[READ-ONLY] Mirror of https://github.com/tiborpilz/infrastructure. Personal Infrastructure managed via terraform & k8s
fix ci
authored by
Tibor Pilz
and committed by
Tibor Pilz
(May 28, 2023, 9:21 AM +0200)
f9bea2ee
3c2f00a7
+144
-19
+121
-16
.gitlab-ci.yml
+121
-16
.gitlab-ci.yml
···
1
+
include:
2
+
- template: Terraform/Base.latest.gitlab-ci.yml
3
+
4
+
workflow:
5
+
rules:
6
+
- if: $CI_MERGE_REQUEST_IID
7
+
changes:
8
+
- .gitlab/ci/Dockerfile
9
+
variables:
10
+
IMAGE_TAG: ${CI_COMMIT_REF_SLUG}
11
+
- when: always
12
+
- if: $CI_MERGE_REQUEST_IID
13
+
- if: $CI_COMMIT_TAG
14
+
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
15
+
16
+
stages:
17
+
- prepare
18
+
- lint
19
+
- init
20
+
- validate
21
+
- build
22
+
- visualize
23
+
24
+
variables:
25
+
IMAGE_TAG: latest
26
+
TF_STATE_BASE_ADDRESS: $CI_API_V4_URL/projects/$CI_PROJECT_ID/terraform/state
27
+
28
+
image: ${CI_REGISTRY_IMAGE}:${IMAGE_TAG}
29
+
30
+
cache:
31
+
key: "${TF_ROOT}"
32
+
paths:
33
+
- ${TF_ROOT}/**/.terraform
34
+
35
+
# Source the gitlab-terraform script so that we get the env vars
36
+
.source:
37
+
script:
38
+
- source $(which gitlab-terraform)
39
+
1
40
.git-crypt:
2
41
before_script:
3
42
- apk add git-crypt
4
43
- echo "$GIT_CRYPT_KEY" | base64 -d > key-file
5
44
- git-crypt unlock key-file
6
45
7
-
.terragrunt:
8
-
extends: .git-crypt
9
-
image: alpine/terragrunt
46
+
# .terragrunt:
47
+
# extends: .git-crypt
48
+
# image: alpine/terragrunt
10
49
11
-
.terraform-parallel:
12
-
extends: .terragrunt
13
-
parallel:
14
-
matrix:
15
-
- SUBFOLDER:
16
-
- metal
17
-
- cluster
18
-
- applications
50
+
prepare:image:
51
+
needs: []
52
+
stage: prepare
53
+
image:
54
+
name: gcr.io/kaniko-project/executor:v1.9.0-debug
55
+
entrypoint: [""]
56
+
rules:
57
+
# Tag with the commit SHA if we're in an MR
58
+
- if: $CI_MERGE_REQUEST_IID
59
+
changes:
60
+
- .gitlab/ci/Dockerfile
61
+
variables:
62
+
DOCKER_TAG: $CI_COMMIT_REF_SLUG
63
+
# If we're on our main branch, tag with "latest"
64
+
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
65
+
changes:
66
+
- .gitlab/ci/Dockerfile
67
+
variables:
68
+
DOCKER_TAG: latest
69
+
before_script:
70
+
# Authenticate to the docker registry and dependency proxy
71
+
- echo "{\"auths\":{\"$CI_REGISTRY\":{\"auth\":\"$(printf "%s:%s" "${CI_REGISTRY_USER}" "${CI_REGISTRY_PASSWORD}" | base64 | tr -d '\n')\"}}}" > /kaniko/.docker/config.json
72
+
script:
73
+
- /kaniko/executor
74
+
--context "${CI_PROJECT_DIR}/.gitlab/ci"
75
+
--cache=true
76
+
--dockerfile "${CI_PROJECT_DIR}/.gitlab/ci/Dockerfile"
77
+
--destination "${CI_REGISTRY_IMAGE}:${DOCKER_TAG}"
78
+
79
+
fmt:
80
+
extends: .terraform:fmt
81
+
stage: lint
82
+
before_script:
83
+
- !reference [.git-crypt, before_script]
84
+
script:
85
+
- !reference [.source, script]
86
+
- terragrunt hclfmt -check -diff
87
+
- terragrunt run-all fmt -check -diff -recursive
88
+
89
+
init:
90
+
stage: init
91
+
before_script:
92
+
- !reference [.git-crypt, before_script]
93
+
script:
94
+
- !reference [.source, script]
95
+
- terragrunt run-all init -input=false -reconfigure -lockfile=readonly
96
+
97
+
validate:
98
+
extends: .terraform:validate
99
+
before_script:
100
+
- !reference [.git-crypt, before_script]
101
+
script:
102
+
- !reference [.source, script]
103
+
- terragrunt validate-inputs
104
+
