Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Terraform交通整備 〜大事故を防ぐために〜
Search
coconala_engineer
December 10, 2023
0
76
Terraform交通整備 〜大事故を防ぐために〜
2023/12/05 Next Year Con for SRE の資料です
https://timeedev.connpass.com/event/302385/
coconala_engineer
December 10, 2023
Tweet
Share
More Decks by coconala_engineer
See All by coconala_engineer
事業会社におけるセキュリティ・ ITガバナンス強化への道のり
coconala_engineer
0
10
徹底解説!Insight SQL Testingを活用したデータベース移行の実践ポイント
coconala_engineer
0
110
人材・モチベーション・情報システムの融合とエンゲージメント
coconala_engineer
0
83
Macインスタンスを活用したアプリE2Eテストの実現
coconala_engineer
1
310
スケーラビリティの課題解決に向けたココナラのデータベース移行戦略
coconala_engineer
1
570
IPO準備企業必見!ココナラから学ぶ上場前後でのセキュリティ改革プロセス
coconala_engineer
0
140
IaC運用を続けて出会うイシューたち
coconala_engineer
0
110
CDN+αの利活用でサイトの高速化を実現してみた
coconala_engineer
0
170
SIEMを用いて、セキュリティログ分析の可視化と分析を実現し、PDCAサイクルを回してみた
coconala_engineer
0
570
Featured
See All Featured
Stop Working from a Prison Cell
hatefulcrawdad
266
20k
Debugging Ruby Performance
tmm1
71
11k
Gamification - CAS2011
davidbonilla
78
4.9k
Design by the Numbers
sachag
277
18k
Designing with Data
zakiwarfel
96
5k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
325
21k
Documentation Writing (for coders)
carmenintech
63
4.2k
A better future with KSS
kneath
231
17k
The Invisible Side of Design
smashingmag
294
50k
Principles of Awesome APIs and How to Build Them.
keavy
124
16k
Why You Should Never Use an ORM
jnunemaker
PRO
51
8.9k
Infographics Made Easy
chrislema
238
18k
