DEVNET-2340
Infrastructure as Code with
Terraform and Cisco ACI
Don’t call me a CLI junkie anymore!
Devarshi Shah, TME – INSBU
Nicolas Vermande, TME - INSBU
Objectives of this session
• Get an understanding of Terraform capabilities
• Understand how ACI can be managed with
Infrastructure-as-Code paradigms
• Use Terraform plans to manage ACI application
network configuration
What is Terraform?
Terraform is an Infrastructure Resources Manager
• Compose and combine infrastructure resources to build
and maintain a desired state
• Plan and execution are distinct actions
• Manages all resources through APIs
• Resources and data can be re-used within modules
• Terraform use core and plugins components for basic
functions and extensibility
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 5
How to install it?
• Go to www.terraform.io/download.html
• Pick you platform
• Unzip
• Move binary somewhere in your PATH
(e.g: /usr/local/bin)
• Run terraform commands
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 6
Terraform defines a high level syntax
• Resources are declared in TF file
• Syntax is HCL – HashiCorp Configuration Language
• Human understandable
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
Terraform Providers
• Providers abstract the API layer of resources providers
• New resources are available for Terraform to provision and manage
• AAA configuration is required as part of the provider definition in the TF file
• ACI supports user and X509 certificate based authentication
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 8
Arguments are used to compose Resources
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
Arguments are used to compose Resources
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 11
How to use variables?
Declare variables and set default values
variable "aci_private_key" {
default = "/home/nvermand/fabric1_admin.key"
}
variable "aci_cert_name" {
default = "admin_cert"
}
variable "provider_profile_dn" {
default = "uni/vmmp-VMware"
}
variables.tf variable "bd_subnet" {}
variable "gateway" {}
variable "vmm_domain_dn" {}
terraform.tfvars
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 12
How to use variables?
variables.tf
terraform.tfvars Specific values for tf file, overriding default values
vsphere_compute_cluster = "pod-03"
folder = "ACI/demos"
aci_vm1_name="aci-tf-test1"
aci_vm2_name="aci-tf-test2"
aci_vm1_address = "1.1.1.10"
aci_vm2_address = "1.1.1.11"
bd_subnet = "1.1.1.1/24"
gateway = "1.1.1.1"
vmm_domain_dn = "uni/vmmp-VMware/dom-ACI-nv-POD03-VDS01"
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 13
Data Sources vs Resources
Resources Data sources
• Managed by Terraform • Managed by Provider
• RW • RO
• Can be used for interpolation • Can be used for interpolation
• terraform apply and destroy modifies • terraform apply and destroy don’t alter
resources data sources lifecycle
• Displayed by terraform show and • Displayed by terraform show and
terraform state list terraform state list
resource "aci_tenant" "terraform_ten" { data "vsphere_datacenter" "dc" {
name = "terraform_ten" name = "${var.vsphere_datacenter}"
} }
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
Interpolation is used to combine Resources
aci_vrf.vrf1
• Interpolation indicates dependency
• Used to build Direct Acyclic Graph (DAG) of dependencies
• Determines the order of Terraform tasks
• References attributes from other resources
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 15
Terraform manages dependencies with DAG
• DAG – Direct Acyclic Graph is a directional tree without loop
• Walking through multiple graphs is handled in parallel
vSphere VM Tenant
ANP VRF
EPG BD
Subnet
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 19
Main command options
• Terraform plan
• Terraform apply
• Terraform show
• Terraform console
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 20
Terraform plan
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 21
Terraform apply
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 22
Terraform show
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 23
Terraform console
• REPL console (Read-eval-print-loop)
• Can leverage sdtin as input for inline usage
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 24
Anatomy of an ACI
Resource in Terraform
Infrastructure as Code with ACI
• ACI has a modeled representation of everything APIC knows
• ACI object model is a distributed MIT (Management Information Tree) structure, fully accessible
through REST API
• Every node is a managed object (MO) with class, attributes and a distinguished name (Dn)
API
Root
Policy
Universe
Fabric Hypervisors
Virtual
Tenants VLANs Network
Nodes
Applications
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 26
Terraform and ACI Resource Mapping
• Terraform identifies ACI objects with their Dn
• Terraform resource id is the absolute path of ACI object in the DMIT
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 27
ACI Provider Resources
Available Future Resource Data Source
aci_tenant
aci_vrf
aci_bridge_domain
aci_subnet
aci_application_profile
aci_application_epg
aci_contract
aci_contract_subject
aci_filter
aci_filter_entry
aci_vmm_domain
aci_l3_outside
aci_external_network_instance_profile
aci_rest
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 28
Connecting to ACI
• You can use user/password or certificate base authentication
• Certificates based authentication is recommended though
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 29
Manage Relation Source Objects
• ACI leverages objects to build relations to other nodes in different part of the tree
• These objects are represented as arguments under the target Terraform resource
• Example with EPG that can have relation to VMM domain ( fvRsDomAtt), Bridge-
Domain (fvBD) and Contract consumer/provider (vzBrCP)
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 30
How to install the ACI provider
Prerequisites
Go latest version
Terraform v0.11.7 onwards
Clone from github: https://github.com/ciscoecosystem/terraform-provider-aci.git
Checkout relation_test branch and build the provider binary file
$ cd terraform-provider-aci
$ git checkout relation_test
Switched to branch 'relation_test'
Your branch is up-to-date with 'origin/relation_test’.
