Commit f175aed5 authored by Cédric OLIVIER's avatar Cédric OLIVIER
Browse files

feat: Change boolean variable behaviour 



BREAKING CHANGE: boolean variable now triggered on explicit 'true' value

Signed-off-by: default avatarCédric OLIVIER <cedric3.olivier@orange.com>
parent 3a11f512

README.md

+12 −12
Original line number Diff line number Diff line
@@ -68,7 +68,7 @@ The Terraform template uses some global configuration used throughout all jobs. 
| Name                     | description                            | default value     |

| ------------------------ | -------------------------------------- | ----------------- |

| `TF_IMAGE`               | the Docker image used to run Terraform CLI commands| `hashicorp/terraform:light` **it is highly recommended to set the CLI version compatible with your Terraform server** |

| `TF_GITLAB_BACKEND_DISABLED`| Set to disable [GitLab managed Terraform State](https://docs.gitlab.com/ee/user/infrastructure/terraform_state.html) | _none_ (enabled) |

| `TF_GITLAB_BACKEND_DISABLED`| Set to `true` to disable [GitLab managed Terraform State](https://docs.gitlab.com/ee/user/infrastructure/terraform_state.html) | _none_ (enabled) |

| `TF_PROJECT_DIR`         | Terraform project root directory        | `.`               |

| `TF_SCRIPTS_DIR`         | Terraform (hook) scripts base directory (relative to `$TF_PROJECT_DIR`) | `.` |

| `TF_OUTPUT_DIR`          | Terraform output directory (relative to `$TF_PROJECT_DIR`). Everything generated in this directory will be kept as job artifacts. | `tf-output` |
@@ -167,10 +167,10 @@ Here are variables supported to configure review environments: 


| Name                     | description                            | default value     |

| ------------------------ | -------------------------------------- | ----------------- |

| `TF_REVIEW_ENABLED`      | Set to enable your `review` environments | _none_ (disabled) |

| `TF_REVIEW_ENABLED`      | Set to `true` to enable your `review` environments | _none_ (disabled) |

| `TF_REVIEW_EXTRA_OPTS`   | Terraform extra options for `review` env (applies to all Terraform commands) | `$TF_EXTRA_OPTS` |

| `TF_REVIEW_INIT_OPTS`    | Terraform extra [init options](https://www.terraform.io/docs/cli/commands/init.html) for `review` env | `$TF_INIT_OPTS` |

| `TF_REVIEW_PLAN_ENABLED` | Set to enable separate Terraform plan job for `review` env. | _none_ (disabled) |

| `TF_REVIEW_PLAN_ENABLED` | Set to `true` to enable separate Terraform plan job for `review` env. | _none_ (disabled) |

| `TF_REVIEW_PLAN_OPTS`    | Terraform extra [plan options](https://www.terraform.io/docs/cli/commands/plan.html) for `review` env | _none_ |

| `TF_REVIEW_APPLY_OPTS`   | Terraform extra [apply options](https://www.terraform.io/docs/cli/commands/apply.html) for `review` env | `$TF_APPLY_OPTS` |

| `TF_REVIEW_DESTROY_OPTS` | Terraform extra [destroy options](https://www.terraform.io/docs/cli/commands/destroy.html) for `review` env | `$TF_DESTROY_OPTS` |
@@ -185,10 +185,10 @@ Here are variables supported to configure the integration environment: 


| Name                     | description                            | default value     |

| ------------------------ | -------------------------------------- | ----------------- |

| `TF_INTEG_ENABLED`      | Set to enable your `integration` env | _none_ (disabled) |

| `TF_INTEG_ENABLED`      | Set to `true` to enable your `integration` env | _none_ (disabled) |

| `TF_INTEG_EXTRA_OPTS`   | Terraform extra options for `integration` env (applies to all Terraform commands) | `$TF_EXTRA_OPTS` |

| `TF_INTEG_INIT_OPTS`    | Terraform extra [init options](https://www.terraform.io/docs/cli/commands/init.html) for `integration` env | `$TF_INIT_OPTS` |

| `TF_INTEG_PLAN_ENABLED` | Set to enable separate Terraform plan job for `integration` env. | _none_ (disabled) |

