terraform

Table of Contents

1. Description
2. Requirements
3. Usage

Description

The Terraform plugin module supports looking up target objects from a Terraform state file, applying, destroying and querying outputs from Terraform project directories.

Requirements

You will need to have installed Terraform on the system you wish to run bolt from. The executable must be on the system $PATH.

Inventory plugin usage

The resolve_reference task supports looking up target objects from a Terraform state file. It accepts several fields:

• dir: The directory containing either a local Terraform state file or Terraform configuration to read remote state from. Relative to the active Boltdir unless absolute path is specified.
• resource_type: The Terraform resources to match, as a regular expression.
• state: (Optional) The name of the local Terraform state file to load, relative to dir (defaults to terraform.tfstate).
• backend: (Optional) The type of backend to load the state form, either remote or local (defaults to local).
• target_mapping: A hash of target attributes to populate with resource values (e.g. target_mapping: { name: 'id' }).

The target_mapping parameter requires either a uri or name field. If only uri is set, the value of uri is used as the name.

Examples

groups:
  - name: cloud-webs
    targets:
      - _plugin: terraform
        dir: /path/to/terraform/project1
        resource_type: google_compute_instance.web
        target_mapping:
          uri: network_interface.0.access_config.0.nat_ip
      - _plugin: terraform
        dir: /path/to/terraform/project2
        resource_type: aws_instance.web
        target_mapping:
          uri: public_ip

Multiple resources with the same name are identified as .0, .1, etc.

The path to nested properties must be separated with .: for example, network_interface.0.access_config.0.nat_ip.

For example, the following truncated output creates two targets, named 34.83.150.52 and 34.83.16.240. These targets are created by matching the resources google_compute_instance.web.0 and google_compute_instance.web.1. The uri for each target is the value of their network_interface.0.access_config.0.nat_ip property, which corresponds to the externally routable IP address in Google Cloud.

google_compute_instance.web.0:
  id = web-0
  cpu_platform = Intel Broadwell
  machine_type = f1-micro
  name = web-0
  network_interface.# = 1
  network_interface.0.access_config.# = 1
  network_interface.0.access_config.0.assigned_nat_ip =
  network_interface.0.access_config.0.nat_ip = 34.83.150.52
  network_interface.0.address =
  network_interface.0.name = nic0
  network_interface.0.network = https://www.googleapis.com/compute/v1/projects/cloud-app1/global/networks/default
  network_interface.0.network_ip = 10.138.0.22
  project = cloud-app1
  self_link = https://www.googleapis.com/compute/v1/projects/cloud-app1/zones/us-west1-a/instances/web-0
  zone = us-west1-a
google_compute_instance.web.1:
  id = web-1
  cpu_platform = Intel Broadwell
  machine_type = f1-micro
  name = web-1
  network_interface.# = 1
  network_interface.0.access_config.# = 1
  network_interface.0.access_config.0.assigned_nat_ip =
  network_interface.0.access_config.0.nat_ip = 34.83.16.240
  network_interface.0.address =
  network_interface.0.name = nic0
  network_interface.0.network = https://www.googleapis.com/compute/v1/projects/cloud-app1/global/networks/default
  network_interface.0.network_ip = 10.138.0.21
  project = cloud-app1
  self_link = https://www.googleapis.com/compute/v1/projects/cloud-app1/zones/us-west1-a/instances/web-1
  zone = us-west1-a
google_compute_instance.app.1:
  id = app-1
  cpu_platform = Intel Broadwell
  machine_type = f1-micro
  name = app-1
  network_interface.# = 1
  network_interface.0.access_config.# = 1
  network_interface.0.access_config.0.assigned_nat_ip =
  network_interface.0.access_config.0.nat_ip = 35.197.93.137
  network_interface.0.address =
  network_interface.0.name = nic0
  network_interface.0.network = https://www.googleapis.com/compute/v1/projects/cloud-app1/global/networks/default
  network_interface.0.network_ip = 10.138.0.23
  project = cloud-app1
  self_link = https://www.googleapis.com/compute/v1/projects/cloud-app1/zones/us-west1-a/instances/app-1
  zone = us-west1-a

Setting up Terraform project directories

The initialize task will setup a Terraform project directory with all the appropriate modules and providers needed to execute your configuration. It accepts a single field:

• dir: (Optional) Path to Terraform project directory. Path is relative to CWD, unless an absolute path is specified.

Provisioning resources

The apply task will apply resources and return the logs printed to stdout. It accepts several fields:

• dir: (Optional) Path to Terraform project directory. Path is relative to CWD, unless an absolute path is specified.
• state: (Optional) Path to read and save state. Defaults to terraform.tfstate. Path is relative to dir.
• state_out: (Optional) Path to write state to that is different than state. This can be used to preserve the old state. Path is relative to dir.
• target: (Optional) Resource to target. Operation will be limited to this resource and its dependencies. Accepts a single resource string or an array of resources.
• var: (Optional) Set Terraform variables, expects a hash with key value pairs representing variables and values (NOTE: single quotes ' are incompatible).
• var_file: (Optional) Set variables in the Terraform configuration from a file. Path is relative to dir.

