{"id":98123,"date":"2020-10-24T14:42:52","date_gmt":"2020-10-24T12:42:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/patterny-v-terraform-dlya-borby-s-haosom-i-ruchnoj-rutinoj-maksim-kostrikin-ixtens"},"modified":"2020-11-18T00:58:49","modified_gmt":"2020-11-17T22:58:49","slug":"patterny-v-terraform-dlya-borby-s-haosom-i-ruchnoj-rutinoj-maksim-kostrikin-ixtens","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/patterny-v-terraform-dlya-borby-s-haosom-i-ruchnoj-rutinoj-maksim-kostrikin-ixtens","title":{"rendered":"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/ec13125c702f42863bbe774cd805442b.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Na prvn\u00ed pohled se zd\u00e1, \u017ee v\u00fdvoj\u00e1\u0159i Terraform nab\u00edzej\u00ed dostate\u010dn\u011b pohodln\u00e9 osv\u011bd\u010den\u00e9 postupy pro pr\u00e1ci s infrastrukturou AWS. Existuje v\u0161ak jeden h\u00e1\u010dek. Postupem \u010dasu se zvy\u0161uje po\u010det prost\u0159ed\u00ed, v ka\u017ed\u00e9m se objevuj\u00ed specifika. V sousedn\u00edm regionu se objevuje t\u00e9m\u011b\u0159 kopie aplika\u010dn\u00edho stacku. A k\u00f3d Terraformu je t\u0159eba pe\u010dliv\u011b zkop\u00edrovat a upravit podle nov\u00fdch po\u017eadavk\u016f, nebo vytvo\u0159it sn\u011bhovou vlo\u010dku.<\/p>\n<p><\/p>\n<p>M\u00e1 prezentace se zam\u011b\u0159uje na vzory v Terraformu jako zp\u016fsob, jak se vypo\u0159\u00e1dat s chaosem a ru\u010dn\u00edmi rutinn\u00edmi \u010dinnostmi ve velk\u00fdch a dlouh\u00fdch projektech.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Video:<\/p>\n<p>\n<center><iframe loading=\"lazy\" width=\"560\" height=\"315\" src=\"https:\/\/embedd.srv.habr.com\/iframe\/5f92845c017bf613f0899d88\" frameborder=\"0\" allowfullscreen><\/iframe><\/center><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/8c67c45e486d6c03793dd08c33a16313.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Je mi 40 let, v IT pracuji 20 let. 12 let pracuji ve spole\u010dnosti Ixtens. Zab\u00fdv\u00e1me se v\u00fdvojem zam\u011b\u0159en\u00fdm na ecommerce. A 5 let praktikuji DevOps postupy.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/8b14b3adaa45d69278d76580baa99042.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>M\u016fj p\u0159\u00edb\u011bh bude o zku\u0161enosti z projektu ve firm\u011b, jej\u00ed\u017e n\u00e1zev nebudu zve\u0159ej\u0148ovat z d\u016fvodu dohody o ml\u010denlivosti. <\/p>\n<p><\/p>\n<p>\u010c\u00edsla na sn\u00edmku jsou uvedena, abychom pochopili rozsah projektu. A v\u0161e, co budu d\u00e1le \u0159\u00edkat, souvis\u00ed s Amazonem.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/3742217a2abaf1fcf2163979d82eac14.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Do tohoto projektu jsem se p\u0159ipojil p\u0159ed 4 lety. V t\u00e9 dob\u011b prob\u00edhaly z\u00e1sadn\u00ed refaktorizace infrastruktury, proto\u017ee projekt se rozrostl. A vzory, kter\u00e9 byly pou\u017eity, u\u017e nevyhovovaly. Vzhledem k pl\u00e1novan\u00e9mu r\u016fstu projektu bylo pot\u0159eba p\u0159ij\u00edt s n\u011b\u010d\u00edm nov\u00fdm. <\/p>\n<p><\/p>\n<p>D\u011bkuji Matveyovi, kter\u00fd v\u010dera mluvil o tom, co se d\u011blo v Dodo Pizza. To, co se d\u011blo u n\u00e1s p\u0159ed 4 lety. <\/p>\n<p><\/p>\n<p>P\u0159i\u0161li v\u00fdvoj\u00e1\u0159i a za\u010dali vytv\u00e1\u0159et infrastrukturn\u00ed k\u00f3d. <\/p>\n<p><\/p>\n<p>Nejz\u0159ejm\u011bj\u0161\u00ed d\u016fvody, pro\u010d to bylo pot\u0159eba, byly zaji\u0161t\u011bn\u00ed doby uveden\u00ed na trh. Muselo se ud\u011blat tak, aby t\u00fdm DevOps nebyl \u00fazk\u00fdm hrdlem b\u011bhem nasazen\u00ed. A krom\u011b toho byly na nejni\u017e\u0161\u00ed \u00farovni pou\u017eity Terraform a Puppet.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/13d6df6a324d2e1162acef77ca2ad0dc.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Terraform je open source projekt spole\u010dnosti HashiCorp. A pro ty, kte\u0159\u00ed nev\u011bd\u00ed, co to je, n\u00e1sleduj\u00edc\u00ed sn\u00edmky. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/61726d4205d1f4f8e449fe9d71507508.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Infrastruktura jako k\u00f3d znamen\u00e1, \u017ee m\u016f\u017eeme pops\u00e1t na\u0161i infrastrukturu a po\u017e\u00e1dat n\u011bjak\u00e9 roboty, aby vytvo\u0159ili zdroje, kter\u00e9 jsme popsali.<\/p>\n<p><\/p>\n<p>Nap\u0159\u00edklad pot\u0159ebujeme <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/vps\/abuzoustojchivye-vps\/\"   title=\"virtu\u00e1ln\u00ed stroj\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4196\">virtu\u00e1ln\u00ed stroj<\/a>. Pops\u00e1me to, p\u0159id\u00e1me n\u011bkolik povinn\u00fdch parametr\u016f. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/eb52c1e458fa092bba8577fffceb864c.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Po tom nastav\u00edme p\u0159\u00edstup k Amazonu v konzoli. A po\u017e\u00e1d\u00e1me Terraform o pl\u00e1n. Terraform pl\u00e1n ozn\u00e1m\u00ed: \u201eDob\u0159e, pro v\u00e1\u0161 zdroj m\u016f\u017eeme ud\u011blat tyto v\u011bci\u201c. A minim\u00e1ln\u011b jeden zdroj bude p\u0159id\u00e1n. A \u017e\u00e1dn\u00e9 zm\u011bny se nepl\u00e1nuj\u00ed. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/879e645596121ee5d05ac247b4be19ee.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Jakmile jste se v\u0161\u00edm spokojeni, m\u016f\u017eete po\u017e\u00e1dat o Terraform apply a Terraform pro v\u00e1s vytvo\u0159\u00ed instanci, a vy obdr\u017e\u00edte virtu\u00e1ln\u00ed stroj ve va\u0161em cloudu.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/77b7fe4d6abcc9116233f48caa887465.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>D\u00e1le se n\u00e1\u0161 projekt vyv\u00edj\u00ed. P\u0159id\u00e1v\u00e1me do n\u011bj n\u011bjak\u00e9 zm\u011bny. Po\u017eadujeme v\u00edce instanc\u00ed, p\u0159id\u00e1v\u00e1me 53. z\u00e1znam.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/98ce7e1f9d1f85aa5e78c269a0708ac1.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A opakujeme. Po\u017e\u00e1d\u00e1me o pl\u00e1n. Vid\u00edme, jak\u00e9 zm\u011bny se pl\u00e1nuj\u00ed. Pou\u017eijeme je. A tak na\u0161e infrastruktura roste. <\/p>\n<p><\/p>\n<p>Terraform pou\u017e\u00edv\u00e1 n\u011bco jako stavy soubory. Tedy v\u0161echny zm\u011bny, kter\u00e9 odch\u00e1zej\u00ed na Amazon, ukl\u00e1d\u00e1 do souboru, kde pro ka\u017ed\u00fd prost\u0159edek, kter\u00fd jste popsali, existuj\u00ed odpov\u00eddaj\u00edc\u00ed prost\u0159edky, kter\u00e9 byly vytvo\u0159eny v Amazonu. T\u00edm p\u00e1dem p\u0159i zm\u011bn\u011b popisu n\u011bjak\u00e9ho prost\u0159edku Terraform p\u0159esn\u011b v\u00ed, co je t\u0159eba zm\u011bnit na Amazonu.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/6e83efffb7af6ab967b4716be170b47b.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Tyto stavy soubory byly p\u016fvodn\u011b prost\u011b soubory. A my je ukl\u00e1dali do Git, co\u017e bylo velmi nepohodln\u00e9. St\u00e1le n\u011bkdo zapom\u00ednal commitovat zm\u011bny a vznikalo mnoho konflikt\u016f. <\/p>\n<p><\/p>\n<p>Nyn\u00ed je mo\u017en\u00e9 pou\u017e\u00edt backend, tedy Terraformu se ur\u010duje, do jak\u00e9ho bucketu a pod jak\u00fdm kl\u00ed\u010dem je t\u0159eba ulo\u017eit stavov\u00fd soubor. A Terraform se postar\u00e1 o to, aby z\u00edskal tento stavov\u00fd soubor, provedl ve\u0161kerou magii a ulo\u017eil zp\u011bt fin\u00e1ln\u00ed v\u00fdsledek.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/e6687463a9fe3cff979f44ac7778b4e8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Na\u0161e infrastruktura roste. Tady je n\u00e1\u0161 k\u00f3d. A nyn\u00ed nechceme jen vytv\u00e1\u0159et virtu\u00e1ln\u00ed stroj, chceme m\u00edt testovac\u00ed prost\u0159ed\u00ed.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/0effb09fa04d3d520c1cdbb34ce97810.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Terraform umo\u017e\u0148uje vytvo\u0159it n\u011bco jako modul, tedy to sam\u00e9 popsat v n\u011bjak\u00e9 slo\u017ece.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/95c8395b10142fe550b0719161211f15.