TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Show HN: Digger – Open Source Terraform automation and collaboration tool

91 点作者 ujnproduct将近 2 年前

7 条评论

thinkmassive将近 2 年前
One of the major security issues with running terraform in your CI&#x2F;CD pipeline is that it usually needs admin permissions to your entire cloud environment. To avoid this you need the pipeline to pass parameters to an internal process that actually applies the changes.<p>Digger makes it sound like it might address this:<p>&gt; Digger runs terraform natively in your CI. This is: Secure, because cloud access secrets aren&#x27;t shared with a third-party<p>From the Github+AWS demo:<p>&gt; 4. Add environment variables into your Github Action Secrets (cloud keys are a requirement since digger needs to connect to your account for coordinating locks) AWS_ACCESS_KEY_ID &amp; AWS_SECRET_ACCESS_KEY<p>It sure looks like AWS admin credentials are shared with Github, and also available to anything else in the diggerhq&#x2F;digger action.
评论 #36655405 未加载
评论 #36656828 未加载
评论 #36655891 未加载
评论 #36660352 未加载
评论 #36658244 未加载
oneplane将近 2 年前
I&#x27;m surprised nobody has mentioned Atlantis yet. Running bare terraform in CI is a bad idea (to the extent that running an &#x27;expect&#x27; script for an interactive tool is a bad idea), and when you consider the impact it can have (both on resources and on escalation) it should be out-of-band anyway.
评论 #36660121 未加载
notsahil将近 2 年前
They migrated from Python to Golang<p>More Detailed Here: <a href="https:&#x2F;&#x2F;old.reddit.com&#x2F;r&#x2F;golang&#x2F;comments&#x2F;14rduec&#x2F;we_rewrote_our_product_in_go_from_scratch&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;old.reddit.com&#x2F;r&#x2F;golang&#x2F;comments&#x2F;14rduec&#x2F;we_rewrote_...</a>
评论 #36656864 未加载
lantry将近 2 年前
I was initially very interested in digger, because I need something like atlantis but the thought of a web-accesible server with owner-level access to my project seemed scary. Having everything in cicd seemed like a great solution. However, when I read the digger docs, I discovered that it too has a publicly accessible server, that gets autodeployed when you first run digger.<p>1. I don&#x27;t like the idea of the tool creating resources I didn&#x27;t explicitly tell it to create<p>2. I don&#x27;t like the idea of a public endpoint for someone to pwn and get owner-level access of all my stuff.<p>It would be nice if the docs explained what the serverless backend thing does (besides the vague comment about handling webhooks), and it would be nice if there was an option that didn&#x27;t require the public backend even if it means slightly degraded functionality. (github actions can be triggered by PR opened, PR updated, comment created, comment edited, merge to main, and many other things. Seems to me like that should be enough?)<p><a href="https:&#x2F;&#x2F;docs.digger.dev&#x2F;readme&#x2F;how-it-works" rel="nofollow noreferrer">https:&#x2F;&#x2F;docs.digger.dev&#x2F;readme&#x2F;how-it-works</a>
评论 #36660084 未加载
ushakov将近 2 年前
I misread it as Dagger, the CI&#x2F;CD tool (<a href="https:&#x2F;&#x2F;dagger.io">https:&#x2F;&#x2F;dagger.io</a>)
评论 #36657555 未加载
_0xdd将近 2 年前
I saw Digger and got excited for a second...<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Digger_(video_game)" rel="nofollow noreferrer">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Digger_(video_game)</a>
评论 #36667456 未加载
seedie将近 2 年前
One of the main reasons for us to use a terraform collaboration tool is to easily manage state files.<p>Would be awesome if they find a way to integrate state management.
评论 #36656942 未加载