Skip to content

Commit ffec476

Browse files
AlibabaCloudLandingZoneAlibabaCloudLandingZone
authored
operations automation
1 parent 01e8c18 commit ffec476

File tree

10 files changed

+579
-0
lines changed

10 files changed

+579
-0
lines changed

‎solution/solution-ecs-system-configuration-maintenance/README.md

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# 通过OOS实现主机系统与软件配置自动化运维
2+
3+
基于 OOS 和云助手，满足多账号体系下，通过脚本命令对主机系统与软件配置进行运维的需求。本代码仓库通过 Terraform 和资源编排（ROS）实现该方案的自动化。
4+
5+
## 使用步骤
6+
7+
本方案的自动化共分为三个步骤：
8+
9+
### Step1. 准备工作
10+
11+
进入 `step1-preparation`，在共享服务账号中创建所需角色和权限，并委派 ROS 管理员给共享服务账号。该步骤使用资源目录管理账号的身份运行。您可以新建 `tfvars.json` 文件并配置参数，并通过 `terraform apply -var-file=tfvars.json` 命令进行部署。
12+
13+
如果已经完成了委派管理员的配置，可以使用如下的 `terraform import` 导入进来，避免执行时报错。
14+
15+
```
16+
terraform import -var-file=tfvars.json alicloud_resource_manager_delegated_administrator.master ${账号 ID}:ros.aliyuncs.com
17+
```
18+
19+
| **参数名称** | **参数值示例** | **描述** |
20+
| --- | --- | --- |
21+
| region | cn-shanghai | 部署地域 |
22+
| share_services_account_id | 11531044***** | 共享服务账号 ID |
23+
| oss_assume_role | EcsCommandRunningAutomationTriggerRole | 共享服务账号中的角色。该步骤中，会为您在共享服务账号中创建该角色，OOS 会扮演该角色来触发自动化运维模版的执行 |
24+
| oos_cross_account_assume_role | EcsCommandRunningAutomationRole | 需要统一运维的其他业务账号中的角色。该步骤中不会创建该角色，您可以通过 Step2 统一跨账号创建角色，OOS 会扮演该角色跨账号执行脚本命令，完成配置运维 |
25+
26+
### Step2. 跨账号创建角色
27+
28+
进入 `step2-create-cross-account-role`，使用 `stack-group-template.yaml` 中的 ROS 模版在共享服务账号中创建资源编排（ROS）的资源栈组，跨账号给所有需要统一运维的业务账号创建所需角色。
29+
30+
| **参数名称** | **参数值示例** | **描述** |
31+
| --- | --- | --- |
32+
| RoleName | EcsCommandRunningAutomationRole | 角色名称 |
33+
| PolicyName | EcsCommandRunningAutomationRolePolicy | 策略名称 |
34+
| AssumeRolePrincipalAccount | | 该角色可信的账号。置空，则默认为当前账号。 |
35+
| AssumeRolePrincipalRole | EcsCommandRunningAutomationTriggerRole | 允许扮演该角色的可信账号下的角色。这里需要填写 Step1 中在共享服务账号中创建出来的角色名称 |
36+
37+
### Step3. 部署自动化运维流程
38+
39+
进入 `step3-automation-deployment`，在共享服务账号中创建 OOS 自定义任务模版。该步骤请使用共享服务账号的身份运行。您可以新建 `tfvars.json` 文件并配置参数，并通过 `terraform apply -var-file=tfvars.json` 命令进行部署。
40+
41+
| **参数名称** | **参数值示例** | **描述** |
42+
| --- | --- | --- |
43+
| region | cn-shanghai | 部署地域 |
44+
| oss_assume_role | EcsCommandRunningAutomationTriggerRole | Step1 中创建的共享服务账号中的角色。OOS 会扮演该角色来触发自动化运维模版的执行 |
45+
| oos_cross_account_assume_role | EcsCommandRunningAutomationRole | Step2 中在需要统一运维的其他业务账号中创建的角色。OOS 会扮演该角色跨账号执行脚本命令，完成配置运维 |
46+
| approverRamUserName | approver | 允许审批运维流程的 RAM 用户。该 RAM 用户至少需要具有下方所示的读写权限，您也可以直接授予其 AliyunOOSFullAccess 权限。该 RAM 用户可以批准/拒绝运维流程。 |
47+
| approverWebHookUrl | 有效的 WebHook 链接 | 在需要人工审批时，会通过该 WebHook 发送消息通知。|
48+
| commandRunningWebHookUrl | 有效的 WebHook 链接 | 在运维流程运行时，会通过该 WebHook 发送消息通知，您可以使用该 WebHook 给业务团队发送通知。 |
49+
50+
允许审批运维流程的 RAM 用户至少需要具有如下所示读写权限：
51+
52+
```
53+
{
54+
"Version": "1",
55+
"Statement": [
56+
{
57+
"Effect": "Allow",
58+
"Action": [
59+
"oos:GetExecutionTemplate",
60+
"oos:ListTaskExecutions",
61+
"oos:ListExecutions",
62+
"oos:NotifyExecution"
63+
],
64+
"Resource": "*"
65+
}
66+
]
67+
}
68+
```

