Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Terraform交通整備 〜大事故を防ぐために〜
Search
coconala_engineer
December 10, 2023
0
49
Terraform交通整備 〜大事故を防ぐために〜
2023/12/05 Next Year Con for SRE の資料です
https://timeedev.connpass.com/event/302385/
coconala_engineer
December 10, 2023
Tweet
Share
More Decks by coconala_engineer
See All by coconala_engineer
IaC運用を続けて出会うイシューたち
coconala_engineer
0
67
CDN+αの利活用でサイトの高速化を実現してみた
coconala_engineer
0
66
SIEMを用いて、セキュリティログ分析の可視化と分析を実現し、PDCAサイクルを回してみた
coconala_engineer
0
440
CircleCIを活用して AWSへの継続的デリバリーを 実践する
coconala_engineer
1
260
技術広報経験0のEMがエンジニアブランディングをはじめてみた
coconala_engineer
1
350
開発生産性運用上の課題と 上流工程まで視野に入れた改善の取り組み
coconala_engineer
1
370
「しでかした」右も左もわからないと こんなミスもできる!
coconala_engineer
0
22
1年間のレビューの中からTOP3を紹介!
coconala_engineer
0
16
PagerDutyを活用したオンコール運用の軌跡(ココナラ編)
coconala_engineer
1
980
Featured
See All Featured
Building Your Own Lightsaber
phodgson
100
5.7k
Building Flexible Design Systems
yeseniaperezcruz
320
37k
Imperfection Machines: The Place of Print at Facebook
scottboms
261
12k
KATA
mclloyd
16
12k
Keith and Marios Guide to Fast Websites
keithpitt
408
22k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
rmw
26
2.3k
Designing with Data
zakiwarfel
96
4.8k
The Illustrated Children's Guide to Kubernetes
chrisshort
32
47k
Optimizing for Happiness
mojombo
370
69k
StorybookのUI Testing Handbookを読んだ
zakiyama
13
4.7k
The Invisible Customer
myddelton
114
12k
Side Projects
sachag
451
41k
Transcript
