在Terraform工作空间之间共享资源 [英] Sharing resources between Terraform workspaces

问题描述

我拥有要在AWS中使用Terraform部署的基础架构.该基础架构可以部署到我正在使用工作空间的不同环境中.

部署中的大多数组件应为每个工作区分别创建，但我希望在它们之间共享几个关键组件，主要是:

• IAM角色和权限
• 它们应使用相同的API网关，但每个工作区应部署到不同的路径和方法

例如:

resource "aws_iam_role" "lambda_iam_role" {
  name = "LambdaGeneralRole"
  policy = <...>
}

resource "aws_lambda_function" "my_lambda" {
  function_name = "lambda-${terraform.workspace}"
  role = "${aws_iam_role.lambda_iam_role.arn}"
}

第一个资源是IAM角色，应在该Lambda的所有实例之间共享，并且不应重复创建一次.

第二个资源是Lambda函数，其名称取决于当前的工作空间，因此每个工作空间都将部署并跟踪不同Lambda的状态.

如何在不同的Terraform工作空间之间共享资源及其状态?

解决方案

对于共享资源，我在单独的模板中创建它们，然后在需要有关它们的信息的模板中使用terraform_remote_state对其进行引用.

接下来是我如何实现它，可能还有其他方法可以实现它. YMMV

在共享服务模板(您将在其中放置IAM角色)中，我使用Terraform后端将共享服务模板的输出数据存储在Consul中.您还需要output您要在其他模板中使用的任何信息.

shared_services模板

terraform {
  backend "consul" {
    address = "consul.aa.example.com:8500"
    path    = "terraform/shared_services"
  }
}

resource "aws_iam_role" "lambda_iam_role" {
  name = "LambdaGeneralRole"
  policy = <...>
}

output "lambda_iam_role_arn" {
  value = "${aws_iam_role.lambda_iam_role.arn}"
}

Terraform中的后端"确定如何加载状态以及如何执行诸如apply之类的操作.这种抽象可以实现非本地文件状态存储，远程执行等.

在单个模板中，您可以使用terraform_remote_state调用后端作为数据源，并可以使用该模板中的数据.

terraform_remote_state:

从远程后端检索状态元数据

个人模板

data "terraform_remote_state" "shared_services" {
    backend = "consul"
    config {
        address = "consul.aa.example.com:8500"
        path    = "terraform/shared_services"
    }
}

# This is where you use the terraform_remote_state data source
resource "aws_lambda_function" "my_lambda" {
  function_name = "lambda-${terraform.workspace}"
  role = "${data.terraform_remote_state.shared_services.lambda_iam_role_arn}"
}

参考:

https://www.terraform.io/docs/state/remote.html

https://www.terraform.io/docs/backends/

https://www.terraform.io/docs/providers/terraform/d/remote_state.html

I have an infrastructure I'm deploying using Terraform in AWS. This infrastructure can be deployed to different environments, for which I'm using workspaces.

Most of the components in the deployment should be created separately for each workspace, but I have several key components that I wish to be shared between them, primarily:

• IAM roles and permissions
• They should use the same API Gateway, but each workspace should deploy to different paths and methods

For example:

resource "aws_iam_role" "lambda_iam_role" {
  name = "LambdaGeneralRole"
  policy = <...>
}

resource "aws_lambda_function" "my_lambda" {
  function_name = "lambda-${terraform.workspace}"
  role = "${aws_iam_role.lambda_iam_role.arn}"
}

The first resource is a IAM role that should be shared across all instances of that Lambda, and shouldn't be recreated more than once.

The second resource is a Lambda function whose name depends on the current workspace, so each workspace will deploy and keep track of the state of a different Lambda.

How can I share resources, and their state, between different Terraform workspaces?

解决方案

For the shared resources, I create them in a separate template and then refer to them using terraform_remote_state in the template where I need information about them.

What follows is how I implement this, there are probably other ways to implement it. YMMV

In the shared services template (where you would put your IAM role) I use Terraform backend to store the output data for the shared services template in Consul. You also need to output any information you want to use in other templates.

shared_services template

terraform {
  backend "consul" {
    address = "consul.aa.example.com:8500"
    path    = "terraform/shared_services"
  }
}

resource "aws_iam_role" "lambda_iam_role" {
  name = "LambdaGeneralRole"
  policy = <...>
}

output "lambda_iam_role_arn" {
  value = "${aws_iam_role.lambda_iam_role.arn}"
}

A "backend" in Terraform determines how state is loaded and how an operation such as apply is executed. This abstraction enables non-local file state storage, remote execution, etc.

In the individual template you invoke the backend as a data source using terraform_remote_state and can use the data in that template.

terraform_remote_state:

Retrieves state meta data from a remote backend

individual template

data "terraform_remote_state" "shared_services" {
    backend = "consul"
    config {
        address = "consul.aa.example.com:8500"
        path    = "terraform/shared_services"
    }
}

# This is where you use the terraform_remote_state data source
resource "aws_lambda_function" "my_lambda" {
  function_name = "lambda-${terraform.workspace}"
  role = "${data.terraform_remote_state.shared_services.lambda_iam_role_arn}"
}

References:

https://www.terraform.io/docs/state/remote.html

https://www.terraform.io/docs/backends/

https://www.terraform.io/docs/providers/terraform/d/remote_state.html

这篇关于在Terraform工作空间之间共享资源的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！