You have heard about how great infrastructure as code is. But your organization already has existing infrastructure which were created manually and are now active in production - growing to an unmanageable level. How do you manage them all now in code? This talk will cover how we at Samsung R&D Canada did exactly that with Terraform including the lessons we learned along the way.

1. Transforming
Production Infrastructure into Code
Importing Existing Cloud Resources with Hashicorp’s Terraform
Shih Oon Liong
Vancouver Hashicorp User Meetup Group
November 22nd 2017, Hootsuite HQ

2. Samsung R&D Canada
Agenda
• Before Infrastructure As Code
• Importing Infrastructure into Code
• Lessons Learned
• Benefits with Infrastructure as Code with Terraform
• Q&A

3. Samsung R&D Canada
Agenda
You can still use Terraform
on existing infrastructure

4. Samsung R&D Canada
Shih Oon Liong
Senior Operations Engineer
Technical Operations and Performance Engineering
Samsung Research & Development Canada
Previously: Hootsuite, Invoke, Syncapse, Nudge
@mechastorm
so@liong.ca
Who am I?

5. Samsung R&D Canada
• Samsung Research & Development Canada (SRCA)
What is Samsung R&D Canada?
• Part of the Global Research & Development
division within Samsung Electronics
• Manages the development and operations for
Samsung Cloud Service
• Works in conjunction with a global operations and
development team

6. Samsung R&D Canada
Disclaimer
Names have been
changed to protect the
innocent

7. Samsung R&D Canada
Before Infrastructure as Code

8. Samsung R&D Canada
 Infrastructure at “Teddy” (not a real name)
 Dedicated Amazon Web Service account per environment
 40 – 50 services in a period of 2 years
 ~10 development teams across 4 different time zones
 4 Operations teams globally – Korea, India, Canada & America, Poland
Before Infrastructure as Code

9. Samsung R&D Canada
 Teddy’s launch story
 Initial launch & set up in one country– all other countries replicate the
same setup
 Short deadlines – little time to reiterate
 Knowledge migration - on-premise hardware to cloud infrastructure
Before Infrastructure as Code

10. Samsung R&D Canada
 Managing infrastructure at Teddy
 Manual set up of every AWS Resource
 Documentation step-by-step on the settings and names to configure on
each resource
Before Infrastructure as Code

11. Samsung R&D Canada
 After 2 – 3 years of running
Before Infrastructure as Code
 Takes days to configure a service in a new environment
 Inconsistencies across environments. (Worked in Env B! Broke in Env A!)
 Long onboarding time for new teams
 A new AWS region required

12. Samsung R&D Canada
Importing Infrastructure into Code

13. Samsung R&D Canada
 Why Terraform?
 Infrastructure as Code (IaC)
 Repeatable / Idempotent
 Cloud-agnostic – same workflow regardless of provider
 Collaboration
Importing Infrastructure into Code

14. Samsung R&D Canada
 Short-term Objectives
 Import all AWS resources in production into code
 Re-deploy code into new AWS region and account
Transforming Infrastructure with Terraform
 Long-term Objectives
 Recreate other environments with same code
 Infrastructure as Code

15. Samsung R&D Canada
Lessons Learned - Alternative
 What did we use
 Alternative - Destroy and recreate

16. Samsung R&D Canada
 What did we use
Transforming Infrastructure with Terraform
 Terraform – terraform import
Get infrastructure into terraform statefile
 Terraforming
Get infrastructure into HCL
(Hashicorp Configuration Language)

17. Samsung R&D Canada
Terraform Import

18. Samsung R&D Canada
 terraform import
 import existing infrastructure. This allows you take resources you've
created by some other means and bring it under Terraform management
 Added in 0.7.x (2016 August)
 https://www.terraform.io/docs/import/index.html
Transforming Infrastructure with Terraform

19. Samsung R&D Canada
Transforming Infrastructure with Terraform
Importing a single resource
terraform import aws_instance.web i-123456789
Terraform Resource Type
Resource Custom Name
Resource Cloud ID

20. Samsung R&D Canada
 terraform import - Limitations
 Only imports into the Terraform Statefile
 Does not yet generate HCL code.
A future version of Terraform will support this later.
 Before import, requires to manually define a HCL resource configuration
block for the resource (can be overridden)
Transforming Infrastructure with Terraform

21. Samsung R&D Canada
Transforming Infrastructure with Terraform
terraform import
aws_instance.web
i-1234567
{
resources:
aws_instance.web: {
…
}
}
Define
aws_instance.web
Terraform Statefile
HOW?

