Hacker News new | ask | show | jobs
by Jasp3r 1487 days ago
That cloud providers provide such muddy/inadequate APIs that it is impossible to view the state they are in is a very bold claim to make.

Do you have an example to back this up?

4 comments

I'm amused that you think "cloud providers have bad APIs" is a bold claim instead of the default state of things. Things as basic as IAM Groups in AWS aren't taggable: https://registry.terraform.io/providers/hashicorp/aws/latest...

IAM Users are taggable, but to get the tags on a given user, you must request them one user at a time from a known list of users. The "List all users" call doesn't return their tags. Obviously this is less of an issue for the TF state use case, but does add to the API call overhead for any tag-based approach.

My favorite is that you can look up some resources by tag directly, but other resources have to use the special resource tagging api. The AWS API also silently fails, on purpose, for some things- try looking up quotas for Organizations as an example and you'll end up with an empty array instead of the actual quotas.

Cloud providers having bad APIs is definitely the default state.

No DNS provider I've ever used has a way to store metadata alongside a DNS record (like an individual A record)
I was just about to give the same example. I’m more familiar with GCP’s DNS, but I don’t see a place for structured metadata in Route 53 either. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...
If you look through the octoDNS providers there's a number of cases where extra info is stored for "dynamic" records. The metadata is often things like the pool name or rule number. In other cases it's details about the health check config/version. The extra info is sometimes stored into a "notes" field, other times it's encoded into the ID or similar.

It's true that nothing extra is needed for simple/standard records, but once you start doing GeoDNS, failover, health check, etc. it's required.

In all cases thus far we've been able to find a way to store/indicate whatever we need.

(maintainer of octoDNS)

Why do I need metadata along with my A record? It either exists or it doesn't. That is the state required for Terraform.

The article explicitly mentions OctoDNS as a stateless configuration management system for DNS as a good solution.

To know if it’s managed by TF or not, to know whether or not to delete it. Exactly what’s being described.
That's what TXT records are for:

https://en.m.wikipedia.org/wiki/TXT_record

Terraform can be used to manage TXT records too. Where does it store metadata for them? Or is it TXT all the way down?
You can have multiple TXT records for a given domain name, so it would be possible to store an arbitrary amount of metadata for whatever systems you desire, and just loop through the TXT records to figure out which ones are for the current system's purpose.
Exposed to the world?
I guess that's not ideal, though I'm not clear what attack surface area is increased by storing creation/ deletion metadata in public.

I guess it lets an attacker know that you're using Terraform, which might help them target their attacks.

Terraform stores secrets in state. Generated database password, etc.
Oh, gotcha. I've not used Terraform yet.

Yes, if that's the case, then TXT records could easily be unsuitable. Depends exactly what metadata needs to be attached to your DNS records.

You can create an s3 object in a bucket with terraform. There isn’t a way to go from “tag -> key”.