TerraformのレビューをConftestで自動化する

Transcript

1. 5FSSBGPSNͷϨϏϡʔΛ
   $POGUFTUͰࣗಈԽ͢Δ
   Terraform meetup ONLINE #2021.02
   Ryo Kubota @ryok6t
   

   View Slide

2. • Ryo Kubota (@ryok6t)
   • FiNC Technologies
   • SRE Team manager
   • Terraformྺ͸1೥൒΄Ͳ
   ࣗݾ঺հ
   

   View Slide

3. • ໿50ͷϚΠΫϩαʔϏε͕ AWS ্ʹଘࡏ
   • ϚΠΫϩαʔϏεͷΠϯϑϥΛ Terraform Ͱ؅ཧ
   • αʔϏεͱ؀ڥ͝ͱʹಠཱͨ͠ state Λอ༗
   લఏ
   4UBHJOH
   UGTUBUF
   1SPEVDUJPO
   UGTUBUF
   αʔϏε"
   4UBHJOH
   UGTUBUF
   1SPEVDUJPO
   UGTUBUF
   αʔϏε#
   ʜ
   

   View Slide

4. • ϚΠΫϩαʔϏεͷΠϯϑϥΛ։ൃऀʹҕৡ͢Δͱ͍
   ͏ࢥ૝͔Β Terraform Λಋೖ
   • ໿2000ݸͷطʹ࡞ΒΕͯ͠·͍ͬͯͨϦιʔεΛ

   શͯ import ͠ɺαʔϏεͱ؀ڥ͝ͱʹ෼ׂ
   ೥൒લ͸*B$ͳͲແ͔ͬͨ
   

   View Slide

5. • Terraform Λಋೖ͠ɺ։ൃऀ͸ HCL Λॻ͍ͯ

   ϓϧϦΫΤετΛग़ͤ͹ΠϯϑϥʹมߋΛՃ͑ΒΕΔ
   Α͏ʹͳͬͨ
   • ࢥ૝ʹҰาۙ෇͍ͨ
   എܠ
   

   View Slide

6. • ࣭ͷ୲อͷͨΊɺϨϏϡʔ͸΄ͱΜͲ SRE ͕୲౰
   • ϨϏϡʔ͕ແࢹͰ͖ͳ͍ίετʹ
   ݟ͖͑ͯͨ৽ͨͳ՝୊
   

   View Slide

7. • ຊདྷͷϚΠΫϩαʔϏεͷ఩ֶͱͯ͠͸ɺ֤νʔϜ͕
   Πϯϑϥͷมߋ΋ؚΊͯ։ൃΛεϐʔσΟʹճ͍ͯ͠
   ͚Δ΂͖
   • ϨϏϡʔ΋ؚΊͯҕৡ͍͖͍ͯͨ͠
   ຊདྷͷࢥ૝ʹཱͪฦΔͱʜ
   

   View Slide

8. • ͦΕͳΓʹෳࡶͳઃఆ͕ඞཁʹͳΔέʔε΋
   • Ճ͑ͯɺTerraform/AWS ͷ஌ࣝ͸ݸਓ/νʔϜʹΑͬ
   ͯҟͳΔ
   ҕৡ͸؆୯Ͱ͸ͳ͍
   

   View Slide

9. • FiNC Ͱ͸αʔϏεؒͷඇಉظ௨৴ʹ Amazon SNS/
   SQS Λ࢖༻
   • ΍΍ෳࡶͳઃఆ͕ඞཁ
   "NB[PO4/4424ͷྫ
   

   View Slide

10. • αʔϏεA ʹ SNS topic Λ࡞੒
    • αʔϏεA ͷ IAM policy ʹ SNS topic ͷݖݶΛ௥Ճ
    • αʔϏεB ʹ SQS queue Λ࡞੒
    • αʔϏεB ͷ IAM policy ʹ SQS queue ͷݖݶΛ௥Ճ
    • SQS queue ͷ policy ʹ SNS topic ͷݖݶΛ௥Ճ
    • SNS topic ͱ SQS queue Λඥ͚ͮΔ resource Λ௥Ճ
    4/4424ͷઃఆ߲໨͸ଟ͍
    

    View Slide

11. • ίετूܭ΍ Datadog ͰͷॲཧͷͨΊʹ tag Λٛ຿
    Խ͍ͯ͠Δ
    • λά෇͚ͳͲͷϕετϓϥΫςΟε΋શһ͕೺Ѳͯ͠
    ͍ΔΘ͚Ͱ͸ͳ͍
    5BHͷྫ
    

    View Slide

12. • શαʔϏεͰͷ࣭ͷ୲อ͕ࠔ೉ʹ
    • HCL ͷߏจ্͸໰୊ແ͍͜ͱ͕ଟ͍ͷͰɺTerraform
    Ͱ͸ݕ஌Ͱ͖ͳ͍
    • ͋͘·Ͱҙຯ্ͷ໰୊
    • e.g. tag ͕ແͯ͘΋౰વ apply ͸Մೳ
    ϨϏϡʔΛҕৡ͢Δͱʜ
    

