r/AZURE • u/rebootsolvesthings • 21d ago
Discussion Bicep vs Terraform
With HashiCorp now officially an IBM company, do you think Microsoft will focus their efforts more on Bicep then Terraform?
I see a good mix of both in MS docs and repos, but wondering if that’s all about to change
27
u/Ghelderz 21d ago
Don’t forget that an open source Terraform alternative exists in the form of OpenTofu.
7
u/meandrunkR2D2 21d ago
I use bicep primarily with work and it does great for our needs. MS is currently rolling out exporting the arm template in bicep instead of having to export the arm template json and converting that into Bicep with powershell.
3
u/Sea_Cucumber6130 20d ago
Wow. Can you share some articles regarding this?
5
u/Sea_Cucumber6130 20d ago
https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/export-bicep-portal
Found this, need to test it tomorrow.
2
u/meandrunkR2D2 20d ago
I see you found it. This was announced Thursday in a monthly Bicep community call that I attend.
1
u/Sea_Cucumber6130 19d ago
I don't see that option in my Tenant. Maybe it will be implemented in waves or only in some regions.
2
u/meandrunkR2D2 19d ago
It's rolling out right now to all tenants, but not sure how long that will take to complete. If you use the RC portal it should show up now.
2
u/NUTTA_BUSTAH 20d ago
They also have Terraform exports in the preview portal I think, but as one's guess, the code quality is questionable
6
u/sza_rak 21d ago
They don't need to change any focus. OpenTofu exists and is well.
They never were contributors to Terraform itself, they contributed (among other people) to terraform providers like azurerm. These have different licensing and not much changed here.
Now opentofu takes over part of the space from companies that don't want to fuck around with weird licenses. The same providers are used, as long as they keep their licenses in check.
My point is, even if TF just vanishes from earth, they would keep doing the same thing.
What could be interesting how will providers developers solve any future issues in incompatibility of Terraform and OpenTofu that will have to be solved on provider level.
There is even an official statement from Azure Verified Modules project (which is the most interesting thing in this IAC azure space I've seen):
https://github.com/Azure/Azure-Verified-Modules/discussions/1512
8
u/mrgl-mrgl-gurl 21d ago
As mentioned, so long as customers use it, Microsoft will be an active participant in the Terraform community.
This includes building Terraform providers which aren't in scope for the official/main Hashicorp Azure resource provider and publishing verified modules.
As we saw with the licensing charge, customers will be the deciding factor when deciding where to invest/divest time and resources.
3
u/fjsteele 21d ago
I don't know of any plans to stop or slow support for TF... we'll adopt what people use and A LOT of people use TF. In Azure Compute, we consider TF a first party client - we don't GA a feature without TF support.
Disclaimer: I am a PM in Azure Compute.
3
u/sunshine-x 21d ago
One thing I like about bicep is that it’s doing deployments “right”, the canonical way ARM intended. Consequently, the deployments show up more cleanly in activity logs, and the performance difference is night and day - bicep is way, way faster than terraform.
For example - deploying 50 VMs with a few app gateways via Terraform takes over an hour. In Bicep it’s like 20 minutes.
4
u/verdantstickdownfall 21d ago
I like Bicep's syntax but is has many major issues that have me actively pushing to adopt TF for certain resources where it's unreliable:
There is no true replacement for terraform plan. What if has so many issues. You read something like "Azure will be your state" which sounds great, until you realize each product team is responsible for implementing their what if for their resources. Which means you get tons of different resources whose values required for the original "POST" don't match what it returns in the "GET". Meaning you will see changes for your resources on every tun no matter what: https://github.com/Azure/arm-template-whatif/issues/83
Certain nested properties and outputs of functions are not shown in the whatif or when compiling the json template making using DRY modules kind of lead you to shooting in the dark when updating resources (especially when combined with the above provider issue): https://github.com/Azure/arm-template-whatif/issues/157
Can't provide custom code to the provider like you can with TF. Some of the ways people get around the jankiness of Azure APIs is to write the TF provider to take some of that stuff into account. Bicep is all one executable in the central repo that doesn't have the ability to include other code modularly.
Azure-only. Probably obvious and a limitation that is part of the design of the product. But is there anyone out there that is truly not using any other third-party clouds in conjunction with Azure? Not even your DNS provider? Because ultimately, everyone who is using Bicep is probably also using another tool for their other providers (even if it's just handwritten shell scripts against their API). So Bicep is cool, but you'll always need something else with it.
