mcpField
I
infrastructure

infrastructure

github.com/dralgorhythm云与 DevOps12960 次安装14 周前更新
代码仓库

关于 infrastructure

面向使用 Terraform 管理云资源的基础设施即代码技能，涵盖项目结构、计划与应用工作流、状态管理、可复用模块及 AWS 资源示例。

主要功能

  1. 01组织 Terraform 项目结构
  2. 02计划并应用基础设施变更
  3. 03管理远程状态与锁定
  4. 04复用基础设施模块
  5. 05配置 AWS 资源

适用场景

  1. 01搭建 Terraform 基础设施仓库
  2. 02应用前审查变更计划
  3. 03隔离并保护不同环境的状态
  4. 04配置 AWS VPC、ECS 或 S3 资源

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/dralgorhythm/claude-agentic-framework --skill infrastructure

安装后在 Claude Code 中输入/infrastructure确认已加载。

详细介绍

基础设施即代码

原则

  1. 一切皆代码：不进行手动更改
  2. 版本控制：跟踪所有更改
  3. 幂等性：可安全地多次运行
  4. 经过测试：应用前进行验证

Terraform 基础

项目结构
infrastructure/
├── main.tf           # Main configuration
├── variables.tf      # Input variables
├── outputs.tf        # Output values
├── providers.tf      # Provider config
├── terraform.tfvars  # Variable values
└── modules/
    └── vpc/          # Reusable modules
示例：AWS VPC
# providers.tf
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# main.tf
resource "aws_vpc" "main" {
  cidr_block = var.vpc_cidr

  tags = {
    Name        = "${var.project}-vpc"
    Environment = var.environment
  }
}

# variables.tf
variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
  default     = "10.0.0.0/16"
}

工作流

# Initialize
terraform init

# Plan changes
terraform plan -out=tfplan

# Apply changes
terraform apply tfplan

# Destroy resources
terraform destroy

最佳实践

  1. 使用远程状态：将状态存储在 S3/GCS 中
  2. 锁定状态：防止并发修改
  3. 使用模块：构建可复用的基础设施组件
  4. 环境隔离：为每个环境单独设置状态
  5. 密钥管理：绝不将密钥存储在代码中

状态管理

terraform {
  backend "s3" {
    bucket         = "terraform-state-bucket"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

ECS/Fargate

# Task Definition
resource "aws_ecs_task_definition" "app" {
  family                   = "${var.project}-task"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = 256
  memory                   = 512
  execution_role_arn       = aws_iam_role.ecs_execution.arn

  container_definitions = jsonencode([{
    name  = "app"
    image = "${aws_ecr_repository.app.repository_url}:latest"
    portMappings = [{
      containerPort = 8080
      protocol      = "tcp"
    }]
    logConfiguration = {
      logDriver = "awslogs"
      options = {
        awslogs-group         = aws_cloudwatch_log_group.app.name
        awslogs-region        = var.aws_region
        awslogs-stream-prefix = "app"
      }
    }
  }])
}

# ECS Service
resource "aws_ecs_service" "app" {
  name            = "${var.project}-service"
  cluster         = aws_ecs_cluster.main.id
  task_definition = aws_ecs_task_definition.app.arn
  desired_count   = var.app_count
  launch_type     = "FARGATE"

  network_configuration {
    subnets         = aws_subnet.private[*].id
    security_groups = [aws_security_group.app.id]
  }
}

S3 存储桶

resource "aws_s3_bucket" "assets" {
  bucket = "${var.project}-assets-${var.environment}"
}

resource "aws_s3_bucket_versioning" "assets" {
  bucket = aws_s3_bucket.assets.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "assets" {
  bucket = aws_s3_bucket.assets.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

评论

支持 Markdown