‎solution/solution-ecs-system-configuration-maintenance/step1-preparation/main.tf

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
provider "alicloud" {
2+
region = var.region
3+
}
4+
5+
provider "alicloud" {
6+
alias = "share_services"
7+
region = var.region
8+
assume_role {
9+
role_arn = format("acs:ram::%s:role/ResourceDirectoryAccountAccessRole", var.share_services_account_id)
10+
session_name = "WellArchitectedSolutionSetup"
11+
session_expiration = 999
12+
}
13+
}
14+
15+
# create delegated administrator
16+
resource "alicloud_resource_manager_delegated_administrator" "master" {
17+
account_id = var.share_services_account_id
18+
service_principal = "ros.aliyuncs.com"
19+
}
20+
21+
resource "alicloud_ram_policy" "share_services" {
22+
provider = alicloud.share_services
23+
policy_name = format("%sPolicy", var.oss_assume_role)
24+
policy_document = <<EOF
25+
{
26+
"Version": "1",
27+
"Statement": [
28+
{
29+
"Action": [
30+
"sts:AssumeRole"
31+
],
32+
"Resource": "acs:ram:*:*:role/${var.oos_cross_account_assume_role}",
33+
"Effect": "Allow"
34+
}
35+
]
36+
}
37+
EOF
38+
}
39+
40+
resource "alicloud_ram_role" "share_services" {
41+
provider = alicloud.share_services
42+
name = var.oss_assume_role
43+
document = <<EOF
44+
{
45+
"Statement": [
46+
{
47+
"Action": "sts:AssumeRole",
48+
"Effect": "Allow",
49+
"Principal": {
50+
"Service": [
51+
"oos.aliyuncs.com"
52+
]
53+
}
54+
}
55+
],
56+
"Version": "1"
57+
}
58+
EOF
59+
}
60+
61+
resource "alicloud_ram_role_policy_attachment" "share_services" {
62+
provider = alicloud.share_services
63+
policy_name = alicloud_ram_policy.share_services.policy_name
64+
policy_type = alicloud_ram_policy.share_services.type
65+
role_name = alicloud_ram_role.share_services.name
66+
}

‎solution/solution-ecs-system-configuration-maintenance/step1-preparation/tfvars.json.example

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"region": "cn-hangzhou",
3+
"share_services_account_id": ""
4+
}

‎solution/solution-ecs-system-configuration-maintenance/step1-preparation/variables.tf

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
variable "region" {
2+
type = string
3+
default = ""
4+
description = "The ID of the deployment region"
5+
}
6+
7+
variable "share_services_account_id" {
8+
type = string
9+
description = "The ID of share services account"
10+
}
11+
12+
variable "oss_assume_role" {
13+
type = string
14+
default = "EcsCommandRunningAutomationTriggerRole"
15+
description = "The name of ram role in share service account. OOS will trigger ecs command running automation by assuming this role."
16+
}
17+
18+
variable "oos_cross_account_assume_role" {
19+
type = string
20+
default = "EcsCommandRunningAutomationRole"
21+
description = "The name of role in all target account. OOS will cross-account execute ecs command running by assuming this role."
22+
}

‎solution/solution-ecs-system-configuration-maintenance/step1-preparation/versions.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
required_providers {
3+
alicloud = {
4+
source = "aliyun/alicloud"
5+
version = ">= 1.203.0"
6+
}
7+
}
8+
required_version = ">= 1.3"
9+
}

‎solution/solution-ecs-system-configuration-maintenance/step2-create-cross-account-role/stack-group-template.yaml

