terraform-toolkit.yml

---
variables:
  DOCKER_DRIVER: "overlay2"
  DOCKER_TLS_CERTDIR: "/certs"

.job_template: &job_template
  before_script:
    - terraform --version
  tags:
    - docker
    - miquido
  cache:
    paths:
      - "**/.terraform"

.get-latest-terraform:
  stage: .pre
  tags:
    - docker
    - miquido
  before_script:
    - apk add jq
    - apk add curl
  script:
    - |
      if [ -z ${GITHUB_TOKEN+x} ];
        then
          echo "GITHUB_TOKEN is unset";
          echo "TF_VERSION=1.0.0" >> build.env
        else
          TF_VERSION=$(curl -H "Authorization: token $GITHUB_TOKEN" \
            https://api.github.com/repos/hashicorp/terraform/releases/latest \
                  | jq --raw-output '.tag_name' | cut -c 2-)
        echo "Latest terraform version = $TF_VERSION"
        echo "TF_VERSION=$TF_VERSION" >> build.env
      fi
  artifacts:
    reports:
      dotenv: build.env

.check-formatting:
  <<: *job_template
  image:
    name: hashicorp/terraform:$TF_VERSION
    entrypoint:
      - "/usr/bin/env"
      - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  variables:
    TF_VERSION: 1.3.7
  script:
    - terraform fmt -check -recursive

#### Deprecated
.validate:
  <<: *job_template
  variables:
    ENVIRONMENTS: prod
    TF_VERSION: 1.3.7
  image:
    name: miquido/terraform:$TF_VERSION
    entrypoint:
      - "/usr/bin/env"
      - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
  script:
    - echo "WARNING! .validate is deprecated and will be removed. Use .validate-terraform instead"
    # yamllint disable rule:line-length
    - |
      IFS=' ' #setting space as delimiter
      read -ra ENVIRONMENTS <<<"$ENVIRONMENTS"
      for ENVIRONMENT in "${ENVIRONMENTS[@]}"
      do
        cd "$ENVIRONMENT"
        git config --global \url."https://${GITLAB_TERRAFORM_DEPLOY_TOKEN_USERNAME}:${GITLAB_TERRAFORM_DEPLOY_TOKEN_SECRET}@gitlab.com/miquido/terraform".insteadOf "ssh://git@gitlab.com/miquido/terraform"
        git config --global url."https://github.com".insteadOf "ssh://git@github.com"
        terraform init -backend=false
        terraform validate
        cd -
      done
    # yamllint enable rule:line-length

.validate-terraform:
  variables:
    ENVIRONMENTS: prod
    TF_VERSION: 1.3.7
  image:
    name: hashicorp/terraform:$TF_VERSION
    entrypoint:
      - ""
  script:
    - git config --global \url."https://${GITLAB_TERRAFORM_DEPLOY_TOKEN_USERNAME}:${GITLAB_TERRAFORM_DEPLOY_TOKEN_SECRET}@gitlab.com/miquido/terraform".insteadOf "ssh://git@gitlab.com/miquido/terraform"  # yamllint disable-line rule:line-length
    - git config --global url."https://github.com".insteadOf "ssh://git@github.com"
    - apk add python3
    - apk add --update py-pip
    - python3 -m venv venv
    - source venv/bin/activate
    - pip install miquido_terraform_environments_check
    - python3 -m miquido_terraform_environments_check
  tags:
    - miquido
    - docker

.generate_readme:
  image: ubuntu:latest
  before_script:
    - apt update
    - apt install make
    - apt install curl -y
    - apt install git -y
  script:
    - make init
    - make readme
  artifacts:
    paths:
      - README.md
  rules:
    - if: $CI_COMMIT_BRANCH
  tags:
    - miquido
    - docker

.oidc-login-tf:
  script:
    - \[ ! -n "ROLE_ARN" \] && echo "Missing ROLE_ARN variable. Exiting" && exit 1
    - \[ ! -n "GITLAB_OIDC_TOKEN" \] && echo "Missing GITLAB_OIDC_TOKEN variable. Exiting" && exit 1
    - >
      export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
      $(aws sts assume-role-with-web-identity
      --role-arn ${ROLE_ARN}
      --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
      --web-identity-token ${GITLAB_OIDC_TOKEN}
      --duration-seconds 3600
      --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
      --output text))


.tf-plan:
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.com
  variables:
    PLAN: plan.cache
    PLAN_JSON: plan.json
    ROLE_ARN: $TF_ROLE_ARN
    TF_VERSION: "1.5"
  image:
    name: hashicorp/terraform:$TF_VERSION
    entrypoint: [""]
  before_script:
    # yamllint disable rule:line-length
    - apk add --no-cache aws-cli
    - !reference [.oidc-login-tf, script]
    - cd $TF_ROOT
    - cp $SECRETS secrets.auto.tfvars || true
    - apk add jq
    - alias convert_report="jq -r '([.resource_changes[]?.change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'"
  script:
    - terraform init -backend-config=password=${BACKEND_STATE_TOKEN} -backend-config=username=gitlab-ci-token
    - terraform plan -out=$PLAN
    - terraform show --json $PLAN | convert_report > $PLAN_JSON
  artifacts:
    paths:
      - ${TF_ROOT}/plan.cache
      - ${TF_ROOT}/.terraform.lock.hcl
    reports:
      terraform: ${TF_ROOT}/$PLAN_JSON
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: on_success
  tags:
    - miquido
    - docker

.tf-apply:
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.com
  variables:
    PLAN: plan.cache
    PLAN_JSON: plan.json
    TF_VERSION: "1.5"
    ROLE_ARN: $TF_ROLE_ARN
  image:
    name: hashicorp/terraform:$TF_VERSION
    entrypoint: [""]
  before_script:
    - apk add --no-cache aws-cli
    - !reference [.oidc-login-tf, script]
    - cd $TF_ROOT
    - cp $SECRETS secrets.auto.tfvars || true
    - apk add jq
  script:
    - aws sts get-caller-identity
    - terraform init -reconfigure -backend-config=password=${BACKEND_STATE_TOKEN} -backend-config=username=gitlab-ci-token
    - terraform apply $PLAN
  artifacts:
    paths:
      - ${TF_ROOT}/plan.cache
      - ${TF_ROOT}/.terraform.lock.hcl
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: on_success
  tags:
    - miquido
    - docker

.tf-destroy:
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.com
  variables:
    PLAN: plan.cache
    PLAN_JSON: plan.json
    TF_VERSION: "1.5"
    ROLE_ARN: $TF_ROLE_ARN
  image:
    name: hashicorp/terraform:$TF_VERSION
    entrypoint: [""]
  before_script:
    - apk add -u --no-cache aws-cli
    - !reference [.oidc-login-tf, script]
    - cd $TF_ROOT
    - cp $SECRETS secrets.auto.tfvars || true
    - apk add jq
  script:
    - aws sts get-caller-identity
    - terraform init -reconfigure -backend-config=password=${BACKEND_STATE_TOKEN} -backend-config=username=gitlab-ci-token
    - terraform destroy -auto-approve
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual
  tags:
    - miquido
    - docker
  allow_failure: true