mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
.
This commit is contained in:
Toby
@@ -0,0 +1,81 @@
|
||||
---
|
||||
name: aws-ec2
|
||||
description: Manage EC2 instances, AMIs, and auto-scaling groups. Configure security groups, key pairs, and instance types. Use when deploying compute resources on AWS.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# AWS EC2
|
||||
|
||||
Deploy and manage Amazon EC2 compute instances.
|
||||
|
||||
## Launch Instance
|
||||
|
||||
```bash
|
||||
aws ec2 run-instances \
|
||||
--image-id ami-0abcdef1234567890 \
|
||||
--instance-type t3.micro \
|
||||
--key-name my-key \
|
||||
--security-group-ids sg-12345678 \
|
||||
--subnet-id subnet-12345678 \
|
||||
--tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=web-server}]'
|
||||
```
|
||||
|
||||
## Auto Scaling
|
||||
|
||||
```bash
|
||||
# Create launch template
|
||||
aws ec2 create-launch-template \
|
||||
--launch-template-name web-template \
|
||||
--version-description v1 \
|
||||
--launch-template-data '{
|
||||
"ImageId": "ami-xxx",
|
||||
"InstanceType": "t3.micro"
|
||||
}'
|
||||
|
||||
# Create ASG
|
||||
aws autoscaling create-auto-scaling-group \
|
||||
--auto-scaling-group-name web-asg \
|
||||
--launch-template LaunchTemplateName=web-template \
|
||||
--min-size 2 --max-size 10 --desired-capacity 2 \
|
||||
--vpc-zone-identifier "subnet-xxx,subnet-yyy"
|
||||
```
|
||||
|
||||
## User Data
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
yum update -y
|
||||
yum install -y httpd
|
||||
systemctl start httpd
|
||||
systemctl enable httpd
|
||||
```
|
||||
|
||||
## Instance Management
|
||||
|
||||
```bash
|
||||
# List instances
|
||||
aws ec2 describe-instances --filters "Name=tag:Name,Values=web*"
|
||||
|
||||
# Stop/Start
|
||||
aws ec2 stop-instances --instance-ids i-xxx
|
||||
aws ec2 start-instances --instance-ids i-xxx
|
||||
|
||||
# Create AMI
|
||||
aws ec2 create-image --instance-id i-xxx --name "my-ami"
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use launch templates
|
||||
- Implement auto-scaling
|
||||
- Use spot instances for cost savings
|
||||
- Regular AMI updates
|
||||
- Instance metadata service v2
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [terraform-aws](../terraform-aws/) - IaC deployment
|
||||
- [aws-vpc](../aws-vpc/) - Networking
|
||||
@@ -0,0 +1,98 @@
|
||||
# EC2 Operations Reference
|
||||
|
||||
## Instance Management
|
||||
|
||||
```bash
|
||||
# Launch instance
|
||||
aws ec2 run-instances \
|
||||
--image-id ami-12345678 \
|
||||
--instance-type t3.micro \
|
||||
--key-name mykey \
|
||||
--security-group-ids sg-12345678 \
|
||||
--subnet-id subnet-12345678
|
||||
|
||||
# Start/Stop/Terminate
|
||||
aws ec2 start-instances --instance-ids i-12345678
|
||||
aws ec2 stop-instances --instance-ids i-12345678
|
||||
aws ec2 terminate-instances --instance-ids i-12345678
|
||||
|
||||
# Describe instances
|
||||
aws ec2 describe-instances \
|
||||
--filters "Name=tag:Environment,Values=prod"
|
||||
```
|
||||
|
||||
## AMI Management
|
||||
|
||||
```bash
|
||||
# Create AMI from instance
|
||||
aws ec2 create-image \
|
||||
--instance-id i-12345678 \
|
||||
--name "MyApp-$(date +%Y%m%d)"
|
||||
|
||||
# Copy AMI to another region
|
||||
aws ec2 copy-image \
|
||||
--source-image-id ami-12345678 \
|
||||
--source-region us-east-1 \
|
||||
--region us-west-2 \
|
||||
--name "MyApp-copy"
|
||||
```
|
||||
|
||||
## Instance Types
|
||||
|
||||
| Type | vCPU | Memory | Use Case |
|
||||
|------|------|--------|----------|
|
||||
| t3.micro | 2 | 1 GB | Dev/Test |
|
||||
| t3.small | 2 | 2 GB | Light apps |
|
||||
| m5.large | 2 | 8 GB | General |
|
||||
| c5.large | 2 | 4 GB | Compute |
|
||||
| r5.large | 2 | 16 GB | Memory |
|
||||
|
||||
## User Data
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
yum update -y
|
||||
yum install -y httpd
|
||||
systemctl start httpd
|
||||
systemctl enable httpd
|
||||
echo "Hello World" > /var/www/html/index.html
|
||||
```
|
||||
|
||||
## Instance Metadata
|
||||
|
||||
```bash
|
||||
# IMDSv2
|
||||
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
|
||||
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/
|
||||
|
||||
# Common endpoints
|
||||
/latest/meta-data/instance-id
|
||||
/latest/meta-data/local-ipv4
|
||||
/latest/meta-data/public-ipv4
|
||||
/latest/meta-data/iam/security-credentials/role-name
|
||||
```
|
||||
|
||||
## Terraform
|
||||
|
||||
```hcl
|
||||
resource "aws_instance" "app" {
|
||||
ami = data.aws_ami.amazon_linux.id
|
||||
instance_type = "t3.micro"
|
||||
|
||||
vpc_security_group_ids = [aws_security_group.app.id]
|
||||
subnet_id = aws_subnet.private.id
|
||||
|
||||
iam_instance_profile = aws_iam_instance_profile.app.name
|
||||
|
||||
user_data = base64encode(file("userdata.sh"))
|
||||
|
||||
root_block_device {
|
||||
volume_size = 20
|
||||
encrypted = true
|
||||
}
|
||||
|
||||
tags = {
|
||||
Name = "app-server"
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,88 @@
|
||||
---
|
||||
name: aws-ecs-fargate
|
||||
description: Deploy containers on ECS and Fargate. Configure task definitions, services, and load balancing. Use when running containerized workloads on AWS.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# AWS ECS & Fargate
|
||||
|
||||
Run containerized applications on Amazon ECS with Fargate.
|
||||
|
||||
## Task Definition
|
||||
|
||||
```json
|
||||
{
|
||||
"family": "myapp",
|
||||
"networkMode": "awsvpc",
|
||||
"requiresCompatibilities": ["FARGATE"],
|
||||
"cpu": "256",
|
||||
"memory": "512",
|
||||
"executionRoleArn": "arn:aws:iam::xxx:role/ecsTaskExecutionRole",
|
||||
"containerDefinitions": [{
|
||||
"name": "myapp",
|
||||
"image": "xxx.dkr.ecr.region.amazonaws.com/myapp:latest",
|
||||
"portMappings": [{
|
||||
"containerPort": 8080,
|
||||
"protocol": "tcp"
|
||||
}],
|
||||
"logConfiguration": {
|
||||
"logDriver": "awslogs",
|
||||
"options": {
|
||||
"awslogs-group": "/ecs/myapp",
|
||||
"awslogs-region": "us-east-1",
|
||||
"awslogs-stream-prefix": "ecs"
|
||||
}
|
||||
}
|
||||
}]
|
||||
}
|
||||
```
|
||||
|
||||
## Create Service
|
||||
|
||||
```bash
|
||||
aws ecs create-service \
|
||||
--cluster my-cluster \
|
||||
--service-name myapp \
|
||||
--task-definition myapp:1 \
|
||||
--desired-count 2 \
|
||||
--launch-type FARGATE \
|
||||
--network-configuration '{
|
||||
"awsvpcConfiguration": {
|
||||
"subnets": ["subnet-xxx"],
|
||||
"securityGroups": ["sg-xxx"],
|
||||
"assignPublicIp": "ENABLED"
|
||||
}
|
||||
}' \
|
||||
--load-balancers '[{
|
||||
"targetGroupArn": "arn:aws:elasticloadbalancing:...",
|
||||
"containerName": "myapp",
|
||||
"containerPort": 8080
|
||||
}]'
|
||||
```
|
||||
|
||||
## Deployment
|
||||
|
||||
```bash
|
||||
# Update service
|
||||
aws ecs update-service \
|
||||
--cluster my-cluster \
|
||||
--service myapp \
|
||||
--task-definition myapp:2 \
|
||||
--force-new-deployment
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use ECR for images
|
||||
- Implement service discovery
|
||||
- Configure health checks
|
||||
- Use secrets manager for secrets
|
||||
- Enable container insights
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [docker-management](../../../devops/containers/docker-management/) - Container basics
|
||||
- [container-registries](../../../devops/containers/container-registries/) - ECR
|
||||
@@ -0,0 +1,97 @@
|
||||
---
|
||||
name: aws-iam
|
||||
description: Manage IAM users, roles, and policies. Implement least-privilege access and security best practices. Use when configuring AWS identity and access management.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# AWS IAM
|
||||
|
||||
Manage identity and access in AWS.
|
||||
|
||||
## IAM Policies
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:GetObject",
|
||||
"s3:PutObject"
|
||||
],
|
||||
"Resource": "arn:aws:s3:::my-bucket/*"
|
||||
}]
|
||||
}
|
||||
```
|
||||
|
||||
## Create Role
|
||||
|
||||
```bash
|
||||
# Create role with trust policy
|
||||
aws iam create-role \
|
||||
--role-name EC2AppRole \
|
||||
--assume-role-policy-document '{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [{
|
||||
"Effect": "Allow",
|
||||
"Principal": {"Service": "ec2.amazonaws.com"},
|
||||
"Action": "sts:AssumeRole"
|
||||
}]
|
||||
}'
|
||||
|
||||
# Attach policy
|
||||
aws iam attach-role-policy \
|
||||
--role-name EC2AppRole \
|
||||
--policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
|
||||
```
|
||||
|
||||
## Service-Linked Roles
|
||||
|
||||
```bash
|
||||
# For services like ECS, RDS
|
||||
aws iam create-service-linked-role \
|
||||
--aws-service-name ecs.amazonaws.com
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
```yaml
|
||||
security_practices:
|
||||
- Use roles, not long-term credentials
|
||||
- Implement least privilege
|
||||
- Enable MFA
|
||||
- Regular access reviews
|
||||
- Use IAM Access Analyzer
|
||||
- Implement SCPs for organizations
|
||||
```
|
||||
|
||||
## Policy Conditions
|
||||
|
||||
```json
|
||||
{
|
||||
"Condition": {
|
||||
"StringEquals": {
|
||||
"aws:RequestedRegion": "us-east-1"
|
||||
},
|
||||
"Bool": {
|
||||
"aws:MultiFactorAuthPresent": "true"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Follow least privilege
|
||||
- Use IAM roles for applications
|
||||
- Enable CloudTrail for auditing
|
||||
- Regular credential rotation
|
||||
- Use permission boundaries
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [terraform-aws](../terraform-aws/) - IaC deployment
|
||||
- [access-review](../../../compliance/governance/access-review/) - Access auditing
|
||||
@@ -0,0 +1,84 @@
|
||||
---
|
||||
name: aws-lambda
|
||||
description: Build and deploy serverless functions on AWS Lambda. Configure triggers, manage permissions, and optimize performance. Use when implementing serverless applications.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# AWS Lambda
|
||||
|
||||
Build serverless applications with AWS Lambda.
|
||||
|
||||
## Create Function
|
||||
|
||||
```bash
|
||||
# Create function
|
||||
aws lambda create-function \
|
||||
--function-name myfunction \
|
||||
--runtime python3.11 \
|
||||
--handler app.handler \
|
||||
--role arn:aws:iam::xxx:role/lambda-role \
|
||||
--zip-file fileb://function.zip
|
||||
|
||||
# Update code
|
||||
aws lambda update-function-code \
|
||||
--function-name myfunction \
|
||||
--zip-file fileb://function.zip
|
||||
```
|
||||
|
||||
## Function Code
|
||||
|
||||
```python
|
||||
# app.py
|
||||
import json
|
||||
|
||||
def handler(event, context):
|
||||
return {
|
||||
'statusCode': 200,
|
||||
'body': json.dumps({'message': 'Hello!'})
|
||||
}
|
||||
```
|
||||
|
||||
## API Gateway Integration
|
||||
|
||||
```bash
|
||||
# Create REST API
|
||||
aws apigateway create-rest-api --name myapi
|
||||
|
||||
# Add Lambda permission
|
||||
aws lambda add-permission \
|
||||
--function-name myfunction \
|
||||
--statement-id apigateway \
|
||||
--action lambda:InvokeFunction \
|
||||
--principal apigateway.amazonaws.com
|
||||
```
|
||||
|
||||
## Environment & Configuration
|
||||
|
||||
```bash
|
||||
# Set environment variables
|
||||
aws lambda update-function-configuration \
|
||||
--function-name myfunction \
|
||||
--environment "Variables={DB_HOST=xxx,API_KEY=yyy}"
|
||||
|
||||
# Set memory and timeout
|
||||
aws lambda update-function-configuration \
|
||||
--function-name myfunction \
|
||||
--memory-size 256 \
|
||||
--timeout 30
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Minimize cold starts
|
||||
- Use layers for dependencies
|
||||
- Implement proper error handling
|
||||
- Use provisioned concurrency for latency-sensitive functions
|
||||
- Monitor with CloudWatch
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [terraform-aws](../terraform-aws/) - IaC deployment
|
||||
- [aws-iam](../aws-iam/) - Execution roles
|
||||
@@ -0,0 +1,78 @@
|
||||
---
|
||||
name: aws-rds
|
||||
description: Provision and manage RDS databases. Configure backups, replication, and security. Use when deploying managed relational databases on AWS.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# AWS RDS
|
||||
|
||||
Deploy managed relational databases with Amazon RDS.
|
||||
|
||||
## Create Database
|
||||
|
||||
```bash
|
||||
aws rds create-db-instance \
|
||||
--db-instance-identifier mydb \
|
||||
--db-instance-class db.t3.micro \
|
||||
--engine postgres \
|
||||
--engine-version 15 \
|
||||
--master-username admin \
|
||||
--master-user-password secretpassword \
|
||||
--allocated-storage 20 \
|
||||
--storage-encrypted \
|
||||
--vpc-security-group-ids sg-xxx \
|
||||
--db-subnet-group-name my-subnet-group \
|
||||
--backup-retention-period 7 \
|
||||
--multi-az
|
||||
```
|
||||
|
||||
## Parameter Groups
|
||||
|
||||
```bash
|
||||
aws rds create-db-parameter-group \
|
||||
--db-parameter-group-name custom-pg \
|
||||
--db-parameter-group-family postgres15 \
|
||||
--description "Custom PostgreSQL parameters"
|
||||
|
||||
aws rds modify-db-parameter-group \
|
||||
--db-parameter-group-name custom-pg \
|
||||
--parameters "ParameterName=max_connections,ParameterValue=200,ApplyMethod=pending-reboot"
|
||||
```
|
||||
|
||||
## Snapshots & Recovery
|
||||
|
||||
```bash
|
||||
# Create snapshot
|
||||
aws rds create-db-snapshot \
|
||||
--db-instance-identifier mydb \
|
||||
--db-snapshot-identifier mydb-snapshot
|
||||
|
||||
# Restore from snapshot
|
||||
aws rds restore-db-instance-from-db-snapshot \
|
||||
--db-instance-identifier mydb-restored \
|
||||
--db-snapshot-identifier mydb-snapshot
|
||||
```
|
||||
|
||||
## Read Replicas
|
||||
|
||||
```bash
|
||||
aws rds create-db-instance-read-replica \
|
||||
--db-instance-identifier mydb-replica \
|
||||
--source-db-instance-identifier mydb
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Enable Multi-AZ for production
|
||||
- Use encryption at rest
|
||||
- Implement automated backups
|
||||
- Use read replicas for read scaling
|
||||
- Store credentials in Secrets Manager
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [terraform-aws](../terraform-aws/) - IaC deployment
|
||||
- [aws-secrets-manager](../../../security/secrets/aws-secrets-manager/) - Credentials
|
||||
@@ -0,0 +1,88 @@
|
||||
---
|
||||
name: aws-s3
|
||||
description: Configure S3 buckets, policies, and lifecycle rules. Implement versioning, replication, and security. Use when managing object storage on AWS.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# AWS S3
|
||||
|
||||
Manage object storage with Amazon S3.
