Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Journey to Terraform Enterprise with upgrading v0.10 to v0.12

5,300 views

Published on

2019.10.23 Mitchell Hashimoto in Tokyo! HashiCorp Meetupにて、リクルートライフスタイルのSENTOチームで、Terraform Enterpriseの導入とTerraform 0.10から0.12へのアップグレードを紹介したLTの資料です。
https://hashicorp.connpass.com/event/146776/

Published in: Engineering
  • Login to see the comments

Journey to Terraform Enterprise with upgrading v0.10 to v0.12

  1. 1. Journey to Terraform Enterprise with upgrading v0.10 to v0.12 2019.10.23 Mitchell Hashimoto in Tokyo! HashiCorp Meetup Yu, SUDO / SENTO Team, Recruit Lifestyle
  2. 2. リクルートライフスタイル
 ネットビジネス本部
 横断インフラグループ
 SENTOチーム
 Yu, SUDO

  3. 3. https://pages.awscloud.com/rs/112-TZM-766/images/J3-03.pdf https://youtu.be/_Y7xGaG3xJU
  4. 4. 1
  5. 5. Our team 11 Members 70 Accounts
  6. 6. 11 Members 70 Accounts 140+ Terraform Workspaces
  7. 7. 11 Members 70 Accounts 70 Strong Credentials!!
  8. 8. Members change...but
  9. 9. Members change...but Can’t revoke everytime!!
  10. 10. Potential Risk on Governance for Credentials
  11. 11. 2
  12. 12. Our Repository is Github Enterprise With IP Whitelist GhE Terraform Cloud CircleCI Travis CI
  13. 13. GhE Jenkins Private Drone CI SSM Automation
  14. 14. Can you maintain CI tools for 70+ Accounts? Endless TOIL!! GhE Jenkins Private Drone CI SSM Automation
  15. 15. 3
  16. 16. Our Accounts are in-service for Customers, Clients
  17. 17. 11 Members 70 Accounts 1300+ commits 430+ PRs
  18. 18. Administering Core components on AWS Avoid misoperation incidents! IAM VPC Peering Security Group Subnets etc.
  19. 19. We needed a Smart Workflow automatic plan, apply with approval Create Pull Request → terraform plan Merged, Approved → terraform apply
  20. 20. Credentials Governance Smart WorkflowMaintenance Free CI for Terraform
  21. 21. Terraform Enterprise Credentials Governance Smart WorkflowMaintenance Free CI for Terraform Cheaper than employ terraform specialist !?
  22. 22. Terraform Enterprise
  23. 23. Workspaces based license, 70 Accounts 140+ Terraform Workspaces
  24. 24. Our Workspaces based on Terraform 0.10.8 upgrade to 0.12.x!! 0.12.x 0.10.8 0.11.x
  25. 25. Terraform Enterprise + Rewrite All with Terraform 0.12 Workspaces based license upgrade to 0.12.x
  26. 26. Workspaces Merged in Each Account system ├── dev │ ├── ap-northeast-1/main.tf │ └── global/main.tf └── prd ├── ap-northeast-1/main.tf └── global/main.tf system ├── dev │ └── main.tf └── prd └── main.tf 70 Workspaces
  27. 27. Modules Re-structured modules ├── cloudtrail ├── cloudwatch_logs ├── config ├── guardduty ├── iam : ├── s3_bucket └── vpc modules ├── account_base ├── audit ├── id_federation ├── log_collection ├── standard_network └── : by Use-cases
  28. 28. No Credentials, AssumeRole with ExternalID provider.tf profile = "****-terraform" assume_role { role_arn = "arn:aws:iam:: ************:role/terraform-role" session_name = "****-terraform" external_id = "XxxXXxxX" }
  29. 29. tfstate in Terraform Enterprise settings.tf backend "s3" { bucket = "****-terraform" key = "path/****.tfstate" region = "ap-northeast-1" profile = "****-terraform" } backend "remote" { hostname = "ptfe.hostname" workspaces { name = "****-terraform" } }
  30. 30. generate new tfstate using import with 800+ lines shell script 0.12.x tfstate 0.10.8 tfstate
  31. 31. Our Trouble on Terraform Enterprise
  32. 32. Terraform Enterprise Automated Recovery Recovery from S3 Snapshot into S3 Crash
  33. 33. Terraform Enterprise Automated Recovery Recovery from S3 Snapshot into S3 Crash
  34. 34. { "DaemonAuthenticationType": "anonymous", "TlsBootstrapType": "self-signed", "BypassPreflightChecks": true, "ImportSettingsFrom": "/path/to/settings.json", "LicenseFileLocation": "/path/to/license.rli" } misconfiguration of /etc/replicated.conf see https://www.terraform.io/docs/enterprise/install/automating-the-installer.html# online
  35. 35. After Terraform Enterprise Our Team 1. Execution without Credentials 2. Up-to-date Terraform CI suite 3. Smart Workflow with Approval
  36. 36. We are hiring! https://engineer.recruit-lifestyle.co.jp/recruiting/
  37. 37. THANK YOU

×