Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
HashiCorp Terraform for Network Infrastructure ...
Search
Rosemary Wang
April 25, 2023
Technology
0
120
HashiCorp Terraform for Network Infrastructure as Code
Presented at Networking Field Day 31.
Rosemary Wang
April 25, 2023
Tweet
Share
More Decks by Rosemary Wang
See All by Rosemary Wang
Build for massive scale & security with the HashiCorp Cloud Platform
joatmon08
0
46
People, process, and technology for ILM and SLM adoption
joatmon08
0
37
Secure Day 2 operations with Boundary and Vault
joatmon08
0
51
Can You Test Your Infrastructure as Code?
joatmon08
1
98
Multi-Account, Multi-Region, Multi-Runtime
joatmon08
1
50
Building a multi-account, multi-runtime service-oriented architecture
joatmon08
0
68
Choose Your Own Abstraction: Iterating on Developer Experience
joatmon08
0
73
Break Glass, Repair Fast, Reconcile Automation
joatmon08
1
61
Building a Developer Platform? Ask these questions.
joatmon08
0
73
Other Decks in Technology
See All in Technology
CDK CLIで使ってたあの機能、CDK Toolkit Libraryではどうやるの?
smt7174
4
190
下手な強制、ダメ!絶対! 「ガードレール」を「檻」にさせない"ガバナンス"の取り方とは?
tsukaman
2
450
まずはマネコンでちゃちゃっと作ってから、それをCDKにしてみよか。
yamada_r
2
120
企業の生成AIガバナンスにおけるエージェントとセキュリティ
lycorptech_jp
PRO
2
190
AWSを利用する上で知っておきたい名前解決のはなし(10分版)
nagisa53
10
3.2k
250905 大吉祥寺.pm 2025 前夜祭 「プログラミングに出会って20年、『今』が1番楽しい」
msykd
PRO
1
990
Django's GeneratedField by example - DjangoCon US 2025
pauloxnet
0
150
5年目から始める Vue3 サイト改善 #frontendo
tacck
PRO
3
230
エンジニアリングマネージャーの成長の道筋とキャリア / Developers Summit 2025 KANSAI
daiksy
2
530
複数サービスを支えるマルチテナント型Batch MLプラットフォーム
lycorptech_jp
PRO
1
830
Apache Spark もくもく会
taka_aki
0
100
なぜスクラムはこうなったのか?歴史が教えてくれたこと/Shall we explore the roots of Scrum
sanogemaru
5
1.7k
Featured
See All Featured
How to Ace a Technical Interview
jacobian
279
23k
Git: the NoSQL Database
bkeepers
PRO
431
66k
For a Future-Friendly Web
brad_frost
180
9.9k
The Language of Interfaces
destraynor
161
25k
Being A Developer After 40
akosma
90
590k
Gamification - CAS2011
davidbonilla
81
5.4k
Scaling GitHub
holman
463
140k
Thoughts on Productivity
jonyablonski
70
4.8k
It's Worth the Effort
3n
187
28k
The Web Performance Landscape in 2024 [PerfNow 2024]
tammyeverts
9
810
[RailsConf 2023] Rails as a piece of cake
palkan
57
5.8k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
46
7.6k
Transcript
© 2023 HASHICORP 1 HashiCorp Terraform for Network Infrastructure as
Code Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 2 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 3
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 4
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 5 Declarative Define expected state of infrastructure
in configuration files that you can version, reuse, and share. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 7 registry.terraform.io/browse/providers?category=networking Terraform Providers for Networking @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 8
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 9 Manage Code & State Establish a
source of truth with configuration and state. terraform { cloud { organization = "hashicorp-team-da-beta" workspaces { tags = ["datacenter", "networking", "source:cli"] } } } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 13
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 14 Inject Dependencies Retrieve metadata from an
abstraction to change downstream dependencies independently. data "aws_availability_zones" "available" { state = "available" filter { name = "group-name" values = [var.region] } } resource "aws_subnet" "public" { count = var.public_subnet_count vpc_id = aws_vpc.nfd.id availability_zone = data.aws_availability_zones.available.names[count .index] // omitted } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 16 developer.hashicorp.com/terraform/language Terraform Configuration Language @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 17
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 18 Learn more at developer.hashicorp.com/terraform/tutorials @joatmon08
© 2023 HASHICORP 19 Collaboration Practices for Network Infrastructure as
Code with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 20 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Modularize Offer self-service for resources. 21 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 22 Modularize Group common resources to enable
self-service of properly configured network infrastructure. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 24 registry.terraform.io/search/modules Modules on Terraform Registry @joatmon08
© 2023 HASHICORP Modularize Offer self-service for resources. 25 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 26 Test Write different tests to check
for specific attributes and functionality. // VARIABLE VALIDATION variable "region" { type = string default = "us-east-1" description = "AWS Region" validation { condition = startswith(var.region, "us-") error_message = "Only use AWS regions in US" } } // TEST aws_subnets_have_correct_mask = rule { all aws_subnets as _, aws_subnets { aws_subnets.values.cidr_block contains "/24" } } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 29 play.sentinelproject.io/ Sentinel @joatmon08
© 2023 HASHICORP
© 2023 HASHICORP Modularize Offer self-service for resources. 31 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 32 Verify Use existing policy libraries and
custom policies to check for compliant and secure infrastructure configuration. // Policies to Run policy "public_access" { query = "data.terraform.policies.public_access.deny" enforcement_level = "mandatory" } // Policy Definition package terraform.policies.public_access import input.plan as tfplan deny[msg] { r := tfplan.resource_changes[_] r.type == "aws_security_group" r.change.after.ingress[_].cidr_blocks[_] == "0.0.0.0/0" msg := sprintf("%v has 0.0.0.0/0 as allowed ingress", [r.address]) } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 34 registry.terraform.io/browse/run-tasks Terraform Cloud Run Tasks @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 37 developer.hashicorp.com/terraform/cloud-docs/policy-enforcement Terraform Cloud Policy Enforcement @joatmon08
© 2023 HASHICORP 38 Learn more at developer.hashicorp.com/terraform/tutorials/cloud -get-started @joatmon08
© 2023 HASHICORP 39 Manage Network Infrastructure as Code Complexity
with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 40 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 41 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP 42 developer.hashicorp.com/terraform/cloud-docs/integrations/service-now Change Management Systems @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 44 developer.hashicorp.com/terraform/tutorials/cloud/no-code-provisioning No-Code Provisioning @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 45 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP 46 Validate Reconcile current state to codified
one in order to reduce errors. data "aws_acm_certificate" "issued" { domain = "tf.example.com" most_recent = true } resource "aws_lb_listener_certificate" "example" { listener_arn = aws_lb_listener.front_end.arn certificate_arn = data.aws_acm_certificate.issued.arn lifecycle { postcondition { condition = data.aws_acm_certificate.issued.status != "EXPIRED" error_message = "The listener certificate has expired." } } } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 49 developer.hashicorp.com/terraform/cloud-docs/workspaces/health Health Assessments @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 50 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 54 …even continuously deployed changes @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 57 developer.hashicorp.com/consul/tutorials/network-infrastructure-automation/co nsul-terraform-sync-intro Consul-Terraform-Sync @joatmon08
© 2023 HASHICORP 58 Learn more at developer.hashicorp.com/terraform/tutorials/cloud @joatmon08