$ make build
==> Checking that code complies with gofmt requirements...
go install
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 31
How to install the ACI provider
• Go to you $GOBIN or $GOPATH/bin path and copy the provider binary to Terraform 3rd party plugins directory
$ cp $GOBIN/terraform-provier-aci ~/.terraform/plugins/linux_amd64
• Create your terraform working directory and build you configuration (main.tf, terraform.tfvars and
variables.tf)
• Initialize your configuration, which will download required providers and also reference the 3 rd party plugins
directory
$ terraform init
...
Initializing provider plugins...
...
Terraform has been successfully initialized!
...
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 32
Let’s get some hands-on
Demo folder is available at
https://github.com/vfiftyfive/CLEUR19-Terraform.git
Note: ”git checkout no_module” tag for the first
part of the demo
What we’re going to do
• Create a Tenant in ACI
• Create VRF, BD, and attach BD to VRF
• Add subnet under BD
• Create an 2-Tier Application Profile with EPGs
and contracts
• Attach EPGs to BD
• Attach VMM Domain to EPG
• Deploy CentOS VMs and attach them to
corresponding EPGs
• Test connectivity
After your first Terraform
plan, you’ll probably want
to reuse some of your
work…
Terraform Modules are like Black Boxes
• Modules create reusable components
• Modules are Terraform configuration files within a folder (nothing more), but
variables are not usable in main TF file outside of the module stanza
• Modules only take inputs, return outputs and contain resources. From the outside,
they look like functions
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
Add Module to TF file
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 37
Create Module Outputs
• Modules outputs are variables that can be used for interpolation
modules/prod_app2/main.tf Main project TF file
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 38
Next steps for our Demo
• Create a module to deploy a standardized
application network profile
• Change main project TF file to include the
module
• Use module outputs to derive new port-group
• Deploy new application from module
• Move VMs to the new network
Note: “git checkout master” for this part of
the demo
Q&A
Cisco Webex Teams
Questions?
Use Cisco Webex Teams (formerly Cisco Spark)
to chat with the speaker after the session
How
1 Find this session in the Cisco Events Mobile App
2 Click “Join the Discussion”
3 Install Webex Teams or go directly to the team space
4 Enter messages/questions in the team space
cs.co/ciscolivebot#DEVNET-2340
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 41
Complete your online
session survey
• Please complete your Online Session
Survey after each session
• Complete 4 Session Surveys & the Overall
Conference Survey (available from
Thursday) to receive your Cisco Live T-
shirt
• All surveys can be completed via the Cisco
Events Mobile App or the Communication
Stations
Don’t forget: Cisco Live sessions will be available for viewing
on demand after the event at ciscolive.cisco.com
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 42
Continue Your Education
Demos in Meet the Related
Walk-in
the Cisco engineer sessions
self-paced
Showcase labs 1:1
meetings
DEVNET-2340 © 2019 Cisco and/or its affiliates. All rights reserved. Cisco Public 43
Thank you
