DDI Automation for Infrastructure as Code

Infrastructure as Code (IaC) is a modern approach to managing and provisioning computing infrastructure using machine-readable scripts and configuration files rather than manual processes. IaC enables rapid and consistent deployment, scaling, and management of infrastructure, driving greater IT agility and efficiency. As enterprises undergo digital transformation, IaC is essential to support complex, dynamic environments and multi-cloud strategies. This blog outlines how DDI (DNS DHCP IPAM) acting as a Network Automation Hub serves as a foundational element of IaC, propelling network teams towards accelerated multicloud transformation and increased agility by leveraging DDI automation.

Automated infrastructure as a starting point

It was a long time ago that we started automating the configuration of some elements of the network infrastructure. The networking devices were among the first to propose an external way of being configured, mainly through SNMP and CMIP/CMIS at a time when asynchronous connection through a passive terminal was the only way to talk with most machines. Immediately, some of us started to automate actions, perform supervision of the statuses, and configure parts of our networks. This movement is still going on, and it has intensified, methods of communicating with devices and equipment are still not universal, but more options are available, and virtualization has brought a lot of simplification and opportunity. 

The promise of Infrastructure as Code

What we call today Infrastructure as Code (IaC) encompasses both declarative and imperative approaches to managing infrastructure components. In a declarative approach, instructions specify the desired state of the network infrastructure, outlining the expected results without detailing the steps to achieve them. This method adheres to the idempotency principle, allowing the same code to be executed multiple times to either achieve or maintain a specific state. For example, if we declare that VLAN 1423 exists and supports the routed subnet 2a01:e0a:3bc:7240::/64, all components should be configured (or tested) so that if the VLAN does not exist, it is created; if the subnet does not exist in the IPAM, it is created and associated with the VLAN; and finally, the routing infrastructure is made aware of the IPv6 subnet, at least through the router interface directly connected to the VLAN. 

On the other hand, the imperative approach involves writing detailed instructions that specify exactly how to achieve the desired state, including all necessary steps and commands. This method can offer more control, but requires more detailed knowledge of the infrastructure components and their configurations.

Both approaches have their advantages, but the declarative approach is often preferred because it is simpler, less error-prone, and can work independently of specific equipment and solutions. This independence helps reduce vendor lock-in and simplifies operations, especially in multi-vendor and multi-solution environments. IaC is crucial for digital transformation, because it provides consistency, scalability, and efficiency in infrastructure management including data centers, public clouds, and edge cloud, thus supporting dynamic, complex environments and multicloud strategies.

Getting into the details of IaC 

For Infrastructure as Code (IaC) to work effectively in the real world, a comprehensive toolset is essential to bridge the gap between declarative instructions and the various infrastructure solutions available. These tools need to support a range of methods and APIs, such as REST, SNMP, YAML, and NETCONF, to interact with different infrastructure components. Ideally, these tools are integrated with a CI/CD pipeline system that allows them to trigger configuration changes described in a version control system (e.g., Git). The pipeline should also perform validation and authorization checks, and take the necessary actions immediately, on a schedule, or during an operational window.

Modern IaC tools such as Terraform, Ansible, Chef, Puppet, Morpheus, and Pulumi play a critical role in this ecosystem. Terraform provides a declarative approach to provisioning infrastructure across multiple vendors. Ansible uses a simpler syntax and is highly effective for configuration management and orchestration. Pulumi supports multiple programming languages, providing a unique way to define cloud infrastructure using familiar languages such as TypeScript, Python, and Go.

Successful IaC implementations provide several benefits, including improved efficiency through reduced deployment times and minimized human error, enhanced collaboration, improved consistency that reduces the risk of configuration drift, and better infrastructure scalability to meet ever-changing business needs. Key considerations for IaC implementation include robust version control, thorough testing, and ensuring security and compliance throughout the automation process.

How DDI Automation steers IaC

At the heart of such an ecosystem is the DDI (DNS, DHCP and IPAM) solution. Advanced IPAM solutions serve as repositories of IP information and can manage related objects such as VLANs, VRFs, devices, applications, identities, and associations between network ports and interfaces. This makes IPAM the ideal solution to rely on to feed a Network Source of Truth (NSoT) for network elements, storing valuable metadata such as location, usage, business unit, external relationships with other repositories, deployment status, dates… 

Combined with the use of a network object inventory such as Network Object Manager (NOM) to plan and model the network topology, organizations can automate aspects of device lifecycle management from provisioning to decommissioning of network resources end-to-end, and consistently and accurately reflect all changes in IPAM and NOM to reconcile desired and actual network states and better manage network changes. As open repositories, NOM and IPAM can be used to connect to and unify existing IT repositories and databases in a single NSoT. 

In addition, enriching DDI with built-in network discovery tools like Cloud Observer and NetChange IPLocator, data reconciliation, open APIs, SDKs, and plug-ins forms a Network Automation Hub (NAH) that provides a complete, accurate, and up-to-date view of network assets, pushes and pulls actionable data via APIs to feed other tools such as IaC, and automates workflows. As a central, high-quality repository, it ensures consistency and accuracy across diverse networks, enabling effective end-to-end automation and management of the infrastructure. 

The engine sitting between the descriptive infrastructure source and the infrastructure components should use the IPAM as its reference and repository of information. This integration considerably eases deployment, adheres to processes, and links the IaC process with the rest of the ecosystem managed through different methods.

On top of the repository feature inherent to the IPAM, full DDI automation adds value by automatically configuring core network services such as DNS and DHCP services. For example, when DDI automation manages the reverse DNS zone associated with a subnet, it simplifies code. When the DHCP scope is automatically created or destroyed based on the IP addressing plan, DDI automation further simplifies the code. In addition, because the DDI solution can integrate with many components in the IT ecosystem through events/webhooks and specific integration, the amount of code written by I&O teams is significantly reduced as an added benefit of DDI automation. For example, the creation of an IP subnet for a new site triggered by the SD-WAN solution can be automatically sent to the network security solution, which will set up the firewall rules and zoning conditions for that new network. All of this is streamlined with DDI automation.

Moving forward with an Infrastructure as Code initiative or project necessitates studying the connection to the existing DDI solution or taking the opportunity to establish an IPAM repository to fuel a Network Source of Truth. By connecting IPAM’s collected data or NSoT and the IaC engine, the I&O teams  can train themselves on coding and API usage, start utilizing advanced features like metadata, and benefit from a sandbox environment typically unavailable on the infrastructure itself. DDI automation of the IP addressing plan and additional information like VLANs and devices will play a fundamental role in deploying new code since most infrastructure components deal with IP parameters.

By leveraging EfficientIP’s Network Automation Hub (NAH) capabilities including DDI automation, organizations can ensure a seamless and efficient transition to an automated, IaC-driven infrastructure, ultimately enhancing agility and simplifying management across multicloud environments. EfficientIP offers a number of no-code and low-code integrations such as Terraform, Ansible, Morpheus Data and more as part of their ecosystem.