![\"Retail](\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png\")
<\/a><\/p>\n<\/p>\n
Infrastructure as Code (IaC) is a hot topic these days, and the IaC tool of choice is Terraform by HashiCorp. Terraform is a cloud provisioning product that provides infrastructure for any application. You can refer to a long list of providers for any target platform.\u00a0<\/span><\/p>\n Terraform\u2019s list of providers now includes Cisco Modeling Labs (CML) 2<\/strong>, so we can use Terraform to control virtual network infrastructure running on CML2.<\/span> Keep reading to learn how to get started with Terraform and CML, from the initial configuration through its advanced features.\u00a0<\/span><\/p>\n Terraform uses code to describe the desired state of the required infrastructure and track this state over the infrastructure\u2019s lifetime. This code is written in HashiCorp Configuration Language (HCL). If it changes, Terraform figures out all the differences (state changes) to update the infrastructure and help reach the new state. Eventually, when the infrastructure isn\u2019t needed anymore, Terraform can destroy it.<\/span>\u00a0<\/span><\/p>\n A Terraform provider offers resources (things that have state) and data sources (read-only data without state). <\/span><\/p>\n In CML2 terms, examples include:<\/span>\u00a0<\/span><\/p>\n NOTE: <\/span><\/b>Currently, only a few data sources are implemented.<\/span>\u00a0<\/span><\/p>\n To get started with Terraform and CML, you\u2019ll need the following:\u00a0<\/strong><\/p>\n First, we\u2019ll create a new directory and change it as follows:<\/span>\u00a0<\/span><\/p>\n All the configuration and state required by Terraform stays in this directory.<\/span>\u00a0<\/span><\/p>\n The code snippets presented need to go into a Terraform configuration file, typically a file called <\/span>main.tf<\/span>. However, configuration blocks can also be spread across multiple files, as Terraform will combine all files with the <\/span>.tf<\/strong> extension in the current working directory.<\/span>\u00a0<\/span><\/p>\n The following code block tells Terraform that we want to use the CML2 provider. It will download and install the latest available version from the registry at initialization. We add this to a new file called <\/span>main.tf<\/strong>:<\/span>\u00a0<\/span><\/p>\n With the provider defined, we can now initialize the environment. This will download the provider binary from the Hashicorp registry and install it on the local computer. It will also create various files and a directory that holds additional Terraform configuration and state.<\/span>\u00a0<\/span><\/p>\n The CML2 terraform provider needs credentials to access CML2. These credentials are configured as shown in the following example. Of course, <\/span>address<\/span>, <\/span>username<\/span> and <\/span>password<\/span> need to match the actual environment:<\/span>\u00a0<\/span><\/p>\n The <\/span>skip_verify<\/strong> is commented out in the example. You might want to uncomment it to work with the default certificate that is shipped with the product, which is signed by the Cisco CML CA. Consider <\/span>installing a trusted certificate chain on the controller<\/span>.<\/span>\u00a0<\/span><\/p>\n While the above works OK, it\u2019s not advisable to configure clear-text credentials in files that might end up in source code management (SCM). A better approach is to use environment variables, ideally in combination with some tooling like <\/span>direnv<\/span>. As a prerequisite, the variables need to be defined within the configuration:<\/span>\u00a0<\/span><\/p>\n NOTE: <\/span><\/b>Adding the \u201csensitive\u201d attribute ensures that this value is not printed in any output.<\/span>\u00a0<\/span><\/p>\n We now can create a <\/span>direnv<\/span> configuration to insert values from the environment into our provider configuration by creating a <\/span>.envrc<\/span> file. You can also achieve this by manually \u201csourcing\u201d this file using <\/span>source .envrc<\/span>. The benefit of <\/span>direnv<\/span> is that this automatically happens when changing into the directory.<\/span>\u00a0<\/span><\/p>\n This decouples the Terraform configuration files from the credentials\/dynamic values so that they can easily be added to SCM, like Git, without exposing sensitive values, such as passwords or addresses.<\/span>\u00a0<\/span><\/p>\n With the basic configuration done, we can now describe our CML2 lab infrastructure. We have two options:<\/span>\u00a0<\/span><\/p>\n This imports an existing CML2 lab YAML topology file as a Terraform <\/span>lifecycle<\/span> resource. This is the \u201cone-stop\u201d solution, defining all nodes, links and interfaces in one go. In addition, you can use Terraform templating to replace properties of the imported lab (see below).<\/span>\u00a0<\/span><\/p>\n Here\u2019s a simple <\/span>import-mode<\/span><\/i> example:<\/span>\u00a0<\/span><\/p>\n The file <\/span>topology.yaml<\/span> will be imported into CML2 and then started. We now need to \u201cplan\u201d the change:<\/span>\u00a0<\/span><\/p>\n Then apply it (<\/span>-auto-approve<\/span> is a short-cut and should be handled with care):<\/span>\u00a0<\/span><\/p>\nHow does Terraform work?<\/span><\/b>\u00a0<\/span><\/h2>\n
