Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
21

Terraform supports adding an additional file with variables during invocation. documentation: https://www.terraform.io/intro/getting-started/variables.html#from-a-file We are using that feature to provide a secrets.tfvars file on each invocation of Terraform. We also use a script to wrap the command so that its invocation is consistent, and all team ...


19

Cloud-init files are essentially bootstrap codes, that run before each startup, and can - among others - modify files, set up services, create users, etc. Not all types of droplets support all functionalities of cloud-init, for example CoreOS uses it's own implementation, with a very limited subset of valid values. To use this in terraform, simply provide ...


19

There is currently no full solution to this integrated into Terraform, but there are some building blocks that could be useful to assist in writing tests in a separate programming language. Terraform produces state files in JSON format that can, in principle, be used by external programs to extract certain data about what Terraform created. While this ...


12

Not really. The standard way to work around this though is to use eg: terraform apply -target=aws_security_group.my_sg but that's only going to apply one security group at a time, so will get tedious if you have a lot of them. You can, however, target multiple resources in one command: terraform apply -target=aws_security_group.my_sg -target=...


10

The desired_capacity in Terraform is marked in the documentation as optional. So with a proper min_size value, Terraform can wait until the minimum capacity is reached before continuing. The above, with the addition of scale policy can effectively manage capacity without being specific about desired_capacity in your Terraform code. This will prevent you ...


10

As an update to this question, there is now Kitchen-Terraform which allows the testing of Terraform Configuration files without breaking production environments. The repository also includes a few examples for different Terraform providers.


10

The old volume is never detached because skip_destroy = true. From the terraform docs: skip_destroy - (Optional, Boolean) Set this to true if you do not wish to detach the volume from the instance to which it is attached at destroy time, and instead just remove the attachment from Terraform state. This is useful when destroying an instance which has ...


8

We recently open sourced Terratest, our swiss army knife for testing infrastructure code. Today, you're probably testing all your infrastructure code manually by deploying, validating, and undeploying. Terratest helps you automate this process: Write tests in Go. Use helpers in Terratest to execute your real IaC tools (e.g., Terraform, Packer, etc.) to ...


8

We avoid terraform handle our secrets. Even if you manage to inject secrets by a var file "secrtes.tfvars" as pointed out above, these secrets will be stored in your terraform (remote-)state. You can protect remote-state files by using e.g. S3 authorization, or you can gitignore local state files but we decided not to rely on this kind of protection.


8

There are a few different ways to achieve goals of this sort, each with some different tradeoffs. I'm going to describe the most common ones below. The simplest approach is to use Terraform's create_before_destroy mechanism with autoscaling groups. An example of this pattern is included in the aws_launch_configuration documentation. In this scenario, ...


7

It all depends on how you are deploying your code. (First, IMHO, I don't think that Terraform is the right hammer for this operation. Terraform responsibility is to build the necessary infrastructure for your application, not to be the tool used for deploying it. But, as always, "the right/best one" will depend on lots of factors and, depending on the case/...


6

For an auto-scaling-group this is the most concise syntax available. For most other resources you use the tags syntax which looks like: tags { Key1 = "value1" Key2 = "value2" }


6

Part of adopting the Immutable Infrastructure Pattern is decomposing your system into small manageable pieces that can move through CI/CD Pipeline very quickly, this means that OS patches can be done quickly and in a controlled manner. I often see clients ending up with a halfway house where infrastructure is mostly immutable. However, there are a few ...


5

There are, as always, a few ways to solve this. You can use a central source to keep secrets that each server reads from ala Hashicorp Vault. While popular this is not my preferred approach as its rather complex. There are quite a few key value stores that can provide similar functionality such as AWS Parameter Store. You can manually put data in these ...


5

An idea key to your question is that of immutable infrastructure, which is the idea that an image is built once, deployed many times, and never changed at runtime. If the contents of the image need to change, an entirely new image is built from scratch and new instances replace the ones running the old image. This is the opposite of what you might now call ...


