github-classmethod-study-20170426

by Koji Nakayama

Slide 1

Slide 1 text

GitHub Enterprise;AWSΨ 奲ΕݳΥͱ͵CDP GitHub;μ϶φϮϊϐϖ΄ۣ䔶տ 뺶GitHub x AWS΄๋ෛDevOpsԪఘ뺶 2017/04/26 Ӿઊ ଛလ 1

Slide 2

Slide 2 text

ᛔ૩奧Օ • Ӿઊ ଛလ • μ϶φϮϊϐϖ AWSԪ䮣᮱ ϊϷϲЄτϴ ЀίЄκϓμϕ • AWSΨڥአͭ͵αЀϢ϶΄戔懯/䯤塈/π ЀςϸϓΰЀν • GitHub: knakayama • 奺䵉 • ηЀϤϹςЄϝ΄晁አ3ଙ • AWS 1ଙ 2

Slide 3

Slide 3 text

ίυδЀύ 1. Ք෭͠扖ͯΡٖ਻ 2. AWSΨֵ͜Ӥͽ΄च๜঵㵟 3. GitHub EnterpriseΨֵ͜Ӥͽ΄च๜঵㵟 4. CDP΄奧Օ 5. Δ;Η 6. ݇ᘍϷЀμ 3

Slide 4

Slide 4 text

ဳ఺ᅩ • GitHub Enterprise΅GHE;ᤒ懿ͯΡ • GHE΅咲ᤒ䦒๋ෛϝЄυϴЀͽ͘Ρ2.9ᔮΨమਧ • AWSΘ匍䦒ᅩ΄ఘ䁭Ψڹ൉΁ͯΡ • 㪒ςЄϠφ;ΘίϐϤϔЄϕ͢෱͚΄ͽڥአͯΡ檭΅๋ෛ΄ఘ 䁭Ψ݇ᆙͯΡͩ; 4

Slide 5

Slide 5 text

1. Ք෭͠扖ͯΡٖ਻ • GHEΨAWSͽֵ͹ͼ͚ͥ檭΄抓氂;ͳ΄ᥴဩΨͪ奧Օ • ۆΠ;OpsੀΠ΀ٖ਻͢ग़Η • ஍ͽφ϶αϖل樄ͭΔͯ • ݇ᘍϷЀμΨ㪥ͱͼ͚Ρ΄ͽ托奞ΨᎣΠ͵͚䁰ݳ΅݇ᆙͥͶͫ ͚ 5

Slide 6

Slide 6 text

2. AWSΨֵ͜Ӥͽ΄च๜঵㵟 • ᒫӞ΁ϫϚЄυϖςЄϠφ΄ڥአΨ䭥懵ͯΡͩ; • ਞਧ௔ • ՜ςЄϠφ;΄昧൭ • 晁አ揗រ΄֗仂 • 䰤伛ςЄϠφͽ΅ᥝկ΁ݳΥ΀͚䁰ݳ΁ᛔړ͵ͷͽ֢Ρ • տᐒ͢ಭ揾ͯΏͣϠυϚφϺυϐμ΁ᵞӾͯΡ 6

Slide 7

Slide 7 text

3. GHEΨֵ͜Ӥͽ΄च๜঵㵟 • च๜ጱ΁GHEᛔ᫝΄戔ਧΨ୓Ο΀͚ • GHE΄ίϐϤϔЄϕͽ/data/userզक़قͼӤ䨗ͣͫ΢Ρ͵Η • GitHub͢൉׀ͭͼͥ΢ͼ͚Ρ䰤伛䱛ᚆΨֵ͜ • 晁አ揗រΨ֗仂ͭ͵୵ͽGHEΨᓕቘͽͣΡ 7

