← Projects

Network-as-code OpenTofu providers

2025–2026 · Palo Alto Networks


The problem

Every product team needed corporate network resources (networks, firewall rules, load balancers) before it could ship, and the only way to get them was through an underdocumented internal API and a manual UI. Network provisioning was a bottleneck on every team’s path to production, and not just in my group.

What I built

Rather than accept that experience, I built OpenTofu/Terraform providers that absorb the rough edges of the underlying APIs and give teams one consistent, declarative way to manage their own networking, firewall, and load balancer changes. I ran them as a first-class internal product: regular releases, bug fixes, documentation, and support for anyone who adopted them.

Outcome

  • 12 product teams self-serve their network changes as code, reviewed and versioned like everything else.
  • Network provisioning stopped being a deployment bottleneck.
  • Teams outside my group adopted the providers, making network-as-code the emerging standard across engineering.

It was a familiar move for me: I’d done the same thing for the community years earlier with the terraform-aws-modules.