ARM vs Terraform vs Pulumi | Infra as Code in 2021

[@lyduybangpro1995]

Thank you for keeping all your content concise and insightful. Love all of your content

[@JulieNgTech]

Thank you 🤗❤️

[@aymanpatel5862]

Heard Pulumi was started by a Microsoft C# team-member. YAML and JSON are really a pain in the butt for evolving infrastructure. Good to see new things coming out in the space.

[@JulieNgTech]

Yep and competing products are great, driving innovation in the space :)

[@NaserAlOqab]

I came here to learn about infrastructure as code, but I'm distracted and impressed by the beautiful design of your home. It looks like IKEA (in the best way possible because I know not everyone likes IKEA).

[@JulieNgTech]

Hehe, thanks :) As a former designer, I also care about interior design and try to put some effort into how everything comes together. And yeah, it's a mix of furniture, but indeed mostly IKEA. It's so affordable and some of the designs are good.

[@simonkeng3908]

This was a really great overview and very insightful. Thank you 🙏

[@JulieNgTech]

Glad you enjoyed it!

[@mohameddridi8020]

break down complex concepts into easily understandable pieces. 😃

[@JulieNgTech]

Thank you mohameddridi8020! Because this video is like 3 years old… did you still find it relevant?

[@kevball21]

Started learning terraform earlier this year then learned about Bicep. It is such a joy to work with over ARM templates and for new customers without IaC practices they seem more willing to start using a Microsoft back technology then a third party. Would it be possible to do a video on CD best practices? Topics like at what level should be you targeting your deployments (Subscription, Resource Group) and deploying infrastructure during the deployment phase. It would be nice to know your thoughts on pipeline design, should a pipeline target a single repository or one pipeline for the whole application target multiple repositories. Thanks for the great content you have created. Always nice to dive deeper then hello world!

[@JulieNgTech]

Hey Kevin, I picked your question for my AMA just published. Great question! There's a good Azure Doc here on Subscription & Resource Groups docs.microsoft.com/en-us/azure/cloud-adoption-framework/govern/guides/standard/ and this one on secure CD Best Practices (written by me btw) docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/best-practices/secure-devops Does that help answer your question?

[@lammelmiklos3765]

I really loved the detailed explanation! And nice drwaings too. What software was it you draw in?

[@JulieNgTech]

Nothing fancy, just Microsoft Whiteboard

[@RastegaevDienis]

Thank you. That was interesting. Please continue :)

[@esguerrag]

What a great way to compare them. Thank you!

[@JulieNgTech]

Glad you liked it!

[@arieheinrich3457]

Couple of points: 1. ARM and thus Bicep are Azure only. 2. Using ARM and thus Bicep will always be up-to-date with all the latest Azure resources, even the preview ones. as they talk to the latest ARM API changes. In contrast, TF and Pulumi will have a delay until the new resources are available via the AzureRM Provider. That said Pulumi has announced that their new Azure provider will work directly with underlying ARM instead of a manual created layer, thus will also support all the latest preview resources. From Terraform perspective, there is a way to run an ARM template inside Terraform, but not usually recommended. 3. Cloud-agnostic does NOT mean you write code once and deploy it to any cloud provider. That is simply not possible as each cloud provider has its own api. If that will ever change, like a CNCF DSL, we would not really need Terraform or Pulumi or ARM. That said, Pulumi is the only one offering, at the moment, a Cloud provider trying to do a real cloud-agnostic, but it is extremely limited and I doubt that it will ever be fully possible, with out all the major cloud vendors gathering together and agreeing on standardizing the API layers. 4. If your project requires hosting on more then one cloud provider, Terraform and Pulumi are the only candidates at the moment. 5. if you have done Terraform on Azure and you want to get into Bicep, a lot of the syntax will seem similar and the idea of interpolation so not a big learning curve.

[@JulieNgTech]

Was it not clear that ARM and Bicep are Azure only? Re #3 Terraform or HashiCorp Language (HCL) to be more specific is a cloud agnostic *language*. That just means you can learn HCL and be able to write IaC for multiple clouds. Obviously the same IaC doesn't deploy to two different clouds. An Azure Storage Account is not an AWS bucket.

[@mandeepmails]

Fabulously covered. You’re cool ❤

[@JulieNgTech]

Thank you so much 🤗 that help with the motivation to start this channel up again.

