I also faced this exact issue in my daily job (on quite a big scale) and indeed, it's quite challenging to get it right, mostly because it depends on a number of factors:
What's the prediction of the infra code change in the future? Usually the infra code gets built once, and then only minor updates are added along the way. Is it going to be a frequent operation or not really?
How many people are going to update the infra code over time? Do they need to check-out many repos or a single one?
How many teams are going to own those repos? There will be one team or many?
Those are just a few thoughts, but I'm sure there can be other aspects that should be considered.
Now from my experience, this is what I can share (hopefully useful):
If the infra code complexity is not projected to be huge, you can start with a dedicated repo that contains all the terraform code. I used that for years and it works even if the infrastructure components is owned by multiple teams. It's not ideal, but it's a working solution.
Splitting the code into each repository can/should be done when the mono-repo gets too big and hard to manage. This will add coupling between the new mono-repo (because you may still need some global infra components, like VPCs or subnets), and the code in each repo. However, in this way you're going to have all the code of a component in a single repo, which is useful for debugging, migrating the service on a different cloud provider (maybe).
Initially I used the first approach and then progressively transitioned to the second one (for new services being deployed). In both cases, the infra code was updated only once (when the service was deployed) and remained untouched afterwards.
I've started avidly working with terraform in ~2017 & it has taken me a few years to get to where I am now with terraform modules & structures:
Each terraform module has it's repo & is versioned (not it's own state file though).
Each terraform module is 100% re-usable by ensuring every parameter is a variable.
Each terraform module is 100% re-usable by ensuring 1:1 module:resource. No other modules are called within these modules.
Examples;
1 terraform module for AWS Load Balancer
1 terraform module for AWS Auto Scaling Group
(or I use a pre-defined HashiCorp module).
Root Modules are used to tie all the Resource Modules above and that is where the terraform plan is applied. It's made it very easy for me to copy and past root modules as templates for other stacks and just change variables.
I use terraform cloud to manage & import all the terraform modules as well as my workspaces (root modules). This helps with centralization. Within Terraform Cloud it's very easy to see where a workspace (root module / plan) has failed and the last time it was run. Alarms can be added via web hooks making infra mgmt more tangible.
With the above set-up my CI/CD pipeline uses a terraform cloud token to trigger any related infra set up or refresh.
For any server related setup (such as AWS EC2 Instances), code is automatically deployed via bootstraps aka user-data when a new EC2 is deployed.
Be sure to use consistent naming conventions!
I've found the above approach to really help with managing micro-services and any kind of cloud infra, whether it's serverless or server based.
发布评论
评论（2）
我在日常工作（相当大的规模上）也遇到了这个确切的问题，而正确的事情是非常具有挑战性的，这主要是因为这取决于许多因素：
这些只是一些想法，但我敢肯定，还可以考虑其他方面。
现在，根据我的经验，这是我可以分享的内容（希望有用）：
最初，我使用了第一种方法，然后逐步过渡到第二种方法（用于部署的新服务）。在这两种情况下，下属代码仅更新一次（部署服务时），此后仍未受到影响。
I also faced this exact issue in my daily job (on quite a big scale) and indeed, it's quite challenging to get it right, mostly because it depends on a number of factors:
Those are just a few thoughts, but I'm sure there can be other aspects that should be considered.
Now from my experience, this is what I can share (hopefully useful):
Initially I used the first approach and then progressively transitioned to the second one (for new services being deployed). In both cases, the infra code was updated only once (when the service was deployed) and remained untouched afterwards.
我已经在2017年开始与Terraform合作。我花了几年的时间才能到达Terraform模块＆amp;结构：
虽然状态文件）。
参数是一个变量。
模块：资源。在这些模块中没有调用其他模块。
例子；
1 AWS负载平衡器1 Terraform模块
1 AWS自动缩放组的Terraform模块
（或者我使用预定固定的Hashicorp模块）。
那就是应用Terraform计划的地方。这使它非常
我很容易复制和过去的根模块作为其他模板
堆栈，只是更改变量。
我找到了上述方法，可以真正帮助管理微服务和任何类型的云下属，无论是无服务器还是基于服务器。
I've started avidly working with terraform in ~2017 & it has taken me a few years to get to where I am now with terraform modules & structures:
state file though).
parameter is a variable.
module:resource. No other modules are called within these modules.
Examples;
1 terraform module for AWS Load Balancer
1 terraform module for AWS Auto Scaling Group
(or I use a pre-defined HashiCorp module).
that is where the terraform plan is applied. It's made it very
easy for me to copy and past root modules as templates for other
stacks and just change variables.
I've found the above approach to really help with managing micro-services and any kind of cloud infra, whether it's serverless or server based.