|
||||
|
||||
## Create Bucket
|
||||
|
||||
```bash
|
||||
aws s3api create-bucket \
|
||||
--bucket my-bucket \
|
||||
--region us-east-1
|
||||
|
||||
# Enable versioning
|
||||
aws s3api put-bucket-versioning \
|
||||
--bucket my-bucket \
|
||||
--versioning-configuration Status=Enabled
|
||||
|
||||
# Block public access
|
||||
aws s3api put-public-access-block \
|
||||
--bucket my-bucket \
|
||||
--public-access-block-configuration '{
|
||||
"BlockPublicAcls": true,
|
||||
"IgnorePublicAcls": true,
|
||||
"BlockPublicPolicy": true,
|
||||
"RestrictPublicBuckets": true
|
||||
}'
|
||||
```
|
||||
|
||||
## Bucket Policy
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [{
|
||||
"Sid": "EnforceHTTPS",
|
||||
"Effect": "Deny",
|
||||
"Principal": "*",
|
||||
"Action": "s3:*",
|
||||
"Resource": [
|
||||
"arn:aws:s3:::my-bucket",
|
||||
"arn:aws:s3:::my-bucket/*"
|
||||
],
|
||||
"Condition": {
|
||||
"Bool": {"aws:SecureTransport": "false"}
|
||||
}
|
||||
}]
|
||||
}
|
||||
```
|
||||
|
||||
## Lifecycle Rules
|
||||
|
||||
```bash
|
||||
aws s3api put-bucket-lifecycle-configuration \
|
||||
--bucket my-bucket \
|
||||
--lifecycle-configuration '{
|
||||
"Rules": [{
|
||||
"ID": "Archive old objects",
|
||||
"Status": "Enabled",
|
||||
"Filter": {"Prefix": "logs/"},
|
||||
"Transitions": [{
|
||||
"Days": 30,
|
||||
"StorageClass": "GLACIER"
|
||||
}],
|
||||
"Expiration": {"Days": 365}
|
||||
}]
|
||||
}'
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Enable versioning
|
||||
- Block public access
|
||||
- Use encryption (SSE-S3 or SSE-KMS)
|
||||
- Implement lifecycle policies
|
||||
- Enable access logging
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [terraform-aws](../terraform-aws/) - IaC deployment
|
||||
- [aws-iam](../aws-iam/) - Access policies
|
||||
@@ -0,0 +1,84 @@
|
||||
---
|
||||
name: aws-vpc
|
||||
description: Design and implement VPCs and networking. Configure subnets, route tables, and security groups. Use when setting up AWS network infrastructure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# AWS VPC
|
||||
|
||||
Design and manage Virtual Private Cloud networking.
|
||||
|
||||
## Create VPC
|
||||
|
||||
```bash
|
||||
# Create VPC
|
||||
aws ec2 create-vpc --cidr-block 10.0.0.0/16
|
||||
|
||||
# Create subnets
|
||||
aws ec2 create-subnet \
|
||||
--vpc-id vpc-xxx \
|
||||
--cidr-block 10.0.1.0/24 \
|
||||
--availability-zone us-east-1a
|
||||
|
||||
# Create internet gateway
|
||||
aws ec2 create-internet-gateway
|
||||
aws ec2 attach-internet-gateway --vpc-id vpc-xxx --internet-gateway-id igw-xxx
|
||||
```
|
||||
|
||||
## Network Architecture
|
||||
|
||||
```
|
||||
VPC (10.0.0.0/16)
|
||||
├── Public Subnets
|
||||
│ ├── 10.0.1.0/24 (us-east-1a)
|
||||
│ └── 10.0.2.0/24 (us-east-1b)
|
||||
├── Private Subnets
|
||||
│ ├── 10.0.11.0/24 (us-east-1a)
|
||||
│ └── 10.0.12.0/24 (us-east-1b)
|
||||
├── Internet Gateway
|
||||
├── NAT Gateway (in public subnet)
|
||||
└── Route Tables
|
||||
```
|
||||
|
||||
## Security Groups
|
||||
|
||||
```bash
|
||||
aws ec2 create-security-group \
|
||||
--group-name web-sg \
|
||||
--description "Web server security group" \
|
||||
--vpc-id vpc-xxx
|
||||
|
||||
aws ec2 authorize-security-group-ingress \
|
||||
--group-id sg-xxx \
|
||||
--protocol tcp \
|
||||
--port 443 \
|
||||
--cidr 0.0.0.0/0
|
||||
```
|
||||
|
||||
## NAT Gateway
|
||||
|
||||
```bash
|
||||
# Allocate EIP
|
||||
aws ec2 allocate-address --domain vpc
|
||||
|
||||
# Create NAT Gateway
|
||||
aws ec2 create-nat-gateway \
|
||||
--subnet-id subnet-public \
|
||||
--allocation-id eipalloc-xxx
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use multiple AZs
|
||||
- Separate public/private subnets
|
||||
- Implement VPC Flow Logs
|
||||
- Use security groups effectively
|
||||
- Plan CIDR ranges carefully
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [terraform-aws](../terraform-aws/) - IaC deployment
|
||||
- [firewall-config](../../../security/network/firewall-config/) - Security
|
||||
@@ -0,0 +1,93 @@
|
||||
---
|
||||
name: cloudformation
|
||||
description: Deploy AWS resources with CloudFormation templates. Create stacks, use nested stacks, and implement drift detection. Use when deploying AWS-native IaC.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# CloudFormation
|
||||
|
||||
Deploy AWS infrastructure with native CloudFormation templates.
|
||||
|
||||
## Template Structure
|
||||
|
||||
```yaml
|
||||
AWSTemplateFormatVersion: '2010-09-09'
|
||||
Description: Web application stack
|
||||
|
||||
Parameters:
|
||||
Environment:
|
||||
Type: String
|
||||
AllowedValues: [dev, staging, prod]
|
||||
|
||||
Resources:
|
||||
WebServer:
|
||||
Type: AWS::EC2::Instance
|
||||
Properties:
|
||||
ImageId: !Ref AMI
|
||||
InstanceType: t3.micro
|
||||
Tags:
|
||||
- Key: Name
|
||||
Value: !Sub '${Environment}-web'
|
||||
|
||||
Outputs:
|
||||
InstanceId:
|
||||
Value: !Ref WebServer
|
||||
Export:
|
||||
Name: !Sub '${Environment}-WebServerId'
|
||||
```
|
||||
|
||||
## Stack Operations
|
||||
|
||||
```bash
|
||||
# Create stack
|
||||
aws cloudformation create-stack \
|
||||
--stack-name myapp \
|
||||
--template-body file://template.yaml \
|
||||
--parameters ParameterKey=Environment,ParameterValue=prod
|
||||
|
||||
# Update stack
|
||||
aws cloudformation update-stack \
|
||||
--stack-name myapp \
|
||||
--template-body file://template.yaml
|
||||
|
||||
# Delete stack
|
||||
aws cloudformation delete-stack --stack-name myapp
|
||||
|
||||
# Detect drift
|
||||
aws cloudformation detect-stack-drift --stack-name myapp
|
||||
```
|
||||
|
||||
## Intrinsic Functions
|
||||
|
||||
```yaml
|
||||
# Reference
|
||||
!Ref MyResource
|
||||
|
||||
# Get attribute
|
||||
!GetAtt MyResource.Arn
|
||||
|
||||
# Substitute
|
||||
!Sub 'arn:aws:s3:::${BucketName}/*'
|
||||
|
||||
# Conditional
|
||||
!If [CreateProdResources, 't3.large', 't3.micro']
|
||||
|
||||
# Join
|
||||
!Join ['-', [!Ref Environment, 'app', 'bucket']]
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use change sets before updates
|
||||
- Implement stack policies
|
||||
- Use nested stacks for modularity
|
||||
- Enable termination protection
|
||||
- Use cfn-lint for validation
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [terraform-aws](../terraform-aws/) - Alternative IaC
|
||||
- [aws-iam](../aws-iam/) - IAM resources
|
||||
@@ -0,0 +1,123 @@
|
||||
# CloudFormation Syntax Reference
|
||||
|
||||
## Template Structure
|
||||
|
||||
```yaml
|
||||
AWSTemplateFormatVersion: '2010-09-09'
|
||||
Description: My CloudFormation Template
|
||||
|
||||
Parameters:
|
||||
Environment:
|
||||
Type: String
|
||||
AllowedValues: [dev, staging, prod]
|
||||
|
||||
Mappings:
|
||||
RegionMap:
|
||||
us-east-1:
|
||||
AMI: ami-12345678
|
||||
|
||||
Conditions:
|
||||
IsProd: !Equals [!Ref Environment, prod]
|
||||
|
||||
Resources:
|
||||
MyBucket:
|
||||
Type: AWS::S3::Bucket
|
||||
Properties:
|
||||
BucketName: !Sub '${AWS::StackName}-bucket'
|
||||
|
||||
Outputs:
|
||||
BucketName:
|
||||
Value: !Ref MyBucket
|
||||
Export:
|
||||
Name: !Sub '${AWS::StackName}-bucket'
|
||||
```
|
||||
|
||||
## Intrinsic Functions
|
||||
|
||||
```yaml
|
||||
# Reference
|
||||
!Ref MyResource
|
||||
|
||||
# GetAtt
|
||||
!GetAtt MyResource.Arn
|
||||
|
||||
# Sub (string substitution)
|
||||
!Sub '${AWS::StackName}-resource'
|
||||
!Sub
|
||||
- 'arn:aws:s3:::${Bucket}/*'
|
||||
- Bucket: !Ref MyBucket
|
||||
|
||||
# Join
|
||||
!Join ['-', [!Ref Environment, app]]
|
||||
|
||||
# Select
|
||||
!Select [0, !GetAZs '']
|
||||
|
||||
# Split
|
||||
!Split [',', 'a,b,c']
|
||||
|
||||
# If
|
||||
!If [IsProd, 3, 1]
|
||||
|
||||
# ImportValue
|
||||
!ImportValue ExportedValue
|
||||
```
|
||||
|
||||
## Common Patterns
|
||||
|
||||
### Cross-Stack References
|
||||
```yaml
|
||||
# Stack A - Export
|
||||
Outputs:
|
||||
VpcId:
|
||||
Value: !Ref VPC
|
||||
Export:
|
||||
Name: SharedVPC
|
||||
|
||||
# Stack B - Import
|
||||
Resources:
|
||||
Subnet:
|
||||
Type: AWS::EC2::Subnet
|
||||
Properties:
|
||||
VpcId: !ImportValue SharedVPC
|
||||
```
|
||||
|
||||
### Nested Stacks
|
||||
```yaml
|
||||
Resources:
|
||||
VPCStack:
|
||||
Type: AWS::CloudFormation::Stack
|
||||
Properties:
|
||||
TemplateURL: https://s3.amazonaws.com/bucket/vpc.yaml
|
||||
Parameters:
|
||||
Environment: !Ref Environment
|
||||
```
|
||||
|
||||
### DependsOn
|
||||
```yaml
|
||||
Resources:
|
||||
MyInstance:
|
||||
Type: AWS::EC2::Instance
|
||||
DependsOn: MySecurityGroup
|
||||
```
|
||||
|
||||
## CLI Commands
|
||||
|
||||
```bash
|
||||
# Create stack
|
||||
aws cloudformation create-stack \
|
||||
--stack-name mystack \
|
||||
--template-body file://template.yaml \
|
||||
--parameters ParameterKey=Environment,ParameterValue=prod
|
||||
|
||||
# Update stack
|
||||
aws cloudformation update-stack \
|
||||
--stack-name mystack \
|
||||
--template-body file://template.yaml
|
||||
|
||||
# Delete stack
|
||||
aws cloudformation delete-stack --stack-name mystack
|
||||
|
||||
# Validate template
|
||||
aws cloudformation validate-template --template-body file://template.yaml
|
||||
```
|
||||
@@ -0,0 +1,100 @@
|
||||
---
|
||||
name: terraform-aws
|
||||
description: Provision AWS infrastructure with Terraform. Create modules, manage state, and implement IaC best practices. Use when deploying AWS resources declaratively.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Terraform AWS
|
||||
|
||||
Provision and manage AWS infrastructure with Terraform.
