Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Terraform交通整備 〜大事故を防ぐために〜
Search
coconala_engineer
December 10, 2023
0
190
Terraform交通整備 〜大事故を防ぐために〜
2023/12/05 Next Year Con for SRE の資料です
https://timeedev.connpass.com/event/302385/
coconala_engineer
December 10, 2023
Tweet
Share
More Decks by coconala_engineer
See All by coconala_engineer
SREの次のキャリアの道しるべ 〜SREがマネジメントレイヤーに挑戦して、 気づいたこととTips〜
coconala_engineer
1
3.8k
ココナラiOSチームの生成AI利用
coconala_engineer
0
27
AIと向き合う若手エンジニアの責任
coconala_engineer
0
30
GraphQLを活用したリアーキテクチャに対応するSLI/Oの再設計
coconala_engineer
0
300
一番気が重いと言われたポストモーテム委員会の改革
coconala_engineer
0
300
SREの視点で考えるSIEM活用術 〜AWS環境でのセキュリティ強化〜
coconala_engineer
1
380
(みんなやっているはずなのに情報が少ない)DNSレコード管理の改善
coconala_engineer
0
120
クラウド時代のDDoS対策:可用性を守るためのベストプラクティス
coconala_engineer
0
100
「エンジニアマネージャー」の役割を担っている / 担ってみたい方へのキャリアパスガイド
coconala_engineer
1
290
Featured
See All Featured
[RailsConf 2023 Opening Keynote] The Magic of Rails
eileencodes
29
9.6k
A Tale of Four Properties
chriscoyier
160
23k
Balancing Empowerment & Direction
lara
1
450
GitHub's CSS Performance
jonrohan
1031
460k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
PRO
181
54k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
161
15k
Building Adaptive Systems
keathley
43
2.7k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
45
7.5k
The Cost Of JavaScript in 2023
addyosmani
51
8.5k
Done Done
chrislema
184
16k
Designing for humans not robots
tammielis
253
25k
Optimising Largest Contentful Paint
