[HN Gopher] System Initiative has open sourced its collab DevOps...
___________________________________________________________________
System Initiative has open sourced its collab DevOps tool
Author : vmbrasseur
Score : 55 points
Date : 2023-08-16 16:11 UTC (6 hours ago)
(HTM) web link (www.systeminit.com)
(TXT) w3m dump (www.systeminit.com)
| c7DJTLrn wrote:
| It looks cool, but I would be hesitant to leave IaC behind.
| DevOps/sysadmin kind of people are infamous for (generally) not
| liking GUIs for a reason. We like being able to grep through a
| repo, revert to older versions of the code, and deploy new infra
| all through the CLI.
|
| It might be adopted by people who already do ClickOps or aren't
| comfortable with the CLI, but I'm not sure about the rest of us.
| Looking forward to seeing how it progresses.
| hiepph wrote:
| I heard in a Podcast that they are inspired by game development
| workflow (e.g. Unity) where multiple teams can work together in
| a unified way. This reduces "niche" power like CLI commands
| that only some of sysadmins can wield.
|
| Personally, as an infrastructure engineer, I still prefer CLI
| and everything as (text) code. But I'm open to change if this
| "second wave" could take off.
| maccard wrote:
| As someone who works on games professionally, the first thing
| people do is turn on the text support for unity assets.
| Unreal still uses binary assets and it's a giant pain in the
| ass.
|
| The problem isn't that everything should be text, it's that
| there are no tools out there that work with other content
| types. Semantic diff tools would be incredible honestly, and
| text is a poor representation of code. It's just the best we
| have right now
| holoway wrote:
| Skepticism here is warranted - the history of things that look
| like this in our space isn't fantastic. We've put a lot of
| engineering into trying to create something that is a power
| tool, and flexible enough to solve hard real world problems.
| It's early, and we've got lots of work to do, but that's the
| goal.
| datahead wrote:
| Hi holoway, I've been following your project for a couple of
| months now. How do you compare yourselves to upbound/crossplane?
|
| IME crossplane has been a "much better terraform" and also
| borrows from some of tf's open source provider code. Seems to be
| one of the best IaC pattern for k8s centric shops.
|
| Pros: - adoption of k8s core engine, state mgmt
|
| - model everything as a CRD, consistent definition pattern both
| infra and app
|
| - open source
|
| - great UI when layered with argoCD
|
| - declarative
|
| Cons:
|
| - steep abstraction learning curve (for me anyway)
|
| - docs lacked key context for newbs (also getting way better, big
| efforts here)
|
| edit: formatting
| holoway wrote:
| I think you hit the nail on the head with crossplane being a
| 'much better terraform' by design. Our goal isn't so much a
| better IaC / Declarative infrastructure tool - it's a better
| overall workflow for doing collaborative DevOps work. We think
| that by having an active model of your component, and tracking
| the resources along side, we can fix the feedback loops in a
| way that things like crossplane, terraform, or pulumi really
| can't.
|
| Of course today it's early - so you have to look at what we're
| building as a foundation for the future. But it's a solid
| foundation to build on!
| hdjjhhvvhga wrote:
| I read their website, their Github project page, and still have
| no idea what it is (but I know how to install it!). I started to
| read their blog post but it's too long and while they claim this
| tool is useful for DevOps, I couldn't find any info on how it
| accomplishes that.
| btobolaski wrote:
| The website seems to have more information
| https://www.systeminit.com/ the video is enlighting. I'm
| unconvinced by their product though, I'm not sure that this is
| a good approach.
| VectorLock wrote:
| I was interested in the concept but after looking at the
| source code and the architecture I think I agree with the
| "not sure that this is a good approach" conclusion.
| holoway wrote:
| Hey - CEO here. Happy to answer questions if y'all have any.
| VectorLock wrote:
| Was this something you had planned to announce prior to the
| whole Terraform kerfuffle and it is just unfortunate timing, or
| was this precipitated by that event in any way?
| holoway wrote:
| We've been planning to open source it this way for the better
| part of a year. It just so happened that we were ready to
| open it up right after the Hashicorp folks made their
| decision. No intentional timing.
|
| You can see more on our approach here:
| https://www.systeminit.com/open-source/
| Dowwie wrote:
| What were the decisions supporting the project's use of Buck2?
| Considering your team is specializing in the domain of infra
| automation, compile times of all of SI's Rust must be a hot
| topic among the team.
| holoway wrote:
| We've got a fairly large monorepo, with code primarily in
| Rust, Typescript and PgSQL. We wanted something that would
| scale as we grew into things like remote execution and build
| farms, but that would let us be pragmatic in the meantime.
| Buck2 fit the bill at the time we needed to solve the
| problem. We also needed it to understand cross language
| dependencies.
|
| One of the great things about it is that our CI system uses
| BXL to automatically generate pipelines on the fly from
| impacted code, taking into account dependencies. So things
| generally move as quickly as possible through the system.
|
| It's been real work to adopt, but the upside for us has been
| worth it.
| dieortin wrote:
| Any specific thing that made you choose Buck2 over Bazel?
| holoway wrote:
| the ability to not have sandboxed local builds meant that
| it was easy for us to write the starlark/python code we
| needed to get things working in a rough way quickly,
| while correctness can come later.
| mdaniel wrote:
| Apologies if this comes across as "gift horse mouth"-y but
| https://github.com/systeminit/si#local-development-setup and
| its
| https://github.com/systeminit/si/blob/main/docs/DEVELOPMENT_...
| friend are some wowzers for just tire kicking the thing. Is
| there any interest or intention to offer a docker-compose.yml
| for a little less "I want to spend an entire day just to see
| this run?"
| holoway wrote:
| Yep. If you go to https://systeminit.com and click "Sign up",
| you can use our launcher to run a build directly.
