Chaos Engineering บน AWS

# ติดตั้ง Chaos Monkey ด้วย Spinnaker
helm repo add spinnaker https://kubernetes-charts.storage.googleapis.com/
helm install chaos-monkey spinnaker/spinnaker --set chaos.enabled=true

# หรือติดตั้งด้วย Docker
docker run -d \
  --name chaos-monkey \
  -e CHAOS_ENABLED=true \
  -e AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY \
  -e AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY \
  netflixoss/chaosmonkey:latest

# ตั้งค่า Chaos Monkey Configuration
cat <<EOF > chaos-config.yaml
{
  "accounts": [
    {
      "name": "aws-account",
      "type": "aws",
      "chaosEnabled": true,
      "minTimeBetweenKillsInWorkDays": 1,
      "regionsAreIndependent": true,
      "exceptions": [],
      "filters": []
    }
  ],
  "settings": {
    "delay": {
      "enabled": true,
      "percent": 1.0
    },
    "notifications": {
      "slack": {
        "enabled": true,
        "channel": "#chaos-engineering"
      }
    }
  }
}
EOF

{
  "description": "Terminate EC2 instances with tag Environment=Production",
  "targets": {
    "EC2Instances-Target-1": {
      "resourceType": "aws:ec2:instance",
      "resourceTags": {
        "Environment": "Production"
      },
      "selectionMode": "COUNT(1)"
    }
  },
  "actions": {
    "TerminateInstances": {
      "actionId": "aws:ec2:terminate-instances",
      "parameters": {
        "duration": "PT1M"
      },
      "targets": {
        "Instances": "EC2Instances-Target-1"
      }
    }
  },
  "stopConditions": [
    {
      "source": "aws:cloudwatch:alarm",
      "value": "my-application-alarm"
    }
  ],
  "roleArn": "arn:aws:iam::123456789012:role/fis-role",
  "tags": {
    "Name": "EC2-Termination-Experiment"
  }
}

# 1. สร้าง IAM Role สำหรับ FIS
aws iam create-role \
  --role-name fis-role \
  --assume-role-policy-document file://fis-trust-policy.json

# 2. Attach policy ให้ role
aws iam attach-role-policy \
  --role-name fis-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/FISExecutionPolicy

# 3. สร้าง experiment template
aws fis create-experiment-template \
  --cli-input-json file://experiment-template.json

# 4. รัน experiment
aws fis start-experiment \
  --experiment-template-id EXPTIDEXAMPLE12345

# ติดตั้ง Gremlin Agent บน EC2 Linux
curl -fsSL https://deb.gremlin.com/gremlin.pub | sudo apt-key add -
echo "deb https://deb.gremlin.com/ release non-free" | sudo tee /etc/apt/sources.list.d/gremlin.list
sudo apt update
sudo apt install gremlin gremlind

# กำหนดค่า Gremlin
sudo systemctl stop gremlind
sudo gremlin init \
  --client.team-id=YOUR_TEAM_ID \
  --client.cluster-id=aws-cluster \
  --client.tags=environment=production,region=ap-southeast-1

sudo systemctl start gremlind

# หรือติดตั้งด้วย Docker
docker run -d \
  --name gremlin \
  --hostname=$(hostname)-$(uname -m | shasum | cut -c1-6) \
  --volume=/var/run/docker.sock:/var/run/docker.sock \
  --volume=/proc/stat:/proc/stat:ro \
  --volume=/sys/fs/cgroup:/host_sys/fs/cgroup:ro \
  --volume=/sys/kernel/debug:/sys/kernel/debug:rw \
  --volume=/var/lib/grype/db:/var/lib/grype/db:rw \
  --volume=/var/log:/var/log:rw \
  --volume=/tmp:/tmp:rw \
  --cap-add=SYS_PTRACE \
  --cap-add=NET_ADMIN \
  --cap-add=SYS_ADMIN \
  --cap-add=IPC_LOCK \
  --security-opt apparmor=unconfined \
  -e GREMLIN_CLIENT_TEAM_ID=YOUR_TEAM_ID \
  -e GREMLIN_CLIENT_CLUSTER_ID=aws-cluster \
  -e GREMLIN_TAGS="environment=linux,host=$(hostname)" \
  gremlin/gremlin daemon

import gremlin
import time

# อัตโนมัติ Chaos Experiment
def automated_chaos_experiment():
    client = gremlin.api_client(api_key="YOUR_API_KEY")
    
    # กำหนด targets (EC2 instances ที่มี tag production)
    targets = [
        {
            "type": "host",
            "ids": ["i-0abcdef1234567890"],
            "tags": {"environment": "production"}
        }
    ]
    
    # สร้าง CPU Attack
    cpu_attack_config = {
        "length": 60,  # 60 seconds
        "cores": 2,
        "load": 80     # 80% CPU utilization
    }
    
    # Inject the attack
    attack_response = client.attacks.new_attack(
        command="cpu",
        args=cpu_attack_config,
        targets=targets
    )
    
    print(f"CPU Attack started: {attack_response['attack_guid']}")
    
    # รอจนจบ attack
    time.sleep(60)
    
    print("Attack completed")
    
    # ตรวจสอบ metrics จาก monitoring tools
    check_system_metrics()
    
# รัน experiment
if __name__ == "__main__":
    automated_chaos_experiment()

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:RebootInstances",
        "ec2:StopInstances",
        "ec2:StartInstances",
        "ec2:TerminateInstances",
        "ecs:DescribeTasks",
        "ecs:StopTask",
        "eks:DescribeNodegroup",
        "eks:DeleteNodegroup",
        "rds:DescribeDBInstances",
        "rds:RebootDBInstance",
        "cloudwatch:DescribeAlarms"
      ],
      "Resource": "*"
    }
  ]
}