Slide 8

Slide 8 text

4. CDP΄奧Օ 8

Slide 9

Slide 9 text

抓氂1 9

Slide 10

Slide 10 text

GHEΨαЀόЄϚϐϕ΁ ل樄ͭ͵ͥ΀͚ 10

Slide 11

Slide 11 text

GHEΨαЀόЄϚϐϕ΁ل樄ͭ͵ͥ΀͚ • GitHub.com͘͢Ρ΁Θ樛ΥΟͰGHEΨڥአͯΡ㵕䱛΅͚ͥͺ͘͡Ρ • ψκϲϷϓΰӤ΄ᥝկ͡Οᐒक़΁ϊЄφπЄϖΨᗝͣ͵ͥ΀͚;ᘍ ͞Ρ͠ਮ䯭΅ग़͚ • Ϥ϶αϦЄϕϷϪυϕϷΨϞϣϷϐμ΁ͭͼͭΔ͹͵ • ίμψφκЄΨπϬϐϕ΁ތΗͼͭΔ͹͵ • ᐒٖ΄LDAPςЄϝͽϺναЀᓕቘͭ͵͚ 11

Slide 12

Slide 12 text

Ϥ϶αϦЄϕNWϞόЄЀ 12

Slide 13

Slide 13 text

䯤౮ • ᐒٖNW;VPC樌Ψψκϲί΁ള姆 • ϜЄϖγδίVPN • αЀόЄϚϐϕࢧ娄ΨIPsec VPNͽ ิݩ۸ • Direct Connect • 䌑አ娄ͽVPC;ള姆 13

Slide 14

Slide 14 text

晝ਧϪαЀϕ ϜЄϖγδίVPN Direct Connect πφϕ ਞ㭅΀ϦφϕεϢζЄ ϕࢧ娄Θڥአݢᚆ κϰϷί΄䌑አ娄ςЄ Ϡφ΄ॶ夹͢஠ᥝ ϷЄϖόαϭ ܨ䦒~ හ昱樌~ 䒏ऒ ิݩ۸΄ηЄϝЄϥϐ ϖ΁ΞΠګᴴ͘Π ~10Gbps ߝ搡 αЀόЄϚϐϕϦЄφ ΄͵Η奺᪠Ӥ΄Ϛϐϕ ϼЄμᇫ䙪΄୽段Ψݑ ͧΡ κϰϷί΁ΞΠߝ搡͢ כ戣ͫ΢ͼ͚Ρ ᵑਸ਼䦒΄ڔΠړͧ αЀόЄϚϐϕϦЄφ ΄͵Ηᛔᐒͽכ೮ͭͼ ͚Ρ塅㾨զक़΄ڔΠړ ͧ͢櫞͚ͭ εЀϖϑЄεЀϖͽͿ ΄奺᪠Ψڥአͭͼ͚Ρ ͡಩ൎͽͣͼ͚Ρ͵Η ྲ斃ጱ਻ฃ https://www.slideshare.net/AmazonWebServicesJapan/aws-black-belt-online-seminar-2016-amazon-vpc/66 14

Slide 15

Slide 15 text

αЀόЄϚϐϕΎ΄ίμψφ • GHE͡ΟαЀόЄϚϐϕ΁ڊͼ͚ͥ͵Η΁΅̵ NAT Gateway͡ᐒٖNW΄οЄϕγδαΨڥአ ͯΡ • ϸЄϕϓЄϣϸ΄戔ਧ΅զӥ΄Ξ͜΁ͯΡ Destination Target 䯤౮ 0.0.0.0/0 nat-xxx NAT Gateway 奺ኧ 0.0.0.0/0 vgw-xxx ᐒٖοЄϕ γδα奺ኧ 15

Slide 16

Slide 16 text

抓氂2 16

Slide 17

Slide 17 text

GHE΄ϝϐμίϐϤͭ͢͵͚ 17

Slide 18

Slide 18 text

GHE΄ϝϐμίϐϤͭ͢͵͚ • य़Ԫ΀ϊЄφπЄϖΨכᓕͭͼ͚ΡGHE΄ϝϐμίϐϤ΅஠殾 • ηϧϬφ΀ͿͽϔЄό΄ၾ०᩸ͩ͢Ρݢᚆ௔΅Ϳ΄奲婻ͽΘ͘Ρ • ϝϐμίϐϤ/ϷφϕίͯΡ͵Η΄ϑЄϸΨGitHub͢ل樄ͭͼͥ΢ ͼ͚Ρ • https://github.com/github/backup-utils • ͵Ͷ̵ͭϑЄϸΨ䋚ᤈͯΡαЀφόЀφ΄ᓕቘ΅ͭ͵ͥ΀͚ 18

