Upgrade to Pro — share decks privately, control downloads, hide ads and more …

HashiCorp Terraform for Network Infrastructure ...

HashiCorp Terraform for Network Infrastructure as Code

Presented at Networking Field Day 31.

Rosemary Wang

April 25, 2023
Tweet

More Decks by Rosemary Wang

Other Decks in Technology

Transcript

  1. © 2023 HASHICORP 1 HashiCorp Terraform for Network Infrastructure as

    Code Rosemary Wang Developer Advocate at HashiCorp @joatmon08
  2. © 2023 HASHICORP 2 Write network infrastructure as code Share

    it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
  3. © 2023 HASHICORP Declarative Define what resources should be. 3

    Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
  4. © 2023 HASHICORP Declarative Define what resources should be. 4

    Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
  5. © 2023 HASHICORP 5 Declarative Define expected state of infrastructure

    in configuration files that you can version, reuse, and share. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
  6. © 2023 HASHICORP Declarative Define what resources should be. 8

    Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
  7. © 2023 HASHICORP 9 Manage Code & State Establish a

    source of truth with configuration and state. terraform { cloud { organization = "hashicorp-team-da-beta" workspaces { tags = ["datacenter", "networking", "source:cli"] } } } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } @joatmon08
  8. © 2023 HASHICORP Declarative Define what resources should be. 13

    Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
  9. © 2023 HASHICORP 14 Inject Dependencies Retrieve metadata from an

    abstraction to change downstream dependencies independently. data "aws_availability_zones" "available" { state = "available" filter { name = "group-name" values = [var.region] } } resource "aws_subnet" "public" { count = var.public_subnet_count vpc_id = aws_vpc.nfd.id availability_zone = data.aws_availability_zones.available.names[count .index] // omitted } @joatmon08
  10. © 2023 HASHICORP Declarative Define what resources should be. 17

    Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
  11. © 2023 HASHICORP 19 Collaboration Practices for Network Infrastructure as

    Code with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
  12. © 2023 HASHICORP 20 Write network infrastructure as code Share

    it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
  13. © 2023 HASHICORP Modularize Offer self-service for resources. 21 Test

    Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
  14. © 2023 HASHICORP 22 Modularize Group common resources to enable

    self-service of properly configured network infrastructure. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
  15. © 2023 HASHICORP Modularize Offer self-service for resources. 25 Test

    Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
  16. © 2023 HASHICORP 26 Test Write different tests to check

    for specific attributes and functionality. // VARIABLE VALIDATION variable "region" { type = string default = "us-east-1" description = "AWS Region" validation { condition = startswith(var.region, "us-") error_message = "Only use AWS regions in US" } } // TEST aws_subnets_have_correct_mask = rule { all aws_subnets as _, aws_subnets { aws_subnets.values.cidr_block contains "/24" } } @joatmon08
  17. © 2023 HASHICORP Modularize Offer self-service for resources. 31 Test

    Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
  18. © 2023 HASHICORP 32 Verify Use existing policy libraries and

    custom policies to check for compliant and secure infrastructure configuration. // Policies to Run policy "public_access" { query = "data.terraform.policies.public_access.deny" enforcement_level = "mandatory" } // Policy Definition package terraform.policies.public_access import input.plan as tfplan deny[msg] { r := tfplan.resource_changes[_] r.type == "aws_security_group" r.change.after.ingress[_].cidr_blocks[_] == "0.0.0.0/0" msg := sprintf("%v has 0.0.0.0/0 as allowed ingress", [r.address]) } @joatmon08
  19. © 2023 HASHICORP 39 Manage Network Infrastructure as Code Complexity

    with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
  20. © 2023 HASHICORP 40 Write network infrastructure as code Share

    it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
  21. © 2023 HASHICORP Bridge Use manual interfaces to run infrastructure

    as code. 41 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
  22. © 2023 HASHICORP Bridge Use manual interfaces to run infrastructure

    as code. 45 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
  23. © 2023 HASHICORP 46 Validate Reconcile current state to codified

    one in order to reduce errors. data "aws_acm_certificate" "issued" { domain = "tf.example.com" most_recent = true } resource "aws_lb_listener_certificate" "example" { listener_arn = aws_lb_listener.front_end.arn certificate_arn = data.aws_acm_certificate.issued.arn lifecycle { postcondition { condition = data.aws_acm_certificate.issued.status != "EXPIRED" error_message = "The listener certificate has expired." } } } @joatmon08
  24. © 2023 HASHICORP Bridge Use manual interfaces to run infrastructure

    as code. 50 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08