how to Terraform cloud

[codeagencybe]

Does anybody has a docs or guideline how to run from Terraform cloud?
I have the basics ready, linked my repo etc... but I wonder how this works with the variables part like HCLOUD token etc...
CC @mysticaltech

Obviously I don't want to pass that directly into my files in the repo but instead using secrets or something? How can I do something like this? I suppose I need to replace the values in the kube.tf file with a var name and then pass it via Github secrets? And then Terraform needs to somehow understand var1 = secret1 kind of trickery?
If somebody has a simple working example/steps for 1 value, would be appreciated.

For the SSH keys, I was considering just uploading them directly into Hcloud project and then reference back from Terraform with below option. Less headaches, at least I though so...

  # You can also add additional SSH public Keys which are saved in the hetzner cloud by a label.
  # See https://docs.hetzner.cloud/#label-selector
  ssh_hcloud_key_label = "role=admin"

  # If you want to use an ssh key that is already registered within hetzner cloud, you can pass its id.
  # If no id is passed, a new ssh key will be registered within hetzner cloud.
  # It is important that exactly this key is passed via `ssh_public_key` & `ssh_private_key` vars.
  # hcloud_ssh_key_id = ""

So all keys will be coming from the label. Do I also then set the initial ssh key to null? Or is this a requirement to always pass the first initial key as minimum?

  # * Your ssh public key
  ssh_public_key = file("/home/username/.ssh/id_ed25519.pub")
  ---> # * Your private key must be "ssh_private_key = null" when you want to use ssh-agent for a Yubikey-like device authentification or an SSH key-pair with a passphrase.

  # For more details on SSH see https://github.com/kube-hetzner/kube-hetzner/blob/master/docs/ssh.md
  ssh_private_key = file("/home/username/.ssh/id_ed25519")
  # You can add additional SSH public Keys to grant other team members root access to your cluster nodes.
  # ssh_additional_public_keys = []

I basically have 3 persons each have their own SSH key. But I don't want the hassle to move that SSH key stuff around on my local since Im on TF cloud anyway.
It seems there are a few options for dealing with this:

1. add all the ssh keys directly into TF cloud, but then the question is: how do I tell the kube.tf that the SSH keys are "somewhere" in TF cloud some location?
2. put everything in Hetzner project directly, and then point to a label? But I don't know if this is supported for all keys, or only additional keys?
3. same as .2 but instead of using a label, using the ID's, but also same question as .2, does this only target additional keys or also the initial key?

Thanks!

[mysticaltech]

@codeagencybe All should work out of the box already. Just choose the execution mode of "local" see #162, and I guess you can have your SSH keys next to your kube.tf, or point to them via label see #356.

About the token, I guess you could just use a workplace variable, https://developer.hashicorp.com/terraform/cloud-docs/workspaces/variables (but haven't tried myself).

[codeagencybe]

@codeagencybe All should work out of the box already. Just choose the execution mode of "local" see #162, and I guess you can have your SSH keys next to your kube.tf, or point to them via label see #356.

About the token, I guess you could just use a workplace variable, https://developer.hashicorp.com/terraform/cloud-docs/workspaces/variables (but haven't tried myself).

@mysticaltech Thanks for the quick feedback!

I prefer using the label trick, as that is the most convenient for me.
But my question is, does this work only for the additional keys? Or ALL keys too?
The information in the kube.tf is not clear on this.
Do I still have to keep at minimum 1 ssh key in my local or if I can do all of them via label?
And if I can do all via label, then what do I set for the variable ssh_public_key and ssh_private_key ? Just null ?
Or do I just comment those lines if I use the label feature? There are no instructions how this plays together.

---

About the workspace variable, that one I also found and I already created those variable names, but I don't understand where I need to the actual values? And how do I change the kube.tf so it knows the value is coming from either a Github secret or a Terraform variable?

Do I need to do something like below?

locals {
  # Fill first and foremost your Hetzner API token, found in your project, Security, API Token, of type Read & Write.
  hcloud_token = ${{ secrets.HCLOUD_TOKEN }}
}

My VS code returns that this is not valid TF code.
The TF documentation also talks about different things regarding variables.

2. Local Environment Variables Prefixed with TF_VAR_
When using a CLI workflow, local environment variables prefixed with TF_VAR_ (e.g., TF_VAR_replicas) overwrite workspace-specific, variable set, and .auto.tfvars file variables that have the same key.

and

7. terraform.tfvars Variable File
Variables in the .auto.tfvars files take precedence over variables in the terraform.tfvars file.

I don't see how this plays with my kube.tf file. I suppose I have to do something so TF understands that my variable H_CLOUD has some value already in TF cloud. But I don't see a clear example if I need to replace something inline in my kube.tf file or if this require using that external file terraform.tfvars but then again, I don't want to store my credentials directly in my git repo. So using that tfvars file seems anti what I'm looking for.
I'm obviously overlooking something dead simple but this documentation is just a pain and way too overwhelming for something simple.
Using my Google skills only returns results about using Github actions secrets with TF which is not what I'm trying to do as we are not using GH actions or build flows at all.
I'm kinda lost on this one. Maybe if somebody who got this working can shine in and explain where the magic sauce is hiding for me lol

[mysticaltech]

@codeagencybe This was the PR were @WolfspiritM added support for Hetzner side SSH, please have a look how it works, and if the doc is not clear, PR welcome! #356

For the rest, I personally have no idea, but it would be surprising to me if TF Cloud did not have a env variable type of mechanism. Please try it and focus on searching the Terraform cloud docs. Also, PR welcome to the TF cloud example in our Readme.

