Commit 64bed8a7 authored by Jakub's avatar Jakub Committed by Pierre SMEYERS
Browse files

feat: allow to override Terraform commands using a GitLab reference feature.

parent d1b7d0b7

README.md

+31 −0
Original line number Diff line number Diff line
@@ -239,6 +239,37 @@ Terraform jobs also support _optional_ **hook scripts** from your project, locat 
* `tf-pre-destroy.sh` is executed **before** running `terraform destroy`

* `tf-post-destroy.sh` is executed **after** running `terraform destroy`



### Terraform commands overrides



Instead of creating hook scripts, you can also override and/or decorate the Terraform commands 

using predefined `.tf-commands` template block, referenced by the [`!reference` directive](https://docs.gitlab.com/ee/ci/yaml/#reference-tags).



By default, the `.tf-commands`, block is composed as below: 



```yaml

.tf-commands:

  init: 

    - !reference [ .tf-commands, default, init ]

  plan: 

    - !reference [ .tf-commands, default, plan ]

  apply: 

    - !reference [ .tf-commands, default, apply ]

  destroy: 

    - !reference [ .tf-commands, default, destroy ]

```



You can override it for example in the following way:



```yaml

.tf-commands:

  init: 

    - source sandbox.env

    - !reference [ .tf-commands, default, init ]

    - echo "I'm executed after the terraform init command"

```



You can use this mechanism to source to the current shell your own environmental variables. 



### Environment & Terraform variables support



You have to be aware that your Terraform code has to be able to cope with various environments

templates/gitlab-ci-terraform.yml

+20 −4
Original line number Diff line number Diff line
@@ -485,6 +485,22 @@ stages: 
  

  # ENDSCRIPT





.tf-commands:

  default:

    init: tf_init "${ENV_INIT_OPTS:-$TF_INIT_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}"

    plan: tf_plan "${ENV_PLAN_OPTS:-$TF_PLAN_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}" "${ENV_TYPE}.tfplan" "${ENV_TYPE}-plan.json"

    apply: tf_apply "${ENV_APPLY_OPTS:-$TF_APPLY_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}" "$tfplan"

    destroy: tf_destroy "${ENV_DESTROY_OPTS:-$TF_DESTROY_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}"

  init:

    - !reference [ .tf-commands, default, init ]

  plan:

    - !reference [ .tf-commands, default, plan ]

  apply:

    - !reference [ .tf-commands, default, apply ]

  destroy:

    - !reference [ .tf-commands, default, destroy ]



# =============================================================================

# === Job Prototypes

# =============================================================================
@@ -508,7 +524,7 @@ stages: 
    - *tf-scripts

    - install_ca_certs "${CUSTOM_CA_CERTS:-$DEFAULT_CA_CERTS}"

    - cd "$TF_PROJECT_DIR"

    - tf_init "${ENV_INIT_OPTS:-$TF_INIT_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}"

    - !reference [ .tf-commands, init ]

  cache:

    key: "$CI_COMMIT_REF_SLUG-terraform"

    paths:
@@ -523,7 +539,7 @@ stages: 
  stage: infra

  script:

    - if [[ "$ENV_PLAN_ENABLED" == "true" ]]; then tfplan="${ENV_TYPE}.tfplan"; fi

    - tf_apply "${ENV_APPLY_OPTS:-$TF_APPLY_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}" "$tfplan"

    - !reference [ .tf-commands, apply ]

  artifacts:

    name: "$CI_JOB_NAME artifacts from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"

    paths:
@@ -537,7 +553,7 @@ stages: 
  extends: .tf-base

  stage: build

  script:

    - tf_plan "${ENV_PLAN_OPTS:-$TF_PLAN_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}" "${ENV_TYPE}.tfplan" "${ENV_TYPE}-plan.json"

    - !reference [ .tf-commands, plan ]

  artifacts:

    name: "Terraform plan for $ENV_TYPE from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"

    paths:
@@ -553,7 +569,7 @@ stages: 
  # force no dependencies

  dependencies: []

  script:

    - tf_destroy "${ENV_DESTROY_OPTS:-$TF_DESTROY_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}"

    - !reference [ .tf-commands, destroy ]



tf-tfsec:

  extends: .tf-base