Terraform is an open-source tool for building, changing, and versioning infrastructure safely and efficiently. It allows users to define infrastructure as code and provision resources on cloud platforms like Azure. The document discusses both the benefits of Terraform for Azure, such as treating infrastructure as code and standardized configuration, as well as some challenges, such as limitations in Terraform's language and potential issues with state management. It provides tips for best practices like organizing code and folders, importing existing resources, and handling credentials and IPs. Overall, Terraform is useful for provisioning Azure infrastructure in a repeatable way but requires care around its language and state management.

1. Terraform for Azure:
the good, the bad and the ugly
Giulio Vian – DevOps Lead – Glass, Lewis & Co.

2. Why Terraform?

4. Agenda
Slides on SlideShare

5. The Good,

6. What is Terraform?
Provisioning
•Terraform
•Azure ARM
Template
•Azure CLI
•Azure
Powershell
Configuration
•Powershell
DSC
•Chef
•Ansible
•Packer
Deployment
•Azure DevOps

7. What is Terraform?
Provisioning
•Terraform
•Azure ARM
Template
•Azure CLI
•Azure
Powershell
Configuration
•Powershell
DSC
•Chef
•Ansible
•Packer
Deployment
•Azure DevOps

8. No, what is Terraform?
Single executable (kinda)
https://www.terraform.io/

9. Terraform DSL
resource "azurerm_virtual_machine" "vm_demo" {
name = "demovm"
location = “northeurope"
resource_group_name = "tf-demo"
network_interface_ids =
["${azurerm_network_interface.vm_demo.id}"]
vm_size = "Standard_B2s"
storage_image_reference {
publisher = "MicrosoftWindowsServer"
offer = "WindowsServerSemiAnnual"
sku = "Datacenter-Core-1803-smalldisk"
version = "latest"
}
storage_os_disk {
name = "demovm-osdisk"
caching = "ReadWrite"
create_option = "FromImage"
}
storage_data_disk {
name = "demovm-datadisk"
create_option = "Empty"
lun = 0
disk_size_gb = "10"
}
os_profile {
computer_name = "DEMOVM"
admin_username = "${var.vm_admin_username}"
admin_password = "${var.vm_admin_password}"
}
os_profile_windows_config {
provision_vm_agent = true
enable_automatic_upgrades = false
}
}

10. How it works
Command line tool
terraform init
terraform plan -out temp.dat
terraform apply temp.dat
Providers
Executables
azurerm, azuread, azurestack
State (metadata)

11. Terraform basics

12. Infrastructure-as-Code mindset
No manual changes
Replace hand built resources
with automation
Source control

13. Terraform 0.12
Great promises
in a not-so-near future

14. Tip: Passing credentials
resource "azurerm_virtual_machine_extension" "my_vm_dscext"
{
#...
protected_settings = <<PROTECTED_SETTINGS
{
"configurationArguments": {
"someCredential": {
"userName": "theUser",
"password": "${var.the_user_pass}"
}
}
}
PROTECTED_SETTINGS
}

15. Tip: assigning IPs
Static addresses
cidrsubnet
cidrhost

16. Tip: pulling KeyVault
Pre-load KeyVault with secrets
data "azurerm_key_vault_secret" "test" {
name = "mypassword"
vault_uri = "https://yourvault.vault.azure.net/"
}

17. Integration
azurerm_virtual_machine_extension
Powershell DSC
Custom script → bash / Ansible
Providers
Chef, Docker, Kubernetes
Provisioners
ssh / WinRM

18. the Bad,

19. Language Limits (HCL <0.12)
Loops are hard
Nested loop almost impossible
Ifs are hard or impossible

20. Catching up
Application Gateway
story

21. Simple errors
Error: Error applying plan:
azurerm_lb_probe.lb_probe_http: Error
Creating/Updating LoadBalancer
network.LoadBalancersClient#CreateOrUpdate
: Failure sending request: StatusCode=0 --
Original Error: Put
https://management.azure.com/subscriptions
/12345678-9abc-def0-1234-
56789abcdef0/resourceGroups/qa/providers/M
icrosoft.Network/loadBalancers/qa-
loadbalancer?api-version=2017-09-01: http:
ContentLength=1655 with Body length 0

22. and the Ugly

23. State management
Myth: State is map of reality
Setup in shared, locked place
Azure Storage or AWS S3
Some changes not sensed
Learn to use
terraform state

24. Stay organized
/ repo root
modules terraform modules
utility general purpose
shared common to multiple applications or environments
application_name internal or public application
non-production can be rebuilt any moment
shared common to multiple environments
e.g. deploy agents, jumpbox
qa Integration test
uat User acceptance test
perf Load testing
production everything here is critical
... details on next slide

25. Stay organized (cont’d)
/ repo root
production everything here is critical
legacy hand made infrastructure e.g. TFS
shared common to main and DR
e.g. networking
live PRODUCTION ENVIRONMENTS
network “everlasting” resources
data-tier long-lived resources
app-tier short-lived resources
app_name resources for an app
dr Disaster recovery site
... As above

26. Folders and state
Each leaf has a state file
Source can refer to existing state files
production
shared production/shared/terraform.tfstate
live
network production/live/network/terraform.tfstate
app-tier production/live/app-tier/terraform.tfstate

27. Three steps to import
Define as regular resources
Add safety clause
lifecycle {
prevent_destroy = true
}
Include in state
terraform import

28. Tip: Terraform tips
HCL parser idiosyncrasies
Regex might be troublesome
is not unusual

29. Wrap-up
29

30. Successo?

31. Study the book
Terraform - Up and Running: Writing Infrastructure as Code — Y.Brikman (O′Reilly)

32. Bio in pictures
32
giulio.dev@casavian.eu
@giulio_vian
https://www.slideshare.net/giuliov
https://tfsaggregator.github.io
http://blog.casavian.eu/
Hardware spec:
1KB RAM (upg. 16KB)
4KB ROM
First computer Companies Communities

33. End of trasmissions
33

34. Backup slides