Commit 235df212 authored by Pierre Smeyers's avatar Pierre Smeyers
Browse files

Merge branch '81-workspace-w-gitlab-backend' into 'master' 

Gitlab backend: unset workspace variable and warn about it

Closes #81

See merge request to-be-continuous/terraform!121
parents d8416b5a 36d749e6

README.md

+6 −1
Original line number Diff line number Diff line
@@ -314,7 +314,12 @@ Be aware of the following: 


* each of those variables support the value `auto`: in that case, the template will use the dynamic [`$environment_slug` value](#deployment-context-variables) as workspace name,

* if the specified workspace doesn't exist, the template will create it,

* HTTP backend (default) doesn't support Workspaces. [See supported backends here](https://developer.hashicorp.com/terraform/language/state/workspaces#backends-supporting-multiple-workspaces).

* HTTP backend doesn't support Workspaces. [See supported backends here](https://developer.hashicorp.com/terraform/language/state/workspaces#backends-supporting-multiple-workspaces).

* corollary as GitLab http backend is on by default workspace selection is explicitly bypassed

  unless `gitlab-backend-disabled` / `TF_GITLAB_BACKEND_DISABLED` is set to `true`.

  If kept enabled and if any of the `TF_WORKSPACE` variable is set the template will warn about it.

* if using another (non-Gitlab) http backend nothing will prevent from  trying to use workspaces, in

  that case you'll get a Terraform error `workspaces not supported`.



### Using modules from private registries

templates/gitlab-ci-terraform.yml

+47 −32
Original line number Diff line number Diff line
@@ -688,6 +688,51 @@ stages: 
    fi

  }



  function tf_gitlab_backend_setup() {

      # impl inspired by GitLab Terraform image script

      # see https://gitlab.com/gitlab-org/terraform-images/-/blob/master/src/bin/gitlab-terraform.sh



      if tf_is_at_least 0.13.2

      then

        log_info "configuring Terraform to use GitLab as http backend for tfstate  (set \\e[33;1m\$TF_GITLAB_BACKEND_DISABLED\\e[0m to prevent this)"

      else

        fail "terraform < 0.13.2 doesn't support environment variables to configure http backend"

      fi



      # GitLab Terraform state storage uses the http backend and this does not support workspaces.

      # With TBC the GitLab http backend configuration is scoped by environment.

      # If you require another state-scoping scheme to implement

      # workspace-like storage with the GitLab backend, you can do so

      # by overriding the TF_HTTP_ADDRESS variable to match your use-case.

      if [[ -n "${ENV_WORKSPACE:-$TF_WORKSPACE}" ]]; then

          log_warn "Using Terraform workspace with GitLab backend is not supported, unsetting (was '${ENV_WORKSPACE:-$TF_WORKSPACE}') ..."

          unset TF_WORKSPACE ENV_WORKSPACE

      fi



      # If TF_USERNAME is unset then default to GITLAB_USER_LOGIN

      TF_USERNAME="${TF_USERNAME:-${GITLAB_USER_LOGIN}}"



      # If TF_PASSWORD is unset then default to gitlab-ci-token/CI_JOB_TOKEN

      if [ -z "${TF_PASSWORD}" ]; then

        TF_USERNAME="gitlab-ci-token"

        TF_PASSWORD="${CI_JOB_TOKEN}"

      fi



      # If TF_ADDRESS is unset then default to GitLab backend in current project

      TF_ADDRESS="${TF_ADDRESS:-${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/${environment_slug}}"



      # Set variables for the HTTP backend to default to TF_* values

      # see: https://developer.hashicorp.com/terraform/language/settings/backends/http

      export TF_HTTP_ADDRESS="${TF_HTTP_ADDRESS:-${TF_ADDRESS}}"

      export TF_HTTP_LOCK_ADDRESS="${TF_HTTP_LOCK_ADDRESS:-${TF_ADDRESS}/lock}"

      export TF_HTTP_LOCK_METHOD="${TF_HTTP_LOCK_METHOD:-POST}"

      export TF_HTTP_UNLOCK_ADDRESS="${TF_HTTP_UNLOCK_ADDRESS:-${TF_ADDRESS}/lock}"

      export TF_HTTP_UNLOCK_METHOD="${TF_HTTP_UNLOCK_METHOD:-DELETE}"

      export TF_HTTP_USERNAME="${TF_HTTP_USERNAME:-${TF_USERNAME}}"

      export TF_HTTP_PASSWORD="${TF_HTTP_PASSWORD:-${TF_PASSWORD}}"

      export TF_HTTP_RETRY_WAIT_MIN="${TF_HTTP_RETRY_WAIT_MIN:-5}"

  }



  function tf_init() {

    opts=${ENV_INIT_OPTS:-$TF_INIT_OPTS}

    extra_opts=${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}
@@ -731,40 +776,10 @@ stages: 
    # maybe execute pre init script

    tf_pre_init



    # setup backend

    if [[ "$TF_GITLAB_BACKEND_DISABLED" != "true" ]]

    then

      # impl inspired by GitLab Terraform image script

      # see https://gitlab.com/gitlab-org/terraform-images/-/blob/master/src/bin/gitlab-terraform.sh



      if tf_is_at_least 0.13.2

      then

        log_info "configuring Terraform to use GitLab as http backend for tfstate  (set \\e[33;1m\$TF_GITLAB_BACKEND_DISABLED\\e[0m to prevent this)"

      else

        fail "terraform < 0.13.2 doesn't support environment variables to configure http backend"

      fi



      # If TF_USERNAME is unset then default to GITLAB_USER_LOGIN

      TF_USERNAME="${TF_USERNAME:-${GITLAB_USER_LOGIN}}"



      # If TF_PASSWORD is unset then default to gitlab-ci-token/CI_JOB_TOKEN

      if [ -z "${TF_PASSWORD}" ]; then

        TF_USERNAME="gitlab-ci-token"

        TF_PASSWORD="${CI_JOB_TOKEN}"

      fi



      # If TF_ADDRESS is unset then default to GitLab backend in current project

      TF_ADDRESS="${TF_ADDRESS:-${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/${environment_slug}}"



      # Set variables for the HTTP backend to default to TF_* values

      # see: https://developer.hashicorp.com/terraform/language/settings/backends/http

      export TF_HTTP_ADDRESS="${TF_HTTP_ADDRESS:-${TF_ADDRESS}}"

      export TF_HTTP_LOCK_ADDRESS="${TF_HTTP_LOCK_ADDRESS:-${TF_ADDRESS}/lock}"

      export TF_HTTP_LOCK_METHOD="${TF_HTTP_LOCK_METHOD:-POST}"

      export TF_HTTP_UNLOCK_ADDRESS="${TF_HTTP_UNLOCK_ADDRESS:-${TF_ADDRESS}/lock}"

      export TF_HTTP_UNLOCK_METHOD="${TF_HTTP_UNLOCK_METHOD:-DELETE}"

      export TF_HTTP_USERNAME="${TF_HTTP_USERNAME:-${TF_USERNAME}}"

      export TF_HTTP_PASSWORD="${TF_HTTP_PASSWORD:-${TF_PASSWORD}}"

      export TF_HTTP_RETRY_WAIT_MIN="${TF_HTTP_RETRY_WAIT_MIN:-5}"

      tf_gitlab_backend_setup

    else

      backend_cfg=$(ls -1 "${environment_type}.tfbackend" 2>/dev/null || ls -1 "default.tfbackend" 2>/dev/null || echo "")

      if [[ -f "$backend_cfg" ]]