Slide 19

Slide 19 text

ϫϚЄυϖϝϐμίϐϤϞόЄЀ 19

Slide 20

Slide 20 text

DatePipeline • GHE΄ϝϐμίϐϤ㳌ቘΨDatePipeline ͽਧ嬝 • ݱ圵ϔЄό΄ᑏ㵕Κ̵ݐ஑΀ͿΨਧ 嬝ͽͣΡ • ϼЄμϢϺЄΨϠυϲί϶αχ΁ᤒ ᐏͭͼͥ΢Ρ • ϝϐμίϐϤ΄Ξ͜΀ϝϐώ㳌ቘ΄ ਧ嬝΁๋晒 20

Slide 21

Slide 21 text

ϼЄμϢϺЄ • φξυϲЄϸͽਧ๗ጱ΁Ec2ResourceΨ᩸ 㵕 • ᩸㵕ͭ͵αЀφόЀφͽ ShellCommandActivityΨ䋚ᤈ • τδϸπϫЀϖ΄Ӿͽghe-backupπϫЀϖ Ψ䋚ᤈ • EBSΔ͵΅EFS΁ϝϐμίϐϤϔЄόΨכਂ • ϝϐμίϐϤ΄ݐ஑΁०䤂ͭ͵䁰ݳ̵SNS ϕϡϐμ奺ኧͽᓕቘᘏ΁᭗Ꭳ 21

Slide 22

Slide 22 text

Ϸφϕί • Ϸφϕί䦒΁Ӟ䦒ጱ΁αЀφόЀφΨ ᩸㵕 • ᩸㵕ͭ͵αЀφόЀφͽEBS͡EFSΨϫ γЀϕ • ghe-restore πϫЀϖΨ䋚ᤈͭͼϷφ ϕί • ΘͷΣΩ̵Ϸφϕί㳌ቘΨDatePipeline ͽਧ嬝ͯΡͩ;Θݢᚆ 22

Slide 23

Slide 23 text

抓氂3 23

Slide 24

Slide 24 text

GHE΄Email NotiﬁcationΨֵ͚͵͚ 24

Slide 25

Slide 25 text

GHE΄Email NotiﬁcationΨֵ͚͵͚ • Email Notiﬁcation;΅GHE΄αϦЀϕ咲ኞ䦒΁ϮЄϸͽ᭗Ꭳͭ ͼͥ΢Ρ䱛ᚆ • PR/Issue/etc... • GHE΄䁰ݳ̵ᛔړͽᭆמአϮЄϸςЄϝΨ䯤塈ͯΡ஠ᥝ͘͢Ρ • ͳ΢አ΄ϮЄϸςЄϝ͢΀͚䁰ݳ̵ͩ΄䱛ᚆΨڥአͯΡ͵ΗͶ ͧ΁䯤塈ͯΡ΄΅τЀϖ͚ 25

Slide 26

Slide 26 text

ϫϚЄυϖEmail Notiﬁcation ϞόЄЀ 26

Slide 27

Slide 27 text

SES • GHE͡ΟSES奺ኧͽNotiﬁcationΨᭆמ • GHE;SES΅㳨ϷЄυϴЀͽΘOK • SES΄ϮЄϸᭆמ΅ϩόЀϪώϪώͽ 墋㶨΁ψϐϕίϐϤݢᚆ • SESΨֵ͜΀ΟϖϮαЀᓕቘΨRoute53 ͽΚΡ;墋㶨 27

