OCI (Oracle Cloud Infrastructure) 에서 Terraform을 이용하여 관리 자동화 구축

1. Terraform with OCI
Jesam Kim, Senior Sales Consultant
Oracle Infrastructure Cloud / IaaS
28 June 2018
Confidential – Oracle RestrictedCopyright © 2018, Oracle and/or its affiliates. All rights reserved. |

2. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Agenda
– Introducing Terraform
– Installing Terraform on Oracle Linux 7
– Terraform configuration files
– Terraform providers and OCI
– Terraform resources, plan and apply
– Terraform : DEMO

3. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Introducing Terraform
• Terraform is written by the team at Hashicorp.
• 인프라를 효율적으로 구축하고 관리하기 위한 “Infrastructure as Code” 도구 입니다.
• Terraform – 다양한 프로바이더에서 인프라를 생성, 결합 및 관리 합니다.
• Terraform은 Chef, Puppet 및 Ansible 과 같은 구성 관리 및 프로비저닝 툴과도 통합됩니다.

4. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Introducing Terraform
– Why not a configuration management tool?
– Why not CloudFormation?
– What can you use Terraform for?
• Multi-tier applications
• Self-service infrastructure
• Production, development and testing environments
• Continues delivery

5. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Introducing Terraform
• Written in Go
• Runtimes available for OSX, Linux and Windows
• Ia32, x64 and ARM
• Fast development - releases monthly+
• HCL – Hashi Configuration Language and simple markup format
- JSON interoperable

6. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Introducing Terraform
• Traditional procedural build process:
- Login to a dashboard
- Go to compute tab
- Click on launch new instance
- …..
- Configure VM, etc
• Terraform uses a declarative build process:
- A VM with 2 OCPUs and 7GB RAM
- 100GB of block storage
- CentOS 7
- Two network interfaces with IP 10.0.0.1/24 and 10.0.1.1./24

7. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Installing Terraform on Oracle Linux 7
Oracle Linux 7.5 인스턴스에 Terraform을 설치하기 위해 yum 저장소를 사용하여 terraform 바이너리
및 oci provider를 설치:
# sudo yum install terraform terraform-provider-oci
These packages are installed:
- Terraform v0.11.7
- terraform-provider-oci v2.1.12
You can also install from provider for OCI using our Github repo:
https://github.com/oracle/terraform-provider-oci

8. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform Configuration Files
• Configuration 은 단일 혹은 복수의 파일로 분할 될 수 있습니다.
• Terraform 은 현재 작업 디렉토리의 모든 .tf 혹은 .tf.json 으로 끝나는 파일을 병합합니다.
• 하위 디렉토리는 포함되지 않습니다. (non-recursive).
• 파일은 순차적으로 병합 됩니다.
• .tf , .tf.json 외 다른 확장자명을 가진 파일은 무시됩니다. (e.g. .jpg)
TIP: Setup a directory to host all your terraform files

9. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform Configuration Files
두 가지 configuration files formats (.tf and .tf.json) :
• Humans -.tf 형식은 광범위하게 사람이 읽을 수 있으며, 인라인 주석을
허용하며 일반적으로 사람이 구성하는 경우 권장됩니다.
• Machines - The .tf.json 형식은 순수한 JSON 형식이며, 기계가 구성 파일을
작성하는 기계 상호 작용을 위한 것입니다.
{
"keyword1": [
{
"some_name": [
{
"key": "value",
"nested": [
{
"key": "value"
}
]
}
]
}
]
}
keyword1
"some_name" {
key = "value"
nested {
key =
"value'
}

10. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform Configuration Files - Providers
• Providers connect Terraform to the infrastructure you want to manage
• They provide configuration like connection details and authentication credentials.
• You can think about them as a wrapper around the services whose infrastructure we
wish to manage.
• In order to download the providers you’re using in your environment you need to
run the terraform init command to install any required providers.

11. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform Configuration Files – OCI Provider
첫 째로 할 일은 provider setup 입니다.
다음은 OCI 예제 입니다 :
provider "oci" {
tenancy_ocid = "${var.tenancy_ocid}"
user_ocid = "${var.user_ocid}"
fingerprint = "${var.fingerprint}"
private_key_path = "${var.private_key_path}"
region = "${var.region}"
}
oci provider 는 Terraform을 사용하여 OCI 테넌시에 대해 자원을 생성, 관리 및 삭제할 수 있습니다.

12. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform Configuration Files – Resources
Resources - provider 가 구성되고 나면 provider의 resource를 사용할 수 있습니다.
oci provider를 사용하여 인스턴스, 블록 및 오브젝트 스토리지, 네트워크 등을 만들 수 있습니다.
The following example starts an instance:
Component Provider Type Name
NOTE: The combination of type and name must be unique in your configuration.

13. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform plan
• The plan shows you what will happen
• You can save plans to guarantee what will happen
• Plans show reasons for certain actions (such as re-create)
• Prior to Terraform, users had to guess change ordering, parallelization, and rollout effect
# terraform plan

14. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform plan - Example

15. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform plan - Indicators
+ indicates a resource will be created
- indicates a resource will be destroyed
~ indicates a resource will be updated in-place
-/+ indicates a resources will be destroyed and re-created

16. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform apply
• Executes changes in order based on the resource graph
• Parallelizes changes when possible
• Handles and recovers transient errors
• Updates existing resources when updates are allowed
• Re-creates existing resources when updates are not allowed
# terraform apply

17. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform apply - Example
# terraform apply -auto-approve

18. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform : DEMO
• Oracle Linux 7.5 VM 생성 및 Terraform 설치는 선행되어 있음.
• Oracle Linux 7.5 에서 OCI API 접속을 위한 Key Pair 생성
(1) Private Key 생성
(2) Public Key 생성
• 생성된 Public Key의 내용을 복사 한뒤, OCI > User의 api용 user에 등록
($ cat ~/.ssh/oci_api_key_public.pem 출력 내용 복사)
$ openssl genrsa –out ~/.ssh/oci_api_key.pem 2048
$ chmod go-r ~/.ssh/oci_api_key.pem
$ openssl rsa –pubout –in ~/.ssh/oci_api_key.pem –out ~/.ssh/oci_api_key_public.pem

19. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform : DEMO
• 생성된 Public Key의 내용을 복사 한뒤, OCI > User의 api용 user에 등록 후
Fingerprint 값 복사

20. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform : DEMO
• 접속용 Key 정보 및 OCI의 각 OCID 정보를 OS 파라미터로 설정
$ vi ~/.bash_profile
…..
export TF_VAR_tenancy_ocid="ocid1.tenancy.oc1..aaaaaaaaujfmhpw3mr6bu3s7ntoe3dwwi36oxw2esgvj2per34kogpnvudja"
export TF_VAR_user_ocid="ocid1.user.oc1..aaaaaaaagv3hsgqmht5roynxn64wab4zjywkuisxhs6rdxvtj32gje4jeufq"
export TF_VAR_compartment_ocid="ocid1.compartment.oc1..aaaaaaaasj3wfoxxtewwa7t4b5g743iixsmetst5pc6l6o3q7yd242nz3bcq"
export TF_VAR_fingerprint="47:eb:46:4b:87:bf:af:c1:84:2b:fb:44:cb:ab:37:64"
export TF_VAR_private_key_path=/home/opc/.ssh/oci_api_key.pem
:wq!
$ source ~/.bash_profile

21. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform : DEMO
• OCI Instance 생성을 위한 Compute.tf 작성 (사전에 VCN 및 Subnet은 생성되어 있음)
variable "tenancy_ocid" {}
variable "user_ocid" {}
variable "fingerprint" {}
variable "private_key_path" {}
variable "compartment_ocid" {}
provider "oci" {
tenancy_ocid = "${var.tenancy_ocid}"
user_ocid = "${var.user_ocid}"
fingerprint = "${var.fingerprint}"
private_key_path = "${var.private_key_path}"
}
resource "oci_core_instance" "TFInstance" {
availability_domain = "rDTV:US-ASHBURN-AD-1"
compartment_id = "${var.compartment_ocid}"
display_name = "TEST"
image = "ocid1.image.oc1.iad.aaaaaaaazq7xlunevyn3cf4wppcx2j53eb26pnnc4ukqtfj4tbjjcklnhpaa"
shape = "VM.Standard1.1"
subnet_id = "ocid1.subnet.oc1.iad.aaaaaaaan4t2zxrc5gf76lfpzndkbg23um5daov5r3yn5oaorupgbhzx2p5a"
metadata {
ssh_authorized_keys = "ssh-rsa
AAAAB3NzaC1yc2EAAAADAQABAAABAQCjDdIiOo3haHr41dSbR1EV2gbNq8by1ldWXaPciwfQs4KkXygPedqWRGf9Iegzw3/CMK8uUvhoVMH6KdBOEYC+k9rPawfl5y7lWxXkY3DKe4Fe1RIMZbh5azmQcRKcx+aW
hksTLIJn630Fe5o8zI2iLaHWwIbyF9aWflSFCQBfr6HwvenSfxVUXgpKrGytbO6QGIYhq5W/7Zb5sYYHg8wET3S3uI5acZu3bD/2Q7OK1PnC6/JrGvLgDDhUAp7Bfqa70xGM0t1I+2AuemzZ1LqQuWIQEHZQJPCEayPg8
WsqwIhURfZ/qTLGF5Az6HdOL2aaQcwXwXNL88t48EAVWgXP"
}
}

22. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform : DEMO
• Terraform plan 및 apply 수행
(OCI Region은 Ashburn 환경이므로, The region for API connections 에 대해서 us-ashburn-1 입력)
$ terraform plan
…
$ terraform apply
…

23. Copyright © 2018, Oracle and/or its affiliates. All rights reserved. |
Terraform : DEMO
• 생성된 TEST instance 확인