Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Terraform交通整備 〜大事故を防ぐために〜
Search
coconala_engineer
December 10, 2023
0
160
Terraform交通整備 〜大事故を防ぐために〜
2023/12/05 Next Year Con for SRE の資料です
https://timeedev.connpass.com/event/302385/
coconala_engineer
December 10, 2023
Tweet
Share
More Decks by coconala_engineer
See All by coconala_engineer
Qiita Organizationに取り組む前後の技術広報活動と今後の展望
coconala_engineer
0
46
ココナラのセキュリティ組織の体制・役割・今後目指す世界
coconala_engineer
0
260
SIEMによるセキュリティログの可視化と分析を通じた信頼性向上プロセスと実践
coconala_engineer
1
3.9k
WafCharm導入で激変!プロダクトの未来を守るためのTips
coconala_engineer
0
31
多様なロール経験が導いたエンジニアキャリアのナビゲーション
coconala_engineer
1
290
未来を創るエンジニアを採用・育成するための制度とマインドセット
coconala_engineer
0
55
VPoE Meetup Vol.1 VPoEとして実践してきたことと反省点
coconala_engineer
4
360
エンジニアマネージャーになった理由を振り返ってみた
coconala_engineer
0
680
Developer Experienceを向上させる基盤づくりの取り組み事例集
coconala_engineer
0
240
Featured
See All Featured
Optimising Largest Contentful Paint
csswizardry
34
3.1k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
30
4.6k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
danielanewman
227
22k
Product Roadmaps are Hard
iamctodd
PRO
51
11k
Git: the NoSQL Database
bkeepers
PRO
428
65k
KATA
mclloyd
29
14k
BBQ
matthewcrist
87
9.5k
We Have a Design System, Now What?
morganepeng
51
7.4k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
40
2k
Writing Fast Ruby
sferik
628
61k
Embracing the Ebb and Flow
colly
84
4.6k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