| `TF_INTEG_PLAN_ENABLED` | Set to `true` to enable separate Terraform plan job for `integration` env. | _none_ (disabled) |

| `TF_INTEG_PLAN_OPTS`    | Terraform extra [plan options](https://www.terraform.io/docs/cli/commands/plan.html) for `integration` env | _none_ |

| `TF_INTEG_APPLY_OPTS`   | Terraform extra [apply options](https://www.terraform.io/docs/cli/commands/apply.html) for `integration` env | `$TF_APPLY_OPTS` |

| `TF_INTEG_DESTROY_OPTS` | Terraform extra [destroy options](https://www.terraform.io/docs/cli/commands/destroy.html) for `integration` env | `$TF_DESTROY_OPTS` |
@@ -204,10 +204,10 @@ Here are variables supported to configure the staging environment: 


| Name                     | description                            | default value     |

| ------------------------ | -------------------------------------- | ----------------- |

| `TF_STAGING_ENABLED`      | Set to enable your `staging` env | _none_ (disabled) |

| `TF_STAGING_ENABLED`      | Set to `true` to enable your `staging` env | _none_ (disabled) |

| `TF_STAGING_EXTRA_OPTS`   | Terraform extra options for `staging` env (applies to all Terraform commands) | `$TF_EXTRA_OPTS` |

| `TF_STAGING_INIT_OPTS`    | Terraform extra [init options](https://www.terraform.io/docs/cli/commands/init.html) for `staging` env | `$TF_INIT_OPTS` |

| `TF_STAGING_PLAN_ENABLED` | Set to enable separate Terraform plan job for `staging` env. | _none_ (disabled) |

| `TF_STAGING_PLAN_ENABLED` | Set to `true` to enable separate Terraform plan job for `staging` env. | _none_ (disabled) |

| `TF_STAGING_PLAN_OPTS`    | Terraform extra [plan options](https://www.terraform.io/docs/cli/commands/plan.html) for `staging` env | _none_ |

| `TF_STAGING_APPLY_OPTS`   | Terraform extra [apply options](https://www.terraform.io/docs/cli/commands/apply.html) for `staging` env | `$TF_APPLY_OPTS` |

| `TF_STAGING_DESTROY_OPTS` | Terraform extra [destroy options](https://www.terraform.io/docs/cli/commands/destroy.html) for `staging` env | `$TF_DESTROY_OPTS` |
@@ -222,10 +222,10 @@ Here are variables supported to configure the production environment: 


| Name                     | description                            | default value     |

| ------------------------ | -------------------------------------- | ----------------- |

| `TF_PROD_ENABLED`      | Set to enable your `production` env | _none_ (disabled) |

| `TF_PROD_ENABLED`      | Set to `true` to enable your `production` env | _none_ (disabled) |

| `TF_PROD_EXTRA_OPTS`   | Terraform extra options for `production` env (applies to all Terraform commands) | `$TF_EXTRA_OPTS` |

| `TF_PROD_INIT_OPTS`    | Terraform extra [init options](https://www.terraform.io/docs/cli/commands/init.html) for `production` env | `$TF_INIT_OPTS` |

| `TF_PROD_PLAN_ENABLED` | Set to enable separate Terraform plan job for `production` env. | `true` (enabled) |

| `TF_PROD_PLAN_ENABLED` | Set to `true` to enable separate Terraform plan job for `production` env. | `true` (enabled) |

| `TF_PROD_PLAN_OPTS`    | Terraform extra [plan options](https://www.terraform.io/docs/cli/commands/plan.html) for `production` env | _none_ |

| `TF_PROD_APPLY_OPTS`   | Terraform extra [apply options](https://www.terraform.io/docs/cli/commands/apply.html) for `production` env | `$TF_APPLY_OPTS` |
@@ -311,7 +311,7 @@ Examples: 
| Name                  | description                              | default value     |

| --------------------- | ---------------------------------------- | ----------------- |

| `TF_TFLINT_IMAGE`     | the Docker image used to run tflint      | `wata727/tflint`  |

| `TF_TFLINT_DISABLED`  | Set to disable tflint                    | _none_ (enabled)  |

| `TF_TFLINT_DISABLED`  | Set to `true` to disable tflint                    | _none_ (enabled)  |

| `TF_TFLINT_ARGS`      | tflint extra [options and args](https://github.com/terraform-linters/tflint/#usage) | _none_ |