|
||||
|
||||
## Provider Configuration
|
||||
|
||||
```hcl
|
||||
terraform {
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
|
||||
backend "s3" {
|
||||
bucket = "terraform-state"
|
||||
key = "prod/terraform.tfstate"
|
||||
region = "us-east-1"
|
||||
}
|
||||
}
|
||||
|
||||
provider "aws" {
|
||||
region = var.region
|
||||
|
||||
default_tags {
|
||||
tags = {
|
||||
Environment = var.environment
|
||||
ManagedBy = "terraform"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Example Resources
|
||||
|
||||
```hcl
|
||||
resource "aws_vpc" "main" {
|
||||
cidr_block = "10.0.0.0/16"
|
||||
enable_dns_hostnames = true
|
||||
|
||||
tags = { Name = "main-vpc" }
|
||||
}
|
||||
|
||||
resource "aws_instance" "web" {
|
||||
ami = data.aws_ami.amazon_linux.id
|
||||
instance_type = "t3.micro"
|
||||
subnet_id = aws_subnet.public.id
|
||||
|
||||
tags = { Name = "web-server" }
|
||||
}
|
||||
```
|
||||
|
||||
## Modules
|
||||
|
||||
```hcl
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
|
||||
name = "my-vpc"
|
||||
cidr = "10.0.0.0/16"
|
||||
|
||||
azs = ["us-east-1a", "us-east-1b"]
|
||||
private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
|
||||
public_subnets = ["10.0.101.0/24", "10.0.102.0/24"]
|
||||
|
||||
enable_nat_gateway = true
|
||||
}
|
||||
```
|
||||
|
||||
## Commands
|
||||
|
||||
```bash
|
||||
terraform init
|
||||
terraform plan -out=plan.tfplan
|
||||
terraform apply plan.tfplan
|
||||
terraform destroy
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use remote state with locking
|
||||
- Implement module structure
|
||||
- Use workspaces or separate states per environment
|
||||
- Pin provider versions
|
||||
- Use data sources for AMIs
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [aws-vpc](../aws-vpc/) - VPC networking
|
||||
- [aws-iam](../aws-iam/) - IAM policies
|
||||
@@ -0,0 +1,152 @@
|
||||
# AWS VPC Module Template
|
||||
# Production-ready VPC with public and private subnets
|
||||
|
||||
variable "vpc_cidr" {
|
||||
description = "CIDR block for VPC"
|
||||
type = string
|
||||
default = "10.0.0.0/16"
|
||||
}
|
||||
|
||||
variable "availability_zones" {
|
||||
description = "Availability zones"
|
||||
type = list(string)
|
||||
default = ["us-east-1a", "us-east-1b", "us-east-1c"]
|
||||
}
|
||||
|
||||
variable "enable_nat_gateway" {
|
||||
description = "Enable NAT Gateway for private subnets"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
locals {
|
||||
public_subnets = [for i, az in var.availability_zones : cidrsubnet(var.vpc_cidr, 8, i)]
|
||||
private_subnets = [for i, az in var.availability_zones : cidrsubnet(var.vpc_cidr, 8, i + 10)]
|
||||
}
|
||||
|
||||
# VPC
|
||||
resource "aws_vpc" "main" {
|
||||
cidr_block = var.vpc_cidr
|
||||
enable_dns_hostnames = true
|
||||
enable_dns_support = true
|
||||
|
||||
tags = {
|
||||
Name = "${var.project_name}-vpc"
|
||||
}
|
||||
}
|
||||
|
||||
# Internet Gateway
|
||||
resource "aws_internet_gateway" "main" {
|
||||
vpc_id = aws_vpc.main.id
|
||||
|
||||
tags = {
|
||||
Name = "${var.project_name}-igw"
|
||||
}
|
||||
}
|
||||
|
||||
# Public Subnets
|
||||
resource "aws_subnet" "public" {
|
||||
count = length(var.availability_zones)
|
||||
vpc_id = aws_vpc.main.id
|
||||
cidr_block = local.public_subnets[count.index]
|
||||
availability_zone = var.availability_zones[count.index]
|
||||
map_public_ip_on_launch = true
|
||||
|
||||
tags = {
|
||||
Name = "${var.project_name}-public-${var.availability_zones[count.index]}"
|
||||
"kubernetes.io/role/elb" = "1"
|
||||
}
|
||||
}
|
||||
|
||||
# Private Subnets
|
||||
resource "aws_subnet" "private" {
|
||||
count = length(var.availability_zones)
|
||||
vpc_id = aws_vpc.main.id
|
||||
cidr_block = local.private_subnets[count.index]
|
||||
availability_zone = var.availability_zones[count.index]
|
||||
|
||||
tags = {
|
||||
Name = "${var.project_name}-private-${var.availability_zones[count.index]}"
|
||||
"kubernetes.io/role/internal-elb" = "1"
|
||||
}
|
||||
}
|
||||
|
||||
# Elastic IP for NAT Gateway
|
||||
resource "aws_eip" "nat" {
|
||||
count = var.enable_nat_gateway ? 1 : 0
|
||||
domain = "vpc"
|
||||
|
||||
tags = {
|
||||
Name = "${var.project_name}-nat-eip"
|
||||
}
|
||||
}
|
||||
|
||||
# NAT Gateway
|
||||
resource "aws_nat_gateway" "main" {
|
||||
count = var.enable_nat_gateway ? 1 : 0
|
||||
allocation_id = aws_eip.nat[0].id
|
||||
subnet_id = aws_subnet.public[0].id
|
||||
|
||||
tags = {
|
||||
Name = "${var.project_name}-nat"
|
||||
}
|
||||
|
||||
depends_on = [aws_internet_gateway.main]
|
||||
}
|
||||
|
||||
# Public Route Table
|
||||
resource "aws_route_table" "public" {
|
||||
vpc_id = aws_vpc.main.id
|
||||
|
||||
route {
|
||||
cidr_block = "0.0.0.0/0"
|
||||
gateway_id = aws_internet_gateway.main.id
|
||||
}
|
||||
|
||||
tags = {
|
||||
Name = "${var.project_name}-public-rt"
|
||||
}
|
||||
}
|
||||
|
||||
# Private Route Table
|
||||
resource "aws_route_table" "private" {
|
||||
vpc_id = aws_vpc.main.id
|
||||
|
||||
dynamic "route" {
|
||||
for_each = var.enable_nat_gateway ? [1] : []
|
||||
content {
|
||||
cidr_block = "0.0.0.0/0"
|
||||
nat_gateway_id = aws_nat_gateway.main[0].id
|
||||
}
|
||||
}
|
||||
|
||||
tags = {
|
||||
Name = "${var.project_name}-private-rt"
|
||||
}
|
||||
}
|
||||
|
||||
# Route Table Associations
|
||||
resource "aws_route_table_association" "public" {
|
||||
count = length(var.availability_zones)
|
||||
subnet_id = aws_subnet.public[count.index].id
|
||||
route_table_id = aws_route_table.public.id
|
||||
}
|
||||
|
||||
resource "aws_route_table_association" "private" {
|
||||
count = length(var.availability_zones)
|
||||
subnet_id = aws_subnet.private[count.index].id
|
||||
route_table_id = aws_route_table.private.id
|
||||
}
|
||||
|
||||
# Outputs
|
||||
output "vpc_id" {
|
||||
value = aws_vpc.main.id
|
||||
}
|
||||
|
||||
output "public_subnet_ids" {
|
||||
value = aws_subnet.public[*].id
|
||||
}
|
||||
|
||||
output "private_subnet_ids" {
|
||||
value = aws_subnet.private[*].id
|
||||
}
|
||||
@@ -0,0 +1,185 @@
|
||||
# Terraform AWS Best Practices
|
||||
|
||||
## Project Structure
|
||||
|
||||
```
|
||||
project/
|
||||
├── main.tf # Main configuration
|
||||
├── variables.tf # Input variables
|
||||
├── outputs.tf # Output values
|
||||
├── locals.tf # Local values
|
||||
├── data.tf # Data sources
|
||||
├── versions.tf # Provider versions
|
||||
├── terraform.tfvars # Variable values (git-ignored)
|
||||
├── modules/ # Local modules
|
||||
│ └── vpc/
|
||||
│ ├── main.tf
|
||||
│ ├── variables.tf
|
||||
│ └── outputs.tf
|
||||
└── environments/ # Environment configs
|
||||
├── dev/
|
||||
├── staging/
|
||||
└── prod/
|
||||
```
|
||||
|
||||
## State Management
|
||||
|
||||
### Remote State with S3
|
||||
```hcl
|
||||
terraform {
|
||||
backend "s3" {
|
||||
bucket = "company-terraform-state"
|
||||
key = "project/env/terraform.tfstate"
|
||||
region = "us-east-1"
|
||||
encrypt = true
|
||||
dynamodb_table = "terraform-locks"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### State Locking
|
||||
```hcl
|
||||
resource "aws_dynamodb_table" "terraform_locks" {
|
||||
name = "terraform-locks"
|
||||
billing_mode = "PAY_PER_REQUEST"
|
||||
hash_key = "LockID"
|
||||
|
||||
attribute {
|
||||
name = "LockID"
|
||||
type = "S"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
### Use IAM Roles, Not Credentials
|
||||
```hcl
|
||||
provider "aws" {
|
||||
region = "us-east-1"
|
||||
# No access_key or secret_key - use IAM role or env vars
|
||||
}
|
||||
```
|
||||
|
||||
### Enable Encryption Everywhere
|
||||
```hcl
|
||||
resource "aws_s3_bucket_server_side_encryption_configuration" "example" {
|
||||
bucket = aws_s3_bucket.example.id
|
||||
|
||||
rule {
|
||||
apply_server_side_encryption_by_default {
|
||||
sse_algorithm = "aws:kms"
|
||||
kms_master_key_id = aws_kms_key.example.arn
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Use Sensitive Variables
|
||||
```hcl
|
||||
variable "database_password" {
|
||||
type = string
|
||||
sensitive = true
|
||||
}
|
||||
```
|
||||
|
||||
## Tagging Strategy
|
||||
|
||||
```hcl
|
||||
locals {
|
||||
common_tags = {
|
||||
Project = var.project_name
|
||||
Environment = var.environment
|
||||
ManagedBy = "terraform"
|
||||
Owner = var.team
|
||||
CostCenter = var.cost_center
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_instance" "example" {
|
||||
# ... configuration ...
|
||||
|
||||
tags = merge(local.common_tags, {
|
||||
Name = "example-instance"
|
||||
Role = "web"
|
||||
})
|
||||
}
|
||||
```
|
||||
|
||||
## Module Best Practices
|
||||
|
||||
### Version Pinning
|
||||
```hcl
|
||||
module "vpc" {
|
||||
source = "terraform-aws-modules/vpc/aws"
|
||||
version = "5.0.0" # Pin specific version
|
||||
|
||||
# ... configuration ...
|
||||
}
|
||||
```
|
||||
|
||||
### Variable Validation
|
||||
```hcl
|
||||
variable "environment" {
|
||||
type = string
|
||||
description = "Environment name"
|
||||
|
||||
validation {
|
||||
condition = contains(["dev", "staging", "prod"], var.environment)
|
||||
error_message = "Environment must be dev, staging, or prod."
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Workflow
|
||||
|
||||
### Plan Before Apply
|
||||
```bash
|
||||
terraform plan -out=tfplan
|
||||
terraform apply tfplan
|
||||
```
|
||||
|
||||
### Use Workspaces or Directories for Environments
|
||||
```bash
|
||||
# Workspaces
|
||||
terraform workspace new prod
|
||||
terraform workspace select prod
|
||||
|
||||
# Or separate directories (recommended)
|
||||
cd environments/prod
|
||||
terraform apply
|
||||
```
|
||||
|
||||
## Common Patterns
|
||||
|
||||
### Data Sources for Existing Resources
|
||||
```hcl
|
||||
data "aws_vpc" "existing" {
|
||||
filter {
|
||||
name = "tag:Name"
|
||||
values = ["main-vpc"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_subnet" "new" {
|
||||
vpc_id = data.aws_vpc.existing.id
|
||||
# ...
|
||||
}
|
||||
```
|
||||
|
||||
### Dynamic Blocks
|
||||
```hcl
|
||||
resource "aws_security_group" "example" {
|
||||
# ...
|
||||
|
||||
dynamic "ingress" {
|
||||
for_each = var.ingress_rules
|
||||
content {
|
||||
from_port = ingress.value.from_port
|
||||
to_port = ingress.value.to_port
|
||||
protocol = ingress.value.protocol
|
||||
cidr_blocks = ingress.value.cidr_blocks
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,134 @@
|
||||
#!/bin/bash
|
||||
# Terraform AWS Project Initialization Script
|
||||
# Usage: ./tf-init.sh <project-name> [region]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PROJECT_NAME="${1:-}"
|
||||
REGION="${2:-us-east-1}"
|
||||
|
||||
if [ -z "$PROJECT_NAME" ]; then
|
||||
echo "Usage: $0 <project-name> [region]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "========================================="
|
||||
echo "Terraform AWS Project Setup"
|
||||
echo "Project: $PROJECT_NAME"
|
||||
echo "Region: $REGION"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
mkdir -p "$PROJECT_NAME"
|
||||
cd "$PROJECT_NAME"
|
||||
|
||||
# Create main.tf
|
||||
cat > main.tf << EOF
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
|
||||
# Uncomment for remote state
|
||||
# backend "s3" {
|
||||
# bucket = "${PROJECT_NAME}-tfstate"
|
||||
# key = "terraform.tfstate"
|
||||
# region = "${REGION}"
|
||||
# encrypt = true
|
||||
# dynamodb_table = "${PROJECT_NAME}-tflock"
|
||||
# }
|
||||
}
|
||||
|
||||
provider "aws" {
|
||||
region = var.region
|
||||
|
||||
default_tags {
|
||||
tags = {
|
||||
Project = var.project_name
|
||||
Environment = var.environment
|
||||
ManagedBy = "terraform"
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create variables.tf
|
||||
cat > variables.tf << EOF
|
||||
variable "project_name" {
|
||||
description = "Project name for tagging"
|
||||
type = string
|
||||
default = "${PROJECT_NAME}"
|
||||
}
|
||||
|
||||
variable "environment" {
|
||||
description = "Environment (dev, staging, prod)"
|
||||
type = string
|
||||
default = "dev"
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "AWS region"
|
||||
type = string
|
||||
default = "${REGION}"
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create outputs.tf
|
||||
cat > outputs.tf << EOF
|
||||
output "region" {
|
||||
description = "AWS region"
|
||||
value = var.region
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create terraform.tfvars
|
||||
cat > terraform.tfvars << EOF
|
||||
project_name = "${PROJECT_NAME}"
|
||||
environment = "dev"
|
||||
region = "${REGION}"
|
||||
EOF
|
||||
|
||||
# Create .gitignore
|
||||
cat > .gitignore << EOF
|
||||
# Terraform
|
||||
.terraform/
|
||||
*.tfstate
|
||||
*.tfstate.*
|
||||
*.tfvars.json
|
||||
crash.log
|
||||
*.tfplan
|
||||
|
||||
# Keep tfvars template
|
||||
!terraform.tfvars.example
|
||||
|
||||
# IDE
|
||||
.idea/
|
||||
*.swp
|
||||
*.swo
|
||||
.vscode/
|
||||
EOF
|
||||
|
||||
# Initialize Terraform
|
||||
echo ""
|
||||
echo "Initializing Terraform..."
|
||||
terraform init
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Project created successfully!"
|
||||
echo ""
|
||||
echo "Files created:"
|
||||
ls -la
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo " 1. cd $PROJECT_NAME"
|
||||
echo " 2. Edit terraform.tfvars"
|
||||
echo " 3. Add resources to main.tf"
|
||||
echo " 4. terraform plan"
|
||||
echo " 5. terraform apply"
|
||||
echo "========================================="
|
||||
@@ -0,0 +1,58 @@
|
||||
---
|
||||
name: arm-templates
|
||||
description: Deploy Azure resources with ARM templates and Bicep. Create modular deployments and manage dependencies. Use when deploying Azure-native IaC.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# ARM Templates & Bicep
|
||||
|
||||
Deploy Azure infrastructure with ARM templates and Bicep.
