Deploy the demo

Terraform stages the infrastructure behind the Canadian traffic path. This page explains its phases and protected inputs; API examples remain in the article and the complete graph is in Terraform source.

Artifacts and inputs

The source pins Terraform 1.16.3 and signed xcsh 15.0.3 with API 12.0.0, contract 7.0.0 and telemetry v2. Its provider release and API release provide immutable references. The verifier checks source identity, archive digest, signature and embedded API receipt; initialization preserves the committed lockfile.

The demonstration uses the existing Azure CLI login and shared subscription Marketplace acceptance. The Canada application namespace and registration token are separately owned; CE sites stay in system, and the reserved allocation stays in its platform namespace. The deployment manages its selector binding.

Private variable files, credentials, allocation identifiers, backend configuration, state and backups live outside the checkout. The local backend file contains the absolute state path; the directory uses mode 0700 and input files use 0600. Terraform’s state lock and the lifecycle’s exclusive lock serialize staging. Source provenance identifies the exact clean merged commit and repository f5-sales-demo/canada.

Staging phases

Bootstrap creates the owned Canadian infrastructure and registrations. The configured phase binds observed NIC MACs and approves those registrations. The deployed example has three CEs and its origin in Canada Central; Canada East is an allowed input rather than a deployed recovery region. Saved plans are reviewed for ownership and scope before application.

The public listener uses tenant-managed DNS, the reserved RE allocation, and the selected country policy. The internal listener carries CE BGP, primary-IP and ILB diagnostics independently. Origin ingress uses infrastructure-source ACLs, separate from the public country policy. Configuration map locates each object in the source.

Implementation commands

With CANADA_PRIVATE set to the protected input directory, the existing staging workflow verifies artifacts and initializes the independent backend:

python3 scripts/verify-showcase-provider.py --private-root "$CANADA_PRIVATE/provider"
terraform -chdir=terraform init -input=false -lockfile=readonly -reconfigure \
  -backend-config="$CANADA_PRIVATE/backend.hcl"

The lifecycle build mode applies the two phases, waits for registration, and collects routing, traffic, recovery and zero-change checks. It changes owned demonstration infrastructure according to the reviewed inputs.

python3 scripts/lifecycle.py --mode build \
  --tfvars "$CANADA_PRIVATE/canada.tfvars" \
  --backend-config "$CANADA_PRIVATE/backend.hcl" \
  --private-root "$CANADA_PRIVATE/build-receipts"

The internal Site Console uses its separate ILB frontend and approved private client path. TCP reachability and valid console login are different observations; the lifecycle’s routing check skips console login. Bastion is optional. The source keeps origin SSH disabled. Verification tools and resource cleanup describe the associated evidence and ownership.