csswizardry
37
3.3k
Transcript
Copyright coconala Inc. All Rights Reserved. Terraformަ௨උ ʙେࣄނΛ͙ͨΊʹʙ γεςϜϓϥοτϑΥʔϜ෦ ΠϯϑϥɾSREνʔϜ
TeamManager ٢ݟ
Copyright coconala Inc. All Rights Reserved. 2 ࣗݾհ ٢ݟʢΑ͔͠Θ ͨ͘Έʣ
• ੜ·Ε ੩Ԭ → จܥେֶ͔ΒΤϯδχΞ • ܦྺ ۚ༥SIer → ελʔτΞοϓ → ίίφϥ • झຯ ϥΠϒɾΠϕϯτʹߦ͘
Vision Ϗδϣϯɺϛογϣϯʹج͍ͮͨࣄۀΛల։ νʔϜ͕ߏங͍ͨ͠ͱࢥ ͏࠷ྑͳະདྷͷΠϝʔδ νʔϜ͕ߏங͍ͨ͠ͱࢥ ͏࠷ྑͳະདྷͷΠϝʔδ Mission νʔϜ͕࣮ݱ͍ͨ͠த৺ తͳతʢଘࡏҙٛʣ ҰਓͻͱΓ͕ʮࣗͷετʔϦʔʯΛੜ͖͍ͯ͘ੈͷதΛ࡞Δ
ݸਓͷࣝɾεΩϧɾܦݧΛՄࢹԽ͠ɺ ඞཁͱ͢Δͯ͢ͷਓʹ݁ͼ͚ͭɺ ݸਓΛΤϯύϫʔϝϯτ͢ΔϓϥοτϑΥʔϜΛఏڙ͢Δ ࣝɾεΩϧɾܦݧͷϚονϯάαʔϏεΛల։ ࣄۀ༰ 3
ࣄɾൿॻɺܦཧɺਓࣄɺCSɺϚʔέςΟϯάɺσβΠϯɾ੍࡞ͳͲ ͷਓखෆΛղফ اۀ๊͕͑Δ༷ʑͳܦӦ՝Λɺ ܦݧݟͷ๛ͳϓϩਓࡐΛ׆༻͢Δ͜ͱͰղܾ ඞཁͳ͚ͩ࣌ؒ՝ۚͰ Ϗδωεߦͯ͘͠Ε͑ΔਓΛհ ϋΠΫϥεͷۀҕୗ ίϯαϧλϯτΛհ ઐελοϑΛ௨ͯ͡ɺݫબͨ͠ඇެ։ͷ໊࣮τοϓΫϦΤΠλʔ ϩΰಈըɺϗʔϜϖʔδͳͲͷσβΠϯɾ੍࡞ܥͷδϟϯϧ
Λఏڙ͠ΫϦΤʔλʔෆΛղফ ίίφϥ͕ܖओମͱͳΓ ϋΠΫϥε໊࣮ΫϦΤΠλʔΛհ ๏Q&AΛແྉͰӾཡɾߘͰ͖ɺ4,000໊Ҏ্ͷหޢ࢜Λ ɾҬผͰݕࡧɾ͍߹Θ͕ͤՄೳʢࠂܝࡌ՝ۚϞσϧʣ ITਓࡐͷۀҕୗ ΤʔδΣϯτ หޢ࢜ͱϢʔβʔͷ ϚονϯάαʔϏε ECܕͷαʔϏε ϚʔέοτϓϨΠε ϚονϯάαʔϏε ֓ཁ 4 Ϗδωεతͷߪೖʹ ಛԽͨ͠αʔϏε ITϑϦʔϥϯεͱاۀΛϚονϯάɻεΩϧϚʔέοτɾ ςοΫΤʔδΣϯτ྆ํͰͷධՁσʔλΛ࿈ܞɾ׆༻༧ఆ
Copyright coconala Inc. All Rights Reserved. 5 ͖͔͚ͬ
Copyright coconala Inc. All Rights Reserved. 6 6ͷࢥ͍͕ίʔυʹڽॖ͞Ε͍ͯͨ ɾ࣮ͨ࣌͠୲ऀόϥόϥ →
ͦͷͨΊ͓ͷ͓ͷͷࢥ͏ߏ͕ݱࡏ·Ͱͬͨ ɾ໋໊༳Ε͕ଟ͍ → module/awsͳͷ͔aws/moduleͳͷ͔ ɾmoduleͱͯ͠࡞͍ͯ͠Δ͕தresource͕1ͭ͋Δ͚ͩͱ͍͏͜ͱ ͕··͋Δ → moduleͷ༗༻ੑ͕Θ͔Βͣʹ࣮͞Ε͍ͯΔ ɾಉ͡ίʔυ͕module֎ʹهड़͞Ε͍ͯͯɺmoduleͷςΠΛͳ͍ͯ͠ͳ ͔ͬͨ → ෆཁͳίʔυ͕ٯʹࠞཚΛট͍ͨ
Copyright coconala Inc. All Rights Reserved. 7 applyͰαʔϏεμϯͤͯ͞͠·ͬͨ • मਖ਼ϛεͰλʔήοτάϧʔϓ͕֎ΕΔࠩΛݟམͱͨ͠