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A nap\u0159\u00edklad v testov\u00e1n\u00ed zavolat tento modul a z\u00edskat to sam\u00e9, jako bychom vykonali Terraform apply v samotn\u00e9m modulu. Pro testov\u00e1n\u00ed by byl takov\u00fd k\u00f3d.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/fa4c16e3835a4507a858d2ddb767daf3.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pro produkci m\u016f\u017eeme poslat n\u011bjak\u00e9 zm\u011bny, proto\u017ee v testov\u00e1n\u00ed nepot\u0159ebujeme velk\u00e9 instance, v produkci velk\u00e9 instance budou pr\u00e1v\u011b pot\u0159ebn\u00e9.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/19478de23da2278567e66bacef78a0a9.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A pak se vr\u00e1t\u00edm zp\u011bt do projektu. Byla to slo\u017eit\u00e1 \u00faloha, infrastruktura byla pl\u00e1nov\u00e1na jako velmi velk\u00e1. A bylo pot\u0159eba n\u011bjak rozlo\u017eit cel\u00fd k\u00f3d, aby to bylo pohodln\u00e9 pro v\u0161echny: jak pro ty, kte\u0159\u00ed prov\u00e1d\u00ed \u00fadr\u017ebu tohoto k\u00f3du, tak pro ty, kte\u0159\u00ed prov\u00e1d\u011bj\u00ed zm\u011bny. A pl\u00e1novalo se, \u017ee jak\u00fdkoli v\u00fdvoj\u00e1\u0159 m\u016f\u017ee j\u00edt a opravit infrastrukturu tak, jak pot\u0159ebuje pro svou \u010d\u00e1st platformy. <\/p>\n<p><\/p>\n<p>Tohle je strom adres\u00e1\u0159\u016f, kter\u00fd doporu\u010duje samotn\u00fd HashiCorp, pokud m\u00e1te velk\u00fd projekt a m\u00e1 smysl rozd\u011blit celou infrastrukturu na n\u011bjak\u00e9 mal\u00e9 kousky, a ka\u017ed\u00e9 kousky popsat v samostatn\u00e9 slo\u017ece. <\/p>\n<p><\/p>\n<p>S rozs\u00e1hlou knihovnou zdroj\u016f lze ve testov\u00e1n\u00ed a produkci volat p\u0159ibli\u017en\u011b to sam\u00e9. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/c30cdc3d3ce5441bc0ae4a485069dacc.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>V na\u0161em p\u0159\u00edpad\u011b to \u00fapln\u011b nevyhovovalo, proto\u017ee testovac\u00ed stack pro v\u00fdvoj\u00e1\u0159e nebo pro testov\u00e1n\u00ed bylo pot\u0159eba z\u00edsk\u00e1vat n\u011bjak jednodu\u0161eji. A necht\u011blo se n\u00e1m proch\u00e1zet slo\u017ekami, aplikovat to ve spr\u00e1vn\u00e9m po\u0159ad\u00ed a b\u00e1t se, \u017ee se nejprve spust\u00ed datab\u00e1ze a pot\u00e9 instance, kter\u00e1 tuto datab\u00e1zi pou\u017e\u00edv\u00e1. Proto se cel\u00e9 testov\u00e1n\u00ed spou\u0161t\u011blo z jedn\u00e9 slo\u017eky. Tam se volaly stejn\u00e9 moduly, ale v\u0161e prob\u00edhalo p\u0159i jednom b\u011bhu.<\/p>\n<p><\/p>\n<p>Terraform se star\u00e1 o v\u0161echny z\u00e1vislosti. A v\u017edy vytv\u00e1\u0159\u00ed zdroje v takov\u00e9m po\u0159ad\u00ed, aby bylo mo\u017en\u00e9 z\u00edskat IP adresu, nap\u0159\u00edklad od \u010derstv\u011b vytvo\u0159en\u00e9 instance, a m\u00edt tuto IP adresu v z\u00e1znamu route53. <\/p>\n<p><\/p>\n<p>Krom\u011b toho je platforma velmi rozs\u00e1hl\u00e1. A spu\u0161t\u011bn\u00ed testovac\u00edho stacku, i kdy\u017e na hodinu, i kdy\u017e na 8 hodin \u2013 je to dost n\u00e1kladn\u00e1 z\u00e1le\u017eitost. <\/p>\n<p><\/p>\n<p>A to jsme automatizovali. Job Jenkins umo\u017e\u0148oval spustit stack. Pot\u0159ebovalo se spustit pull request se zm\u011bnami, kter\u00e9 cht\u011bl v\u00fdvoj\u00e1\u0159 testovat, zadat v\u0161echny pot\u0159ebn\u00e9 mo\u017enosti, komponenty a tak\u00e9 velikosti. Pokud pot\u0159eboval v\u00fdkonnostn\u00ed testov\u00e1n\u00ed, mohl vz\u00edt v\u00edce instanc\u00ed. Pokud pot\u0159eboval jen zkontrolovat, \u017ee se n\u011bjak\u00fd formul\u00e1\u0159 otev\u00edr\u00e1, mohl za\u010d\u00edt s minim\u00e1ln\u00edm zat\u00ed\u017een\u00edm. A tak\u00e9 ur\u010dit, zda pot\u0159ebuje cluster nebo ne a tak d\u00e1le. <\/p>\n<p><\/p>\n<p>A pot\u00e9 Jenkins spustil shell skript, kter\u00fd m\u00edrn\u011b modifikoval k\u00f3d ve slo\u017ece Terraform. Odstra\u0148oval nepot\u0159ebn\u00e9 soubory, p\u0159id\u00e1val pot\u0159ebn\u00e9 soubory. A pot\u00e9 jedn\u00edm p\u0159\u00edkazem Terraform apply stack vzrostl. <\/p>\n<p><\/p>\n<p>A pot\u00e9 u\u017e n\u00e1sledovaly dal\u0161\u00ed kroky, do kter\u00fdch se nechci zat\u011b\u017eovat. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/b288c0b320d8cb6e282db994bc1c1f43.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Proto\u017ee jsme k testov\u00e1n\u00ed pot\u0159ebovali o n\u011bco v\u00edce mo\u017enost\u00ed ne\u017e v produkci, museli jsme vytv\u00e1\u0159et kopie modul\u016f, abychom do t\u011bchto kopi\u00ed mohli p\u0159idat ty funkce, kter\u00e9 byly pot\u0159eba pouze v testov\u00e1n\u00ed. <\/p>\n<p><\/p>\n<p>A tak se stalo, \u017ee v testov\u00e1n\u00ed bylo jakoby cht\u011bn\u00e9 otestovat ty zm\u011bny, kter\u00e9 nakonec p\u016fjdou do produkce. Ale ve skute\u010dnosti se testovalo n\u011bco jin\u00e9ho, zat\u00edmco v produkci se aplikovalo n\u011bco tro\u0161ku jin\u00e9ho. A byl tam mal\u00fd rozpor v tom, \u017ee v\u0161echny zm\u011bny v produkci aplikovala opera\u010dn\u00ed t\u00fdm. A ob\u010das se stalo, \u017ee ty zm\u011bny, kter\u00e9 m\u011bly p\u0159ej\u00edt z testov\u00e1n\u00ed do produkce, z\u016fst\u00e1valy v jin\u00e9 verzi. <\/p>\n<p><\/p>\n<p>Krom\u011b toho byl probl\u00e9m v tom, \u017ee byl p\u0159id\u00e1n nov\u00fd servis, kter\u00fd se pon\u011bkud li\u0161il od ji\u017e existuj\u00edc\u00edho. M\u00edsto toho, abychom modifikovali st\u00e1vaj\u00edc\u00ed modul, museli jsme vytvo\u0159it jeho kopii a p\u0159idat pot\u0159ebn\u00e9 zm\u011bny. <\/p>\n<p><\/p>\n<p>V podstat\u011b Terraform nen\u00ed skute\u010dn\u00fd jazyk. Je to deklarace. Pokud pot\u0159ebujeme n\u011bco deklarovat, tak to deklarujeme. A v\u0161echno to funguje.<\/p>\n<p><\/p>\n<p>V ur\u010dit\u00e9m okam\u017eiku, kdy\u017e se diskutoval jeden z m\u00fdch pull request\u016f, jeden z koleg\u016f \u0159ekl, \u017ee nen\u00ed pot\u0159eba vytv\u00e1\u0159et sn\u011bhov\u00e9 vlo\u010dky. Zaj\u00edmalo m\u011b, co t\u00edm mysl\u00ed. Existuje v\u011bdeck\u00fd fakt, \u017ee na sv\u011bt\u011b neexistuj\u00ed dv\u011b toto\u017en\u00e9 sn\u011bhov\u00e9 vlo\u010dky, v\u0161echny se tro\u0161ku li\u0161\u00ed. A jakmile jsem to sly\u0161el, okam\u017eit\u011b jsem poc\u00edtil ve\u0161kerou t\u00edhu Terraform k\u00f3du. Proto\u017ee kdy\u017e bylo pot\u0159eba p\u0159ej\u00edt z jedn\u00e9 verze na druhou, Terraform vy\u017eadoval breaking chain zm\u011bnu, tj. k\u00f3d ji\u017e nebyl kompatibiln\u00ed s n\u00e1sleduj\u00edc\u00ed verz\u00ed. A bylo nutn\u00e9 ud\u011blat pull request, kter\u00fd pokr\u00fdval t\u00e9m\u011b\u0159 polovinu soubor\u016f v infrastruktu\u0159e, aby se infrastruktura p\u0159izp\u016fsobila dal\u0161\u00ed verzi Terraform.<\/p>\n<p><\/p>\n<p>A pot\u00e9, co se objevila takov\u00e1 sn\u011bhov\u00e1 vlo\u010dka, ve\u0161ker\u00fd Terraform k\u00f3d, kter\u00fd jsme m\u011bli, se prom\u011bnil ve velkou hromadu sn\u011bhu. <\/p>\n<p><\/p>\n<p>Pro extern\u00edho v\u00fdvoj\u00e1\u0159e, kter\u00fd nen\u00ed v operac\u00edch, to nem\u00e1 velk\u00fd v\u00fdznam, proto\u017ee ud\u011blal pull request, jeho zdroj byl spu\u0161t\u011bn. A t\u00edm to kon\u010d\u00ed, d\u00e1l se o to nestar\u00e1. Ale t\u00fdm DevOps, kter\u00fd dohl\u00ed\u017e\u00ed na to, aby bylo v\u0161e v po\u0159\u00e1dku, mus\u00ed ud\u011blat v\u0161echny tyto zm\u011bny. A cena t\u011bchto zm\u011bn velmi, velmi vzrostla s ka\u017edou dal\u0161\u00ed sn\u011bhovou vlo\u010dkou.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/d07039414027798861d1424bb2c686b6.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Existuje p\u0159\u00edb\u011bh o tom, jak student na semin\u00e1\u0159i kresl\u00ed k\u0159\u00eddou na tabuli dva dokonal\u00e9 kruhy. A u\u010ditel je p\u0159ekvapen, jak se mu poda\u0159ilo tak rovn\u011b nakreslit bez kru\u017e\u00edtka. Student odpov\u00edd\u00e1: \u201eVelmi jednodu\u0161e, dva roky jsem v arm\u00e1d\u011b kroutil ml\u00fdnek na maso.\" <\/p>\n<p><\/p>\n<p>A z t\u011bch \u010dty\u0159 let, kdy se \u00fa\u010dastn\u00edm tohoto projektu, jsem asi dva roky v\u011bnoval Terraform. A samoz\u0159ejm\u011b m\u00e1m n\u011bjak\u00e9 triky, n\u011bjak\u00e9 tipy, jak zjednodu\u0161it Terraform k\u00f3d, pracovat s n\u00edm jako s programovac\u00edm jazykem a sn\u00ed\u017eit z\u00e1t\u011b\u017e na v\u00fdvoj\u00e1\u0159e, kte\u0159\u00ed mus\u00ed tento k\u00f3d udr\u017eovat aktu\u00e1ln\u00ed. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/9413c6adf1933482dcc822b021773df9.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Prvn\u00ed, co bych cht\u011bl za\u010d\u00edt, jsou symlinky. Terraform m\u00e1 hodn\u011b opakuj\u00edc\u00edho se k\u00f3du. Nap\u0159\u00edklad vol\u00e1n\u00ed poskytovatele je prakticky na ka\u017ed\u00e9m m\u00edst\u011b, kde vytv\u00e1\u0159\u00edme kousek infrastruktury, stejn\u00e9. A je logick\u00e9 to p\u0159esunout do samostatn\u00e9 slo\u017eky. A v\u0161ude tam, kde je pot\u0159eba poskytovatel, ud\u011blat symlinky na tento soubor. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/6dcf36cc8c94e7a70cf6ab1456cc1215.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Nap\u0159\u00edklad, pokud m\u00e1te v produkci pou\u017eit\u00fd assume role, kter\u00fd v\u00e1m umo\u017e\u0148uje z\u00edskat p\u0159\u00edstupov\u00e1 pr\u00e1va k n\u011bjak\u00e9mu extern\u00edmu Amazon \u00fa\u010dtu. A zm\u011bnou jednoho souboru budou m\u00edt v\u0161echny zbyl\u00e9 soubory ve strom\u011b zdroj\u016f pot\u0159ebn\u00e1 pr\u00e1va, aby Terraform v\u011bd\u011bl, na kter\u00fd Amazon segment se obr\u00e1tit. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/6df9a89ef48ae9a7adda7fb1f86b76aa.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Kde symlinky nefunguj\u00ed? Jak jsem ji\u017e \u0159ekl, v Terraform jsou stavov\u00e9 soubory. A ty jsou velmi, velmi skv\u011bl\u00e9. Ale probl\u00e9m je v tom, \u017ee Terraform inicializuje backend jako prvn\u00ed. A nem\u016f\u017ee pou\u017e\u00edvat jak\u00e9koliv prom\u011bnn\u00e9 v t\u011bchto parametrech, mus\u00edte je v\u017edy ps\u00e1t jako text. <\/p>\n<p><\/p>\n<p>A jako v\u00fdsledek, kdy\u017e n\u011bkdo d\u011bl\u00e1 nov\u00fd zdroj, zkop\u00edruje \u010d\u00e1st k\u00f3du z jin\u00fdch slo\u017eek. A m\u016f\u017ee se m\u00fdlit s kl\u00ed\u010dem nebo s bucketem. Nap\u0159\u00edklad, vytv\u00e1\u0159\u00ed ze sandboxu sandboxovou v\u011bc, a pak to d\u011bl\u00e1 v produkci. A tak m\u016f\u017ee nakonec b\u00fdt, \u017ee bucket v produkci bude pou\u017e\u00edv\u00e1n ze sandboxu. Samoz\u0159ejm\u011b, to se rychle najde. Bude mo\u017en\u00e9 to n\u011bjak opravit, ale i tak to ztr\u00e1ta \u010dasu a do ur\u010dit\u00e9 m\u00edry zdroj\u016f. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/757294dc6a1a27fc4a5fe174cc4aa7d7.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Co m\u016f\u017eeme ud\u011blat d\u00e1l? Ne\u017e za\u010dneme pracovat s Terraform, mus\u00edme ho inicializovat. V okam\u017eiku inicializace Terraform st\u00e1hne v\u0161echny pluginy. V ur\u010dit\u00e9m okam\u017eiku se z monolitu rozpadly na v\u00edce mikroservisn\u00ed architekturu. A v\u017edy je pot\u0159eba ud\u011blat Terraform init, aby st\u00e1hl v\u0161echny moduly, v\u0161echny pluginy.<\/p>\n<p><\/p>\n<p>M\u016f\u017eeme pou\u017e\u00edt shell skript, kter\u00fd jednak dok\u00e1\u017ee z\u00edskat v\u0161echny prom\u011bnn\u00e9. Shell skript nen\u00ed ni\u010d\u00edm omezen. A za druh\u00e9, cesty. Pokud v\u017edy pou\u017e\u00edv\u00e1me tu cestu, kter\u00e1 je v repozit\u00e1\u0159i jako kl\u00ed\u010d k stavov\u00e9mu souboru, pak chyba zde bude vylou\u010dena. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/b70dbc6d8edb1b255c64d722a7e40680.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Odkud z\u00edskat data? JSON soubor. Terraform umo\u017e\u0148uje zapisovat infrastrukturu nejen v hcl (HashiCorp Configuration Language), ale tak\u00e9 v JSON.<\/p>\n<p><\/p>\n<p>JSON je snadno \u010diteln\u00fd ze shell skriptu. Odpov\u00eddaj\u00edc\u00edm zp\u016fsobem lze n\u011bkde um\u00edstit konfigura\u010dn\u00ed soubor s bucketem. A pou\u017e\u00edvat tento bucket jak v Terraform k\u00f3du, tak v shell skriptu pro inicializaci. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/a18b92cac763003ec49af8d4a37e19d9.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pro\u010d je d\u016fle\u017eit\u00e9 m\u00edt bucket pro Terraform? Proto\u017ee existuje n\u011bco jako vzd\u00e1len\u00e9 stavov\u00e9 soubory. To znamen\u00e1, \u017ee kdy\u017e vytv\u00e1\u0159\u00edm n\u011bjak\u00fd zdroj, mus\u00edm Amazone \u0159\u00edct: \u201ePros\u00edm, zvedn\u011bte instance\u201c, a k tomu je pot\u0159eba zadat spoustu povinn\u00fdch parametr\u016f. <\/p>\n<p><\/p>\n<p>A tyto identifik\u00e1tory jsou ulo\u017eeny v n\u011bjak\u00e9m jin\u00e9m adres\u00e1\u0159i. Mohu \u0159\u00edct: \u201eTerraform, pros\u00edm b\u011b\u017e do stavov\u00e9ho souboru toho konkr\u00e9tn\u00edho zdroje a p\u0159ines mi ty identifik\u00e1tory\u201c. T\u00edmto zp\u016fsobem doch\u00e1z\u00ed k ur\u010dit\u00e9 unifikaci mezi r\u016fzn\u00fdmi regiony nebo prost\u0159ed\u00edmi.<\/p>\n<p><\/p>\n<p>Ne v\u017edy je mo\u017en\u00e9 pou\u017e\u00edt vzd\u00e1len\u00fd stavov\u00fd soubor. Nap\u0159\u00edklad, pokud jste ru\u010dn\u011b vytvo\u0159ili VPC. A ten Terraform k\u00f3d, kter\u00fd vytv\u00e1\u0159\u00ed VPC, vytv\u00e1\u0159\u00ed natolik odli\u0161n\u00fd VPC, \u017ee budete muset dlouho p\u0159izp\u016fsobovat jedno druh\u00e9mu, proto m\u016f\u017eete pou\u017e\u00edt n\u00e1sleduj\u00edc\u00ed trik. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/04ffcd97e2fae323d9b4d81e5f6c751a.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>To znamen\u00e1, vytvo\u0159it modul, kter\u00fd jakoby d\u011bl\u00e1 VPC a jakoby v\u00e1m dod\u00e1v\u00e1 identifik\u00e1tory, ale ve skute\u010dnosti existuje soubor se zhardcodovan\u00fdmi hodnotami, kter\u00fd lze pou\u017e\u00edt k vytvo\u0159en\u00ed stejn\u00e9ho instance.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/9cd878c459f377caf5af9bf27b026187.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Nen\u00ed v\u017edy pot\u0159eba uchov\u00e1vat stavov\u00fd soubor v cloudu. Nap\u0159\u00edklad p\u0159i testov\u00e1n\u00ed modul\u016f m\u016f\u017eete pou\u017e\u00edt inicializaci backendu, kdy bude soubor uchov\u00e1v\u00e1n prost\u011b na disku po dobu testov\u00e1n\u00ed.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/70fee8d4105cfddacafeec00825127b5.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Te\u010f n\u011bco m\u00e1lo o testov\u00e1n\u00ed. Co se v Terraformu d\u00e1 testovat? Pravd\u011bpodobn\u011b toho lze testovat hodn\u011b, ale budu mluvit o t\u011bchto \u010dty\u0159ech v\u011bcech.<\/p>\n<p><\/p>\n<p>HashiCorp m\u00e1 p\u0159edstavu o tom, jak by m\u011bl b\u00fdt form\u00e1tov\u00e1n Terraform k\u00f3d. A Terraform fmt v\u00e1m umo\u017e\u0148uje naform\u00e1tovat k\u00f3d, kter\u00fd editujete, v souladu s touto v\u00edrou. Odpov\u00eddaj\u00edc\u00ed testy by m\u011bly nutn\u011b zkontrolovat, zda form\u00e1tov\u00e1n\u00ed odpov\u00edd\u00e1 tomu, co p\u0159edal HashiCorp, abyste nemuseli m\u011bnit um\u00edst\u011bn\u00ed z\u00e1vorek atd. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/bb99ffdd9f963f0f44ea7b5379689737.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Dal\u0161\u00ed je Terraform validate. D\u011bl\u00e1 trochu v\u00edce ne\u017e jen kontrolu syntaxe \u2013 jako \u017ee jsou v\u0161echny z\u00e1vorky p\u00e1rov\u00e9. Co je zde d\u016fle\u017eit\u00e9? Na\u0161e infrastruktura je velmi rozs\u00e1hl\u00e1. M\u00e1me v n\u00ed spoustu r\u016fzn\u00fdch adres\u00e1\u0159\u016f. A v ka\u017ed\u00e9m je pot\u0159eba spustit Terraform validate.<\/p>\n<p><\/p>\n<p>Abychom urychlili testov\u00e1n\u00ed, spou\u0161t\u00edme n\u011bkolik proces\u016f paraleln\u011b, pomoc\u00ed paraleln\u00ed obsluhy. <\/p>\n<p><\/p>\n<p>Paralela je skv\u011bl\u00e1 v\u011bc, vyu\u017e\u00edvejte ji.<\/p>\n<p><\/p>\n<p>Ale poka\u017ed\u00e9, kdy\u017e se prov\u00e1d\u00ed inicializace Terraformu, jde na HashiCorp a pt\u00e1 se: \u201eJak\u00e9 jsou posledn\u00ed verze plugin\u016f? A ten plugin, kter\u00fd m\u00e1m v cache \u2013 je ten nebo nen\u00ed?\u201c A to ka\u017ed\u00fdm krokem zp\u016fsobuje zpo\u017ed\u011bn\u00ed. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/836e90327c7a60c493f42f0a055e248b.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Pokud Terraformu \u0159eknete, kde se pluginy nach\u00e1zej\u00ed, \u0159ekne: \u201eOk, to je pravd\u011bpodobn\u011b to nejnov\u011bj\u0161\u00ed, co m\u00e1me. Nebudu chodit nikam jinam, rovnou za\u010dnu validovat v\u00e1\u0161 Terraform k\u00f3d.\u201c<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/8ab344cf8de7087d30a1212d44691c20.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Abychom naplnili slo\u017eku pot\u0159ebn\u00fdmi pluginy, m\u00e1me velmi jednoduch\u00fd Terraform k\u00f3d, kter\u00fd je t\u0159eba pouze inicializovat. Samoz\u0159ejm\u011b zde mus\u00edme uv\u00e9st v\u0161echny poskytovatele, kte\u0159\u00ed se n\u011bjak\u00fdm zp\u016fsobem pod\u00edlej\u00ed na va\u0161em k\u00f3du, jinak Terraform \u0159ekne: \u201eNev\u00edm o \u017e\u00e1dn\u00e9m poskytovateli, proto\u017ee nen\u00ed v cache.\u201c<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/b8130753045624d38bce32ba08b56fb0.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Dal\u0161\u00edm krokem je Terraform plan. Jak u\u017e bylo \u0159e\u010deno, v\u00fdvoj je cyklick\u00fd. D\u011bl\u00e1me k\u00f3d se zm\u011bnami a pak je t\u0159eba zjistit, jak\u00e9 zm\u011bny se pl\u00e1nuj\u00ed pro infrastrukturu. <\/p>\n<p><\/p>\n<p>A kdy\u017e je infrastruktura opravdu velmi velk\u00e1, m\u016f\u017eete zm\u011bnit jeden modul, opravit n\u011bjak\u00e9 testovac\u00ed prost\u0159ed\u00ed nebo n\u011bjak\u00fd konkr\u00e9tn\u00ed region a p\u0159itom zlomit n\u011bco sousedn\u00edho. Proto by m\u011bl b\u00fdt Terraform plan proveden pro celou infrastrukturu a uk\u00e1zat, jak\u00e9 zm\u011bny se pl\u00e1nuj\u00ed.<\/p>\n<p><\/p>\n<p>D\u00e1 se to ud\u011blat chyt\u0159e. Nap\u0159\u00edklad jsme napsali skript v Pythonu, kter\u00fd vy\u0159e\u0161\u00ed z\u00e1vislosti. A v z\u00e1vislosti na tom, co bylo zm\u011bn\u011bno: Terraform modul nebo jen n\u011bjak\u00e1 konkr\u00e9tn\u00ed komponenta, vytv\u00e1\u0159\u00ed pl\u00e1ny pro v\u0161echny z\u00e1visl\u00e9 slo\u017eky.<\/p>\n<p><\/p>\n<p>Terraform plan by m\u011bl b\u00fdt prov\u00e1d\u011bn na vy\u017e\u00e1d\u00e1n\u00ed. Minim\u00e1ln\u011b to je to, co d\u011bl\u00e1me my. <\/p>\n<p><\/p>\n<p>Testy je samoz\u0159ejm\u011b dobr\u00e9 prov\u00e1d\u011bt na ka\u017edou zm\u011bnu, na ka\u017ed\u00fd commit, ale pl\u00e1ny jsou pom\u011brn\u011b n\u00e1kladn\u00e1 z\u00e1le\u017eitost. A v pull requestu \u0159\u00edk\u00e1me: \u201ePros\u00edm, dej mi pl\u00e1ny.\u201c Spust\u00ed se robot a za\u0161le v koment\u00e1\u0159\u00edch nebo jako p\u0159\u00edlohu v\u0161echny pl\u00e1ny, kter\u00e9 by m\u011bly vypl\u00fdvat z va\u0161ich zm\u011bn. <\/p>\n<p><\/p>\n<p>Pl\u00e1n je pom\u011brn\u011b n\u00e1kladn\u00fd. Trv\u00e1 to \u010das, proto\u017ee Terraform jde do Amazonu a pt\u00e1 se: \u201eExistuje je\u0161t\u011b tento instance? M\u00e1 tento autoscale opravdu takov\u00e9 parametry?\u201c A aby se to urychlilo, m\u016f\u017eete pou\u017e\u00edt parametr jako refresh=false. To znamen\u00e1, \u017ee Terraform st\u00e1hne ze S3 stav. A bude v\u011b\u0159it, \u017ee stav bude p\u0159esn\u011b odpov\u00eddat tomu, co se nach\u00e1z\u00ed v Amazonu.<\/p>\n<p><\/p>\n<p>Tento Terraform pl\u00e1n prob\u00edh\u00e1 mnohem rychleji, ale stav mus\u00ed odpov\u00eddat va\u0161\u00ed infrastruktu\u0159e, tzn. n\u011bkde, n\u011bkdy mus\u00ed b\u00fdt spu\u0161t\u011bn Terraform refresh. Terraform refresh d\u011bl\u00e1 p\u0159esn\u011b to, aby stav odpov\u00eddal tomu, co existuje v re\u00e1ln\u00e9 infrastruktu\u0159e. <\/p>\n<p><\/p>\n<p>A je pot\u0159eba zm\u00ednit bezpe\u010dnost. T\u00edmto bych m\u011bl za\u010d\u00edt. Tam, kde spou\u0161t\u00edte Terraform, a Terraform pracuje s va\u0161\u00ed infrastrukturou, existuje zranitelnost. Tzn. v podstat\u011b vykon\u00e1v\u00e1te k\u00f3d. A pokud pull request obsahuje n\u011bjak\u00fd \u0161kodliv\u00fd k\u00f3d, m\u016f\u017ee se vykonat na infrastruktu\u0159e, kter\u00e1 m\u00e1 p\u0159\u00edli\u0161 mnoho p\u0159\u00edstupu. Proto bu\u010fte opatrn\u00ed, kde spou\u0161t\u00edte Terraform pl\u00e1n.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/2153cc01acf2b1f46978f837b82b317e.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>D\u00e1le, o \u010dem bych cht\u011bl mluvit, je testov\u00e1n\u00ed user-data.<\/p>\n<p><\/p>\n<p>Co je to user-data? V Amazonu, kdy\u017e vytv\u00e1\u0159\u00edme instanci, m\u016f\u017eeme z instance poslat ur\u010dit\u00e9 zpr\u00e1vy \u2013 metadata. Kdy\u017e se instance spou\u0161t\u00ed, obvykle je cloud init v\u017edy p\u0159\u00edtomn\u00fd na t\u011bchto instanc\u00edch. Cloud init p\u0159e\u010dte tuto zpr\u00e1vu a \u0159\u00edk\u00e1: \u201eDob\u0159e, dnes jsem load balancer\u201c. A v souladu s t\u011bmito p\u0159\u00edkazy prov\u00e1d\u00ed ur\u010dit\u00e9 akce.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/406ac9341e102f5e0d7ca239d10675cd.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Ale bohu\u017eel, kdy\u017e prov\u00e1d\u00edme Terraform pl\u00e1n a Terraform aplikaci, user-data vypad\u00e1 jako takov\u00e1 ka\u0161e z \u010d\u00edsel. Tzn. jednodu\u0161e v\u00e1m po\u0161le hash. A v\u0161echno, co m\u016f\u017eete vid\u011bt v pl\u00e1nu, je, zda dojde k n\u011bjak\u00fdm zm\u011bn\u00e1m nebo hash z\u016fstane stejn\u00fd. <\/p>\n<p><\/p>\n<p>A pokud si toho nev\u0161imnete, na Amazonu m\u016f\u017ee na re\u00e1lnou infrastrukturu odej\u00edt n\u011bjak\u00fd po\u0161kozen\u00fd textov\u00fd soubor. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/cd7b56f1149d9cbebb0ad3228c0eeb5f.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Jako alternativu m\u016f\u017eete p\u0159i prov\u00e1d\u011bn\u00ed uv\u00e9st nejen celou infrastrukturu, ale pouze \u0161ablonu. A v k\u00f3du \u0159\u00edct: \u201ePros\u00edm, zobraz mi tuto \u0161ablonu\u201c. A nakonec m\u016f\u017eete z\u00edskat v\u00fdtisk, jak budou vypadat va\u0161e data na Amazonu.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/86da779cdf7f9cacfd80a196efde47f7.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Dal\u0161\u00ed mo\u017enost\u00ed je pou\u017e\u00edt modul pro generaci user-data. Tento modul aplikujete. Z\u00edsk\u00e1te soubor na disku. Porovn\u00e1te ho s referen\u010dn\u00edm. A tak, pokud se n\u011bjak\u00fd nov\u00e1\u010dek rozhodne m\u00edrn\u011b upravit user-data, va\u0161e testy \u0159eknou: \u201eDob\u0159e, tady a tady jsou n\u011bjak\u00e9 zm\u011bny \u2013 to je v po\u0159\u00e1dku.\u201c<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/7e69ec1b2c04710066d93ee48f872254.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Dal\u0161\u00ed t\u00e9ma, o kter\u00e9m bych r\u00e1d mluvil, je Automatizace Terraform apply.<\/p>\n<p><\/p>\n<p>Samoz\u0159ejm\u011b je docela d\u011bsiv\u00e9 prov\u00e1d\u011bt Terraform apply automaticky, proto\u017ee kdo v\u00ed, jak\u00e9 zm\u011bny byly p\u0159edneseny a jak destruktivn\u00ed mohou b\u00fdt pro \u017eivou infrastrukturu. <\/p>\n<p><\/p>\n<p>Pro testovac\u00ed prost\u0159ed\u00ed je to naprosto v po\u0159\u00e1dku. Tedy job, kter\u00fd vytv\u00e1\u0159\u00ed testovac\u00ed prost\u0159ed\u00ed, je to, co pot\u0159ebuj\u00ed v\u0161ichni v\u00fdvoj\u00e1\u0159i. A takov\u00fd v\u00fdrok jako \u201ev\u0161echno mi fungovalo\u201c nen\u00ed vtipn\u00fd mem, ale d\u016fkaz, \u017ee se \u010dlov\u011bk sna\u017eil, nasadil stack, spustil na tomto stacku n\u011bjak\u00e9 testy. A ujistil se, \u017ee je v\u0161e v po\u0159\u00e1dku a \u0159ekl: \u201eO.k., ten k\u00f3d, kter\u00fd vyd\u00e1v\u00e1m, byl otestov\u00e1n.