The apply plan will run the apply task against the localhost target and optionally return the result of the output task. It accepts several fields:

• dir: (Optional) Path to Terraform project directory. Path is relative to CWD, unless an absolute path is specified.
• state: (Optional) Path to read and save state. Defaults to terraform.tfstate. Path is relative to dir.
• state_out: (Optional) Path to write state to that is different than state. This can be used to preserve the old state. Path is relative to dir.
• target: (Optional) Resource to target. Operation will be limited to this resource and its dependencies. Accepts a single resource string or an array of resources.
• var: (Optional) Set Terraform variables, expects a hash with key value pairs representing variables and values (NOTE: single quotes ' are incompatible).
• var_file: (Optional) Set variables in the Terraform configuration from a file. Path is relative to dir.
• return_output: (Optional) Return the result of the output task (defualts to false).

The output task will return the result of executing terraform output. It accepts several fields:

• dir: (Optional) Path to Terraform project directory. Path is relative to CWD, unless an absolute path is specified.
• state: (Optional) Path to read and save state. Defaults to terraform.tfstate. Path is relative to dir.

Destroying resources

The destroy task will destroy resources and return the logs printed to stdout. It accepts several fields:

• dir: (Optional) Path to Terraform project directory. Path is relative to CWD, unless an absolute path is specified.
• state: (Optional) Path to read and save state. Defaults to terraform.tfstate. Path is relative to dir.
• state_out: (Optional) Path to write state to that is different than state. This can be used to preserve the old state. Path is relative to dir.
• target: (Optional) Resource to target. Operation will be limited to this resource and its dependencies. Accepts a single resource string or an array of resources.
• var: (Optional) Set Terraform variables, expects a hash with key value pairs representing variables and values (NOTE: single quotes ' are incompatible).
• var_file: (Optional) Set variables in the Terraform configuration from a file. Path is relative to dir.

The destroy plan will run the destroy task against the localhost and return it's result. It accepts several fields:

• dir: (Optional) Path to Terraform project directory. Path is relative to CWD, unless an absolute path is specified.
• state: (Optional) Path to read and save state. Defaults to terraform.tfstate. Path is relative to dir.
• state_out: (Optional) Path to write state to that is different than state. This can be used to preserve the old state. Path is relative to dir.
• target: (Optional) Resource to target. Operation will be limited to this resource and its dependencies. Accepts a single resource string or an array of resources.
• var: (Optional) Set Terraform variables, expects a hash with key value pairs representing variables and values (NOTE: single quotes ' are incompatible).
• var_file: (Optional) Set variables in the Terraform configuration from a file. Path is relative to dir.

Example

In this example plan, resources are applied and then destroyed during plan execution. The outputs from the terraform::apply plan are used to pass as data to a task.

plan example(TargetSpec $targets){
  run_task('terraform::initialize', 'dir' => '/home/cas/working_dir/dynamic-inventory-demo')
  $apply_result = run_plan('terraform::apply', 'dir' => '/home/cas/working_dir/dynamic-inventory-demo', 'return_output' => true)
  run_task('important::stuff', $targets, 'task_var' => $apply_result)
  run_plan('destroy', 'dir' => '/home/cas/working_dir/dynamic-inventory-demo')
}

Release 0.7.0

Added

• New refresh task and plan

  Task executes a terraform refresh to enable updating the state without running an apply, which could potentially destroy resources.

• New refresh_state option added to apply plan

  Will run the terrafrom::refresh task after doing an apply. This allows for situations where resources were modified during the apply and not written to state so a refresh is required to capture them.

Changed

• Puppet 8 Support / Drop Puppet 4 & 5

Release 0.6.1

Bug fixes

• Add PDK as a gem dependency

  PDK is now a gem dependency for the module release pipeline

Release 0.6.0

New features

• Bump maximum Puppet version to include 7.x (#22)

Release 0.5.0

New features

• Set resolve_reference task to private (#14)

  The resolve_reference task has been set to private so it no longer appears in UI lists.

Bug fixes

• Inventory plugin raised an exception when no statefile was found (#16)

  The resolve_reference task would error when no statefile was found. It now returns an empty inventory instead.

Release 0.4.0

New features

• Added initialize task

  There has been a simple initialize task added to the module that can be used to ensure Terraform project directories are initialized with required modules and providers installed so your code runs without manually running terraform init before executing a plan.

Release 0.3.0

New features

• Added target_mapping parameter in resolve_reference task (#1405)

  The resolve_reference task has a new target_mapping parameter that accepts a hash of target attributes and the resource values to populate them with.

• Added state parameter in the resolve_reference task (#1405)

  The statefile parameter for the resolve_reference task has been replaced with a state parameter to maintain consistency among the other tasks and plans in the module.

Bug fixes

• Raise error when remote state cannot be loaded (#1436)

  When attempting to load remote state from a non-existent state file, terraform would return a nil value which would be loaded into the inventory and cause Bolt to error. The terraform plugin now checks whether the attempt to load remote state returned any data and errors if it did not.

Release 0.2.0

Bug fixes

• Expand dir path relative to Boltdir (#1162)

  The dir option will now be expanded relative to the active Boltdir the user is running bolt with, instead of the current working directory they ran Bolt from. This is part of standardizing all configurable paths in Bolt to be relative to the Boltdir.

Release 0.1.0

This is the initial release.