Slide 1

Slide 1 text

MS Azure Zürich User Group IAC Episode 3 Terraform Strikes Back! Jonas Wanninger

Slide 2

Slide 2 text

Jonas Wanninger Consultant and Cloud Architect • Azure (Automation, Architecture and Security) • Development (.NET, PowerShell, SQL) • Microsoft SQL Server • Microsoft Certified Trainer https://www.linkedin.com/in/jonas-wanninger-0a4833139/

Slide 3

Slide 3 text

Terraform Strikes Back?! VS

Slide 4

Slide 4 text

Why is IaC cool? Provides consistency across all deployments and stages Version control Faster deployments and recovery Just in time deployments

Slide 5

Slide 5 text

First things First: Terraform Overview • Company: Hashicorp • Open Source • based on Azure SDK for GO! • Cloud vendor independent

Slide 6

Slide 6 text

Terraform Cloud Consistent and reliable deployment environment Shared state and secret data Approving changes to infrastructure, A private registry for modules Terraform Enterprise is the Self Hosted version of the Terraform Cloud

Slide 7

Slide 7 text

resource "azurerm_resource_group" "rg" { name = "myTFResourceGroup" location = "westus2" } HCL Introduction "" "" { # Block body = # Argument } Overall Syntax Example

Slide 8

Slide 8 text

First things First: Terraform Workflow Write Code Init Terraform Validate Plan Apply Get Happy!

Slide 9

Slide 9 text

DEMO

Slide 10

Slide 10 text

Terraform files terraform.tfstate terraform.tfvars main.tf

Slide 11

Slide 11 text

Advanced Terraform Topics: The Statefile Terraform always keeps track of your infrastrucuture Contains sensitive data in clear text Stored locally Not great for working in teams Shows your entire cloud infrastructure Including security issues ;)

Slide 12

Slide 12 text

Advanced Terraform Topics: The Statefile • Remote Backend are the solution e.g Azure Blob Storage • Encrypted • Locking mechanism state.tfstate Authenticate to storage account (e.g with SP or MSI) Gets decrypted while Terraform works with it On the Storage Accounts its encrypted again.

Slide 13

Slide 13 text

Advanced Terraform Topics: Keeping Your Secrets

Slide 14

Slide 14 text

Advanced Terraform Topics: Keeping Your Secrets

Slide 15

Slide 15 text

Advanced Terraform Topics: Keeping Your Secrets

Slide 16

Slide 16 text

Advanced Terraform Topics: Keeping Your Secrets

Slide 17

Slide 17 text

Advanced Terraform Topics: Keeping Your Secrets • Tool Recommendation • GitHub: mozilla / sops • Encrypts and decrypts variable files on the fly • Encryption Keys can be kept in an Azure Key Vault • Encrypted Terraform variable file can be checked in Version Control Pull Code incl. encrypted variables files from source control Decrypt variables file Terraform deployment Delete files from deployment server

Slide 18

Slide 18 text

Advanced Terraform Topics: Dependency Graph Terraform plan •Create Dependency Graph •Can be saved Terraform apply •Traverses dependency graph Depends On •Dependencies can be manually specified but that's not necessary

Slide 19

Slide 19 text

When to Use Terraform When to Use ARM? – Speed ARM Templates o directly talk to the ressource manager o Can parallelize work Terraform o In most cases slower o No parallelism, just for depdendency traversal

Slide 20

Slide 20 text

When to Use Terraform When to Use ARM? - Features ARM Templates o Always has the latest Azure features (previews) o Lacks Code management fatures and modularization o Manual dependency management o Especially annoying since you sometimes run into limitations e.g V-NET Terraform o Depends on the Azure SDK for GO! o More features towards code modularization and dynamic code functions o Automatic dependency management o No history tracking in Azure

Slide 21

Slide 21 text

When to Use Terraform When to Use ARM? – Use Cases Use Case Go With Need newest features? ARM Deployment times are critical? ARM Infrastructure is quite simple? ARM Infrastructure is complex? Terraform Hybrid Cloud capablitiy is important? Terraform

Slide 22

Slide 22 text

Contact: [email protected] Thank you for attending! Stay Healthy!