In my previous ACI automation post, I used Terraform and the credentials were in plain text inside the main.tf file.
I have updated this, so the credentials are stored in GitLab environment variables, which is a much more secure method. The process of the credentials from GitLab to Terraform are as follows;
Create Environment Variables
The environment variables are key/value pairs located under: <Project> >> Settings >> CI/CD >> Variables
Import Variables to GitLab CI File
The .gitlab-ci.yml file will have the variables imported. It will then pass them to each stage by default.
Each variable must be prefixed with TF_VAR_. When passed to Terraform, it will ignore this and just keep the value name.
|
0 1 2 3 4 |
variables: TF_VAR_ACI_PASS: $ACI_PASS TF_VAR_ACI_USER: $ACI_USER |
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 |
# To contribute improvements to CI/CD templates, please follow the Development guide at: # https://docs.gitlab.com/ee/development/cicd/templates.html # This specific template is located at: # https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Terraform.gitlab-ci.yml include: - template: Terraform/Base.gitlab-ci.yml # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Terraform/Base.gitlab-ci.yml - template: Jobs/SAST-IaC.gitlab-ci.yml # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Jobs/SAST-IaC.gitlab-ci.yml variables: TF_VAR_ACI_PASS: $ACI_PASS TF_VAR_ACI_USER: $ACI_USER stages: - validate - test - build - deploy - cleanup fmt: extends: .terraform:fmt needs: [] |
Stages can ignore the variables provided by using a blank variables key. Documentation reference.
|
0 1 2 3 4 5 6 7 8 |
variables: GLOBAL_VAR: "A global variable" job1: variables: {} script: - echo This job does not need any variables |
Import Variables in Terraform
To import the variables into Terraform, the prefixed TF_VAR_ must be removed and a variable must be declared in terraform.
|
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 |
terraform { required_providers { aci = { source = "ciscodevnet/aci" } } } variable "ACI_USER" { type = string } variable "ACI_PASS" { type = string } #configure provider with your cisco aci credentials. provider "aci" { # cisco-aci user name username = var.ACI_USER # cisco-aci password password = var.ACI_PASS # cisco-aci url url = "https://10.10.20.14" insecure = true } |