RETEX: Pitfalls and Traps with Terraform in the Enterprise
summary
Concrete failure modes and fixes for using Terraform at scale are described, including tfstate desynchronization caused by Azure Policy adding public IPs to storage accounts, cloud-triggered restores that replace disks and break state (so lifecycle ignore_changes is insufficient), and a Python script that detects new disks and runs terraform state rm/comment to resync state. The talk also covers engineering practices: modular AKS Terraform modules with enforced defaults, nightly integration tests that spin up real stacks, CI steps that consume terraform output JSON, and preferring kubectl/helm for application deployments rather than forcing Terraform to manage the dataplane.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 2:06Terraform tfstate problems
- 14:28Terraform modules and refactoring
- 22:22Terraform interoperability
- 25:58Control plane vs data plane
- 33:06SIDI chain and best practices
- 38:29Q&A
related talks
35mMisadventures with Terraform
05mWAT.tf
39mTerraform Practices to Enable Infrastructure Scaling
21mI Can’t Do This With Terraform, Now What?
30mTerraform Practices to Enable Infrastructure Scaling
29mInfinity and beyond: Scaling Terraform for the global enterprise
14mLightning Talk: 5 Security Tips for Terraform
08mLighting Talk: Lessons Learned from Writing Thousands of Lines of IaC