[@mandeepmails]

@@JulieNgTech I'm still a learner though i can tell you have originality in your content. Liked your blog too. Fortunate to say, all content that i'm grasping is being covered by you perfectly.

[@Chriswright96]

I think a good anaolfy I've heard, is the difference between Chef and Puppet Chef is based on Ruby, so you an code anything if you know the language, Puppet requires learning the functions that they make available Same with Terraform vs Pulumi - Pulumi let's you write your own code to do whatever you want, however it makes it more difficult to continualy mainain if the code isn't structured well

[@JulieNgTech]

Yep, I agree. And the "best" solution will be dependent on the engineers, their skill levels and code cleanliness ;-)

[@ren_ergy]

Great explanation! Also wished Crossplane was mentioned as most of my intended resources would live inside Kubernetes.

[@JulieNgTech]

Great point! Crossplane is something I'm not familiar with and on my list to learn. Maybe in the future, if I get to it, will definitely make a video :)

Super cool comparison. :) One addon: Azure also has infrastructure as code option with `az` commands.

[@JulieNgTech]

Yep it does. I guess I forget to count it because in total the az cli is sooooo slow. But you're right and at some point I need to do a follow up with Bicep

[@elad3958]

Why does Pulumi being funded matter to you? Very much interested in your answer. Great video btw

[@JulieNgTech]

When a product is funded and if it's not clear if it's profitable, I'm personally hesitant to invest time and energy because I'm not sure if the company or product will still be around in a few years. I can tell you however I finally found time to try Pulumi with a real use case last week and I was very impressed! Will be posting that video soon :)

[@elad3958]

@@JulieNgTech great point. Thank you for responding. I hope you have great rest of your day =)

[@Naster001]

Very nice. So now I had to look at Terraform SDK and they support C# nice.

[@JulieNgTech]

nice, better C# than JSON 🙃

[@allochi]

Great explanation, just what I needed.

[@JulieNgTech]

Glad it helped! I hope you find more helpful info on the channel :) and feel free to drop a comment and let me know what you'd like to see.

[@sebastians3773]

Super useful, thanks, subbed

[@JulieNgTech]

You're welcome!

Great explanation, thanks very much!

[@JulieNgTech]

Thanks Sergio! Let me know what kind of content you like

[@stephane184]

Let’s not forget Biceps. Although not cloud agnostic, pretty powerful and full parity with ARM but without backend state files like Terraform.

[@JulieNgTech]

Yeah, Bicep is way better than ARM. But still not good enough to convince me to learn and use it properly 🙃 Terraform has better DX for modules (it makes more sense to me than the bi-polar Bicep oh wait sometimes I want JSON) and I rely heavily on Terraform's ability to generate random strings and remove resources (for security and cost reasons) as well as ability to leverage Azure AD APIs, which both Terraform and Pulumi do - but ARM/Bicep do not.

[@scotronix]

Oh! Arm and Bicep. I was looking at these for a month and did not pick up on that. Ha

[@JulieNgTech]

I didn't either for months - until a colleague pointed it out to me 😅

[@duncanhunter9025]

Awesome video thanks for sharing

[@JulieNgTech]

Thank you for the feedback. Let me know if there's something else I can explain and make a video about :)

[@alexanderkosarev9915]

so, if you have to choose, what what you will choose for existing project? for new project?

[@JulieNgTech]

My personal preference is still for Terraform because my previous experience means it's how I can deliver value mostly quickly. Everyone should make their own decisions though. If someone else is faster with ARM, Bicep or Pulumi and those technologies meet their requirements, they should consider/use them.

[@staker4]

Thanks for sharing

[@cafehodge]

What does pulumi’s funding status mean to you? Why is it something you notice or consider?

[@JulieNgTech]

When a product is funded and if it's not clear if it's profitable, I'm personally hesitant to invest time and energy because I'm not sure if the company or product will still be around in a few years. I can tell you however I finally found time to try Pulumi with a real use case last week and I was very impressed! Will be posting that video soon :)

[@tofasneil]

After few years of break, I had to manage infrastructure as it's currently small it will grow pretty fast. So I went over Terraform, pulumi, etc.. Overall with some wrapper I think pulumi + ansible very efficent way to create + configure + deploy if you are solo this approach saved me lots time and other configurations for CI/CD.

