AI
Replacing a 350-Service Legacy Catalog
Air France-KLM’s old automation platform ran on OpenText Cloud Services with over 350 catalog entries covering IaaS, DNS, database services, and server restarts. Every offering had to be engineered and maintained by the automation team. Moving to a multi-cloud footprint across Google Cloud, Azure, and on-premise data centers made that model too slow.
Feedback sessions with other French companies pointed toward the same stack: Terraform, Ansible, and Vault. Terraform’s multi-cloud declarative model matched their infrastructure goals. Vault handled dynamic secret management in the hybrid environment.
Scale and Cost Results After the Migration
By automating start, stop, deploy, and destroy through infrastructure as code, Air France-KLM avoids tens of thousands in cloud costs every week. That figure comes from only two-thirds of product teams participating. The platform now manages 7,200 workspaces across 450 teams with 90 modules in a private registry.
Automating Terraform workspace creation alone cut errors and support requests by more than 70%. Typos, naming convention mismatches, and wrong team names disappeared. Policy-as-code guardrails enforce naming conventions automatically so developers can provision on any cloud provider without breaking compliance.
How Terraform Enterprise, Vault, and AAP Connect
Terraform Enterprise is the core engine. It manages the full infrastructure lifecycle, triggered either by a code push through GitHub Actions or by a service catalog request. Vault sits in the middle of every critical handoff: it issues short-lived tokens to the CI/CD pipeline, to Terraform Enterprise, and to Ansible Automation Platform, so no secrets are hard-coded anywhere in the chain.
Once Terraform finishes provisioning, Ansible Automation Platform takes over for post-installation tasks and application configuration, whether the target is GCP, Azure, VMware SDDC, or on-premise. Golomeov called the result “automation for automation.”
Dynamic Credentials Across the Full Deployment Chain
Each GitHub Actions workflow carries a JWT token stamped with the team name. Vault validates it against the Terraform secret engine, then issues a short-lived team token for terraform apply. He demonstrated the Vault-brokered Terraform deployment to Azure (13:18) live: Azure storage accounts created with no hard-coded credentials.
The same pattern extends to Ansible. Platform teams authenticate via AppRole, and Vault’s SSH client signer issues certificates valid for only a few minutes. Once the TTL expires, Vault rotates the password and writes it directly to the OpenLDAP directory server.
Notable Quotes
automation for automation. Developers Trajce Golomeov · ▶ 10:30
validity is set to few minutes maximum. Sébastien Bouvet · ▶ 18:00
Today we are focused on high value work. Trajce Golomeov · ▶ 14:22
Key Takeaways
- Automating Terraform workspace creation cut configuration errors and support requests by more than 70%.
- Vault issues short-lived JWT-authenticated tokens to GitHub Actions and AAP, eliminating all hard-coded secrets.
- 7,200 workspaces and 450 teams run under policy-as-code guardrails that enforce compliance without developer intervention.