GitHub Actions でTerraformを 安全に実行する仕組み

8.8K Views

September 01, 23

スライド概要

シェア

またはPlayer版

埋め込む »CMSなどでJSが使えない場合

関連スライド

各ページのテキスト
1.

SRE Lounge #15 GitHub Actions 2023/08/31 証券コード:2980 © 2023 SRE Holdings Corporation © 2023 SRE Holdings Corporation Terraform

2.

SRE Holdings 2014 2019 SRE / DX IT AI DX © 2023 SRE Holdings Corporation 2

3.

( • @kota65535) • • ⁃ ⁃ ⁃ ⁃ CI/CD ⁃ © 2023 SRE Holdings Corporation 3

4.

Agenda • • • ⁃ Plan ⁃ Plan ⁃ Apply & Apply • © 2023 SRE Holdings Corporation 4

5.

© 2023 SRE Holdings Corporation

6.

CI/CD with Terraform • main Push terraform apply © 2023 SRE Holdings Corporation 6

7.

• Plan Auto Approve ⁃ ⁃ 1: • target ⁃ ⁃ • https://developer.hashicorp.com/terraform/tutorials/state/resource-targeting ⁃ 2: Plan • Apply ⁃ ⁃ © 2023 SRE Holdings Corporation 7

8.

• Plan Slack Apply • • or Apply © 2023 SRE Holdings Corporation 8

9.

© 2023 SRE Holdings Corporation

10.

© 2023 SRE Holdings Corporation 10

11.

1. Plan ⁃ main Push ⁃ terraform plan 2. Plan ⁃ Plan ⁃ Plan & Apply Slack Apply 3. Apply ⁃ OK ⁃ Plan Slack Bot terraform apply © 2023 SRE Holdings Corporation 11

12.

Plan © 2023 SRE Holdings Corporation

13.

Plan • main Push • terraform plan Plan © 2023 SRE Holdings Corporation 13

14.

Plan • main Push name: Plan to dev on: push: branches: - main ... © 2023 SRE Holdings Corporation 14

15.

Plan • terraform plan Plan jobs: plan: steps: ... - name: Run terraform init run: terraform init - name: Run terraform plan run: terraform plan -out tfplan - name: Upload plan file uses: actions/upload-artifact@v3 with: name: Terraform plan file path: tfplan Plan Plan ... © 2023 SRE Holdings Corporation 15

16.

Plan © 2023 SRE Holdings Corporation & Apply

17.

Plan • Plan • & Apply Slack Apply © 2023 SRE Holdings Corporation 17

18.

Plan Slack Plan • jobs: plan: ... after-plan: needs: - plan steps: - name: Notify terraform plan result to slack uses: kota65535/github-terraform-plan-slack-action@v1 id: plan-result with: plan-job: plan terraform plan plan-step: Run terraform plan channel: infra-dev Slack ... © 2023 SRE Holdings Corporation 18

19.

Plan • Plan © 2023 SRE Holdings Corporation 19

20.
[beta]
Apply
Slack

•
after-plan:
needs:
- plan
steps:
...

- name: Ask if apply workflow should be run
should-apply true
if: steps.plan-result.outputs.should-apply == 'true'
uses: kota65535/github-workflow-dispatch-slack-action@v1
with:
workflow: apply-dev.yml
inputs: '{"plan-workflow-run-id":"${{ github.run_id }}","commit":"${{ github.sha }}"}'
channel: infra-dev
Slack

© 2023 SRE Holdings Corporation

20

21.

Apply • Slack • OK Slack User Interaction (Apply to dev) © 2023 SRE Holdings Corporation 21

22.

Apply © 2023 SRE Holdings Corporation

23.

Apply • OK Slack Bot • Plan terraform apply © 2023 SRE Holdings Corporation 23

24.
[beta]
Apply
•

User Interaction
⁃

•

Slack Bot

cf. https://qiita.com/odm_knpr0122/items/04c342ec8d9fe85e0fe9

Request URL
⁃
⁃

•

Slack Bot

Slack

POST

Endpoint URL

API Gateway

URL

Veri cation Token
⁃

Endpoint Public

⁃

Slack Bot

{
"choice": true,
"request": {
"owner": "sre-aip",
"repo": "sample-basic",
"workflow_id": "apply-dev.yml",
...
}
}
}

© 2023 SRE Holdings Corporation

24

25.

Apply Terraform • AWS Slack User Interaction API Gateway, Lambda module "github_workflow_dispatch_slack" { source = "kota65535/github-workflow-dispatch-slack/aws" version = "0.1.0" github_token = "aaaaaaaa" slack_verification_token = "bbbbbbbb" } © 2023 SRE Holdings Corporation 25

26.

Apply Work ow Dispatch • ⁃ Plan ⁃ Plan Run ID name: Apply to dev on: workflow_dispatch: inputs: commit: description: Commit hash type: string plan-workflow-run-id: description: Plan workflow run ID type: string required: false ... © 2023 SRE Holdings Corporation 26

27.

Apply • Plan terraform apply jobs: apply: steps: ... - name: Download plan file if run ID given uses: dawidd6/action-download-artifact@v2 with: run_id: ${{ github.event.inputs.plan-workflow-run-id }} name: Terraform plan file path: terraform/envs/${{ env.ENV }} - name: Run terraform init run: terraform init - name: Run terraform apply Apply run: terraform apply tfplan © 2023 SRE Holdings Corporation Plan 27

28.

© 2023 SRE Holdings Corporation

29.

• ⁃ CI/CD ⁃ Slack Terraform Plan Apply • Plan Apply • ⁃ ⁃ ⁃ ChatOps GitHub Action Slack Bot Terraform Module ⁃ © 2023 SRE Holdings Corporation 29

30.

• github-terraform-plan-slack-action ⁃ • github-work ow-dispatch-slack-action ⁃ • Terraform Plan GitHub Action Work ow Slack terraform-aws-github-work ow-dispatch-slack ⁃ GitHub Action Work ow Terraform Module © 2023 SRE Holdings Corporation Slack API Gateway + Lambda 30

31.

© 2023 SRE Holdings Corporation