@phaer @tschifftner Maybe you folks have an idea on how this project works on TF Cloud?

[mysticaltech]

As posted in #363, You can use labels to include more SSH keys, but you also need one local to work with the remote_execs. So just use TF Cloud in local mode, and it will work. Many folks have confirmed in the past, that it does work. And here's a tutorial about using variables. https://developer.hashicorp.com/terraform/tutorials/cloud/cloud-multiple-variable-sets

[codeagencybe]

@mysticaltech

I know how to create the variables itself, that is not the problem.
The problem is, I don't know/see how it works with the kube.tf file.

Lets take a simple example:

locals {
  # Fill first and foremost your Hetzner API token, found in your project, Security, API Token, of type Read & Write.
  hcloud_token = "xxxxxyyyyyyzzzzzz"
}

turn into something like this:

locals {
  # Fill first and foremost your Hetzner API token, found in your project, Security, API Token, of type Read & Write.
  hcloud_token = ${{ secrets.H_CLOUD }}
}

The above is failing. It says invalid TF code.
I already have my HCLOUD token stored in TF Cloud in a variable H_CLOUD. TF cloud already has the value.

The big question is: how does TF cloud understand it need to inject that value from TFcloud into that field when I click apply/run?
That's what I can't find. I need to change this inside my kube.tf file but their documentation is not clear to me.
They talk about using a tfvars file but that doesn't make any sense to me as I use TF cloud that is storing my vars, I don't want them locally in my repo.
Then they say variables need to be prefixed with TF_varname, but how exactly?
Below returns an error too while I'm using the exact formatting they have documented.

locals {
  # Fill first and foremost your Hetzner API token, found in your project, Security, API Token, of type Read & Write.
  hcloud_token = TF_H_CLOUD
}

Its so much abracadabra at this point. I don't understand why they don't show very simple short "real life" examples just like how Nextjs and React do documentation. They show explicit example commands so you instantly learn how to use and apply it.
With Terraform its just a bunch of abstract documentation and after reading several hours, its still one big puzzle...

[codeagencybe]

@mysticaltech

update: I tried with both "null" and "" (empty string" and also commented the lines, and all fail as below error

It still need some extra stuff in the Terraform script to be able to use variables as you can clearly see TF cloud is picking up my variable, but it doesn't know where to go with it.
I'm now googling for some examples on Digital Ocean and Linode to see if I can see some working examples from that and try to extract into a Hetzner variation.

[codeagencybe]

@mysticaltech

update 2:
We are getting close.

For Terraform Cloud, you need a file variables.tf, otherwise it won't work with cloud version.

variable "HCLOUD_TOKEN" {
  type = string
  default = "xxx"
}

inside kube.tf, you have to call it like this:

locals {
  # Fill first and foremost your Hetzner API token, found in your project, Security, API Token, of type Read & Write.
  hcloud_token = var.HCLOUD_TOKEN
}

I got a run working. Woohoo!
But I'm botching against the ssh key requirement. I'm just putting an empty string for the ssh key ""
If we could change requirement for local sh key into optional if label/id is used, that would solve all my problems.

[mysticaltech]

That should be simple enough, even if you do not know terraform well, also you are ideally positioned to do it as you can immediately test if t works or not @codeagencybe ! 😁 🚀

[codeagencybe]

When you retry stuff, always start from a clean slate, terraform destroy is your friend, and if the state is lost, just delete the whole hetzner project, and create a new one!

I did exactly that too, but still same result.

[codeagencybe]

Also about tf cloud "remote", it may be possible if we allow the possibility to add the private key as a variable (see https://discuss.hashicorp.com/t/how-to-do-remote-exec-operation-if-i-am-using-terraform-cloud/4370/8), and allow label hetzner-only SSH.

Ideally, you would create new variables tf_cloud_remote = (boolean) and tf_cloud_ssh_private_key = (string). And with those, adapt the current logic to make it work on tf cloud remote, without breaking backward compatibility.

That sounds like a plan! I will give that a try also this evening. I'm also all in for backwards compatibility.
Trying to keep things simple here myself. But sometimes when it just doesn't want to work, it gets frustration.
So I just gave up last evening to get my head clear again.

[mysticaltech]

Exactly, sometimes it's important to take a breath and comes back stronger! It will work... 🤞

[mysticaltech]

@codeagencybe Just had a profound realization 😁

We load the SSH files, both private key and public key via the terraform file() function, which itself just reads the file and returns the string.

Meaning you can already go full-fileless more. Just pass the string in there, or load it via a terraform cloud env variable.

Try it and let me know if you are able to go full terraform cloud "remote", or not.

Remember to pass a terraform multiline to a variable, just enclose the content of the file with EOT like so:

xyz = <<EOT
hello
world
EOT