addyosmani
4
380
Transcript
Copyright coconala Inc. All Rights Reserved. Terraformަ௨උ ʙେࣄނΛ͙ͨΊʹʙ γεςϜϓϥοτϑΥʔϜ෦ ΠϯϑϥɾSREνʔϜ
TeamManager ٢ݟ
Copyright coconala Inc. All Rights Reserved. 2 ࣗݾհ ٢ݟʢΑ͔͠Θ ͨ͘Έʣ
• ੜ·Ε ੩Ԭ → จܥେֶ͔ΒΤϯδχΞ • ܦྺ ۚ༥SIer → ελʔτΞοϓ → ίίφϥ • झຯ ϥΠϒɾΠϕϯτʹߦ͘
Vision Ϗδϣϯɺϛογϣϯʹج͍ͮͨࣄۀΛల։ νʔϜ͕ߏங͍ͨ͠ͱࢥ ͏࠷ྑͳະདྷͷΠϝʔδ νʔϜ͕ߏங͍ͨ͠ͱࢥ ͏࠷ྑͳະདྷͷΠϝʔδ Mission νʔϜ͕࣮ݱ͍ͨ͠த৺ తͳతʢଘࡏҙٛʣ ҰਓͻͱΓ͕ʮࣗͷετʔϦʔʯΛੜ͖͍ͯ͘ੈͷதΛ࡞Δ
ݸਓͷࣝɾεΩϧɾܦݧΛՄࢹԽ͠ɺ ඞཁͱ͢Δͯ͢ͷਓʹ݁ͼ͚ͭɺ ݸਓΛΤϯύϫʔϝϯτ͢ΔϓϥοτϑΥʔϜΛఏڙ͢Δ ࣝɾεΩϧɾܦݧͷϚονϯάαʔϏεΛల։ ࣄۀ༰ 3
ࣄɾൿॻɺܦཧɺਓࣄɺCSɺϚʔέςΟϯάɺσβΠϯɾ੍࡞ͳͲ ͷਓखෆΛղফ اۀ๊͕͑Δ༷ʑͳܦӦ՝Λɺ ܦݧݟͷ๛ͳϓϩਓࡐΛ׆༻͢Δ͜ͱͰղܾ ඞཁͳ͚ͩ࣌ؒ՝ۚͰ Ϗδωεߦͯ͘͠Ε͑ΔਓΛհ ϋΠΫϥεͷۀҕୗ ίϯαϧλϯτΛհ ઐελοϑΛ௨ͯ͡ɺݫબͨ͠ඇެ։ͷ໊࣮τοϓΫϦΤΠλʔ ϩΰಈըɺϗʔϜϖʔδͳͲͷσβΠϯɾ੍࡞ܥͷδϟϯϧ
Λఏڙ͠ΫϦΤʔλʔෆΛղফ ίίφϥ͕ܖओମͱͳΓ ϋΠΫϥε໊࣮ΫϦΤΠλʔΛհ ๏Q&AΛແྉͰӾཡɾߘͰ͖ɺ4,000໊Ҏ্ͷหޢ࢜Λ ɾҬผͰݕࡧɾ͍߹Θ͕ͤՄೳʢࠂܝࡌ՝ۚϞσϧʣ ITਓࡐͷۀҕୗ ΤʔδΣϯτ หޢ࢜ͱϢʔβʔͷ ϚονϯάαʔϏε ECܕͷαʔϏε ϚʔέοτϓϨΠε ϚονϯάαʔϏε ֓ཁ 4 Ϗδωεతͷߪೖʹ ಛԽͨ͠αʔϏε ITϑϦʔϥϯεͱاۀΛϚονϯάɻεΩϧϚʔέοτɾ ςοΫΤʔδΣϯτ྆ํͰͷධՁσʔλΛ࿈ܞɾ׆༻༧ఆ
Copyright coconala Inc. All Rights Reserved. 5 ͖͔͚ͬ
Copyright coconala Inc. All Rights Reserved. 6 6ͷࢥ͍͕ίʔυʹڽॖ͞Ε͍ͯͨ ɾ࣮ͨ࣌͠୲ऀόϥόϥ →
ͦͷͨΊ͓ͷ͓ͷͷࢥ͏ߏ͕ݱࡏ·Ͱͬͨ ɾ໋໊༳Ε͕ଟ͍ → module/awsͳͷ͔aws/moduleͳͷ͔ ɾmoduleͱͯ͠࡞͍ͯ͠Δ͕தresource͕1ͭ͋Δ͚ͩͱ͍͏͜ͱ ͕··͋Δ → moduleͷ༗༻ੑ͕Θ͔Βͣʹ࣮͞Ε͍ͯΔ ɾಉ͡ίʔυ͕module֎ʹهड़͞Ε͍ͯͯɺmoduleͷςΠΛͳ͍ͯ͠ͳ ͔ͬͨ → ෆཁͳίʔυ͕ٯʹࠞཚΛট͍ͨ
Copyright coconala Inc. All Rights Reserved. 7 applyͰαʔϏεμϯͤͯ͞͠·ͬͨ • मਖ਼ϛεͰλʔήοτάϧʔϓ͕֎ΕΔࠩΛݟམͱͨ͠
