伺服器映像檔自動化：基礎設施團隊中的角色分工

// 基礎設施變更工作流程範例
function infrastructureChangeWorkflow() {
  // 1. 在版本控制系統中建立分支
  const branch = createFeatureBranch('update-network-config');
  
  // 2. 在分支中進行變更
  updateNetworkConfiguration(branch, {
    securityGroups: updatedSecurityGroups,
    routingRules: newRoutingRules
  });
  
  // 3. 提交變更並建立合併請求
  commitChanges(branch, 'Update network security groups and routing rules');
  createMergeRequest(branch, 'main');
  
  // 4. 自動化測試和審核
  runAutomatedTests(branch);
  requestPeerReview(branch);
  
  // 5. 合併並應用變更
  if (isApproved(branch) && testsPass(branch)) {
    mergeBranch(branch, 'main');
    // 自動觸釋出署流程
    triggerDeployment('main');
  }
}

# 環境設定範例 - 使用相同結構但不同引數
environments:
  development:
    instance_type: t3.medium
    auto_scaling:
      min_instances: 1
      max_instances: 2
    monitoring:
      log_level: DEBUG
      alerts_enabled: false
      
  staging:
    instance_type: t3.large
    auto_scaling:
      min_instances: 2
      max_instances: 4
    monitoring:
      log_level: INFO
      alerts_enabled: true
      
  production:
    instance_type: m5.xlarge
    auto_scaling:
      min_instances: 3
      max_instances: 10
    monitoring:
      log_level: WARN
      alerts_enabled: true

# Terraform藍綠佈署範例
resource "aws_autoscaling_group" "blue" {
  name                 = "blue-asg"
  launch_configuration = aws_launch_configuration.app_server.id
  min_size             = var.environment == "production" ? 3 : 1
  max_size             = var.environment == "production" ? 10 : 3
  vpc_zone_identifier  = aws_subnet.private.*.id
  
  tag {
    key                 = "Environment"
    value               = var.environment
    propagate_at_launch = true
  }
  
  tag {
    key                 = "Version"
    value               = "blue"
    propagate_at_launch = true
  }
}

resource "aws_autoscaling_group" "green" {
  name                 = "green-asg"
  launch_configuration = aws_launch_configuration.app_server_new.id
  min_size             = 0
  max_size             = 0  # 初始設定為0，佈署時會更新
  vpc_zone_identifier  = aws_subnet.private.*.id
  
  tag {
    key                 = "Environment"
    value               = var.environment
    propagate_at_launch = true
  }
  
  tag {
    key                 = "Version"
    value               = "green"
    propagate_at_launch = true
  }
}

resource "aws_lb_target_group" "blue" {
  name     = "blue-tg"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
}

resource "aws_lb_target_group" "green" {
  name     = "green-tg"
  port     = 80
  protocol = "HTTP"
  vpc_id   = aws_vpc.main.id
}

resource "aws_lb_listener" "front_end" {
  load_balancer_arn = aws_lb.main.arn
  port              = "80"
  protocol          = "HTTP"
  
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.blue.arn  # 初始指向藍色環境
  }
}

# Flux GitOps設定範例
apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: GitRepository
metadata:
  name: infrastructure-repo
  namespace: flux-system
spec:
  interval: 1m
  url: https://github.com/organization/infrastructure-repo
  ref:
    branch: main

---
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
kind: Kustomization
metadata:
  name: infrastructure
  namespace: flux-system
spec:
  interval: 10m
  path: "./environments/production"
  prune: true
  sourceRef:
    kind: GitRepository
    name: infrastructure-repo
  validation: client
  healthChecks:
    - apiVersion: apps/v1
      kind: Deployment
      name: api-gateway
      namespace: production
    - apiVersion: apps/v1
      kind: 有狀態集合
      name: database
      namespace: production