Transcript
Copyright coconala Inc. All Rights Reserved. Terraformަ௨උ ʙେࣄނΛ͙ͨΊʹʙ γεςϜϓϥοτϑΥʔϜ෦ ΠϯϑϥɾSREνʔϜ
TeamManager ٢ݟ
Copyright coconala Inc. All Rights Reserved. 2 ࣗݾհ ٢ݟʢΑ͔͠Θ ͨ͘Έʣ
• ੜ·Ε ੩Ԭ → จܥେֶ͔ΒΤϯδχΞ • ܦྺ ۚ༥SIer → ελʔτΞοϓ → ίίφϥ • झຯ ϥΠϒɾΠϕϯτʹߦ͘
Vision Ϗδϣϯɺϛογϣϯʹج͍ͮͨࣄۀΛల։ νʔϜ͕ߏங͍ͨ͠ͱࢥ ͏࠷ྑͳະདྷͷΠϝʔδ νʔϜ͕ߏங͍ͨ͠ͱࢥ ͏࠷ྑͳະདྷͷΠϝʔδ Mission νʔϜ͕࣮ݱ͍ͨ͠த৺ తͳతʢଘࡏҙٛʣ ҰਓͻͱΓ͕ʮࣗͷετʔϦʔʯΛੜ͖͍ͯ͘ੈͷதΛ࡞Δ
ݸਓͷࣝɾεΩϧɾܦݧΛՄࢹԽ͠ɺ ඞཁͱ͢Δͯ͢ͷਓʹ݁ͼ͚ͭɺ ݸਓΛΤϯύϫʔϝϯτ͢ΔϓϥοτϑΥʔϜΛఏڙ͢Δ ࣝɾεΩϧɾܦݧͷϚονϯάαʔϏεΛల։ ࣄۀ༰ 3
ࣄɾൿॻɺܦཧɺਓࣄɺCSɺϚʔέςΟϯάɺσβΠϯɾ੍࡞ͳͲ ͷਓखෆΛղফ اۀ๊͕͑Δ༷ʑͳܦӦ՝Λɺ ܦݧݟͷ๛ͳϓϩਓࡐΛ׆༻͢Δ͜ͱͰղܾ ඞཁͳ͚ͩ࣌ؒ՝ۚͰ Ϗδωεߦͯ͘͠Ε͑ΔਓΛհ ϋΠΫϥεͷۀҕୗ ίϯαϧλϯτΛհ ઐελοϑΛ௨ͯ͡ɺݫબͨ͠ඇެ։ͷ໊࣮τοϓΫϦΤΠλʔ ϩΰಈըɺϗʔϜϖʔδͳͲͷσβΠϯɾ੍࡞ܥͷδϟϯϧ
Λఏڙ͠ΫϦΤʔλʔෆΛղফ ίίφϥ͕ܖओମͱͳΓ ϋΠΫϥε໊࣮ΫϦΤΠλʔΛհ ๏Q&AΛແྉͰӾཡɾߘͰ͖ɺ4,000໊Ҏ্ͷหޢ࢜Λ ɾҬผͰݕࡧɾ͍߹Θ͕ͤՄೳʢࠂܝࡌ՝ۚϞσϧʣ ITਓࡐͷۀҕୗ ΤʔδΣϯτ หޢ࢜ͱϢʔβʔͷ ϚονϯάαʔϏε ECܕͷαʔϏε ϚʔέοτϓϨΠε ϚονϯάαʔϏε ֓ཁ 4 Ϗδωεతͷߪೖʹ ಛԽͨ͠αʔϏε ITϑϦʔϥϯεͱاۀΛϚονϯάɻεΩϧϚʔέοτɾ ςοΫΤʔδΣϯτ྆ํͰͷධՁσʔλΛ࿈ܞɾ׆༻༧ఆ
Copyright coconala Inc. All Rights Reserved. 5 ͖͔͚ͬ
Copyright coconala Inc. All Rights Reserved. 6 6ͷࢥ͍͕ίʔυʹڽॖ͞Ε͍ͯͨ ɾ࣮ͨ࣌͠୲ऀόϥόϥ →
ͦͷͨΊ͓ͷ͓ͷͷࢥ͏ߏ͕ݱࡏ·Ͱͬͨ ɾ໋໊༳Ε͕ଟ͍ → module/awsͳͷ͔aws/moduleͳͷ͔ ɾmoduleͱͯ͠࡞͍ͯ͠Δ͕தresource͕1ͭ͋Δ͚ͩͱ͍͏͜ͱ ͕··͋Δ → moduleͷ༗༻ੑ͕Θ͔Βͣʹ࣮͞Ε͍ͯΔ ɾಉ͡ίʔυ͕module֎ʹهड़͞Ε͍ͯͯɺmoduleͷςΠΛͳ͍ͯ͠ͳ ͔ͬͨ → ෆཁͳίʔυ͕ٯʹࠞཚΛট͍ͨ
Copyright coconala Inc. All Rights Reserved. 7 applyͰαʔϏεμϯͤͯ͞͠·ͬͨ • मਖ਼ϛεͰλʔήοτάϧʔϓ͕֎ΕΔࠩΛݟམͱͨ͠