|
||||
|
||||
## Bicep Example
|
||||
|
||||
```bicep
|
||||
param location string = resourceGroup().location
|
||||
param vmName string
|
||||
|
||||
resource vm 'Microsoft.Compute/virtualMachines@2023-03-01' = {
|
||||
name: vmName
|
||||
location: location
|
||||
properties: {
|
||||
hardwareProfile: {
|
||||
vmSize: 'Standard_B2s'
|
||||
}
|
||||
osProfile: {
|
||||
computerName: vmName
|
||||
adminUsername: 'azureuser'
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
output vmId string = vm.id
|
||||
```
|
||||
|
||||
## Deployment
|
||||
|
||||
```bash
|
||||
# Deploy Bicep
|
||||
az deployment group create \
|
||||
--resource-group mygroup \
|
||||
--template-file main.bicep \
|
||||
--parameters vmName=myvm
|
||||
|
||||
# Deploy ARM
|
||||
az deployment group create \
|
||||
--resource-group mygroup \
|
||||
--template-file template.json \
|
||||
--parameters @parameters.json
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use Bicep over JSON ARM
|
||||
- Implement modules for reusability
|
||||
- Use parameter files per environment
|
||||
- Validate before deployment
|
||||
@@ -0,0 +1,108 @@
|
||||
# ARM Template Syntax Reference
|
||||
|
||||
## Template Structure
|
||||
|
||||
```json
|
||||
{
|
||||
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
|
||||
"contentVersion": "1.0.0.0",
|
||||
"parameters": {
|
||||
"environment": {
|
||||
"type": "string",
|
||||
"allowedValues": ["dev", "staging", "prod"]
|
||||
}
|
||||
},
|
||||
"variables": {
|
||||
"storageAccountName": "[concat('storage', uniqueString(resourceGroup().id))]"
|
||||
},
|
||||
"resources": [],
|
||||
"outputs": {}
|
||||
}
|
||||
```
|
||||
|
||||
## Functions
|
||||
|
||||
```json
|
||||
// Concatenation
|
||||
"[concat('prefix-', parameters('name'), '-suffix')]"
|
||||
|
||||
// Unique string
|
||||
"[uniqueString(resourceGroup().id)]"
|
||||
|
||||
// Resource ID
|
||||
"[resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))]"
|
||||
|
||||
// Reference (runtime)
|
||||
"[reference(resourceId('Microsoft.Storage/storageAccounts', variables('storageName'))).primaryEndpoints.blob]"
|
||||
|
||||
// Conditions
|
||||
"[if(equals(parameters('environment'), 'prod'), 'Standard_GRS', 'Standard_LRS')]"
|
||||
```
|
||||
|
||||
## Resource Example
|
||||
|
||||
```json
|
||||
{
|
||||
"type": "Microsoft.Storage/storageAccounts",
|
||||
"apiVersion": "2021-09-01",
|
||||
"name": "[variables('storageAccountName')]",
|
||||
"location": "[resourceGroup().location]",
|
||||
"sku": {
|
||||
"name": "[variables('storageSku')]"
|
||||
},
|
||||
"kind": "StorageV2",
|
||||
"properties": {
|
||||
"supportsHttpsTrafficOnly": true,
|
||||
"minimumTlsVersion": "TLS1_2"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Dependencies
|
||||
|
||||
```json
|
||||
{
|
||||
"type": "Microsoft.Web/sites",
|
||||
"dependsOn": [
|
||||
"[resourceId('Microsoft.Web/serverfarms', variables('appServicePlanName'))]"
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Deployment
|
||||
|
||||
```bash
|
||||
# Create resource group
|
||||
az group create --name myRG --location eastus
|
||||
|
||||
# Deploy template
|
||||
az deployment group create \
|
||||
--resource-group myRG \
|
||||
--template-file template.json \
|
||||
--parameters @parameters.json
|
||||
|
||||
# What-if (preview changes)
|
||||
az deployment group what-if \
|
||||
--resource-group myRG \
|
||||
--template-file template.json
|
||||
```
|
||||
|
||||
## Bicep (Recommended)
|
||||
|
||||
```bicep
|
||||
param location string = resourceGroup().location
|
||||
param environment string
|
||||
|
||||
var storageAccountName = 'st${uniqueString(resourceGroup().id)}'
|
||||
|
||||
resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
|
||||
name: storageAccountName
|
||||
location: location
|
||||
sku: {
|
||||
name: environment == 'prod' ? 'Standard_GRS' : 'Standard_LRS'
|
||||
}
|
||||
kind: 'StorageV2'
|
||||
}
|
||||
|
||||
output storageEndpoint string = storageAccount.properties.primaryEndpoints.blob
|
||||
```
|
||||
@@ -0,0 +1,62 @@
|
||||
---
|
||||
name: azure-aks
|
||||
description: Deploy and manage Azure Kubernetes Service clusters. Configure node pools, networking, and integrations. Use when running Kubernetes workloads on Azure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Azure Kubernetes Service
|
||||
|
||||
Deploy managed Kubernetes clusters on Azure.
|
||||
|
||||
## Create Cluster
|
||||
|
||||
```bash
|
||||
az aks create \
|
||||
--resource-group mygroup \
|
||||
--name myakscluster \
|
||||
--node-count 3 \
|
||||
--node-vm-size Standard_B2s \
|
||||
--enable-managed-identity \
|
||||
--generate-ssh-keys
|
||||
|
||||
# Get credentials
|
||||
az aks get-credentials --resource-group mygroup --name myakscluster
|
||||
```
|
||||
|
||||
## Node Pools
|
||||
|
||||
```bash
|
||||
az aks nodepool add \
|
||||
--resource-group mygroup \
|
||||
--cluster-name myakscluster \
|
||||
--name gpupool \
|
||||
--node-count 1 \
|
||||
--node-vm-size Standard_NC6
|
||||
```
|
||||
|
||||
## Enable Add-ons
|
||||
|
||||
```bash
|
||||
# Enable monitoring
|
||||
az aks enable-addons \
|
||||
--resource-group mygroup \
|
||||
--name myakscluster \
|
||||
--addons monitoring
|
||||
|
||||
# Enable Azure Policy
|
||||
az aks enable-addons \
|
||||
--resource-group mygroup \
|
||||
--name myakscluster \
|
||||
--addons azure-policy
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use managed identity
|
||||
- Enable Azure CNI for networking
|
||||
- Implement pod identity
|
||||
- Use node pools for workload isolation
|
||||
- Enable cluster autoscaler
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
name: azure-functions
|
||||
description: Build serverless applications on Azure Functions. Configure triggers, bindings, and deployment. Use when implementing serverless workloads on Azure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Azure Functions
|
||||
|
||||
Build serverless applications with Azure Functions.
|
||||
|
||||
## Create Function App
|
||||
|
||||
```bash
|
||||
az functionapp create \
|
||||
--resource-group mygroup \
|
||||
--consumption-plan-location eastus \
|
||||
--runtime python \
|
||||
--runtime-version 3.11 \
|
||||
--functions-version 4 \
|
||||
--name myfunctionapp \
|
||||
--storage-account mystorageaccount
|
||||
```
|
||||
|
||||
## Function Code
|
||||
|
||||
```python
|
||||
import azure.functions as func
|
||||
|
||||
def main(req: func.HttpRequest) -> func.HttpResponse:
|
||||
return func.HttpResponse("Hello, World!")
|
||||
```
|
||||
|
||||
## Deployment
|
||||
|
||||
```bash
|
||||
# Deploy using Core Tools
|
||||
func azure functionapp publish myfunctionapp
|
||||
|
||||
# Deploy using ZIP
|
||||
az functionapp deployment source config-zip \
|
||||
--resource-group mygroup \
|
||||
--name myfunctionapp \
|
||||
--src function.zip
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use consumption plan for variable workloads
|
||||
- Implement Durable Functions for orchestration
|
||||
- Use managed identity for authentication
|
||||
- Monitor with Application Insights
|
||||
@@ -0,0 +1,60 @@
|
||||
---
|
||||
name: azure-networking
|
||||
description: Configure Azure VNets, NSGs, and Azure Firewall. Implement hub-spoke topology and private endpoints. Use when designing Azure network infrastructure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Azure Networking
|
||||
|
||||
Design and implement Azure network infrastructure.
|
||||
|
||||
## Create VNet
|
||||
|
||||
```bash
|
||||
az network vnet create \
|
||||
--resource-group mygroup \
|
||||
--name myvnet \
|
||||
--address-prefix 10.0.0.0/16 \
|
||||
--subnet-name default \
|
||||
--subnet-prefix 10.0.1.0/24
|
||||
```
|
||||
|
||||
## Network Security Group
|
||||
|
||||
```bash
|
||||
az network nsg create \
|
||||
--resource-group mygroup \
|
||||
--name mynsg
|
||||
|
||||
az network nsg rule create \
|
||||
--resource-group mygroup \
|
||||
--nsg-name mynsg \
|
||||
--name AllowHTTPS \
|
||||
--priority 100 \
|
||||
--destination-port-ranges 443 \
|
||||
--access Allow
|
||||
```
|
||||
|
||||
## Private Endpoint
|
||||
|
||||
```bash
|
||||
az network private-endpoint create \
|
||||
--resource-group mygroup \
|
||||
--name myendpoint \
|
||||
--vnet-name myvnet \
|
||||
--subnet default \
|
||||
--private-connection-resource-id /subscriptions/.../sql/... \
|
||||
--group-id sqlServer \
|
||||
--connection-name myconnection
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Implement hub-spoke topology
|
||||
- Use NSGs and Azure Firewall
|
||||
- Enable DDoS protection
|
||||
- Use private endpoints
|
||||
- Implement VNet peering
|
||||
@@ -0,0 +1,58 @@
|
||||
---
|
||||
name: azure-sql
|
||||
description: Provision Azure SQL Database and Cosmos DB. Configure security, backups, and replication. Use when deploying managed databases on Azure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Azure SQL
|
||||
|
||||
Deploy managed databases on Azure.
|
||||
|
||||
## Create SQL Database
|
||||
|
||||
```bash
|
||||
# Create server
|
||||
az sql server create \
|
||||
--name myserver \
|
||||
--resource-group mygroup \
|
||||
--admin-user sqladmin \
|
||||
--admin-password SecureP@ss123
|
||||
|
||||
# Create database
|
||||
az sql db create \
|
||||
--resource-group mygroup \
|
||||
--server myserver \
|
||||
--name mydb \
|
||||
--service-objective S1
|
||||
```
|
||||
|
||||
## Firewall Rules
|
||||
|
||||
```bash
|
||||
az sql server firewall-rule create \
|
||||
--resource-group mygroup \
|
||||
--server myserver \
|
||||
--name AllowAzure \
|
||||
--start-ip-address 0.0.0.0 \
|
||||
--end-ip-address 0.0.0.0
|
||||
```
|
||||
|
||||
## Cosmos DB
|
||||
|
||||
```bash
|
||||
az cosmosdb create \
|
||||
--name mycosmosdb \
|
||||
--resource-group mygroup \
|
||||
--default-consistency-level Session
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Enable transparent data encryption
|
||||
- Use Azure AD authentication
|
||||
- Implement geo-replication
|
||||
- Configure automated backups
|
||||
- Use private endpoints
|
||||
@@ -0,0 +1,45 @@
|
||||
---
|
||||
name: azure-vms
|
||||
description: Manage Azure Virtual Machines and scale sets. Configure availability sets and managed disks. Use when deploying compute resources on Azure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Azure Virtual Machines
|
||||
|
||||
Deploy and manage Azure VMs and scale sets.
|
||||
|
||||
## Create VM
|
||||
|
||||
```bash
|
||||
az vm create \
|
||||
--resource-group mygroup \
|
||||
--name myvm \
|
||||
--image Ubuntu2204 \
|
||||
--size Standard_B2s \
|
||||
--admin-username azureuser \
|
||||
--generate-ssh-keys \
|
||||
--nsg-rule SSH
|
||||
```
|
||||
|
||||
## Scale Sets
|
||||
|
||||
```bash
|
||||
az vmss create \
|
||||
--resource-group mygroup \
|
||||
--name myvmss \
|
||||
--image Ubuntu2204 \
|
||||
--instance-count 2 \
|
||||
--vm-sku Standard_B2s \
|
||||
--upgrade-policy-mode automatic
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use managed disks
|
||||
- Implement availability zones
|
||||
- Use scale sets for auto-scaling
|
||||
- Enable Azure Backup
|
||||
- Use spot instances for cost savings
|
||||
@@ -0,0 +1,99 @@
|
||||
# Azure VM Operations Reference
|
||||
|
||||
## VM Management
|
||||
|
||||
```bash
|
||||
# Create VM
|
||||
az vm create \
|
||||
--resource-group myRG \
|
||||
--name myVM \
|
||||
--image Ubuntu2204 \
|
||||
--admin-username azureuser \
|
||||
--generate-ssh-keys \
|
||||
--size Standard_B2s
|
||||
|
||||
# Start/Stop/Delete
|
||||
az vm start --resource-group myRG --name myVM
|
||||
az vm stop --resource-group myRG --name myVM
|
||||
az vm deallocate --resource-group myRG --name myVM
|
||||
az vm delete --resource-group myRG --name myVM --yes
|
||||
|
||||
# List VMs
|
||||
az vm list --resource-group myRG -o table
|
||||
az vm list-ip-addresses --resource-group myRG -o table
|
||||
```
|
||||
|
||||
## VM Sizes
|
||||
|
||||
| Size | vCPU | Memory | Use Case |
|
||||
|------|------|--------|----------|
|
||||
| Standard_B1s | 1 | 1 GB | Dev/Test |
|
||||
| Standard_B2s | 2 | 4 GB | Light workloads |
|
||||
| Standard_D2s_v3 | 2 | 8 GB | General |
|
||||
| Standard_F2s_v2 | 2 | 4 GB | Compute |
|
||||
| Standard_E2s_v3 | 2 | 16 GB | Memory |
|
||||
|
||||
```bash
|
||||
# List available sizes
|
||||
az vm list-sizes --location eastus -o table
|
||||
|
||||
# Resize VM
|
||||
az vm resize --resource-group myRG --name myVM --size Standard_D4s_v3
|
||||
```
|
||||
|
||||
## Images
|
||||
|
||||
```bash
|
||||
# List images
|
||||
az vm image list --output table
|
||||
az vm image list --publisher Canonical --all --output table
|
||||
|
||||
# Create image from VM
|
||||
az vm deallocate --resource-group myRG --name myVM
|
||||
az vm generalize --resource-group myRG --name myVM
|
||||
az image create --resource-group myRG --name myImage --source myVM
|
||||
```
|
||||
|
||||
## Custom Script Extension
|
||||
|
||||
```bash
|
||||
az vm extension set \
|
||||
--resource-group myRG \
|
||||
--vm-name myVM \
|
||||
--name customScript \
|
||||
--publisher Microsoft.Azure.Extensions \
|
||||
--settings '{"commandToExecute":"apt-get update && apt-get install -y nginx"}'
|
||||
```
|
||||
|
||||
## Terraform
|
||||
|
||||
```hcl
|
||||
resource "azurerm_linux_virtual_machine" "main" {
|
||||
name = "myVM"
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
location = azurerm_resource_group.main.location
|
||||
size = "Standard_B2s"
|
||||
admin_username = "azureuser"
|
||||
|
||||
admin_ssh_key {
|
||||
username = "azureuser"
|
||||
public_key = file("~/.ssh/id_rsa.pub")
|
||||
}
|
||||
|
||||
os_disk {
|
||||
caching = "ReadWrite"
|
||||
storage_account_type = "Premium_LRS"
|
||||
}
|
||||
|
||||
source_image_reference {
|
||||
publisher = "Canonical"
|
||||
offer = "0001-com-ubuntu-server-jammy"
|
||||
sku = "22_04-lts"
|
||||
version = "latest"
|
||||
}
|
||||
|
||||
network_interface_ids = [
|
||||
azurerm_network_interface.main.id,
|
||||
]
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
name: terraform-azure
|
||||
description: Provision Azure infrastructure with Terraform. Configure providers, manage state, and deploy resources. Use when implementing IaC for Azure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Terraform Azure
|
||||
|
||||
Provision Azure infrastructure with Terraform.
