Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
HashiCorp Terraform for Network Infrastructure as Code
Search
Rosemary Wang
April 25, 2023
Technology
0
81
HashiCorp Terraform for Network Infrastructure as Code
Presented at Networking Field Day 31.
Rosemary Wang
April 25, 2023
Tweet
Share
More Decks by Rosemary Wang
See All by Rosemary Wang
Secure Day 2 operations with Boundary and Vault
joatmon08
0
9
Can You Test Your Infrastructure as Code?
joatmon08
1
24
Multi-Account, Multi-Region, Multi-Runtime
joatmon08
1
19
Building a multi-account, multi-runtime service-oriented architecture
joatmon08
0
19
Choose Your Own Abstraction: Iterating on Developer Experience
joatmon08
0
25
Break Glass, Repair Fast, Reconcile Automation
joatmon08
2
31
Building a Developer Platform? Ask these questions.
joatmon08
0
19
From Cloud-Hosted to Cloud-Native
joatmon08
0
47
Refactoring Applications for Dynamic Secrets
joatmon08
1
32
Other Decks in Technology
See All in Technology
セキュリティ研修 Day1【MIXI 24新卒技術研修】
mixi_engineers
PRO
0
150
Datadog Cloud SIEMを使ってAWS環境の脅威を可視化した話/lifeistech-datadog-cloud-siem
gidajun
0
480
データベース研修 分析向けSQL入門【MIXI 24新卒技術研修】
mixi_engineers
PRO
0
110
簡単に始めるSnowflakeの機械学習
nayuts
1
190
さらに高品質・高速化を目指すAI時代のテスト設計支援と、めざす先 / AI Test Lab vol.1
shift_evolve
0
190
DDDにおける認可の扱いとKotlinにおける実装パターン / authorization-for-ddd-and-kotlin-implement-pattern
urmot
4
390
What if...? 처음부터 다시 LLM 어플리케이션을 개발한다면
huffon
0
1k
ゆめみのアクセシビリティの現在地と今後
ryokatsuse
3
290
スタートアップにおける組織設計とスクラムの長期戦略 / Scrum Fest Kanazawa 2024
yoshikiiida
13
3.6k
Docker互換のセキュアなコンテナ実行環境「Podman」超入門
devops_vtj
6
3.2k
LINE WORKSへ簡単通知!Incoming Webhookアプリの紹介
mmclsntr
0
110
Git 研修 Advanced【MIXI 24新卒技術研修】
mixi_engineers
PRO
0
200
Featured
See All Featured
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
12
3.8k
Become a Pro
speakerdeck
PRO
15
4.8k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
36
9.1k
Thoughts on Productivity
jonyablonski
64
4.1k
Easily Structure & Communicate Ideas using Wireframe
afnizarnur
189
16k
Designing for humans not robots
tammielis
247
25k
Designing on Purpose - Digital PM Summit 2013
jponch
113
6.6k
Fontdeck: Realign not Redesign
paulrobertlloyd
79
5.1k
Why You Should Never Use an ORM
jnunemaker
PRO
51
8.9k
The Art of Programming - Codeland 2020
erikaheidi
48
13k
5 minutes of I Can Smell Your CMS
philhawksworth
200
19k
Raft: Consensus for Rubyists
vanstee
134
6.5k
Transcript
© 2023 HASHICORP 1 HashiCorp Terraform for Network Infrastructure as
Code Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 2 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 3
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 4
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 5 Declarative Define expected state of infrastructure
in configuration files that you can version, reuse, and share. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 7 registry.terraform.io/browse/providers?category=networking Terraform Providers for Networking @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 8
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 9 Manage Code & State Establish a
source of truth with configuration and state. terraform { cloud { organization = "hashicorp-team-da-beta" workspaces { tags = ["datacenter", "networking", "source:cli"] } } } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 13
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 14 Inject Dependencies Retrieve metadata from an
abstraction to change downstream dependencies independently. data "aws_availability_zones" "available" { state = "available" filter { name = "group-name" values = [var.region] } } resource "aws_subnet" "public" { count = var.public_subnet_count vpc_id = aws_vpc.nfd.id availability_zone = data.aws_availability_zones.available.names[count .index] // omitted } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 16 developer.hashicorp.com/terraform/language Terraform Configuration Language @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 17
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 18 Learn more at developer.hashicorp.com/terraform/tutorials @joatmon08
© 2023 HASHICORP 19 Collaboration Practices for Network Infrastructure as
Code with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 20 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Modularize Offer self-service for resources. 21 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 22 Modularize Group common resources to enable
self-service of properly configured network infrastructure. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 24 registry.terraform.io/search/modules Modules on Terraform Registry @joatmon08
© 2023 HASHICORP Modularize Offer self-service for resources. 25 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 26 Test Write different tests to check
for specific attributes and functionality. // VARIABLE VALIDATION variable "region" { type = string default = "us-east-1" description = "AWS Region" validation { condition = startswith(var.region, "us-") error_message = "Only use AWS regions in US" } } // TEST aws_subnets_have_correct_mask = rule { all aws_subnets as _, aws_subnets { aws_subnets.values.cidr_block contains "/24" } } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 29 play.sentinelproject.io/ Sentinel @joatmon08
© 2023 HASHICORP
© 2023 HASHICORP Modularize Offer self-service for resources. 31 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 32 Verify Use existing policy libraries and
custom policies to check for compliant and secure infrastructure configuration. // Policies to Run policy "public_access" { query = "data.terraform.policies.public_access.deny" enforcement_level = "mandatory" } // Policy Definition package terraform.policies.public_access import input.plan as tfplan deny[msg] { r := tfplan.resource_changes[_] r.type == "aws_security_group" r.change.after.ingress[_].cidr_blocks[_] == "0.0.0.0/0" msg := sprintf("%v has 0.0.0.0/0 as allowed ingress", [r.address]) } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 34 registry.terraform.io/browse/run-tasks Terraform Cloud Run Tasks @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 37 developer.hashicorp.com/terraform/cloud-docs/policy-enforcement Terraform Cloud Policy Enforcement @joatmon08
© 2023 HASHICORP 38 Learn more at developer.hashicorp.com/terraform/tutorials/cloud -get-started @joatmon08
© 2023 HASHICORP 39 Manage Network Infrastructure as Code Complexity
with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 40 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 41 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP 42 developer.hashicorp.com/terraform/cloud-docs/integrations/service-now Change Management Systems @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 44 developer.hashicorp.com/terraform/tutorials/cloud/no-code-provisioning No-Code Provisioning @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 45 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP 46 Validate Reconcile current state to codified
one in order to reduce errors. data "aws_acm_certificate" "issued" { domain = "tf.example.com" most_recent = true } resource "aws_lb_listener_certificate" "example" { listener_arn = aws_lb_listener.front_end.arn certificate_arn = data.aws_acm_certificate.issued.arn lifecycle { postcondition { condition = data.aws_acm_certificate.issued.status != "EXPIRED" error_message = "The listener certificate has expired." } } } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 49 developer.hashicorp.com/terraform/cloud-docs/workspaces/health Health Assessments @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 50 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 54 …even continuously deployed changes @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 57 developer.hashicorp.com/consul/tutorials/network-infrastructure-automation/co nsul-terraform-sync-intro Consul-Terraform-Sync @joatmon08
© 2023 HASHICORP 58 Learn more at developer.hashicorp.com/terraform/tutorials/cloud @joatmon08