\u201c<\/p>\n<p><\/p>\n<p>Ve v\u00fdrobn\u00edm prost\u0159ed\u00ed, sandboxu a dal\u0161\u00edch prost\u0159ed\u00edch, kter\u00e1 jsou pro podnik\u00e1n\u00ed d\u016fle\u017eit\u011bj\u0161\u00ed, lze \u010d\u00e1ste\u010dn\u011b aplikovat n\u011bkter\u00e9 zdroje dostate\u010dn\u011b bezpe\u010dn\u011b, proto\u017ee to nevede k tomu, \u017ee by n\u011bkdo zem\u0159el. To jsou: autoscale skupiny, security skupiny, role, route53 a seznam m\u016f\u017ee b\u00fdt dost dlouh\u00fd. Ale sledujte, co se d\u011bje, \u010dt\u011bte zpr\u00e1vy o automatick\u00fdch aplikac\u00edch. <\/p>\n<p><\/p>\n<p>Tam, kde je aplikace nebezpe\u010dn\u00e1 nebo se j\u00ed ob\u00e1v\u00e1te, nap\u0159\u00edklad pokud se jedn\u00e1 o n\u011bjak\u00e9 zdroje s persistentn\u00edmi datab\u00e1zemi, z\u00edsk\u00e1vejte zpr\u00e1vy o tom, \u017ee v n\u011bjak\u00e9 \u010d\u00e1sti infrastruktury jsou neaplikovan\u00e9 zm\u011bny. A in\u017een\u00fdr pak u\u017e pod dozorem spou\u0161t\u00ed jobs, aby je aplikoval, nebo to d\u011bl\u00e1 ze sv\u00e9 konzole. <\/p>\n<p><\/p>\n<p>Na Amazonu existuje n\u011bco jako ochrana p\u0159ed ukon\u010den\u00edm. A ta m\u016f\u017ee v n\u011bkter\u00fdch p\u0159\u00edpadech ochr\u00e1nit p\u0159ed ne\u017e\u00e1douc\u00edmi zm\u011bnami. Tedy Terraform p\u0159ich\u00e1z\u00ed na Amazon a \u0159\u00edk\u00e1: \u201ePot\u0159ebuji zab\u00edt tento instance, abych mohl vytvo\u0159it jin\u00fd.\u201c A Amazon odpov\u00edd\u00e1: \u201eOmlouv\u00e1m se, dnes ne. M\u00e1m ochranu p\u0159ed ukon\u010den\u00edm.\u201c<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/9f4258d8688556829586a1e308f5a1e2.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A t\u0159e\u0161ni\u010dka na dortu \u2013 to je optimalizace k\u00f3du. Kdy\u017e pracujeme s Terraform k\u00f3dem, mus\u00edme p\u0159edat do modulu velmi velk\u00e9 mno\u017estv\u00ed parametr\u016f. To jsou ty parametry, kter\u00e9 jsou nezbytn\u00e9 pro vytvo\u0159en\u00ed n\u011bjak\u00e9ho zdroje. A k\u00f3d se st\u00e1v\u00e1 velk\u00fdmi seznamy parametr\u016f, kter\u00e9 je t\u0159eba p\u0159edat z modulu do modulu, z modulu do modulu, zejm\u00e9na pokud jsou moduly vno\u0159en\u00e9. <\/p>\n<p><\/p>\n<p>A to se velmi t\u011b\u017eko \u010dte. O to se velmi t\u011b\u017eko prov\u00e1d\u00ed revize. A velmi \u010dasto se st\u00e1v\u00e1, \u017ee n\u011bjak\u00e9 parametry projdou reviz\u00ed a nejsou zcela t\u00edm, co je pot\u0159eba. A to stoj\u00ed \u010das a pen\u00edze, abychom to pak opravili.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/ad7e8a91692212fda9f2561854b881c9.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Proto v\u00e1m navrhuji pou\u017e\u00edt n\u011bco jako komplexn\u00ed parametr, kter\u00fd zahrnuje jak\u00e9si stromov\u00e9 hodnoty. Tedy pot\u0159ebujete n\u011bjakou slo\u017eku, kde m\u00e1te uvedeny v\u0161echny hodnoty, kter\u00e9 byste cht\u011bli m\u00edt na n\u011bjak\u00e9m prost\u0159ed\u00ed.<\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/909632949eb30057bf86b116239d9077.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>A pou\u017eit\u00edm tohoto modulu lze z\u00edskat strom, kter\u00fd se generuje v jednom obecn\u00e9m modulu, tj. v obecn\u00e9m modulu, kter\u00fd funguje stejn\u011b pro celou infrastrukturu.<\/p>\n<p><\/p>\n<p>V tomto modulu lze prov\u00e1d\u011bt ur\u010dit\u00e9 v\u00fdpo\u010dty s vyu\u017eit\u00edm nov\u00e9 funkce v Terraformu, jako jsou locals. A pot\u00e9 jedn\u00edm outputem poskytnout n\u011bjak\u00fd slo\u017eit\u00fd parametr, kter\u00fd m\u016f\u017ee zahrnovat hash a pole atd. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/25c14e0397f8d95c301e0dfe6ae761df.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>T\u00edmto m\u00e1m na mysli v\u0161echny nejlep\u0161\u00ed n\u00e1lezy, kter\u00e9 m\u00e1m. A r\u00e1d bych vypr\u00e1v\u011bl poh\u00e1dku o Kolumbovi. Kdy\u017e hledal pen\u00edze na svou expedici, aby objevil Indii (jak si tenkr\u00e1t myslel), nikdo mu nev\u011b\u0159il a pova\u017eovali to za nemo\u017en\u00e9. Tehdy \u0159ekl: \u201eUd\u011blte tak, aby se vejce nesflattenilo.\u201c V\u0161ichni bank\u00e9\u0159i, velmi bohat\u00ed a pravd\u011bpodobn\u011b chyt\u0159\u00ed lid\u00e9, se sna\u017eili vejce n\u011bjak postavit, ale po\u0159\u00e1d padalo. Pot\u00e9 Kolumbus vzal vejce, trochu na n\u011bj zatla\u010dil. \u0160lupka se zm\u00e1\u010dkla a vejce z\u016fstalo st\u00e1t. \u0158ekli: \u201eOh, to je p\u0159\u00edli\u0161 jednoduch\u00e9!\u201c. A Kolumbus odpov\u011bd\u011bl: \u201eAno, je to p\u0159\u00edli\u0161 jednoduch\u00e9. A kdy\u017e otev\u0159u Indii, v\u0161ichni budou pou\u017e\u00edvat tuto obchodn\u00ed cestu.\u201c <\/p>\n<p><\/p>\n<p>A to, co jsem v\u00e1m te\u010f \u0159ekl, jsou pravd\u011bpodobn\u011b dost jednoduch\u00e9 a trivi\u00e1ln\u00ed v\u011bci. A kdy\u017e o nich zjist\u00edte a za\u010dnete je pou\u017e\u00edvat, je to v po\u0159\u00e1dku. Tak\u017ee jich vyu\u017eijte. A pokud jsou to pro v\u00e1s norm\u00e1ln\u00ed v\u011bci, aspo\u0148 v\u00edte, jak postavit vejce, aby nespadlo. <\/p>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/37bf83d04b99f089f2319c8d2e8aaeb4.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Shrneme to: <\/p>\n<p><\/p>\n<ul>\n<li>Sna\u017ete se vyhnout sn\u011bhov\u00fdm vlo\u010dk\u00e1m. A \u010d\u00edm m\u00e9n\u011b sn\u011bhov\u00fdch vlo\u010dek, t\u00edm m\u00e9n\u011b zdroj\u016f budete pot\u0159ebovat, abyste provedli n\u011bjak\u00e9 zm\u011bny ve va\u0161\u00ed velk\u00e9 infrastruktu\u0159e. <\/li>\n<li>St\u00e1l\u00e9 zm\u011bny. Tj. kdy\u017e dojde ke zm\u011bn\u00e1m v k\u00f3du, je t\u0159eba co nejrychleji uv\u00e9st va\u0161i infrastrukturu do souladu s t\u011bmito zm\u011bnami. Nem\u011bla by nastat situace, kdy n\u011bkdo p\u0159ijde za dva a\u017e t\u0159i m\u011bs\u00edce, aby se pod\u00edval na Elasticsearch, provede Terraform plan a tam je spousta zm\u011bn, kter\u00e9 neo\u010dek\u00e1val. A zabere to spoustu \u010dasu, aby se v\u0161e op\u011bt uvedlo do po\u0159\u00e1dku. <\/li>\n<li>Testy a automatizace. \u010c\u00edm v\u00edce m\u00e1te k\u00f3d pokryt\u00fd testy a funkcemi, t\u00edm v\u00edce m\u00e1te jistotu, \u017ee d\u011bl\u00e1te v\u0161e spr\u00e1vn\u011b. A automatizovan\u00e9 dod\u00e1n\u00ed zvy\u0161uje va\u0161i d\u016fv\u011bru mnohon\u00e1sobn\u011b. <\/li>\n<li>K\u00f3d pro testovac\u00ed a produk\u010dn\u00ed prost\u0159ed\u00ed by m\u011bl b\u00fdt prakticky stejn\u00fd. Prakticky, proto\u017ee produkce je p\u0159ece jen trochu jin\u00e1 a budou tam ur\u010dit\u00e9 nuance, kter\u00e9 p\u0159esahuj\u00ed r\u00e1mec testovac\u00edho prost\u0159ed\u00ed. Nicm\u00e9n\u011b, plus minus je mo\u017en\u00e9 to zajistit. <\/li>\n<li>A pokud m\u00e1te hodn\u011b Terraform k\u00f3du a na jeho udr\u017eov\u00e1n\u00ed v aktu\u00e1ln\u00edm stavu pot\u0159ebujete spoustu \u010dasu, nikdy nen\u00ed pozd\u011b na refactoring a p\u0159iv\u00e9st ho do po\u0159\u00e1dku. <\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/68f3946536f44eed33939b234fb3ca0d.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<ul>\n<li>Immutable infrastructure. Dostava AMI podle pl\u00e1nu. <\/li>\n<li>Struktura pro route53, kdy\u017e m\u00e1te hodn\u011b z\u00e1znam\u016f a chcete, aby byly v jednotn\u00e9m po\u0159ad\u00ed. <\/li>\n<li>Boj s API rate limits. To je, kdy\u017e Amazon \u0159\u00edk\u00e1: \u201eV\u0161echno, v\u0161echno, v\u00edce nemohu p\u0159ij\u00edmat, pros\u00edm, po\u010dkejte.\u201c A polovina firmy \u010dek\u00e1, dokud nebude moci spustit svou infrastrukturu. <\/li>\n<li>Spot instances. Amazon nen\u00ed levn\u00e1 z\u00e1le\u017eitost a spoty umo\u017e\u0148uj\u00ed zna\u010dn\u011b u\u0161et\u0159it. O tom by se dalo p\u0159edn\u00e9st cel\u00e9 vystoupen\u00ed. <\/li>\n<li>Bezpe\u010dnost a IAM role. <\/li>\n<li>Hled\u00e1n\u00ed ztracen\u00fdch zdroj\u016f, kdy\u017e m\u00e1te v Amazonu instance nejasn\u00e9ho p\u016fvodu, kter\u00e9 spot\u0159ebov\u00e1vaj\u00ed pen\u00edze. I kdy\u017e instance stoj\u00ed 100-150 dolar\u016f m\u011bs\u00ed\u010dn\u011b \u2013 za rok je to p\u0159es 1 000. Hled\u00e1n\u00ed takov\u00fdch zdroj\u016f je v\u00fdnosn\u00e9. <\/li>\n<li>A rezervovan\u00e9 instance. <\/li>\n<\/ul>\n<p><\/p>\n<p><img decoding=\"async\" alt=\"Vzory v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens)\" src=\"\/wp-content\/uploads\/2020\/10\/69ddbf4c726bcc15aea1a1e2d67a3fc8.png\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p><\/p>\n<p>Na tom m\u00e1m v\u0161e. Terraform je opravdu skv\u011bl\u00fd, pou\u017e\u00edvejte ho. D\u011bkuji!