CredentialsPlugin should support unique credentials for different TerraformEnvironmentStages

[kmanning]

• This is work broken out of Issue CredentialsPlugin should be applied to every Stage, not just BuildStage #192

[kmanning]

From @dkolb :

Overview

Currently Credentials Plugin only supports the build stage and Username/Password credentail types.

The current use case I have requires mapping credentials onto TF_VAR_blah environment variables in the environment stages. Furthermore, some of these credentials are of the string() type of DSL call. Finally, some of these credentials differ between individual environment stage.

Current Workarounds

Currently I'm moving to decorating each stage directly in the Jenkinsfile for now.

def validate   = new TerraformValidateStage()
def deployDev  = new TerraformEnvironmentStage('dev')

deployDev.decorate(TerraformEnvironmentStage.ALL, { closure ->
  withCredentials([
    usernamePassword(
      credentialsId: 'some-user'
      usernameVariable: 'TF_VAR_some_user',
      passwordVariable: 'TF_VAR_some_passord'
    ),
    string(
      credentialsId: 'some-secret',
      variable: 'TF_VAR_some_secret'
    )
  ]) {
    closure()
  }
})

validate
  .then(deployDev)
  .build()

[dkolb]

(Migrated from the issue I didn't notice you closed)

At the risk of being less DRY perhaps credentials and environment variables should be a first-class object you apply to a particular stage instance rather than a plugin?

It seems mapping various "things" into the environment of each stage is something that needs to be directly supported through a common interface on the stages themselves than being deferred to the plugin system.

[kmanning]

I think you're right - the more I think about it, the more it feels like a first-class object.

I think you're right that decorate is currently the closest thing to such a common interface for generically modifying any stage in any arbitrary way.

I started carving out a common interface, and immediately hit a snag with TerraformEnvironmentStage - you can decorate specific areas (plan/apply), which is different from TerraformValidateStage/Build/Regression, where you basically just decorate the whole-thing/one-thing.

The common interface could be decorate(Closure closure) (ALL), and decorate(String specificPart, Closure closure), but the second method doesn't make a whole lot of sense for non-TerraformEnvironmentStages. It's not the worst thing in the world, but already is feeling 'icky'