Refactoring terraform
•
6 recomendaciones•2,987 vistas
The document discusses refactoring Terraform configuration files to improve their design. It provides an example of refactoring a "supermarket-terraform" configuration that originally defined AWS resources across multiple files. The refactoring consolidates the configuration into a single file and adds testing using Test Kitchen. It emphasizes starting small by adding tests incrementally and not making changes without tests to avoid introducing errors.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Destacado
Destacado (20)
Similar a Refactoring terraform
Similar a Refactoring terraform (20)
Más de Nell Shamrell-Harrington
Más de Nell Shamrell-Harrington (20)
Último
Último (20)
Refactoring terraform
- 1. Untangling Terraform Through Refactoring HashiConf 2016 @nellshamrell
- 2. Who Am I? Nell Shamrell-Harrington • Software Engineer at Chef • @nellshamrell • nshamrell@chef.io
- 3. Let’s talk about Terraform!
- 4. Why Refactor? • Add a feature
- 5. • Add a feature • Fix a bug Why Refactor?
- 6. • Add a feature • Fix a bug • Improve the design Why Refactor?
- 7. • Add a feature • Fix a bug • Improve the design • Optimize resource usage Why Refactor?
- 8. Let’s go through an example!
- 9. Today, we will refactor supermarket-terraform http://github.com/nellshamrell/supermarket-terraform supermarket-terraform
- 10. supermarket-cluster.tf provider “aws” { access_key = “${var.access_key}” secret_key = “${var.secret_key}” } supermarket-terraform
- 11. supermarket-cluster.tf provider “aws” { access_key = “${var.access_key}” secret_key = “${var.secret_key}” } supermarket-terraform
- 12. supermarket-cluster.tf variables.tf provider “aws” { access_key = “${var.access_key}” secret_key = “${var.secret_key}” } variable “access_key” = {} variable “secret_key” = {} supermarket-terraform
- 13. supermarket-cluster.tf variables.tf terraform.tfvars provider “aws” { access_key = “${var.access_key}” secret_key = “${var.secret_key}” } variable “access_key” = {} variable “secret_key” = {} access_key = “xxxxx” secret_key = “xxxxx” supermarket-terraform
- 14. Wait…should you use a credentials file?
- 15. You can…but for the sake of the example, let’s supply them inline
- 16. supermarket-cluster.tf provider “aws” { access_key = “${var.access_key}” secret_key = “${var.secret_key}” } supermarket-terraform
- 19. Security Group Allow SSH $ terraform apply supermarket-cluster.tf
- 20. Security Group Security Group Allow SSH $ terraform apply supermarket-cluster.tf
- 21. Security Group Security Group Allow SSH Allow Out $ terraform apply supermarket-cluster.tf
- 22. Security Group Security Group EC2 Allow SSH Allow Out $ terraform apply supermarket-cluster.tf
- 23. Security Group Security Group EC2 Chef Server Allow SSH Allow Out $ terraform apply supermarket-cluster.tf
- 24. EC2 Security Group Security Group EC2 Chef Server Allow OutAllow SSH $ terraform apply supermarket-cluster.tf
- 25. EC2 Security Group Security Group EC2 Chef Server Supermarket Allow OutAllow SSH $ terraform apply supermarket-cluster.tf
- 26. EC2 Security Group Security Group EC2 Chef Server Supermarket Allow OutAllow SSH $ terraform apply supermarket-cluster.tf
- 27. EC2 Security Group Security Group EC2 Chef Server Supermarket Allow OutAllow SSH $ terraform apply supermarket-cluster.tf
- 28. EC2 Security Group Security Group EC2 Chef Server Supermarket Allow OutAllow SSH $ terraform apply supermarket-cluster.tf
- 29. EC2 Security Group Security Group EC2 Chef Server Supermarket Allow OutAllow SSH $ terraform apply supermarket-cluster.tf
- 30. Hypothetical: We are using too many AWS Security Groups Why Refactor?
- 31. We need this config to create only one security group Why Refactor?
- 32. Source: Working Effectively with Legacy Code How to Refactor? Two Approaches
- 33. Source: Working Effectively with Legacy Code How to Refactor? • Edit and Pray Two Approaches
- 34. • Edit and Pray • Cover and Modify Two Approaches Source: Working Effectively with Legacy Code How to Refactor?