| lijok wrote:
| So, so many questions.
|
| Let me preface this by saying - if this works well enough to
| give devs confidence in the tool, this could be revolutionary.
| It would combine implementation, documentation, visuals and
| deployment into a single view simple enough for everyday devs
| to grok.
|
| I couldn't find any documentation - if there is, that answers
| these questions, please link me to them.
|
| 1. How does authentication work? Is it handled by the tool?
|
| 2. Can it support non-AWS resources, such as Grafana?
|
| 3. How does version control work? Can you review changes, roll
| back, etc?
|
| 4. In the demo on the main site, the security group was not
| attached to any VPC, what's going on there?
|
| 5. Does this remain maintainable when dealing with very large
| configurations, for example, a multi-account AWS setup with
| tens of thousands of resources. If so, what mechanisms are
| available in this tool to facilitate this maintainability?
|
| Thank you
| holoway wrote:
| It's very early - it doesn't do much yet (but what it does do
| is compelling!). There isn't a ton of documentation, but we
| have put a lot of real user research into things.
|
| 1. Authentication works through Auth0. We're building towards
| multiple deployment models, where your account works across
| all of them. That said, it's all open source, so if Auth0
| doesn't work for someone, we're happy to make it pluggable.
|
| 2. You can model anything you like. Under the hood it's a
| hypergraph of Typescript functions - so you would model
| Grafana, and then make calls to its API when actions are
| needed.
|
| 3. It's built in to the model via change-sets. As you do
| change the model, we show you whats changed, and what actions
| we would take. The design is heading toward letting you have
| comprehensive reviews based on which portions of the entire
| model are impacted. Roll-backs aren't really a thing in
| infrastructure land, but you can see old versions of the
| model and decide you want that to be the current one.
|
| 4. We model the upstream 1:1 - so that configuration uses the
| default VPC in the AWS account (which has likely been deleted
| if you use Terraform, for example.)
|
| 5. It's too early to have very large configurations yet. But
| there are techniques we can borrow from other domains -
| nesting, for example, or layers. We're working on the
| fundamentals first, and then we will deal with scale.
|
| Great questions!
| kitanata wrote:
| Hacker News does not allow users to delete comments. Your
| comments are trapped here forever. If you ask them to delete your
| comments they will not. If you ask them to delete your account,
| they will not.
|
| We have the right to be forgotten, and Hacker News is in ongoing
| violation of those rights.
|
| Call Congress and demand data protection laws that protect all of
| us. No company should be allowed to keep our data forever,
| especially if we decide to withdraw our consent.
|
| Take back your rights. Take back your data. Delete the algorithm.
| dang wrote:
| You've posted over 150 of these comments in the last 24 hours.
| That's abusive, and I've banned the account. Please don't
| create accounts to break HN's rules with.
|
| https://news.ycombinator.com/newsguidelines.html
| 1xb3l wrote:
| [dead]
| hdjjhhvvhga wrote:
| They were off-topic, but they do have a point.
| dredmorbius wrote:
| _Can I delete my account?_
|
| _We try not to delete entire account histories because
| that would gut the threads the account had participated in.
| However, we care about protecting individual users and take
| care of privacy requests every day, so if we can help,
| please email hn@ycombinator.com. We don 't want anyone to
| get in trouble from anything they posted to HN. More here
| <https://news.ycombinator.com/item?id=23623799>._
|
| <https://news.ycombinator.com/newsfaq.html>
| zen928 wrote:
| and when you architect managing user privacy as a drawn-
| out process that won't even begin until another human
| responds in a completely manual engagement, i can
| immediately see the motivation of the above poster
| wanting administration to provide an answer without the
| response time being calculated in business days.
|
| completely fair game to shortcut an outdated hostile
| process with your own hostility, not really an unexpected
| result (e.g.: web scraping VS using an inaccessible API).
| it's an unacceptable approach in a modern context.
| dredmorbius wrote:
| HN moderator email response is typically within a few
| hours, days at the outside.
|
| The process is not, by any reasonable interpretation,
| "drawn out".
| kitanata wrote:
| I'm going to attempt to respond. I emailed HN asking my
| account to be deleted. HN staff refused. I followed your
| official process for account removal and deletion and I
| got told to take a hike.
|
| Anyone from HN saying I did not make a formal request is
| lying! Delete my data at once!
|
| Edit: look ma! I've been unbanned! Listen HN mods. I'm
| cool with a ban. Just delete my data first.
|
| Edit 2: (looks like I'm kinda banned again IDK) Lol.
| Please delete all my comments, posts and account dang. I
| don't want to be here anymore and I feel trapped. Please
| just delete my data. Please!!!
| dang wrote:
| Nobody has a point after posting the same thing 150 times.
|
| The posts were almost all flagkilled by users, which is a
| strong community reaction.
| amf12 wrote:
| Well, do you allow account deletions then? It should be
| supported under GDPR. We discuss this about other tech
| companies all the time here on HN. I never realized this
| is not possible on HN.
| viraptor wrote:
| There seems to be a way you could quickly solve this
| problem... can't quite put my finger on it, but there may be
| a hint in that person's comment.
| throwawaaarrgh wrote:
| Used identical tools before. It's just another vendor lock in
| monoculture. Doesn't matter that it's open source. The design is
| such that it's all or nothing. Same as Terraform.
| holoway wrote:
| One side effect of our design is that, once we bring more of
| the bi-directional capabilities back into the product - we can
| track the real-world resources as they change, and update the
| model on your behalf. So you can keep using (or start using)
| whatever tool you like to make the changes, and SI will do its
| best to help you rationalize that. We've had this working in
| earlier versions, and will again in the not too distant future.
___________________________________________________________________
(page generated 2023-08-16 23:01 UTC)