# 自動化合規檢查範例
def compliance_check(infrastructure_code):
    compliance_issues = []
    
    # 檢查安全組規則
    security_groups = extract_security_groups(infrastructure_code)
    for sg in security_groups:
        # 檢查是否有開放的SSH存取
        if has_open_ssh_access(sg):
            compliance_issues.append({
                "severity": "HIGH",
                "message": f"Security group {sg.id} allows unrestricted SSH access",
                "remediation": "Restrict SSH access to specific IP ranges"
            })
        
        # 檢查是否有過於寬鬆的入站規則
        if has_overly_permissive_rules(sg):
            compliance_issues.append({
                "severity": "MEDIUM",
                "message": f"Security group {sg.id} has overly permissive inbound rules",
                "remediation": "Restrict inbound traffic to necessary services only"
            })
    
    # 檢查加密設定
    storage_resources = extract_storage_resources(infrastructure_code)
    for resource in storage_resources:
        if not is_encryption_enabled(resource):
            compliance_issues.append({
                "severity": "HIGH",
                "message": f"Storage resource {resource.id} does not have encryption enabled",
                "remediation": "Enable encryption for all storage resources"
            })
    
    # 檢查標籤合規性
    all_resources = extract_all_resources(infrastructure_code)
    for resource in all_resources:
        missing_tags = check_required_tags(resource)
        if missing_tags:
            compliance_issues.append({
                "severity": "LOW",
                "message": f"Resource {resource.id} is missing required tags: {', '.join(missing_tags)}",
                "remediation": "Add all required tags to the resource"
            })
    
    return compliance_issues

#!/bin/bash
# 定期重新應用Terraform設定的指令碼

# 設定環境變數
export TF_LOG=INFO
export TF_LOG_PATH=/var/log/terraform/apply-$(date +%Y%m%d-%H%M%S).log

# 確保日誌目錄存在
mkdir -p /var/log/terraform

# 切換到Terraform設定目錄
cd /opt/terraform/environments/production

# 初始化Terraform（如果需要）
terraform init -input=false

# 應用設定
echo "Starting scheduled Terraform apply at $(date)"
terraform apply -auto-approve -input=false

# 檢查結果
if [ $? -eq 0 ]; then
  echo "Terraform apply completed successfully at $(date)"
  # 傳送成功通知
  /usr/local/bin/notify-team "Scheduled Terraform apply completed successfully"
else
  echo "Terraform apply failed at $(date)"
  # 傳送失敗警示
  /usr/local/bin/alert-team "Scheduled Terraform apply failed, manual intervention required"
fi

# 基礎設施偏差檢測指令碼
import json
import subprocess
import datetime
import smtplib
from email.mime.text import MIMEText
from email.mime.multipart import MIMEMultipart

def detect_terraform_drift():
    # 執行Terraform計劃以檢測偏差
    result = subprocess.run(
        ["terraform", "plan", "-detailed-exitcode", "-out=drift.plan"],
        capture_output=True,
        text=True
    )
    
    # Terraform結束碼：
    # 0 = 無變更
    # 1 = 錯誤
    # 2 = 有變更（偏差）
    
    if result.returncode == 0:
        return {"has_drift": False, "details": "No drift detected"}
    elif result.returncode == 2:
        # 提取計劃詳情
        show_result = subprocess.run(
            ["terraform", "show", "-json", "drift.plan"],
            capture_output=True,
            text=True
        )
        plan_json = json.loads(show_result.stdout)
        
        # 分析變更
        resource_changes = plan_json.get("resource_changes", [])
        drift_details = []
        
        for change in resource_changes:
            if change["change"]["actions"] != ["no-op"]:
                drift_details.append({
                    "resource": change["address"],
                    "action": change["change"]["actions"],
                    "reason": "Drift detected"
                })
        
        return {
            "has_drift": True,
            "details": drift_details,
            "count": len(drift_details)
        }
    else:
        # 錯誤情況
        return {
            "has_drift": None,
            "details": f"Error checking drift: {result.stderr}"
        }

def send_drift_report(drift_result):
    if not drift_result["has_drift"]:
        return  # 無偏差，不傳送報告
    