5

On Aws-Side there is https://github.com/k1LoW/awspec - it should be possible, to feed in terraform.state and test, wheter terraform applied correct. But I think, beyond testing on low level the tool, you used, it's probably a better idea, to think about how to test whole infrastructures. We're discussing around this idea here: https://github.com/...


5

When you create an Auto Scaling group with Terraform, you can specify the user_data to be used by instances created by this ASG. Documented here - https://www.terraform.io/docs/providers/aws/r/launch_configuration.html#user_data You can also create a single EC2 instance, and provide user_data to be used - https://www.terraform.io/docs/providers/aws/r/...


5

You may use matchbox on a VM as you do on a baremetal machine, you won't be able to use packer on a baremetal machine ont he other hand as it doesn't handle any PXE boot option. That said, leveraging vSphere/AWS/ API/cli to create a new machine from a template is usually quicker and more effective than using the API/cli to create the VM and then make it ...


5

So let's imagine you have 20 microservices, each in a separate repository. Each microservice needs to be deployed into 5+ environments: dev local, dev cloud, test, staging, prod. Understandably all configuration will be different in each environment. However, you don't need to put it into the Dockerfile - in fact you don't put any configuration into the ...


4

If you're on AWS, then have a look at "The Right Way to Manage Secrets" by Segment.io on the AWS Blog. We advocate using chamber to all of our customers for managing secrets. It works by leveraging the AWS Systems Manager Parameter Store (SSM) together with KMS keys. This ensures secrets are encrypted at rest (and in transit), secured with IAM, auditable ...


4

According to the article you linked, Team Resources are shared. This means that all droplets (hosts) are shared across the team once you have a team in place. source: https://www.digitalocean.com/community/tutorials/how-to-use-teams-on-digitalocean#team-resources This means that each team member, using his own personal token, can manage all the resources ...


4

In addition to all the other options mentioned, I would like to mention that InSpec 2.0 added support for cloud provider APIs. Basically, you can continue writing the IaC with Terraform, then write compliancy checks with InSpec for your cloud resources. In addition, InSpec supports writing tests for individual machines if you ever need it. Here is an ...


4

The layout of your repository depends in many ways upon the context you are developing the automation in. If, for example, you are building out the infrastructure for a product as part of a product team, then it would make sense to tie the infrastructure to the product - i.e. keep the infrastructure in the same repository as the software source code. If ...


4

So what happens in first case is, as Dan's already said, there's no shell used and as such nothing to expand the ~. Quoting the documentation about program: Terraform does not execute the program through a shell On the second case, bash receive in stdin something like this: { "-c": "ssh-keygen -y -f ~/.ssh/id_rsa" } And this looks like a command block ...


3

Turns out this was not a real issue. My apologies. At the end of that shell script, it did an echo which is what was returning the non-zero status code. After I took that out, it worked as expected.


3

To import secrets into .tf files, you can also use an external data source. This could be e.g. a script which decrypts your secrets.


3

Image generation and distribution quickly rises to O(n^2) or higher, and as terraform is explicitly focused on instantiation it relies on external provisioners for internal state. It will work at a smaller scale, but will greatly complicate a hybrid-cloud model and will have problems if the systems are long lived. It also tends to cause difficulties with ...


3

You can use a remote backend as a data source. That is working well for us thus far but this project is not very mature and we will likely refactor a time or ten. data "terraform_remote_state" "network" { backend = "s3" config { // some variables related to config would likely go here } } then for the teams not managing the network to consume ...


3

Variables are static, literal inputs to your configuration that come from either the command line or from tfvars files. It is not possible to use interpolations here, since the variable values are processed before interpolation begins in order to make them available to other expressions. If the goal is to define the S3 bucket name in one place and re-use it ...


3

Answered on Slack, the likely first issue here is that the output from openssl req is not a cert, it's a CSR. But there are some other lingering issues here too. It is recommended to use something like Certstrap to do internal cert generation rather than raw openssl commands as the modern standards are quite fiddly.


Only top voted, non community-wiki answers of a minimum length are eligible