• deleteʹහײ͕ͩͬͨɺchangeͩͬͨͷ͕᠘ ~ resource "aws_autoscaling_group" "api_production" { + force_delete_warm_pool = false id = "api-prod" ~ launch_configuration = "api-prod_v1" -> "api-prod_v2" name = "api-prod" ~ target_group_arns = [ - "arn:aws:elasticloadbalancing:ap-northeast-1:XXX:targetgroup/api/v2” ]
Copyright coconala Inc. All Rights Reserved. 8 ੳͱֶͼ • ͻͱͭͷPRͰෳͷରॲΛͨ͠
◦ ϦϑΝΫλ + terraformόʔδϣϯΞοϓ + ຊདྷͷมߋ ◦ ຊདྷ͋Δ͖planͷ͕ࠩݟ͑ͮΒ͘ͳͬͨ • ίʔυ͕ݹ͗ͯ͢ϦϑΝΫλͤ͟ΔΛಘͳ͔ͬͨ • terraformόʔδϣϯ͕దʹཧͰ͖͍ͯͳ͔ͬͨ • োޙʹݪҼ͕ຊ࡞ۀͰ͋Δ͜ͱΛ͑Δ·Ͱʹ࣌ؒΛཁͨ͠ ◦ ୭͕͍ͭͬͨͷ͔ه͞Εͳ͍
Copyright coconala Inc. All Rights Reserved. 9 ରࡦ • ίʔυͷෛ࠴Λղফ
• దͳόʔδϣϯཧ • plan / applyͷΈڧԽ • ӡ༻໘Ͱͷվળ
Copyright coconala Inc. All Rights Reserved. 10 ίʔυෛ࠴ղফ
Copyright coconala Inc. All Rights Reserved. 11 ίʔυͷෛ࠴Λղফ ɾεςʔτϑΝΠϧΛͲͷΑ͏ʹ͚Δ͔Λ ߟ͑Δ
ɾαʔϏε / module ϨϕϧͰಉ༷ͷߏΛ ͱΔΑ͏ʹ͢Δ ɾਖ਼ղͳ͘ɺߏมߋΛߟ͑Δ ɾ৽ن࡞͔Βద༻͠ɺաڈͷͷਵ࣌ Ҡߦ͍ͯ͘͠
Copyright coconala Inc. All Rights Reserved. 12 ίʔυͷෛ࠴Λղফ ɾαʔϏε͝ͱʹཧϦϙδτϦɾAWSΞΧϯτΛ ͍ͯ͠Δ
ɾ৽αʔϏεΛཱͯΔͱ͖ʹVPCRDSͳͲɺಉ͡Α͏ ͳͷͷίʔυΛϓϦηοτͱ͍ͯ͠Δؾ͕ͨ͠ → ڞ௨moduleʹҠಈ ɾ·ͣ৽ཱͯ͘͠ΔαʔϏεΛڞ௨module ɾطଘαʔϏεΛimportͰҠ২ ɾmoduleΧϯϖΩͰ͋Δඞཁͳ͍
Copyright coconala Inc. All Rights Reserved. 13 దͳόʔδϣϯཧ
Copyright coconala Inc. All Rights Reserved. 14 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯ͝ͱʹ͖͢ػೳվળ͓ΑͼҰ෦deprecation͕ߦΘΕ͍ͯΔ •
null_resourceͷඪ४Խʢ1.4ʣ • importϒϩοΫಋೖʢ1.5ʣ • testίϚϯυരʢ1.6ʣ
Copyright coconala Inc. All Rights Reserved. 15 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯ͝ͱʹ͖͢ػೳվળ͓ΑͼҰ෦deprecation͕ߦΘΕ͍ͯΔ •
null_resourceͷඪ४Խʢ1.4ʣ • importϒϩοΫಋೖʢ1.5ʣ • testίϚϯυരʢ1.6ʣ → ࠷ݶEOLରԠɺՄೳͰ͋Ε࠷৽൛͕·͍͠
Copyright coconala Inc. All Rights Reserved. 16 దʹόʔδϣϯΞοϓΛ͔͚Δ ϓϩόΠμਵ࣌ߋ৽͞Ε͍ͯΔʢؾ͍ͮͨΒ৽͘͠ͳ͍ͬͯΔϨϕϧʣ •