22. Samsung R&D Canada
Terraforming

23. Samsung R&D Canada
 terraforming
 import AWS resources into Terraform HCL or Statefile code
 Requires Ruby 2.1 and Terraform 0.9.3 or higher
 By Daisuke Fujita (dtan4)
 https://github.com/dtan4/terraforming
Transforming Infrastructure with Terraform

24. Samsung R&D Canada
Transforming Infrastructure with Terraform
Importing ec2 instances
export AWS_REGION=us-west-2
terraforming ec2 –profile=myaccount | tee "ec2.tf"
As there is no region flag in the CLI,
we need to define the AWS region
The type of AWS resource to generate from
The AWS credential profile to authenticate with
terraforming only outputs to screen.
You need to do your own custom
output redirection

25. Samsung R&D Canada
 terraforming - limitations
 Generates HCL code for ALL resources of a type in a region
 No way to limit to a specific resource
 Regions that with 100s or resources – slow to generate. Limited by API
connection limit
Transforming Infrastructure with Terraform

26. Samsung R&D Canada
Transforming Infrastructure with Terraform
us-west-2 testing-123 service-gamma-01 service-gamma-02 kalka-01 rabbitmq-01
export AWS_REGION=us-west-2
terraforming ec2 –profile=myaccount | tee "ec2.tf"
ec2.tf
resource "aws_instance" ”testing-123-i-123456" {
...
}
resource "aws_instance" “service-gamma-01-i-1234” {
...
}
resource "aws_instance" “service-gamma-02-i-1235” {
...
}

27. Samsung R&D Canada
Import Workflow

28. Samsung R&D Canada
 terraform import
 Great for importing specific
resources into statefile
 Support for majority of
resources (AWS)
 terraform import limitations
 Does not generate HCL code
 Will only import to statefile
 terraforming
 Great for generating HCL
code from existing AWS
resources
 terraforming limitations
 imports everything to HCL or
statefile
Import Workflow – Tools

29. Samsung R&D Canada
 Break up each service into its own repository
 Shared resources in its own repository
(ie. common subnets, security groups)
 Terraform Remote State Storage for each repository, each environment
 Retrieving metadata from remote states
data.terraform_remote_state.abc
 Only import existing resources – do not change existing resources yet
 terraform plan = zero changes
Import Workflow – Conventions

30. Samsung R&D Canada
1. Map it
2. Pick a Service
3. Setup Repository
4. Import Resource into HCL
5. Import Resource into StateFile
6. Verify - Terraform Plan = Zero Changes
Import Workflow – Steps

31. Samsung R&D Canada
1. Map it
 Get a physical architecture diagram of the whole system
Import Workflow – Steps
Disclaimer: Not a real actual physical architecture diagram

32. Samsung R&D Canada
1. Map it
2. Pick a Service – Order to start with. Example
 Common Networking – VPC
 Common Security Groups
 Kafka Queueing Service
 Service A
Import Workflow – Steps
• Lowest dependency
• Will be reused alot

33. Samsung R&D Canada
2. Pick a Service
3. Setup Repository
 Set up Git Repo
 Set up remote state configurations
Import Workflow – Steps
vpc
common-sg
kafka-q
service-a
Terraform remote
state dependency

34. Samsung R&D Canada
3. Setup Repository
4. Import Resource into HCL
 Have a central repo for all terraforming outputs
 Pick a resource and copy/paste
Import Workflow – Steps

35. Samsung R&D Canada
4. Import Resource into HCL
Import Workflow – Steps
ec2.tf
resource "aws_instance" ”a-i-123456" {
...
tags {
Name = “service-a”
}
}
resource "aws_instance" “b-01-i-1234” {
...
}
resource "aws_instance" “b-02-i-1235” {
...
}
terraforming-output.gitservice-a.git
~: terraforming ec2 | tee ec2.tf
ec2.tf
resource "aws_instance" ”server" {
...
tags {
Name = “service-a”
}
}

36. Samsung R&D Canada
4. Import Resource into HCL
5. Import Resource into Terraform State file
 Run terraform import on the desired resource
Import Workflow – Steps

37. Samsung R&D Canada
5. Import Resource into Terraform State file
6. Verify - Run terraform plan
 Should report zero changes
 Any changes – manual configure the HCL resource until in-sync
Import Workflow – Steps

38. Samsung R&D Canada
 Took 3 – 4 weeks to import ~30 core services (1 - 2 persons)
 We were lucky
 Good Documentation
 Similar architecture for a majority of services
Result