<\/p>\n<p><\/p>\n<p>Ot\u00e1zky<\/p>\n<p><\/p>\n<p><em>D\u011bkuji za prezentaci! V\u00e1\u0161 state soubor le\u017e\u00ed v S3, jak \u0159e\u0161\u00edte probl\u00e9m, \u017ee n\u011bkolik lid\u00ed m\u016f\u017ee vz\u00edt tento state soubor a pokusit se nasadit?<\/em><\/p>\n<p><\/p>\n<p>Za prv\u00e9, nesp\u011bch\u00e1me. Za druh\u00e9, m\u00e1me flagy, ve kter\u00fdch oznamujeme, \u017ee pracujeme na n\u011bjak\u00e9 \u010d\u00e1sti k\u00f3du. Tedy, i kdy\u017e je infrastruktura velmi velk\u00e1, neznamen\u00e1 to, \u017ee n\u011bkdo n\u011bco neust\u00e1le aplikuje. Kdy\u017e byla aktivn\u00ed f\u00e1ze \u2013 to byl probl\u00e9m, na\u0161e state soubory byly ulo\u017eeny v Gitu. Bylo to d\u016fle\u017eit\u00e9, jinak by n\u011bkdo vytvo\u0159il state soubor a museli jsme je ru\u010dn\u011b sb\u00edrat do kupy, aby v\u0161echno pokra\u010dovalo. Te\u010f tento probl\u00e9m nen\u00ed. A v\u016fbec, Terraform tuto \u00falohu vy\u0159e\u0161il. A pokud se n\u011bco neust\u00e1le m\u011bn\u00ed, m\u016f\u017eete pou\u017e\u00edt z\u00e1mky, kter\u00e9 br\u00e1n\u00ed tomu, co jste zm\u00ednili.<\/p>\n<p><\/p>\n<p><em>Pou\u017e\u00edv\u00e1te otev\u0159enou verzi nebo enterprise?<\/em><\/p>\n<p><\/p>\n<p>\u017d\u00e1dn\u00e9 enterprise, tedy v\u0161e, co si m\u016f\u017eete st\u00e1hnout zdarma. <\/p>\n<p><\/p>\n<p><em>Jmenuji se Stanislav. Cht\u011bl jsem ud\u011blat malou pozn\u00e1mku. Hovo\u0159ili jste o funkci Amazon, kter\u00e1 umo\u017e\u0148uje, aby byl instance nezni\u010diteln\u00fd. To je tak\u00e9 v samotn\u00e9m Terraformu, v bloku Life Second m\u016f\u017eete zapsat z\u00e1kaz na zm\u011bnu nebo z\u00e1kaz na zni\u010den\u00ed.<\/em> <\/p>\n<p><\/p>\n<p>M\u011bl jsem \u010dasov\u00e9 omezen\u00ed. Dobr\u00fd post\u0159eh. <\/p>\n<p><\/p>\n<p><em>Cht\u011bl jsem se tak\u00e9 zeptat na dv\u011b v\u011bci. Zaprv\u00e9, zm\u00ednili jste se o testov\u00e1n\u00ed. Pou\u017e\u00edvali jste n\u011bjak\u00e9 n\u00e1stroje pro testov\u00e1n\u00ed? Sly\u0161el jsem o pluginu Test Kitchen. Mo\u017en\u00e1 existuje i n\u011bco jin\u00e9ho. A cht\u011bl bych se tak\u00e9 zeptat na Local Values. \u010c\u00edm se v z\u00e1sad\u011b li\u0161\u00ed od Input Variables? A pro\u010d nemohu parametrizovat n\u011bco jen p\u0159es Local Values? Sna\u017eil jsem se s touto t\u00e9matem pochopit, ale n\u011bjak jsem se v tom nevyznal.<\/em><\/p>\n<p><\/p>\n<p>O tomto m\u016f\u017eeme podrobn\u011bji mluvit za t\u00edmto s\u00e1lem. N\u00e1stroje pro testov\u00e1n\u00ed - to m\u00e1me \u00fapln\u011b dom\u00e1c\u00ed. Tam nen\u00ed nic, co by n\u00e1m umo\u017enilo testovat. V z\u00e1sad\u011b existuj\u00ed mo\u017enosti, kdy automatick\u00e9 testy zvedaj\u00ed infrastrukturu n\u011bkde, kontroluj\u00ed, \u017ee je v po\u0159\u00e1dku, a pak v\u0161echno zni\u010d\u00ed s reportem, \u017ee va\u0161e infrastruktura je st\u00e1le v dobr\u00e9 kondici. To u n\u00e1s nen\u00ed, proto\u017ee testovac\u00ed steky se spou\u0161t\u011bj\u00ed ka\u017ed\u00fd den. A to je dost. A pokud se n\u011bco za\u010dne rozpadat, za\u010dne se to rozpadat, ani\u017e bychom to je\u0161t\u011b n\u011bkde zkontrolovali. <\/p>\n<p><\/p>\n<p>Pokud jde o Local Values, poj\u010fme pokra\u010dovat v rozhovoru za s\u00e1lem. <\/p>\n<p><\/p>\n<p><em>Ahoj! D\u011bkuji za p\u0159edn\u00e1\u0161ku! Bylo to velmi informativn\u00ed. Mluvil jsi o tom, \u017ee m\u00e1te hodn\u011b uniformn\u00edho k\u00f3du pro popis infrastruktury. Nezva\u017eovali jste mo\u017enost generov\u00e1n\u00ed tohoto k\u00f3du?<\/em><\/p>\n<p><\/p>\n<p>Skv\u011bl\u00e1 ot\u00e1zka, d\u011bkuji! V\u011bc je takov\u00e1, \u017ee kdy\u017e pou\u017e\u00edv\u00e1me infrastrukturu jako k\u00f3d, p\u0159edpokl\u00e1d\u00e1me, \u017ee se d\u00edv\u00e1me na k\u00f3d a rozum\u00edme, jak\u00e1 infrastruktura za t\u00edmto k\u00f3dem le\u017e\u00ed. Pokud je k\u00f3d generov\u00e1n, mus\u00edme si p\u0159edstavit, jak\u00fd k\u00f3d bude vygenerov\u00e1n, abychom pochopili, jak\u00e1 infrastruktura tam bude. Bu\u010f generujeme k\u00f3d, commiteme ho a v podstat\u011b se dost\u00e1v\u00e1me k tomu sam\u00e9mu. Proto jsme \u0161li cestou, jak jsme to napsali, dostali jsme to. Nav\u00edc gener\u00e1tory se objevily o n\u011bco pozd\u011bji, kdy\u017e jsme za\u010dali d\u011blat. A u\u017e bylo pozd\u011b na zm\u011bnu.<\/p>\n<p><\/p>\n<p><em>Sly\u0161el jsi n\u011bco o jsonnet?<\/em><\/p>\n<p><\/p>\n<p>Ne. <\/p>\n<p><\/p>\n<p><em>Pod\u00edvej, to je velmi skv\u011bl\u00e1 v\u011bc. Vid\u00edm konkr\u00e9tn\u00ed p\u0159\u00edpad, kde bychom to mohli aplikovat a generovat datovou strukturu.<\/em> <\/p>\n<p><\/p>\n<p>Gener\u00e1tory jsou dobr\u00e9, kdy\u017e m\u00e1te, jako v anekdot\u011b o holic\u00edm strojku. Tedy prvn\u011b je obli\u010dej r\u016fzn\u00fd, ale pak maj\u00ed v\u0161ichni obli\u010dej stejn\u00fd. Gener\u00e1tory jsou velmi p\u0159\u00edjemn\u00e9. Ale bohu\u017eel, na\u0161e obli\u010deje jsou trochu jin\u00e9. To je probl\u00e9m. <\/p>\n<p><\/p>\n<p><em>Jen se pod\u00edvej. D\u011bkuji!<\/em><\/p>\n<p><\/p>\n<p><em>Jmenuji se Maxim, jsem ze Sberbank. Trochu jste \u0159ekli, \u017ee jste se sna\u017eili p\u0159izp\u016fsobit Terraform analogii programovac\u00edho jazyka. Nebylo by jednodu\u0161\u0161\u00ed pou\u017e\u00edvat Ansible?<\/em><\/p>\n<p><\/p>\n<p>To jsou velmi r\u016fzn\u00e9 v\u011bci. Lze pomoc\u00ed Ansible vytv\u00e1\u0159et zdroje a Puppet tak\u00e9 dok\u00e1\u017ee vytv\u00e1\u0159et zdroje v Amazonu. Ale Terraform je p\u0159\u00edmo na to zam\u011b\u0159en. <\/p>\n<p><\/p>\n<p><em>M\u00e1te jen Amazon?<\/em><\/p>\n<p><\/p>\n<p>Nejde o to, \u017ee m\u00e1me jen Amazon. M\u00e1me t\u00e9m\u011b\u0159 jen Amazon. Ale kl\u00ed\u010dovou funkc\u00ed je, \u017ee Terraform si pamatuje. V Ansible, kdy\u017e \u0159eknete: \"Zvedni mi 5 instance\", tak je zvedne, a pak \u0159eknete: \"A te\u010f pot\u0159ebuji 3\". A Terraform \u0159ekne: \"Dob\u0159e, 2 zru\u0161\u00edm\", zat\u00edmco Ansible \u0159ekne: \"Dob\u0159e, tady m\u00e1\u0161 3\". Celkem 8.<\/p>\n<p><\/p>\n<p><em>Dobr\u00fd den! D\u011bkuji za va\u0161i p\u0159edn\u00e1\u0161ku! Bylo velmi zaj\u00edmav\u00e9 poslouchat o Terraformu. Hned chci d\u00e1t mal\u00fd koment\u00e1\u0159 k tomu, \u017ee Terraform p\u0159ece jen nem\u00e1 stabiln\u00ed verzi, tak\u017ee k Terraformu p\u0159istupujte s velkou opatrnost\u00ed.<\/em><\/p>\n<p><\/p>\n<p>Dobr\u00e1 l\u017e\u00edce ke ob\u011bdu. Tedy pokud pot\u0159ebujete \u0159e\u0161en\u00ed, n\u011bkdy odlo\u017e\u00edte to, co je nestabiln\u00ed apod., ale funguje to a pomohlo n\u00e1m. <\/p>\n<p><\/p>\n<p><em>M\u00e1m ot\u00e1zku. Pou\u017e\u00edv\u00e1te Remote backend, pou\u017e\u00edv\u00e1te S3. Pro\u010d nepou\u017e\u00edv\u00e1te ofici\u00e1ln\u00ed backend?<\/em><\/p>\n<p><\/p>\n<p>Ofici\u00e1ln\u00ed?<\/p>\n<p><\/p>\n<p><em>Terraform Cloud.<\/em><\/p>\n<p><\/p>\n<p>Kdy se objevil?<\/p>\n<p><\/p>\n<p><em>P\u0159ed 4 m\u011bs\u00edci.<\/em> <\/p>\n<p><\/p>\n<p>Kdyby se objevil p\u0159ed 4 lety, pravd\u011bpodobn\u011b bych odpov\u011bd\u011bl na va\u0161i ot\u00e1zku.<\/p>\n<p><\/p>\n<p><em>Ji\u017e m\u00e1 vestav\u011bnou funkci a z\u00e1mky, a m\u016f\u017eete uchov\u00e1vat state-file. Zkuste to. Ale ani j\u00e1 jsem to netestoval.<\/em><\/p>\n<p><\/p>\n<p>Jedeme ve velk\u00e9m vlaku, kter\u00fd jede velkou rychlost\u00ed. A nem\u016f\u017eete jen tak vz\u00edt a vyhodit n\u011bkolik vagon\u016f. <\/p>\n<p><\/p>\n<p><em>Mluvili jste o sn\u011bhov\u00fdch vlo\u010dk\u00e1ch, a pro\u010d jste nepou\u017eili branch? Pro\u010d se to nepoda\u0159ilo tak ud\u011blat?<\/em><\/p>\n<p><\/p>\n<p>M\u00e1me p\u0159\u00edstup, \u017ee cel\u00e1 infrastruktura je v jednom repozit\u00e1\u0159i. Terraform, Puppet, v\u0161echny skripty, kter\u00e9 se n\u011bjak t\u00fdkaj\u00ed tohoto, jsou v\u0161echny v jednom repozit\u00e1\u0159i. T\u00edmto zp\u016fsobem m\u016f\u017eeme zaru\u010dit, \u017ee inkrement\u00e1ln\u00ed zm\u011bny jsou testov\u00e1ny jedna po druh\u00e9. Kdyby to byly hromady branch\u00ed, byl by takov\u00fd projekt prakticky neudr\u017eovateln\u00fd. Uplynou p\u016fl roku a rozch\u00e1zej\u00ed se tak, \u017ee je to prost\u011b trest. To je to, od \u010deho jsem cht\u011bl ut\u00e9ct, a\u017e do refaktoringu. <\/p>\n<p><\/p>\n<p><em>Tedy to nefunguje?