August 2023 Summaries

Linting is a process of using static code analysis tools to identify potential errors, bugs, stylistic errors, and suspicious constructs in your code. It helps establish consistent coding styles across projects, making the code more readable and understandable while catching common mistakes that might go unnoticed during manual code reviews. TFLint is a popular open-source linter and static analysis tool designed specifically for Terraform, ensuring quality and consistency of Terraform code by analyzing it for potential issues, errors, or violations of best practices. Other open-source tools like Checkov and Terrascan can also be used for Terraform linting. TFLint installation varies depending on the operating system, but once installed, it can be verified using the command tflint --version. The .tflint.hcl file is a configuration file that allows customization of TFLint's behavior and rules. Plugins for popular cloud providers can be installed to add further functionality and improve code quality in Terraform projects.

The Elastic Container Service (ECS) from Amazon Web Services (AWS) is a fully-managed cloud Container Orchestration Service that runs multiple Docker containers on the cluster using AWS EC2 instances. ECS simplifies the deployment process by providing an automated way to manage AWS ECS Clusters, making it consistent and repeatable. Terraform is used to set up an ECS cluster of EC2 instances, covering topics such as VPC setup, EC2 instance configuration, application load balancer setup, ECS task definition creation, and service provisioning. The final Terraform configuration is saved in a Github repository. To deploy ECS using Terraform, one needs to establish an isolated network by defining the VPC and related components, creating EC2 launch templates, configuring auto-scaling groups, setting up application load balancers, and provisioning ECS clusters and services. Terraform helps manage infrastructure at scale, providing features such as state management, build workflows, policy as code, and resource visualization.

Docker's CMD and ENTRYPOINT instructions work together to define the command that runs when a container starts. ENTRYPOINT sets the process that will be executed inside the container, while CMD supplies default arguments to that process. Images can only have one ENTRYPOINT, which defaults to /bin/sh -c if not specified. The docker run command starts a new container using a specified image and sets the CMD passed as arguments to the image's ENTRYPOINT. It is possible to override the ENTRYPOINT using the --entrypoint flag, but this should rarely be necessary for container images being used in the intended way. Separating these two instructions makes Docker container images more flexible, particularly when packaging command-line applications.

Hashicorp's adoption of a Business Source License (BSL) for its core products has led to the creation of OpenTF, an initiative by more than 100 companies and 400 individuals to maintain Terraform as an open-source tool. Inspired by the OpenTF manifesto, which aims to keep Terraform truly open-source and governed by the community for the community, a fork of the legacy MPL-licensed Terraform has been created under the name OpenTF fork. The project is now working towards making a foundation responsible for the project to ensure its open-source and vendor-neutral nature.

On August 10th, HashiCorp announced a change in the license for their core products, including Terraform, from an open-source Mozilla Public License (MPL v2) to a Business Source License (BSL v1.1). Unlike MPL, BSL is not an open source license and places restrictions on commercial use of HashiCorp's products. This move has raised concerns within the open-source community, as it appears to violate the trust placed in HashiCorp by those who have adopted, contributed to, and advocated for Terraform over the past nine years. In response, a collaborative initiative called OpenTF has been formed, with the intent of ensuring the continued survival of Terraform as an open-source tool. OpenTF is appealing to HashiCorp to revert Terraform back to its original MPL license and establish safeguards to ensure it remains open source indefinitely. If unsuccessful, OpenTF plans to fork the project under its original MPL license and establish a foundation with independent governance.

Spacelift has promised a more comprehensive update on the impact of HashiCorp's recent license change on its operations and customers. While there is no immediate impact on current operations, there are long-term consequences for the entire community that need to be addressed collectively. All current versions of Terraform remain unaffected, and Spacelift believes it is not in violation of the new license as it does not incorporate any Terraform source code into its services. However, concerns have been raised about the vague wording of the license and HashiCorp's willingness to change interpretation according to their business objectives. Spacelift has decided to back a community effort to create a level playing field for the future relevance of the Terraform language and ecosystem.

HashiCorp has announced that they are changing the license on all their products to exclude use by direct competitors, affecting versions of Terraform beyond 1.5.5. While current versions remain unaffected, this move raises questions about its ethics and consistency with open source software ideals. Despite this change, alternative tools like Spacelift offer flexibility in CI/CD automation and infrastructure management.