• deleteʹහײ͕ͩͬͨɺchangeͩͬͨͷ͕᠘ ~ resource "aws_autoscaling_group" "api_production" { + force_delete_warm_pool = false id = "api-prod" ~ launch_configuration = "api-prod_v1" -> "api-prod_v2" name = "api-prod" ~ target_group_arns = [ - "arn:aws:elasticloadbalancing:ap-northeast-1:XXX:targetgroup/api/v2” ]
Copyright coconala Inc. All Rights Reserved. 8 ੳͱֶͼ • ͻͱͭͷPRͰෳͷରॲΛͨ͠
◦ ϦϑΝΫλ + terraformόʔδϣϯΞοϓ + ຊདྷͷมߋ ◦ ຊདྷ͋Δ͖planͷ͕ࠩݟ͑ͮΒ͘ͳͬͨ • ίʔυ͕ݹ͗ͯ͢ϦϑΝΫλͤ͟ΔΛಘͳ͔ͬͨ • terraformόʔδϣϯ͕దʹཧͰ͖͍ͯͳ͔ͬͨ • োޙʹݪҼ͕ຊ࡞ۀͰ͋Δ͜ͱΛ͑Δ·Ͱʹ࣌ؒΛཁͨ͠ ◦ ୭͕͍ͭͬͨͷ͔ه͞Εͳ͍
Copyright coconala Inc. All Rights Reserved. 9 ରࡦ • ίʔυͷෛ࠴Λղফ
• దͳόʔδϣϯཧ • plan / applyͷΈڧԽ • ӡ༻໘Ͱͷվળ
Copyright coconala Inc. All Rights Reserved. 10 ίʔυෛ࠴ղফ
Copyright coconala Inc. All Rights Reserved. 11 ίʔυͷෛ࠴Λղফ ɾεςʔτϑΝΠϧΛͲͷΑ͏ʹ͚Δ͔Λ ߟ͑Δ
ɾαʔϏε / module ϨϕϧͰಉ༷ͷߏΛ ͱΔΑ͏ʹ͢Δ ɾਖ਼ղͳ͘ɺߏมߋΛߟ͑Δ ɾ৽ن࡞͔Βద༻͠ɺաڈͷͷਵ࣌ Ҡߦ͍ͯ͘͠
Copyright coconala Inc. All Rights Reserved. 12 ίʔυͷෛ࠴Λղফ ɾαʔϏε͝ͱʹཧϦϙδτϦɾAWSΞΧϯτΛ ͍ͯ͠Δ
ɾ৽αʔϏεΛཱͯΔͱ͖ʹVPCRDSͳͲɺಉ͡Α͏ ͳͷͷίʔυΛϓϦηοτͱ͍ͯ͠Δؾ͕ͨ͠ → ڞ௨moduleʹҠಈ ɾ·ͣ৽ཱͯ͘͠ΔαʔϏεΛڞ௨module ɾطଘαʔϏεΛimportͰҠ২ ɾmoduleΧϯϖΩͰ͋Δඞཁͳ͍
Copyright coconala Inc. All Rights Reserved. 13 దͳόʔδϣϯཧ
Copyright coconala Inc. All Rights Reserved. 14 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯ͝ͱʹ͖͢ػೳվળ͓ΑͼҰ෦deprecation͕ߦΘΕ͍ͯΔ •
null_resourceͷඪ४Խʢ1.4ʣ • importϒϩοΫಋೖʢ1.5ʣ • testίϚϯυരʢ1.6ʣ
Copyright coconala Inc. All Rights Reserved. 15 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯ͝ͱʹ͖͢ػೳվળ͓ΑͼҰ෦deprecation͕ߦΘΕ͍ͯΔ •
null_resourceͷඪ४Խʢ1.4ʣ • importϒϩοΫಋೖʢ1.5ʣ • testίϚϯυരʢ1.6ʣ → ࠷ݶEOLରԠɺՄೳͰ͋Ε࠷৽൛͕·͍͠
Copyright coconala Inc. All Rights Reserved. 16 దʹόʔδϣϯΞοϓΛ͔͚Δ ϓϩόΠμਵ࣌ߋ৽͞Ε͍ͯΔʢؾ͍ͮͨΒ৽͘͠ͳ͍ͬͯΔϨϕϧʣ •