<\/em><\/p>\n<p><\/p>\n<p>To v\u016fbec nefunguje.<\/p>\n<p><\/p>\n<p>V branchi jsem odstranil sn\u00edmek slo\u017eky. Tedy pokud bychom vytvo\u0159ili pro ka\u017edou testovac\u00ed v\u011btev, nap\u0159\u00edklad t\u00fdm A \u2013 maj\u00ed svou slo\u017eku, t\u00fdm B m\u00e1 svou slo\u017eku, pak to tak\u00e9 nefunguje. Vytvo\u0159ili jsme jednotn\u00fd k\u00f3d testovac\u00edho prost\u0159ed\u00ed, kter\u00fd byl dostate\u010dn\u011b flexibiln\u00ed, aby vyhovoval v\u0161em. Tedy jsme spravovali jeden k\u00f3d. <\/p>\n<p><\/p>\n<p><em>Ahoj! Jmenuji se Jura! D\u011bkuji za prezentaci! M\u00e1m ot\u00e1zku ohledn\u011b modul\u016f. \u0158\u00edk\u00e1te, \u017ee pou\u017e\u00edv\u00e1te moduly. Jak \u0159e\u0161\u00edte situaci, kdy\u017e n\u011bkdo v jednom modulu provede zm\u011bny, kter\u00e9 nejsou kompatibiln\u00ed se zm\u011bnou druh\u00e9 osoby? N\u011bjak verzujete moduly, nebo se sna\u017e\u00edte p\u0159izp\u016fsobit vyn\u00e1lez, abyste splnili dv\u011b po\u017eadavky?<\/em><\/p>\n<p><\/p>\n<p>Je to probl\u00e9m velk\u00e9ho sn\u011bhul\u00e1ka. To je, co n\u00e1s tr\u00e1p\u00ed, kdy\u017e n\u011bjak\u00e1 ne\u0161kodn\u00e1 zm\u011bna m\u016f\u017ee rozb\u00edt n\u011bjakou \u010d\u00e1st infrastruktury. A to bude patrn\u00e9 a\u017e po n\u011bjak\u00e9 dob\u011b.<\/p>\n<p><\/p>\n<p><em>Tedy zat\u00edm to nen\u00ed \u0159e\u0161eno?<\/em><\/p>\n<p><\/p>\n<p>D\u011bl\u00e1te univerz\u00e1ln\u00ed moduly. Vyh\u00fdbejte se sn\u011bhov\u00fdm vlo\u010dk\u00e1m. A v\u0161echno bude fungovat. Druh\u00e1 polovina prezentace je o tom, jak tomu zabr\u00e1nit.<\/p>\n<p><\/p>\n<p><em>Dobr\u00fd den! D\u011bkuji za prezentaci! Cht\u011bl bych up\u0159esnit. Z\u016fstala zde velk\u00e1 hromada, kv\u016fli kter\u00e9 jsem p\u0159i\u0161el. Jak\u00fdm zp\u016fsobem jsou integrov\u00e1ny Puppet a rozd\u011blen\u00ed rol\u00ed?<\/em><\/p>\n<p><\/p>\n<p>User-data.<\/p>\n<p><\/p>\n<p><em>Tedy jen vypust\u00edte soubor a podle n\u011bj n\u011bjak prov\u00e1d\u00edte?<\/em><\/p>\n<p><\/p>\n<p>User-data \u2013 to je pozn\u00e1mka, tedy kdy\u017e vytv\u00e1\u0159\u00edme klon obrazu, tak se tam spust\u00ed Daemon a sna\u017e\u00ed se pochopit, k\u00fdm je, a \u010dte pozn\u00e1mku, \u017ee je load balancer.<\/p>\n<p><\/p>\n<p><em>Tedy je to n\u011bjak\u00fd samostatn\u00fd proces, kter\u00fd se vrac\u00ed?<\/em><\/p>\n<p><\/p>\n<p>Nebyli jsme ti, kdo to vynalezli. Pou\u017e\u00edv\u00e1me to. <\/p>\n<p><\/p>\n<p><em>Dobr\u00fd den! M\u00e1m ot\u00e1zku ohledn\u011b User-data. \u0158\u00edkali jste, \u017ee tam jsou probl\u00e9my, \u017ee n\u011bkdo m\u016f\u017ee n\u011bco poslat \u0161patn\u011b. Je n\u011bjak\u00fd zp\u016fsob, jak uchov\u00e1vat user-data ve stejn\u00e9m Gitu, aby bylo v\u017edy jasn\u00e9, na co se odkazuje User-data?<\/em><\/p>\n<p><\/p>\n<p>User-data generujeme z template. To znamen\u00e1, \u017ee se tam dostane n\u011bjak\u00fd po\u010det prom\u011bnn\u00fdch. A Terraform generuje fin\u00e1ln\u00ed v\u00fdsledek. Proto se ned\u00e1 jen tak pod\u00edvat na template a \u0159\u00edct, co vznikne, proto\u017ee v\u0161echny probl\u00e9my vznikaj\u00ed z toho, \u017ee v\u00fdvoj\u00e1\u0159 si mysl\u00ed, \u017ee do t\u00e9to prom\u011bnn\u00e9 p\u0159ed\u00e1v\u00e1 \u0159et\u011bzec, ale ve skute\u010dnosti se dost\u00e1v\u00e1 pole. A on najednou \u2013 bum, a j\u00e1 \u2013 ten a ten, n\u00e1sleduj\u00edc\u00ed \u0159et\u011bzec, a v\u0161echno se rozpadne. Pokud je to nov\u00fd zdroj a \u010dlov\u011bk jej spou\u0161t\u00ed, sleduje, \u017ee n\u011bco nefunguje, tak se to rychle vy\u0159e\u0161\u00ed. Ale pokud se aktualizovala autoscale skupina, tak v ur\u010dit\u00e9m okam\u017eiku se instance v autoscale skupin\u011b za\u010dnou m\u011bnit. A bum, n\u011bco nefunguje. To je frustruj\u00edc\u00ed.<\/p>\n<p><\/p>\n<p><em>Znamen\u00e1 to, \u017ee jedin\u00e9 \u0159e\u0161en\u00ed je testovat?<\/em><\/p>\n<p><\/p>\n<p>Ano, vid\u00edte probl\u00e9m, p\u0159id\u00e1te tam testovac\u00ed kroky. To znamen\u00e1, \u017ee lze tak\u00e9 testovat output. Mo\u017en\u00e1 to nen\u00ed tak pohodln\u00e9, ale m\u016f\u017eete tak\u00e9 nastavit n\u011bjak\u00e9 zna\u010dky \u2013 zkontrolujte, \u017ee User-data je tady p\u0159ibita h\u0159eb\u00edky. <\/p>\n<p><\/p>\n<p><em>Jmenuji se Timur. Je skv\u011bl\u00e9, \u017ee existuj\u00ed p\u0159edn\u00e1\u0161ky o tom, jak spr\u00e1vn\u011b organizovat Terraform.<\/em><\/p>\n<p><\/p>\n<p>Je\u0161t\u011b jsem ani neza\u010dal.<\/p>\n<p><\/p>\n<p><em>Mysl\u00edm, \u017ee na p\u0159\u00ed\u0161t\u00ed konferenci mo\u017en\u00e1 bude. M\u00e1m jednoduchou ot\u00e1zku. Pro\u010d hardcod\u00edte hodnotu v samostatn\u00e9m modulu, a nepou\u017e\u00edv\u00e1te tfvars, to znamen\u00e1, \u010d\u00edm je lep\u0161\u00ed modul se hodnotami ne\u017e tfvars?<\/em><\/p>\n<p><\/p>\n<p>To znamen\u00e1, \u017ee tady (sn\u00edmek: Production\/environment\/settings.tf) nap\u00ed\u0161u: domain = prom\u011bnn\u00e1, domain vpcnetwork, prom\u011bnn\u00e1 vpcnetwork a stvars \u2013 tak\u00e9 z\u00edskat tot\u00e9\u017e?<\/p>\n<p><\/p>\n<p><em>D\u011bl\u00e1me to p\u0159esn\u011b takto. Odkazujeme na modul setting source, nap\u0159\u00edklad.<\/em><\/p>\n<p><\/p>\n<p>V podstat\u011b je to takov\u00fd tfvars. Tfvars je velmi pohodln\u00fd v testing prost\u0159ed\u00ed. M\u00e1m tfvars pro velk\u00e9 instance, pro mal\u00e9. A hod\u00edm jeden soubor do slo\u017eky. A dostanu to, co jsem cht\u011bl. Kdy\u017e stav\u00edme infrastrukturu, chceme, aby bylo mo\u017en\u00e9 se pod\u00edvat a okam\u017eit\u011b v\u0161e pochopit. A tak se ukazuje, \u017ee je pot\u0159eba se pod\u00edvat sem, pak se pod\u00edvat do tfvars.<\/p>\n<p><\/p>\n<p><em>Znamen\u00e1 to, aby bylo v\u0161e na jednom m\u00edst\u011b?<\/em><\/p>\n<p><\/p>\n<p>Ano, tfvars \u2013 to je, kdy\u017e m\u00e1te jeden k\u00f3d. A ten je pou\u017e\u00edv\u00e1n na n\u011bkolika r\u016fzn\u00fdch m\u00edstech s r\u016fzn\u00fdmi nuancemi. Pak byste tfvars hodili a z\u00edskali sv\u00e9 nuance. A my \u2013 to je infrastruktura jako k\u00f3d v \u010dist\u00e9 podob\u011b. Pod\u00edval jste se a pochopil. <\/p>\n<p><\/p>\n<p><em>Ahoj! Setkal jste se n\u011bkdy se situacemi, kdy cloudov\u00fd poskytovatel zasahuje do toho, co jste ud\u011blali pomoc\u00ed Terraformu? \u0158ekn\u011bme, upravujeme metadata. Tam jsou ssh kl\u00ed\u010de. A Google tam neust\u00e1le cpuje sv\u00e1 metadata, sv\u00e9 kl\u00ed\u010de. A Terraform neust\u00e1le p\u00ed\u0161e, \u017ee m\u00e1 zm\u011bny. Po ka\u017ed\u00e9m b\u011bhu, i kdy\u017e se nic nem\u011bn\u00ed, v\u017edy \u0159\u00edk\u00e1, \u017ee toto pole bude aktualizovat.<\/em><\/p>\n<p><\/p>\n<p>S kl\u00ed\u010di, ano, \u010d\u00e1st infrastruktury je zasa\u017eena t\u00edmto probl\u00e9mem, tj. Terraform nem\u016f\u017ee nic zm\u011bnit. My tak\u00e9 nem\u016f\u017eeme nic zm\u011bnit ru\u010dn\u011b. Zat\u00edm s t\u00edm \u017eijeme.<\/p>\n<p><\/p>\n<p><em>Tedy, setkal jste se s t\u00edm, ale nic jste nevymysleli, on to d\u011bl\u00e1 znovu a znovu s\u00e1m?<\/em><\/p>\n<p><\/p>\n<p>Bohu\u017eel, ano. <\/p>\n<p><\/p>\n<p><em>Ahoj! Jmenuji se Stanislav Starkov. Mail.ru Group. Jak \u0159e\u0161\u00edte probl\u00e9m s generov\u00e1n\u00edm tagu na ..., jak ho p\u0159ed\u00e1v\u00e1te dovnit\u0159? Ch\u00e1pu to spr\u00e1vn\u011b, \u017ee p\u0159es User-data, abyste uvedli host name, nasm\u011brovali Puppet? A druh\u00e1 \u010d\u00e1st ot\u00e1zky. Jak \u0159e\u0161\u00edte tuto ot\u00e1zku v SG, tj. kdy\u017e generujete SG, stovka podobn\u00fdch instanc\u00ed, jak je spr\u00e1vn\u011b pojmenovat?<\/em><\/p>\n<p><\/p>\n<p>Ty instance, kter\u00e9 jsou pro n\u00e1s velmi d\u016fle\u017eit\u00e9, pojmenov\u00e1v\u00e1me hezky. Ty, kter\u00e9 nejsou pot\u0159eba, maj\u00ed p\u0159\u00edponu, \u017ee to je autoscale-skupina. A ide\u00e1ln\u011b to lze ukon\u010dit a z\u00edskat nov\u00e9. <\/p>\n<p><\/p>\n<p>Pokud jde o probl\u00e9m s tagem, tak nen\u00ed takov\u00fd probl\u00e9m, ale je to takov\u00fd \u00fakol. A tagy m\u00e1me velmi, velmi siln\u011b pou\u017e\u00edv\u00e1ny, proto\u017ee infrastruktura je velk\u00e1 a drah\u00e1. Mus\u00edme se d\u00edvat, na co jdou pen\u00edze, proto tagy umo\u017e\u0148uj\u00ed zjistit, co a kam \u0161lo. A tedy hled\u00e1n\u00ed toho, na co se utr\u00e1c\u00ed hodn\u011b pen\u011bz. <\/p>\n<p><\/p>\n<p>O \u010dem byl je\u0161t\u011b dal\u0161\u00ed dotaz?