Commit 0513532f authored by Guilhem Bonnefille's avatar Guilhem Bonnefille Committed by Pierre Smeyers
Browse files

fix: configure http backend via exported variables only

Fixes the "Error acquiring the state lock" issue
parent af308a92
Loading
Loading
Loading
Loading
+0 −11
Original line number Diff line number Diff line
@@ -222,17 +222,6 @@ terraform {
This default behavior can also be disabled by setting `$TF_GITLAB_BACKEND_DISABLED` to `true`.
In that case, you'll have to declare and configure your backend and tfstate by yourself (see [Implicit Backend configuration support](#implicit-backend-configuration-support) below).

#### _Error acquiring the state lock_ workaround

The template takes care of [configuring the http backend](https://developer.hashicorp.com/terraform/language/settings/backends/http#configuration-variables),
including with authentication credentials (using GitLab job token).

Anyway - depending on the Terraform version you are using - you _may_ face this error when applying a plan that was computed in an upstream job:

> Error locking state: Error acquiring the state lock: HTTP remote state endpoint requires auth

This is [a known issue](https://gitlab.com/gitlab-org/terraform-images/-/issues/9). A simple workaround is to create a [Project Access Token](https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html) with API rights, then declare it as a masked secret variable with name `TF_PASSWORD` in your Terraform project.

#### How to use GitLab backend in your development environment ?

First create a [Project Access Token](https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html) or [Personal Access Token](https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html#personal-access-tokens).
+12 −11
Original line number Diff line number Diff line
@@ -366,6 +366,11 @@ stages:
    fi
  }

  tf_is_at_least() {
    [ "${1}" = "$(terraform -version | awk -v min="${1}" '/^Terraform v/{ sub(/^v/, "", $2); print min; print $2 }' | sort -V | head -n1)" ]
    return $?
  }

  function tf_init() {
    opts=$1
    extra_opts=$2
@@ -412,7 +417,13 @@ stages:
    then
      # impl inspired by GitLab Terraform image script
      # see https://gitlab.com/gitlab-org/terraform-images/-/blob/master/src/bin/gitlab-terraform.sh

      if tf_is_at_least 0.13.2
      then
        log_info "configuring Terraform to use GitLab as http backend for tfstate  (set \\e[33;1m\$TF_GITLAB_BACKEND_DISABLED\\e[0m to prevent this)"
      else
        fail "terraform < 0.13.2 doesn't support environment variables to configure http backend"
      fi

      # If TF_USERNAME is unset then default to GITLAB_USER_LOGIN
      TF_USERNAME="${TF_USERNAME:-${GITLAB_USER_LOGIN}}"
@@ -436,16 +447,6 @@ stages:
      export TF_HTTP_USERNAME="${TF_HTTP_USERNAME:-${TF_USERNAME}}"
      export TF_HTTP_PASSWORD="${TF_HTTP_PASSWORD:-${TF_PASSWORD}}"
      export TF_HTTP_RETRY_WAIT_MIN="${TF_HTTP_RETRY_WAIT_MIN:-5}"

      # terraform < 0.13.2 doesn't support env var..
      tf_backend_opts="-backend-config=address=${TF_HTTP_ADDRESS}"
      tf_backend_opts="$tf_backend_opts -backend-config=lock_address=${TF_HTTP_LOCK_ADDRESS}"
      tf_backend_opts="$tf_backend_opts -backend-config=unlock_address=${TF_HTTP_UNLOCK_ADDRESS}"
      tf_backend_opts="$tf_backend_opts -backend-config=username=${TF_HTTP_USERNAME}"
      tf_backend_opts="$tf_backend_opts -backend-config=password=${TF_HTTP_PASSWORD}"
      tf_backend_opts="$tf_backend_opts -backend-config=lock_method=${TF_HTTP_LOCK_METHOD}"
      tf_backend_opts="$tf_backend_opts -backend-config=unlock_method=${TF_HTTP_UNLOCK_METHOD}"
      tf_backend_opts="$tf_backend_opts -backend-config=retry_wait_min=${TF_HTTP_RETRY_WAIT_MIN}"
    else
      backend_cfg=$(ls -1 "${environment_type}.tfbackend" 2>/dev/null || ls -1 "default.tfbackend" 2>/dev/null || echo "")
      if [[ -f "$backend_cfg" ]]