Copyright coconala Inc. All Rights Reserved. Terraformަ௨උ ʙେࣄނΛ͙ͨΊʹʙ γεςϜϓϥοτϑΥʔϜ෦ ΠϯϑϥɾSREνʔϜ
TeamManager ٢ݟ
Copyright coconala Inc. All Rights Reserved. 2 ࣗݾհ ٢ݟʢΑ͔͠Θ ͨ͘Έʣ
• ੜ·Ε ੩Ԭ → จܥେֶ͔ΒΤϯδχΞ • ܦྺ ۚ༥SIer → ελʔτΞοϓ → ίίφϥ • झຯ ϥΠϒɾΠϕϯτʹߦ͘
Vision Ϗδϣϯɺϛογϣϯʹج͍ͮͨࣄۀΛల։ νʔϜ͕ߏங͍ͨ͠ͱࢥ ͏࠷ྑͳະདྷͷΠϝʔδ νʔϜ͕ߏங͍ͨ͠ͱࢥ ͏࠷ྑͳະདྷͷΠϝʔδ Mission νʔϜ͕࣮ݱ͍ͨ͠த৺ తͳతʢଘࡏҙٛʣ ҰਓͻͱΓ͕ʮࣗͷετʔϦʔʯΛੜ͖͍ͯ͘ੈͷதΛ࡞Δ
ݸਓͷࣝɾεΩϧɾܦݧΛՄࢹԽ͠ɺ ඞཁͱ͢Δͯ͢ͷਓʹ݁ͼ͚ͭɺ ݸਓΛΤϯύϫʔϝϯτ͢ΔϓϥοτϑΥʔϜΛఏڙ͢Δ ࣝɾεΩϧɾܦݧͷϚονϯάαʔϏεΛల։ ࣄۀ༰ 3
ࣄɾൿॻɺܦཧɺਓࣄɺCSɺϚʔέςΟϯάɺσβΠϯɾ੍࡞ͳͲ ͷਓखෆΛղফ اۀ๊͕͑Δ༷ʑͳܦӦ՝Λɺ ܦݧݟͷ๛ͳϓϩਓࡐΛ׆༻͢Δ͜ͱͰղܾ ඞཁͳ͚ͩ࣌ؒ՝ۚͰ Ϗδωεߦͯ͘͠Ε͑ΔਓΛհ ϋΠΫϥεͷۀҕୗ ίϯαϧλϯτΛհ ઐελοϑΛ௨ͯ͡ɺݫબͨ͠ඇެ։ͷ໊࣮τοϓΫϦΤΠλʔ ϩΰಈըɺϗʔϜϖʔδͳͲͷσβΠϯɾ੍࡞ܥͷδϟϯϧ
Λఏڙ͠ΫϦΤʔλʔෆΛղফ ίίφϥ͕ܖओମͱͳΓ ϋΠΫϥε໊࣮ΫϦΤΠλʔΛհ ๏Q&AΛແྉͰӾཡɾߘͰ͖ɺ4,000໊Ҏ্ͷหޢ࢜Λ ɾҬผͰݕࡧɾ͍߹Θ͕ͤՄೳʢࠂܝࡌ՝ۚϞσϧʣ ITਓࡐͷۀҕୗ ΤʔδΣϯτ หޢ࢜ͱϢʔβʔͷ ϚονϯάαʔϏε ECܕͷαʔϏε ϚʔέοτϓϨΠε ϚονϯάαʔϏε ֓ཁ 4 Ϗδωεతͷߪೖʹ ಛԽͨ͠αʔϏε ITϑϦʔϥϯεͱاۀΛϚονϯάɻεΩϧϚʔέοτɾ ςοΫΤʔδΣϯτ྆ํͰͷධՁσʔλΛ࿈ܞɾ׆༻༧ఆ
Copyright coconala Inc. All Rights Reserved. 5 ͖͔͚ͬ
Copyright coconala Inc. All Rights Reserved. 6 6ͷࢥ͍͕ίʔυʹڽॖ͞Ε͍ͯͨ ɾ࣮ͨ࣌͠୲ऀόϥόϥ →
ͦͷͨΊ͓ͷ͓ͷͷࢥ͏ߏ͕ݱࡏ·Ͱͬͨ ɾ໋໊༳Ε͕ଟ͍ → module/awsͳͷ͔aws/moduleͳͷ͔ ɾmoduleͱͯ͠࡞͍ͯ͠Δ͕தresource͕1ͭ͋Δ͚ͩͱ͍͏͜ͱ ͕··͋Δ → moduleͷ༗༻ੑ͕Θ͔Βͣʹ࣮͞Ε͍ͯΔ ɾಉ͡ίʔυ͕module֎ʹهड़͞Ε͍ͯͯɺmoduleͷςΠΛͳ͍ͯ͠ͳ ͔ͬͨ → ෆཁͳίʔυ͕ٯʹࠞཚΛট͍ͨ
Copyright coconala Inc. All Rights Reserved. 7 applyͰαʔϏεμϯͤͯ͞͠·ͬͨ • मਖ਼ϛεͰλʔήοτάϧʔϓ͕֎ΕΔࠩΛݟམͱͨ͠
