2018년 11월 17일 GDG Incheon DevFest에서 발표한 내용입니다. Terraform / Ansible / Packer 등의 도구를 이용하여 서버를 코드로 관리하는 방법을 정리하였습니다.

1. ,
@wan2land
Incheon
Infrastructure as Code
(with AWS, Hashicorp)

2. Incheon
(@wan2land),
“ ”

3. www.monkeyuser.com/2018/architecture

4. www.monkeyuser.com/2018/architecture

5. • AWS
• Terraform
• Ansible
• Packer

6. .
1. Product(Backend + Frontend) .
2. t2.micro ( ..) .
3. git clone Product .
.
4. git pull, build .

7. 1. AMI .
2. .
3. logrotate
.

8. 1. .bash_history .
2. Stackoverflow .

9. 1. DynamoDB
2. DynamoDB Lambda → RDS
3. DynamoDB Stream Kinesis Firehose
4. Kinesis Firehose S3
5. S3 Athena
6. IAM

10. 1. DynamoDB
2. DynamoDB Lambda → RDS
3. DynamoDB Stream Kinesis Firehose
4. Kinesis Firehose S3
5. S3 Athena
6. IAM
..

14. Infrastructure as Code
…
1. AWS :
2. Terraform :
3. Packer :
4. Ansible :

15. Infrastructure as Code
…
1. AWS :
2. Terraform :
3. Packer :
4. Ansible :
?

16. ,
( )
Incheon

17. .

19. AWS
AWS .
, AWS .

20. AWS
,
direnv .
blog.outsider.ne.kr/1306

23. AdministratorAccess ,
.
docs.aws.amazon.com/ko_kr/general/latest/gr/aws-arns-and-namespaces.html

24. IAM?
AWS ,
Action + Resource .
Action .
( ..)

26. # .envrc 파일에 다음과 같이 작성합니다.
export AWS_ACCESS_KEY_ID='AKIAJQNQ5AHCU7DO2XTQ'
export AWS_SECRET_ACCESS_KEY='*******' # 비밀 액세스 키
.envrc

27. direnv: error .envrc is blocked. Run `direnv allow` to
approve its content.
$ direnv allow

28. AWS
,
Terraform, Packer
AWS .

30. Terraform
(EC2, RDS, VPC )
.

31. AWS .
www.terraform.io/docs/providers

32. Desired State Current State Real State

33. Terraform -
AWS CLI Parameter
. ( )
docs.aws.amazon.com/ko_kr/cli/latest/userguide/
cli-ec2-launch.html
www.terraform.io/docs/providers/aws/r/
instance.html

34. Terraform -
Terraform ,
AWS CLI .

35. # AWS 인스턴스 만들기
resource "aws_instance" "service" {
count = 1
ami = "${data.aws_ami.python3_latest.id}"
instance_type = "t2.small"
key_name = "${var.ec2_keyname}"
subnet_id = "${aws_subnet.default.id}"
vpc_security_group_ids = [
"${aws_security_group.ssh.id}",
]
root_block_device {
volume_size = 200
}
private_ip = "10.0.1.${11 + count.index}"
associate_public_ip_address = true
tags {
Name = "myservice"
}
}
main.tf

36. # AWS 인스턴스 만들기
resource "aws_instance" “service" {
count = 1
ami = "${data.aws_ami.python3_latest.id}"
instance_type = "t2.small"
key_name = "${var.ec2_keyname}"
subnet_id = "${aws_subnet.default.id}"
vpc_security_group_ids = [
"${aws_security_group.ssh.id}",
]
root_block_device {
volume_size = 200
}
private_ip = "10.0.1.${11 + count.index}"
associate_public_ip_address = true
tags {
Name = "myservice"
}
}
AMI ..
Subnet ..
Security Group ..
main.tf

37. # Subnet도 필요해서...
resource "aws_subnet" "default" {
vpc_id = "${aws_vpc.default.id}"
cidr_block = "10.0.0.0/20"
availability_zone = "ap-northeast-2a"
map_public_ip_on_launch = true # 인스턴스 생성시 자동 IP 매핑
tags {
Name = "default"
}
}
main.tf

38. Terraform
• aws_instance ..
• ami ..
• subnet
• vpc
• route table
• security group
• vpc
• ….

39. ,
.

