[HN Gopher] System Initiative has open sourced its collab DevOps...
       ___________________________________________________________________
        
       System Initiative has open sourced its collab DevOps tool
        
       Author : vmbrasseur
       Score  : 55 points
       Date   : 2023-08-16 16:11 UTC (6 hours ago)
        
 (HTM) web link (www.systeminit.com)
 (TXT) w3m dump (www.systeminit.com)
        
       | c7DJTLrn wrote:
       | It looks cool, but I would be hesitant to leave IaC behind.
       | DevOps/sysadmin kind of people are infamous for (generally) not
       | liking GUIs for a reason. We like being able to grep through a
       | repo, revert to older versions of the code, and deploy new infra
       | all through the CLI.
       | 
       | It might be adopted by people who already do ClickOps or aren't
       | comfortable with the CLI, but I'm not sure about the rest of us.
       | Looking forward to seeing how it progresses.
        
         | hiepph wrote:
         | I heard in a Podcast that they are inspired by game development
         | workflow (e.g. Unity) where multiple teams can work together in
         | a unified way. This reduces "niche" power like CLI commands
         | that only some of sysadmins can wield.
         | 
         | Personally, as an infrastructure engineer, I still prefer CLI
         | and everything as (text) code. But I'm open to change if this
         | "second wave" could take off.
        
           | maccard wrote:
           | As someone who works on games professionally, the first thing
           | people do is turn on the text support for unity assets.
           | Unreal still uses binary assets and it's a giant pain in the
           | ass.
           | 
           | The problem isn't that everything should be text, it's that
           | there are no tools out there that work with other content
           | types. Semantic diff tools would be incredible honestly, and
           | text is a poor representation of code. It's just the best we
           | have right now
        
         | holoway wrote:
         | Skepticism here is warranted - the history of things that look
         | like this in our space isn't fantastic. We've put a lot of
         | engineering into trying to create something that is a power
         | tool, and flexible enough to solve hard real world problems.
         | It's early, and we've got lots of work to do, but that's the
         | goal.
        
       | datahead wrote:
       | Hi holoway, I've been following your project for a couple of
       | months now. How do you compare yourselves to upbound/crossplane?
       | 
       | IME crossplane has been a "much better terraform" and also
       | borrows from some of tf's open source provider code. Seems to be
       | one of the best IaC pattern for k8s centric shops.
       | 
       | Pros: - adoption of k8s core engine, state mgmt
       | 
       | - model everything as a CRD, consistent definition pattern both
       | infra and app
       | 
       | - open source
       | 
       | - great UI when layered with argoCD
       | 
       | - declarative
       | 
       | Cons:
       | 
       | - steep abstraction learning curve (for me anyway)
       | 
       | - docs lacked key context for newbs (also getting way better, big
       | efforts here)
       | 
       | edit: formatting
        
         | holoway wrote:
         | I think you hit the nail on the head with crossplane being a
         | 'much better terraform' by design. Our goal isn't so much a
         | better IaC / Declarative infrastructure tool - it's a better
         | overall workflow for doing collaborative DevOps work. We think
         | that by having an active model of your component, and tracking
         | the resources along side, we can fix the feedback loops in a
         | way that things like crossplane, terraform, or pulumi really
         | can't.
         | 
         | Of course today it's early - so you have to look at what we're
         | building as a foundation for the future. But it's a solid
         | foundation to build on!
        
       | hdjjhhvvhga wrote:
       | I read their website, their Github project page, and still have
       | no idea what it is (but I know how to install it!). I started to
       | read their blog post but it's too long and while they claim this
       | tool is useful for DevOps, I couldn't find any info on how it
       | accomplishes that.
        
         | btobolaski wrote:
         | The website seems to have more information
         | https://www.systeminit.com/ the video is enlighting. I'm
         | unconvinced by their product though, I'm not sure that this is
         | a good approach.
        
           | VectorLock wrote:
           | I was interested in the concept but after looking at the
           | source code and the architecture I think I agree with the
           | "not sure that this is a good approach" conclusion.
        
       | holoway wrote:
       | Hey - CEO here. Happy to answer questions if y'all have any.
        