- 35. Confidence in code without tests is false confidence
- 36. What code is intended to do is much less important than what it actually does
- 37. Do I have to add tests for the entire thing?
- 38. No.
- 39. The point of adding tests is to not make things worse
- 40. And to start making the code better here and now
- 41. How can we test Terraform?
- 42. How Can We Test Terraform? • Test Kitchen (http://kitchen.ci)
- 43. How Can We Test Terraform? • Test Kitchen (http://kitchen.ci) • Kitchen Terraform (http://github.com/newcontext/ kitchen-terraform)
- 44. driver: name: terraform provisioner: name: terraform variable_files: terraform.@vars transport: name: ssh ssh_key: ~/path/to/your/aws/key pla@orms: -‐ name: ubuntu suites -‐ name: default .kitchen.yml
- 45. driver: name: terraform provisioner: name: terraform variable_files: terraform.@vars transport: name: ssh ssh_key: ~/path/to/your/aws/key pla@orms: -‐ name: ubuntu suites -‐ name: default .kitchen.yml
- 46. driver: name: terraform provisioner: name: terraform variable_files: terraform.5vars transport: name: ssh ssh_key: ~/path/to/your/aws/key pla@orms: -‐ name: ubuntu suites -‐ name: default .kitchen.yml
- 47. driver: name: terraform provisioner: name: terraform variable_files: terraform.5vars transport: name: ssh ssh_key: ~/path/to/your/aws/key pla@orms: -‐ name: ubuntu suites -‐ name: default .kitchen.yml
- 48. driver: name: terraform provisioner: name: terraform variable_files: terraform.@vars transport: name: ssh ssh_key: ~/path/to/your/aws/key pla@orms: -‐ name: ubuntu suites -‐ name: default .kitchen.yml
- 49. .kitchen.yml driver: name: terraform provisioner: name: terraform variable_files: terraform.@vars transport: name: ssh ssh_key: ~/path/to/your/aws/key pla5orms: -‐ name: ubuntu suites -‐ name: default Test Kitchen Boilerplate
- 50. • Test Kitchen (http://kitchen.ci) • Kitchen Terraform (http://github.com/newcontext/ kitchen-terraform) • Inspec (http://chef.io/inspec) How Can We Test Terraform?
- 51. Now that we have our tools…
- 52. Let’s start from a clean slate
- 53. #provider “aws” { # access_key = “${var.access_key}” # secret_key = “${var.secret_key}” # region = “${var.region}” #} #resource “aws_security_group” “allow-‐ssh” { # name = “${var.user_name}-‐allow-‐ssh” # tags = { # Name = “${var.user_name} Allow All SSH” # } … supermarket-cluster.tf
- 55. $ terraform apply Nothing happens! supermarket-cluster.tf
- 56. First, we need the provider
- 57. provider “aws” { access_key = “${var.access_key}” secret_key = “${var.secret_key}” region = “${var.region}” } #resource “aws_security_group” “allow-‐ssh” { # name = “${var.user_name}-‐allow-‐ssh” # tags = { # Name = “${var.user_name} Allow All SSH” # } … supermarket-cluster.tf
- 58. We also need actual AWS instances
- 59. Including both our Chef Server…
- 60. … #resource “aws_instance” “chef_server” { # ami = “${var.ami}” # instance_type = “${var.instance_type}” # key_name = “${var.key_name}” # tags { # Name = “dev-‐chef-‐server” # } # security_groups = [“${aws_security_group.allow-‐ssh.name}”, # “${aws_security_group.allow-‐out.name}”] # (…) #} … This is the Chef Server supermarket-cluster.tf
- 61. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”, “${aws_security_group.allow-‐out.name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 63. EC2 Chef Server $ terraform apply supermarket-cluster.tf