|
||||
|
||||
## Provider Configuration
|
||||
|
||||
```hcl
|
||||
terraform {
|
||||
required_providers {
|
||||
azurerm = {
|
||||
source = "hashicorp/azurerm"
|
||||
version = "~> 3.0"
|
||||
}
|
||||
}
|
||||
backend "azurerm" {
|
||||
resource_group_name = "tfstate"
|
||||
storage_account_name = "tfstate12345"
|
||||
container_name = "tfstate"
|
||||
key = "prod.terraform.tfstate"
|
||||
}
|
||||
}
|
||||
|
||||
provider "azurerm" {
|
||||
features {}
|
||||
}
|
||||
```
|
||||
|
||||
## Example Resources
|
||||
|
||||
```hcl
|
||||
resource "azurerm_resource_group" "main" {
|
||||
name = "myapp-rg"
|
||||
location = "East US"
|
||||
}
|
||||
|
||||
resource "azurerm_virtual_network" "main" {
|
||||
name = "myapp-vnet"
|
||||
address_space = ["10.0.0.0/16"]
|
||||
location = azurerm_resource_group.main.location
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
}
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use remote state in Azure Storage
|
||||
- Implement resource naming conventions
|
||||
- Use data sources for existing resources
|
||||
- Tag all resources
|
||||
- Use modules for reusability
|
||||
@@ -0,0 +1,80 @@
|
||||
# Azure Virtual Network Module Template
|
||||
|
||||
variable "address_space" {
|
||||
description = "VNet address space"
|
||||
type = list(string)
|
||||
default = ["10.0.0.0/16"]
|
||||
}
|
||||
|
||||
# Virtual Network
|
||||
resource "azurerm_virtual_network" "main" {
|
||||
name = "${var.project_name}-${var.environment}-vnet"
|
||||
location = azurerm_resource_group.main.location
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
address_space = var.address_space
|
||||
|
||||
tags = local.common_tags
|
||||
}
|
||||
|
||||
# Public Subnet
|
||||
resource "azurerm_subnet" "public" {
|
||||
name = "public-subnet"
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
virtual_network_name = azurerm_virtual_network.main.name
|
||||
address_prefixes = ["10.0.1.0/24"]
|
||||
}
|
||||
|
||||
# Private Subnet
|
||||
resource "azurerm_subnet" "private" {
|
||||
name = "private-subnet"
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
virtual_network_name = azurerm_virtual_network.main.name
|
||||
address_prefixes = ["10.0.2.0/24"]
|
||||
}
|
||||
|
||||
# AKS Subnet
|
||||
resource "azurerm_subnet" "aks" {
|
||||
name = "aks-subnet"
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
virtual_network_name = azurerm_virtual_network.main.name
|
||||
address_prefixes = ["10.0.10.0/23"]
|
||||
}
|
||||
|
||||
# Network Security Group
|
||||
resource "azurerm_network_security_group" "main" {
|
||||
name = "${var.project_name}-${var.environment}-nsg"
|
||||
location = azurerm_resource_group.main.location
|
||||
resource_group_name = azurerm_resource_group.main.name
|
||||
|
||||
security_rule {
|
||||
name = "SSH"
|
||||
priority = 1001
|
||||
direction = "Inbound"
|
||||
access = "Allow"
|
||||
protocol = "Tcp"
|
||||
source_port_range = "*"
|
||||
destination_port_range = "22"
|
||||
source_address_prefix = "*"
|
||||
destination_address_prefix = "*"
|
||||
}
|
||||
|
||||
tags = local.common_tags
|
||||
}
|
||||
|
||||
# NSG Association
|
||||
resource "azurerm_subnet_network_security_group_association" "public" {
|
||||
subnet_id = azurerm_subnet.public.id
|
||||
network_security_group_id = azurerm_network_security_group.main.id
|
||||
}
|
||||
|
||||
output "vnet_id" {
|
||||
value = azurerm_virtual_network.main.id
|
||||
}
|
||||
|
||||
output "subnet_ids" {
|
||||
value = {
|
||||
public = azurerm_subnet.public.id
|
||||
private = azurerm_subnet.private.id
|
||||
aks = azurerm_subnet.aks.id
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,130 @@
|
||||
#!/bin/bash
|
||||
# Terraform Azure Project Initialization Script
|
||||
# Usage: ./tf-init-azure.sh <project-name> [location]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PROJECT_NAME="${1:-}"
|
||||
LOCATION="${2:-eastus}"
|
||||
|
||||
if [ -z "$PROJECT_NAME" ]; then
|
||||
echo "Usage: $0 <project-name> [location]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "========================================="
|
||||
echo "Terraform Azure Project Setup"
|
||||
echo "Project: $PROJECT_NAME"
|
||||
echo "Location: $LOCATION"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
mkdir -p "$PROJECT_NAME"
|
||||
cd "$PROJECT_NAME"
|
||||
|
||||
# Create main.tf
|
||||
cat > main.tf << EOF
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
azurerm = {
|
||||
source = "hashicorp/azurerm"
|
||||
version = "~> 3.0"
|
||||
}
|
||||
}
|
||||
|
||||
# Uncomment for remote state
|
||||
# backend "azurerm" {
|
||||
# resource_group_name = "${PROJECT_NAME}-tfstate-rg"
|
||||
# storage_account_name = "${PROJECT_NAME}tfstate"
|
||||
# container_name = "tfstate"
|
||||
# key = "terraform.tfstate"
|
||||
# }
|
||||
}
|
||||
|
||||
provider "azurerm" {
|
||||
features {}
|
||||
}
|
||||
|
||||
# Resource Group
|
||||
resource "azurerm_resource_group" "main" {
|
||||
name = "\${var.project_name}-\${var.environment}-rg"
|
||||
location = var.location
|
||||
|
||||
tags = local.common_tags
|
||||
}
|
||||
|
||||
locals {
|
||||
common_tags = {
|
||||
Project = var.project_name
|
||||
Environment = var.environment
|
||||
ManagedBy = "terraform"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create variables.tf
|
||||
cat > variables.tf << EOF
|
||||
variable "project_name" {
|
||||
description = "Project name for resource naming"
|
||||
type = string
|
||||
default = "${PROJECT_NAME}"
|
||||
}
|
||||
|
||||
variable "environment" {
|
||||
description = "Environment (dev, staging, prod)"
|
||||
type = string
|
||||
default = "dev"
|
||||
}
|
||||
|
||||
variable "location" {
|
||||
description = "Azure region"
|
||||
type = string
|
||||
default = "${LOCATION}"
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create outputs.tf
|
||||
cat > outputs.tf << EOF
|
||||
output "resource_group_name" {
|
||||
description = "Resource group name"
|
||||
value = azurerm_resource_group.main.name
|
||||
}
|
||||
|
||||
output "location" {
|
||||
description = "Azure region"
|
||||
value = azurerm_resource_group.main.location
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create terraform.tfvars
|
||||
cat > terraform.tfvars << EOF
|
||||
project_name = "${PROJECT_NAME}"
|
||||
environment = "dev"
|
||||
location = "${LOCATION}"
|
||||
EOF
|
||||
|
||||
# Create .gitignore
|
||||
cat > .gitignore << EOF
|
||||
.terraform/
|
||||
*.tfstate
|
||||
*.tfstate.*
|
||||
*.tfvars.json
|
||||
crash.log
|
||||
*.tfplan
|
||||
!terraform.tfvars.example
|
||||
.idea/
|
||||
*.swp
|
||||
.vscode/
|
||||
EOF
|
||||
|
||||
# Initialize Terraform
|
||||
echo ""
|
||||
echo "Initializing Terraform..."
|
||||
terraform init
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Project created successfully!"
|
||||
echo "========================================="
|
||||
@@ -0,0 +1,49 @@
|
||||
---
|
||||
name: gcp-cloud-functions
|
||||
description: Deploy serverless functions on Google Cloud Functions. Configure triggers and manage deployments. Use when implementing serverless workloads on GCP.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# GCP Cloud Functions
|
||||
|
||||
Build serverless applications with Cloud Functions.
|
||||
|
||||
## Deploy Function
|
||||
|
||||
```bash
|
||||
# Deploy HTTP function
|
||||
gcloud functions deploy hello \
|
||||
--runtime=python311 \
|
||||
--trigger-http \
|
||||
--allow-unauthenticated \
|
||||
--entry-point=hello_http
|
||||
|
||||
# Deploy Pub/Sub triggered function
|
||||
gcloud functions deploy process-message \
|
||||
--runtime=python311 \
|
||||
--trigger-topic=my-topic \
|
||||
--entry-point=process
|
||||
```
|
||||
|
||||
## Function Code
|
||||
|
||||
```python
|
||||
# main.py
|
||||
def hello_http(request):
|
||||
return 'Hello, World!'
|
||||
|
||||
def process(event, context):
|
||||
import base64
|
||||
data = base64.b64decode(event['data']).decode('utf-8')
|
||||
print(f"Received: {data}")
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use 2nd gen functions for better performance
|
||||
- Implement proper error handling
|
||||
- Use environment variables for configuration
|
||||
- Monitor with Cloud Logging
|
||||
@@ -0,0 +1,49 @@
|
||||
---
|
||||
name: gcp-cloud-sql
|
||||
description: Provision Cloud SQL and Spanner databases. Configure high availability, backups, and security. Use when deploying managed databases on GCP.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# GCP Cloud SQL
|
||||
|
||||
Deploy managed databases on Google Cloud.
|
||||
|
||||
## Create Instance
|
||||
|
||||
```bash
|
||||
gcloud sql instances create mydb \
|
||||
--database-version=POSTGRES_15 \
|
||||
--tier=db-f1-micro \
|
||||
--region=us-central1 \
|
||||
--root-password=secretpassword \
|
||||
--storage-auto-increase \
|
||||
--backup-start-time=02:00
|
||||
|
||||
# Create database
|
||||
gcloud sql databases create myapp --instance=mydb
|
||||
|
||||
# Create user
|
||||
gcloud sql users create appuser \
|
||||
--instance=mydb \
|
||||
--password=userpassword
|
||||
```
|
||||
|
||||
## High Availability
|
||||
|
||||
```bash
|
||||
gcloud sql instances create mydb \
|
||||
--database-version=POSTGRES_15 \
|
||||
--tier=db-custom-2-8192 \
|
||||
--region=us-central1 \
|
||||
--availability-type=REGIONAL
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Enable automated backups
|
||||
- Use Cloud SQL Proxy for connections
|
||||
- Implement private IP
|
||||
- Use read replicas for scaling
|
||||
@@ -0,0 +1,42 @@
|
||||
---
|
||||
name: gcp-compute
|
||||
description: Manage Compute Engine instances and instance templates. Configure managed instance groups and preemptible VMs. Use when deploying compute resources on GCP.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# GCP Compute Engine
|
||||
|
||||
Deploy and manage Compute Engine instances.
|
||||
|
||||
## Create Instance
|
||||
|
||||
```bash
|
||||
gcloud compute instances create web-server \
|
||||
--machine-type=e2-medium \
|
||||
--zone=us-central1-a \
|
||||
--image-family=debian-11 \
|
||||
--image-project=debian-cloud \
|
||||
--boot-disk-size=20GB \
|
||||
--tags=http-server
|
||||
|
||||
# Create from instance template
|
||||
gcloud compute instance-templates create web-template \
|
||||
--machine-type=e2-medium \
|
||||
--image-family=debian-11 \
|
||||
--image-project=debian-cloud
|
||||
|
||||
gcloud compute instance-groups managed create web-group \
|
||||
--template=web-template \
|
||||
--size=3 \
|
||||
--zone=us-central1-a
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use managed instance groups
|
||||
- Implement preemptible VMs for cost savings
|
||||
- Use custom images for consistency
|
||||
- Enable shielded VMs
|
||||
@@ -0,0 +1,55 @@
|
||||
---
|
||||
name: gcp-gke
|
||||
description: Deploy and manage Google Kubernetes Engine clusters. Configure node pools, networking, and workload identity. Use when running Kubernetes on GCP.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Google Kubernetes Engine
|
||||
|
||||
Deploy managed Kubernetes clusters on GCP.
|
||||
|
||||
## Create Cluster
|
||||
|
||||
```bash
|
||||
gcloud container clusters create my-cluster \
|
||||
--num-nodes=3 \
|
||||
--machine-type=e2-medium \
|
||||
--zone=us-central1-a \
|
||||
--enable-autoscaling \
|
||||
--min-nodes=1 \
|
||||
--max-nodes=5 \
|
||||
--workload-pool=${PROJECT_ID}.svc.id.goog
|
||||
|
||||
# Get credentials
|
||||
gcloud container clusters get-credentials my-cluster --zone=us-central1-a
|
||||
```
|
||||
|
||||
## Node Pools
|
||||
|
||||
```bash
|
||||
gcloud container node-pools create gpu-pool \
|
||||
--cluster=my-cluster \
|
||||
--zone=us-central1-a \
|
||||
--machine-type=n1-standard-4 \
|
||||
--accelerator=type=nvidia-tesla-k80,count=1 \
|
||||
--num-nodes=1
|
||||
```
|
||||
|
||||
## Workload Identity
|
||||
|
||||
```bash
|
||||
gcloud iam service-accounts add-iam-policy-binding \
|
||||
--role=roles/iam.workloadIdentityUser \
|
||||
--member="serviceAccount:${PROJECT_ID}.svc.id.goog[NAMESPACE/KSA_NAME]" \
|
||||
GSA_NAME@${PROJECT_ID}.iam.gserviceaccount.com
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use Workload Identity
|
||||
- Enable VPC-native clusters
|
||||
- Implement node auto-provisioning
|
||||
- Use regional clusters for HA
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
name: gcp-networking
|
||||
description: Configure VPCs, firewall rules, and Cloud NAT. Implement shared VPC and private service connect. Use when designing GCP network infrastructure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# GCP Networking
|
||||
|
||||
Design and implement GCP network infrastructure.
|
||||
|
||||
## Create VPC
|
||||
|
||||
```bash
|
||||
gcloud compute networks create my-vpc --subnet-mode=custom
|
||||
|
||||
gcloud compute networks subnets create my-subnet \
|
||||
--network=my-vpc \
|
||||
--region=us-central1 \
|
||||
--range=10.0.0.0/24
|
||||
```
|
||||
|
||||
## Firewall Rules
|
||||
|
||||
```bash
|
||||
gcloud compute firewall-rules create allow-http \
|
||||
--network=my-vpc \
|
||||
--allow=tcp:80,tcp:443 \
|
||||
--source-ranges=0.0.0.0/0 \
|
||||
--target-tags=http-server
|
||||
|
||||
gcloud compute firewall-rules create allow-internal \
|
||||
--network=my-vpc \
|
||||
--allow=tcp,udp,icmp \
|
||||
--source-ranges=10.0.0.0/8
|
||||
```
|
||||
|
||||
## Cloud NAT
|
||||
|
||||
```bash
|
||||
gcloud compute routers create my-router \
|
||||
--network=my-vpc \
|
||||
--region=us-central1
|
||||
|
||||
gcloud compute routers nats create my-nat \
|
||||
--router=my-router \
|
||||
--region=us-central1 \
|
||||
--nat-all-subnet-ip-ranges \
|
||||
--auto-allocate-nat-external-ips
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use Shared VPC for multi-project
|
||||
- Implement Cloud Armor for DDoS
|
||||
- Use Private Google Access
|
||||
- Enable VPC Flow Logs
|
||||
@@ -0,0 +1,66 @@
|
||||
---
|
||||
name: terraform-gcp
|
||||
description: Provision GCP infrastructure with Terraform. Configure providers and deploy Google Cloud resources. Use when implementing IaC for GCP.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Terraform GCP
|
||||
|
||||
Provision Google Cloud infrastructure with Terraform.
