izalutski
Joined 10 years ago
Joined 10 years ago
(Disclosure: I'm from Digger and OpenTF so am biased)
Hashi's biggest miscalculation is that they put Terraform (an open language / ecosystem) into the same bucket as Vault and Consul, which are hostable backend applications.
BSL makes sense for Vault, just like it does for MongoDB. It is reasonable to prevent others from charging for hosting your code.
But with Terraform, the backend part (TF Cloud) was never even open source. And it's not required for Terraform to work.
Hashi shot themselves in the foot. Unlike with Vault or Consul, there is enormous vested interest in the community to keep Terraform truly open. Hashi trying to enforce everyone to use their non-oss backend with it will only result in Hashi losing the privileged (and well deserved) position among providers of commercial products in the Terraform ecosystem.
Yeah so basically TACOS are ci-like tools / control planes for Terraform. The OG one being Terraform Cloud.
The term TACOS was coined by Piotr Zaniewski here: https://itnext.io/spice-up-your-infrastructure-as-code-with-...
It looks like it boils down to being no longer able to "incorporate the source code or embed or distribute newer versions of Terraform." (From Spacelift's blog). For a piece of software that doesn't even have a server, this seems extremely restrictive. I wouldn't be surprised if Hashicorp takes a few steps back on this / provides clarifications for specific use cases
Companies that use Atlantis at scale (eg Lyft) felt the need to fork it and use a scalable compute backend instead, eg Temporal. At which point you've basically got a DIY in-house CI.
Our view is that it's best to keep matters separate. The CI part with compute, jobs, logs etc is a solved problem. What's unsolved for Terraform is state-aware logic when / how to run those jobs. It's all about the orchestrator really.
We were initially completely backend-less; but then it increasingly became apparent that a central orchestrator is unavoidable.
Rationale here: https://diggerdev.notion.site/Why-digger-introduces-an-orche...
In hindsight, it makes sense that literally every single other tool in the space has a central backend that orchestrates jobs. There's a good reason for that.
To address security / access concerns, you can either self-host the orchestrator, or use OIDC, or both
The most fun thing is - Digger + Dagger could be a great combo! We haven't yet explored properly but in theory it shouldn't be anything different from adding another CI provider; we already support GitHub Actions, Gitlab CI and Azure DevOps
Tracking here: https://github.com/diggerhq/digger/issues/206
And btw contributions very welcome, we're a small team so every bit helps, even if it's just filing or labeling an issue
Also blogged about it: https://medium.com/@DiggerHQ/we-rewrote-our-product-in-go-fr...
https://docs.digger.dev/cloud-providers/authenticating-with-...