Slide 1

Slide 1 text

Copyright © 2020 HashiCorp Patterns to Refactor Terraform NYC HashiCorp User Group November 2022

Slide 2

Slide 2 text

No content

Slide 3

Slide 3 text

Developer Advocate at HashiCorp 
 she/her 
 
 @joatmon08 joatmon08.github.io Rosemary Wang

Slide 4

Slide 4 text

Write “Cleaner” Terraform For happier future refactoring

Slide 5

Slide 5 text

Pattern: Find and Replace 😫😫😫 resource "aws_lb_target_group" "app" { port = 3000 } resource "aws_security_group" “app” { ingress { description = "Access to app." from_port = 3000 to_port = 3000 protocol = "tcp" security_groups = aws_security_group.ingress_alb.id } } CODE EDITOR

Slide 6

Slide 6 text

Pattern: Variables with Defaults 😀😀😀 Easier to move into modules later variable "application_port" { default = 3000 } resource "aws_lb_target_group" "app" { port = var.application_port } resource "aws_security_group" “app” { ingress { description = "Access to app." from_port = var.application_port to_port = var.application_port protocol = "tcp" security_groups = aws_security_group.ingress_alb.id } } CODE EDITOR

Slide 7

Slide 7 text

Pattern: Secrets as Variables 🧐 🧐 🧐 variable "password" { type = string sensitive = true } resource "aws_db_instance" "db" { password = var.password } CODE EDITOR

Slide 8

Slide 8 text

Pattern: Secrets as Dynamic Values 😀😀😀 resource "random_password" "db" { length = 16 min_upper = 2 min_lower = 2 min_numeric = 2 min_special = 2 special = true override_special = "`~!#$%^&*?" } resource "aws_db_instance" "db" { password = random_password.db.result } CODE EDITOR

Slide 9

Slide 9 text

Pattern: Secrets as Data Sources 🤩🤩🤩 data "vault_generic_secret" "db" { path = "app/database/admin" } resource "aws_db_instance" "db" { password = data.vault_generic_secret.db.data["password"] } CODE EDITOR

Slide 10

Slide 10 text

Pattern: Prototype Module 😀😀😀 module "tags" { source = "example/tags/aws" organization = "HashiCorp" unit = "HUG" } ## Tags Module with Prototype Pattern variable "organization" {} variable "unit" {} output "tags" { value = { organization = var.organization unit = var.unit expiration = timestamp() } } CODE EDITOR

Slide 11

Slide 11 text

1. Variables - names, tags, environments 2. Constants - set defaults if overrides, otherwise locals 3. Dynamic Values - use interpolation / data sources 4. Secrets - generate dynamically / data sources

Slide 12

Slide 12 text

Break Down Monoliths There’s no such thing as micro-Terraform

Slide 13

Slide 13 text

Monolithic Singleton put everything in one configuration and one state to rule it all.

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

Do I have a monolithic singleton? 1. Find and replace 2. Long apply time

Slide 16

Slide 16 text

Refactor 1. Find and replace → modules 2. Long apply time → state

Slide 17

Slide 17 text

Module Refactor

Slide 18

Slide 18 text

Pattern: Use moved Module Refactor Only resource "aws_instance" "bastion" {} module "bastion" {} moved { from = aws_instance.bastion to = 
 module.bastion.aws_instance.bastion } CODE EDITOR developer.hashicorp.com/terraform/language/modules/develop/refactoring

Slide 19

Slide 19 text

Pattern: Use import Module Refactor TERMINAL # Build module > terraform import \
 module... > terraform state rm . # Comment out old resources in Terraform > terraform plan # check no drift # Delete old resources in Terraform

Slide 20

Slide 20 text

State Refactor

Slide 21

Slide 21 text

Dependency Injection decouple dependencies to handle cross-state interpolation

Slide 22

Slide 22 text

Pattern: Dependency Injection with Terraform Outputs # create network in TFC workspace data "tfe_outputs" "network" { organization = "hashicorp" workspace = "network" } resource "aws_instance" "server" { subnet_id = data.tfe_outputs.network.values.private_subnets.0 } CODE EDITOR

Slide 23

Slide 23 text

Pattern: Dependency Injection with Data Sources data "aws_vpcs" "network" { tags = { unit = "hug" } } data "aws_subnet_ids" "private" { vpc_id = data.aws_vpcs.network.ids.0 tags = { Type = "private" } } resource "aws_instance" "server" { subnet_id = data.aws_subnet_ids.private.ids.0 } CODE EDITOR

Slide 24

Slide 24 text

State Refactor

Slide 25

Slide 25 text

Pattern: Use import State Refactor TERMINAL # Copy resource configurations to new working directory # Implement dependency injection > cd > terraform init > terraform import . > terraform plan # check no drift

Slide 26

Slide 26 text

Pattern: Use import State Refactor TERMINAL > cd > terraform state rm . # Comment out old resources in Terraform > terraform plan # check no drift # Delete old resources in Terraform

Slide 27

Slide 27 text

Refactor Rules 1. Go from high-level to low-level resources 2. Choose resources with fewer dependencies 3. terraform plan = test 4. terraform state = source of truth

Slide 28

Slide 28 text

Use Immutability When all else fails, create everything new.

Slide 29

Slide 29 text

Many scenarios… 1. High-risk refactors 2. Failures 3. Terraform upgrades (syntax)

Slide 30

Slide 30 text

Pattern: Blue-green deployment Old Network New Network Servers Servers Modules in same state Module in separate state Module in separate state

Slide 31

Slide 31 text

Pattern: Blue-green deployment Blue resources share the same state terraform { cloud { organization = "hashicorp" workspaces { name = “hug" } } } module "network" {} module "servers" { count = 3 subnet = module.network.subnet.0 } CODE EDITOR

Slide 32

Slide 32 text

Pattern: Blue-green deployment Green resources in separate states terraform { cloud { organization = "hashicorp" workspaces { name = "hug-network" } } } module "network" {} output “subnets" { value = module.network.subnets } CODE EDITOR

Slide 33

Slide 33 text

Pattern: Blue-green deployment Green resources in separate states terraform { cloud { organization = "hashicorp" workspaces { name = "hug-servers" } } } data "tfe_outputs" "network" { organization = "hashicorp" workspace = "hug-network" } module "servers" { count = 3 subnet = data.tfe_outputs.network.values.subnets.0 } CODE EDITOR

Slide 34

Slide 34 text

Pattern: Blue-green deployment Old Network New Network Servers Servers Servers Modules in same state Module in separate state Module in separate state Load Balancer 50% 50%

Slide 35

Slide 35 text

Refactoring is inevitable. 1. Takes time and effort. 2. Go high-level to low-level. 3. Roll forward.

Slide 36

Slide 36 text

Rosemary Wang 
 @joatmon08 joatmon08.github.io Thanks!