### `tfsec` job
@@ -321,7 +321,7 @@ Examples: 
| Name                  | description                              | default value     |

| --------------------- | ---------------------------------------- | ----------------- |

| `TF_TFSEC_IMAGE`      | the Docker image used to run tfsec       | `tfsec/tfsec-ci`  |

| `TF_TFSEC_ENABLED`    | Set to enable tfsec                      | _none_ (disabled) |

| `TF_TFSEC_ENABLED`    | Set to `true` to enable tfsec                      | _none_ (disabled) |

| `TF_TFSEC_ARGS`       | tfsec options and args                   | `.`               |



### `checkov` job
@@ -331,5 +331,5 @@ Examples: 
| Name                  | description                              | default value     |

| --------------------- | ---------------------------------------- | ----------------- |

| `TF_CHECKOV_IMAGE`    | the Docker image used to run checkov     | `bridgecrew/checkov` |

| `TF_CHECKOV_ENABLED`  | Set to enable checkov                    | _none_ (disabled) |

| `TF_CHECKOV_ENABLED`  | Set to `true` to enable checkov                    | _none_ (disabled) |

| `TF_CHECKOV_ARGS`     | checkov [options and args](https://www.checkov.io/2.Basics/CLI%20Command%20Reference.html) | `--directory .` |

templates/gitlab-ci-terraform.yml

+27 −27
Original line number Diff line number Diff line
@@ -297,7 +297,7 @@ stages: 
    # dump terraform version

    terraform --version



    if [[ -z "$TF_GITLAB_BACKEND_DISABLED" ]]

    if [[ "$TF_GITLAB_BACKEND_DISABLED" != "true" ]]

    then

      # impl inspired by GitLab Terraform image script

      # see https://gitlab.com/gitlab-org/terraform-images/-/blob/master/src/bin/gitlab-terraform.sh
@@ -465,7 +465,7 @@ stages: 
    fi

  }



  if [[ -z "$TEMPLATE_CHECK_UPDATE_DISABLED" ]]; then check_for_update terraform "1.1.2"; fi

  if [[ "$TEMPLATE_CHECK_UPDATE_DISABLED" != "true" ]]; then check_for_update terraform "1.1.2"; fi

  unscope_variables

  eval_secrets
@@ -508,7 +508,7 @@ stages: 
  extends: .tf-base

  stage: infra

  script:

    - if [[ "$ENV_PLAN_ENABLED" ]] && [[ "$ENV_PLAN_ENABLED" != "false" ]]; then tfplan="${ENV_TYPE}.tfplan"; fi

    - if [[ "$ENV_PLAN_ENABLED" == "true" ]]; then tfplan="${ENV_TYPE}.tfplan"; fi

    - tf_apply "${ENV_APPLY_OPTS:-$TF_APPLY_OPTS}" "${ENV_EXTRA_OPTS:-$TF_EXTRA_OPTS}" "$tfplan"

  artifacts:

    name: "$CI_JOB_NAME artifacts from $CI_PROJECT_NAME on $CI_COMMIT_REF_SLUG"
@@ -570,9 +570,9 @@ tf-tfsec: 
      when: never

    # on any branch: when $TFSEC_ENABLED is set

    # on production or integration branches: auto

    - if: '$TF_TFSEC_ENABLED && ($CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF)'

    - if: '$TF_TFSEC_ENABLED == "true" && ($CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF)'

    # else (development branches): allow failure

    - if: $TF_TFSEC_ENABLED

    - if: '$TF_TFSEC_ENABLED == "true"'

      allow_failure: true



tf-tflint:
@@ -598,7 +598,7 @@ tf-tflint: 
  dependencies: []      

  rules:

    # exclude merge requests

    - if: $CI_MERGE_REQUEST_ID || $TF_TFLINT_DISABLED

    - if: '$CI_MERGE_REQUEST_ID || $TF_TFLINT_DISABLED == "true"'

      when: never

    - if: $CI_COMMIT_REF_NAME # useless but prevents GitLab from warning
@@ -629,9 +629,9 @@ tf-checkov: 
      when: never