- 65. … #resource “aws_instance” “supermarket_server” { # ami = “${var.ami}” # instance_type = “${var.instance_type}” # key_name = “${var.key_name}” # tags { # Name = “dev-‐supermarket-‐server” # } # security_groups = [“${aws_security_group.allow-‐ssh.name}”, # “${aws_security_group.allow-‐out.name}”] # (…) #} … This is the Supermarket Server supermarket-cluster.tf
- 66. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”, “${aws_security_group.allow-‐out.name}”] (…) } … This is the Supermarket Server supermarket-cluster.tf
- 67. EC2 Chef Server $ terraform apply EC2 Supermarket supermarket-cluster.tf
- 68. We also need at least one security group
- 69. #resource “aws_security_group” “allow-‐ssh” { # name = “${var.user_name}-‐allow-‐ssh” # tags = { # Name = “${var.user_name} Allow all ssh” # } #} #resource “aws_security_group_rule” “allow-‐ssh” { # type = “ingress” # from_port = 22 # to_port = 22 … #} supermarket-cluster.tf
- 70. resource “aws_security_group” “allow-‐ssh” { name = “${var.user_name}-‐allow-‐ssh” tags = { Name = “${var.user_name} Allow all ssh” } } #resource “aws_security_group_rule” “allow-‐ssh” { # type = “ingress” # from_port = 22 # to_port = 22 … #} supermarket-cluster.tf
- 71. EC2 Chef Server supermarket-cluster.tf $ terraform apply EC2 Supermarket Security Group
- 72. kitchen-terraform needs to be able to ssh into our instances
- 73. We need a security group rule
- 74. resource “aws_security_group” “allow-‐ssh” { name = “${var.user_name}-‐allow-‐ssh” tags = { Name = “${var.user_name} Allow all ssh” } } #resource “aws_security_group_rule” “allow-‐ssh” { # type = “ingress” # from_port = 22 # to_port = 22 … #} supermarket-cluster.tf
- 75. resource “aws_security_group” “allow-‐ssh” { name = “${var.user_name}-‐allow-‐ssh” tags = { Name = “${var.user_name} Allow all ssh” } } resource “aws_security_group_rule” “allow-‐ssh” { type = “ingress” from_port = 22 to_port = 22 … } supermarket-cluster.tf
- 76. EC2 Chef Server $ terraform apply EC2 Supermarket Security Group Allow SSH supermarket-cluster.tf
- 77. Now, let’s create our test cluster
- 79. Like running terraform apply $ kitchen converge
- 80. $ kitchen converge (…) >>>>>> ------Exception------- >>>>>> Class: Kitchen::ActionFailed >>>>>> Message: 1 actions failed. >>>>>> Converge failed on instance <default-ubuntu>. >>>>>> Please see .kitchen/logs/kitchen.log for more details
- 81. -‐-‐-‐-‐ Begin output of terraform validate /root/supermarket-‐terraform-‐2 -‐-‐-‐-‐ STDOUT: STDERR: ^[[31mError validaWng: 2 error(s) occurred: * resource 'aws_instance.chef_server' config: unknown resource * 'aws_security_group.allow-‐egress' referenced in * variable aws_security_group.allow-‐egress.name * resource 'aws_instance.supermarket_server' config: * unknown resource 'aws_security_group.allow-‐egress' * referenced in variable aws_security_group.allow-‐egress. * name .kitchen/logs/default-ubuntu.log
- 82. We need our EC2 resources to reference only one security group
- 83. Let’s look at the Chef Server
- 84. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”, “${aws_security_group.allow-‐out.name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 85. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 86. And the Supermarket Server
- 87. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”, “${aws_security_group.allow-‐out.name}”] (…) } … This is the Supermarket Server supermarket-cluster.tf
- 88. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}” (…) } … This is the Supermarket Server supermarket-cluster.tf
- 89. $ kitchen converge$ kitchen converge
- 90. $ kitchen converge Apply complete! Resources: 2 added, 0 changed, 0 destroyed. (…) Finished converging <default-ubuntu> (0m7.10s).
