Benefits: Small blast radius, logical chunks, can use Terraform when updating to new ECS task definitions.
I thought I found a doc on Terraforms site that suggested breaking workspaces similar to this was their recommended approach but I can't seem to find it again at the moment.
Is this good? bad? I've heard putting all your infrastructure in a single workspace can make things painful later.
Any ideas, thoughts or suggestions greatly appreciated!
Are there any benefits to spawn a new AWKS EKS cluster by using terraform or eksctl?
Are there some long-term maintenance benefits of one vs another?
Well, although I haven't actually tried this out with Terraform, I can definitely say that the eksctl way is not recommended. At least not if you're interested in manageing your infrastructure as code.
With eksctl, most changes to an existing cluster need to be made with specific eksctl commands. Just changing the (declarative) cluster.yaml (or whatever you name) does not apply anything relevant. You want to scale a nodeGroup? Well, please use eksctl scale nodegroup, as changing the size in the YAML file is not applying anything. I think you get the pattern.
It's really sad that, of all companies, Weaveworks, the "inventors" of GitOps, provide a tool that does not even support basic IaC :(
I would highly recommend using terraform. It is declarative and provides an interface that can be used to support all of your infrastructure and not just your EKS cluster(s).
The time and effort you put into learning terraform and implementing it in your pipeline can be easily re-used for other infrastructure needs unlike eksctl.
I'm struggling to solve a problem with terraform :
The problem in short is related to collaboration between teams while writing infra code using the SAME state file exemple :
Infra team : network plumbing
App team: create VMs/k8s workloads
App team obviously takes some inputs from the infra team using data sources... until here everything is alright. Both teams use different git repos but same remote STATE file.
Because both teams uses the SAME state file, ressources created by one team ( example infra team) are marked for DELETION when App team tries to deploy something and vice versa.
can we prevent this, is using separate state files the only solution ?
thanks you
The short answer is Yes.
Separate state files is the best long-term solution. The other option that you could think about is workspaces but according to terraform documentation that's not a good idea:
When Terraform is used to manage larger systems, teams should use multiple separate Terraform configurations that correspond with suitable architectural boundaries within the system so that different components can be managed separately and, if appropriate, by distinct teams. Workspaces alone are not a suitable tool for system decomposition, because each subsystem should have its own separate configuration and backend, and will thus have its own distinct set of workspaces.
https://www.terraform.io/docs/state/workspaces.html#when-to-use-multiple-workspaces
I want to manage multiple environments with difference in instance size and instance cost. Can we use Terragrunt used for that purpose. Also is Terragrunt used in Azure?
Terragrunt is just a wrapper for Terraform script, not related to the actual provider. Terragrunt worked better for Terraform < 0.12 but now I would not recommend it.
For handling multiple environments you can:
Use Terraform Workspaces (available for Azure backend)
Use a smart layout of directories and modules. Check here - with Azure example.
Yes it is available. You have this nice article explaining how to use it on Azure. But, i would not recommend you to go in that direction. Most of the Terragrunt features have been adopted by Terraform Enterprise. Terragrunt allows you to work faster than Terraform for some cases but it has the main issues than Terraform. In my opinion, the main benefits are the plan-all/apply-all command if you have a lot of different sub-resources grouped by folders, but you can work on and achieve the same with Terraform.
Not sure there is going to be a right or wrong answer for this one, but I am just interested how people manage Terraform in the real world? In terms of do you use modules, different environments and collaborations.
At the moment we are planning on having a production, dev and test environments. All similar.
Now at the moment I have made my terraform files in a way that define individual components of AWS, so say one for, VPC, IAM, EC2, Monitoring (CloudWatch + CloudTrail + CloudConfig) etc. And there is one variable file and .tfvars for the above, so the files are portable (all environments will be the same). So if you need to change something its all in one place. Also means if we have a specific project running I can create a tf file defining all the resource for the project and drop it in, then once its completed remove it.
Each environment has its own folder structure on our Terraform server.
Is this too simplistic? I keep looking at module.
Also does anyone have experience of collaboration with Terraform, as in different teams? I have been looking at things like Atlantis to tie into GitHub, so any changes need to be approved. But also at the sametime with the correct IAM role I can limit what Terraform can change.
Like I said may not be a wrong of right answer just interested in how people are managing terraform and their experiences.
Thanks
My answer is just an use case...
We are using terraform for an application deployed for several customers each having small specific configuration features.
We have only one CVS repository. We don't use CVS branches mechanism.
For each folder, we have remote states at least to share states between developers.
We are using one global folder having remote states also to share states between customers configurations
We are using one folder per customer and using workspaces (former environment) for each context for each customer (prod:blue/green, stage)
For common infrastructure chunks shared by all customers, we use module
We mainly use variables to reduce the number of specific files in each customer folders.
Hope this will help you...