    # on any branch: when $TF_CHECKOV_ENABLED is set

    # on production or integration branches: auto

    - if: '$TF_CHECKOV_ENABLED && ($CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF)'

    - if: '$TF_CHECKOV_ENABLED == "true" && ($CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF)'

    # else (development branches): allow failure

    - if: $TF_CHECKOV_ENABLED

    - if: '$TF_CHECKOV_ENABLED == "true"'

      allow_failure: true



# =============================================================================
@@ -660,10 +660,10 @@ tf-plan-review: 
    - if: '$CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF'

      when: never

    # exclude if $TF_REVIEW_PLAN_ENABLED unset

    - if: '$TF_REVIEW_PLAN_ENABLED == null || $TF_REVIEW_PLAN_ENABLED == "" || $TF_REVIEW_PLAN_ENABLED == "false"'

    - if: '$TF_REVIEW_PLAN_ENABLED != "true"'

      when: never

    # if $TF_REVIEW_ENABLED: auto

    - if: $TF_REVIEW_ENABLED

    - if: '$TF_REVIEW_ENABLED == "true"'



# create review env (only on feature branches)

tf-review:
@@ -689,10 +689,10 @@ tf-review: 
    - if: '$CI_COMMIT_REF_NAME =~ $PROD_REF || $CI_COMMIT_REF_NAME =~ $INTEG_REF'

      when: never

    # exclude if $TF_REVIEW_ENABLED not set

    - if: '$TF_REVIEW_ENABLED == null || $TF_REVIEW_ENABLED == ""'

    - if: '$TF_REVIEW_ENABLED != "true"'

      when: never

    # if $TF_REVIEW_PLAN_ENABLED unset: auto

    - if: '$TF_REVIEW_PLAN_ENABLED == null || $TF_REVIEW_PLAN_ENABLED == "" || $TF_REVIEW_PLAN_ENABLED == "false"'

    - if: '$TF_REVIEW_PLAN_ENABLED != "true"'

    # else: manual, blocking

    - if: $CI_COMMIT_REF_NAME # useless test, just to prevent GitLab warning

      when: manual
@@ -717,7 +717,7 @@ tf-destroy-review: 
    - if: $CI_COMMIT_TAG

      when: never

    # only on non-production, non-integration branches, with $TF_REVIEW_ENABLED set

    - if: '$TF_REVIEW_ENABLED && $CI_COMMIT_REF_NAME !~ $PROD_REF && $CI_COMMIT_REF_NAME !~ $INTEG_REF'

    - if: '$TF_REVIEW_ENABLED == "true" && $CI_COMMIT_REF_NAME !~ $PROD_REF && $CI_COMMIT_REF_NAME !~ $INTEG_REF'

      when: manual

      allow_failure: true
@@ -744,10 +744,10 @@ tf-plan-integration: 
    - if: '$CI_COMMIT_REF_NAME !~ $INTEG_REF'

      when: never

    # exclude if $TF_INTEG_PLAN_ENABLED unset

    - if: '$TF_INTEG_PLAN_ENABLED == null || $TF_INTEG_PLAN_ENABLED == "" || $TF_INTEG_PLAN_ENABLED == "false"'

    - if: '$TF_INTEG_PLAN_ENABLED != "true"'

      when: never

    # if $TF_INTEG_ENABLED: auto

    - if: $TF_INTEG_ENABLED

    - if: '$TF_INTEG_ENABLED == "true"'



# create integration env (only on develop branch)

tf-integration:
@@ -770,10 +770,10 @@ tf-integration: 
    - if: '$CI_COMMIT_REF_NAME !~ $INTEG_REF'

      when: never

    # exclude if $TF_INTEG_ENABLED not set

    - if: '$TF_INTEG_ENABLED == null || $TF_INTEG_ENABLED == ""'

    - if: '$TF_INTEG_ENABLED != "true"'

      when: never

    # if $TF_INTEG_PLAN_ENABLED unset: auto

    - if: '$TF_INTEG_PLAN_ENABLED == null || $TF_INTEG_PLAN_ENABLED == "" || $TF_INTEG_PLAN_ENABLED == "false"'

    - if: '$TF_INTEG_PLAN_ENABLED != "true"'

