Commodified IaC using Terraform Cloud

Commodified IaC using Terraform Cloud

• 2.
  COMMODIFIED IaC USING TERRAFORMCLOUD_ Marko Bevc
• 3.
  COMMON COMMODITIES_
• 4.
  POWER AS COMMODITY_
• 5.
  REFINING & ADOPTING_ S. Wardley:value chain mapping Thoughts and ideas Solution attempts Solution to known problems Refinement of solutions Very little knowledge Lots of knowledge product Problem definition Solution identification Standardization of solution Industrialization of solution New problems Gartner: hype cycle
• 6.
  ABOUT ME_ ● Senior ITConsultant at The Scale Factory (DevOps consultancy, AWS advanced consulting partner and K8s service provider) ● IT system engineering background with extensive Linux and virtualization experience ● Certifications and competencies: AWS, CKA, RHEL, Hashi stack ● Open source contributor and supporter ● Fan of automation/simplifying things, hiking, cycling and travelling
• 7.
  TALK AGENDA_ • Infrastructure asCode • Terraform Cloud • Abstracting complexity • Automation and CI/CD integration • Demo • Conclusions and takeaways
• 8.
  INFRASTRUCTURE AS CODE_ • Keyattribute for enabling good DevOps practices: – breaking organisational silos – multi-team collaboration • State visibility across estate • Disposable infrastructure and reproducibility • Higher delivery velocity and automation • Better testing and lowering risk of errors
• 9.
  TERRAFORM CLOUD_ • GA announcedat HashiConf’19 • Extensible SaaS solution (API, registries, plug-ins) • Abstraction of Terraform complexity • Safe: 2-factor authentication & Vault secrets • Collaboration: VCS integration, notifications, team management and Web UI/API • Fine-grained control: Sentinel policies, user roles, cost estimation • 160+ available providers
• 10.
  TERRAFORM CLOUD ARCHITECTURE_ Cloud /Enterprise OSS CLI Source: https://www.terraform.io/
• 11.
  ABSTRACTING COMPLEXITY_ ● Delegation of responsibility: –State and lock management – Remote/local execution & speculative plans – Unified workflows – Notifications – Web UI ● Same approach and structures (API / HCL) ● Changing infrastructure deployment perspective ● Of-the-shelf SaaS solution – commodity?
• 12.
  AUTOMATION AND PIPELINES_ • Integrationwith major VCS providers: GitHub, GitLab, Bitbucket, Azure DevOps • Containers used as runtime (Terraform version) • Auto or manual approvals • Variables/secrets & state access using: – TFE provider resources, i.e. tfe_variable – terraform_remote_state data resource • Private repositories and providers • Caveats: – Overwrites terraform.tfvars → *.auto.tfvars – Special vars: CONFIRM_DESTROY, TFE_PARALLELISM
• 13.
  HOW TO START_ ● Create organisation:team & workspaces ● Two factor authentication (TOTP, SMS) ● VCS integration ● Credential tokens ● Remote backend configuration ● Workspace creation – automatically with remote backend ● API tokens, SSH keys & policies*
• 14.
  $ cat ~/.terraformrc -------------------- plugin_cache_dir= "$HOME/.terraform.d/plugin-cache" disable_checkpoint = true credentials "app.terraform.io" { token = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" } backend.tf: ----------- terraform { backend "remote" { organization = "my-org" workspaces { name = "demo-tf-remote" } } }
• 15.
  REMOTE RUNS_ •
• 16.
  TIME FOR DEMO!_
• 17.
  CONCLUSIONS_ & TAKEAWAYS ● Complexity delegation(state, locking, execution, ...) ● Automation and deployment workflow integration ● Careful not storing/emitting secrets in configurations and logs ● Non-free and beta features: cost estimation, polices, run triggers, ... ● Room for improvement: default is remote, custom Docker images, cloud SAML/SSO and audit logs/compliance,… ● Shift left practice and platform convergence (multi/poly-cloud) → IaC as software delivered commodity
• 18.
  CONTACTS_ & RESOURCES ● “Make things assimple as possible, but not simpler.” A. Einstein ● Twitter: @_MarkoB ● GitHub / GitLab: @mbevc1 ● LinkedIn: https://www.linkedin.com/in/marko-bevc/ ● Resources: – https://www.thehistoricalarchive.com/happenings/57/the-history-of-elec tricity-a-timeline/ – https://en.wikipedia.org/wiki/Wardley_map – https://en.wikipedia.org/wiki/Hype_cycle – https://en.wikipedia.org/wiki/Infrastructure_as_code – https://terraform.cloud – https://www.hashicorp.com/cloud-operating-model – https://www.terraform.io/docs/cloud/run/cli.html – https://www.hashicorp.com/products/terraform/pricing/