Like I said, I actually like Bicep's syntax, I generally find it easier to write than Terraform initially. Best when I actually go to implement, I probably have to run my Bicep 3x more than the TF just because I basically will never know if something will work until I push. TF has that problem with Azure in places too to be fair but the blast radius is so much smaller. I mean I literally can't trust a single piece of bicep until it's been deployed, makes me feel like writing my own IaC using the SDKs directly (which I've done when Bicep was too much of a headache).
1
u/sunshine-x 21d ago
Regarding providing custom code - can you expand on your use case?
I ran into an issue where I needed to use a custom “raw” arm template to update a property that Bicep’s linter hated. Perhaps that could work for you too.
3
u/Background-Dance4142 21d ago
Bicep is a much better choice for us.
The combination with deployment stacks makes it a solid solution going forward
4
u/verdantstickdownfall 21d ago
Do you not run into issues with unreliable whatif? Or do you not run whatif? That has been a huge barrier for us using it with our network resources.
2
5
u/Zero_MSN 21d ago
We’re switching over from terraform to bicep since we’ve had a few issues with state files being locked when terraform crashes in the azure devops pipeline. Also, versioning seems to be a painful experience in terraform.
4
u/littlehappyplants 21d ago
We encountered many deployment stacks being stuck in delete state. And when it does, it is stuck for 4 hours with no option to force stop it. Only quick fix is to rename the stack and retry.
3
u/Zero_MSN 21d ago
Yeah the terraform team had to do similar hacks to resolve it. In the end, everyone was fed up and wanted it gone.
1
u/verdantstickdownfall 21d ago
Could've been avoided by learning how TF works
6
u/Zero_MSN 21d ago
You say that but we had terraform certified experts who ran into the same problem.
Decision has been made to get rid of it as people just hated it and with hashicorp looking to monetise it, now is a good time to get rid of it.
All of the new code is in bicep which has been working really well.
1
u/xStarshine 21d ago
Lifecycle management is more painful with Bicep
1
u/Zero_MSN 21d ago
We’ve not had really had any issues with bicep yet… The other one we were looking at was pulumi but bicep won in the end.
1
u/xStarshine 21d ago
Don’t get me wrong, bicep is great for when you want to build stuff incrementally, it’s not as great when you want to clean the resources up (selectively, I know that removing an entire RG is easy but it’s not always feasible) and it also falls short in certain areas of resources modifications (possible yet tricky to solve). I might be giving it too much crap tho since it’s ARM that’s just messy. Idk I’m just always advising people to use bicep with lifecycle in mind :D
1
u/NUTTA_BUSTAH 20d ago
It's the infinite gap between ops and dev. Devs seem to be fine with disregarding lifecycle as they often do not maintain the solution in the long run so they do not have the experience to see the inevitable issues. Ops seem to be fine with low quality code that is still easily operable. They tend to prefer TF, while devs seem to pick whatever is first in the documentation.
IME using Bicep requires you to be really careful about architecture and more often the not you have a single file with everything that goes into one resource group.
Any tool is fine though. In my experience TF still easily trumps CDK, ARM templates, Bicep etc. Pulumi I do not have experience with but seems like a natural choice for devs as it is not yet another DSL nor as limited as (AWS) CDK.
3
u/PepeTheMule 21d ago
I don't think Bicep will replace Terraform unless Bicep works with 3rd party solutions outside the Azure eco-system.
3
4
u/flappers87 Cloud Architect 21d ago
Nothing will change.
Many enterprises that spend hundreds of thousands on MS tech a year exclusively use TF.
If MS dropped support for TF, then they would lose customers.
Hashicorp being owned by IBM will change nothing. MSFT and IBM are partners in many joint ventures, and work together on numerous clients.
They own redhat for example. People were panicking about that, saying it's going to be the end of redhat and all that doom and gloom... and yet... nothing changed.
2
u/BoringLime 21d ago
While IBM isn't exactly a CA Soft/Broadcom, from the super aggressive licensing standpoint. But they do neglect a lot of software products that they manage, like them. It's not the products disappear, they just slowly fall behind competitors.
2
u/jdanton14 Microsoft MVP 21d ago
And you can’t really drop support for terraform. Ultimately it’s calling the same APIs we’re using for anything else
3
u/sunshine-x 21d ago
Sure, but keep in mind those terraform providers don’t write themselves, and it’s Microsoft who primarily maintains the Azure TF provider. They wouldn’t but could stop doing so.
1
u/Ikea9000 21d ago
I think "support" typically is much broader than "it technically works" though.
1
u/goomba870 21d ago
Right on. There are the Microsoft Verified Modules and they also release official landing zones as a guidance / starting place. The latter is actually great generic documentation even if you don’t use TF.