    # else: manual, blocking

    - if: $CI_COMMIT_REF_NAME # useless test, just to prevent GitLab warning

      when: manual
@@ -795,7 +795,7 @@ tf-destroy-integration: 
    - if: $CI_MERGE_REQUEST_ID

      when: never

    # only on integration branch(es), with $TF_INTEG_ENABLED set

    - if: '$TF_INTEG_ENABLED && $CI_COMMIT_REF_NAME =~ $INTEG_REF'

    - if: '$TF_INTEG_ENABLED == "true" && $CI_COMMIT_REF_NAME =~ $INTEG_REF'

      when: manual

      allow_failure: true
@@ -822,10 +822,10 @@ tf-plan-staging: 
    - if: '$CI_COMMIT_REF_NAME !~ $PROD_REF'

      when: never

    # exclude if $TF_STAGING_PLAN_ENABLED unset

    - if: '$TF_STAGING_PLAN_ENABLED == null || $TF_STAGING_PLAN_ENABLED == "" || $TF_STAGING_PLAN_ENABLED == "false"'

    - if: '$TF_STAGING_PLAN_ENABLED != "true"'

      when: never

    # if $TF_STAGING_ENABLED: auto

    - if: $TF_STAGING_ENABLED

    - if: '$TF_STAGING_ENABLED == "true"'



# create staging env (only on master branch)

tf-staging:
@@ -848,10 +848,10 @@ tf-staging: 
    - if: '$CI_COMMIT_REF_NAME !~ $PROD_REF'

      when: never

    # exclude if $TF_STAGING_ENABLED not set

    - if: '$TF_STAGING_ENABLED == null || $TF_STAGING_ENABLED == ""'

    - if: '$TF_STAGING_ENABLED != "true"'

      when: never

    # if $TF_STAGING_PLAN_ENABLED unset: auto

    - if: '$TF_STAGING_PLAN_ENABLED == null || $TF_STAGING_PLAN_ENABLED == "" || $TF_STAGING_PLAN_ENABLED == "false"'

    - if: '$TF_STAGING_PLAN_ENABLED != "true"'

    # else: manual, blocking

    - if: $CI_COMMIT_REF_NAME # useless test, just to prevent GitLab warning

      when: manual
@@ -873,7 +873,7 @@ tf-destroy-staging: 
    - if: $CI_MERGE_REQUEST_ID

      when: never

    # only on production branch(es), with $TF_STAGING_ENABLED set

    - if: '$TF_STAGING_ENABLED && $CI_COMMIT_REF_NAME =~ $PROD_REF'

    - if: '$TF_STAGING_ENABLED == "true" && $CI_COMMIT_REF_NAME =~ $PROD_REF'

      when: manual

      allow_failure: true
@@ -897,10 +897,10 @@ tf-plan-production: 
    - if: $CI_COMMIT_TAG

      when: never

    # exclude if $TF_PROD_ENABLED not set

    - if: '$TF_PROD_ENABLED == null || $TF_PROD_ENABLED == ""'

    - if: '$TF_PROD_ENABLED != "true"'

      when: never

    # exclude if $TF_PROD_PLAN_ENABLED not set

    - if: '$TF_PROD_PLAN_ENABLED == null || $TF_PROD_PLAN_ENABLED == "" || $TF_PROD_PLAN_ENABLED == "false"'

    - if: '$TF_PROD_PLAN_ENABLED != "true"'

      when: never

    # enabled on merge requests

    - if: $CI_MERGE_REQUEST_ID
@@ -929,10 +929,10 @@ tf-production: 
    - if: '$CI_COMMIT_REF_NAME !~ $PROD_REF'

      when: never

    # exclude if $TF_PROD_ENABLED not set

    - if: '$TF_PROD_ENABLED == null || $TF_PROD_ENABLED == ""'

    - if: '$TF_PROD_ENABLED != "true"'

      when: never

    # if $TF_PROD_PLAN_ENABLED unset: auto

    - if: '$TF_PROD_PLAN_ENABLED == null || $TF_PROD_PLAN_ENABLED == "" || $TF_PROD_PLAN_ENABLED == "false"'

    - if: '$TF_PROD_PLAN_ENABLED != "true"'

    # else: manual, blocking

    - if: $CI_COMMIT_REF_NAME # useless test, just to prevent GitLab warning

      when: manual