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
ROSTemplateFormatVersion: '2015-09-01'
2+
Description: Create a ram role and policy for ecs command running automation.
3+
Parameters:
4+
RoleName:
5+
AllowedPattern: ^[a-zA-Z0-9\-]+$
6+
ConstraintDescription:
7+
zh-cn: 不得超过 64 个字符、英文字母、数字或'-'。
8+
en: No more than 64 characters,English letters, Numbers, or '-' are allowed.
9+
Description:
10+
zh-cn: 角色的名称，如果已经存在，请更改名称，<br>由英文字母、数字或'-'组成，不超过64个字符。
11+
en: The name of role, Change the name if it already exists,<br>Consist of english letters, numbers or '-',not more than 64 characters.
12+
MaxLength: 64
13+
MinLength: 1
14+
Label:
15+
zh-cn: 角色的名称
16+
en: Role Name
17+
Default: EcsCommandRunningAutomationRole
18+
Type: String
19+
PolicyName:
20+
Description:
21+
zh-cn: 策略名，改变名称如果它已经存在，<br>由英文字母，数字或'-'，5-128个字符组成。
22+
en: The policy name, Change the name if it already exists,<br>Consist of english letters, numbers or '-', 5-128 characters.
23+
AllowedPattern: ^[a-zA-Z0-9\-]+$
24+
ConstraintDescription:
25+
zh-cn: 由英文字母、数字或'-',5-128个字符组成。
26+
en: Consist of english letters, numbers or '-',5-128 characters.
27+
MinLength: 5
28+
MaxLength: 128
29+
Type: String
30+
Label:
31+
zh-cn: 策略名
32+
en: Policy Name
33+
Default: EcsCommandRunningAutomationRolePolicy
34+
AssumeRolePrincipalAccount:
35+
Description:
36+
zh-cn: 该角色可信的账号。置空，则默认为当前账号。
37+
en: The trusted account for this role. Default is current account while empty.
38+
Type: String
39+
Label:
40+
zh-cn: 角色可信的账号
41+
en: Principal Account
42+
Default: ''
43+
AssumeRolePrincipalRole:
44+
Description:
45+
zh-cn: 允许扮演该角色的可信账号下的角色。
46+
en: Role of trusted account that are allowed to assume this role.
47+
Type: String
48+
Label:
49+
zh-cn: 可信账号下允许扮演的角色
50+
en: Principal Role
51+
Default: 'EcsCommandRunningAutomationTriggerRole'
52+
Conditions:
53+
EmptyPrincipalAccount:
54+
Fn::Equals:
55+
- ''
56+
- Ref: AssumeRolePrincipalAccount
57+
Resources:
58+
RamManagedPolicy:
59+
Type: ALIYUN::RAM::ManagedPolicy
60+
Properties:
61+
PolicyName:
62+
Ref: PolicyName
63+
PolicyDocument:
64+
Version: '1'
65+
Statement:
66+
- Action:
67+
- ecs:DescribeInvocationResults
68+
- ecs:DescribeInstances
69+
- ecs:RunCommand
70+
- ecs:DescribeInvocations
71+
- ecs:DescribeManagedInstances
72+
Resource:
73+
- '*'
74+
Effect: Allow
75+
RamRole:
76+
Type: ALIYUN::RAM::Role
77+
Properties:
78+
RoleName:
79+
Ref: RoleName
80+
AssumeRolePolicyDocument:
81+
Version: '1'
82+
Statement:
83+
- Action: sts:AssumeRole
84+
Effect: Allow
85+
Principal:
86+
RAM:
87+
- Fn::Join:
88+
- ''
89+
- - 'acs:ram::'
90+
- Fn::If:
91+
- EmptyPrincipalAccount
92+
- Ref: ALIYUN::AccountId
93+
- Ref: AssumeRolePrincipalAccount
94+
- ':role/'
95+
- Ref: AssumeRolePrincipalRole
96+
RamAttachPolicyToRole:
97+
DependsOn:
98+
- RamManagedPolicy
99+
- RamRole
100+
Type: ALIYUN::RAM::AttachPolicyToRole
101+
Properties:
102+
PolicyName:
103+
Fn::GetAtt:
104+
- RamManagedPolicy
105+
- PolicyName
106+
PolicyType: Custom
107+
RoleName:
108+
Fn::GetAtt:
109+
- RamRole
110+
- RoleName
111+
Outputs:
112+
RoleName:
113+
Value:
114+
Fn::GetAtt:
115+
- RamRole
116+
- RoleName
117+
RoleArn:
118+
Value:
119+
Fn::GetAtt:
120+
- RamRole
121+
- Arn
122+
PolicyName:
123+
Value:
124+
Fn::GetAtt:
125+
- RamManagedPolicy
126+
- PolicyName

0 commit comments

Comments
 (0)