- 91. EC2 Chef Server EC2 Supermarket Security Group Allow SSH supermarket-cluster.tf $ terraform apply
- 92. Now let’s write some tests
- 93. First, let’s define a test group
- 94. driver: name: terraform (…) verifier: name: terraform format: doc groups: -‐ name: default tests: -‐ security_groups hostnames: aws_hostnames username: ubuntu .kitchen.yml
- 95. driver: name: terraform (…) verifier: name: terraform format: doc groups: -‐ name: default tests: -‐ security_groups hostnames: aws_hostnames username: ubuntu .kitchen.yml
- 96. driver: name: terraform (…) verifier: name: terraform format: doc groups: -‐ name: default tests: -‐ security_groups hostnames: aws_hostnames username: ubuntu .kitchen.yml
- 97. driver: name: terraform (…) verifier: name: terraform format: doc groups: -‐ name: default tests: -‐ security_groups hostnames: aws_hostnames username: ubuntu .kitchen.yml
- 98. Output variable driver: name: terraform (…) verifier: name: terraform format: doc groups: -‐ name: default tests: -‐ security_groups hostnames: aws_hostnames username: ubuntu .kitchen.yml
- 99. We need to create that output variable
- 100. output “aws_hostnames” { } outputs.tf
- 101. output “aws_hostnames” { value = “${aws_instance.chef_server.public_dns}, ${aws_instance.supermarket_server.public_dns}” } outputs.tf
- 102. output “aws_hostnames” { value = “${aws_instance.chef_server.public_dns}, ${aws_instance.supermarket_server.public_dns}” } outputs.tf
- 103. Spins up AWS resources Using Outputs
- 104. Spins up AWS resources Captures public_dns of EC2 instances in aws_hostnames Using Outputs
- 105. Spins up AWS resources Passes to kitchen-terraform Captures public_dns of EC2 instances in aws_hostnames Using Outputs
- 106. Spins up AWS resources Captures public_dns of EC2 instances in aws_hostnames Passes to kitchen-terraform kitchen-terraform uses aws_hostnames to ssh into the instances Using Outputs
- 107. Spins up AWS resources Runs Tests kitchen-terraform uses aws_hostnames to ssh into the instances Captures public_dns of EC2 instances in aws_hostnames Passes to kitchen-terraform Using Outputs
- 108. $ kitchen destroy$ kitchen destroy
- 109. $ kitchen destroy $ kitchen converge $ kitchen destroy $ kitchen converge
- 110. #resource “aws_security_group” “allow-‐egress” { # name = “${var.user_name}-‐allow-‐egress” # tags = { # Name = “${var.user_name} Allow connecLons out” # } #} #resource “aws_security_group_rule” “allow-‐out” { # type = “egress” # from_port = 0 # to_port = 65535 # cidr_blocks = ["0.0.0.0/0"] … supermarket-cluster.tf
- 111. Let’s write a test
- 112. describe command(‘ping -‐c 1 google.com’) do end security_groups_spec.rb
- 113. describe command(‘ping -‐c 1 google.com’) do its(‘stdout’) { should match /1 packets transmiSed, 1 received/ } end security_groups_spec.rb
- 114. $ kitchen verify$ kitchen verify
- 115. $ kitchen verify Failure/Error: expected "PING google.com (216.58.218.238) 56(84) bytes of data.nn--- google.com ping statistics —n 1 packets transmitted, 0 received, to match /1 packets transmitted, 1 received/ Diff: @@ -1,2 +1,5 @@ -/1 packets transmitted, 1 received/
- 116. Good! We have a failure!
