Terraform

From Ever changing code
Jump to navigation Jump to search

This article is about utilising a tool from HashiCorp called Terraform to build infrastructure as a code. Meaning to spin up AWS instances, setup security groups, VPC and any other cloud based infrastructure component.

Install terraform 

wget https://releases.hashicorp.com/terraform/0.9.1/terraform_0.9.1_linux_amd64.zip
unzip terraform_0.9.1_linux_amd64.zip
sudo mv ./terraform /usr/local/bin

When terraform is run it looks for .tf file where configuration is stored. The look up process is limited to a flat directory and never leaves the directory that runs from. Therefore if you wish to address a common file a symbolic-link needs to be created within the directory you have .tf file. 

vi example.tf 
provider "aws" {
	access_key = "AK01234567890OGD6WGA" 
	secret_key = "N8012345678905acCY6XIc1bYjsvvlXHUXMaxOzN"
	region = "eu-west-1"
}
resource "aws_instance" "webserver" {
	ami = "ami-405f7226"
	instance_type = "t2.nano"
}

The example above will create an Ubuntu instance. 

$ terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
<...>

+ aws_instance.webserver
   ami:                         "ami-405f7226"
   associate_public_ip_address: "<computed>"
   availability_zone:           "<computed>"
   ebs_block_device.#:          "<computed>"
   ephemeral_block_device.#:    "<computed>"
   instance_state:              "<computed>"
   instance_type:               "t2.nano"
   ipv6_addresses.#:            "<computed>"
   key_name:                    "<computed>"
   network_interface_id:        "<computed>"
   placement_group:             "<computed>"
   private_dns:                 "<computed>"
   private_ip:                  "<computed>"
   public_dns:                  "<computed>"
   public_ip:                   "<computed>"
   root_block_device.#:         "<computed>"
   security_groups.#:           "<computed>"
   source_dest_check:           "true"
   subnet_id:                   "<computed>"
   tenancy:                     "<computed>"
   vpc_security_group_ids.#:    "<computed>"

Apply stage, if runs first time will create terraform.tfstate after all changes are done. This file should not be modified manually. It's used to compare what is out in cloud already so the next time APPLY stage runs it will look at the file and execute only necessary changes. 

$ terraform apply
aws_instance.webserver: Creating...
 ami:                         "" => "ami-405f7226"
 associate_public_ip_address: "" => "<computed>"
 availability_zone:           "" => "<computed>"
 ebs_block_device.#:          "" => "<computed>"
 ephemeral_block_device.#:    "" => "<computed>"
 instance_state:              "" => "<computed>"
 instance_type:               "" => "t2.nano"
 ipv6_addresses.#:            "" => "<computed>"
 key_name:                    "" => "<computed>"
 network_interface_id:        "" => "<computed>"
 placement_group:             "" => "<computed>"
 private_dns:                 "" => "<computed>"
 private_ip:                  "" => "<computed>"
 public_dns:                  "" => "<computed>"
 public_ip:                   "" => "<computed>"
 root_block_device.#:         "" => "<computed>"
 security_groups.#:           "" => "<computed>"
 source_dest_check:           "" => "true"
 subnet_id:                   "" => "<computed>"
 tenancy:                     "" => "<computed>"
 vpc_security_group_ids.#:    "" => "<computed>"
aws_instance.webserver: Still creating... (10s elapsed)
aws_instance.webserver: Creation complete (ID: i-0eb33af34b94d1a78)

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

The state of your infrastructure has been saved to the path
below. This state is required to modify and destroy your
infrastructure, so keep it safe. To inspect the complete state
use the `terraform show` command.

State path: 

$ terraform show
aws_instance.webserver:
 id = i-0eb33af34b94d1a78
 ami = ami-405f7226
 associate_public_ip_address = true
 availability_zone = eu-west-1c
 disable_api_termination = false
 ebs_block_device.# = 0
 ebs_optimized = false
 ephemeral_block_device.# = 0
 iam_instance_profile = 
 instance_state = running
 instance_type = t2.nano
 ipv6_address_count = 0
 ipv6_addresses.# = 0
 key_name = 
 monitoring = false
 network_interface_id = eni-2c6b1553
 private_dns = ip-172-31-7-109.eu-west-1.compute.internal
 private_ip = 172.31.7.109
 public_dns = ec2-34-249-29-115.eu-west-1.compute.amazonaws.com
 public_ip = 34.249.29.115
 root_block_device.# = 1
 root_block_device.0.delete_on_termination = true
 root_block_device.0.iops = 100
 root_block_device.0.volume_size = 8
 root_block_device.0.volume_type = gp2
 security_groups.# = 0
 source_dest_check = true
 subnet_id = subnet-92a4bbf6
 tags.% = 0
 tenancy = default
 vpc_security_group_ids.# = 1
 vpc_security_group_ids.1039819662 = sg-5201fb2b

$ terraform destroy
Do you really want to destroy?
 Terraform will delete all your managed infrastructure.
 There is no undo. Only 'yes' will be accepted to confirm.
 Enter a value: yes
aws_instance.webserver: Refreshing state... (ID: i-0eb33af34b94d1a78)
aws_instance.webserver: Destroying... (ID: i-0eb33af34b94d1a78)
aws_instance.webserver: Still destroying... (ID: i-0eb33af34b94d1a78, 10s elapsed)
aws_instance.webserver: Still destroying... (ID: i-0eb33af34b94d1a78, 20s elapsed)
aws_instance.webserver: Still destroying... (ID: i-0eb33af34b94d1a78, 30s elapsed)
aws_instance.webserver: Destruction complete

Destroy complete! Resources: 1 destroyed.

After the instance has been terminated the terraform.tfstate looks like below: 

vi terraform.tfstate
{
    "version": 3,
    "terraform_version": "0.9.1",
    "serial": 1,
    "lineage": "c22ccad7-ff26-4b8a-bf19-819477b45202",
    "modules": [
        {
            "path": [
                "root"
            ],
            "outputs": {},
            "resources": {},
            "depends_on": []
        }
    ]
}

AWS credentials profiles and variable files

Instead to reference secret_access keys within .tf file directly we can use AWS profile file. This file will be look at for the profile variable we specify in variables.tf file. 

$ vi ~/.aws/credentials    #create AWS profile file
[terraform-profile1]       #profile name
aws_access_key_id = AK01234567890OGD6WGA
aws_secret_access_key = N8012345678905acCY6XIc1bYjsvvlXHUXMaxOzN

Then we can now remove the secret_access keys from the main .tf file (example.tf) and amend as follows: 

provider "aws" {                provider "aws" { 
  access_key = "AK012345678 =>    profile = "${var.profile}"
  secret_key = "N8012345678       region  = "${var.region }"
  region = "eu-west-1"

and create a variable file to reference it 

$ vi variables.tf
variable "region" {
        default = "eu-west-1"
}
variable "profile" {}     #variable without a default value will prompt to type in the value. And that should be 'terraform-profile1'

Run terraform 

$ terraform   #it it will prompt for a value
$ terraform plan -var 'profile=terraform-profile1'  #this way value can be set
Retrieved from ‘http://wiki.ciscolinux.co.uk/index.php?title=Terraform&oldid=2254’