Comparison
Apply blast radiusvsPlan and apply
Apply blast radius
one careless change proposed to destroy the database because everything lives in a single state, and the plan was long enough not to be read.
How much of your estate one apply can affect, which is decided by how the configuration and state are split. A single monolithic state is convenient and means every change is a change to everything; splitting by environment, by lifecycle and by ownership shrinks what any one mistake can reach. It also shrinks plan times, which matters more than it should, because a plan nobody reads is not a control.
Full entry →Plan and apply
the tool prints exactly what it will create, change and destroy, and you read the destroy list before typing yes.
The two-phase model of declarative infrastructure tooling: compute the difference between desired and recorded state and show it, then execute it. The plan is the single most valuable safety feature in the category, and reviewing it — particularly the replacements and deletions — is the actual control. A plan is only as good as its freshness, since anything that changes between planning and applying is not in it.
Full entry →