Versioning is crucial when using Infrastructure as Code (IaC) tools like Terraform to ensure that there are no breaking changes in the code. Key points related to versioning include: 1. Stick to a specific version for your Terraform code and providers to avoid breaking changes. 2. Use a Version Control System (VCS) like git for collaboration between teams, reducing human errors. 3. Understand the widely accepted standard of defining versions as Major.Minor.Patch. 4. Be aware that patch updates are less likely to cause breaking changes, while minor and major updates may introduce them. 5. Use Terraform commands to check your current version and the latest available versions for both Terraform and its providers. 6. Introduce version constraints in multiple ways, such as equal, not equal, greater/less or equal to, and allowing only the most upright version to increment. 7. Understand breaking changes that may occur during minor version updates and follow upgrade guides provided by Terraform. 8. Upgrade your local Terraform version using different methods like downloading directly, using tfswitch, or tfenv. 9. Develop an upgrade strategy for both Terraform and its providers to ensure a smooth transition between versions. 10. Follow Terraform's GitHub repository and the repository for specific providers to stay updated on new features and changes.

Infrastructure as Code (IaC) offers significant benefits in terms of scalability, efficiency, and reliability but is also subject to security threats. To secure IaC infrastructure, it's crucial to focus on network security, access control, data protection, runtime configuration, and regular audits. Common security concerns in IaC include misconfiguration, hard-coded secrets, lack of security tests, encryption issues, and audit trails. Adopting best practices such as using SSO, enabling MFA, encrypting data at rest and transit, and conducting regular security vulnerability scanning can help improve IaC security. Spacelift's security architecture is SOC2 Type II certified, which involves assessing five pillars of trust: Security, Availability, Integrity, Confidentiality, and Privacy. Regular security audits and penetration testing are also conducted to identify weaknesses and ensure compliance with the trust pillars. Spacelift's security features include SSO, private workers, access to private VCS, spaces for access control, cloud integrations, environment variables and contexts, policies, custom inputs, module registry, state management, and self-hosted options.

Infrastructure as code (IaC) is an emerging market, predicted to grow significantly by 2030. IaC emerged from the Automation element of the CALMS framework and is a pillar of modern DevOps Approach. However, many organizations implemented CI/CD for applications but treated infrastructure separately, leading to issues such as inconsistent executions, incomplete understanding of the process inside teams, lack of communication, long delays, and lack of control. Combining IaC execution with CI/CD pipelines allowed businesses to automate processes, not just single executions. Dedicated tools like Spacelift encapsulate the whole spectrum of infrastructure SDLC in one tool, allowing organizations to control the process from all angles, including tooling, processes themselves, governance, security, and compliance.

This blog post delves into the use of Ansible's shell module to execute remote commands on nodes as part of automation efforts. The shell module is used to run shell commands in target machines and supports pipe |, redirection <, >, >>, etc. Examples are provided for using the shell module, including executing a single command, running a command if a file doesn't exist, showing disk usage, executing commands in a specific directory, and more. Alternative options to run remote commands with Ansible include the command, expect, script, and raw modules. The post also discusses when to use the shell module vs. the command module, highlighting that the shell module is preferred for cases involving shell-specific features or scripts that must be executed in a shell context.

Kubecost is a tool designed to address Kubernetes cost management challenges by offering real-time visibility into the costs associated with your cluster's resources. It helps detect cost overruns early and provides recommendations for improving resource utilization efficiency. Key features include precise cost breakdowns, monitoring of resource utilization, alerts when cost thresholds are breached, and suggestions on how to reduce costs. Kubecost can be easily installed using Helm and offers a free community version with limited metric retention period and paid Enterprise plan with additional features such as budgeting and SSO/SAML support.

Women are underrepresented in the DevOps field, with only 13.8% of engineers being female in the United States. However, this is a lucrative and evolving career that offers excellent opportunities for progression. To become a successful DevOps practitioner, one needs to have not just technical skills but also flexibility, innovation, teamwork, transparency, empathy, and a growth mindset. Some of the key skills required include basic coding, automation, containerization, configuration, version control systems (VCS), packaging, networking, cloud training and certification, and advanced scripting. To close the gender gap in DevOps, awareness, advocacy, and action are needed through initiatives like Women in DevOps, National Center for Women & Information Technology (NCWIT), Women in Infrastructure (WIM), and Women Who Code.

This article provides a comprehensive guide on setting up Kubernetes clusters using four different tools: Minikube, MicroK8s, K3s, and Kubeadm. It covers the installation process for each tool, as well as their respective advantages and disadvantages. Additionally, it discusses how to interact with your cluster once it's set up, including using popular tools like Kubectl CLI, Kubernetes Dashboard, and Lens. The article concludes by recommending Spacelift for automating Kubernetes deployments in cloud infrastructure.

Infrastructure as Code (IaC) has become a popular method for managing infrastructure in the last decade. Terraform Cloud is a platform developed by Hashicorp that helps manage your Terraform code, enhancing collaboration between developers and DevOps engineers, simplifying workflows, and improving security overall around the product. Key features of Terraform Cloud include workspaces, projects, runs, variables and variable sets, policies and policy sets, run tasks, single sign-on (SSO), remote state, private registry, agents, and drift detection. The benefits of using Terraform Cloud include role-based access control, remote state management, policy as code, version control integration, observability, and drift detection.