5FSSBGPSNͷϨϏϡʔΛ$POGUFTUͰࣗಈԽ͢ΔTerraform meetup ONLINE #2021.02Ryo Kubota @ryok6t
View Slide
• Ryo Kubota (@ryok6t)• FiNC Technologies• SRE Team manager• Terraformྺ1΄Ͳࣗݾհ
• 50ͷϚΠΫϩαʔϏε͕ AWS ্ʹଘࡏ• ϚΠΫϩαʔϏεͷΠϯϑϥΛ Terraform Ͱཧ• αʔϏεͱڥ͝ͱʹಠཱͨ͠ state Λอ༗લఏ4UBHJOHUGTUBUF1SPEVDUJPOUGTUBUFαʔϏε"4UBHJOHUGTUBUF1SPEVDUJPOUGTUBUFαʔϏε#ʜ
• ϚΠΫϩαʔϏεͷΠϯϑϥΛ։ൃऀʹҕৡ͢Δͱ͍͏ࢥ͔Β Terraform Λಋೖ• 2000ݸͷطʹ࡞ΒΕͯ͠·͍ͬͯͨϦιʔεΛ શͯ import ͠ɺαʔϏεͱڥ͝ͱʹׂલ*B$ͳͲແ͔ͬͨ
• Terraform Λಋೖ͠ɺ։ൃऀ HCL Λॻ͍ͯ ϓϧϦΫΤετΛग़ͤΠϯϑϥʹมߋΛՃ͑ΒΕΔΑ͏ʹͳͬͨ• ࢥʹҰา͍ۙͨഎܠ
• ࣭ͷ୲อͷͨΊɺϨϏϡʔ΄ͱΜͲ SRE ͕୲• ϨϏϡʔ͕ແࢹͰ͖ͳ͍ίετʹݟ͖͑ͯͨ৽ͨͳ՝
• ຊདྷͷϚΠΫϩαʔϏεͷֶͱͯ͠ɺ֤νʔϜ͕ΠϯϑϥͷมߋؚΊͯ։ൃΛεϐʔσΟʹճ͍͚ͯ͠Δ͖• ϨϏϡʔؚΊͯҕৡ͍͖͍ͯͨ͠ຊདྷͷࢥʹཱͪฦΔͱʜ
• ͦΕͳΓʹෳࡶͳઃఆ͕ඞཁʹͳΔέʔε• Ճ͑ͯɺTerraform/AWS ͷࣝݸਓ/νʔϜʹΑͬͯҟͳΔҕৡ؆୯Ͱͳ͍
• FiNC ͰαʔϏεؒͷඇಉظ௨৴ʹ Amazon SNS/SQS Λ༻• ෳࡶͳઃఆ͕ඞཁ"NB[PO4/4424ͷྫ
• αʔϏεA ʹ SNS topic Λ࡞• αʔϏεA ͷ IAM policy ʹ SNS topic ͷݖݶΛՃ• αʔϏεB ʹ SQS queue Λ࡞• αʔϏεB ͷ IAM policy ʹ SQS queue ͷݖݶΛՃ• SQS queue ͷ policy ʹ SNS topic ͷݖݶΛՃ• SNS topic ͱ SQS queue Λඥ͚ͮΔ resource ΛՃ4/4424ͷઃఆ߲ଟ͍
• ίετूܭ Datadog ͰͷॲཧͷͨΊʹ tag ΛٛԽ͍ͯ͠Δ• λά͚ͳͲͷϕετϓϥΫςΟεશһ͕Ѳ͍ͯ͠ΔΘ͚Ͱͳ͍5BHͷྫ
• શαʔϏεͰͷ࣭ͷ୲อ͕ࠔʹ• HCL ͷߏจ্ແ͍͜ͱ͕ଟ͍ͷͰɺTerraformͰݕͰ͖ͳ͍• ͋͘·Ͱҙຯ্ͷ• e.g. tag ͕ແͯ͘વ apply ՄೳϨϏϡʔΛҕৡ͢Δͱʜ
