Terraform bootstrap recipe #26

ilkka · 2023-02-17T08:09:31Z

No description provided.

majori · 2023-09-22T09:34:47Z

Jalapeno now supports conditional variables and table variables, which could be useful for this recipe

Needs a "--" to make `task` pass it in .CLI_ARGS instead of trying to parse it as a subcommand.

Once we generate the backend.tf file, we can't run the `terraform output` command to get the storage account access key before we re-init, but we can't re-init because we don't have the access key. Therefore we do this in 3 steps instead of 2: 1. Create storage account 2. Grab the access key into `terraform-backend.config` 3. Create the `backend.tf` file

Rules are official Azure naming rules

We will use this to bootstrap state management for all envs in one go

It's a separate storage account so this is redundant

This is the case when e.g. init'ing a second environment

…cipe-as-one-of-first-possible-killer-recipes

ilkka · 2023-12-01T11:12:43Z

examples/terraform-bootstrap/templates/.github/workflows/terraform.yml

+    uses: ./.github/workflows/terraform-plan.yml
+    with:
+      ENVIRONMENT: {{ $env.NAME }}
+      TERRAFORM_VERSION: {{ "${{ env.TERRAFORM.VERSION }}" }}


@majori this should be env.TERRAFORM_VERSION with an underscore probably, right?

For some reason the env context is not available in the with block of a reusable workflow. See https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability. With this change we use vars instead.

…bootstrap-recipe-as-one-of-first-possible-killer-recipes' into ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes

Forgot to change these refs to secrets

…cipe-as-one-of-first-possible-killer-recipes

…form-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes

This way users of this recipe can use it in their own resource names if they need to be globally unique (e.g. KV) fixup: pass the ctx

We need this so we can fix things up with az cli later

If we're doing the GA pipeline, we need to switch the owner role assignment over from the user running the init task to the GA SP. It requires us to slightly change how the IDs and other things are managed.

ilkka force-pushed the ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes branch from 39bd0ba to b9a9dc3 Compare February 19, 2023 12:58

majori force-pushed the ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes branch from f09d7d0 to 92e64d6 Compare March 7, 2023 13:47

majori force-pushed the ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes branch from d5b4d81 to 62ade0b Compare March 23, 2023 08:30

majori force-pushed the main branch from 7fe648e to fc16e20 Compare May 3, 2023 11:50

ilkka force-pushed the ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes branch from 2c92ac7 to d109ced Compare August 25, 2023 11:50

ilkka force-pushed the ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes branch from d109ced to 1a51726 Compare September 11, 2023 08:32

majori force-pushed the main branch 7 times, most recently from 774e0e0 to 516f44f Compare September 21, 2023 10:51

majori force-pushed the ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes branch 2 times, most recently from ca56e51 to 23cfcf0 Compare September 25, 2023 11:32

Ilkka Poutanen and others added 14 commits September 26, 2023 16:15

wip state management terraform recipe

1f48bf8

Escape CLI_ARGS in taskfile template

a4ec399

Fix help text on how to provide environment name

834d24d

Needs a "--" to make `task` pass it in .CLI_ARGS instead of trying to parse it as a subcommand.

Validate Azure resource group name

911ea12

Rules are official Azure naming rules

Add environments var

4118d9e

We will use this to bootstrap state management for all envs in one go

Drop env name from tfstate key

ad03982

It's a separate storage account so this is redundant

WIP loop over envs and create all (mostly TODOs)

004adac

Use hash of anchor instead of randNumeric

ef5ed6b

Improve recipe process

9a3e34d

Use stableRandom in tfstate storage account name

c825dd5

Remove some whitespace

921987a

Don't fail when terraform.tfstate.d doesn't exist

3568b0c

This is the case when e.g. init'ing a second environment

Init task name changed

dd13599

majori force-pushed the main branch 3 times, most recently from ac6aa39 to fbb5670 Compare November 12, 2023 12:21

Merge branch 'main' into ilkka/20-Create-Terraform-state-bootstrap-re…

fb551bf

…cipe-as-one-of-first-possible-killer-recipes

ilkka commented Dec 1, 2023

View reviewed changes

Ilkka Poutanen and others added 13 commits December 1, 2023 14:04

Fix typo in environment variable

4adfaed

Don't use env vars for reusable workflows

d71a80b

For some reason the env context is not available in the with block of a reusable workflow. See https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability. With this change we use vars instead.

Sub and tenant IDs are passed as secrets

0cb4201

Merge remote-tracking branch 'origin/ilkka/20-Create-Terraform-state-…

0e0aafb

…bootstrap-recipe-as-one-of-first-possible-killer-recipes' into ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes

Fix generated terraform formatting

dfd12fc

Pass container and key to tf init in plan stage

2d77ee5

Fix configuring plan and apply env

469bcce

Forgot to change these refs to secrets

Add a readme with some details on the permissions setup

e597072

Reword SP and app reg

ffedb28

Fix state storage formatting

fe77508

Making RGs is optional

b2f0387

Add recommendations

0bb7d96

Merge branch 'main' into ilkka/20-Create-Terraform-state-bootstrap-re…

160ed5d

…cipe-as-one-of-first-possible-killer-recipes

majori force-pushed the main branch from 0bb7d96 to b5b2c5b Compare December 13, 2023 10:03

Ilkka Poutanen added 8 commits December 13, 2023 12:32

Merge remote-tracking branch 'origin/main' into ilkka/20-Create-Terra…

a7b49eb

…form-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes

Provide the shasum resource tag separately

c606b70

This way users of this recipe can use it in their own resource names if they need to be globally unique (e.g. KV) fixup: pass the ctx

Output role assignment ID for later use

ce6c3e8

We need this so we can fix things up with az cli later

Update to more recent tf version

82d24a2

Correctly manage tfstate container permissions

b63649c

If we're doing the GA pipeline, we need to switch the owner role assignment over from the user running the init task to the GA SP. It requires us to slightly change how the IDs and other things are managed.

Fix passthru mustache stuff

ed4d978

Add resource tag to tf GHA workflow

58218fd

Clean up some whitespace

c24e328

ilkka marked this pull request as ready for review December 15, 2023 10:55

ilkka merged commit 4c5f820 into main Dec 15, 2023
4 checks passed

ilkka deleted the ilkka/20-Create-Terraform-state-bootstrap-recipe-as-one-of-first-possible-killer-recipes branch December 15, 2023 10:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Terraform bootstrap recipe #26

Terraform bootstrap recipe #26

ilkka commented Feb 17, 2023

majori commented Sep 22, 2023

ilkka Dec 1, 2023

majori Dec 1, 2023

Terraform bootstrap recipe #26

Terraform bootstrap recipe #26

Conversation

ilkka commented Feb 17, 2023

majori commented Sep 22, 2023

ilkka Dec 1, 2023

Choose a reason for hiding this comment

majori Dec 1, 2023

Choose a reason for hiding this comment