    # 建立報告
    report = f"""
    Infrastructure Drift Report - {datetime.datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
    
    Number of resources with drift: {drift_result['count']}
    
    Detailed Changes:
    """
    
    for item in drift_result["details"]:
        report += f"\n- Resource: {item['resource']}"
        report += f"\n  Action needed: {', '.join(item['action'])}"
        report += f"\n  Reason: {item['reason']}\n"
    
    # 傳送電子郵件報告
    msg = MIMEMultipart()
    msg['Subject'] = f"[ALERT] Infrastructure Drift Detected - {drift_result['count']} resources"
    msg['From'] = "infrastructure-monitor@example.com"
    msg['To'] = "infrastructure-team@example.com"
    
    msg.attach(MIMEText(report, 'plain'))
    
    with smtplib.SMTP('smtp.example.com') as server:
        server.send_message(msg)
    
    print(f"Drift report sent with {drift_result['count']} changes detected")

# 主執行流程
if __name__ == "__main__":
    drift_result = detect_terraform_drift()
    if drift_result["has_drift"]:
        send_drift_report(drift_result)
    else:
        print("No infrastructure drift detected")

# 混合不可變和可變基礎設施的Terraform範例

# 不可變元件 - 透過AMI和啟動組態管理
resource "aws_ami_from_instance" "app_server" {
  name               = "app-server-${var.app_version}"
  source_instance_id = var.build_instance_id
  
  tags = {
    Name        = "AppServerAMI"
    Version     = var.app_version
    BuildDate   = timestamp()
    Environment = var.environment
  }
}

resource "aws_launch_configuration" "app_server" {
  name_prefix          = "app-server-${var.app_version}-"
  image_id             = aws_ami_from_instance.app_server.id
  instance_type        = var.instance_type
  security_groups      = [aws_security_group.app_server.id]
  iam_instance_profile = aws_iam_instance_profile.app_server.name
  
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "app_server" {
  name                 = "app-server-asg-${var.app_version}"
  launch_configuration = aws_launch_configuration.app_server.name
  min_size             = var.min_instances
  max_size             = var.max_instances
  vpc_zone_identifier  = var.subnet_ids
  
  lifecycle {
    create_before_destroy = true
  }
  
  tag {
    key                 = "Name"
    value               = "AppServer"
    propagate_at_launch = true
  }
  
  tag {
    key                 = "Version"
    value               = var.app_version
    propagate_at_launch = true
  }
}

# 可變元件 - 透過組態管理工具更新
resource "aws_instance" "database" {
  ami                    = var.database_ami
  instance_type          = var.database_instance_type
  subnet_id              = var.database_subnet_id
  vpc_security_group_ids = [aws_security_group.database.id]
  key_name               = var.ssh_key_name
  
  tags = {
    Name        = "Database"
    Environment = var.environment
    Managed     = "ansible"
  }
  
  # 使用null_resource和provisioner來應用組態管理
  provisioner "local-exec" {
    command = <<-EOT
      ansible-playbook \
        -i '${self.public_ip},' \
        -u ec2-user \
        --private-key=${var.ssh_private_key_path} \
        -e "db_version=${var.db_version}" \
        -e "environment=${var.environment}" \
        database-config.yml
    EOT
  }
  
  # 定期重新應用設定的null_resource
  resource "null_resource" "database_config_sync" {
    triggers = {
      db_version = var.db_version
      config_hash = filemd5("${path.module}/database-config.yml")
      # 增加時間觸發器以定期重新應用
      sync_time = formatdate("YYYY-MM-DD-hh-mm", timestamp())
    }
    
    provisioner "local-exec" {
      command = <<-EOT
        ansible-playbook \
          -i '${aws_instance.database.public_ip},' \
          -u ec2-user \
          --private-key=${var.ssh_private_key_path} \
          -e "db_version=${var.db_version}" \
          -e "environment=${var.environment}" \
          database-config.yml
      EOT
    }
  }
}