Slide 28

Slide 28 text

ψϐϕίϐϤ • SES厏हΨςЀϖϩϐμφक़΁ᑏ㵕 • SMTP扯戣አIAMϳЄσ΄֢౮ • ᭆמزϖϮαЀ΄扯戣 • GHE΄ϫϚυϮЀϕπЀϊЄϸ͡Ο SMTP΄戔ਧ 28

Slide 29

Slide 29 text

抓氂4 29

Slide 30

Slide 30 text

GHEΨ䮭΁ᓕቘͭ͵͚ 30

Slide 31

Slide 31 text

GHEΨ䮭΁ᓕቘͭ͵͚ • GHE΄ϺνΨכਂͭ͵Π̵ϮϕϷμφΨ㷧ᵞͭ͵͚ • ͽΘεЄυδЀϕ΀Ϳ΄ϊϢϕγδίΨGHEᛔ֛΁αЀφϕЄϸͯΡ΄ ΅᭿ͧ͵͚ • Ϻν΅ϢζϼЄϔΰЀνͯΡͩ;΁ΞΠ敢ᭆݢᚆ • ϺναЀઆ䵉/ίϤϷξЄτϴЀϺν/etc... • SNMPͽϮϕϷμφΨ㷧ᵞݢᚆ • CPU/φϕϹЄυ਻ᰁ/ϮϯϷ/etc... 31

Slide 32

Slide 32 text

WorkerϞόЄЀ 32

Slide 33

Slide 33 text

Ϻν΄ίЄθαϣ • GHEͽϺνϢζϼЄϔΰЀνΨํ㵁۸ • UDP:514ͽGHE͡ΟϺνΨ㷧ᵞ • ﬂuentd-plugin-s3ͽS3΁כਂ • Ϥ϶αϦЄϕNWϞόЄЀ΄䁰ݳ΅VPC EndpointΨڥአͯΡͩ; • S3΅ϔЄόϹαμ;ͭͼڥአݢᚆ΀΄ ͽਖ਼๶ጱ΁ړຉ/ݢ憙۸;͚͹͵ͩ;Θ ݢᚆ 33

Slide 34

Slide 34 text

Ϻν΄哶憙 • GHEͽϺνϢζϼЄϔΰЀνΨํ㵁۸ • ﬂuent-plugin-cloudwatch-logsͽ CloudWatch Logs΁ϺνΨ敢ᭆ • Metrics FilterΨڥአͭͼᇙਧ΄෈ਁڜ ΁ϫϐώͭ͵䁰ݳSNSϕϡϐμ΁᭗Ꭳ 34

Slide 35

Slide 35 text

ϷϊЄφ΄哶憙 • GHEͽSNMPϯϘόϷЀνΨํ㵁۸ • CollectdΨαЀφϕЄϸͭ͵αЀφόЀ φͽGHE΄ϮϕϷμφΨSNMP奺ኧͽ 㷧ᵞ • Collectd͡ΟCloudWatch MetricsΎ΄敢 ᭆ΅AWSلୗϤ϶ναЀΨڥአ • https://github.com/awslabs/collectd- cloudwatch 35

Slide 36

Slide 36 text

抓氂5 36

Slide 37

Slide 37 text

GHE΁ϫϸώϖϮαЀ戣ก䨗Ψ 戔ਧͭ͵͚ 37

Slide 38

Slide 38 text

GHE΁ϫϸώϖϮαЀ戣ก䨗Ψ戔ਧͭ͵͚ • GHE΅HTTPS᭗מ͢വ䅏 • GHE΁΅Subdomain Isolation;͚͜䱛ᚆ͘͢Πവ䅏戔ਧ • URLΨςϣϖϮαЀ୵ୗ΁ͭͼXSS΁㯪͞Ρ䱛ᚆ • ͩ΄䱛ᚆΨڥአͭͺͺHTTPS᭗מͯΡ͵Η΁΅ϫϸώϖϮαЀ 戣ก䨗͢஠ᥝ 38

