10 ms·

Why on earth is your state in git? The tool has built-in functionality to handle just these kinds of workflows. This reads a lot like hitting your thumb with th

Why on earth is your state in git? The tool has built-in functionality to handle just these kinds of workflows. This reads a lot like hitting your thumb with the hammer and blaming hammers.

kasfkaj 3y ago
Yes, this. Just supply a few flags to configure terraform backend to store the state in remote storage and encrypt it. terraform init --backend=gcs --bucket="xxx" --prefix="my-deployment-name" --encryption_key="my-random-bits"
- Hnrobert42 3y ago
  Again, that just puts a bandaid over the problem. You can’t individual audit access to or rotate secrets stored state files.
fishnchips 3y ago
Presumably one would want to store the state in Git to get contextual diffing “for free” and possibly to avoid a dependency on another system.
- Pet_Ant 3y ago
  If that then create a separate locked down Git repo just for this. Protecting your state file was a big deal when I first reading about Terraform. It was really drilled in.
  - ta1243 3y ago
    And that's why many people don't like the idea of a state file. Sure there are benefits, but there are also drawbacks. You now need another system to manage your state. You don't with ansible.
    - fishnchips 3y ago
      Ansible is a different system, with a subtly different use case. It generally manages a preexisting list of targets. In that sense, there is some initial "state" in Ansible, this being your inventory. Terraform (or CloudFormation, or Pulumi, or Crossplane, for that matter) shine when you need to create resources. Think of the state as the inventory of what you've created (or imported).
      - ta1243 3y ago
        If you think of the resource you are managing with ansible being your AWS account (or your VMWare system, or whatever), then I guess it makes more sense. That state (the account you manage) doesn't really change. (I don't use ansible but that is my understanding) Having 3 different sources of truth (what is, in AWS, what should be, in the .tf, and something else -- in the statefile) can mean nasty 3 way merges, which i But I don't manage thousands of different resources, I manage 50. It feels to me that the overhead needed to manage thousand struggles to scale down without bringing all the required baggage. It feels like kubernetes vs docker-compose. That said, the concept of using an S3 bucked for storing state I saw elsewhere in these comments is an interesting idea so I may revisit terraform.
      - Hnrobert42 3y ago
        Not always. I’ve used Ansible to stand up all the inventory that I managed with it.
Hnrobert42 3y ago
I didn’t choose it, but my guess is that they didn’t know what they were doing. Even so, git only exacerbated the problem of secrets being in state files.

Why on earth is your state in git? The tool has built-in functionality to handle just these kinds of workflows. This reads a lot like hitting your thumb with the hammer and blaming hammers.

kasfkaj 3y ago

Yes, this. Just supply a few flags to configure terraform backend to store the state in remote storage and encrypt it. terraform init --backend=gcs --bucket="xxx" --prefix="my-deployment-name" --encryption_key="my-random-bits"

Hnrobert42 3y ago
Again, that just puts a bandaid over the problem. You can’t individual audit access to or rotate secrets stored state files.

fishnchips 3y ago

Presumably one would want to store the state in Git to get contextual diffing “for free” and possibly to avoid a dependency on another system.

Pet_Ant 3y ago
If that then create a separate locked down Git repo just for this. Protecting your state file was a big deal when I first reading about Terraform. It was really drilled in.
- ta1243 3y ago
  And that's why many people don't like the idea of a state file. Sure there are benefits, but there are also drawbacks. You now need another system to manage your state. You don't with ansible.
  - fishnchips 3y ago
    Ansible is a different system, with a subtly different use case. It generally manages a preexisting list of targets. In that sense, there is some initial "state" in Ansible, this being your inventory. Terraform (or CloudFormation, or Pulumi, or Crossplane, for that matter) shine when you need to create resources. Think of the state as the inventory of what you've created (or imported).
    - ta1243 3y ago
      If you think of the resource you are managing with ansible being your AWS account (or your VMWare system, or whatever), then I guess it makes more sense. That state (the account you manage) doesn't really change. (I don't use ansible but that is my understanding) Having 3 different sources of truth (what is, in AWS, what should be, in the .tf, and something else -- in the statefile) can mean nasty 3 way merges, which i But I don't manage thousands of different resources, I manage 50. It feels to me that the overhead needed to manage thousand struggles to scale down without bringing all the required baggage. It feels like kubernetes vs docker-compose. That said, the concept of using an S3 bucked for storing state I saw elsewhere in these comments is an interesting idea so I may revisit terraform.
    - Hnrobert42 3y ago
      Not always. I’ve used Ansible to stand up all the inventory that I managed with it.

Hnrobert42 3y ago

I didn’t choose it, but my guess is that they didn’t know what they were doing. Even so, git only exacerbated the problem of secrets being in state files.