[@frozenintime]

Why did you decide to not use plain cloud foundry? Less tech stacks (1 instead 2), easily extends into scripting and general purpose languages with consistent support for several years and used by more than half of fortune 500 companies. It also supports and helps manage k8s solutions. Any "fee" like managing & hosting a file for authenticating with a service doesn't exist in development. In production a secrets vault is standard practice can be hosted from your infrastructure instead of hashi. CF also allows for the smooth validation of layers being approved by security prior to reviewing the code the was written on top of prior layers for a buildpack (a container that can run anywhere) .

[@tofasneil]

​ @Frozen Thank you for input, yet I'm currently one man army, in such cases you don't need what fortune 500 componies do, instead you can sacriface few things. in example I don't need secret vault because "my" key is enough for now we don't have 10 different person that deploys code because full dev op happens on one computer. Also I don't want to depend on aws/azure not currently writing a wrapper allows me to migrate, whole systems interface is already there if that makes sense. Most of the people think in "task" try to think in "utility" even every task has unique characteristics every task mostly a version of regular tasks.

[@frozenintime]

@@tofasneil thank you for helping understand. The tools do relatively the same thing. Such as CF offers support across the different vendors including gcp, azure, tanzu, and heroku. The "key" for local would also be done the same way as your current implementation. Similarly it could be utilized for deployments, given its not stored in plain site (such as the current location on your machine). Are you saying that terraform is simpler for isolating different provisioning tasks?

[@tofasneil]

​@@frozenintime for me terraform is configuration tool, pulumi infrastructure build tool... They serve different purpuses...

[@tzegoful]

I think you missed maybe one of biggest drawbacks of terraform vs ARM / Pulumi. Since terraform requires writing a specific terraform provider for all resources it will never have full coverage of Azure resources available. There are still features that have been in Azure for over a year that does not exist as an option in the terraform resource. This can be really annoying and in some cases you end up either deploying ARM with terraform or using null_resource running az cli commands.. which is really hacky. Pulumi is 100% compatible with Azure and does not have that problem. What the Azure SDK support, Pulumi supports.

[@JulieNgTech]

Hey Terje, thanks for the input. Can you give a specific example of a resource that is 100% in ARM and Pulumi but not in Terraform?

[@tzegoful]

@@JulieNgTech Key Vault Managed Storage SAS Definition (github.com/terraform-providers/terraform-provider-azurerm/issues/4659) and Azure Monitor Private Link Scope (github.com/terraform-providers/terraform-provider-azurerm/issues/10059) of the top of my head. Working with new features its a reoccuring problem all the time though that certain settings are not available on a resource. Like the SNAT firewall setting mentioned in another comment which was added 2. of April to terraform resource. Pulumi's azure-native has same day access to all features and properties defined in azure API: www.pulumi.com/blog/full-coverage-of-azure-resources-with-azure-native/

[@JulieNgTech]

@@tzegoful thanks for the feedback and examples. I know my Azure colleagues who work on Terraform and HashiCorp aim for parity. I hope the gap is closing and that for the most requested gaps, I hope we bridge them quickly.

[@kokizzu]

how about crossplane?

[@JulieNgTech]

Yeah someone else commented about that. I don't know it. It's on my list to check out and if I manage to get to it, I'll make a video with an updated comparison :)

[@nasarazam]

Nice...

[@JulieNgTech]

Thanks

[@JohnJohnson-ng2os]

Why is Pulumi taking funding mentioned in this way? Is it bad in your eyes?

[@JulieNgTech]

I was waiting for someone to point this out :) From a technology perspective, nothing is wrong with it. I come from a conservative industry and would be hesitant to invest in something when I don't know if it will be around in a few years. I wouldn't think twice about $5 - 10m. But $50m is a lot in my opinion. How do you see this?

[@JohnJohnson-ng2os]

I see it as a good idea getting some capital behind it. However I don't work in silicon valley/the US so I don't have to deal with this kind of thing to be honest

[@kaparora]

👍

[@emmanuelgelatimesa2712]

terraform syntax is still the better one

[@JulieNgTech]

I agree :)

[@bhhmidi4]

Windows is ewww!

[@JulieNgTech]

I use a Mac 😅