|
||||
|
||||
## Provider Configuration
|
||||
|
||||
```hcl
|
||||
terraform {
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
backend "gcs" {
|
||||
bucket = "tf-state-bucket"
|
||||
prefix = "terraform/state"
|
||||
}
|
||||
}
|
||||
|
||||
provider "google" {
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
}
|
||||
```
|
||||
|
||||
## Example Resources
|
||||
|
||||
```hcl
|
||||
resource "google_compute_network" "vpc" {
|
||||
name = "main-vpc"
|
||||
auto_create_subnetworks = false
|
||||
}
|
||||
|
||||
resource "google_compute_instance" "vm" {
|
||||
name = "web-server"
|
||||
machine_type = "e2-micro"
|
||||
zone = "us-central1-a"
|
||||
|
||||
boot_disk {
|
||||
initialize_params {
|
||||
image = "debian-cloud/debian-11"
|
||||
}
|
||||
}
|
||||
|
||||
network_interface {
|
||||
network = google_compute_network.vpc.name
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use service accounts for authentication
|
||||
- Store state in GCS
|
||||
- Use labels consistently
|
||||
- Implement least-privilege IAM
|
||||
@@ -0,0 +1,114 @@
|
||||
# GCP VPC Module Template
|
||||
|
||||
variable "network_name" {
|
||||
description = "VPC network name"
|
||||
type = string
|
||||
default = "main"
|
||||
}
|
||||
|
||||
# VPC Network
|
||||
resource "google_compute_network" "main" {
|
||||
name = "${var.project_name}-${var.environment}-vpc"
|
||||
auto_create_subnetworks = false
|
||||
project = var.project_id
|
||||
}
|
||||
|
||||
# Public Subnet
|
||||
resource "google_compute_subnetwork" "public" {
|
||||
name = "${var.project_name}-${var.environment}-public"
|
||||
ip_cidr_range = "10.0.1.0/24"
|
||||
region = var.region
|
||||
network = google_compute_network.main.id
|
||||
project = var.project_id
|
||||
|
||||
secondary_ip_range {
|
||||
range_name = "gke-pods"
|
||||
ip_cidr_range = "10.1.0.0/16"
|
||||
}
|
||||
|
||||
secondary_ip_range {
|
||||
range_name = "gke-services"
|
||||
ip_cidr_range = "10.2.0.0/20"
|
||||
}
|
||||
}
|
||||
|
||||
# Private Subnet
|
||||
resource "google_compute_subnetwork" "private" {
|
||||
name = "${var.project_name}-${var.environment}-private"
|
||||
ip_cidr_range = "10.0.2.0/24"
|
||||
region = var.region
|
||||
network = google_compute_network.main.id
|
||||
project = var.project_id
|
||||
private_ip_google_access = true
|
||||
}
|
||||
|
||||
# Cloud Router (for NAT)
|
||||
resource "google_compute_router" "main" {
|
||||
name = "${var.project_name}-${var.environment}-router"
|
||||
region = var.region
|
||||
network = google_compute_network.main.id
|
||||
project = var.project_id
|
||||
}
|
||||
|
||||
# Cloud NAT
|
||||
resource "google_compute_router_nat" "main" {
|
||||
name = "${var.project_name}-${var.environment}-nat"
|
||||
router = google_compute_router.main.name
|
||||
region = var.region
|
||||
project = var.project_id
|
||||
nat_ip_allocate_option = "AUTO_ONLY"
|
||||
source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"
|
||||
}
|
||||
|
||||
# Firewall - Allow SSH
|
||||
resource "google_compute_firewall" "allow_ssh" {
|
||||
name = "${var.project_name}-${var.environment}-allow-ssh"
|
||||
network = google_compute_network.main.name
|
||||
project = var.project_id
|
||||
|
||||
allow {
|
||||
protocol = "tcp"
|
||||
ports = ["22"]
|
||||
}
|
||||
|
||||
source_ranges = ["0.0.0.0/0"]
|
||||
target_tags = ["ssh"]
|
||||
}
|
||||
|
||||
# Firewall - Allow Internal
|
||||
resource "google_compute_firewall" "allow_internal" {
|
||||
name = "${var.project_name}-${var.environment}-allow-internal"
|
||||
network = google_compute_network.main.name
|
||||
project = var.project_id
|
||||
|
||||
allow {
|
||||
protocol = "icmp"
|
||||
}
|
||||
|
||||
allow {
|
||||
protocol = "tcp"
|
||||
ports = ["0-65535"]
|
||||
}
|
||||
|
||||
allow {
|
||||
protocol = "udp"
|
||||
ports = ["0-65535"]
|
||||
}
|
||||
|
||||
source_ranges = ["10.0.0.0/8"]
|
||||
}
|
||||
|
||||
output "network_name" {
|
||||
value = google_compute_network.main.name
|
||||
}
|
||||
|
||||
output "network_id" {
|
||||
value = google_compute_network.main.id
|
||||
}
|
||||
|
||||
output "subnet_ids" {
|
||||
value = {
|
||||
public = google_compute_subnetwork.public.id
|
||||
private = google_compute_subnetwork.private.id
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,130 @@
|
||||
#!/bin/bash
|
||||
# Terraform GCP Project Initialization Script
|
||||
# Usage: ./tf-init-gcp.sh <project-name> <gcp-project-id> [region]
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
PROJECT_NAME="${1:-}"
|
||||
GCP_PROJECT="${2:-}"
|
||||
REGION="${3:-us-central1}"
|
||||
|
||||
if [ -z "$PROJECT_NAME" ] || [ -z "$GCP_PROJECT" ]; then
|
||||
echo "Usage: $0 <project-name> <gcp-project-id> [region]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "========================================="
|
||||
echo "Terraform GCP Project Setup"
|
||||
echo "Project: $PROJECT_NAME"
|
||||
echo "GCP Project: $GCP_PROJECT"
|
||||
echo "Region: $REGION"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
mkdir -p "$PROJECT_NAME"
|
||||
cd "$PROJECT_NAME"
|
||||
|
||||
# Create main.tf
|
||||
cat > main.tf << EOF
|
||||
terraform {
|
||||
required_version = ">= 1.0"
|
||||
|
||||
required_providers {
|
||||
google = {
|
||||
source = "hashicorp/google"
|
||||
version = "~> 5.0"
|
||||
}
|
||||
}
|
||||
|
||||
# Uncomment for remote state
|
||||
# backend "gcs" {
|
||||
# bucket = "${PROJECT_NAME}-tfstate"
|
||||
# prefix = "terraform/state"
|
||||
# }
|
||||
}
|
||||
|
||||
provider "google" {
|
||||
project = var.project_id
|
||||
region = var.region
|
||||
}
|
||||
|
||||
locals {
|
||||
common_labels = {
|
||||
project = var.project_name
|
||||
environment = var.environment
|
||||
managed-by = "terraform"
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create variables.tf
|
||||
cat > variables.tf << EOF
|
||||
variable "project_name" {
|
||||
description = "Project name for resource naming"
|
||||
type = string
|
||||
default = "${PROJECT_NAME}"
|
||||
}
|
||||
|
||||
variable "project_id" {
|
||||
description = "GCP Project ID"
|
||||
type = string
|
||||
default = "${GCP_PROJECT}"
|
||||
}
|
||||
|
||||
variable "environment" {
|
||||
description = "Environment (dev, staging, prod)"
|
||||
type = string
|
||||
default = "dev"
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "GCP region"
|
||||
type = string
|
||||
default = "${REGION}"
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create outputs.tf
|
||||
cat > outputs.tf << EOF
|
||||
output "project_id" {
|
||||
description = "GCP Project ID"
|
||||
value = var.project_id
|
||||
}
|
||||
|
||||
output "region" {
|
||||
description = "GCP region"
|
||||
value = var.region
|
||||
}
|
||||
EOF
|
||||
|
||||
# Create terraform.tfvars
|
||||
cat > terraform.tfvars << EOF
|
||||
project_name = "${PROJECT_NAME}"
|
||||
project_id = "${GCP_PROJECT}"
|
||||
environment = "dev"
|
||||
region = "${REGION}"
|
||||
EOF
|
||||
|
||||
# Create .gitignore
|
||||
cat > .gitignore << EOF
|
||||
.terraform/
|
||||
*.tfstate
|
||||
*.tfstate.*
|
||||
*.tfvars.json
|
||||
crash.log
|
||||
*.tfplan
|
||||
!terraform.tfvars.example
|
||||
.idea/
|
||||
*.swp
|
||||
.vscode/
|
||||
EOF
|
||||
|
||||
# Initialize Terraform
|
||||
echo ""
|
||||
echo "Initializing Terraform..."
|
||||
terraform init
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo "Project created successfully!"
|
||||
echo "========================================="
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
name: database-backups
|
||||
description: Implement database backup strategies. Configure automated backups, retention, and recovery testing. Use when designing backup and recovery procedures.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Database Backups
|
||||
|
||||
Implement comprehensive database backup strategies.
|
||||
|
||||
## Backup Types
|
||||
|
||||
```yaml
|
||||
backup_types:
|
||||
full:
|
||||
description: Complete database copy
|
||||
frequency: Weekly
|
||||
|
||||
incremental:
|
||||
description: Changes since last backup
|
||||
frequency: Daily
|
||||
|
||||
transaction_log:
|
||||
description: Continuous transaction logging
|
||||
frequency: Continuous
|
||||
```
|
||||
|
||||
## Automated Backup Script
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
DATE=$(date +%Y%m%d_%H%M%S)
|
||||
BACKUP_DIR="/backups"
|
||||
|
||||
# PostgreSQL
|
||||
pg_dump -Fc mydb > $BACKUP_DIR/pg_$DATE.dump
|
||||
|
||||
# MySQL
|
||||
mysqldump -u root -p$MYSQL_PWD mydb | gzip > $BACKUP_DIR/mysql_$DATE.sql.gz
|
||||
|
||||
# Upload to S3
|
||||
aws s3 cp $BACKUP_DIR/pg_$DATE.dump s3://backups/postgres/
|
||||
|
||||
# Cleanup old backups (keep 7 days)
|
||||
find $BACKUP_DIR -name "*.dump" -mtime +7 -delete
|
||||
```
|
||||
|
||||
## Recovery Testing
|
||||
|
||||
```bash
|
||||
# Create test environment
|
||||
docker run -d --name restore-test postgres:15
|
||||
|
||||
# Restore backup
|
||||
pg_restore -d testdb backup.dump
|
||||
|
||||
# Verify data integrity
|
||||
psql testdb -c "SELECT COUNT(*) FROM users;"
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- 3-2-1 Rule: 3 copies, 2 media types, 1 offsite
|
||||
- Regular recovery testing
|
||||
- Encrypt backups at rest
|
||||
- Monitor backup success
|
||||
- Document recovery procedures
|
||||
@@ -0,0 +1,79 @@
|
||||
---
|
||||
name: mongodb
|
||||
description: Administer MongoDB databases. Configure replica sets, sharding, and backups. Use when managing MongoDB deployments.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# MongoDB
|
||||
|
||||
Administer MongoDB NoSQL databases.
|
||||
|
||||
## Installation & Setup
|
||||
|
||||
```bash
|
||||
# Install
|
||||
apt install mongodb-org
|
||||
|
||||
# Start service
|
||||
systemctl start mongod
|
||||
|
||||
# Connect
|
||||
mongosh
|
||||
|
||||
# Create user
|
||||
use admin
|
||||
db.createUser({
|
||||
user: "admin",
|
||||
pwd: "secret",
|
||||
roles: ["root"]
|
||||
})
|
||||
```
|
||||
|
||||
## Basic Operations
|
||||
|
||||
```javascript
|
||||
// Create database and collection
|
||||
use mydb
|
||||
db.users.insertOne({ name: "John", email: "john@example.com" })
|
||||
|
||||
// Query
|
||||
db.users.find({ name: "John" })
|
||||
db.users.find().sort({ name: 1 }).limit(10)
|
||||
|
||||
// Index
|
||||
db.users.createIndex({ email: 1 }, { unique: true })
|
||||
```
|
||||
|
||||
## Replica Set
|
||||
|
||||
```javascript
|
||||
// Initialize replica set
|
||||
rs.initiate({
|
||||
_id: "myReplicaSet",
|
||||
members: [
|
||||
{ _id: 0, host: "mongo1:27017" },
|
||||
{ _id: 1, host: "mongo2:27017" },
|
||||
{ _id: 2, host: "mongo3:27017" }
|
||||
]
|
||||
})
|
||||
```
|
||||
|
||||
## Backup
|
||||
|
||||
```bash
|
||||
# Backup
|
||||
mongodump --out /backup/
|
||||
|
||||
# Restore
|
||||
mongorestore /backup/
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use replica sets in production
|
||||
- Implement proper indexing
|
||||
- Enable authentication
|
||||
- Regular backups with mongodump
|
||||
@@ -0,0 +1,78 @@
|
||||
---
|
||||
name: mysql
|
||||
description: Administer MySQL/MariaDB databases. Configure replication and optimize performance. Use when managing MySQL deployments.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# MySQL / MariaDB
|
||||
|
||||
Administer MySQL and MariaDB databases.
|
||||
|
||||
## Installation & Setup
|
||||
|
||||
```bash
|
||||
# Install
|
||||
apt install mysql-server
|
||||
|
||||
# Secure installation
|
||||
mysql_secure_installation
|
||||
|
||||
# Access
|
||||
mysql -u root -p
|
||||
|
||||
# Create database and user
|
||||
CREATE DATABASE mydb;
|
||||
CREATE USER 'myapp'@'%' IDENTIFIED BY 'secret';
|
||||
GRANT ALL PRIVILEGES ON mydb.* TO 'myapp'@'%';
|
||||
FLUSH PRIVILEGES;
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
```bash
|
||||
# /etc/mysql/mysql.conf.d/mysqld.cnf
|
||||
[mysqld]
|
||||
innodb_buffer_pool_size = 1G
|
||||
max_connections = 200
|
||||
slow_query_log = 1
|
||||
long_query_time = 2
|
||||
```
|
||||
|
||||
## Backup & Restore
|
||||
|
||||
```bash
|
||||
# Backup
|
||||
mysqldump -u root -p mydb > backup.sql
|
||||
mysqldump -u root -p --all-databases > full_backup.sql
|
||||
|
||||
# Restore
|
||||
mysql -u root -p mydb < backup.sql
|
||||
```
|
||||
|
||||
## Replication
|
||||
|
||||
```bash
|
||||
# Primary
|
||||
[mysqld]
|
||||
server-id = 1
|
||||
log_bin = mysql-bin
|
||||
|
||||
# Replica
|
||||
CHANGE MASTER TO
|
||||
MASTER_HOST='primary',
|
||||
MASTER_USER='replicator',
|
||||
MASTER_PASSWORD='secret',
|
||||
MASTER_LOG_FILE='mysql-bin.000001',
|
||||
MASTER_LOG_POS=0;
|
||||
START SLAVE;
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Enable slow query logging
|
||||
- Use InnoDB storage engine
|
||||
- Regular backups with mysqldump
|
||||
- Monitor with SHOW PROCESSLIST
|
||||
@@ -0,0 +1,68 @@
|
||||
---
|
||||
name: postgresql
|
||||
description: Administer PostgreSQL databases. Configure replication, backups, and performance tuning. Use when managing PostgreSQL deployments.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# PostgreSQL
|
||||
|
||||
Administer and optimize PostgreSQL databases.