    View Slide

13. • ֤αʔϏεͷࣗ཯Խͱશମͷ࣭ͷτϨʔυΦϑʹ
    • ϨϏϡʔ͸ҕৡ͍ͨ͠ʢࣗ཯Խ͍ͨ͠ʣ͕ɺ

    ࣭΋୲อ͍ͨ͠
    • ͳΜΒ͔ͷ࢓૊ΈΛ༻͍ͯࣗಈԽ͢Δඞཁ͋Γ
    ࣭ͱࣗ཯ԽͷτϨʔυΦϑʁ
    

    View Slide

14. • CircleCI Ͱ terraform plan Λ͢Δࡍʹɺઃఆʹ໰୊͕
    ແ͍͔ΛࣗಈͰνΣοΫ͢Δ
    • Open Policy Agent(OPA) Λར༻ͯ͜͠ΕΛୡ੒
    ղܾࡦ
    

    View Slide

15. • OSS ͷϙϦγʔΤϯδϯ
    • CNCF ͷ Graduation project
    • Rego ͱݺ͹ΕΔϙϦγʔهड़ݴޠΛ࢖ͬͯϙϦγʔ
    Λఆٛ
    01"ͱ͸ʁ
    

    View Slide

16. 01"ͷΠϝʔδ
    :".-+40/
    ͳͲͷ
    σʔλ
    3FHP
    1PMJDZ
    ೖྗ
    ൑ఆ
    

    View Slide

17. • ηϚϯςΟΫεతͳ໰୊ͷݕ஌ΛࣗಈԽՄೳ
    • ஞҰʮtag ͍ͭͯͳ͍Αʂʯͱ͔ࢦఠ͕ෆཁ
    • Policy as Code ͕࣮ݱՄೳ
    • ϙϦγʔΛ໌จԽ 㱻 ଐਓԽ
    • ϙϦγʔ΋ίʔυͱͯ͠։ൃՄೳ
    01"Λ࢖͏ͱԿ͕خ͍͠ͷ͔
    

    View Slide

18. • CircleCI ্Ͱ Conftest ͱ͍͏ OPA ͷπʔϧΛ࣮ߦ
    • Conftest ͱ͸ʁ
    • ୯ͳΔ OPA ͷϢʔβʔΠϯλʔϑΣʔε
    • ࣮ࡍͷ࡞ۀ͸΄΅ OPA ͕࣮ߦ
    ࣮ࡍͲ͏࢖͍ͬͯΔͷ͔
    

    View Slide

19. • plan ݁ՌΛ JSONʹͯ͠ೖྗ͢Δ
    • terraform plan -out plan.tfplan
    • terraform show -json plan.tfplan | conftest test -
    5FSSBGPSNͰͷ$POGUFTU
    

    View Slide

20. 5FSSBGPSNQMBOͷ+40/
    ϦιʔεͱͦΕʹର͢ΔมߋҰཡ
    Ճ͑Δૢ࡞ʢDSFBUF VQEBUFͳͲʣ
    Ϧιʔεͷ৘ใ
    มߋલมߋޙͷঢ়ଶ
    

    View Slide

21. ϙϦγʔͷྫʢUBHʣ
    ඞਢʹ͍ͨ͠UBH
    SFTPVSDF@DIBOHFTΛϧʔϓ
    ҰͭͰ΋ຬ͍ͨͯ͠ͳ͍΋ͷ͕
    ͋Ε͹WJPMBUJPO
    

    View Slide

22. • action ͱϦιʔεͷछྨ͔ΒมߋͷӨڹൣғΛܭࢉ
    • ͦΕʹΑͬͯϨϏϡϫʔΛมߋ
    ଞʹ΋͜Μͳ͜ͱ΋ʜ
    

    View Slide

23. • Policy as Code: ϙϦγʔΛίʔυͱͯ͠ѻ͏
    • Rego ͷจ๏ʹ͸Ϋη͕͋ΔͨΊɺςετ͕ॏཁ
    • OPA Ͱ͸ϙϦγʔͷςετ༻ϑϨʔϜϫʔΫ͕ଘࡏ
    ͠ɺ؆୯ʹςετ͕Մೳ
    ϙϦγʔ͸ςετՄೳ
    

    View Slide

24. • ϚΠΫϩαʔϏεʹ͓͍ͯ͸αʔϏεͷࣗ཯ੑͱશମ
    ͷ࣭ͷ୲อ͕τϨʔυΦϑʹͳΓ΍͍͢
    • ҆શͰߴ଎ͳ։ൃͷͨΊʹ͸ɺPolicy as Code ʹΑΔ
    ηϚϯςΟΫεݕূͷࣗಈԽ͕༗ޮ
    • Conftest Λ࢖͏͜ͱͰ͜ΕΛ࣮ݱՄೳ
    ·ͱΊ
    

    View Slide

25. • Sentinel Ͱ΋ Terraform ͷ Policy as Code ͕Մೳ
    • FiNC Ͱ͸ Kubernetes ͷ manifest ͷνΣοΫʹ΋
    Conftest Λ༻͍͍ͯΔͨΊ Conftest Λ࠾༻
    ͪͳΈʹʜ
    

    View Slide