• deleteʹහײ͕ͩͬͨɺchangeͩͬͨͷ͕᠘ ~ resource "aws_autoscaling_group" "api_production" { + force_delete_warm_pool = false id = "api-prod" ~ launch_configuration = "api-prod_v1" -> "api-prod_v2" name = "api-prod" ~ target_group_arns = [ - "arn:aws:elasticloadbalancing:ap-northeast-1:XXX:targetgroup/api/v2” ]
Copyright coconala Inc. All Rights Reserved. 8 ੳͱֶͼ • ͻͱͭͷPRͰෳͷରॲΛͨ͠
◦ ϦϑΝΫλ + terraformόʔδϣϯΞοϓ + ຊདྷͷมߋ ◦ ຊདྷ͋Δ͖planͷ͕ࠩݟ͑ͮΒ͘ͳͬͨ • ίʔυ͕ݹ͗ͯ͢ϦϑΝΫλͤ͟ΔΛಘͳ͔ͬͨ • terraformόʔδϣϯ͕దʹཧͰ͖͍ͯͳ͔ͬͨ • োޙʹݪҼ͕ຊ࡞ۀͰ͋Δ͜ͱΛ͑Δ·Ͱʹ࣌ؒΛཁͨ͠ ◦ ୭͕͍ͭͬͨͷ͔ه͞Εͳ͍
Copyright coconala Inc. All Rights Reserved. 9 ରࡦ • ίʔυͷෛ࠴Λղফ
• దͳόʔδϣϯཧ • plan / applyͷΈڧԽ • ӡ༻໘Ͱͷվળ
Copyright coconala Inc. All Rights Reserved. 10 ίʔυෛ࠴ղফ
Copyright coconala Inc. All Rights Reserved. 11 ίʔυͷෛ࠴Λղফ ɾεςʔτϑΝΠϧΛͲͷΑ͏ʹ͚Δ͔Λ ߟ͑Δ
ɾαʔϏε / module ϨϕϧͰಉ༷ͷߏΛ ͱΔΑ͏ʹ͢Δ ɾਖ਼ղͳ͘ɺߏมߋΛߟ͑Δ ɾ৽ن࡞͔Βద༻͠ɺաڈͷͷਵ࣌ Ҡߦ͍ͯ͘͠
Copyright coconala Inc. All Rights Reserved. 12 ίʔυͷෛ࠴Λղফ ɾαʔϏε͝ͱʹཧϦϙδτϦɾAWSΞΧϯτΛ ͍ͯ͠Δ
ɾ৽αʔϏεΛཱͯΔͱ͖ʹVPCRDSͳͲɺಉ͡Α͏ ͳͷͷίʔυΛϓϦηοτͱ͍ͯ͠Δؾ͕ͨ͠ → ڞ௨moduleʹҠಈ ɾ·ͣ৽ཱͯ͘͠ΔαʔϏεΛڞ௨module ɾطଘαʔϏεΛimportͰҠ২ ɾmoduleΧϯϖΩͰ͋Δඞཁͳ͍
Copyright coconala Inc. All Rights Reserved. 13 దͳόʔδϣϯཧ
Copyright coconala Inc. All Rights Reserved. 14 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯ͝ͱʹ͖͢ػೳվળ͓ΑͼҰ෦deprecation͕ߦΘΕ͍ͯΔ •
null_resourceͷඪ४Խʢ1.4ʣ • importϒϩοΫಋೖʢ1.5ʣ • testίϚϯυരʢ1.6ʣ
Copyright coconala Inc. All Rights Reserved. 15 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯ͝ͱʹ͖͢ػೳվળ͓ΑͼҰ෦deprecation͕ߦΘΕ͍ͯΔ •
null_resourceͷඪ४Խʢ1.4ʣ • importϒϩοΫಋೖʢ1.5ʣ • testίϚϯυരʢ1.6ʣ → ࠷ݶEOLରԠɺՄೳͰ͋Ε࠷৽൛͕·͍͠
Copyright coconala Inc. All Rights Reserved. 16 దʹόʔδϣϯΞοϓΛ͔͚Δ ϓϩόΠμਵ࣌ߋ৽͞Ε͍ͯΔʢؾ͍ͮͨΒ৽͘͠ͳ͍ͬͯΔϨϕϧʣ •
