Introduction to Terraform for Cloud service provider (CSP) onboarding - Introductory concepts for working with Terraform to facilitate cloud onboarding. - Administrator Guide - Cortex CLOUD

These concepts explain the underlying logic of how Terraform interacts with your cloud environment.

Infrastructure as Code (IaC)

Infrastructure as Code allows you to manage your network and security settings through declarative configuration (text) files. Terraform reads these files and compares them to your actual cloud environment to determine which resources need to be created, updated, or deleted to match the template.

The Terraform state file (.tfstate)

The .tfstate state file is a local record that maps your template configuration to the real resources in your cloud. The state file acts as a database that maps your configuration to real-world resources.

Each time you execute a Terraform template (such as by using plan or apply commands), Terraform compares the state file with the actual cloud environment to ensure everything is in sync. If there are differences, Terraform attempts to sync between the template and the cloud. Any resources that differ from the template are synced to match the template definition.

It is critical that you follow the following rules:

Terraform does not have its own login; it uses the credentials for each cloud service provider. Before executing Terraform templates provided by Cortex Cloud, configure and authenticate using your cloud provider's Command Line Interface (CLI):

While Terraform has many features, the Cortex Cloud onboarding process typically only uses the following core commands.

The terraform init command

The terraform init command prepares Terraform for the actual actions it will perform, such as downloading any required modules and cloud provider plugins.

Command: terraform init

Run this command when:

The terraform apply command

The terraform apply command previews the changes and executes the template to create or update the cloud resources.

Command: terraform apply --var-file=template_params.tfvars [-auto-approve]

When running the command, you must pass the template parameter file as an argument. 

This command requests confirmation before making any changes. Type yes for the changes to be made. You can bypass the confirmation by passing -auto-approve to the apply command.

The first time this command is run, this command also creates the .tfstate state file. This file stores the state of the cloud resources at the time the command is executed.

The terraform destroy command

The terraform destroy command removes all resources created by the terraform apply command. This is the standard way to offboard the CSP.

Command: terraform destroy --var-file=template_params.tfvars [-auto-approve]

Run this command: 

When running the command, you must pass the template parameter file as an argument. 

This command requests confirmation before making any changes. Type yes for the changes to be made. You can bypass the confirmation by passing -auto-approve to the apply command.

The lifecycle of a Cortex Cloud resource involves the following primary workflows: 

Initial template onboarding

The onboarding process involves the initial translation of your cloud configuration into live cloud resources.

Upgrades

As Cortex releases new features or updates, or you have changes to your own cloud infrastructure, you must update the existing template. This workflow involves merging new configuration files into your existing local directory while strictly maintaining the original state file.

This "upgrade" scenario relies on the state file to identify what has changed. By reconfiguring the initialization and applying the new files, Terraform identifies the differences and modifies the existing resources rather than recreating them from scratch.

If you are onboarding using a browser-based terminal (like Azure Cloud Shell or GCP Cloud Shell) instead of locally, make sure to adhere to the following: