Amazon EKS で実現するプラットフォームエンジニアリング - GitOps によるセルフサービス型開発プラットフォーム

cd environments/sample
cat << EOF > terraform.tfvars
# AWS プロファイル名
aws_profile = "your-aws-profile"

# デプロイ先のリージョン
aws_region = "ap-northeast-1"

# リソース名のプレフィックス（AWS アカウント内でのリソース名の衝突を避けるため）
resource_prefix = "ex-idp"

# IAM Identity Center の設定
argo_cd_idc_region = "ap-northeast-1"
argo_cd_idc_instance_arn = "arn:aws:sso:::instance/ssoins-xxxxxxxxxx"

# Argo CD の管理者権限を付与する Identity Center グループ
# キー: グループ ID、値: グループ名
argo_cd_idc_groups = {
  "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" = "ADMIN"
}
EOF

terraform init
terraform plan
terraform apply

export AWS_REGION=ap-northeast-1
aws eks update-kubeconfig --name ex-idp-dev-cluster

# ノードの確認
kubectl get nodes

# Argo CD の URL を取得
aws eks describe-capability \
  --cluster-name ex-idp-dev-cluster \
  --capability-name argocd \
  --query 'capability.configuration.argoCd.serverUrl' \
  --output text

# CodeCommit リポジトリの URL を取得
export PLATFORM_REPO_URL=$(terraform output -raw platform_repo_url)
export WORKLOAD_REPO_URL=$(terraform output -raw workload_repo_url)

# 作業ディレクトリを作成
mkdir -p tmp

# Platform 設定をプッシュ
cp -r $PROJECT_DIR/repositories/platform tmp/platform
cd tmp/platform
git init
git add .
git commit -m "Initial platform configuration"
git remote add origin $PLATFORM_REPO_URL
git push -u origin main

# Workload マニフェストをプッシュ
cd ..
cp -r $PROJECT_DIR/repositories/workloads tmp/workloads
cd workloads
git init
git add .
git commit -m "Initial workload manifests"
git remote add origin $WORKLOAD_REPO_URL
git push -u origin main

cat << 'EOF' > distribution-monitor/base/rollouts.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: distribution-monitor
spec:
  replicas: 2
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: distribution-monitor
  template:
    metadata:
      labels:
        app.kubernetes.io/name: distribution-monitor
    spec:
      containers:
      - name: distribution-monitor
        image: distribution-monitor
        imagePullPolicy: Always
        ports:
        - name: http
          containerPort: 8080
          protocol: TCP
        env:
        - name: POD_ID
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
  strategy:
    blueGreen: 
      activeService: distribution-monitor-active
      previewService: distribution-monitor-preview
      autoPromotionEnabled: false
EOF

cat << 'EOF' > distribution-monitor/base/ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: distribution-monitor-active
spec:
  rules:
    - http:
        paths:
          - path: /*
            pathType: ImplementationSpecific
            backend:
              service:
                name: distribution-monitor-active
                port:
                  name: http

---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: distribution-monitor-preview
spec:
  rules:
    - http:
        paths:
          - path: /*
            pathType: ImplementationSpecific
            backend:
              service:
                name: distribution-monitor-preview
                port:
                  name: http
EOF

# Active 環境の URL を取得
kubectl get ingress -n ex-app distribution-monitor-active \
  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

# Rollout の状態を確認
kubectl argo rollouts get rollout distribution-monitor -n ex-app

# Preview 環境の URL を取得
kubectl get ingress -n ex-app distribution-monitor-preview \
  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'

kubectl argo rollouts undo distribution-monitor -n ex-app

module "ack_iam_role_selector_ex_app_s3" {
  source = "$PROJECT_DIR/modules/ack_iam_role_selector"

  resource_prefix          = var.resource_prefix
  environment              = "dev"
  selector_name            = "ex-app-s3"
  namespace                = "ex-app"
  ack_controller_role_arn  = module.cluster_development.ack_capability_role_arn
  namespace_selector_names = ["ex-app"]

  # S3 バケットの作成・管理権限
  iam_policy_statements = [
    {
      effect = "Allow"
      actions = [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:GetBucket*",
        "s3:PutBucket*",
        "s3:ListBucket"
      ]
      resources = [
        "arn:aws:s3:::ex-idp-dev-ex-app-*"
      ]
    },
    {
      effect = "Allow"
      actions = [
        "s3:ListAllMyBuckets"
      ]
      resources = ["*"]
    }
  ]
}

NAME SYNCED AGE
my-app-data True 30s

2026-03-05 10:30:00 ex-idp-dev-ex-app-my-app-data

# エラーを確認
kubectl describe bucket -n ex-app invalid-bucket

cd environments/sample
terraform destroy