• deleteʹහײ͕ͩͬͨɺchangeͩͬͨͷ͕᠘ ~ resource "aws_autoscaling_group" "api_production" { + force_delete_warm_pool = false id = "api-prod" ~ launch_configuration = "api-prod_v1" -> "api-prod_v2" name = "api-prod" ~ target_group_arns = [ - "arn:aws:elasticloadbalancing:ap-northeast-1:XXX:targetgroup/api/v2” ]
Copyright coconala Inc. All Rights Reserved. 8 ੳͱֶͼ • ͻͱͭͷPRͰෳͷରॲΛͨ͠
◦ ϦϑΝΫλ + terraformόʔδϣϯΞοϓ + ຊདྷͷมߋ ◦ ຊདྷ͋Δ͖planͷ͕ࠩݟ͑ͮΒ͘ͳͬͨ • ίʔυ͕ݹ͗ͯ͢ϦϑΝΫλͤ͟ΔΛಘͳ͔ͬͨ • terraformόʔδϣϯ͕దʹཧͰ͖͍ͯͳ͔ͬͨ • োޙʹݪҼ͕ຊ࡞ۀͰ͋Δ͜ͱΛ͑Δ·Ͱʹ࣌ؒΛཁͨ͠ ◦ ୭͕͍ͭͬͨͷ͔ه͞Εͳ͍
Copyright coconala Inc. All Rights Reserved. 9 ରࡦ • ίʔυͷෛ࠴Λղফ
• దͳόʔδϣϯཧ • plan / applyͷΈڧԽ • ӡ༻໘Ͱͷվળ
Copyright coconala Inc. All Rights Reserved. 10 ίʔυෛ࠴ղফ
Copyright coconala Inc. All Rights Reserved. 11 ίʔυͷෛ࠴Λղফ ɾεςʔτϑΝΠϧΛͲͷΑ͏ʹ͚Δ͔Λ ߟ͑Δ
ɾαʔϏε / module ϨϕϧͰಉ༷ͷߏΛ ͱΔΑ͏ʹ͢Δ ɾਖ਼ղͳ͘ɺߏมߋΛߟ͑Δ ɾ৽ن࡞͔Βద༻͠ɺաڈͷͷਵ࣌ Ҡߦ͍ͯ͘͠
Copyright coconala Inc. All Rights Reserved. 12 ίʔυͷෛ࠴Λղফ ɾαʔϏε͝ͱʹཧϦϙδτϦɾAWSΞΧϯτΛ ͍ͯ͠Δ
ɾ৽αʔϏεΛཱͯΔͱ͖ʹVPCRDSͳͲɺಉ͡Α͏ ͳͷͷίʔυΛϓϦηοτͱ͍ͯ͠Δؾ͕ͨ͠ → ڞ௨moduleʹҠಈ ɾ·ͣ৽ཱͯ͘͠ΔαʔϏεΛڞ௨module ɾطଘαʔϏεΛimportͰҠ২ ɾmoduleΧϯϖΩͰ͋Δඞཁͳ͍
Copyright coconala Inc. All Rights Reserved. 13 దͳόʔδϣϯཧ
Copyright coconala Inc. All Rights Reserved. 14 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯ͝ͱʹ͖͢ػೳվળ͓ΑͼҰ෦deprecation͕ߦΘΕ͍ͯΔ •
null_resourceͷඪ४Խʢ1.4ʣ • importϒϩοΫಋೖʢ1.5ʣ • testίϚϯυരʢ1.6ʣ
Copyright coconala Inc. All Rights Reserved. 15 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯ͝ͱʹ͖͢ػೳվળ͓ΑͼҰ෦deprecation͕ߦΘΕ͍ͯΔ •
null_resourceͷඪ४Խʢ1.4ʣ • importϒϩοΫಋೖʢ1.5ʣ • testίϚϯυരʢ1.6ʣ → ࠷ݶEOLରԠɺՄೳͰ͋Ε࠷৽൛͕·͍͠
Copyright coconala Inc. All Rights Reserved. 16 దʹόʔδϣϯΞοϓΛ͔͚Δ ϓϩόΠμਵ࣌ߋ৽͞Ε͍ͯΔʢؾ͍ͮͨΒ৽͘͠ͳ͍ͬͯΔϨϕϧʣ •
