Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
HashiCorp Terraform for Network Infrastructure ...
Search
Rosemary Wang
April 25, 2023
Technology
0
110
HashiCorp Terraform for Network Infrastructure as Code
Presented at Networking Field Day 31.
Rosemary Wang
April 25, 2023
Tweet
Share
More Decks by Rosemary Wang
See All by Rosemary Wang
Build for massive scale & security with the HashiCorp Cloud Platform
joatmon08
0
21
People, process, and technology for ILM and SLM adoption
joatmon08
0
13
Secure Day 2 operations with Boundary and Vault
joatmon08
0
37
Can You Test Your Infrastructure as Code?
joatmon08
1
68
Multi-Account, Multi-Region, Multi-Runtime
joatmon08
1
39
Building a multi-account, multi-runtime service-oriented architecture
joatmon08
0
50
Choose Your Own Abstraction: Iterating on Developer Experience
joatmon08
0
52
Break Glass, Repair Fast, Reconcile Automation
joatmon08
2
47
Building a Developer Platform? Ask these questions.
joatmon08
0
48
Other Decks in Technology
See All in Technology
【5分でわかる】セーフィー エンジニア向け会社紹介
safie_recruit
0
19k
Global Databaseで実現するマルチリージョン自動切替とBlue/Greenデプロイ
j2yano
0
190
データモデルYANGの処理系を再発明した話
tjmtrhs
0
380
職位にかかわらず全員がリーダーシップを発揮するチーム作り / Building a team where everyone can demonstrate leadership regardless of position
madoxten
32
22k
目標と時間軸 〜ベイビーステップでケイパビリティを高めよう〜
kakehashi
PRO
8
1.1k
AI-Driven-Development-20250310
yuhattor
3
280
AIエージェント時代のエンジニアになろう #jawsug #jawsdays2025 / 20250301 Agentic AI Engineering
yoshidashingo
9
4.3k
「頑張る」を「楽しむ」に変換する技術
tomoyakitaura
2
760
AIエージェント入門
minorun365
PRO
35
20k
エンジニアのキャリアパスと、 その中で自分が大切にしていること
noteinc
3
2.5k
プロダクト開発者目線での Entra ID 活用
sansantech
PRO
0
180
Pwned Labsのすゝめ
ken5scal
2
590
Featured
See All Featured
The Pragmatic Product Professional
lauravandoore
32
6.4k
How STYLIGHT went responsive
nonsquared
99
5.4k
The Power of CSS Pseudo Elements
geoffreycrofte
75
5.5k
Docker and Python
trallard
44
3.3k
The Cost Of JavaScript in 2023
addyosmani
47
7.5k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
45
9.4k
YesSQL, Process and Tooling at Scale
rocio
172
14k
[RailsConf 2023] Rails as a piece of cake
palkan
53
5.3k
10 Git Anti Patterns You Should be Aware of
lemiorhan
PRO
656
59k
個人開発の失敗を避けるイケてる考え方 / tips for indie hackers
panda_program
100
18k
Gamification - CAS2011
davidbonilla
80
5.2k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
27
1.6k
Transcript
© 2023 HASHICORP 1 HashiCorp Terraform for Network Infrastructure as
Code Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 2 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 3
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 4
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 5 Declarative Define expected state of infrastructure
in configuration files that you can version, reuse, and share. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 7 registry.terraform.io/browse/providers?category=networking Terraform Providers for Networking @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 8
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 9 Manage Code & State Establish a
source of truth with configuration and state. terraform { cloud { organization = "hashicorp-team-da-beta" workspaces { tags = ["datacenter", "networking", "source:cli"] } } } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 13
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 14 Inject Dependencies Retrieve metadata from an
abstraction to change downstream dependencies independently. data "aws_availability_zones" "available" { state = "available" filter { name = "group-name" values = [var.region] } } resource "aws_subnet" "public" { count = var.public_subnet_count vpc_id = aws_vpc.nfd.id availability_zone = data.aws_availability_zones.available.names[count .index] // omitted } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 16 developer.hashicorp.com/terraform/language Terraform Configuration Language @joatmon08
© 2023 HASHICORP Declarative Define what resources should be. 17
Maintain Code & State Use as source of truth. Inject Dependencies Decouple resources to mitigate impact. Practices @joatmon08
© 2023 HASHICORP 18 Learn more at developer.hashicorp.com/terraform/tutorials @joatmon08
© 2023 HASHICORP 19 Collaboration Practices for Network Infrastructure as
Code with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 20 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Modularize Offer self-service for resources. 21 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 22 Modularize Group common resources to enable