hashicorp/aws ◦ 2ϲ݄Ͱ14όʔδϣϯϦϦʔε͍ͯ͠Δʢ5.18.0 → 5.28.0ʣ • hashicorp/google ◦ 2ϲ݄Ͱ10όʔδϣϯϦϦʔε͍ͯ͠Δʢ4.83.0 → 5.7.0ʣ
Copyright coconala Inc. All Rights Reserved. 17 దʹόʔδϣϯΞοϓΛ͔͚Δ ϓϩόΠμਵ࣌ߋ৽͞Ε͍ͯΔʢؾ͍ͮͨΒ৽͘͠ͳ͍ͬͯΔϨϕϧʣ •
hashicorp/aws ◦ 2ϲ݄Ͱ14όʔδϣϯϦϦʔε͍ͯ͠Δʢ5.18.0 → 5.28.0ʣ • hashicorp/google ◦ 2ϲ݄Ͱ10όʔδϣϯϦϦʔε͍ͯ͠Δʢ4.83.0 → 5.7.0ʣ → terraformͷόʔδϣϯͱ࿈ಈ͍ͯ͠Δͱߟ͑ɺ͋Θͤͯ͋͛Δ → όά͕ࠞೖ͞ΕΔ͜ͱ͕͋ΔͨΊύονόʔδϣϯ্͕͕ͬͨΒૣ͋ͯ͘Δඞཁ͋Γ
Copyright coconala Inc. All Rights Reserved. 18 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯΞοϓπʔϧҎԼ͕ީิ •
dependabot • tfupdate • renovate • ࣗલͷεΫϦϓτ
Copyright coconala Inc. All Rights Reserved. 19 దʹόʔδϣϯΞοϓΛ͔͚Δ ͦΕͧΕʹྑ͠ѱ͠ •
dependabot ◦ GithubΛར༻͍ͯ͠ΕͬͱؾܰʹಋೖՄೳ ◦ PR͕େྔʹͰ͖ΔՄೳੑ͋Γ • tfupdate ◦ terraformͱϓϩόΠμͱผʑʹ্͛Δ͜ͱ͕Մೳ ◦ recursiveʹมߋͰ͖Δ • renovate ◦ tfenvΛར༻͍ͯ͠Δέʔεͷʮ.terraform-versionʯߋ৽ର ◦ ʮ.terraform.lock.hclʯΑ͠ͳʹߋ৽
Copyright coconala Inc. All Rights Reserved. 20 దʹόʔδϣϯΞοϓΛ͔͚Δ ͦͷ΄͔ͷߟྀϙΠϯτ •
࣮ߦස ◦ ߏมߋ͕ͲΕ͘Β͍ೖΔ͔ʹΑͬͯΑ͍ͱߟ͑Δ ◦ ίίφϥͰि࣍Ͱ·Θ͍ͯ͠Δ • PRΛ࡞͢Δͷπʔϧʹ͓ͤɺͨͩͦ͠ΕʹΑΔมߋ֬ೝ͢Δඞཁ͋Γ ◦ ࣍અҎ߱Ͱݴٴ
Copyright coconala Inc. All Rights Reserved. 21 plan / applyͷΈڧԽ
Copyright coconala Inc. All Rights Reserved. 22 ਓͷखΛۃྗհࡏͤ͞ͳ͍ & ద༻͕ʹݟ͑ΔΑ͏ʹ͢Δ
• ݱࡏͷӡ༻ ◦ PRΛ࡞ → ࠩνΣοΫ͠plan݁ՌΛίϝϯτ·Ͱࣗಈ ◦ applyखಈͰ͋ΓɺmainϚʔδͱͷ߹ੑ͕͍͋͠
Copyright coconala Inc. All Rights Reserved. 23 ਓͷखΛۃྗհࡏͤ͞ͳ͍ & ద༻͕ʹݟ͑ΔΑ͏ʹ͢Δ
• ͜Μͳ࢟ʹ͠Α͏ͱ͍ͯ͠Δ ※ ઈࢍਐߦத ◦ merge / push͞Ε͕ͨ࠷ޙɺ apply͞ΕΔͪΐͬͱා͍ ◦ plan͕ҙຯΛͳ͢Α͏ʹ͢Δ ◦ ͍ͭมԽ͕ద༻͞Ε͔ͨɺ ◦ ୭͕ঝೝͨ͠ͷ͔Λه͢Δ
Copyright coconala Inc. All Rights Reserved. 24 ӡ༻໘Ͱͷվળ
