Terraform整合簡單Gitlab CI方案詳解

variables:
  # PHASE: BUILD|DESTROY
  PHASE: DESTROY
#  PROXY: http://squiduser:xxzx789@43.134.199.162:3128
#  PROXY: http://squiduser:xxzx789@43.154.230.17:3128
  REGION: "ap-guangzhou"
  PLAN_JSON: plan.json
  BACKEND_CONF: "backend_oss.conf"
#
before_script:
#  - apk add --no-cache curl git jq
  - apk add --no-cache jq
  - export http_proxy=${SQUID_PROXY}
  - export https_proxy=${SQUID_PROXY}
  - export TENCENTCLOUD_SECRET_KEY=${TENCENTCLOUD_SECRET_KEY}
  - export TENCENTCLOUD_SECRET_ID=${TENCENTCLOUD_SECRET_ID}
  - export TF_REGISTRY_CLIENT_TIMEOUT=120000
  - export CHECKPOINT_TIMEOUT=500000
  - export TF_REGISTRY_DISCOVERY_RETRY=5
  - alias convert_report="jq -r '([.resource_changes[]?.change.actions?]|flatten)|{"create":(map(select(.=="create"))|length),"update":(map(select(.=="update"))|length),"delete":(map(select(.=="delete"))|length)}'"
# 設定快取
cache:
  paths:
    - ${CI_PROJECT_DIR}/.terraform/*
stages:
  - init
  - validate
  - plan
  - deploy
Init:
  image:
    name: hashicorp/terraform:0.14.0
    entrypoint: [""]
  stage: init
  retry:
    max: 2
    when:
      - script_failure
  tags:
    - gitlab-runner-k8s-new
  script:
    - terraform version
    - terraform init -backend-config=${BACKEND_CONF}
  only:
    - dev
Validate:
  image:
    name: hashicorp/terraform:0.14.0
    entrypoint: [""]
  stage: validate
  tags:
    - gitlab-runner-k8s-new
  retry: 2
  script:
    - terraform init -backend-config=${BACKEND_CONF}
    - terraform validate
    - terraform fmt -check -recursive || echo 0
  cache:
    paths:
      - ${CI_PROJECT_DIR}/.terraform/*
    policy: pull
  allow_failure: true
Plan:
  image:
    name: hashicorp/terraform:0.14.0
    entrypoint: [""]
  stage: plan
  retry: 2
  tags:
    - gitlab-runner-k8s-new
  artifacts:
    paths:
      - plan.bin
      - app_config.zip
    expire_in: 2 week
  script:
    - terraform init -backend-config=${BACKEND_CONF}
    - terraform plan -input=false -out=plan.bin -var region=${REGION}
    - terraform show --json "plan.bin" | convert_report > ${PLAN_JSON}
    - cat ${PLAN_JSON}
  only:
    variables:
      - $PHASE == "BUILD"
Apply:
  image:
    name: hashicorp/terraform:0.14.0
    entrypoint: [""]
  when: manual
  stage: deploy
  retry: 2
  tags:
    - gitlab-runner-k8s-new
  script:
    - terraform init -backend-config=${BACKEND_CONF}
    - terraform apply -auto-approve -input=false plan.bin
  only:
    variables:
      - $PHASE == "BUILD"
  environment:
    name: snunv
Destroy:
  image:
    name: hashicorp/terraform:0.14.0
    entrypoint: [""]
  stage: deploy
  retry: 2
  tags:
    - gitlab-runner-k8s-new
  script:
    - terraform init -backend-config=${BACKEND_CONF}
    - terraform destroy -auto-approve -var region=${REGION}
  only:
    variables:
      - $PHASE == "DESTROY"

provider "tencentcloud" {
  region = var.region
}
terraform {
  required_providers {
    tencentcloud = {
      source  = "registry.terraform.io/tencentcloudstack/tencentcloud"
      version = ">=1.61.5"
    }
  }
  backend "cos" {}
}
# 輸入變數
variable "region" {
  type = string
}
# 再次僅為一個查詢範例
data "tencentcloud_instances" "cvm" {
}
# 輸出
output "result" {
  value = {
    cvm_result = { for k, v in data.tencentcloud_instances.cvm : k => v },
    count      = data.tencentcloud_instances.cvm.instance_list[*]
  }
}

region = "ap-beijing"
bucket = "tfproject-1253329830"
prefix = "samxxxxitlab/dexxxxxt"