Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure

Production-Ready Terraform Deployments on Azure
Azure Meetup Hamburg, July 2021

Nico Meisenzahl
• Senior Cloud & DevOps Consultant at white duck
• Microsoft MVP, Docker Community Leader &
GitLab Hero
• Container, Kubernetes, Cloud-Native & DevOps
© white duck GmbH 2021
Phone: +49 8031 230159 0
Email: nico.meisenzahl@whiteduck.de
Twitter: @nmeisenzahl
LinkedIn: https://www.linkedin.com/in/nicomeisenzahl
Blog: https://meisenzahl.org

Agenda
• What is Infrastructure as Code and why do we need it?
• Get started with Terraform
• Demo: Terraform on Azure

What is Infrastructure as Code?
Infrastructure as Code (IaC) is the management and
provisioning of infrastructure through code rather
than manual processes.

Infrastructure as Code is…
• version controlled through Git
• automated through CI/CD
• reusable
• self-documented
• declarative

Declarative vs imperative

Why do we need IaC?
• to prevent configuration drift
• to recover quickly (rollback, restore)
• to reproduce errors & test our infrastructure
• to reduce costs & time-to-market

Infrastructure vs. configuration
• infrastructure orchestration is used to provision & manage
immutable infrastructure like Cloud resources
• e.g. provisioning of a Resource Group containing a Function App
• with Terraform, ARM Templates, Pulumi, AWS CloudFormation, …
• configuration management can be used to configure/maintain
mutable resources
• e.g. installing or configuring something within a Virtual Machine
• With Ansible, Chef, Puppet, Saltstack, …

What is Terraform?
Terraform is an Infrastructure as Code tool that
provides a consistent CLI workflow to manage
hundreds of cloud services.
Terraform codifies cloud APIs into declarative
configuration files.

What is Terraform?
• contains of
• a CLI
• a domain specific language (DSL)
• supports hundreds of cloud services
• extendable and therefore flexible
• is not a configuration tool
• introduced and open-sourced by Hashicorp
• is defacto the tool of choice

Terraform Providers
• Terraform relies on plugins called "providers" to interact
with Cloud resources
• Resource types are implemented by a provider
• Terraform itself cannot manage any resources
• are provided by
• Hashicorp (official flag)
• Cloud Providers and Third-Party (verified flag)
• open-source community (community flag)
• yourself J

Terraform Modules
• are “containers” for multiple resources that are used
together
• are the main way to package and reuse resource
configurations
• are stored locally (subfolder) or can be shared/published

Terraform Registry

Hashicorp Configuration Language - HCL
• a DSL (domain specific language) used to describe
resources
• there is also the Cloud Development Kit (CDK)
• supports TypeScript, Python, Java, C#, Golang
• early-stage project
• https://github.com/hashicorp/terraform-cdk

HCL sample

Terraform workflow

Terraform State
• is used to map “real world” resources to your configuration
• code à state ß real world
• stores Terraform-managed resources
• contains all infrastructure and metadata
• incl. secrets!
• local by default but should be stored remote backend
• Terraform Cloud
• Azure Storage Account
• AWS, GCP, GitLab, …
• …

Terraform CLI

Production-ready workflow (PR)

Terraform sample project structure

Generic Providers
• Template Provider
• allows injecting variables into config files
• https://registry.terraform.io/providers/hashicorp/template/latest
• Random Provider
• generates random strings, id, integer, passwords
• https://registry.terraform.io/providers/hashicorp/random/latest
• TLS Provider
• used to generate keys and certificates
• https://registry.terraform.io/providers/hashicorp/tls/latest
• Null Provider
• advanced - helps orchestrate tricky behavior or work arounds
• https://registry.terraform.io/providers/hashicorp/null/latest

Terraform providers for Azure
• Azure RM provider
• https://registry.terraform.io/providers/hashicorp/azurerm/latest
• Azure AAD provider
• https://registry.terraform.io/providers/hashicorp/azuread/latest
• Azure Stack provider
• https://registry.terraform.io/providers/hashicorp/azurestack/latest
• Azure DevOps provider
• https://registry.terraform.io/providers/microsoft/azuredevops/latest
• GitHub provider
• https://registry.terraform.io/providers/integrations/github/latest

Generic resources
• Data resource
• used to retrieve meta data from unmanaged resources
• Remote state resource
• used to retrieve meta data from “other” projects
• https://registry.terraform.io/providers/hashicorp/terraform/latest/
docs/data-sources/remote_state

Variables
• input variables
• serves as parameters for a module or project
• output variables
• child module can use outputs to expose resource attributes
• print certain values in the CLI for further usage
• local variables
• are a convenience feature for assigning a short name to any
expression

Meta arguments & functions
• Terraform supports meta arguments like
• count, for_each
• depends_on, lifecycle
• and a variety of functions like
• numeric, string, encoding, hash, crypto, …
• https://www.terraform.io/docs/language/functions/index.html

Provisioners
• should only be used as a last option
• are not declarative!
• Terraform supports
• file
• local_exec
• remote_exec
• https://www.terraform.io/docs/language/resources/provisioners/i
ndex.html

Environment stages in Terraform
• build one project for all stages (DEV, QS/QA, PROD, …)
• build it customizable via variables
• repositories vs branches
• state management via
• Terraform “Workspaces”
• uses one backend with multiple states
• not supported by all backends
• customizable backends
• different Backend configurations
• inject backend details via CLI/Shell

Terraform vs ARM Templates
• Terraform
• extendable and therefore flexible
• multi-cloud
• requires some work to run it production-ready (CI/CD, state)
• also supports ARM templates for advanced use-cases
• ARM Templates
• first-class support on Azure (but also limited to Azure)
• “only” Azure resources, no Azure AAD, etc.
• easy start with Bicep (https://github.com/Azure/bicep)

Demo: Terraform on Azure
• scaffold a first Terraform project
• provision some Azure resources

Authentication with Azure RM / Azure AD
• local Azure CLI
• Service Principal with a Client Certificate
• Service Principal with a Client Secret
• Managed Identity

Terraform scaffold for Azure
• provisions
• a service principal used to run Terraform on behalf
• a Storage Container used to store the Terraform state file
• a Key Vault containing all secrets to allow easy and secure
access
• https://github.com/whiteducksoftware/terraform-scaffold-
for-azure

Questions?
Slides: https://www.slideshare.net/nmeisenzahl
Nico Meisenzahl (Senior Cloud & DevOps Consultant)
Phone: +49 8031 230159 0
Email: nico.meisenzahl@whiteduck.de
Twitter: @nmeisenzahl
LinkedIn: https://www.linkedin.com/in/nicomeisenzahl
Blog: https://meisenzahl.org

Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure

Similar to Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure (20)

More from Nico Meisenzahl

More from Nico Meisenzahl (9)

Recently uploaded

Recently uploaded (20)

Azure Meetup Hamburg: Production-Ready Terraform Deployments on Azure