Two Teams, One Conflict

▶ Watch (04:33)

Platform teams and dev teams want the same things in a different order. Dev teams want infrastructure now. They have mocked-up UIs and design documents already signed off, with no appetite for waiting days for a Postgres server.

“the platform team, they want to go safe” — Brian McClain

Platform teams are watching the budget and enforcing security standards across the org. That mismatch produces a queue: developers open tickets, platform engineers work through them manually, and neither side moves as fast as it could.

No-Code Modules and Landing Zones

▶ Watch (07:24)

No-code modules package a Terraform module with all its metadata so a developer can click “provision workspace,” fill in a handful of values, and get running infrastructure. No Terraform configuration required.

Landing zones pair with this. The platform team pre-creates the HCP Terraform project, sets up team membership, and attaches a variable set with cloud credentials. Every workspace deployed into that project inherits those credentials automatically, so a developer never touches an AWS key.

Module Lifecycle: Deploy, Deprecate, Revoke

▶ Watch (24:01)

Shipping version 2.0 means more than tagging a GitHub release. In the no-code module provisioning demo (24:01), v2.0 adds an AWS provider upgrade from version 5 to 6, a title variable with 1-25 character validation, and a check block that hits the running app and fails the plan if it does not return 200.

Once v2.0 is active, v1.0 gets deprecated with a named end-of-support date and a remediation link. Users can still provision from it, but the UI makes the deadline visible. One click on “revoke module” removes the provision button for good.

Communicating at Scale with Workspace Explorer

▶ Watch (31:15)

Finding every workspace still on an old provider version is a single query in the workspace explorer provider query (31:58). Set the filter to “providers does not contain AWS v6,” and HCP Terraform returns every workspace that qualifies. Select them all, click “create change request,” write a markdown-formatted message with the upgrade deadline, and submit.

Two things happen at once: a badge appears on the workspace’s change request tab, and the team that owns that workspace gets an email. The platform team sent one message; every affected team received it directly, with no Slack broadcast or ticket needed.

Q&A

What caused the webhook failure during the live lab setup? An audience member identified the cause: GitHub enforces a limit of 20 webhooks per event type per repository, so the first 20 attendees worked fine but everyone after hit the cap. ▶ 39:29

Notable Quotes

the platform team, they want to go safe Brian McClain · ▶ 5:57

Got to love those live demos, right? Brian McClain · ▶ 27:29

running an old version of the provider. Brian McClain · ▶ 34:04

Key Takeaways

  • No-code modules let dev teams provision infrastructure by filling a form, with no Terraform knowledge required.
  • Landing zones pre-configure the project, team membership, and cloud credentials so developers start with a clean slate.
  • Workspace Explorer queries let platform teams find outdated workspaces and send change requests that trigger email notifications.