1 1 00:00:00,280 --> 00:00:02,610 Infrastructure as Code. 2 2 00:00:02,610 --> 00:00:04,360 In this lesson, we're going to talk about 3 3 00:00:04,360 --> 00:00:05,750 infrastructure as code, 4 4 00:00:05,750 --> 00:00:08,360 which is used for automation and orchestration. 5 5 00:00:08,360 --> 00:00:12,040 So let's talk about this IAC or infrastructure as code. 6 6 00:00:12,040 --> 00:00:14,300 Essentially infrastructure as code is the ability 7 7 00:00:14,300 --> 00:00:17,270 to manage and provision the infrastructure through code 8 8 00:00:17,270 --> 00:00:19,270 instead of through manual processes. 9 9 00:00:19,270 --> 00:00:22,000 The term infrastructure here is also rather generic. 10 10 00:00:22,000 --> 00:00:23,390 It can refer to virtual machines 11 11 00:00:23,390 --> 00:00:25,000 that contain servers or clients 12 12 00:00:25,000 --> 00:00:28,130 or virtual devices like switches, routers, firewalls, 13 13 00:00:28,130 --> 00:00:29,920 and other security appliances. 14 14 00:00:29,920 --> 00:00:31,920 To use infrastructure as code effectively, 15 15 00:00:31,920 --> 00:00:35,260 we need to also use scripted automation and orchestration. 16 16 00:00:35,260 --> 00:00:37,120 Now scripted automation and orchestration 17 17 00:00:37,120 --> 00:00:39,570 are used in cloud computing all of the time. 18 18 00:00:39,570 --> 00:00:42,200 This allows our development security and operations teams 19 19 00:00:42,200 --> 00:00:43,603 or the dev sec ops team 20 20 00:00:43,603 --> 00:00:46,390 to rapidly deploy things like a new router, switch 21 21 00:00:46,390 --> 00:00:47,900 or even an entire network, 22 22 00:00:47,900 --> 00:00:50,540 complete with servers and security devices. 23 23 00:00:50,540 --> 00:00:53,280 The best part of all of this is that it is less error prone, 24 24 00:00:53,280 --> 00:00:55,750 and it's a lot faster than having our network technicians 25 25 00:00:55,750 --> 00:00:58,810 or system administrators building out these things manually. 26 26 00:00:58,810 --> 00:01:01,490 The great thing here is that if we use scripted automation, 27 27 00:01:01,490 --> 00:01:03,080 we're relying on a computer script 28 28 00:01:03,080 --> 00:01:04,610 to do most of the hard work. 29 29 00:01:04,610 --> 00:01:06,220 And once you have a well-written script, 30 30 00:01:06,220 --> 00:01:07,980 it can be reused over and over again, 31 31 00:01:07,980 --> 00:01:09,720 and it will never make a mistake. 32 32 00:01:09,720 --> 00:01:10,950 So this allows us 33 33 00:01:10,950 --> 00:01:13,040 to get a lot of our deployments done faster 34 34 00:01:13,040 --> 00:01:15,180 and in a much more secure way. 35 35 00:01:15,180 --> 00:01:18,420 Now, when we're talking about infrastructure as code or IAC, 36 36 00:01:18,420 --> 00:01:20,520 it really comes down to three key areas 37 37 00:01:20,520 --> 00:01:22,070 when you're doing your implementation. 38 38 00:01:22,070 --> 00:01:25,260 This is scripting, security templates and policies. 39 39 00:01:25,260 --> 00:01:27,520 Now scripting will let you perform a series of actions 40 40 00:01:27,520 --> 00:01:29,250 in a particular order or sequence, 41 41 00:01:29,250 --> 00:01:31,410 and it can even include some basic logic 42 42 00:01:31,410 --> 00:01:32,930 to ensure the right things are being deployed 43 43 00:01:32,930 --> 00:01:34,740 based on the current conditions, 44 44 00:01:34,740 --> 00:01:36,150 security templates and policies 45 45 00:01:36,150 --> 00:01:37,230 are then going to be deployed, 46 46 00:01:37,230 --> 00:01:39,470 and these contain a series of configuration files 47 47 00:01:39,470 --> 00:01:40,830 that are applied to the different devices 48 48 00:01:40,830 --> 00:01:42,770 being deployed in your environment. 49 49 00:01:42,770 --> 00:01:44,270 These might include network settings, 50 50 00:01:44,270 --> 00:01:46,958 access control lists, group policies, or permissions. 