Back to Details

infrastructure-iac

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Infrastructure as Code

基础设施即代码（IaC）

Guiding Principles

指导原则

  1. Security First: Non-root users, minimal images, secret management
  2. Reproducibility: Pin versions, deterministic builds, locked dependencies
  3. Modularity: Reusable modules, DRY patterns, clear interfaces
  4. State Management: Remote state, locking, backup strategies
  1. 安全优先：使用非root用户、最小化镜像、密钥管理
  2. 可重复性：固定版本、确定性构建、锁定依赖
  3. 模块化：可复用模块、DRY原则、清晰接口
  4. 状态管理：远程状态、锁定机制、备份策略

Tool Selection

工具选择

Use CaseTool
Cloud infrastructureTerraform
ContainersDocker
Configuration managementAnsible
AWS-native IaCCloudFormation
使用场景工具
云基础设施Terraform
容器Docker
配置管理Ansible
AWS原生IaCCloudFormation

Terraform Quick Reference

Terraform速查指南

Essential Commands

常用命令

bash
terraform init                    # Initialize working directory
terraform plan                    # Preview changes
terraform plan -out=tfplan        # Save plan for apply
terraform apply tfplan            # Apply saved plan
terraform fmt -recursive          # Format all files
terraform validate                # Validate configuration
bash
terraform init                    # 初始化工作目录
terraform plan                    # 预览变更
terraform plan -out=tfplan        # 保存计划用于执行
terraform apply tfplan            # 应用已保存的计划
terraform fmt -recursive          # 格式化所有文件
terraform validate                # 验证配置

Critical Patterns

关键模式

hcl
undefined
hcl
undefined

1. Pin provider versions

1. 固定Provider版本

terraform { required_version = ">= 1.6.0" required_providers { aws = { source = "hashicorp/aws" version = "~> 5.60" } } }
terraform { required_version = ">= 1.6.0" required_providers { aws = { source = "hashicorp/aws" version = "~> 5.60" } } }

2. Use for_each for stability

2. 使用for_each保证稳定性

resource "aws_subnet" "private" { for_each = var.private_subnets # NOT: count }
resource "aws_subnet" "private" { for_each = var.private_subnets # 不要使用count }

3. Validate inputs

3. 验证输入参数

variable "environment" { type = string validation { condition = can(regex("^(dev|staging|prod)$", var.environment)) error_message = "Must be: dev, staging, prod." } }
variable "environment" { type = string validation { condition = can(regex("^(dev|staging|prod)$", var.environment)) error_message = "必须为：dev、staging、prod。" } }

4. Mark sensitive data

4. 标记敏感数据

variable "db_password" { type = string sensitive = true }
variable "db_password" { type = string sensitive = true }

5. Lifecycle protection

5. 生命周期保护

resource "aws_s3_bucket" "state" { lifecycle { prevent_destroy = true } }
undefined
resource "aws_s3_bucket" "state" { lifecycle { prevent_destroy = true } }
undefined

Docker Quick Reference

Docker速查指南

Multi-Stage Build

多阶段构建

dockerfile
undefined
dockerfile
undefined

Build stage

构建阶段

FROM node:20-alpine AS builder WORKDIR /app COPY package*.json ./ RUN npm ci --only=production COPY . . RUN npm run build
FROM node:20-alpine AS builder WORKDIR /app COPY package*.json ./ RUN npm ci --only=production COPY . . RUN npm run build

Production stage

生产阶段

FROM node:20-alpine WORKDIR /app COPY --from=builder /app/dist ./dist COPY --from=builder /app/node_modules ./node_modules
USER node EXPOSE 3000 CMD ["node", "dist/index.js"]
undefined
FROM node:20-alpine WORKDIR /app COPY --from=builder /app/dist ./dist COPY --from=builder /app/node_modules ./node_modules
USER node EXPOSE 3000 CMD ["node", "dist/index.js"]
undefined

Best Practices

最佳实践

dockerfile
undefined
dockerfile
undefined

Pin versions

固定版本

FROM python:3.12.1-slim-bookworm
FROM python:3.12.1-slim-bookworm

Run as non-root

以非root用户运行

RUN useradd -m appuser USER appuser
RUN useradd -m appuser USER appuser

Layer optimization

分层优化

COPY requirements.txt . RUN pip install -r requirements.txt COPY . .
COPY requirements.txt . RUN pip install -r requirements.txt COPY . .

Health check

健康检查

HEALTHCHECK --interval=30s --timeout=3s
CMD curl -f http://localhost:8080/health || exit 1
undefined
HEALTHCHECK --interval=30s --timeout=3s
CMD curl -f http://localhost:8080/health || exit 1
undefined

Naming Conventions

命名规范

ToolConventionExample
Terraformsnake_case
aws_vpc.main
Dockerlowercase, hyphens
my-app:1.0.0
Ansiblesnake_case
install_packages
CloudFormationHungarian
pEnvironment
, 
rVpc
工具规范示例
Terraform蛇形命名法（snake_case）
aws_vpc.main
Docker小写字母+连字符
my-app:1.0.0
Ansible蛇形命名法（snake_case）
install_packages
CloudFormation匈牙利命名法
pEnvironment
, 
rVpc

Security Checklist

安全检查清单

  • No secrets in code (use vaults/secret managers)
  • Non-root containers
  • Minimal base images
  • Version pinning
  • Vulnerability scanning
  • State encryption (Terraform)
  • Network segmentation
  • 代码中不包含密钥（使用密钥管理工具/服务）
  • 使用非root容器
  • 使用最小化基础镜像
  • 固定版本
  • 漏洞扫描
  • 状态加密（Terraform）
  • 网络分段

Detailed References

详细参考资料

  • Terraform: See references/terraform.md
  • Docker: See references/docker.md
  • Ansible: See references/ansible.md
  • Configuration: See references/configuration.md
  • Terraform：查看references/terraform.md
  • Docker：查看references/docker.md
  • Ansible：查看references/ansible.md
  • 配置：查看references/configuration.md