Copyright coconala Inc. All Rights Reserved. 25 Τϥʔൃੜ֬ΛԼ͛Δ ਓͷʹΑΔΤϥʔͷ֬ΛԼ͛ΔΑ͏ͳϙϦγʔΛఆΊΔ •
ҰͷplanมߋྔΛԼ͛Δ ◦ ಛੑͷҟͳΔมߋผʑͷPRΛͨͯΔ ◦ ͍ͭͰʹͳʹ͔Λ͍Εͳ͍ • ϨϏϡʔڧԽ ◦ Ͳ͏ͯ͠ଟ͘ͳΔͱ͖ηϧϑϨϏϡʔඞਢͱ͢Δ ▪ ࣮ଶͱͯ͠ͷมߋΛਤࣔ͢ΔɺηϧϑϨϏϡʔίϝϯτΛ͢ͳͲ ◦ ϨϏϡΞʔʮQuestionʯΛ͔͚͛Δ ▪ ॳาతͳ͜ͱͰͳΜͰ͍͍ ▪ Ή͠ΖԿؾͳ͍͜ͱ͕ҙ֎ͱॏେͳ͜ͱͩͬͨ͜ͱ͋Δ → ͲΜͳʹؤுͬͯ100%ͷ୲อͱஅݴग़དྷͳ͍
Copyright coconala Inc. All Rights Reserved. 26 ςετͷݕ౼ ͍ΘΏΔςετπʔϧͰ͋ΔTerratestෆ࠾༻ •
ಈతςετͰ͋Γɺͱ͘ʹ୲อ͍ͨ͠ϙΠϯτʹޮ͔ͳ͍ ◦ applyͨ͠Βࣄނ͕ى͖ͨͷͰɺͦͷલʹݕ͍ͨ͠ͱ͍͏ಈػ͕ڧ͍ ▪ ࣄલʹݕͳΒvalidationͳͲ΄͔ͷํ๏͕·͞Δ ◦ ςετίʔυΛॻͨ͘ΊͷͦΕͳΓ ▪ ͦΕʹݟ߹͏୲อ͕Ͱ͖ͳ͍ → จ௨ΓʹͰ͖ͨ͜ͱΛ୲อ͢Δ ΑΓ ΨʔυϨʔϧ͕֑͔͋ͬͯΒམͪͳ͍ ঢ়گΛ࡞Γ͍ͨ
Copyright coconala Inc. All Rights Reserved. 27 ςετͷݕ౼ ΨʔυϨʔϧͷྫ •
preconditionΛهࡌ • Open Policy AgentͷΈࠐΈ ※ઈࢍਐߦத ◦ ҰྫɿLBʹඥͮ͘λʔήοτάϧʔϓ͕θϩNG ◦ Terraform CloudΛಋೖ͍ͯ͠ΕɺCloudͷػೳͷҰͰΈࠐΈՄೳ ◦ ίίφϥTerraform CloudΛಋೖ͍ͯ͠ͳ͍ͨΊɺGithubActionsͷϑϩʔʹΈࠐΈ ༧ఆ • Sentinel ◦ Terraform Cloudݶఆ • terraform-compliance ◦ BDDͰهࡌ → ͜ΕΒΛCIʹΈࠐΜͰະવʹࣄނΛ͙
Copyright coconala Inc. All Rights Reserved. 28 ·ͱΊ • ίʔυͷෛ࠴Λղফ
◦ γεςϜͷม༰ͱڞʹϕετͳߏߟ͑͢ • దͳόʔδϣϯཧ ◦ GA࠷৽൛Λར༻͢Δͷ͕ͨΓલʹ • plan / applyͷΈڧԽ ◦ ਓҝతͳϛεͷՄೳੑΛՄೳͳݶΓഉআ • ӡ༻໘Ͱͷվળ ◦ ӡ༻໘ʹϙϦγʔΛ ◦ ώτͷೖΕସ͑ͳͲͰܧଓతʹߦ͏ඞཁ͕͋Δ
ίίφϥ ΤϯδχΞͷX(Twitter) X /Twitterʢ@coconala_engʣ https://twitter.com/coconala_eng We are hiring!! ࠾༻ϗʔϜϖʔδ https://coconala.co.jp/recruit
ΤϯδχΞ࠾༻ϗʔϜϖʔδ https://coconala.co.jp/recruit/engineer ίίφϥͷਓͱ৫Λ͑Δϒϩά ίίφϥLIVE https://blog.coconala.co.jp/m/m4e4abe8b17e5 ਓੜͷՄೳੑΛ͛ͨϢʔβʔετʔϦʔ Θͨ͠ͷεΩϧղ์ه https://blog.coconala.co.jp/m/me8a586112ad2 ίίφϥʹॴଐ͢ΔΤϯδχΞʹΑΔϒϩά ςοΫϒϩά https://zenn.dev/coconala 29