hashicorp/aws ◦ 2ϲ݄Ͱ14όʔδϣϯϦϦʔε͍ͯ͠Δʢ5.18.0 → 5.28.0ʣ • hashicorp/google ◦ 2ϲ݄Ͱ10όʔδϣϯϦϦʔε͍ͯ͠Δʢ4.83.0 → 5.7.0ʣ
Copyright coconala Inc. All Rights Reserved. 17 దʹόʔδϣϯΞοϓΛ͔͚Δ ϓϩόΠμਵ࣌ߋ৽͞Ε͍ͯΔʢؾ͍ͮͨΒ৽͘͠ͳ͍ͬͯΔϨϕϧʣ •
hashicorp/aws ◦ 2ϲ݄Ͱ14όʔδϣϯϦϦʔε͍ͯ͠Δʢ5.18.0 → 5.28.0ʣ • hashicorp/google ◦ 2ϲ݄Ͱ10όʔδϣϯϦϦʔε͍ͯ͠Δʢ4.83.0 → 5.7.0ʣ → terraformͷόʔδϣϯͱ࿈ಈ͍ͯ͠Δͱߟ͑ɺ͋Θͤͯ͋͛Δ → όά͕ࠞೖ͞ΕΔ͜ͱ͕͋ΔͨΊύονόʔδϣϯ্͕͕ͬͨΒૣ͋ͯ͘Δඞཁ͋Γ
Copyright coconala Inc. All Rights Reserved. 18 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯΞοϓπʔϧҎԼ͕ީิ •
dependabot • tfupdate • renovate • ࣗલͷεΫϦϓτ
Copyright coconala Inc. All Rights Reserved. 19 దʹόʔδϣϯΞοϓΛ͔͚Δ ͦΕͧΕʹྑ͠ѱ͠ •
dependabot ◦ GithubΛར༻͍ͯ͠ΕͬͱؾܰʹಋೖՄೳ ◦ PR͕େྔʹͰ͖ΔՄೳੑ͋Γ • tfupdate ◦ terraformͱϓϩόΠμͱผʑʹ্͛Δ͜ͱ͕Մೳ ◦ recursiveʹมߋͰ͖Δ • renovate ◦ tfenvΛར༻͍ͯ͠Δέʔεͷʮ.terraform-versionʯߋ৽ର ◦ ʮ.terraform.lock.hclʯΑ͠ͳʹߋ৽
Copyright coconala Inc. All Rights Reserved. 20 దʹόʔδϣϯΞοϓΛ͔͚Δ ͦͷ΄͔ͷߟྀϙΠϯτ •
࣮ߦස ◦ ߏมߋ͕ͲΕ͘Β͍ೖΔ͔ʹΑͬͯΑ͍ͱߟ͑Δ ◦ ίίφϥͰि࣍Ͱ·Θ͍ͯ͠Δ • PRΛ࡞͢Δͷπʔϧʹ͓ͤɺͨͩͦ͠ΕʹΑΔมߋ֬ೝ͢Δඞཁ͋Γ ◦ ࣍અҎ߱Ͱݴٴ
Copyright coconala Inc. All Rights Reserved. 21 plan / applyͷΈڧԽ
Copyright coconala Inc. All Rights Reserved. 22 ਓͷखΛۃྗհࡏͤ͞ͳ͍ & ద༻͕ʹݟ͑ΔΑ͏ʹ͢Δ
• ݱࡏͷӡ༻ ◦ PRΛ࡞ → ࠩνΣοΫ͠plan݁ՌΛίϝϯτ·Ͱࣗಈ ◦ applyखಈͰ͋ΓɺmainϚʔδͱͷ߹ੑ͕͍͋͠
Copyright coconala Inc. All Rights Reserved. 23 ਓͷखΛۃྗհࡏͤ͞ͳ͍ & ద༻͕ʹݟ͑ΔΑ͏ʹ͢Δ
• ͜Μͳ࢟ʹ͠Α͏ͱ͍ͯ͠Δ ※ ઈࢍਐߦத ◦ merge / push͞Ε͕ͨ࠷ޙɺ apply͞ΕΔͪΐͬͱා͍ ◦ plan͕ҙຯΛͳ͢Α͏ʹ͢Δ ◦ ͍ͭมԽ͕ద༻͞Ε͔ͨɺ ◦ ୭͕ঝೝͨ͠ͷ͔Λه͢Δ
Copyright coconala Inc. All Rights Reserved. 24 ӡ༻໘Ͱͷվળ