\n
Getting started<\/span><\/b> with Terraform and CML<\/span><\/h2>\n
Define and initialize a workspace<\/span><\/b>\u00a0<\/span><\/h2>\n
$ mkdir tftest<\/span>
\n$ cd tftest<\/span>\u00a0<\/span><\/pre>\nterraform {<\/span>
\n\u00a0 required_providers {<\/span>
\n\u00a0\u00a0\u00a0 cml2 = {<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 source\u00a0 = \"registry.terraform.io\/ciscodevnet\/cml2\"<\/span>
\n\u00a0\u00a0\u00a0 }<\/span>
\n\u00a0 }<\/span>
\n}<\/span>\u00a0<\/span><\/pre>\n$ terraform init<\/span>
\n
\nInitializing the backend...<\/span>
\n
\nInitializing provider plugins...<\/span>
\n- Finding latest version of ciscodevnet\/cml2...<\/span>
\n- Installing ciscodevnet\/cml2 v0.4.1...<\/span>
\n- Installed ciscodevnet\/cml2 v0.4.1 (self-signed, key ID A97E6292972408AB)<\/span>
\n
\nPartner and community providers are signed by their developers.<\/span>
\nIf you'd like to know more about provider signing, you can read about it here:<\/span>
\nhttps:\/\/www.terraform.io\/docs\/cli\/plugins\/signing.html<\/span>
\n
\nTerraform has created a lock file .terraform.lock.hcl to record the provider<\/span>
\nselections it made above. Include this file in your version control repository so that Terraform can guarantee to make the same selections by default when you run \"terraform init\" in the future.<\/span>
\n
\nTerraform has been successfully initialized!<\/span>
\n
\nYou may now begin working with Terraform. Try running \"terraform plan\" to see<\/span>
\nany changes that are required for your infrastructure. All Terraform commands<\/span>
\nshould now work.<\/span>
\n
\nIf you ever set or change modules or backend configuration for Terraform,<\/span>
\nrerun this command to reinitialize your working directory. If you forget, other commands will detect it and remind you to do so if necessary.<\/span>
\n$<\/span>\u00a0<\/span><\/pre>\nConfigure the provider<\/span><\/b>\u00a0<\/span><\/h2>\n
provider \"cml2\" {<\/span>
\n\u00a0 address\u00a0\u00a0\u00a0\u00a0 = \"https:\/\/cml-controller.cml.lab\"<\/span>
\n\u00a0 username\u00a0\u00a0\u00a0 = \"admin\"<\/span>
\n\u00a0 password\u00a0\u00a0\u00a0 = \"supersecret\"<\/span>
\n\u00a0 # skip_verify = true<\/span>
\n}<\/span>\u00a0<\/span><\/pre>\nvariable \"address\" {<\/span>
\n\u00a0 description = \"CML controller address\"<\/span>
\n\u00a0 type\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = string<\/span>
\n\u00a0 default\u00a0\u00a0\u00a0\u00a0 = \"https:\/\/cml-controller.cml.lab\"<\/span>
\n}<\/span>
\n
\nvariable \"username\" {<\/span>
\n\u00a0 description = \"cml2 username\"<\/span>
\n\u00a0 type\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = string<\/span>
\n\u00a0 default\u00a0\u00a0\u00a0\u00a0 = \"admin\"<\/span>
\n}<\/span>
\n
\nvariable \"password\" {<\/span>
\n\u00a0 description = \"cml2 password\"<\/span>
\n\u00a0 type\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = string<\/span>
\n\u00a0 sensitive\u00a0\u00a0 = true<\/span>
\n}<\/span>\u00a0<\/span><\/pre>\nTF_VAR_address=<\/span>\"https:\/\/cml-controller.cml.lab\"<\/span>
\nTF_VAR_username=<\/span>\"admin\"<\/span>
\nTF_VAR_password=<\/span>\"secret\"<\/span>
\n
\nexport <\/span>TF_VAR_username<\/span> TF_VAR_password<\/span> TF_VAR_address<\/span>\u00a0<\/span><\/pre>\nDefine the CML2 lab infrastructure<\/span><\/b>\u00a0<\/span><\/h2>\n
\n
\n
Import-mode<\/span><\/b>\u00a0<\/span><\/h3>\n
Import-mode example<\/i>\u00a0<\/strong><\/h4>\n
resource \"cml2_lifecycle\" \"this\" {<\/span>
\n\u00a0 topology = file(\"topology.yaml\")<\/span>
\n}<\/span>\u00a0<\/span><\/pre>\n$ terraform plan<\/span>
\n
\nTerraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:<\/span>
\n\u00a0 + create<\/span>
\n
\nTerraform will perform the following actions:<\/span>
\n
\n\u00a0 # cml2_lifecycle.this will be created<\/span>
\n\u00a0 + resource \"cml2_lifecycle\" \"this\" {<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 + booted\u00a0\u00a0 = (known after apply)<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 + id\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = (known after apply)<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 + lab_id\u00a0\u00a0 = (known after apply)<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 + nodes\u00a0\u00a0\u00a0 = {<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 } -> (known after apply)<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 + state\u00a0\u00a0\u00a0 = (known after apply)<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 + topology = (sensitive value)<\/span>
\n\u00a0\u00a0\u00a0 }<\/span>
\n
\nPlan: 1 to add, 0 to change, 0 to destroy.<\/span>
\n$<\/span>\u00a0<\/span><\/pre>\n$ terraform apply -auto-approve<\/span><\/pre>\nTerraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:<\/span>
\n\u00a0 + create<\/span><\/pre>\nTerraform will perform the following actions:<\/span>
\n
\n\u00a0 # cml2_lifecycle.this will be created<\/span>
\n\u00a0 + resource \"cml2_lifecycle\" \"this\" {<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 + booted\u00a0\u00a0 = (known after apply)<\/span>
\n\u00a0\u00a0\u00a0\u00a0\u00a0 + id\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = (known after apply)<\/span>
\n