1
terraform {
2
  required_providers {
3
    aws = {
4
      source  = "hashicorp/aws"
5
      version = "~> 5.0"
6
    }
7
  }
8

9
  backend "s3" {
10
    bucket = "tf-state-bucket"
11
    key    = "prod/terraform.tfstate"
12
    region = "us-east-1"
13
    dynamodb_table = "tf-locks"
14
  }
15
}
16

17
provider "aws" {
18
  region = "us-east-1"
19
}
20

21
# 变量定义
22
variable "environment" {
23
  type    = string
24
  default = "production"
25
}
26

27
# 资源定义
28
resource "aws_instance" "app" {
29
  ami           = "ami-0c55b159cbfafe1f0"
30
  instance_type = "t3.medium"
31

32
  tags = {
33
    Name        = "app-${var.environment}"
34
    Environment = var.environment
35
  }
36
}

1
module "vpc" {
2
  source  = "./modules/vpc"
3

4
  environment = var.environment
5
  cidr_block = var.vpc_cidr
6

7
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
8
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]
9

10
  enable_nat_gateway = true
11
  single_nat_gateway = false
12
}
13

14
# modules/vpc/variables.tf
15
variable "environment" {
16
  type = string
17
}
18

19
variable "vpc_cidr" {
20
  type = string
21
}
22

23
variable "private_subnets" {
24
  type = list(string)
25
}
26

27
variable "public_subnets" {
28
  type = list(string)
29
}

1
[webservers]
2
web1.example.com ansible_host=10.0.1.1
3
web2.example.com ansible_host=10.0.1.2
4

5
[databases]
6
db1.example.com ansible_host=10.0.2.1
7

8
[production:children]
9
webservers
10
databases
11

12
[production:vars]
13
ansible_user=ubuntu
14
ansible_python_interpreter=/usr/bin/python3

1
- name: Deploy Application
2
  hosts: webservers
3
  become: yes
4

5
  vars:
6
    app_version: "1.0.0"
7
    app_port: 8080
8

9
  tasks:
10
    - name: Install dependencies
11
      apt:
12
        name:
13
          - nginx
14
          - python3-pip
15
        state: present
16
        update_cache: yes
17

18
    - name: Deploy application
19
      git:
20
        repo: "https://github.com/org/app.git"
21
        dest: /opt/app
22
        version: "{{ app_version }}"
23
        force: yes
24

25
    - name: Configure nginx
26
      template:
27
        src: nginx.conf.j2
28
        dest: /etc/nginx/conf.d/app.conf
29
      notify: Restart nginx
30

31
    - name: Start application
32
      systemd:
33
        name: app
34
        state: started
35
        enabled: yes
36
        daemon_reload: yes
37

38
    - name: Wait for application
39
      wait_for:
40
        port: "{{ app_port }}"
41
        delay: 5
42
        timeout: 60
43

44
  handlers:
45
    - name: Restart nginx
46
      systemd:
47
        name: nginx
48
        state: restarted

1
import * as pulumi from "@pulumi/pulumi";
2
import * as aws from "@pulumi/aws";
3

4
// 创建 VPC
5
const vpc = new aws.ec2.Vpc("app-vpc", {
6
  cidrBlock: "10.0.0.0/16",
7
  enableDnsHostnames: true,
8
  enableDnsSupport: true,
9
  tags: {
10
    Name: "app-vpc",
11
    Environment: pulumi.getStack(),
12
  },
13
});
14

15
// 创建子网
16
const subnet = new aws.ec2.Subnet("app-subnet", {
17
  vpcId: vpc.id,
18
  cidrBlock: "10.0.1.0/24",
19
  availabilityZone: "us-east-1a",
20
  tags: {
21
    Name: "app-subnet",
22
  },
23
});
24

25
// 创建 ECS 集群
26
const cluster = new aws.ecs.Cluster("app-cluster", {
27
  name: "app-cluster",
28
  settings: [
29
    {
30
      name: "containerInsights",
31
      value: "enabled",
32
    },
33
  ],
34
});
35

36
// 导出
37
export const vpcId = vpc.id;
38
export const clusterName = cluster.name;
39
export const subnetId = subnet.id;

1
import * as aws from "@pulumi/aws";
2
import * as azure from "@pulumi/azure-native";
3
import * as gcp from "@pulumi/gcp";
4

5
// 统一的网络接口
6
interface NetworkConfig {
7
  vpcCidr: string;
8
  tags: Record<string, string>;
9
}
10

11
// AWS VPC
12
export function createAwsNetwork(config: NetworkConfig) {
13
  return new aws.ec2.Vpc("vpc", {
14
    cidrBlock: config.vpcCidr,
15
    tags: config.tags,
16
  });
17
}
18

19
// Azure Virtual Network
20
export function createAzureNetwork(config: NetworkConfig) {
21
  return new azure.network.VirtualNetwork("vnet", {
22
    resourceGroupName: "my-rg",
23
    addressSpace: [config.vpcCidr],
24
    tags: config.tags,
25
  });
26
}
27

28
// GCP Network
29
export function createGcpNetwork(config: NetworkConfig) {
30
  return new gcp.compute.Network("network", {
31
    autoCreateSubnetworks: false,
32
    routingConfig: {
33
      routingMode: "REGIONAL",
34
    },
35
  });
36
}

1
name: Terraform CI/CD
2

3
on:
4
  push:
5
    branches: [main]
6
  pull_request:
7

8
jobs:
9
  terraform:
10
    runs-on: ubuntu-latest
11
    steps:
12
      - uses: actions/checkout@v4
13

14
      - uses: hashicorp/setup-terraform@v3
15
        with:
16
          terraform_version: 1.6.0
17

18
      - name: Terraform Init
19
        run: terraform init
20
        env:
21
          TF_VAR aws_access_key: ${{ secrets.AWS_ACCESS_KEY_ID }}
22
          TF_VAR aws_secret_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
23

24
      - name: Terraform Format Check
25
        run: terraform fmt -check
26

27
      - name: Terraform Validate
28
        run: terraform validate
29

30
      - name: Terraform Plan
31
        run: terraform plan -no-color
32
        env:
33
          TF_VAR aws_access_key: ${{ secrets.AWS_ACCESS_KEY_ID }}
34
          TF_VAR aws_secret_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
35

36
      - name: Terraform Apply
37
        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
38
        run: terraform apply -auto-approve
39
        env:
40
          TF_VAR aws_access_key: ${{ secrets.AWS_ACCESS_KEY_ID }}
41
          TF_VAR aws_secret_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

1
name: Ansible CI/CD
2

3
on:
4
  push:
5
    paths:
6
      - "ansible/**"
7
      - "inventory/**"
8

9
jobs:
10
  ansible-lint:
11
    runs-on: ubuntu-latest
12
    steps:
13
      - uses: actions/checkout@v4
14

15
      - name: Install ansible-lint
16
        run: pip install ansible-lint
17

18
      - name: Run ansible-lint
19
        run: ansible-lint
20

21
  molecule-test:
22
    runs-on: ubuntu-latest
23
    steps:
24
      - uses: actions/checkout@v4
25

26
      - name: Molecule Test
27
        run: |
28
          pip install molecule ansible
29
          molecule test