Copyright coconala Inc. All Rights Reserved. 25 Τϥʔൃੜ֬ΛԼ͛Δ ਓͷʹΑΔΤϥʔͷ֬ΛԼ͛ΔΑ͏ͳϙϦγʔΛఆΊΔ •
ҰͷplanมߋྔΛԼ͛Δ ◦ ಛੑͷҟͳΔมߋผʑͷPRΛͨͯΔ ◦ ͍ͭͰʹͳʹ͔Λ͍Εͳ͍ • ϨϏϡʔڧԽ ◦ Ͳ͏ͯ͠ଟ͘ͳΔͱ͖ηϧϑϨϏϡʔඞਢͱ͢Δ ▪ ࣮ଶͱͯ͠ͷมߋΛਤࣔ͢ΔɺηϧϑϨϏϡʔίϝϯτΛ͢ͳͲ ◦ ϨϏϡΞʔʮQuestionʯΛ͔͚͛Δ ▪ ॳาతͳ͜ͱͰͳΜͰ͍͍ ▪ Ή͠ΖԿؾͳ͍͜ͱ͕ҙ֎ͱॏେͳ͜ͱͩͬͨ͜ͱ͋Δ → ͲΜͳʹؤுͬͯ100%ͷ୲อͱஅݴग़དྷͳ͍
Copyright coconala Inc. All Rights Reserved. 26 ςετͷݕ౼ ͍ΘΏΔςετπʔϧͰ͋ΔTerratestෆ࠾༻ •
ಈతςετͰ͋Γɺͱ͘ʹ୲อ͍ͨ͠ϙΠϯτʹޮ͔ͳ͍ ◦ applyͨ͠Βࣄނ͕ى͖ͨͷͰɺͦͷલʹݕ͍ͨ͠ͱ͍͏ಈػ͕ڧ͍ ▪ ࣄલʹݕͳΒvalidationͳͲ΄͔ͷํ๏͕·͞Δ ◦ ςετίʔυΛॻͨ͘ΊͷͦΕͳΓ ▪ ͦΕʹݟ߹͏୲อ͕Ͱ͖ͳ͍ → จ௨ΓʹͰ͖ͨ͜ͱΛ୲อ͢Δ ΑΓ ΨʔυϨʔϧ͕֑͔͋ͬͯΒམͪͳ͍ ঢ়گΛ࡞Γ͍ͨ
Copyright coconala Inc. All Rights Reserved. 27 ςετͷݕ౼ ΨʔυϨʔϧͷྫ •
preconditionΛهࡌ • Open Policy AgentͷΈࠐΈ ※ઈࢍਐߦத ◦ ҰྫɿLBʹඥͮ͘λʔήοτάϧʔϓ͕θϩNG ◦ Terraform CloudΛಋೖ͍ͯ͠ΕɺCloudͷػೳͷҰͰΈࠐΈՄೳ ◦ ίίφϥTerraform CloudΛಋೖ͍ͯ͠ͳ͍ͨΊɺGithubActionsͷϑϩʔʹΈࠐΈ ༧ఆ • Sentinel ◦ Terraform Cloudݶఆ • terraform-compliance ◦ BDDͰهࡌ → ͜ΕΒΛCIʹΈࠐΜͰະવʹࣄނΛ͙
Copyright coconala Inc. All Rights Reserved. 28 ·ͱΊ • ίʔυͷෛ࠴Λղফ
◦ γεςϜͷม༰ͱڞʹϕετͳߏߟ͑͢ • దͳόʔδϣϯཧ ◦ GA࠷৽൛Λར༻͢Δͷ͕ͨΓલʹ • plan / applyͷΈڧԽ ◦ ਓҝతͳϛεͷՄೳੑΛՄೳͳݶΓഉআ • ӡ༻໘Ͱͷվળ ◦ ӡ༻໘ʹϙϦγʔΛ ◦ ώτͷೖΕସ͑ͳͲͰܧଓతʹߦ͏ඞཁ͕͋Δ
ίίφϥ ΤϯδχΞͷX(Twitter) X /Twitterʢ@coconala_engʣ https://twitter.com/coconala_eng We are hiring!! ࠾༻ϗʔϜϖʔδ https://coconala.co.jp/recruit
ΤϯδχΞ࠾༻ϗʔϜϖʔδ https://coconala.co.jp/recruit/engineer ίίφϥͷਓͱ৫Λ͑Δϒϩά ίίφϥLIVE https://blog.coconala.co.jp/m/m4e4abe8b17e5 ਓੜͷՄೳੑΛ͛ͨϢʔβʔετʔϦʔ Θͨ͠ͷεΩϧղ์ه https://blog.coconala.co.jp/m/me8a586112ad2 ίίφϥʹॴଐ͢ΔΤϯδχΞʹΑΔϒϩά ςοΫϒϩά https://zenn.dev/coconala 29