An Epic Journey: Automating networks with Terraform#

Eduardo Pozo

• Why: A concrete, numbers-backed account of Terraform at datacenter scale — including where it hurts (provider bugs, plan times, state risks) — which is rare and directly useful for DC automation decisions.
• What: Using Terraform as the primary automation tool across oil, health, and enterprise projects, including migrating a large multi-site datacenter to fully automated deployment.
• How: The slides quantify the pain: a 500+ leaf, 4-location, 2000+ VLAN fabric; a full terraform plan against an empty APIC (Cisco ACI, ~5334 resources) took 45 minutes, cut to 19 minutes by moving data transformation (dedups via set(), key lookups, validation) out of Terraform into Python. Honest coverage of vendor provider reality: "vendors say yes yes, it just doesn't work," API bugs, 12+ month-old issues, no CRUD — and the mitigations (contribute, pressure the vendor, hybrid approach, fork the provider). Also state loss/locking, apply-can-destroy surprises driven by provider quality, and preferring pipelines straight to infrastructure over controller-mediated paths where possible.
• Where applicable: The specific numbers are ACI/APIC-specific, but the lessons (stateful tools at DC scale, controller API limits vs. parallelism, keeping computation out of your IaC layer) apply to any large fabric automation effort.