1

I want to separate my development stages in the TerraForm repository.

The TerraForm workspaces page states:

"Workspaces alone are not a suitable tool for system decomposition, because each subsystem should have its own separate configuration and backend, and will thus have its own distinct set of workspaces."

However, many tutorials, like this one state:

"There are two primary methods to separate state between environments: (...) and workspaces."

Those two statements seem to be in contradiction. Could someone explain what the best practice is for stage separation? Currently I plan to use separate directories:

├── prod
│   ├── main.tf (referencing the modules)
│   ├── variables.tf
│   ├── terraform.tfstate
│   └── terraform.tfvars
├── dev
│   ├── main.tf (referencing the modules)
│   ├── variables.tf
│   ├── terraform.tfstate
│   └── terraform.tfvars
└── modules
   ├── module A
   └── module B

1 Answer 1

1

I don't think there are any best practices because it would depend on both your company structure as well as how your developers manage their code in SCM (gitflow, trunk, etc).

Lets start with the statements that seem to be in contradiction. I think quoted like that they do seem to tell a different story. But lets look at the start of the paragraph where the first quote came from.

When Terraform is used to manage larger systems, teams should use multiple separate Terraform configurations that correspond with suitable architectural boundaries within the system so that different components can be managed separately and, if appropriate, by distinct teams.

So it's saying that when you have multiple teams using the same terraform directory (aka configuration) then...

Workspaces alone are not a suitable tool for system decomposition, because each subsystem should have its own separate configuration and backend, and will thus have its own distinct set of workspaces.

Which makes sense. Each team will need different things from their workspace and since all the teams will be sharing workspaces then it kinda falls apart. So in conclusion, different directories and workspaces can be used to separate environments in Terraform but they have certain limitations. In the tutorial you linked, I think it's explained even better:

To separate environments with potential configuration differences, use a directory structure. Use workspaces for environments that do not greatly deviate from one another, to avoid duplicating your configurations.

The second part of your question about recommendations can get somewhat complicated depending on what level of CICD and automation your company currently has. If your infra is small and the number of changes every month is pretty minimal then it's probably fine to just checkout the code, make the change and deploy it locally.

But if you are a large organization with 100's of changes a week, then you are probably going to want to automate the deployments. A common way of doing that is to trigger CICD on new PR's or changes to certain branches. From there you can have your CICD engine change workspaces based on the branch name. Or more commonly for older companies who used Terraform before workspaces existed, you can just set the state path to something like ${env}/tf.state because that really has the same effect as just using workspaces.

I'm a Terraform and terratest contribtutor. I'm also the author of cf2tf and the terraform-module-template.

1
  • Thanks for your reply Levi. Eventually we went for separate directories containing separate statefiles, which works quite well for us.
    – Salmon
    Jul 22, 2022 at 12:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.