2.5 Облачные платформы #

# azure-pipelines.yml
trigger:
- main

pool:
  vmImage: 'ubuntu-latest'

variables:
  buildConfiguration: 'Release'

stages:
- stage: Build
  jobs:
  - job: Build
    steps:
    - task: UseDotNet@2
      inputs:
        packageType: 'sdk'
        version: '6.0.x'
    
    - task: DotNetCoreCLI@2
      displayName: 'Restore packages'
      inputs:
        command: 'restore'
        projects: '**/*.csproj'
    
    - task: DotNetCoreCLI@2
      displayName: 'Build application'
      inputs:
        command: 'build'
        projects: '**/*.csproj'
        arguments: '--configuration $(buildConfiguration)'
    
    - task: DotNetCoreCLI@2
      displayName: 'Run tests'
      inputs:
        command: 'test'
        projects: '**/*Tests.csproj'
        arguments: '--configuration $(buildConfiguration) --collect "Code coverage"'

- stage: Deploy
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: Deploy
    environment: 'production'
    strategy:
      runOnce:
        deploy:
          steps:
          - task: AzureWebApp@1
            inputs:
              azureSubscription: 'Azure-Service-Connection'
              appType: 'webApp'
              appName: 'myWebApp'
              package: '$(Pipeline.Workspace)/**/*.zip'

# Compute Engine
gcloud compute instances create my-instance \
  --image-family=ubuntu-2004-lts \
  --image-project=ubuntu-os-cloud \
  --machine-type=e2-medium \
  --zone=us-central1-a

# Google Kubernetes Engine
gcloud container clusters create my-cluster \
  --zone=us-central1-a \
  --num-nodes=3 \
  --enable-autoscaling \
  --min-nodes=1 \
  --max-nodes=5

# Cloud Functions (Serverless)
gcloud functions deploy hello-world \
  --runtime python39 \
  --trigger-http \
  --allow-unauthenticated \
  --source=.

# Cloud SQL
gcloud sql instances create my-instance \
  --database-version=MYSQL_8_0 \
  --tier=db-f1-micro \
  --region=us-central1

# cloudbuild.yaml
steps:
# Build Docker image
- name: 'gcr.io/cloud-builders/docker'
  args: ['build', '-t', 'gcr.io/$PROJECT_ID/myapp:$COMMIT_SHA', '.']

# Push to Container Registry
- name: 'gcr.io/cloud-builders/docker'
  args: ['push', 'gcr.io/$PROJECT_ID/myapp:$COMMIT_SHA']

# Deploy to GKE
- name: 'gcr.io/cloud-builders/gke-deploy'
  args:
  - run
  - --filename=k8s/
  - --image=gcr.io/$PROJECT_ID/myapp:$COMMIT_SHA
  - --location=us-central1-a
  - --cluster=my-cluster

options:
  logging: CLOUD_LOGGING_ONLY

# providers.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 4.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
    google = {
      source  = "hashicorp/google"
      version = "~> 4.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
  alias  = "us_east"
}

provider "azurerm" {
  features {}
  alias = "azure_primary"
}

provider "google" {
  project = "my-gcp-project"
  region  = "us-central1"
  alias   = "gcp_primary"
}

# AWS Resources
resource "aws_s3_bucket" "primary_storage" {
  provider = aws.us_east
  bucket   = "my-primary-storage"
}

# Azure Resources  
resource "azurerm_storage_account" "backup_storage" {
  provider                 = azurerm.azure_primary
  name                     = "mybackupstorage"
  resource_group_name      = azurerm_resource_group.main.name
  location                 = azurerm_resource_group.main.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

# GCP Resources
resource "google_storage_bucket" "archive_storage" {
  provider = google.gcp_primary
  name     = "my-archive-storage"
  location = "US"
  
  lifecycle_rule {
    condition {
      age = 30
    }
    action {
      type          = "SetStorageClass"
      storage_class = "COLDLINE"
    }
  }
}

# AWS Cost Explorer CLI
aws ce get-cost-and-usage \
  --time-period Start=2024-01-01,End=2024-01-31 \
  --granularity MONTHLY \
  --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

# Включить детализированный биллинг
aws configure set preview.cloudfront true
aws logs create-log-group --log-group-name aws-cost-analysis

# Создать бюджет
aws budgets create-budget \
  --account-id 123456789012 \
  --budget file://budget.json

{
  "BudgetName": "Monthly-Budget",
  "BudgetLimit": {
    "Amount": "100",
    "Unit": "USD"
  },
  "TimeUnit": "MONTHLY",
  "BudgetType": "COST",
  "CostFilters": {
    "Service": ["Amazon Elastic Compute Cloud - Compute"]
  }
}

# 1. Reserved Instances (экономия 30-70%)
aws ec2 describe-reserved-instances-offerings \
  --instance-type t3.medium \
  --product-description "Linux/UNIX"

# 2. Spot Instances (экономия до 90%)
aws ec2 request-spot-instances \
  --spot-price "0.05" \
  --instance-count 2 \
  --type "one-time" \
  --launch-specification file://spot-specification.json

# 3. Auto Scaling для оптимизации использования
aws autoscaling create-auto-scaling-group \
  --auto-scaling-group-name my-asg \
  --launch-template LaunchTemplateName=my-template,Version=1 \
  --min-size 1 \
  --max-size 10 \
  --desired-capacity 2 \
  --target-group-arns arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/my-targets/1234567890123456

# 4. Lifecycle policies для S3
aws s3api put-bucket-lifecycle-configuration \
  --bucket my-bucket \
  --lifecycle-configuration file://lifecycle.json

# 1. Включить CloudTrail (логирование всех API вызовов)
aws cloudtrail create-trail \
  --name management-events \
  --s3-bucket-name my-cloudtrail-bucket

# 2. Включить AWS Config (мониторинг конфигураций)
aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/config-role

# 3. Включить GuardDuty (threat detection)
aws guardduty create-detector --enable

# 4. Использовать IAM роли вместо ключей
aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/S3Access \
  --role-session-name MySession

# 5. Включить шифрование EBS томов по умолчанию
aws ec2 enable-ebs-encryption-by-default

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-app-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        },
        "IpAddress": {
          "aws:SourceIp": ["203.0.113.0/24", "198.51.100.0/24"]
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

# Создание ВМ через CLI
yc compute instance create \
  --name my-vm \
  --zone ru-central1-a \
  --network-interface subnet-name=default,nat-ip-version=ipv4 \
  --ssh-key ~/.ssh/id_rsa.pub \
  --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-2004-lts

# Аутентификация в реестре
yc container registry configure-docker

# Сборка и загрузка образа
docker build -t cr.yandex/registry-id/my-app:latest .
docker push cr.yandex/registry-id/my-app:latest

# Создание кластера через CLI
yc managed-kubernetes cluster create \
  --name my-k8s-cluster \
  --network-name default \
  --zone ru-central1-a \
  --subnet-name default \
  --public-ip

# Работа с Object Storage через AWS CLI
aws --endpoint-url=https://storage.yandexcloud.net \
    s3 mb s3://my-bucket

aws --endpoint-url=https://storage.yandexcloud.net \
    s3 cp file.txt s3://my-bucket/

# API для управления серверами
curl -X POST https://api.selectel.ru/vpc/servers \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-server",
    "flavor": "1001",
    "image": "ubuntu-20-04",
    "keypair": "my-key"
  }'

# Создание кластера через API
curl -X POST https://api.selectel.ru/mks/v1/clusters \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "my-cluster",
    "kube_version": "1.27.4",
    "region": "ru-1",
    "enable_autorepair": true
  }'

# Настройка S3 клиента
aws configure set aws_access_key_id $SELECTEL_ACCESS_KEY
aws configure set aws_secret_access_key $SELECTEL_SECRET_KEY
aws configure set default.region ru-1

# Создание бакета
aws --endpoint-url https://s3.selcdn.ru s3 mb s3://my-bucket

# Загрузка файлов
aws --endpoint-url https://s3.selcdn.ru s3 cp ./files/ s3://my-bucket/ --recursive

# Создание PostgreSQL кластера
curl -X POST https://api.selectel.ru/dbaas/v1/projects/$PROJECT_ID/instances \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "production-db",
    "datastore": {
      "type": "postgresql",
      "version": "14"
    },
    "flavor": "SL1.2-4",
    "volume": {
      "size": 100,
      "type": "fast.ru-1a"
    },
    "network": {
      "type": "routed",
      "subnet_id": "subnet-12345"
    }
  }'

# docker-compose.yml для продакшена
version: '3.8'

services:
  app:
    image: registry.selectel.ru/project/my-app:latest
    ports:
      - "80:8080"
    environment:
      - DATABASE_URL=postgresql://user:pass@db.selcloud.ru:5432/mydb
      - REDIS_URL=redis://cache.selcloud.ru:6379
    deploy:
      replicas: 3
      resources:
        limits:
          memory: 512M
        reservations:
          memory: 256M

  nginx:
    image: nginx:alpine
    ports:
      - "443:443"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf
      - selectel-ssl:/etc/ssl/certs
    depends_on:
      - app

volumes:
  selectel-ssl:
    driver: selectel
    driver_opts:
      project_id: "12345"
      region: "ru-1"