• ֤αʔϏεͷࣗԽͱશମͷ࣭ͷτϨʔυΦϑʹ• ϨϏϡʔҕৡ͍ͨ͠ʢࣗԽ͍ͨ͠ʣ͕ɺ ࣭୲อ͍ͨ͠• ͳΜΒ͔ͷΈΛ༻͍ͯࣗಈԽ͢Δඞཁ͋Γ࣭ͱࣗԽͷτϨʔυΦϑʁ
• CircleCI Ͱ terraform plan Λ͢Δࡍʹɺઃఆʹ͕ແ͍͔ΛࣗಈͰνΣοΫ͢Δ• Open Policy Agent(OPA) Λར༻ͯ͜͠ΕΛୡղܾࡦ
• OSS ͷϙϦγʔΤϯδϯ• CNCF ͷ Graduation project• Rego ͱݺΕΔϙϦγʔهड़ݴޠΛͬͯϙϦγʔΛఆٛ01"ͱʁ
01"ͷΠϝʔδ:".-+40/ͳͲͷσʔλ3FHP1PMJDZೖྗఆ
• ηϚϯςΟΫεతͳͷݕΛࣗಈԽՄೳ• ஞҰʮtag ͍ͭͯͳ͍Αʂʯͱ͔ࢦఠ͕ෆཁ• Policy as Code ͕࣮ݱՄೳ• ϙϦγʔΛ໌จԽ 㱻 ଐਓԽ• ϙϦγʔίʔυͱͯ͠։ൃՄೳ01"Λ͏ͱԿ͕خ͍͠ͷ͔
• CircleCI ্Ͱ Conftest ͱ͍͏ OPA ͷπʔϧΛ࣮ߦ• Conftest ͱʁ• ୯ͳΔ OPA ͷϢʔβʔΠϯλʔϑΣʔε• ࣮ࡍͷ࡞ۀ΄΅ OPA ͕࣮ߦ࣮ࡍͲ͏͍ͬͯΔͷ͔
• plan ݁ՌΛ JSONʹͯ͠ೖྗ͢Δ• terraform plan -out plan.tfplan• terraform show -json plan.tfplan | conftest test -5FSSBGPSNͰͷ$POGUFTU
5FSSBGPSNQMBOͷ+40/ϦιʔεͱͦΕʹର͢ΔมߋҰཡՃ͑Δૢ࡞ʢDSFBUF VQEBUFͳͲʣϦιʔεͷใมߋલมߋޙͷঢ়ଶ
ϙϦγʔͷྫʢUBHʣඞਢʹ͍ͨ͠UBHSFTPVSDF@DIBOHFTΛϧʔϓҰͭͰຬ͍ͨͯ͠ͳ͍ͷ͕͋ΕWJPMBUJPO
• action ͱϦιʔεͷछྨ͔ΒมߋͷӨڹൣғΛܭࢉ• ͦΕʹΑͬͯϨϏϡϫʔΛมߋଞʹ͜Μͳ͜ͱʜ
• Policy as Code: ϙϦγʔΛίʔυͱͯ͠ѻ͏• Rego ͷจ๏ʹΫη͕͋ΔͨΊɺςετ͕ॏཁ• OPA ͰϙϦγʔͷςετ༻ϑϨʔϜϫʔΫ͕ଘࡏ͠ɺ؆୯ʹςετ͕ՄೳϙϦγʔςετՄೳ
• ϚΠΫϩαʔϏεʹ͓͍ͯαʔϏεͷࣗੑͱશମͷ࣭ͷ୲อ͕τϨʔυΦϑʹͳΓ͍͢• ҆શͰߴͳ։ൃͷͨΊʹɺPolicy as Code ʹΑΔηϚϯςΟΫεݕূͷࣗಈԽ͕༗ޮ• Conftest Λ͏͜ͱͰ͜ΕΛ࣮ݱՄೳ·ͱΊ
• Sentinel Ͱ Terraform ͷ Policy as Code ͕Մೳ• FiNC Ͱ Kubernetes ͷ manifest ͷνΣοΫʹConftest Λ༻͍͍ͯΔͨΊ Conftest Λ࠾༻ͪͳΈʹʜ