51 51 00:01:46,958 --> 00:01:48,658 Now automation is great, 52 52 00:01:48,658 --> 00:01:50,970 but where infrastructure as code really excels 53 53 00:01:50,970 --> 00:01:52,754 is through the use of orchestration. 54 54 00:01:52,754 --> 00:01:55,797 Orchestration is the process of arranging or coordinating 55 55 00:01:55,797 --> 00:01:59,030 the installation and configuration of multiple systems. 56 56 00:01:59,030 --> 00:02:00,450 In most implementations, 57 57 00:02:00,450 --> 00:02:02,520 it really comes down to running the same task 58 58 00:02:02,520 --> 00:02:04,520 on a bunch of different servers or devices 59 59 00:02:04,520 --> 00:02:05,750 all at the same time, 60 60 00:02:05,750 --> 00:02:09,070 but not always on every single server or device. 61 61 00:02:09,070 --> 00:02:10,810 This is where machine learning and logic 62 62 00:02:10,810 --> 00:02:11,940 are going to come into play. 63 63 00:02:11,940 --> 00:02:13,750 If you're using some robust orchestration, 64 64 00:02:13,750 --> 00:02:15,550 that's been properly configured and tested, 65 65 00:02:15,550 --> 00:02:17,262 you can lower your overall IT costs, 66 66 00:02:17,262 --> 00:02:20,250 speed up your deployments and increase your security. 67 67 00:02:20,250 --> 00:02:23,870 So it really becomes a win-win-win for our organizations. 68 68 00:02:23,870 --> 00:02:25,760 Now, as an aspiring network technician, 69 69 00:02:25,760 --> 00:02:27,960 you might be worried that infrastructure as code 70 70 00:02:27,960 --> 00:02:29,550 might put you at a job someday, 71 71 00:02:29,550 --> 00:02:31,560 but really it's just being used to automate 72 72 00:02:31,560 --> 00:02:34,094 the most boring and tedious portions of your job. 73 73 00:02:34,094 --> 00:02:35,960 It is designed to ease your burden 74 74 00:02:35,960 --> 00:02:37,950 and allow you to focus on more higher level tasks 75 75 00:02:37,950 --> 00:02:39,210 instead of just installing 76 76 00:02:39,210 --> 00:02:41,170 a hundred more virtual switches or routers 77 77 00:02:41,170 --> 00:02:42,700 using some boring checklist. 78 78 00:02:42,700 --> 00:02:44,637 So don't worry, have no fear, 79 79 00:02:44,637 --> 00:02:46,330 there is nothing but goodness here 80 80 00:02:46,330 --> 00:02:48,290 when it comes to infrastructure as code. 81 81 00:02:48,290 --> 00:02:51,710 Also infrastructure as code is the basis of everything we do 82 82 00:02:51,710 --> 00:02:53,930 in horizontal scaling or scaling out 83 83 00:02:53,930 --> 00:02:55,330 within our cloud environments 84 84 00:02:55,330 --> 00:02:57,010 when we need to use elasticity. 85 85 00:02:57,010 --> 00:02:59,430 So it is really important to embrace it. 86 86 00:02:59,430 --> 00:03:01,700 Now, one of the things you have to be careful of though, 87 87 00:03:01,700 --> 00:03:03,646 is that when you're using infrastructure as code, 88 88 00:03:03,646 --> 00:03:06,062 people in your organization who believe they might have 89 89 00:03:06,062 --> 00:03:08,470 some kind of a special project, 90 90 00:03:08,470 --> 00:03:10,880 I like to call these the special snowflakes. 91 91 00:03:10,880 --> 00:03:12,820 Remember with infrastructure as code, 92 92 00:03:12,820 --> 00:03:14,680 we're trying to embrace standardization, 93 93 00:03:14,680 --> 00:03:16,040 templates and scripts. 94 94 00:03:16,040 --> 00:03:16,877 So when you have people 95 95 00:03:16,877 --> 00:03:18,663 who think they have a special snowflake, 96 96 00:03:18,663 --> 00:03:20,550 this can lead to trouble. 97 97 00:03:20,550 --> 00:03:23,080 After all, if they have a special snowflake project, 98 98 00:03:23,080 --> 00:03:24,670 they believe they have to be able to go 99 99 00:03:24,670 --> 00:03:26,230 and create their own infrastructure 100 100 00:03:26,230 --> 00:03:27,540 to support their project 101 101 00:03:27,540 --> 00:03:29,208 instead of relying on the standard infrastructure 102 102 00:03:29,208 --> 00:03:32,350 that you provide to everyone else through IAC. 103 103 00:03:32,350 --> 00:03:34,630 These people don't really care about your standardization 104 104 00:03:34,630 --> 00:03:36,098 and all of your scripting and all the efficiencies 105 105 00:03:36,098 --> 00:03:38,240 that you've already gained by embracing 106 106 00:03:38,240 --> 00:03:41,030 infrastructure as code using orchestration. 