hashicorp/aws ◦ 2ϲ݄Ͱ14όʔδϣϯϦϦʔε͍ͯ͠Δʢ5.18.0 → 5.28.0ʣ • hashicorp/google ◦ 2ϲ݄Ͱ10όʔδϣϯϦϦʔε͍ͯ͠Δʢ4.83.0 → 5.7.0ʣ
Copyright coconala Inc. All Rights Reserved. 17 దʹόʔδϣϯΞοϓΛ͔͚Δ ϓϩόΠμਵ࣌ߋ৽͞Ε͍ͯΔʢؾ͍ͮͨΒ৽͘͠ͳ͍ͬͯΔϨϕϧʣ •
hashicorp/aws ◦ 2ϲ݄Ͱ14όʔδϣϯϦϦʔε͍ͯ͠Δʢ5.18.0 → 5.28.0ʣ • hashicorp/google ◦ 2ϲ݄Ͱ10όʔδϣϯϦϦʔε͍ͯ͠Δʢ4.83.0 → 5.7.0ʣ → terraformͷόʔδϣϯͱ࿈ಈ͍ͯ͠Δͱߟ͑ɺ͋Θͤͯ͋͛Δ → όά͕ࠞೖ͞ΕΔ͜ͱ͕͋ΔͨΊύονόʔδϣϯ্͕͕ͬͨΒૣ͋ͯ͘Δඞཁ͋Γ
Copyright coconala Inc. All Rights Reserved. 18 దʹόʔδϣϯΞοϓΛ͔͚Δ όʔδϣϯΞοϓπʔϧҎԼ͕ީิ •
dependabot • tfupdate • renovate • ࣗલͷεΫϦϓτ
Copyright coconala Inc. All Rights Reserved. 19 దʹόʔδϣϯΞοϓΛ͔͚Δ ͦΕͧΕʹྑ͠ѱ͠ •
dependabot ◦ GithubΛར༻͍ͯ͠ΕͬͱؾܰʹಋೖՄೳ ◦ PR͕େྔʹͰ͖ΔՄೳੑ͋Γ • tfupdate ◦ terraformͱϓϩόΠμͱผʑʹ্͛Δ͜ͱ͕Մೳ ◦ recursiveʹมߋͰ͖Δ • renovate ◦ tfenvΛར༻͍ͯ͠Δέʔεͷʮ.terraform-versionʯߋ৽ର ◦ ʮ.terraform.lock.hclʯΑ͠ͳʹߋ৽
Copyright coconala Inc. All Rights Reserved. 20 దʹόʔδϣϯΞοϓΛ͔͚Δ ͦͷ΄͔ͷߟྀϙΠϯτ •
࣮ߦස ◦ ߏมߋ͕ͲΕ͘Β͍ೖΔ͔ʹΑͬͯΑ͍ͱߟ͑Δ ◦ ίίφϥͰि࣍Ͱ·Θ͍ͯ͠Δ • PRΛ࡞͢Δͷπʔϧʹ͓ͤɺͨͩͦ͠ΕʹΑΔมߋ֬ೝ͢Δඞཁ͋Γ ◦ ࣍અҎ߱Ͱݴٴ
Copyright coconala Inc. All Rights Reserved. 21 plan / applyͷΈڧԽ
Copyright coconala Inc. All Rights Reserved. 22 ਓͷखΛۃྗհࡏͤ͞ͳ͍ & ద༻͕ʹݟ͑ΔΑ͏ʹ͢Δ
• ݱࡏͷӡ༻ ◦ PRΛ࡞ → ࠩνΣοΫ͠plan݁ՌΛίϝϯτ·Ͱࣗಈ ◦ applyखಈͰ͋ΓɺmainϚʔδͱͷ߹ੑ͕͍͋͠
Copyright coconala Inc. All Rights Reserved. 23 ਓͷखΛۃྗհࡏͤ͞ͳ͍ & ద༻͕ʹݟ͑ΔΑ͏ʹ͢Δ
• ͜Μͳ࢟ʹ͠Α͏ͱ͍ͯ͠Δ ※ ઈࢍਐߦத ◦ merge / push͞Ε͕ͨ࠷ޙɺ apply͞ΕΔͪΐͬͱා͍ ◦ plan͕ҙຯΛͳ͢Α͏ʹ͢Δ ◦ ͍ͭมԽ͕ద༻͞Ε͔ͨɺ ◦ ୭͕ঝೝͨ͠ͷ͔Λه͢Δ
Copyright coconala Inc. All Rights Reserved. 24 ӡ༻໘Ͱͷվળ
