使用 Terraform Code 部署 Azure 基础设施资源是特别受欢迎的,我曾经有写文章分享过利用 Azure DevOps 自动部署 Terraform Code 所描述的 Azure 基础设施资源。但是有些人对于Azure DevOps 可能比较陌生,再加上 Azure DevOps 的 Parallel jobs 付费作业。所以作为替代方案,今天给大家分享如何使用 GitHub Actions 部署 Terraform Code。
Terraform Code 以及Azure CLI 会使用 Azure Service Principle 对 Azure 进行身份认证
关于 Azure Service Principle 的创建大家可以参考:
https://www.cnblogs.com/AllenMaster/p/13065643.html
接下来需要添加以下机密信息
1)AZURE_AD_CLIENT_ID
2)AZURE_AD_CLIENT_SECRET
3)AZURE_AD_TENANT_ID
4)AZURE_SUBSCRIPTION_ID
5)AZURE_CREDENTIALS
其中 AZURE_CREDENTIALS 格式内容如下所示:
{ "clientId": "XXXX", "clientSecret": "XXXX", "subscriptionId": "XXXX", "tenantId": "XXXX" }
将上述信息存储到对应名称的 GitHub Secrets。
在 Terraform 项目根目录创建 terraform.yaml 并保存在以下目录
terraform.yaml 内容如下
name: " using GitHub Action for Terraform Auto CI/CD" on: pull_request: branches: - remote_stats push: branches: - remote_stats env: tf_version: "latest" tf_working_dir: "./src/model/" terraform_rg: "Web_Test_TF_RG" storage_account: "cnbatestorestatefile004" storage_account_container: "terraform-state" key: "cnbate.terraform.stats" jobs: terraform_auto_deploy: name: "Azure CLI Action (secrect created)" env: ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }} ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }} ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }} runs-on: ubuntu-latest environment: production # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest defaults: run: shell: bash steps: - name: "Checkout" uses: actions/checkout@master - name: Azure Login uses: azure/login@v1 with: creds: ${{ secrets.AZURE_CREDENTIALS }} enable-AzPSSession: false environment: azurecloud allow-no-subscriptions: false - name: Azure CLI script uses: azure/CLI@v1 with: creds: ${{ secrets.AZURE_CREDENTIALS }} enable-AzPSSession: false environment: azurecloud allow-no-subscriptions: false azcliversion: 2.30.0 inlineScript: | # create azure resource group az group create --location eastasia --name ${{ env.terraform_rg }} # create azure storage account az storage account create --name ${{ env.storage_account }} --resource-group ${{ env.terraform_rg }} --location eastasia --sku Standard_LRS # create storage account container for tf state az storage container create --name ${{ env.storage_account_container }} --account-name ${{ env.storage_account }} # query storage key and set variable export ARM_ACCESS_KEY=$(az storage account keys list --resource-group ${{env.terraform_rg}} --account-name ${{ env.storage_account }} --query "[?keyName == 'key1'][value]" --output tsv) echo $ARM_ACCESS_KEY - name: "Terraform init azurerm backend" uses: ahmedig/terraform-azurerm-backend@v1 with: azure_credentials: ${{ secrets.AZURE_CREDENTIALS }} resource_group_name: ${{ env.terraform_rg }} container_name: ${{ env.storage_account_container }} storage_account_name: ${{ env.storage_account }} file_name: ${{ env.key }} subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} tf_working_directory: ${{ env.tf_working_dir }} - name: "Terraform Validate" uses: hashicorp/terraform-github-actions@master with: tf_actions_version: ${{ env.tf_version }} tf_actions_subcommand: 'validate' tf_actions_working_dir: ${{ env.tf_working_dir }} env: GITHUB_TOKEN: ${{ secrets.AZURE_CREDENTIALS }} - name: "Terraform Plan" uses: hashicorp/terraform-github-actions@master with: tf_actions_version: ${{ env.tf_version }} tf_actions_subcommand: 'plan' tf_actions_working_dir: ${{ env.tf_working_dir }} env: GITHUB_TOKEN: ${{ secrets.AZURE_CREDENTIALS }} - name: "Terraform Deploy" uses: hashicorp/terraform-github-actions@master with: tf_actions_version: ${{ env.tf_version }} tf_actions_subcommand: 'apply' tf_actions_working_dir: ${{ env.tf_working_dir }} env: GITHUB_TOKEN: ${{ secrets.AZURE_CREDENTIALS }} - name: "Terraform Destroy" uses: hashicorp/terraform-github-actions@master with: tf_actions_version: ${{ env.tf_version }} tf_actions_subcommand: 'destroy' tf_actions_working_dir: ${{ env.tf_working_dir }} env: GITHUB_TOKEN: ${{ secrets.AZURE_CREDENTIALS }}
由于我们在 "terraform.yaml" 中指定指定工作分支 “remote_stats”,当 “remote” 分支发生 “push” 或者 “pull_request” 操作就会触发 GitHub Actions 的 workflows 的运行。所以我们直接推送当前已编辑好的 "terraform.yaml" 文件到 “remote_stats” 分支,并在 GitHub 上查看 workflows 运行结果。
如果需要进一步了解每个步骤都执行了那些操作,可以选择当前 workflow runs
查看每个步骤并其输出内容
查看 Terraform 执行部署计划内容
如需参考详细输出信息,点击以下链接进行查看
https://github.com/yunqian44/Terraform_Cnbate_Traffic_Manager/runs/4740814994?check_suite_focus=true
本期实验,我们学习如何使用 GitHub Actions 自动化的方式实现 Terraform Code 的语法校验、生成部署计划,执行部署计划,销毁部署计划。也为我们在选择自动化部署 Azure 基础设施即代码的解决方案上又增加了新的方案。
GitHub Action 工作流程中设置 Secrets:https://github.com/Azure/actions-workflow-samples/blob/master/assets/create-secrets-for-GitHub-workflows.md
Azure服务主体:https://www.cnblogs.com/AllenMaster/p/13065643.html
GitHub:https://github.com/yunqian44/Terraform_Cnbate_Traffic_Manager