Terraform Code Reviews: Supercharged with Conftest

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

1
Jay Wallace, Production Engineering
Feb 20th, 2020
Twitter: @mootpt
Terraform Code Reviews:
Supercharged with Conftest

HashiTalks
2
Morning
Routine

HashiTalks
3
What we will cover
Typical Evolution of Terraform
Conftest
Easy Recipes For Success
Demo In Practice
OUTLINE

4
Typical Evolution of
Terraform

HashiTalks
Works on my machine
5
Looks good to me 🤖🤖🤖🤖
Evolution broken into 3 eras

HashiTalks
6
Agility vs
Stability
Agility
Stability

HashiTalks
7
Agility vs
Stability
Stability
Agility
Help Wanted

HashiTalks
8
Write some code
Works on
my
machine

HashiTalks
Apply locally
Works on
my
machine
9

HashiTalks
Uh Oh. Someone already
created the resource
Works on
my
machine
10

HashiTalks
11
This is a simple ﬁx. We will just add remote
state and it won’t happen again.

HashiTalks
Resource was created, but
it’s not in our conﬁg
Works on
my
machine
12

HashiTalks
13
Works on my machine
Make Changes Quick
Engineers can just ship.
Terraform apply is easy to just
run.
Nothing...

HashiTalks
Agility vs
Stability
Stability
Agility
Help Wanted
Startup Mode
14

HashiTalks
15
All of this should be happening in version
control. That’ll ﬁx it!

HashiTalks
16
Atlantis
Terraform Pull Request Automation

HashiTalks
17
Engineer writes some code
LGTM

HashiTalks
Pushes to GitHub.
LGTM
18

HashiTalks
Explains what they are
doing
LGTM
19

HashiTalks
20
Atlantis runs the plan
instead of the engineer
LGTM

HashiTalks
21
Requests an approval
before an apply can occur
LGTM

HashiTalks
22
Comments in GitHub to
trigger Atlantis to run apply
LGTM

HashiTalks
23
Looks good to me
Collaborative
Engineers able to collaborate
eﬀectively. Allows for code
review and approval...

HashiTalks
24
Agility vs
Stability
Stability
Agility
Help Wanted
Startup Mode
Slow and Steady

HashiTalks
25
Now I’m a full-time Pull Request reviewer.
How can I automate this?

26
Conftest

HashiTalks
27
These (policies) are the things were actually looking for when we
do code reviews. We should be checking for...

HashiTalks
28
OPA is an engine that
enables a single approach
for policy enforcement
across diﬀerent services
Conftest

HashiTalks
29
Built on top of OPA. With a
focus on testing data
Conftest

HashiTalks
30
Conftest
Purposeful Design
Designed speciﬁcally to be used
with CI or local testing.
Functionally same as OP...

HashiTalks
Conftest functionality
geared towards user
Conftest
31

HashiTalks
For us it started small.
Conftest
32

HashiTalks
Example policy execution
Conftest
33

HashiTalks
Example policy checking if
our security groups are too
open.
Conftest
34

HashiTalks
35
Great. How do I run this in my pipelines?

HashiTalks
GitHub Actions
36
There is a GitHub action for contest CircleCI has a conftest orb
Traditional CI
Atlantis is a...

37
Recipes for Success

HashiTalks
38
Recipe 1: Resource whitelisting

HashiTalks
Do we care about this
resource?
Recipe 1
39

HashiTalks
40
Recipe 2: Approved Modules

HashiTalks
Is the module approved?
Recipe 2
41

HashiTalks
42
Recipe 3: CRUD

HashiTalks
Is this engineer about to
delete a bunch of
resources?
Recipe 3
43

44
Example setup

HashiTalks
Atlantis + Custom Workﬂow
45
Execute Terraform and Conftest Pul; Request mergeable
GitHub Status Checks
Determi...

HashiTalks
Note the custom conftest
workﬂow
atlantis
46

HashiTalks
We both run conftest in this
scripts and update GitHub
with custom statuses
opa.sh
47

HashiTalks
We use this service over
CODEOWNERS as it
supports conditional
approvals on custom
statuses
pullapprove
48

49
Demo - Approved
Modules

HashiTalks
50
Conftest
Agility
With automated testing
engineers can move faster
without approvals
Auditable and Accountabl...

HashiTalks
51
Agility vs
Stability
Stability
Agility
Help Wanted
Startup Mode
Slow and Steady
Supercharged

52
Photo by Laura Johnston on Unsplash
Thank you

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1052471 views
Storytelling For The Web: Integrate... by Chiara Aliotta 967761 views
Artificial Intelligence, Data and C... by OECD Directorate ... 900577 views
How to Leverage AI to Boost Employe... by SocialHRCamp 380598 views
2024 State of Marketing Report – by... by Marius Sescu 215763 views
Everything You Need To Know About C... by Expeed Software 233752 views

View on Slideshare

1 of 52 Ad

View on Slideshare

1 of 52 Ad