Hacker News Reader

Comment by ThrowawayR2 | Hacker News Reader

A lot of developers have a cowboy coder mentality that causes problems when they are given access to production instances. That's caused many organizations to establish a wall between development teams and operations.

Learn to work with your devops team to get the information you need. Developers should not need direct production access.

View on HN

> Developers should not need direct production access.

Then stop telling me I need years of experience with Docker, K8s, AWS, etc. on dev job listings.

The architect who designed my house does not need access to come inside my house anytime they feel like it.

This is a poor analogy. Does a developer need to understand some infra fundamentals in order to properly architect applications? Absolutely. Should they need as much experience as a devops of infra engineer? Absolutely not. That's just shoveling more work and expectations on someone to squeeze more value for the same dollars out of them.

There are only so many productive hours in the day. You can not be an expert in everything, there simply isn't enough time.

> The architect who designed my house does not need access to the construction site.

FTFY

Architects routinely visit job sites. Of we continue to twist this analogy, staging would be the construction site and the finished building would be prod. Developers never need access to prod.

It’s also worth noting that if you’ve got enterprise customers, and you’re shipping “on prem” to them, your company might not even be able to access “prod.” You need to get the devops to a point of maturity that you can hand the whole stack over to an engineer at the customer company and have them take it from there.

If in order to get a job as a senior architect I have to have experience that I can only get by having access to come inside your house, then yeah I kind of do.

Nope. Developers can get all the experience they need in a dev sandbox environment with all the same tools and infra. They do not need access to the production environment.

It's a responsibility / authority issue, generally brought on by poor management. I get what you are saying, and I suspect many in this thread agree with your sentiments. Frankly, when I'm wearing the developer hat I'd rather not have production access, because then I can tell management / the business that I can't fix their production issue. But, often management is going to cajole, yell, scream, etc at whomever they think can fix the problem, and that often ends up with a developer who doesn't even want to be there having production access in order to fight yet another fire. Shouldn't be that way, but there it is.

I remember seeing job postings in the early 2000s requiring 10 years of php experience.

Those requirements are usually BS added by hr or a recruiter mangling what devs said they need on the team. i.e. "it'd be nice if they were familar with aws" becomes "aws required... well we're looking for someone above jr level, so all the requirements need at least 10 years..."

Devs don’t necessarily need to be involved with IAM roles, but they should know what their app requires.

Devs that have their work deployed on k8s don’t need to know how the ingress controller is configured, or how etcd works, but will be crippled if you’re confused my service and deployments.

All that being said, job listings are often filled with nonsense. If you like the company, just ignore all of that and start a conversation.

Just because I don't have direct production access doesn't mean that the people with direct production access aren't just executing the same scripts with different environment variables that I'm writing and running in the development and test environments.

> Developers should not need direct production access.

Agreed with the proviso that there are enough people this is possible (not always).

I'm a senior dev who runs a team and I am the only one with access to production which I've not used yet - if I ever actually need to use that access then the outcome will be a discussion on how to avoid that need in future (my access is for a holy shit, that should never have happend, put it back up and figure out how it happened now scenario).

It's not just a stability issue, it is also a data protection/security issue - I trust every dev on my team but if they don't have access whether I trust them or not is immaterial.

I write code for many projects. I vastly prefer those that forbid my access to the production instance. So much less stress.

Reply on news.ycombinator.com