         | VectorLock wrote:
         | Was this something you had planned to announce prior to the
         | whole Terraform kerfuffle and it is just unfortunate timing, or
         | was this precipitated by that event in any way?
        
           | holoway wrote:
           | We've been planning to open source it this way for the better
           | part of a year. It just so happened that we were ready to
           | open it up right after the Hashicorp folks made their
           | decision. No intentional timing.
           | 
           | You can see more on our approach here:
           | https://www.systeminit.com/open-source/
        
         | Dowwie wrote:
         | What were the decisions supporting the project's use of Buck2?
         | Considering your team is specializing in the domain of infra
         | automation, compile times of all of SI's Rust must be a hot
         | topic among the team.
        
           | holoway wrote:
           | We've got a fairly large monorepo, with code primarily in
           | Rust, Typescript and PgSQL. We wanted something that would
           | scale as we grew into things like remote execution and build
           | farms, but that would let us be pragmatic in the meantime.
           | Buck2 fit the bill at the time we needed to solve the
           | problem. We also needed it to understand cross language
           | dependencies.
           | 
           | One of the great things about it is that our CI system uses
           | BXL to automatically generate pipelines on the fly from
           | impacted code, taking into account dependencies. So things
           | generally move as quickly as possible through the system.
           | 
           | It's been real work to adopt, but the upside for us has been
           | worth it.
        
             | dieortin wrote:
             | Any specific thing that made you choose Buck2 over Bazel?
        
               | holoway wrote:
               | the ability to not have sandboxed local builds meant that
               | it was easy for us to write the starlark/python code we
               | needed to get things working in a rough way quickly,
               | while correctness can come later.
        
         | mdaniel wrote:
         | Apologies if this comes across as "gift horse mouth"-y but
         | https://github.com/systeminit/si#local-development-setup and
         | its
         | https://github.com/systeminit/si/blob/main/docs/DEVELOPMENT_...
         | friend are some wowzers for just tire kicking the thing. Is
         | there any interest or intention to offer a docker-compose.yml
         | for a little less "I want to spend an entire day just to see
         | this run?"
        
           | holoway wrote:
           | Yep. If you go to https://systeminit.com and click "Sign up",
           | you can use our launcher to run a build directly.
        
         | lijok wrote:
         | So, so many questions.
         | 
         | Let me preface this by saying - if this works well enough to
         | give devs confidence in the tool, this could be revolutionary.
         | It would combine implementation, documentation, visuals and
         | deployment into a single view simple enough for everyday devs
         | to grok.
         | 
         | I couldn't find any documentation - if there is, that answers
         | these questions, please link me to them.
         | 
         | 1. How does authentication work? Is it handled by the tool?
         | 
         | 2. Can it support non-AWS resources, such as Grafana?
         | 
         | 3. How does version control work? Can you review changes, roll
         | back, etc?
         | 
         | 4. In the demo on the main site, the security group was not
         | attached to any VPC, what's going on there?
         | 
         | 5. Does this remain maintainable when dealing with very large
         | configurations, for example, a multi-account AWS setup with
         | tens of thousands of resources. If so, what mechanisms are
         | available in this tool to facilitate this maintainability?
         | 
         | Thank you
        
           | holoway wrote:
           | It's very early - it doesn't do much yet (but what it does do
           | is compelling!). There isn't a ton of documentation, but we
           | have put a lot of real user research into things.
           | 
           | 1. Authentication works through Auth0. We're building towards
           | multiple deployment models, where your account works across
           | all of them. That said, it's all open source, so if Auth0
           | doesn't work for someone, we're happy to make it pluggable.
           | 
           | 2. You can model anything you like. Under the hood it's a
           | hypergraph of Typescript functions - so you would model
           | Grafana, and then make calls to its API when actions are
           | needed.
           | 
           | 3. It's built in to the model via change-sets. As you do
           | change the model, we show you whats changed, and what actions
           | we would take. The design is heading toward letting you have
           | comprehensive reviews based on which portions of the entire
           | model are impacted. Roll-backs aren't really a thing in
           | infrastructure land, but you can see old versions of the
           | model and decide you want that to be the current one.
           | 
           | 4. We model the upstream 1:1 - so that configuration uses the
           | default VPC in the AWS account (which has likely been deleted
           | if you use Terraform, for example.)
           | 
           | 5. It's too early to have very large configurations yet. But
           | there are techniques we can borrow from other domains -
           | nesting, for example, or layers. We're working on the
           | fundamentals first, and then we will deal with scale.
           | 
           | Great questions!
        