|
||||
|
||||
## Installation & Setup
|
||||
|
||||
```bash
|
||||
# Install
|
||||
apt install postgresql postgresql-contrib
|
||||
|
||||
# Access
|
||||
sudo -u postgres psql
|
||||
|
||||
# Create database and user
|
||||
CREATE USER myapp WITH PASSWORD 'secret';
|
||||
CREATE DATABASE mydb OWNER myapp;
|
||||
GRANT ALL PRIVILEGES ON DATABASE mydb TO myapp;
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
```bash
|
||||
# /etc/postgresql/15/main/postgresql.conf
|
||||
max_connections = 200
|
||||
shared_buffers = 256MB
|
||||
effective_cache_size = 768MB
|
||||
work_mem = 4MB
|
||||
maintenance_work_mem = 64MB
|
||||
```
|
||||
|
||||
## Backup & Restore
|
||||
|
||||
```bash
|
||||
# Backup
|
||||
pg_dump mydb > backup.sql
|
||||
pg_dump -Fc mydb > backup.dump # Custom format
|
||||
|
||||
# Restore
|
||||
psql mydb < backup.sql
|
||||
pg_restore -d mydb backup.dump
|
||||
```
|
||||
|
||||
## Replication
|
||||
|
||||
```bash
|
||||
# Primary
|
||||
ALTER SYSTEM SET wal_level = replica;
|
||||
CREATE USER replicator REPLICATION LOGIN PASSWORD 'secret';
|
||||
|
||||
# Replica
|
||||
pg_basebackup -h primary -U replicator -D /var/lib/postgresql/15/main -P
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Regular VACUUM and ANALYZE
|
||||
- Monitor slow queries
|
||||
- Implement connection pooling (PgBouncer)
|
||||
- Regular backups with pg_dump or pg_basebackup
|
||||
@@ -0,0 +1,74 @@
|
||||
---
|
||||
name: redis
|
||||
description: Configure Redis for caching and data storage. Set up clustering, persistence, and Sentinel. Use when implementing Redis caching or queues.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Redis
|
||||
|
||||
Configure Redis for caching and data storage.
|
||||
|
||||
## Installation & Setup
|
||||
|
||||
```bash
|
||||
# Install
|
||||
apt install redis-server
|
||||
|
||||
# Configuration
|
||||
# /etc/redis/redis.conf
|
||||
bind 0.0.0.0
|
||||
protected-mode yes
|
||||
requirepass yourpassword
|
||||
maxmemory 256mb
|
||||
maxmemory-policy allkeys-lru
|
||||
```
|
||||
|
||||
## Basic Operations
|
||||
|
||||
```bash
|
||||
redis-cli -a yourpassword
|
||||
|
||||
# String operations
|
||||
SET key "value"
|
||||
GET key
|
||||
SETEX key 3600 "value" # With TTL
|
||||
|
||||
# Hash
|
||||
HSET user:1 name "John" email "john@example.com"
|
||||
HGETALL user:1
|
||||
|
||||
# List
|
||||
LPUSH queue "task1"
|
||||
RPOP queue
|
||||
```
|
||||
|
||||
## Persistence
|
||||
|
||||
```bash
|
||||
# RDB (snapshot)
|
||||
save 900 1
|
||||
save 300 10
|
||||
|
||||
# AOF (append-only file)
|
||||
appendonly yes
|
||||
appendfsync everysec
|
||||
```
|
||||
|
||||
## Sentinel (HA)
|
||||
|
||||
```bash
|
||||
# sentinel.conf
|
||||
sentinel monitor mymaster 10.0.0.1 6379 2
|
||||
sentinel down-after-milliseconds mymaster 30000
|
||||
sentinel failover-timeout mymaster 180000
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Set maxmemory and eviction policy
|
||||
- Use persistence for critical data
|
||||
- Implement Sentinel for HA
|
||||
- Monitor memory usage
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
name: cdn-setup
|
||||
description: Configure CDNs for content delivery. Set up CloudFront, Cloudflare, and Fastly. Use when optimizing global content delivery.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# CDN Setup
|
||||
|
||||
Configure content delivery networks.
|
||||
|
||||
## AWS CloudFront
|
||||
|
||||
```bash
|
||||
aws cloudfront create-distribution --distribution-config '{
|
||||
"CallerReference": "my-distribution",
|
||||
"Origins": {
|
||||
"Quantity": 1,
|
||||
"Items": [{
|
||||
"Id": "myS3Origin",
|
||||
"DomainName": "mybucket.s3.amazonaws.com",
|
||||
"S3OriginConfig": {"OriginAccessIdentity": ""}
|
||||
}]
|
||||
},
|
||||
"DefaultCacheBehavior": {
|
||||
"TargetOriginId": "myS3Origin",
|
||||
"ViewerProtocolPolicy": "redirect-to-https",
|
||||
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6"
|
||||
},
|
||||
"Enabled": true
|
||||
}'
|
||||
```
|
||||
|
||||
## Cloudflare
|
||||
|
||||
```bash
|
||||
# Via API
|
||||
curl -X POST "https://api.cloudflare.com/client/v4/zones" \
|
||||
-H "Authorization: Bearer $TOKEN" \
|
||||
-d '{"name":"example.com","jump_start":true}'
|
||||
```
|
||||
|
||||
## Cache Headers
|
||||
|
||||
```nginx
|
||||
location ~* \.(jpg|jpeg|png|gif|ico|css|js)$ {
|
||||
expires 30d;
|
||||
add_header Cache-Control "public, immutable";
|
||||
}
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Set appropriate cache headers
|
||||
- Use cache invalidation sparingly
|
||||
- Implement cache warming
|
||||
- Monitor cache hit ratios
|
||||
@@ -0,0 +1,67 @@
|
||||
---
|
||||
name: dns-management
|
||||
description: Configure DNS zones and records. Manage Route53, Cloud DNS, and self-hosted DNS. Use when setting up DNS infrastructure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# DNS Management
|
||||
|
||||
Configure and manage DNS infrastructure.
|
||||
|
||||
## AWS Route 53
|
||||
|
||||
```bash
|
||||
# Create hosted zone
|
||||
aws route53 create-hosted-zone --name example.com --caller-reference $(date +%s)
|
||||
|
||||
# Create record
|
||||
aws route53 change-resource-record-sets --hosted-zone-id ZXXXXX --change-batch '{
|
||||
"Changes": [{
|
||||
"Action": "CREATE",
|
||||
"ResourceRecordSet": {
|
||||
"Name": "www.example.com",
|
||||
"Type": "A",
|
||||
"TTL": 300,
|
||||
"ResourceRecords": [{"Value": "1.2.3.4"}]
|
||||
}
|
||||
}]
|
||||
}'
|
||||
```
|
||||
|
||||
## BIND Configuration
|
||||
|
||||
```bash
|
||||
# /etc/bind/zones/example.com.db
|
||||
$TTL 86400
|
||||
@ IN SOA ns1.example.com. admin.example.com. (
|
||||
2024010101 ; Serial
|
||||
3600 ; Refresh
|
||||
1800 ; Retry
|
||||
604800 ; Expire
|
||||
86400 ) ; Minimum TTL
|
||||
|
||||
IN NS ns1.example.com.
|
||||
IN A 1.2.3.4
|
||||
www IN A 1.2.3.4
|
||||
```
|
||||
|
||||
## Common Records
|
||||
|
||||
```
|
||||
A - IPv4 address
|
||||
AAAA - IPv6 address
|
||||
CNAME - Alias to another domain
|
||||
MX - Mail server
|
||||
TXT - Text record (SPF, DKIM)
|
||||
NS - Name server
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Low TTL during migrations
|
||||
- Implement DNSSEC
|
||||
- Use multiple name servers
|
||||
- Monitor DNS resolution
|
||||
@@ -0,0 +1,64 @@
|
||||
---
|
||||
name: load-balancing
|
||||
description: Configure load balancers and traffic distribution. Implement health checks and SSL termination. Use when distributing traffic across servers.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Load Balancing
|
||||
|
||||
Distribute traffic across application servers.
|
||||
|
||||
## nginx Load Balancer
|
||||
|
||||
```nginx
|
||||
upstream backend {
|
||||
least_conn;
|
||||
server backend1:8080 weight=3;
|
||||
server backend2:8080;
|
||||
server backend3:8080 backup;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
|
||||
location / {
|
||||
proxy_pass http://backend;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## HAProxy
|
||||
|
||||
```
|
||||
frontend http_front
|
||||
bind *:80
|
||||
default_backend http_back
|
||||
|
||||
backend http_back
|
||||
balance roundrobin
|
||||
option httpchk GET /health
|
||||
server web1 10.0.0.1:8080 check
|
||||
server web2 10.0.0.2:8080 check
|
||||
```
|
||||
|
||||
## AWS ALB
|
||||
|
||||
```bash
|
||||
aws elbv2 create-load-balancer \
|
||||
--name my-alb \
|
||||
--subnets subnet-xxx subnet-yyy \
|
||||
--security-groups sg-xxx \
|
||||
--type application
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Implement health checks
|
||||
- Use sticky sessions when needed
|
||||
- Enable connection draining
|
||||
- Monitor backend health
|
||||
@@ -0,0 +1,68 @@
|
||||
---
|
||||
name: reverse-proxy
|
||||
description: Configure nginx and Traefik as reverse proxies. Implement SSL termination and routing. Use when setting up application gateways.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Reverse Proxy
|
||||
|
||||
Configure reverse proxies for application routing.
|
||||
|
||||
## nginx
|
||||
|
||||
```nginx
|
||||
server {
|
||||
listen 80;
|
||||
server_name api.example.com;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
server_name api.example.com;
|
||||
|
||||
ssl_certificate /etc/ssl/certs/api.crt;
|
||||
ssl_certificate_key /etc/ssl/private/api.key;
|
||||
|
||||
location / {
|
||||
proxy_pass http://backend:8080;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
location /ws {
|
||||
proxy_pass http://backend:8080;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
## Traefik
|
||||
|
||||
```yaml
|
||||
# traefik.yml
|
||||
entryPoints:
|
||||
web:
|
||||
address: ":80"
|
||||
websecure:
|
||||
address: ":443"
|
||||
|
||||
providers:
|
||||
docker:
|
||||
exposedByDefault: false
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Implement SSL termination
|
||||
- Set proper headers
|
||||
- Configure timeouts
|
||||
- Enable gzip compression
|
||||
@@ -0,0 +1,70 @@
|
||||
---
|
||||
name: service-mesh
|
||||
description: Implement Istio and Linkerd service meshes. Configure mTLS, traffic management, and observability. Use when managing microservices communication.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Service Mesh
|
||||
|
||||
Implement service-to-service communication management.
|
||||
|
||||
## Istio Installation
|
||||
|
||||
```bash
|
||||
istioctl install --set profile=demo
|
||||
|
||||
# Enable sidecar injection
|
||||
kubectl label namespace default istio-injection=enabled
|
||||
```
|
||||
|
||||
## Traffic Management
|
||||
|
||||
```yaml
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: VirtualService
|
||||
metadata:
|
||||
name: myapp
|
||||
spec:
|
||||
hosts:
|
||||
- myapp
|
||||
http:
|
||||
- match:
|
||||
- headers:
|
||||
canary:
|
||||
exact: "true"
|
||||
route:
|
||||
- destination:
|
||||
host: myapp
|
||||
subset: canary
|
||||
- route:
|
||||
- destination:
|
||||
host: myapp
|
||||
subset: stable
|
||||
weight: 90
|
||||
- destination:
|
||||
host: myapp
|
||||
subset: canary
|
||||
weight: 10
|
||||
```
|
||||
|
||||
## mTLS
|
||||
|
||||
```yaml
|
||||
apiVersion: security.istio.io/v1beta1
|
||||
kind: PeerAuthentication
|
||||
metadata:
|
||||
name: default
|
||||
spec:
|
||||
mtls:
|
||||
mode: STRICT
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Enable strict mTLS
|
||||
- Implement circuit breakers
|
||||
- Use traffic shifting for deployments
|
||||
- Monitor with Kiali and Jaeger
|
||||
@@ -0,0 +1,65 @@
|
||||
---
|
||||
name: linux-administration
|
||||
description: System administration for Linux servers. Manage packages, services, and system configuration. Use when administering Linux systems.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Linux Administration
|
||||
|
||||
Core Linux system administration skills.
|
||||
|
||||
## Package Management
|
||||
|
||||
```bash
|
||||
# Debian/Ubuntu
|
||||
apt update && apt upgrade -y
|
||||
apt install nginx
|
||||
apt remove nginx
|
||||
apt autoremove
|
||||
|
||||
# RHEL/CentOS
|
||||
dnf update
|
||||
dnf install nginx
|
||||
dnf remove nginx
|
||||
```
|
||||
|
||||
## System Information
|
||||
|
||||
```bash
|
||||
uname -a # Kernel info
|
||||
hostnamectl # System info
|
||||
lscpu # CPU info
|
||||
free -h # Memory usage
|
||||
df -h # Disk usage
|
||||
ip addr # Network interfaces
|
||||
```
|
||||
|
||||
## Log Management
|
||||
|
||||
```bash
|
||||
journalctl -u nginx # Service logs
|
||||
journalctl -f # Follow logs
|
||||
tail -f /var/log/syslog # System logs
|
||||
dmesg # Kernel messages
|
||||
```
|
||||
|
||||
## Process Management
|
||||
|
||||
```bash
|
||||
ps aux | grep nginx
|
||||
top / htop
|
||||
kill -9 <pid>
|
||||
pgrep nginx
|
||||
pkill nginx
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Regular updates
|
||||
- Minimal installed packages
|
||||
- Proper file permissions
|
||||
- Log rotation configuration
|
||||
- Automated backups
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
name: performance-tuning
|
||||
description: Optimize Linux system performance. Configure kernel parameters, analyze bottlenecks, and tune resources. Use when improving system performance.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Performance Tuning
|
||||
|
||||
Optimize Linux system performance.