- 117. Now let’s make it pass
- 118. #resource “aws_security_group” “allow-‐egress” { # name = “${var.user_name}-‐allow-‐egress” # tags = { # Name = “${var.user_name} Allow connecLons out” # } #} #resource “aws_security_group_rule” “allow-‐out” { # type = “egress” # from_port = 0 # to_port = 65535 # cidr_blocks = ["0.0.0.0/0"] … supermarket-cluster.tf
- 119. resource “aws_security_group” “allow-‐egress” { name = “${var.user_name}-‐allow-‐egress” tags = { Name = “${var.user_name} Allow connecTons out” } } resource “aws_security_group_rule” “allow-‐out” { type = “egress” from_port = 0 to_port = 65535 cidr_blocks = ["0.0.0.0/0"] … supermarket-cluster.tf
- 120. EC2 Chef Server $ terraform apply EC2 Supermarket Security Group Allow SSH Security Group Allow Out supermarket-cluster.tf
- 121. Now let’s call this security group from our Chef Server
- 122. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 123. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”, “${aws_security_group.allow-‐out.name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 124. And the Supermarket Server
- 125. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}” (…) } … This is the Supermarket Server supermarket-cluster.tf
- 126. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”, “${aws_security_group.allow-‐out.name}”] (…) } … This is the Supermarket Server supermarket-cluster.tf
- 127. $ kitchen destroy $ kitchen converge $ kitchen destroy $ kitchen converge
- 128. $ kitchen destroy $ kitchen converge $ kitchen verify
- 129. $ kitchen verify$ kitchen verify$ kitchen verify Command ping -c 1 google.com stdout should match /1 packets transmitted, 1 received/ 1 example, 0 failures
- 130. It passes! Now let’s make a change
- 131. Let’s condense the two security groups into one security group
- 132. resource “aws_security_group” “allow-‐egress” { name = “${var.user_name}-‐allow-‐egress” tags = { Name = “${var.user_name} Allow connecWons out” } } resource “aws_security_group_rule” “allow-‐out” { type = “egress” from_port = 0 to_port = 65535 cidr_blocks = ["0.0.0.0/0"] … supermarket-cluster.tf
- 133. resource “aws_security_group_rule” “allow-‐out” { type = “egress” from_port = 0 to_port = 65535 cidr_blocks = ["0.0.0.0/0"] security_group_id “${aws_security_group.allow-‐egress.id}” } supermarket-cluster.tf
- 134. resource “aws_security_group_rule” “allow-‐out” { type = “egress” from_port = 0 to_port = 65535 cidr_blocks = ["0.0.0.0/0"] security_group_id “${aws_security_group.allow-‐ssh.id}” } supermarket-cluster.tf
- 135. Now our instances should only use the one security group
- 136. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”, “${aws_security_group.allow-‐out.name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 137. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 138. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”, “${aws_security_group.allow-‐out.name}”] (…) } … This is the Supermarket Server supermarket-cluster.tf
- 139. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”] (…) } … This is the Supermarket Server supermarket-cluster.tf
- 140. EC2 Chef Server $ terraform apply EC2 Supermarket Security Group Allow SSH Allow Out supermarket-cluster.tf
- 141. $ kitchen destroy $ kitchen converge
- 142. $ kitchen destroy $ kitchen converge $ kitchen verify
- 143. $ kitchen verify$ kitchen verify Command ping -c 1 google.com stdout should match /1 packets transmitted, 1 received/ 1 example, 0 failures
- 144. Now let’s improve the design
- 145. By moving the security group code into a module
- 146. Source: Terraform Docs Why Move into a Module? • Self-contained package
- 147. Source: Terraform Docs Why Move into a Module? • Self-contained package • Reusable component
- 148. • Self-contained package • Reusable component • Improve organization Source: Terraform Docs Why Move into a Module?
- 149. $ kitchen destroy
- 152. resource “aws_security_group” “allow-‐ssh” { name = “${var.user_name}-‐allow-‐ssh” tags = { Name = “${var.user_name} Allow All SSH” } resource “aws_security_group_rule” “allow-‐ssh” { type = “ingress” from_port = 22 to_port = 22 … } security-groups/main.tf
- 153. Now we need to connect to the module from main config
- 154. First, we need to know what variables the module needs passed to it
- 155. resource “aws_security_group” “allow-‐ssh” { name = “${var.user_name}-‐allow-‐ssh” tags = { Name = “${var.user_name} Allow All SSH” } resource “aws_security_group_rule” “allow-‐ssh” { type = “ingress” from_port = 22 … security_group_id = “${aws_security_group.allow-‐ssh.id}” } Needs to be passed to the module security-groups/main.tf
- 156. resource “aws_security_group” “allow-‐ssh” { name = “${var.user_name}-‐allow-‐ssh” tags = { Name = “${var.user_name} Allow All SSH” } resource “aws_security_group_rule” “allow-‐ssh” { type = “ingress” from_port = 22 … security_group_id = “${aws_security_group.allow-‐ssh.id}” } security-groups/main.tf Thank you, Nikhil Vaze!
