Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
HashiCorp Terraform for Network Infrastructure ...
Search
Rosemary Wang
April 25, 2023
Technology
0
90
HashiCorp Terraform for Network Infrastructure as Code
Presented at Networking Field Day 31.
Rosemary Wang
April 25, 2023
Tweet
Share
More Decks by Rosemary Wang
See All by Rosemary Wang
Secure Day 2 operations with Boundary and Vault
joatmon08
0
14
Can You Test Your Infrastructure as Code?
joatmon08
1
49
Multi-Account, Multi-Region, Multi-Runtime
joatmon08
1
21
Building a multi-account, multi-runtime service-oriented architecture
joatmon08
0
26
Choose Your Own Abstraction: Iterating on Developer Experience
joatmon08
0
31
Break Glass, Repair Fast, Reconcile Automation
joatmon08
2
40
Building a Developer Platform? Ask these questions.
joatmon08
0
26
From Cloud-Hosted to Cloud-Native
joatmon08
0
50
Refactoring Applications for Dynamic Secrets
joatmon08
1
37
Other Decks in Technology
See All in Technology
新卒1年目が向き合う生成AI事業の開発を加速させる技術選定 / ai-web-launcher
cyberagentdevelopers
PRO
7
1.5k
現地でMeet Upをやる場合の注意点〜反省点を添えて〜
shotashiratori
0
530
CyberAgent 生成AI Deep Dive with Amazon Web Services / genai-aws
cyberagentdevelopers
PRO
1
480
10分でわかるfreeeのQA
freee
1
3.4k
なんで、私がAWS Heroに!? 〜社外の広い世界に一歩踏み出そう〜
minorun365
PRO
6
1.1k
フルカイテン株式会社 採用資料
fullkaiten
0
36k
ユーザーの購買行動モデリングとその分析 / dsc-purchase-analysis
cyberagentdevelopers
PRO
2
100
ガバメントクラウド先行事業中間報告を読み解く
sugiim
1
1.4k
Gradle: The Build System That Loves To Hate You
aurimas
2
150
AWS CDKでデータリストアの運用、どのように設計する?~Aurora・EFSの実践事例を紹介~/aws-cdk-data-restore-aurora-efs
mhrtech
4
650
最速最小からはじめるデータプロダクト / Data Product MVP
amaotone
5
740
LeSSに潜む「隠れWF病」とその処方箋
lycorptech_jp
PRO
2
120
Featured
See All Featured
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
47
5k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
328
21k
Designing Experiences People Love
moore
138
23k
The Straight Up "How To Draw Better" Workshop
denniskardys
232
140k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
43
6.6k
The World Runs on Bad Software
bkeepers
PRO
65
11k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
irinanazarova
4
290
Music & Morning Musume
bryan
46
6.1k
Reflections from 52 weeks, 52 projects
jeffersonlam
346
20k
Building an army of robots
kneath
302
42k
ピンチをチャンスに:未来をつくるプロダクトロードマップ #pmconf2020
aki_iinuma
107
49k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
3
370
Transcript
© 2023 HASHICORP 1 HashiCorp Terraform for Network Infrastructure as
Code Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 2 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 3
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 4
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 5 Declarative Define expected state of infrastructure
in configuration files that you can version, reuse, and share. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 7 registry.terraform.io/browse/providers?category=networking Terraform Providers for Networking @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 8
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 9 Manage Code & State Establish a
source of truth with configuration and state. terraform { cloud { organization = "hashicorp-team-da-beta" workspaces { tags = ["datacenter", "networking", "source:cli"] } } } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 13
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 14 Inject Dependencies Retrieve metadata from an
abstraction to change downstream dependencies independently. data "aws_availability_zones" "available" { state = "available" filter { name = "group-name" values = [var.region] } } resource "aws_subnet" "public" { count = var.public_subnet_count vpc_id = aws_vpc.nfd.id availability_zone = data.aws_availability_zones.available.names[count .index] // omitted } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 16 developer.hashicorp.com/terraform/language Terraform Configuration Language @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 17
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 18 Learn more at developer.hashicorp.com/terraform/tutorials @joatmon08
© 2023 HASHICORP 19 Collaboration Practices for Network Infrastructure as
Code with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 20 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Modularize Offer self-service for resources. 21 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 22 Modularize Group common resources to enable
self-service of properly configured network infrastructure. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 24 registry.terraform.io/search/modules Modules on Terraform Registry @joatmon08
© 2023 HASHICORP Modularize Offer self-service for resources. 25 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 26 Test Write different tests to check
for specific attributes and functionality. // VARIABLE VALIDATION variable "region" { type = string default = "us-east-1" description = "AWS Region" validation { condition = startswith(var.region, "us-") error_message = "Only use AWS regions in US" } } // TEST aws_subnets_have_correct_mask = rule { all aws_subnets as _, aws_subnets { aws_subnets.values.cidr_block contains "/24" } } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 29 play.sentinelproject.io/ Sentinel @joatmon08
© 2023 HASHICORP
© 2023 HASHICORP Modularize Offer self-service for resources. 31 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 32 Verify Use existing policy libraries and
custom policies to check for compliant and secure infrastructure configuration. // Policies to Run policy "public_access" { query = "data.terraform.policies.public_access.deny" enforcement_level = "mandatory" } // Policy Definition package terraform.policies.public_access import input.plan as tfplan deny[msg] { r := tfplan.resource_changes[_] r.type == "aws_security_group" r.change.after.ingress[_].cidr_blocks[_] == "0.0.0.0/0" msg := sprintf("%v has 0.0.0.0/0 as allowed ingress", [r.address]) } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 34 registry.terraform.io/browse/run-tasks Terraform Cloud Run Tasks @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 37 developer.hashicorp.com/terraform/cloud-docs/policy-enforcement Terraform Cloud Policy Enforcement @joatmon08
© 2023 HASHICORP 38 Learn more at developer.hashicorp.com/terraform/tutorials/cloud -get-started @joatmon08
© 2023 HASHICORP 39 Manage Network Infrastructure as Code Complexity
with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 40 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 41 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP 42 developer.hashicorp.com/terraform/cloud-docs/integrations/service-now Change Management Systems @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 44 developer.hashicorp.com/terraform/tutorials/cloud/no-code-provisioning No-Code Provisioning @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 45 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP 46 Validate Reconcile current state to codified
one in order to reduce errors. data "aws_acm_certificate" "issued" { domain = "tf.example.com" most_recent = true } resource "aws_lb_listener_certificate" "example" { listener_arn = aws_lb_listener.front_end.arn certificate_arn = data.aws_acm_certificate.issued.arn lifecycle { postcondition { condition = data.aws_acm_certificate.issued.status != "EXPIRED" error_message = "The listener certificate has expired." } } } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 49 developer.hashicorp.com/terraform/cloud-docs/workspaces/health Health Assessments @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 50 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 54 …even continuously deployed changes @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 57 developer.hashicorp.com/consul/tutorials/network-infrastructure-automation/co nsul-terraform-sync-intro Consul-Terraform-Sync @joatmon08
© 2023 HASHICORP 58 Learn more at developer.hashicorp.com/terraform/tutorials/cloud @joatmon08