|
||||
|
||||
## System Monitoring
|
||||
|
||||
```bash
|
||||
top / htop # Process monitoring
|
||||
vmstat 1 # Memory statistics
|
||||
iostat -x 1 # Disk I/O
|
||||
sar -n DEV 1 # Network statistics
|
||||
perf top # CPU profiling
|
||||
```
|
||||
|
||||
## Kernel Parameters
|
||||
|
||||
```bash
|
||||
# /etc/sysctl.d/99-performance.conf
|
||||
vm.swappiness = 10
|
||||
net.core.somaxconn = 65535
|
||||
net.ipv4.tcp_max_syn_backlog = 65535
|
||||
fs.file-max = 2097152
|
||||
vm.dirty_ratio = 40
|
||||
vm.dirty_background_ratio = 10
|
||||
```
|
||||
|
||||
## File Descriptor Limits
|
||||
|
||||
```bash
|
||||
# /etc/security/limits.conf
|
||||
* soft nofile 65535
|
||||
* hard nofile 65535
|
||||
* soft nproc 65535
|
||||
* hard nproc 65535
|
||||
```
|
||||
|
||||
## Disk I/O
|
||||
|
||||
```bash
|
||||
# Change scheduler
|
||||
echo noop > /sys/block/sda/queue/scheduler
|
||||
|
||||
# Enable trim for SSDs
|
||||
fstrim -av
|
||||
```
|
||||
|
||||
## Network Tuning
|
||||
|
||||
```bash
|
||||
# Increase buffers
|
||||
sysctl -w net.core.rmem_max=134217728
|
||||
sysctl -w net.core.wmem_max=134217728
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Profile before optimizing
|
||||
- Change one parameter at a time
|
||||
- Monitor impact of changes
|
||||
- Document all tuning
|
||||
@@ -0,0 +1,76 @@
|
||||
---
|
||||
name: ssh-configuration
|
||||
description: Configure SSH servers and clients securely. Manage keys, tunnels, and config files. Use when setting up secure remote access.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# SSH Configuration
|
||||
|
||||
Secure SSH server and client configuration.
|
||||
|
||||
## Key Management
|
||||
|
||||
```bash
|
||||
# Generate key
|
||||
ssh-keygen -t ed25519 -C "user@example.com"
|
||||
|
||||
# Copy to server
|
||||
ssh-copy-id user@server
|
||||
|
||||
# Add to agent
|
||||
eval "$(ssh-agent -s)"
|
||||
ssh-add ~/.ssh/id_ed25519
|
||||
```
|
||||
|
||||
## SSH Config (~/.ssh/config)
|
||||
|
||||
```
|
||||
Host production
|
||||
HostName prod.example.com
|
||||
User deploy
|
||||
IdentityFile ~/.ssh/prod_key
|
||||
Port 22
|
||||
|
||||
Host bastion
|
||||
HostName bastion.example.com
|
||||
User admin
|
||||
|
||||
Host internal
|
||||
HostName 10.0.0.5
|
||||
User admin
|
||||
ProxyJump bastion
|
||||
```
|
||||
|
||||
## Secure Server Config
|
||||
|
||||
```bash
|
||||
# /etc/ssh/sshd_config
|
||||
PermitRootLogin no
|
||||
PasswordAuthentication no
|
||||
PubkeyAuthentication yes
|
||||
MaxAuthTries 3
|
||||
AllowUsers deploy admin
|
||||
```
|
||||
|
||||
## Tunneling
|
||||
|
||||
```bash
|
||||
# Local port forward
|
||||
ssh -L 8080:internal:80 bastion
|
||||
|
||||
# Remote port forward
|
||||
ssh -R 8080:localhost:80 server
|
||||
|
||||
# SOCKS proxy
|
||||
ssh -D 1080 server
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use ed25519 keys
|
||||
- Disable password auth
|
||||
- Use SSH agent forwarding carefully
|
||||
- Implement jump hosts/bastions
|
||||
@@ -0,0 +1,76 @@
|
||||
---
|
||||
name: systemd-services
|
||||
description: Create and manage systemd services and timers. Configure service dependencies and resource limits. Use when managing system services.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Systemd Services
|
||||
|
||||
Manage system services with systemd.
|
||||
|
||||
## Service Unit File
|
||||
|
||||
```ini
|
||||
# /etc/systemd/system/myapp.service
|
||||
[Unit]
|
||||
Description=My Application
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
User=myapp
|
||||
WorkingDirectory=/opt/myapp
|
||||
ExecStart=/opt/myapp/bin/start
|
||||
ExecStop=/opt/myapp/bin/stop
|
||||
Restart=always
|
||||
RestartSec=5
|
||||
Environment=NODE_ENV=production
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
```
|
||||
|
||||
## Service Management
|
||||
|
||||
```bash
|
||||
systemctl daemon-reload
|
||||
systemctl start myapp
|
||||
systemctl stop myapp
|
||||
systemctl restart myapp
|
||||
systemctl enable myapp
|
||||
systemctl status myapp
|
||||
journalctl -u myapp -f
|
||||
```
|
||||
|
||||
## Timer (Cron Replacement)
|
||||
|
||||
```ini
|
||||
# /etc/systemd/system/backup.timer
|
||||
[Unit]
|
||||
Description=Daily backup
|
||||
|
||||
[Timer]
|
||||
OnCalendar=daily
|
||||
Persistent=true
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
```
|
||||
|
||||
## Resource Limits
|
||||
|
||||
```ini
|
||||
[Service]
|
||||
MemoryLimit=512M
|
||||
CPUQuota=50%
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use Type=notify for better tracking
|
||||
- Implement proper restart policies
|
||||
- Use timers instead of cron
|
||||
- Set resource limits
|
||||
@@ -0,0 +1,69 @@
|
||||
---
|
||||
name: user-management
|
||||
description: Manage users, groups, and permissions on Linux systems. Configure sudo and access controls. Use when managing system access.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# User Management
|
||||
|
||||
Manage users, groups, and permissions.
|
||||
|
||||
## User Operations
|
||||
|
||||
```bash
|
||||
# Create user
|
||||
useradd -m -s /bin/bash username
|
||||
passwd username
|
||||
|
||||
# Delete user
|
||||
userdel -r username
|
||||
|
||||
# Modify user
|
||||
usermod -aG sudo username
|
||||
usermod -s /bin/zsh username
|
||||
```
|
||||
|
||||
## Group Management
|
||||
|
||||
```bash
|
||||
# Create group
|
||||
groupadd developers
|
||||
|
||||
# Add user to group
|
||||
usermod -aG developers username
|
||||
gpasswd -a username developers
|
||||
|
||||
# Remove from group
|
||||
gpasswd -d username developers
|
||||
```
|
||||
|
||||
## Sudo Configuration
|
||||
|
||||
```bash
|
||||
# /etc/sudoers.d/developers
|
||||
%developers ALL=(ALL) NOPASSWD: /usr/bin/docker
|
||||
username ALL=(ALL) NOPASSWD: ALL
|
||||
```
|
||||
|
||||
## File Permissions
|
||||
|
||||
```bash
|
||||
chmod 755 file # rwxr-xr-x
|
||||
chmod u+x file # Add execute for user
|
||||
chown user:group file # Change ownership
|
||||
chown -R user:group dir/
|
||||
|
||||
# ACLs
|
||||
setfacl -m u:user:rx file
|
||||
getfacl file
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use groups for access control
|
||||
- Minimal sudo privileges
|
||||
- Regular access reviews
|
||||
- Strong password policies
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
name: windows-server
|
||||
description: Administer Windows Server systems. Manage IIS, Active Directory, and PowerShell automation. Use when administering Windows infrastructure.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Windows Server Administration
|
||||
|
||||
Windows Server management and PowerShell automation.
|
||||
|
||||
## Server Roles
|
||||
|
||||
```powershell
|
||||
# Install IIS
|
||||
Install-WindowsFeature -Name Web-Server -IncludeManagementTools
|
||||
|
||||
# Install AD DS
|
||||
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
|
||||
|
||||
# List installed features
|
||||
Get-WindowsFeature | Where-Object Installed
|
||||
```
|
||||
|
||||
## System Information
|
||||
|
||||
```powershell
|
||||
Get-ComputerInfo
|
||||
Get-Process
|
||||
Get-Service
|
||||
Get-EventLog -LogName System -Newest 50
|
||||
```
|
||||
|
||||
## IIS Management
|
||||
|
||||
```powershell
|
||||
# Create website
|
||||
New-Website -Name "MyApp" -Port 80 -PhysicalPath "C:\inetpub\myapp"
|
||||
|
||||
# Create app pool
|
||||
New-WebAppPool -Name "MyAppPool"
|
||||
|
||||
# Start/Stop
|
||||
Start-Website -Name "MyApp"
|
||||
Stop-Website -Name "MyApp"
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use Server Core when possible
|
||||
- Implement Windows Admin Center
|
||||
- Regular Windows Update
|
||||
- PowerShell remoting over WinRM
|
||||
- Active Directory best practices
|
||||
@@ -0,0 +1,63 @@
|
||||
---
|
||||
name: backup-recovery
|
||||
description: Implement backup and recovery strategies. Configure rsync, Restic, and cloud backups. Use when designing data protection solutions.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Backup and Recovery
|
||||
|
||||
Implement comprehensive backup strategies.
|
||||
|
||||
## rsync Backups
|
||||
|
||||
```bash
|
||||
# Basic sync
|
||||
rsync -avz --delete /source/ /backup/
|
||||
|
||||
# Remote backup
|
||||
rsync -avz -e ssh /data/ user@backup:/backups/
|
||||
|
||||
# Incremental with hard links
|
||||
rsync -avz --delete --link-dest=/backup/latest /source/ /backup/$(date +%Y%m%d)/
|
||||
```
|
||||
|
||||
## Restic Backup
|
||||
|
||||
```bash
|
||||
# Initialize repository
|
||||
restic init --repo /backups
|
||||
|
||||
# Backup
|
||||
restic backup /data --repo /backups
|
||||
|
||||
# List snapshots
|
||||
restic snapshots --repo /backups
|
||||
|
||||
# Restore
|
||||
restic restore latest --target /restore --repo /backups
|
||||
|
||||
# Prune old backups
|
||||
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune
|
||||
```
|
||||
|
||||
## Cloud Backup
|
||||
|
||||
```bash
|
||||
# AWS S3 with restic
|
||||
restic init --repo s3:s3.amazonaws.com/bucket-name
|
||||
restic backup /data --repo s3:s3.amazonaws.com/bucket-name
|
||||
|
||||
# GCS
|
||||
restic init --repo gs:bucket-name:/
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Follow 3-2-1 rule
|
||||
- Test recovery regularly
|
||||
- Encrypt backups
|
||||
- Document procedures
|
||||
- Monitor backup success
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
name: block-storage
|
||||
description: Manage block storage volumes and LVM. Configure cloud block storage and local disks. Use when managing disk storage.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Block Storage
|
||||
|
||||
Manage block storage volumes and LVM.
|
||||
|
||||
## LVM Management
|
||||
|
||||
```bash
|
||||
# Create physical volume
|
||||
pvcreate /dev/sdb
|
||||
|
||||
# Create volume group
|
||||
vgcreate data_vg /dev/sdb
|
||||
|
||||
# Create logical volume
|
||||
lvcreate -L 50G -n app_lv data_vg
|
||||
|
||||
# Format and mount
|
||||
mkfs.ext4 /dev/data_vg/app_lv
|
||||
mount /dev/data_vg/app_lv /data
|
||||
|
||||
# Extend volume
|
||||
lvextend -L +10G /dev/data_vg/app_lv
|
||||
resize2fs /dev/data_vg/app_lv
|
||||
```
|
||||
|
||||
## AWS EBS
|
||||
|
||||
```bash
|
||||
# Create volume
|
||||
aws ec2 create-volume \
|
||||
--availability-zone us-east-1a \
|
||||
--size 100 \
|
||||
--volume-type gp3
|
||||
|
||||
# Attach to instance
|
||||
aws ec2 attach-volume \
|
||||
--volume-id vol-xxx \
|
||||
--instance-id i-xxx \
|
||||
--device /dev/xvdf
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use LVM for flexibility
|
||||
- Implement RAID for redundancy
|
||||
- Monitor disk I/O
|
||||
- Regular disk health checks
|
||||
@@ -0,0 +1,67 @@
|
||||
---
|
||||
name: nfs-storage
|
||||
description: Configure NFS servers and clients. Implement network file sharing for Linux systems. Use when setting up shared storage.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# NFS Storage
|
||||
|
||||
Configure NFS for network file sharing.
|
||||
|
||||
## Server Configuration
|
||||
|
||||
```bash
|
||||
# Install
|
||||
apt install nfs-kernel-server
|
||||
|
||||
# Configure exports
|
||||
# /etc/exports
|
||||
/data 10.0.0.0/24(rw,sync,no_subtree_check,no_root_squash)
|
||||
/shared *(ro,sync,no_subtree_check)
|
||||
|
||||
# Apply changes
|
||||
exportfs -ra
|
||||
|
||||
# Start service
|
||||
systemctl enable --now nfs-kernel-server
|
||||
```
|
||||
|
||||
## Client Configuration
|
||||
|
||||
```bash
|
||||
# Install
|
||||
apt install nfs-common
|
||||
|
||||
# Mount
|
||||
mount -t nfs server:/data /mnt/data
|
||||
|
||||
# /etc/fstab
|
||||
server:/data /mnt/data nfs defaults,_netdev 0 0
|
||||
```
|
||||
|
||||
## Kubernetes NFS
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: nfs-pv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 100Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
nfs:
|
||||
server: nfs-server.example.com
|
||||
path: /data
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use proper export options
|
||||
- Implement firewall rules
|
||||
- Monitor NFS performance
|
||||
- Use NFSv4 for security
|
||||
@@ -0,0 +1,52 @@
|
||||
---
|
||||
name: object-storage
|
||||
description: Configure object storage with S3, GCS, and MinIO. Implement lifecycle policies and access controls. Use when managing object storage.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# Object Storage
|
||||
|
||||
Configure and manage object storage solutions.
|
||||
|
||||
## AWS S3
|
||||
|
||||
```bash
|
||||
# Create bucket
|
||||
aws s3 mb s3://my-bucket
|
||||
|
||||
# Upload/Download
|
||||
aws s3 cp file.txt s3://my-bucket/
|
||||
aws s3 sync ./local s3://my-bucket/remote
|
||||
|
||||
# Configure lifecycle
|
||||
aws s3api put-bucket-lifecycle-configuration \
|
||||
--bucket my-bucket \
|
||||
--lifecycle-configuration file://lifecycle.json
|
||||
```
|
||||
|
||||
## MinIO (Self-Hosted)
|
||||
|
||||
```bash
|
||||
# Deploy
|
||||
docker run -d \
|
||||
-p 9000:9000 -p 9001:9001 \
|
||||
-e MINIO_ROOT_USER=admin \
|
||||
-e MINIO_ROOT_PASSWORD=password \
|
||||
-v /data:/data \
|
||||
minio/minio server /data --console-address ":9001"
|
||||
|
||||
# Configure mc client
|
||||
mc alias set myminio http://localhost:9000 admin password
|
||||
mc mb myminio/mybucket
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Enable versioning
|
||||
- Implement lifecycle policies
|
||||
- Use server-side encryption
|
||||
- Configure access logging
|
||||
- Implement bucket policies
|
||||
Reference in New Issue
Block a user