Copyright coconala Inc. All Rights Reserved. 25 Τϥʔൃੜ֬ΛԼ͛Δ ਓͷʹΑΔΤϥʔͷ֬ΛԼ͛ΔΑ͏ͳϙϦγʔΛఆΊΔ •
ҰͷplanมߋྔΛԼ͛Δ ◦ ಛੑͷҟͳΔมߋผʑͷPRΛͨͯΔ ◦ ͍ͭͰʹͳʹ͔Λ͍Εͳ͍ • ϨϏϡʔڧԽ ◦ Ͳ͏ͯ͠ଟ͘ͳΔͱ͖ηϧϑϨϏϡʔඞਢͱ͢Δ ▪ ࣮ଶͱͯ͠ͷมߋΛਤࣔ͢ΔɺηϧϑϨϏϡʔίϝϯτΛ͢ͳͲ ◦ ϨϏϡΞʔʮQuestionʯΛ͔͚͛Δ ▪ ॳาతͳ͜ͱͰͳΜͰ͍͍ ▪ Ή͠ΖԿؾͳ͍͜ͱ͕ҙ֎ͱॏେͳ͜ͱͩͬͨ͜ͱ͋Δ → ͲΜͳʹؤுͬͯ100%ͷ୲อͱஅݴग़དྷͳ͍
Copyright coconala Inc. All Rights Reserved. 26 ςετͷݕ౼ ͍ΘΏΔςετπʔϧͰ͋ΔTerratestෆ࠾༻ •
ಈతςετͰ͋Γɺͱ͘ʹ୲อ͍ͨ͠ϙΠϯτʹޮ͔ͳ͍ ◦ applyͨ͠Βࣄނ͕ى͖ͨͷͰɺͦͷલʹݕ͍ͨ͠ͱ͍͏ಈػ͕ڧ͍ ▪ ࣄલʹݕͳΒvalidationͳͲ΄͔ͷํ๏͕·͞Δ ◦ ςετίʔυΛॻͨ͘ΊͷͦΕͳΓ ▪ ͦΕʹݟ߹͏୲อ͕Ͱ͖ͳ͍ → จ௨ΓʹͰ͖ͨ͜ͱΛ୲อ͢Δ ΑΓ ΨʔυϨʔϧ͕֑͔͋ͬͯΒམͪͳ͍ ঢ়گΛ࡞Γ͍ͨ
Copyright coconala Inc. All Rights Reserved. 27 ςετͷݕ౼ ΨʔυϨʔϧͷྫ •
preconditionΛهࡌ • Open Policy AgentͷΈࠐΈ ※ઈࢍਐߦத ◦ ҰྫɿLBʹඥͮ͘λʔήοτάϧʔϓ͕θϩNG ◦ Terraform CloudΛಋೖ͍ͯ͠ΕɺCloudͷػೳͷҰͰΈࠐΈՄೳ ◦ ίίφϥTerraform CloudΛಋೖ͍ͯ͠ͳ͍ͨΊɺGithubActionsͷϑϩʔʹΈࠐΈ ༧ఆ • Sentinel ◦ Terraform Cloudݶఆ • terraform-compliance ◦ BDDͰهࡌ → ͜ΕΒΛCIʹΈࠐΜͰະવʹࣄނΛ͙
Copyright coconala Inc. All Rights Reserved. 28 ·ͱΊ • ίʔυͷෛ࠴Λղফ
◦ γεςϜͷม༰ͱڞʹϕετͳߏߟ͑͢ • దͳόʔδϣϯཧ ◦ GA࠷৽൛Λར༻͢Δͷ͕ͨΓલʹ • plan / applyͷΈڧԽ ◦ ਓҝతͳϛεͷՄೳੑΛՄೳͳݶΓഉআ • ӡ༻໘Ͱͷվળ ◦ ӡ༻໘ʹϙϦγʔΛ ◦ ώτͷೖΕସ͑ͳͲͰܧଓతʹߦ͏ඞཁ͕͋Δ
ίίφϥ ΤϯδχΞͷX(Twitter) X /Twitterʢ@coconala_engʣ https://twitter.com/coconala_eng We are hiring!! ࠾༻ϗʔϜϖʔδ https://coconala.co.jp/recruit
ΤϯδχΞ࠾༻ϗʔϜϖʔδ https://coconala.co.jp/recruit/engineer ίίφϥͷਓͱ৫Λ͑Δϒϩά ίίφϥLIVE https://blog.coconala.co.jp/m/m4e4abe8b17e5 ਓੜͷՄೳੑΛ͛ͨϢʔβʔετʔϦʔ Θͨ͠ͷεΩϧղ์ه https://blog.coconala.co.jp/m/me8a586112ad2 ίίφϥʹॴଐ͢ΔΤϯδχΞʹΑΔϒϩά ςοΫϒϩά https://zenn.dev/coconala 29