39. Samsung R&D Canada
Lessons Learned

40. Samsung R&D Canada
1. Good documentation
2. Communicate / train early
3. Terraform import gotchas
Lessons Learned

41. Samsung R&D Canada
Lessons Learned – Good Documentation
 Detailed architecture diagram – always helps!
 A map to your services
 Helps to plan what service you want to import into code
 Maps out dependencies

42. Samsung R&D Canada
Lessons Learned – Communication / Training
 Communicate early - make everyone aware that how infrastructure
should be managed from now on
 Training early
 have everyone ready to use Terraform the moment code is imported
 new services can be started on Terraform immediately – stop the flow of
manual configured resources

43. Samsung R&D Canada
Lessons Learned – Communication / Training
 Importing existing infrastructure
 Great onboarding process for new engineers

44. Samsung R&D Canada
Lessons Learned – Terraform Import Gotcha’s
 Slow & Steady
 Run your imports resource by resource (especially for more unique
services)
 Import one resource
 Plan
 Repeat
 Automation???

45. Samsung R&D Canada
Lessons Learned – Terraform Import Gotcha’s
 terraforming ec2
 Will import EVERYTHING about an EC2 instance in HCL code including
optional properties (example: ebs_optimized, source_dest_check)
 Complicates when running terraform import after
 Simplify it (Your mileage may vary)
 Remove optional data from HCL code
(example: ebs_optimized, source_dest_check)
 Then run terraform import

46. Samsung R&D Canada
Lessons Learned – Terraform Import Gotcha’s
 terraform import aws_security_group
 Will import AWS security group with two types of rules
 Inline security group rules
 Individual security group stanzas (aws_security_group_rule)
 It is dependent on usage on which to keep
resource "aws_security_group" ”ssh” {
...
ingress {
from_port = 22
to_port = 22
...
}
egress {
...
}
}
resource "aws_security_group_rule" ”ssh-22” {
type = “ingress”
from_port = 22
to_port = 22
...
}
HCL representation (terraform import will actually import the JSON into tfstate)

47. Samsung R&D Canada
Lessons Learned – Terraform Import Gotcha’s
 Terraform State manipulation
 Remove a resource from tfstate
 terraform state rm aws_instance.web
 Rename a resource
 terraform state mv aws_instance.web aws_instance.server
 Move a resource to a module
 terraform state mv aws_instance.web
module.mymod.aws_instance.server

48. Samsung R&D Canada
Benefits of Infrastructure as Code with
Terraform

49. Samsung R&D Canada
 Visibility
 Consistency
 Collaboration
 Reusability
Benefits of IaC with Terraform

50. Samsung R&D Canada
 See the how a service infrastructure is defined in code
Benefits of IaC with Terraform
 Visibility

51. Samsung R&D Canada
 Notice inconsistencies with different
services and environments
Benefits of IaC with Terraform
 Consistency
 Maintain consistency across services
and environments (to a point)

52. Samsung R&D Canada
 Open up infrastructure architecture to developers
Benefits of IaC with Terraform
 Collaboration
 Working in pairs – reviewer and reviewee

53. Samsung R&D Canada
 Similar architectures can use a common module
Benefits of IaC with Terraform
 Reusability
 No hardcoded values for shared services
(ie. Kafka - Queueing)

54. Samsung R&D Canada
What we still need to do – Future with Terraform
 Onboarding more engineers
(different timezones)
 Centralized Terraform Workflow
 Terraform Enterprise
 Atlantis (https://atlantis.run)
 Security compliance

55. Samsung R&D Canada
Questions
Thank You!
We are hiring! Java, CloudOps, Big Data
http://ow.ly/2nlT30gqEPu

57. Samsung R&D Canada
Images
• https://pixabay.com/en/matrix-communication-software-pc-434037/
• https://www.flickr.com/photos/neospire/3595638492 (www.neospire.net)
• http://maxpixel.freegreatpicture.com/Equipments-Artisan-Indoors-Craftsman-Grinder-Adult-1866533
• https://pixabay.com/en/code-technology-monitor-computer-2588957/
• https://www.cinemablend.com/new/Tron-Legacy-Explained-Or-What-Newcomers-Need-Know-They-Go-22262.html
• https://pixabay.com/en/network-society-social-community-1020332/
• https://pixabay.com/en/boys-school-teacher-education-asia-1782427/
• https://pixabay.com/en/wall-bricks-pen-obstacle-worn-by-1724113/
• https://www.commonsensemedia.org/movie-reviews/dead-poets-society
• http://knowyourmeme.com/photos/897535-perfectly-looped-gifs
• https://hobbylink.tv/135-tachikoma-with-kusanagi-motoko-batou-by-kotobukiya-part-2-review