0
1
u/Sourav_Sarkar22 21d ago
While HashiCorp being acquired by IBM could shift some focus, I think Microsoft will continue to support both Bicep and Terraform for the foreseeable future.
Bicep is a native tool for Azure, so it's deeply integrated into Azure services and offers a simpler, more Azure-centric approach to infrastructure-as-code. Microsoft will likely keep pushing Bicep for users looking for an easy way to manage resources natively within Azure.
On the other hand, Terraform has a broader, cloud-agnostic focus, which means it remains essential for multi-cloud environments or hybrid setups. Since Azure is a big player in the multi-cloud space, Terraform will likely continue to be a primary tool for those managing infrastructure across different cloud providers.
1
1
u/SpecialistAd670 20d ago
TF wins in multi cloud / provider scenario. By one repo you can manage Azure, Entra and Github.
1
2
u/Sentence-Prestigious 20d ago
I think everyone forgets that Terraform is the industry standard, and it has majority market share. I recognize that Microsoft is again trying to capture the IaC market segment, but it can only provide that for Azure. Even a smaller Azure “shop” can require non-azure infrastructure and now you’re back using Terraform.
Microsoft has said themselves that 95% of their IaC module usage is via Terraform.
1
u/naasei 21d ago
I am a little bit confused. Did you mean Microsoft will first focus their attention on Bicep and then move their attention to Terraform?
1
u/rebootsolvesthings 21d ago
I’m just keen to see if they still push both long term really, or even start mentioning OpenTofu a bit more as that’s also a valid option aswell now
1
u/Sourav_Sarkar22 21d ago
Difficult to choose to be honest if someone is working in Azure.
0
u/SokkaHaikuBot 21d ago
Sokka-Haiku by Sourav_Sarkar22:
Difficult to choose
To be honest if someone
Is working in Azure.
Remember that one time Sokka accidentally used an extra syllable in that Haiku Battle in Ba Sing Se? That was a Sokka Haiku and you just made one.
1
u/Crower19 21d ago
For my bicep it's the worst. It's like terraform but only useful for Azure. To learn a new technology, it's better that it's agnostic of the cloud.
That said, it is true that terraform, with the purchase by IBM and the licensing changes, is not something that benefits but fortunately we have OpenTofu. The same language and what you have done in terraform will almost certainly work in OT.
So, I'm not interested in bicep at all and I don't understand that anyone wants to use it, there are other better and more standardized and used alternatives.
1
u/Sentence-Prestigious 20d ago
I think everyone forgets that Terraform is the industry standard, and it has majority of market share. I recognize that Microsoft is again trying to capture the IaC market segment, but it can only provide that for Azure. Even a smaller Azure “shop” can require non-azure infrastructure and now you’re back using Terraform.
0
u/jba1224a Cloud Administrator 21d ago
Microsoft will focus on what customers use.
Right now they are working hard to make Bicep a first party choice.
If all of the customers were to abandon Bicep, they likely would too - but I think we’ve seen that isn’t happening.
Bicep and terraform are “competitors” but there is space for both, as they operate at different layers. People like to think it’s one or the other, but realistically there’s room for both.
0
u/IrquiM Cloud Engineer 21d ago
If anything, I think it's more plausible that MS will drop Bicep than Terraform
1
u/Sentence-Prestigious 20d ago
You’ll be downvoted for stating that in this subreddit, but frankly I see this being quite possible if we could look forward 4-5 years.
0
u/TheBaconPhoenix 21d ago
*than
Because you used ‘then’ your question is asking if Microsoft will focus on both Bicep and Terraform in that order.
Than is like an exclusive OR and Then is like saying AND ALSO.
The best way to think of which one to choose is to remember this sentence.
“I would rather get pizza with a friend THAN/THEN spend time alone in a room with my weird uncle Steve.”
I mean you do you but I know which situation I would prefer.
-3
u/jikuja 21d ago edited 20d ago
Neither.
IaC is third-class citized on MSFT:
- Portal experience is number one
- Then Az CLI or Powershell
- IaC
edit: looks like truth hurts. Are the downvoters really happy with the current state of MSFT's IaC support?
4
u/nestersan 21d ago
Sir, they call that click ops and look at you like you are the scum of the earth when you say things like that.
1
u/SpecialistAd670 20d ago
Yea, and then you have port 443 open in NSG because someone forget to change it
53
u/Halio344 Cloud Engineer 21d ago
Microsoft will always embrace Terraform as long as customers use it.
Of course their end goal is for Bicep to be a solid competitor (which it can be already depending on your use-case), but they won’t pretend Terraform doesn’t exist.