Slide 39

Slide 39 text

Subdomain Isolation Original Path With subdomain isolation http(s)://hostname/gist/ http(s)://gist.hostname/ http(s)://hostname/raw/ http(s)://raw.hostname/ • SSL戣ก䨗΄ϖϮαЀ͢ *.hostname ;SANͽ hostname ΁䌏䖕ͭͼ͚Ρ஠ᥝ͘͢Ρ • ηϹηϹ戣ก䨗Ͷ;ϣ϶γσ΁ᦄޞ͢ڊͼͭΔ͜ • ᐒٖڥአ΄͵Η΁SSL戣ก䨗Ψ揮͚͵ͥ΀͚ 39

Slide 40

Slide 40 text

ϫϚЄυϖCertiﬁcationϞόЄЀ 40

Slide 41

Slide 41 text

ACM • 戣ก䨗΄咲ᤈ΅僻ාͽֵ͞Ρ • 戣ก䨗΄ๅෛ֢䮣΅AWS͢Κ͹ͼͥ΢Ρ • ϫϸώϖϮαЀ戣ก䨗΁Θ䌏䖕 • ACM΅ϖϮαЀ扯戣(DV)΄Ε䌏䖕 • 䋚ࣁ扯戣(EV)/奲婻扯戣(OV)戣ก䨗΅๚䌏䖕 • ᐒक़΁ل樄ͭ΀͚΄ͽ͘΢ΆACMͽ܈ړ 41

Slide 42

Slide 42 text

ϺЄϖϝ϶Ѐς • GHE΄2.9ᔮ͡ΟϺЄϖϝ϶ЀςΨςϪЄ ϕ • PROXY protocol(വ䅏) • X-Forwarded-For • զӥ΄2ͺ΅ᶋ䌏䖕 • ϺЄϖϝ϶ЀτЀν • SSLόЄϬϚЄτϴЀ • GHE΄ڹྦྷ΁ELBΨ戔ᗝ̵ͭͳͩ΁ACMΨ 戔ਧͯΡ 42

Slide 43

Slide 43 text

ϺЄϖϝ϶Ѐς • ALB΅PROXY protocol΁䌏䖕ͭͼ΀͚ ΄ͽCLBΨֵ͜ • Ϥ϶αϦЄϕNWϞόЄЀ΄䁰ݳ΅ Internal ELB 43

Slide 44

Slide 44 text

Slide 45

Slide 45 text

抓氂6 45

Slide 46

Slide 46 text

GHE΄HA䯤౮Ψ䮭΁ᓕቘͭ͵͚ 46

Slide 47

Slide 47 text

GHE΄HA䯤౮ • GHE΅Active/Standby୵ୗ΄HA䯤౮͢ ݢᚆ • Ϥ϶αϫϷ - ψθЀύϷͽϹϤϷξЄ τϴЀΨ奲Ε̵ϔЄόΨݶ๗ͫͱΡ䯤౮ • SSHΚVPNϕЀϚϸΨڥአͭͼ͚Ρ΄ ͽ̵Ϥ϶αϫϷ - ψθЀύϷ樌ͽͳ΢Ο ΄ψϐϕίϐϤΨͭͼͥ͠஠ᥝ͘Π • 戔ਧ΁΅ghe-replᔮ΄πϫЀϖΨڥአͯ Ρ 47

Slide 48

Slide 48 text

HA䯤౮΄ψϐϕίϐϤ # ϹϤϷξЄτϴЀ΄ψϐϕίϐϤ $ ghe-repl-setup <Ϥ϶αϫϷ΄IPίϖϹφ or Ϩφϕݷ> # ϹϤϷξЄτϴЀ΄樄ত $ ghe-repl-start # ϹϤϷξЄτϴЀ΄ᇫ䙪嘦扯 $ ghe-repl-status 48