hashicorp/aws ◦ 2ϲ݄Ͱ14όʔδϣϯϦϦʔε͍ͯ͠Δʢ5.18.0 → 5.28.0ʣ • hashicorp/google ◦ 2ϲ݄Ͱ10όʔδϣϯϦϦʔε͍ͯ͠Δʢ4.83.0 → 5.7.0ʣ
Copyright coconala Inc. All Rights Reserved. 17 దʹόʔδϣϯΞοϓΛ͔͚Δ ϓϩόΠμਵ࣌ߋ৽͞Ε͍ͯΔʢؾ͍ͮͨΒ৽͘͠ͳ͍ͬͯΔϨϕϧʣ •
hashicorp/aws ◦ 2ϲ݄Ͱ14όʔδϣϯϦϦʔε͍ͯ͠Δʢ5.18.0 → 5.28.0ʣ • hashicorp/google ◦ 2ϲ݄Ͱ10όʔδϣϯϦϦʔε͍ͯ͠Δʢ4.83.0 → 5.7.0ʣ → terraformͷόʔδϣϯͱ࿈ಈ͍ͯ͠Δͱߟ͑ɺ͋Θͤͯ͋͛Δ → όά͕ࠞೖ͞ΕΔ͜ͱ͕͋ΔͨΊύονόʔδϣϯ্͕͕ͬͨΒૣ͋ͯ͘Δඞཁ͋Γ
Copyright coconala Inc. All Rights Reserved. 18 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯΞοϓπʔϧҎԼ͕ީิ •
dependabot • tfupdate • renovate • ࣗલͷεΫϦϓτ
Copyright coconala Inc. All Rights Reserved. 19 దʹόʔδϣϯΞοϓΛ͔͚Δ ͦΕͧΕʹྑ͠ѱ͠ •
dependabot ◦ GithubΛར༻͍ͯ͠ΕͬͱؾܰʹಋೖՄೳ ◦ PR͕େྔʹͰ͖ΔՄೳੑ͋Γ • tfupdate ◦ terraformͱϓϩόΠμͱผʑʹ্͛Δ͜ͱ͕Մೳ ◦ recursiveʹมߋͰ͖Δ • renovate ◦ tfenvΛར༻͍ͯ͠Δέʔεͷʮ.terraform-versionʯߋ৽ର ◦ ʮ.terraform.lock.hclʯΑ͠ͳʹߋ৽
Copyright coconala Inc. All Rights Reserved. 20 దʹόʔδϣϯΞοϓΛ͔͚Δ ͦͷ΄͔ͷߟྀϙΠϯτ •
࣮ߦස ◦ ߏมߋ͕ͲΕ͘Β͍ೖΔ͔ʹΑͬͯΑ͍ͱߟ͑Δ ◦ ίίφϥͰि࣍Ͱ·Θ͍ͯ͠Δ • PRΛ࡞͢Δͷπʔϧʹ͓ͤɺͨͩͦ͠ΕʹΑΔมߋ֬ೝ͢Δඞཁ͋Γ ◦ ࣍અҎ߱Ͱݴٴ
Copyright coconala Inc. All Rights Reserved. 21 plan / applyͷΈڧԽ
Copyright coconala Inc. All Rights Reserved. 22 ਓͷखΛۃྗհࡏͤ͞ͳ͍ & ద༻͕ʹݟ͑ΔΑ͏ʹ͢Δ
• ݱࡏͷӡ༻ ◦ PRΛ࡞ → ࠩνΣοΫ͠plan݁ՌΛίϝϯτ·Ͱࣗಈ ◦ applyखಈͰ͋ΓɺmainϚʔδͱͷ߹ੑ͕͍͋͠
Copyright coconala Inc. All Rights Reserved. 23 ਓͷखΛۃྗհࡏͤ͞ͳ͍ & ద༻͕ʹݟ͑ΔΑ͏ʹ͢Δ
• ͜Μͳ࢟ʹ͠Α͏ͱ͍ͯ͠Δ ※ ઈࢍਐߦத ◦ merge / push͞Ε͕ͨ࠷ޙɺ apply͞ΕΔͪΐͬͱා͍ ◦ plan͕ҙຯΛͳ͢Α͏ʹ͢Δ ◦ ͍ͭมԽ͕ద༻͞Ε͔ͨɺ ◦ ୭͕ঝೝͨ͠ͷ͔Λه͢Δ
Copyright coconala Inc. All Rights Reserved. 24 ӡ༻໘Ͱͷվળ