       | kitanata wrote:
       | Hacker News does not allow users to delete comments. Your
       | comments are trapped here forever. If you ask them to delete your
       | comments they will not. If you ask them to delete your account,
       | they will not.
       | 
       | We have the right to be forgotten, and Hacker News is in ongoing
       | violation of those rights.
       | 
       | Call Congress and demand data protection laws that protect all of
       | us. No company should be allowed to keep our data forever,
       | especially if we decide to withdraw our consent.
       | 
       | Take back your rights. Take back your data. Delete the algorithm.
        
         | dang wrote:
         | You've posted over 150 of these comments in the last 24 hours.
         | That's abusive, and I've banned the account. Please don't
         | create accounts to break HN's rules with.
         | 
         | https://news.ycombinator.com/newsguidelines.html
        
           | 1xb3l wrote:
           | [dead]
        
           | hdjjhhvvhga wrote:
           | They were off-topic, but they do have a point.
        
             | dredmorbius wrote:
             | _Can I delete my account?_
             | 
             |  _We try not to delete entire account histories because
             | that would gut the threads the account had participated in.
             | However, we care about protecting individual users and take
             | care of privacy requests every day, so if we can help,
             | please email hn@ycombinator.com. We don 't want anyone to
             | get in trouble from anything they posted to HN. More here
             | <https://news.ycombinator.com/item?id=23623799>._
             | 
             | <https://news.ycombinator.com/newsfaq.html>
        
               | zen928 wrote:
               | and when you architect managing user privacy as a drawn-
               | out process that won't even begin until another human
               | responds in a completely manual engagement, i can
               | immediately see the motivation of the above poster
               | wanting administration to provide an answer without the
               | response time being calculated in business days.
               | 
               | completely fair game to shortcut an outdated hostile
               | process with your own hostility, not really an unexpected
               | result (e.g.: web scraping VS using an inaccessible API).
               | it's an unacceptable approach in a modern context.
        
               | dredmorbius wrote:
               | HN moderator email response is typically within a few
               | hours, days at the outside.
               | 
               | The process is not, by any reasonable interpretation,
               | "drawn out".
        
               | kitanata wrote:
               | I'm going to attempt to respond. I emailed HN asking my
               | account to be deleted. HN staff refused. I followed your
               | official process for account removal and deletion and I
               | got told to take a hike.
               | 
               | Anyone from HN saying I did not make a formal request is
               | lying! Delete my data at once!
               | 
               | Edit: look ma! I've been unbanned! Listen HN mods. I'm
               | cool with a ban. Just delete my data first.
               | 
               | Edit 2: (looks like I'm kinda banned again IDK) Lol.
               | Please delete all my comments, posts and account dang. I
               | don't want to be here anymore and I feel trapped. Please
               | just delete my data. Please!!!
        
             | dang wrote:
             | Nobody has a point after posting the same thing 150 times.
             | 
             | The posts were almost all flagkilled by users, which is a
             | strong community reaction.
        
               | amf12 wrote:
               | Well, do you allow account deletions then? It should be
               | supported under GDPR. We discuss this about other tech
               | companies all the time here on HN. I never realized this
               | is not possible on HN.
        
           | viraptor wrote:
           | There seems to be a way you could quickly solve this
           | problem... can't quite put my finger on it, but there may be
           | a hint in that person's comment.
        
       | throwawaaarrgh wrote:
       | Used identical tools before. It's just another vendor lock in
       | monoculture. Doesn't matter that it's open source. The design is
       | such that it's all or nothing. Same as Terraform.
        
         | holoway wrote:
         | One side effect of our design is that, once we bring more of
         | the bi-directional capabilities back into the product - we can
         | track the real-world resources as they change, and update the
         | model on your behalf. So you can keep using (or start using)
         | whatever tool you like to make the changes, and SI will do its
         | best to help you rationalize that. We've had this working in
         | earlier versions, and will again in the not too distant future.
        
       ___________________________________________________________________
       (page generated 2023-08-16 23:01 UTC)