40. Terraform - import
state
.
www.terraform.io/docs/import/usage.html

41. Terraform - data resource
data .
www.terraform.io/docs/configuration/data-
sources.html

42. Terraform
ID .

43. # AWS 인스턴스 만들기
resource "aws_instance" “service" {
count = 1
ami = "${data.aws_ami.python3_latest.id}"
instance_type = "t2.small"
key_name = "${var.ec2_keyname}"
subnet_id = "subnet-00000000000000000"
vpc_security_group_ids = [
"sg-00000000000000000",
]
root_block_device {
volume_size = 200
}
private_ip = "10.0.1.${11 + count.index}"
associate_public_ip_address = true
tags {
Name = "myservice"
}
}
main.tf

44. Terraform
ID ,
.

45. Terraform -
terraform apply
.

46. Terraform - tfstate
terraform.tfstate
.gitignore .

47. Desired State Current State Real State

48. Terraform - tfstate
tfstate PC
.

49. resource "aws_vpc" "default" {
cidr_block = "10.0.0.0/16"
enable_dns_hostnames = true # 인스턴스 생성시 dns 자동 매핑
tags {
Name = "default"
Terraform = "true"
}
}
resource "aws_internet_gateway" "default" {
vpc_id = "${aws_vpc.default.id}"
tags {
Name = "default"
Terraform = "true"
}
}
resource "aws_default_route_table" "default" {
default_route_table_id = "${aws_vpc.default.default_route_table_id}"
route {
cidr_block = "0.0.0.0/0"
gateway_id = "${aws_internet_gateway.default.id}"
}
tags {
Name = "default"
Terraform = "true"
}
}
resource "aws_subnet" "default_a" {
vpc_id = "${aws_vpc.default.id}"
cidr_block = "10.0.0.0/20"
availability_zone = "ap-northeast-2a"
map_public_ip_on_launch = true
tags {
Name = "default-a"
Terraform = "true"
}
} main.tf

50. resource "aws_security_group" "ssh" {
name = "ssh"
description = "SSH"
vpc_id = "${aws_vpc.default.id}"
tags {
Name = "ssh"
Terraform = "true"
}
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
description = "SSH"
cidr_blocks = "10.0.0.0/16"
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
description = "all"
cidr_blocks = ["0.0.0.0/0"]
ipv6_cidr_blocks = ["::/0"]
}
}
resource "aws_security_group" "http" {
name = "http"
description = "HTTP"
vpc_id = "${aws_vpc.default.id}"
tags {
Name = "http"
Terraform = "true"
}
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
description = "HTTP"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
description = "all"
cidr_blocks = ["0.0.0.0/0"]
ipv6_cidr_blocks = ["::/0"]
}
} main.tf

51. resource "aws_instance" "service" {
count = 1
ami = "${data.aws_ami.python3_latest.id}"
instance_type = "t2.small"
key_name = "${var.ec2_keyname}"
subnet_id = "${aws_subnet.default_a.id}"
vpc_security_group_ids = [
"${aws_security_group.ssh.id}",
"${aws_security_group.http.id}",
]
root_block_device {
volume_size = 200
}
private_ip = "10.0.1.${11 + count.index}"
associate_public_ip_address = true
tags {
Name = "myservice"
}
} main.tf

52. Terraform
VPC ,
VPC .
VPC , .

53. Terraform Registry
python pip .
registry.terraform.io

54. Terraform Registry
. ,
.
…

55. 55
.
Incheon

56. Terraform Provisioner
chef / puppet
Ansible .

59. Ansible
ansible-playbook .
(Push) ,
Ansible .
.

60. Ansible vs Shell
Ansible .
, 100
.
( , : idempotent)
,
.

61. Ansible vs Shell
, ,
(Shell)
.
Ansible
.

62. Ansible - Shell
Ansible
.
.
docs.ansible.com/ansible/2.5/modules/
shell_module.html

63. # fstab에 device를 추가하는 예시..
grep -q $DEVICE /etc/fstab
if [ $? == 1 ]; then
echo "append fstab..."
echo "$DEVICE $MOUNTPOINT ext4 defaults,nofail 0 2" | sudo tee --append /etc/
fstab > /dev/null
else
echo "skip append fstab"
fi