- terragrunt run-all validate
105
+
106
+
build:
107
+
extends: .terraform:build
108
+
before_script:
109
+
- !reference [.git-crypt, before_script]
110
+
script:
111
+
- !reference [.source, script]
112
+
- terragrunt run-all plan -input=false -out=plan.cache
113
+
- terragrunt run-all show -json plan.cache | jq -r "${JQ_PLAN}" | jq -s 'map(to_entries) | flatten | group_by(.key) | map({(.[0].key):map(.value) | add}) | add' > "${TF_ROOT}/plan.json"
114
+
artifacts:
115
+
paths:
116
+
- ${TF_ROOT}/**/plan.cache
117
+
reports:
118
+
terraform: ${TF_ROOT}/plan.json
19
119
20
120
create_plan:
21
-
extends: .terragrunt
121
+
stage: visualize
122
+
before_script:
123
+
- !reference [.git-crypt, before_script]
22
124
script:
23
125
- cd metal
24
-
- terraform init
25
-
- terraform plan -out=plan.out
26
-
- terraform show -json plan.out > plan.json
126
+
- terragrunt init
127
+
- terragrunt plan -out=plan.out
128
+
- terragrunt show -json plan.out > plan.json
27
129
artifacts:
28
130
paths:
29
131
- metal/plan.json
30
132
31
133
visualize_plan:
134
+
stage: visualize
32
135
dependencies: [create_plan]
33
-
extends: .terragrunt
136
+
extends: .git-crypt
34
137
image: node
138
+
before_script:
139
+
- !reference [.git-crypt, before_script]
35
140
script:
36
141
- cd metal
37
142
- npx -y @terraform-visual/cli --plan plan.json
+13
backend.tf
+13
backend.tf
···
1
+
# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
2
+
terraform {
3
+
backend "http" {
4
+
config = {
5
+
address = "https://gitlab.com/api/v4/projects/39120322/terraform/state/."
6
+
lock_address = "https://gitlab.com/api/v4/projects/39120322/terraform/state/./lock"
7
+
unlock_address = "https://gitlab.com/api/v4/projects/39120322/terraform/state/./lock"
8
+
lock_method = "POST"
9
+
unlock_method = "DELETE"
10
+
retry_wait_min = "5"
11
+
}
12
+
}
13
+
}
+3
-3
terragrunt.hcl
+3
-3
terragrunt.hcl
···
17
17
terraform {
18
18
backend "http" {
19
19
config = {
20
-
address = "https://gitlab.com/api/v4/projects/${local.gitlab_project_id}/terraform/state/${path_relative_to_include()}"
21
-
lock_address = "https://gitlab.com/api/v4/projects/${local.gitlab_project_id}/terraform/state/${path_relative_to_include()}/lock"
22
-
unlock_address = "https://gitlab.com/api/v4/projects/${local.gitlab_project_id}/terraform/state/${path_relative_to_include()}/lock"
20
+
address = "${get_env("TF_STATE_BASE_ADDRESS", "https://gitlab.com/api/v4/projects/${local.gitlab_project_id}/terraform/state")}/${path_relative_to_include()}"
21
+
lock_address = "${get_env("TF_STATE_BASE_ADDRESS", "https://gitlab.com/api/v4/projects/${local.gitlab_project_id}/terraform/state")}/${path_relative_to_include()}/lock"
22
+
unlock_address = "${get_env("TF_STATE_BASE_ADDRESS", "https://gitlab.com/api/v4/projects/${local.gitlab_project_id}/terraform/state")}/${path_relative_to_include()}/lock"
23
23
lock_method = "POST"
24
24
unlock_method = "DELETE"
25
25
retry_wait_min = "5"
+7
.gitlab/ci/Dockerfile
+7
.gitlab/ci/Dockerfile
···
1
+
FROM registry.gitlab.com/gitlab-org/terraform-images/stable:latest
2
+
3
+
# Install Terragrunt
4
+
RUN ( curl -sLo terragrunt "https://github.com/gruntwork-io/terragrunt/releases/download/v0.42.5/terragrunt_linux_amd64" && \
5
+
chmod +x terragrunt && \
6
+
mv terragrunt /usr/local/bin/terragrunt \
7
+
) && terragrunt --version