<\/p>\n<p><\/p>\n<p><em>Kdy\u017e SG vytv\u00e1\u0159\u00ed stovku instanc\u00ed, je pot\u0159eba je n\u011bjak odli\u0161it?<\/em><\/p>\n<p><\/p>\n<p>Ne, nen\u00ed pot\u0159eba. Na ka\u017ed\u00e9 instanci je agent, kter\u00fd hl\u00e1s\u00ed, \u017ee m\u00e1m probl\u00e9m. Pokud agent hl\u00e1s\u00ed, agent o n\u011bm v\u00ed a minim\u00e1ln\u011b jeho IP adresa existuje. U\u017e lze ut\u00edkat. D\u00e1le pou\u017e\u00edv\u00e1me Consul pro Discovery tam, kde nen\u00ed Kubernetes. A Consul tak\u00e9 ukazuje IP adresu instance.<\/p>\n<p><\/p>\n<p><em>Tedy, orientujete se pr\u00e1v\u011b podle IP, a ne podle host name?<\/em><\/p>\n<p><\/p>\n<p>Nen\u00ed mo\u017en\u00e9 se orientovat podle host name, je jich p\u0159\u00edli\u0161 mnoho. Existuj\u00ed identifik\u00e1tory instance \u2013 AE atd. Ten lze n\u011bkde naj\u00edt, m\u016f\u017eete ho hodit do vyhled\u00e1v\u00e1n\u00ed. <\/p>\n<p><\/p>\n<p><em>Ahoj! Pochopil jsem, \u017ee Terraform je skv\u011bl\u00e1 v\u011bc, ur\u010den\u00e1 pro cloudy.<\/em> <\/p>\n<p><\/p>\n<p>Nejen to. <\/p>\n<p><\/p>\n<p><em>Toto je ot\u00e1zka, kter\u00e1 m\u011b zaj\u00edm\u00e1. Pokud se rozhodnete p\u0159ech\u00e1zet, dejme tomu, na Bare Metal ve velk\u00e9m se v\u0161emi sv\u00fdmi instancemi? Nebudou \u017e\u00e1dn\u00e9 probl\u00e9my? Anebo se bude muset pou\u017e\u00edt jin\u00e9 produkty, nap\u0159\u00edklad ten zm\u00edn\u011bn\u00fd Ansible?<\/em><\/p>\n<p><\/p>\n<p>Ansible je o n\u011b\u010dem jin\u00e9m. Tedy Ansible funguje a\u017e pot\u00e9, co se instance spustila. Terraform funguje p\u0159ed t\u00edm, ne\u017e se instance spustila. P\u0159echod na Bare Metal \u2013 ne. <\/p>\n<p><\/p>\n<p><em>Te\u010f ne, ale p\u0159ijdou obchodn\u00edci a \u0159eknou: 'Jdeme na to.'<\/em><\/p>\n<p><\/p>\n<p>P\u0159echod na jinou cloudovou slu\u017ebu \u2013 ano, ale tady je to tro\u0161ku jin\u00e1 z\u00e1le\u017eitost. Je pot\u0159eba napsat Terraform k\u00f3d tak, aby bylo mo\u017en\u00e9 s men\u0161\u00edmi obt\u00ed\u017eemi p\u0159ej\u00edt na jin\u00fd cloud. <\/p>\n<p><\/p>\n<p>P\u016fvodn\u011b byla stanovena takov\u00e1 \u00faloha, \u017ee na\u0161e cel\u00e1 infrastruktura by m\u011bla b\u00fdt agnostick\u00e1, tedy jak\u00fdkoli cloud by m\u011bl vyhovovat, ale v ur\u010dit\u00e9m okam\u017eiku se byznys vzdal a \u0159ekl: 'Dob\u0159e, v nejbli\u017e\u0161\u00edch N letech nikam neodejdeme, m\u016f\u017eeme pou\u017e\u00edvat slu\u017eby od Amazonu.'<\/p>\n<p><\/p>\n<p>Terraform umo\u017e\u0148uje vytv\u00e1\u0159et frontendov\u00e1 zam\u011bstn\u00e1n\u00ed, konfigurovat PagerDuty, datov\u00e9 dokumenty atd. M\u00e1 toho opravdu spoustu. V podstat\u011b m\u016f\u017ee kontrolovat cel\u00fd sv\u011bt.<\/p>\n<p><\/p>\n<p><em>D\u011bkuji za p\u0159edn\u00e1\u0161ku! J\u00e1 tak\u00e9 u\u017e 4 roky pracuji s Terraformem. B\u011bhem plynul\u00e9ho p\u0159echodu k Terraformu, k infrastruktu\u0159e, k deklarativn\u00edmu popisu, jsme se setk\u00e1vali se situac\u00ed, kdy n\u011bkdo n\u011bco d\u011bl\u00e1 ru\u010dn\u011b, a vy se sna\u017e\u00edte ud\u011blat pl\u00e1n. A dostanete tam n\u011bjakou chybu. Jak \u0159e\u0161\u00edte takov\u00e9 probl\u00e9my? Jak nach\u00e1z\u00edte ztracen\u00e9 zdroje, kter\u00e9 byly uvedeny?<\/em><\/p>\n<p><\/p>\n<p>Hlavn\u011b rukama a o\u010dima, pokud vid\u00edme v reportu n\u011bco podivn\u00e9ho, tak analyzujeme, co se tam d\u011bje, nebo to prost\u011b odstran\u00edme. A v\u016fbec, pull requesty \u2013 to je b\u011b\u017en\u00e1 v\u011bc. <\/p>\n<p><\/p>\n<p><em>Pokud se objev\u00ed chyba, d\u011bl\u00e1te rollback? Zkou\u0161eli jste to u\u017e?<\/em><\/p>\n<p><\/p>\n<p>Ne, to je rozhodnut\u00ed \u010dlov\u011bka v tu chv\u00edli, kdy vid\u00ed probl\u00e9m.<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/524712\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u0430\u0437\u0430\u043b\u043e\u0441\u044c \u0431\u044b, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Terraform \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0443\u0434\u043e\u0431\u043d\u044b\u0435 best practices \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 AWS-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u043e\u0439. \u0422\u043e\u043b\u044c\u043a\u043e \u0435\u0441\u0442\u044c \u043d\u044e\u0430\u043d\u0441. \u0421\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f, \u0432 \u043a\u0430\u0436\u0434\u043e\u043c \u043f\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0447\u0442\u0438 \u043a\u043e\u043f\u0438\u044f \u0441\u0442\u0435\u043a\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u0441\u043e\u0441\u0435\u0434\u043d\u0435\u043c \u0440\u0435\u0433\u0438\u043e\u043d\u0435. \u0418 Terraform-\u043a\u043e\u0434 \u043d\u0443\u0436\u043d\u043e \u0430\u043a\u043a\u0443\u0440\u0430\u0442\u043d\u043e \u0441\u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u043e\u0442\u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043d\u043e\u0432\u044b\u043c \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f\u043c \u0438\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u043d\u0435\u0436\u0438\u043d\u043a\u0443. \u041c\u043e\u0439 \u0434\u043e\u043a\u043b\u0430\u0434 \u043f\u0440\u043e \u043f\u0430\u0442\u0442\u0435\u0440\u043d\u044b \u0432 Terraform \u0434\u043b\u044f \u0431\u043e\u0440\u044c\u0431\u044b \u0441 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":98124,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-98123","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/patterny-v-terraform-dlya-borby-s-haosom-i-ruchnoj-rutinoj-maksim-kostrikin-ixtens\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041f\u0430\u0442\u0442\u0435\u0440\u043d\u044b \u0432 Terraform \u0434\u043b\u044f \u0431\u043e\u0440\u044c\u0431\u044b \u0441 \u0445\u0430\u043e\u0441\u043e\u043c \u0438 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0443\u0442\u0438\u043d\u043e\u0439. \u041c\u0430\u043a\u0441\u0438\u043c \u041a\u043e\u0441\u0442\u0440\u0438\u043a\u0438\u043d (Ixtens) | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/patterny-v-terraform-dlya-borby-s-haosom-i-ruchnoj-rutinoj-maksim-kostrikin-ixtens\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-24T12:42:52+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-11-17T22:58:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vzorov\u00e9 \u0161ablony v Terraformu pro boj s chaosem a ru\u010dn\u00ed rutinou. Maxim Kostrykin (Ixtens) | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/patterny-v-terraform-dlya-borby-s-haosom-i-ruchnoj-rutinoj-maksim-kostrikin-ixtens","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0430\u0442\u0442\u0435\u0440\u043d\u044b \u0432 Terraform \u0434\u043b\u044f \u0431\u043e\u0440\u044c\u0431\u044b \u0441 \u0445\u0430\u043e\u0441\u043e\u043c \u0438 \u0440\u0443\u0447\u043d\u043e\u0439 \u0440\u0443\u0442\u0438\u043d\u043e\u0439. \u041c\u0430\u043a\u0441\u0438\u043c \u041a\u043e\u0441\u0442\u0440\u0438\u043a\u0438\u043d (Ixtens) | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/patterny-v-terraform-dlya-borby-s-haosom-i-ruchnoj-rutinoj-maksim-kostrikin-ixtens","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-24T12:42:52+00:00","article:modified_time":"2020-11-17T22:58:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98123","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:04:35","updated":"2022-09-29 03:09:38","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/98123","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=98123"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/98123\/revisions"}],"predecessor-version":[{"id":164071,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/98123\/revisions\/164071"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/98124"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=98123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=98123"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=98123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}