107 107 00:03:41,030 --> 00:03:44,160 Instead, they want to create something as a one-off system. 108 108 00:03:44,160 --> 00:03:45,390 And when that happens, 109 109 00:03:45,390 --> 00:03:47,190 you end up with this special snowflake 110 110 00:03:47,190 --> 00:03:49,790 and these special snowflake systems are any system 111 111 00:03:49,790 --> 00:03:52,000 that is different from the standard configuration template 112 112 00:03:52,000 --> 00:03:53,430 that's used within your organization's 113 113 00:03:53,430 --> 00:03:55,590 infrastructure as code architecture. 114 114 00:03:55,590 --> 00:03:57,607 Now, the problem with this is that it adds risk 115 115 00:03:57,607 --> 00:03:59,216 to your overall security posture. 116 116 00:03:59,216 --> 00:04:01,620 And it also adds a lot of configuration problems 117 117 00:04:01,620 --> 00:04:03,402 and long-term supportability problems for you 118 118 00:04:03,402 --> 00:04:05,580 because it's a one-off system. 119 119 00:04:05,580 --> 00:04:07,540 The lack of consistency that you're going to find 120 120 00:04:07,540 --> 00:04:09,100 in a special snowflake system 121 121 00:04:09,100 --> 00:04:11,670 is going to lead to a lot of issues for you down the road, 122 122 00:04:11,670 --> 00:04:13,240 especially in terms of security 123 123 00:04:13,240 --> 00:04:14,620 and your ability to support it 124 124 00:04:14,620 --> 00:04:16,290 after it's moved into production. 125 125 00:04:16,290 --> 00:04:18,160 This is because you have a one-off system 126 126 00:04:18,160 --> 00:04:19,870 and it is by definition unique, 127 127 00:04:19,870 --> 00:04:21,120 and it doesn't look or act like 128 128 00:04:21,120 --> 00:04:23,100 every other system that you support. 129 129 00:04:23,100 --> 00:04:24,250 Think about it this way. 130 130 00:04:24,250 --> 00:04:25,760 Pretend you're in a large environment, 131 131 00:04:25,760 --> 00:04:26,820 that's operating in the cloud 132 132 00:04:26,820 --> 00:04:29,530 and you have thousands upon thousands of virtual machines. 133 133 00:04:29,530 --> 00:04:31,310 Now, out of all those virtual machines, 134 134 00:04:31,310 --> 00:04:33,050 we have just one that's different. 135 135 00:04:33,050 --> 00:04:34,130 When somebody calls up and says 136 136 00:04:34,130 --> 00:04:35,620 something isn't working properly. 137 137 00:04:35,620 --> 00:04:36,690 Now you have to figure out, 138 138 00:04:36,690 --> 00:04:38,110 is it something with that special machine 139 139 00:04:38,110 --> 00:04:39,170 that's causing the problem, 140 140 00:04:39,170 --> 00:04:41,640 or is this a bigger problem across your entire cloud? 141 141 00:04:41,640 --> 00:04:43,810 This is now a really big support issue 142 142 00:04:43,810 --> 00:04:44,650 for you and your team 143 143 00:04:44,650 --> 00:04:46,400 and it can lead to a lot of security headaches 144 144 00:04:46,400 --> 00:04:47,700 in the long run. 145 145 00:04:47,700 --> 00:04:49,710 For this reason, I always want to eliminate 146 146 00:04:49,710 --> 00:04:50,990 these special snowflakes 147 147 00:04:50,990 --> 00:04:52,597 because we want everything to be consistent. 148 148 00:04:52,597 --> 00:04:54,240 By keeping things consistent 149 149 00:04:54,240 --> 00:04:56,490 and using carefully developed and tested scripts 150 150 00:04:56,490 --> 00:04:57,940 we can end up using orchestration 151 151 00:04:57,940 --> 00:04:59,963 extremely efficiently and securely, 152 152 00:04:59,963 --> 00:05:03,023 which maintains a good, solid baseline for our networks.