Hacker News Reader

Comment by jen20 | Hacker News Reader

This is a weird take. If anything, Nomad, Consul and Vault are on the ascent, as the realities of the CNCF ecosystem set in for people with results to deliver.

View on HN

The BSL licensing thing has turned off a lot of the more hobbyist/tinkerer-centric users who really rocketed HashiCorp's products up the ladder in their orgs.

It's a bit like Elasticsearch, I think—it's gotten big enough it won't be a quick death, but I don't see Hashi's products growing/dominating as much now as I did a couple years ago.

(As an aside, I'd like to thank Mitchell for his work over the years, Vagrant especially was huge in my infrastructure work, and Terraform was a great companion to Ansible and CloudFormation as we automated more and more stuff.)

It's true that the licensing change is a turnoff, but Terraform redefined an industry. What's the alternative?

(I'm hoping Mitchell is going to have an answer to that)

It was forked. The OpenTofu variant seems to have backing. Used it yesterday.

Pulumi and Crossplane

Or OpenTF if you want to same thing minus the licensing mess

> Crossplane

I tried to understand what is it, how it works, what is it good for, but ... never managed to. It still has the same "build control planes without needing to write code" on its website. okay, it says "orchestrate applications and infrastructure". that's at least makes sense when the context is Terraform and Pulumi.

okay, in the quickstart the whole thing seems like code. but okay.

ah, so you can use k8s CRDs to define cloud stuff (like S3 buckets and GCP GCS buckets and whatnot), not bad, but super verbose.

Pulumi -> Same end result as Terraform but you use Code (python, go, typescript) to describe resources instead of hcl

Crossplane -> Same end result as Terraform but you use K8s resources in YAML to describe your infra.

I hope that helps. But I agree that the crossplane/upbound marketing is super confusing.

Thanks for noting these. From my experience, neither can replace terraform (though Pulumi might be on the right track). Neither come anywhere close to the Terraform AWS provider, and tightly coupling my IaC to Kubernetes is a non-starter for me (and I'm sure for many others as well).

Imo main benefit is you can use 1 tool/deploy pipeline for app and infrastructure.

Yes, technically you can do that with Terraform but in my experience it doesn't work great for code deploys (which tend to have procedural steps)

Based on my limited experience Vault is actually becoming a niche tool. Big cloud players have been offering more limited solutions that are good enough for many if not most use cases. A few years ago as a consultant I'd unconditionally recommend Vault to my clients. If I were consulting today, I'd first ask what are they missing from KMS and Secrets Manager.

KMS? Secrets manager? Are those offered by a particular vendor or what

Yeah, they’re AWS secrets management services.

Yes, these two are AWS terms, but other clouds have nearly the same services, and often called the same, too.

Yes but if you want to be multi-cloud and not have to integrate with each cloud's secret storage API, you would do it once for Vault and bring it with you to each cloud.

Probably I just work at more dysfunctional places than you, but:

If I'm building product for on prem I'd prefer to use env vars or k8s secrets and let the customer integrate their preferred secrets manager. Also helpful when you run sales POCs where ease of getting to splash page really matters.

Building inside enterprise, I've never actually had to support multiple clouds for the same component but if it ever comes up and I have any sort of choice in the matter I would probably rather template 3 native secrets integrations than deal with the special circle of hell that is enterprise-managed Vault or CyberArk.

The reality is you will never use a common secret storage anyway as usually and even when using multi-cloud tools like terraform you write a lot of cloud vendor specific stuff because they do not share the same provider. So using different secret storage API is not a huge deal and pretty much a moot point.

Also my vision of multi-cloud in large org hasn't been that a particular product/app or team was ever using multiple clouds. My experience is that large orgs like to have multi-cloud support because they grow by acquiring other companies regardless of which cloud vendor they are using so you just want to provide standards and templates for everyone. Obviously said templates will be usually cloud vendor specifics.

Even when going multi-cloud you can employ different strategies. Vault is definitely one of them, but you can also use federation to exchange one cloud's credentials for another's, giving you the ability to centralize secrets in one of them. You can use a layer of abstraction like GoCloud [0]. You can also build for each cloud separately and decide either not to centralize secrets at all, or build some trivial bespoke tooling to synchronize some of them. I'm not endorsing any of the options, nor am I trying to argue that Vault is never the right choice, I'm just pointing out that Vault isn't the only viable alternative.

https://github.com/google/go-cloud

Nomad is dead in the water.

When you talk to Consul support engineers, they assume you're using kubernetes, and are confused if you tell them you're using Nomad, _a product that their company makes_.

Nomad will be there when managed k8s gets too expensive. I was looking at it seriously last year for on prem. I chickend put bcz I didn't want to be the only person on my team that understood it. We still don't have a solution, but nomad will be there for when we are ready to progress, regardless of the license.

Why would managed k8s get more expensive?

Complexity. Monetary is not the only (or even primary) form of expense.

> I chickend put bcz I didn't want to be the only person on my team that understood it.

There are online courses for free and paid courses (online and in person) so if they have the desire to learn, you won't be the only person.

Anecdotally, I've started transitioning more stuff from Nomad/Consul to k8s after Hashicorp's licensing changes. I somehow doubt I'm the only one.

Still happily using Vault for now, though.

> Still happily using Vault for now, though.

You should switch to OpenBAO.

It’s not really. For a long time their products were open source, free to use and widely adopted by the tinkering masses. Now the company has shareholders, is chasing the big juicy enterprise customers and has a pricing structure that would make Oracle blush (hyperbole, but still…).

It’s a different beast than the company Mitchell founded and that HN knew and loved, that’s all.

Reply on news.ycombinator.com