Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated gitignore and added terraform lock files #27

Merged
merged 1 commit into from
Dec 6, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 39 additions & 4 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,5 +1,40 @@
**/.terraform
**/terraform.tfstate
**/terraform.tfstate.backup
# Local .terraform directories
**/.terraform/*

# .tfstate files
*.tfstate
*.tfstate.*

# Crash log files
crash.log
crash.*.log

# Exclude all .tfvars files, which are likely to contain sensitive data, such as
# password, private keys, and other secrets. These should not be part of version
# control as they are data points which are potentially sensitive and subject
# to change depending on the environment.
*.tfvars
Comment on lines +12 to +15
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure this is always true though. The original idea about introducing tfvars files is that we want to keep some default values in version control and avoid going through repetitive questions on each TF run. Devs should make sensible decisions on not checking in sensitive data but only encrypted data. Following this gitignoring, can the current terraform.tfvars files be renamed to sth like terraform.tfvars.example as still being instructive?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The current terraform.tfvars that have been checked in and committed won't be ignored, but new .tfvars files will.
Shouldn't the default values be provided in variables.tf files?
People make mistakes, it's better to systematically try to prevent it from happening instead of relying on people to be careful.
Yes we can have a terraform.tfvars.example file and ask people to copy it to terraform.tfvars when deploying, we're doing this in RADAR-Kubernetes with base.yaml file.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes but variables.tf won't memorise values the user typed in during the first run. On consecutive runs, the user needs to type in the same values again and again if they forget (or don't want) to update the default values in variables.tf.

Great and it sounds terraform.tfvars.example could be the middle ground.

Copy link
Collaborator Author

@keyvaann keyvaann Dec 6, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In our own deployment I've created a terraform.tfvars file on the top level of this repo and run terraform commands with -var-file=../terraform.tfvars argument. I suspected that the S3 or Hashicorp backend also stores this file in a secure location but I haven't looked into them yet.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool. In that case, how can other Devs see the terraform.tfvars and your change to it if *.tfvars is ignored?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alright. We are not using a top-level terraform.tfvars and hence I believe it is safe to merge this.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How to you manage your terraform.tfvars file?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Our terraform.tfvars files only contain non-sensitive values so they are version-controlled in the private repo for each cluster.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it just a private fork of this repository with the terraform.tfvars committed to git?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, each cluster has its own forked private repo.

*.tfvars.json

# Ignore override files as they are usually used to override resources locally and so
# are not checked in
override.tf
override.tf.json
*_override.tf
*_override.tf.json

# Ignore transient lock info files created by terraform apply
.terraform.tfstate.lock.info

# Include override files you do wish to add to version control using negated pattern
# !example_override.tf

# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
# example: *tfplan*

# Ignore CLI configuration files
.terraformrc
terraform.rc

misc/experimental
.DS_Store
.DS_Store
122 changes: 122 additions & 0 deletions cluster/.terraform.lock.hcl

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

82 changes: 82 additions & 0 deletions config/.terraform.lock.hcl

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading