https://www.youtube.com/watch?v=IeweKUdHJc4
My presentation from Hashiconf 2017, discussing our use of Terraform, and our techniques
to help make it safe and accessible.
2. Terraform at Segment
- Analytics API for 1000s of
online businesses
- 349 services
- 14k containers peak
- 90B msg/month
- 100k rps
- All AWS
- ECS
(# containers running)
3. - 2.5 years of Terraform
(since v0.4!)
- ~30 developers interacting
with Terraform weekly
- 30-50 ‘applies’ per day
- Tens of thousands of AWS
resources
Terraform at Segment
4. This Talk
- Why is safety such a big deal?
- Some Terraform ‘nouns’
- Safety with your state
- Safety with your modules
- Safety elsewhere
7. Developers avoid selecting tools if the … effect
of the tools is unknown, and the tools have
some risks.
To promote development support tools, we
have to suppress the risk of the tools.
- Analyzing the Decision Criteria of Software Based on Prospect Theory
31. Terraform Workflow
1. load the desired configuration
2. load the stored .tfstate file
3. calculate the diff between the current and desired states
4. use CRUD APIs to update the current state to match the
desired state
5. update the state file
48. - Price? S3 or Consul
- Custom configuration? S3 or Consul
- Out-of-the-box dashboard + changelog? TFE
- Remote applies? TFE
- CI Integration? TFE
- Versioning? Either (with tweaks)
- Locking? Either!
What remote state provider should I use?
49. - Price? S3 or Consul
- Custom configuration? S3 or Consul
- Out-of-the-box dashboard + changelog? TFE
- Remote applies? TFE
- CI Integration? TFE
- Versioning? Either (with tweaks)
- Locking? Either!
(at Segment, we’ve used S3 but moved to TFE)
What remote state provider should I use?
65. State Safety
- Separate AWS (or GCP) accounts
- A state per environment
- Consider states per service or per team
- We use per-team states
- Use a remote state manager like TFE or S3
- Limit your blast radius
- Use some sort of ‘read-only’ state
- We use a combination of data sources and shared outputs
96. - Modules for logical ‘units’ of resources
- Simple defaults to hide complexity
- Variable all the things
- If you write it more than twice, make it a module
- Modules can reference across repos, share them
- github.com/segmentio/terraform-docs
- github.com/segmentio/stack
Safety with modules