self-service of properly configured network infrastructure. locals { annotation = "orchestrator:terraform" } resource "aci_tenant" "dev" { description = "This tenant is created by Terraform" name = "${var.prefix}_tenant" annotation = local.annotation } resource "aci_application_profile" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_ap" annotation = local.annotation } resource "aci_vrf" "dev" { tenant_dn = aci_tenant.dev.id name = "${var.prefix}_vrf" annotation = local.annotation } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 24 registry.terraform.io/search/modules Modules on Terraform Registry @joatmon08
© 2023 HASHICORP Modularize Offer self-service for resources. 25 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 26 Test Write different tests to check
for specific attributes and functionality. // VARIABLE VALIDATION variable "region" { type = string default = "us-east-1" description = "AWS Region" validation { condition = startswith(var.region, "us-") error_message = "Only use AWS regions in US" } } // TEST aws_subnets_have_correct_mask = rule { all aws_subnets as _, aws_subnets { aws_subnets.values.cidr_block contains "/24" } } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 29 play.sentinelproject.io/ Sentinel @joatmon08
© 2023 HASHICORP
© 2023 HASHICORP Modularize Offer self-service for resources. 31 Test
Validate system functions as intended. Verify Check secure & compliant configurations and settings. Practices @joatmon08
© 2023 HASHICORP 32 Verify Use existing policy libraries and
custom policies to check for compliant and secure infrastructure configuration. // Policies to Run policy "public_access" { query = "data.terraform.policies.public_access.deny" enforcement_level = "mandatory" } // Policy Definition package terraform.policies.public_access import input.plan as tfplan deny[msg] { r := tfplan.resource_changes[_] r.type == "aws_security_group" r.change.after.ingress[_].cidr_blocks[_] == "0.0.0.0/0" msg := sprintf("%v has 0.0.0.0/0 as allowed ingress", [r.address]) } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 34 registry.terraform.io/browse/run-tasks Terraform Cloud Run Tasks @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 37 developer.hashicorp.com/terraform/cloud-docs/policy-enforcement Terraform Cloud Policy Enforcement @joatmon08
© 2023 HASHICORP 38 Learn more at developer.hashicorp.com/terraform/tutorials/cloud -get-started @joatmon08
© 2023 HASHICORP 39 Manage Network Infrastructure as Code Complexity
with HashiCorp Terraform Cloud Rosemary Wang Developer Advocate at HashiCorp @joatmon08
© 2023 HASHICORP 40 Write network infrastructure as code Share
it with your team and organization. Run it in production. Research Adopt Standardize Scale The Infrastructure as Code Journey @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 41 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP 42 developer.hashicorp.com/terraform/cloud-docs/integrations/service-now Change Management Systems @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 44 developer.hashicorp.com/terraform/tutorials/cloud/no-code-provisioning No-Code Provisioning @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 45 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP 46 Validate Reconcile current state to codified
one in order to reduce errors. data "aws_acm_certificate" "issued" { domain = "tf.example.com" most_recent = true } resource "aws_lb_listener_certificate" "example" { listener_arn = aws_lb_listener.front_end.arn certificate_arn = data.aws_acm_certificate.issued.arn lifecycle { postcondition { condition = data.aws_acm_certificate.issued.status != "EXPIRED" error_message = "The listener certificate has expired." } } } @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 49 developer.hashicorp.com/terraform/cloud-docs/workspaces/health Health Assessments @joatmon08
© 2023 HASHICORP Bridge Use manual interfaces to run infrastructure
as code. 50 Validate Reconcile source of truth. Change Use immutability to update infrastructure. Practices @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 54 …even continuously deployed changes @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP @joatmon08
© 2023 HASHICORP 57 developer.hashicorp.com/consul/tutorials/network-infrastructure-automation/co nsul-terraform-sync-intro Consul-Terraform-Sync @joatmon08
© 2023 HASHICORP 58 Learn more at developer.hashicorp.com/terraform/tutorials/cloud @joatmon08