- 157. resource “aws_security_group” “allow-‐ssh” { name = “${var.user_name}-‐allow-‐ssh” tags = { Name = “${var.user_name} Allow All SSH” } resource “aws_security_group_rule” “allow-‐ssh” { type = “ingress” from_port = 22 … security_group_id = “${aws_security_group.allow-‐ssh.id}” } Does not need to be passed in security-groups/main.tf
- 160. terraform.tfvars variables.tf supermarket- cluster.tf Defines values for variables Using the Module
- 161. terraform.tfvars variables.tf supermarket- cluster.tf security-groups module Defines variables used by module config variables.tf Using the Module
- 165. module “security-‐groups” { source = “./security-‐groups” user_name = “${var.user_name}” } supermarket-cluster.tf
- 166. module “security-‐groups” { source = “./security-‐groups” user_name = “${var.user_name}” } supermarket-cluster.tf
- 167. $ kitchen converge
- 168. $ kitchen converge -----> Starting Kitchen (v1.10.2) -----> Converging <default-ubuntu>… (…) >>>>>> ------Exception------- >>>>>> Class: Kitchen::ActionFailed Message: 1 actions failed. >>>>>> Converge failed on instance <default-ubuntu>. Please see .kitchen/logs/default-ubuntu.log for more details
- 169. $ kitchen converge -----> Starting Kitchen (v1.10.2) -----> Converging <default-ubuntu>… (…) >>>>>> ------Exception------- >>>>>> Class: Kitchen::ActionFailed Message: 1 actions failed. >>>>>> Converge failed on instance <default-ubuntu>. Please see .kitchen/logs/default-ubuntu.log for more details
- 170. -‐-‐-‐ Begin output of terraform validate (…) STDOUT: STDERR: Error validaWng: 2 error(s) occurred: * resource 'aws_instance.supermarket_server' config: * unknown resource 'aws_security_group.allow-‐ssh' * referenced in variable aws_security_group.allow-‐ssh.name * resource 'aws_instance.chef_server' config: * unknown resource 'aws_security_group.allow-‐ssh' * referenced in variable aws_security_group.allow-‐ssh.name .kitchen/logs/default-ubuntu.log
- 171. terraform.tfvars variables.tf supermarket- cluster.tf security-groups module variables.tf main.tf output.tf Passes output values to main config Workflow Into The Module
- 172. output “sg-‐name” { } security-groups/output.tf
- 173. output “sg-‐name” { value = “${aws_security_group.allow-‐ssh.name}” } security-groups/output.tf
- 174. Now, we need to use this output in our supermarket-cluster config
- 175. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${aws_security_group.allow-‐ssh.name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 176. … resource “aws_instance” “chef_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐chef-‐server” } security_groups = [“${module.security-‐groups.sg-‐name}”] (…) } … This is the Chef Server supermarket-cluster.tf
- 177. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${aws_security_group.allow-‐ssh-‐name}”] (…) } … This is the Supermarket Server supermarket-cluster.tf
- 178. … resource “aws_instance” “supermarket_server” { ami = “${var.ami}” instance_type = “${var.instance_type}” key_name = “${var.key_name}” tags { Name = “dev-‐supermarket-‐server” } security_groups = [“${module.security-‐groups.sg-‐name}”] (…) } … This is the Supermarket Server supermarket-cluster.tf
- 179. $ kitchen converge
- 180. $ kitchen converge $ kitchen verify
- 181. $ kitchen verify$ kitchen verify$ kitchen verify Command ping -c 1 google.com stdout should match /1 packets transmitted, 1 received/ 1 example, 0 failures
- 182. So we have improved our resource usage
- 183. And the code’s organization and design
- 184. With minimal risk
- 185. Infrastructure code must be maintained and refactored just like application code
- 186. Even more so because infrastructure code involves so many moving pieces
- 187. When refactoring, always cover with tests
- 188. And refactor one small piece at a time
- 189. Thank you
- 190. Who Am I? Nell Shamrell-Harrington • Software Engineer at Chef • @nellshamrell • nshamrell@chef.io
- 191. Who Am I? Any Questions? Nell Shamrell-Harrington • Software Engineer at Chef • @nellshamrell • nshamrell@chef.io