Slide 49

Slide 49 text

ψθЀύϷ΄䥮໒ • Ϥ϶αϫϷ͢ύγЀͭ͵䁰ݳ΁̵ψθ ЀύϷΨϤ϶αϫϷ΁䥮໒ͯΡ # Ϥ϶αϫϷΎ΄䥮໒ $ ghe-repl-promote • 䥮໒䦒΁̵GHE΄FQDNΨψθЀύϷ㯎 ΁䄜ๅͯΡ஠ᥝ͘͢Ρ • ᵑਸ਼咲ኞ䦒΁DNS΄戔ਧΨ䄜ๅͯΡ΄ ΅ͷΝ͹;τЀϖ͚ 49

Slide 50

Slide 50 text

HA SwappingϞόЄЀ 50

Slide 51

Slide 51 text

DNS΄ڔΠ๊͞ • ELBΨڥአͭͼ͚΢ΆϤ϶αϫϷ/ψθЀ ύϷΨSwapͯ΢ΆOK • ψθЀύϷΨELB΁ίόϐώͯΡ • Ϥ϶αϫϷΨELB͡ΟϔόϐώͯΡ • ELB΄UnHealthyHostCount΁䌏ͭͼ AlarmΨ戔ਧ • ϫφόЄ͢ύγЀͭ͵ΟSNSϕϡϐμͽ ί϶Єϕ᭗Ꭳ • ELB΄ݻͣضΨψθЀύϷ΁䄜ๅ 51

Slide 52

Slide 52 text

5. Δ;Η 52

Slide 53

Slide 53 text

Δ;Η • AWSΨڥአͯΡ΀ΟϫϚЄυϖςЄϠφΨֵ͜͠ • GHEΨ䮭΁ᓕቘͭ͵͚䁰ݳ̵AWS΄ϫϚЄυϖςЄϠφ΅๋晒 • 敋斪΄ٚ咲ก΅䮩ێͭ΀͚ • AWSӤͽGHEΨڥአͭ͵͚;ᘍ͞ͼ͚Ρ䁰ݳ΅ฎᶋͪፘ抨ͥͶ ͚ͫ:) 53

Slide 54

Slide 54 text

͠ΥΠ 54

Slide 55

Slide 55 text

6. ݇ᘍϷЀμ 55

Slide 56

Slide 56 text

Ϥ϶αϦЄϕNWϞόЄЀ • https://www.slideshare.net/AmazonWebServicesJapan/aws- black-belt-online-seminar-2016-amazon-vpc 56

Slide 57

Slide 57 text

ϫϚЄυϖϝϐμίϐϤϞόЄЀ • http://dev.classmethod.jp/cloud/aws/aws-datapipeline-all-pipeline- objects/ • http://dev.classmethod.jp/cloud/aws/creating-efs-backup- environment-with-datapipeline/ • http://dev.classmethod.jp/cloud/aws/github-enterprise-on-aws-5/ • https://github.com/awslabs/data-pipeline-samples • https://help.github.com/enterprise/2.9/admin/guides/installation/ backups-and-disaster-recovery/ 57

Slide 58

Slide 58 text

ϫϚЄυϖEmail NotiﬁcationϞόЄЀ • http://dev.classmethod.jp/cloud/aws/github-enterprise-on- aws-3/ 58

Slide 59

Slide 59 text

WorkerϞόЄЀ • http://dev.classmethod.jp/cloud/aws/github-enterprise-on-aws-8/ • http://dev.classmethod.jp/cloud/aws/github-enterprise-on-aws-7/ • http://dev.classmethod.jp/cloud/aws/github-enterprise-on-aws-6/ • https://help.github.com/enterprise/2.9/admin/articles/log- forwarding/ • https://help.github.com/enterprise/2.9/admin/articles/ monitoring-using-snmp/ 59

Slide 60

Slide 60 text

ϫϚЄυϖCertiﬁcationϞόЄЀ & HA SwappingϞόЄ Ѐ • http://dev.classmethod.jp/cloud/aws/check_acm_speciﬁcation/ • https://help.github.com/enterprise/2.9/admin/guides/ installation/using-github-enterprise-with-a-load-balancer/ 60