64. Ansible + Terraform
Terraform Ansible
Terraform local_file .

65. resource "local_file" "ansible_hosts" {
# 서버가 여러대일수도 있어서 *를 사용합니다.
content = <<EOF
[service]
${join("n", aws_instance.service.*.public_ip)}
EOF
filename = "${path.module}/inventories/prod/hosts" # 사용할 inventories 디렉토리
}
main.tf

66. Ansible + Terraform
hosts
.
ansible-playbook -i inventories/prod role/
example.yml

67. Ansible + Terraform
Terraform Provisioner Ansible ,
local-exec .
www.terraform.io/docs/provisioners/local-exec.html

68. ---
- name: Service Up
hosts: "{{ host | default('service') }}"
connection: ssh
user: ubuntu
vars:
ansible_ssh_private_key_file: "./certs/ansible.pem"
ansible_python_interpreter: "/usr/bin/python3"
tasks:
- name: install nginx
apt:
name: nginx
state: present
- name: install nodejs
apt:
name: nodejs
state: present
… 생략 …
role/example.yml

69. Ansible
Infra Ansible .
.

70. Ansible
.
1. Packer AMI .
2. Elastic Beanstalk, ECS AWS
.

71. Ansible
Ansible .
AMI
.

72. Ansible - Galaxy
Ansible .
galaxy.ansible.com

74. Packer
AMI .
Dockerfile , Shell
.

75. Packer
Instance
. ( )

76. {
"_comment": "우분투 한국어 AMI",
"_comment1": "- 한국어 언어팩 설치",
"_comment2": "- CloudWatch Server Agent 설치",
"builders": [
{
"type": "amazon-ebs",
"region": "ap-northeast-2",
"instance_type": "t2.micro",
"source_ami_filter": {
"filters": {
"virtualization-type": "hvm",
"name": "ubuntu/images/*ubuntu-xenial-16.04-amd64-server-*",
"root-device-type": "ebs"
},
"owners": [“0000000000”],
"most_recent": true
},
"ssh_username": "ubuntu",
"ami_name": "ubuntu-ko-{{isotime "060102-150405"}}",
"tags": {
"Name": "ubuntu-ko",
"Packer": "true"
}
}
],
ami/ubuntu-ko.json
"provisioners": [
{
"type": "shell",
"inline": [
"sudo apt update",
"sudo apt upgrade -y",
"sudo apt install -y language-pack-ko",
"sudo locale-gen ko_KR.UTF-8",
"sudo update-locale LANG=ko_KR.UTF-8 LC_MESSAGES=POSIX
LANGUAGE=ko_KR.UTF-8 LC_ALL=ko_KR.UTF-8",
"sudo apt install -y unzip libwww-perl libdatetime-perl",
"curl https://aws-cloudwatch.s3.amazonaws.com/downloads/
CloudWatchMonitoringScripts-1.2.2.zip -O",
"unzip CloudWatchMonitoringScripts-1.2.2.zip && rm
CloudWatchMonitoringScripts-1.2.2.zip"
]
},
{
"type": "file",
"source": "ami/ubuntu-ko/awscreds.conf",
"destination": "/home/ubuntu/aws-scripts-mon/awscreds.conf"
},
{
"type": "shell",
"inline": [
"echo "*/5 * * * * /home/ubuntu/aws-scripts-mon/mon-put-instance-
data.pl --mem-used-incl-cache-buff --mem-util --disk-space-util --disk-path=/ --
from-cron" | sudo tee /etc/cron.d/aws-scripts-mon"
]
}
]
}
AWS User ID