Copyright coconala Inc. All Rights Reserved. 25 Τϥʔൃੜ֬ΛԼ͛Δ ਓͷʹΑΔΤϥʔͷ֬ΛԼ͛ΔΑ͏ͳϙϦγʔΛఆΊΔ •
ҰͷplanมߋྔΛԼ͛Δ ◦ ಛੑͷҟͳΔมߋผʑͷPRΛͨͯΔ ◦ ͍ͭͰʹͳʹ͔Λ͍Εͳ͍ • ϨϏϡʔڧԽ ◦ Ͳ͏ͯ͠ଟ͘ͳΔͱ͖ηϧϑϨϏϡʔඞਢͱ͢Δ ▪ ࣮ଶͱͯ͠ͷมߋΛਤࣔ͢ΔɺηϧϑϨϏϡʔίϝϯτΛ͢ͳͲ ◦ ϨϏϡΞʔʮQuestionʯΛ͔͚͛Δ ▪ ॳาతͳ͜ͱͰͳΜͰ͍͍ ▪ Ή͠ΖԿؾͳ͍͜ͱ͕ҙ֎ͱॏେͳ͜ͱͩͬͨ͜ͱ͋Δ → ͲΜͳʹؤுͬͯ100%ͷ୲อͱஅݴग़དྷͳ͍
Copyright coconala Inc. All Rights Reserved. 26 ςετͷݕ౼ ͍ΘΏΔςετπʔϧͰ͋ΔTerratestෆ࠾༻ •
ಈతςετͰ͋Γɺͱ͘ʹ୲อ͍ͨ͠ϙΠϯτʹޮ͔ͳ͍ ◦ applyͨ͠Βࣄނ͕ى͖ͨͷͰɺͦͷલʹݕ͍ͨ͠ͱ͍͏ಈػ͕ڧ͍ ▪ ࣄલʹݕͳΒvalidationͳͲ΄͔ͷํ๏͕·͞Δ ◦ ςετίʔυΛॻͨ͘ΊͷͦΕͳΓ ▪ ͦΕʹݟ߹͏୲อ͕Ͱ͖ͳ͍ → จ௨ΓʹͰ͖ͨ͜ͱΛ୲อ͢Δ ΑΓ ΨʔυϨʔϧ͕֑͔͋ͬͯΒམͪͳ͍ ঢ়گΛ࡞Γ͍ͨ
Copyright coconala Inc. All Rights Reserved. 27 ςετͷݕ౼ ΨʔυϨʔϧͷྫ •
preconditionΛهࡌ • Open Policy AgentͷΈࠐΈ ※ઈࢍਐߦத ◦ ҰྫɿLBʹඥͮ͘λʔήοτάϧʔϓ͕θϩNG ◦ Terraform CloudΛಋೖ͍ͯ͠ΕɺCloudͷػೳͷҰͰΈࠐΈՄೳ ◦ ίίφϥTerraform CloudΛಋೖ͍ͯ͠ͳ͍ͨΊɺGithubActionsͷϑϩʔʹΈࠐΈ ༧ఆ • Sentinel ◦ Terraform Cloudݶఆ • terraform-compliance ◦ BDDͰهࡌ → ͜ΕΒΛCIʹΈࠐΜͰະવʹࣄނΛ͙
Copyright coconala Inc. All Rights Reserved. 28 ·ͱΊ • ίʔυͷෛ࠴Λղফ
◦ γεςϜͷม༰ͱڞʹϕετͳߏߟ͑͢ • దͳόʔδϣϯཧ ◦ GA࠷৽൛Λར༻͢Δͷ͕ͨΓલʹ • plan / applyͷΈڧԽ ◦ ਓҝతͳϛεͷՄೳੑΛՄೳͳݶΓഉআ • ӡ༻໘Ͱͷվળ ◦ ӡ༻໘ʹϙϦγʔΛ ◦ ώτͷೖΕସ͑ͳͲͰܧଓతʹߦ͏ඞཁ͕͋Δ
ίίφϥ ΤϯδχΞͷX(Twitter) X /Twitterʢ@coconala_engʣ https://twitter.com/coconala_eng We are hiring!! ࠾༻ϗʔϜϖʔδ https://coconala.co.jp/recruit
ΤϯδχΞ࠾༻ϗʔϜϖʔδ https://coconala.co.jp/recruit/engineer ίίφϥͷਓͱ৫Λ͑Δϒϩά ίίφϥLIVE https://blog.coconala.co.jp/m/m4e4abe8b17e5 ਓੜͷՄೳੑΛ͛ͨϢʔβʔετʔϦʔ Θͨ͠ͷεΩϧղ์ه https://blog.coconala.co.jp/m/me8a586112ad2 ίίφϥʹॴଐ͢ΔΤϯδχΞʹΑΔϒϩά ςοΫϒϩά https://zenn.dev/coconala 29