77. "provisioners": [
{
"type": "shell",
"inline": [
"sudo apt update",
"sudo apt upgrade -y",
"sudo apt install -y build-essential",
"curl -sL https://deb.nodesource.com/setup_10.x | sudo -E bash -",
"sudo apt install -y nodejs",
"sudo npm install -g npm",
"sudo npm install -g pm2",
"sudo pm2 startup systemd -u ubuntu --hp /home/ubuntu",
"sudo pm2 logrotate -u ubuntu",
"sudo chown -R $USER:$(id -gn $USER) ~/.config",
"sudo chown -R $USER:$(id -gn $USER) ~/.pm2",
"echo "nodejs $(node -v)"",
"echo "npm $(npm -v)"",
"echo "pm2 $(pm2 -v)"",
"echo "install complete!"",
"sudo dd if=/dev/zero of=/home/swapfile bs=1024 count=2000000",
"sudo mkswap /home/swapfile",
"sudo chmod 0644 /home/swapfile",
"sudo swapon /home/swapfile",
"echo "/home/swapfile none swap sw 0 0" | sudo tee --append /etc/
fstab > /dev/null",
"echo "swap setting complete!""
]
}
]
}
{
"_comment": "우분투 한국어 + NodeJS AMI",
"_comment1": "- NodeJS 설치",
"builders": [
{
"type": "amazon-ebs",
"region": "ap-northeast-2",
"instance_type": "t2.micro",
"source_ami_filter": {
"filters": {
"tag:Name": "ubuntu-ko",
"root-device-type": "ebs"
},
"owners": ["0000000000"],
"most_recent": true
},
"ssh_username": "ubuntu",
"ami_name": "ubuntu-nodejs-{{isotime "060102-150405"}}",
"tags": {
"Name": "ubuntu-nodejs",
"Packer": "true"
}
}
],
ami/ubuntu-nodejs.json
AWS User ID

79. Packer
AMI
.
git
.

80. {
"type": "file",
"source": "ami/service/bitbucket_rsa",
"destination": "~/.ssh/bitbucket_rsa"
},
{
"type": "shell",
"inline": [
"chmod 0400 ~/.ssh/bitbucket_rsa",
"echo "Host bitbucket-service" >> ~/.ssh/config",
"echo " Hostname bitbucket.org" >> ~/.ssh/config",
"echo " IdentityFile ~/.ssh/bitbucket_rsa" >> ~/.ssh/config",
"echo " IdentitiesOnly yes" >> ~/.ssh/config",
"touch ~/.ssh/known_hosts && ssh-keyscan bitbucket.org >> ~/.ssh/known_hosts",
"git clone git@bitbucket-service:datableteam/service.git",
"cd ~/service && git show",
"cd ~/service && npm ci && npm run build"
]
},
{
"type": "file",
"source": "ami/service/.env",
"destination": "~/service/.env"
},
{
"type": "file",
"source": "ami/service/pm2-app.json",
"destination": "~/service/pm2-app.json"
},
{
"type": "shell",
"inline": [
"pm2 start ~/service/pm2-app.json && pm2 stop service && pm2 dump"
]
}
ami/service.json

81. Packer + Terraform
Terraform data aws_ami
.

82. data "aws_ami" "nodejs_latest" {
most_recent = true
filter {
name = "name"
values = ["ubuntu-nodejs-*"]
}
owners = ["self"]
}
main.tf

83. Packer + Terraform
ubuntu-nodejs-* ,
terraform apply ,
.
.

84. Packer + Terraform
.
.

86. 1. direnv AWS .
2. Packer AMI .
3. AMI Terraform
. (Packer + Terraform )
4. Ansible
. (Ansible + Terraform )

87. 1. EC2 70
2. Elastic Beanstalk 2
3. RDS 2
4. DynamoDB 500GB
5. Lambda 10
6. Kinesis + S3 + Athena

88. 3 terraform ,
.

89. ,
.

90. 1.
→ vault / consul
2. EC2
→ Elastic Beanstalk / ECS
3. Terraform
4.
CI / Data Pipeline / Blue-Green
5. Serverless Framework for Lambda

91. • https://blog.outsider.ne.kr/1266
• https://medium.com/build-acl/state-drift-
detection-using-terraform-d0383628d2ea

92. Incheon
Thank you!
,
@wan2land

93. Q&A
Incheon