Enable the Terraform Integration Stage in Armory Continuous Deployment

Overview of enabling Terraform Integration

Enabling the Terraform Integration stage consists of these steps:

1. Configure Armory CD
2. Enable Terraform Integration
3. Apply the update

Compatibility

Before you begin

• You have read the Terraform Integration Overview.
• You are running Armory Continuous Deployment.
• You manage your instance using the Armory Operator.

Terraform Integration is a built-in feature of Armory CD.

If you are running open source Spinnaker, see the Terraform Integration Overview for installation paths based on whether you are using Halyard or the Spinnaker Operator.

Terraform Integration requirements

• Basic auth credentials for the Git repository where your store your Terraform scripts. The Terraform Integration plugin needs access to credentials to download directories that house your Terraform templates.
  • You can configure your Git repo with any of the following:
    • A Personal Access Token (potentially associated with a service account).
    • SSH protocol in the form of an SSH key or an SSH key file
    • Basic auth in the form of a user and password, or a user-password file
• A source for Terraform Input Variable files (tfvar) or a backend config. You must have a separate artifact provider that can pull your tfvar file(s). The Terraform Integration plugin supports the following artifact providers for tfvar files and backend configs:
  • GitHub
  • BitBucket
  • HTTP artifact
• A dedicated external Redis instance
  • Armory requires configuring a dedicated external Redis instance for production usage of the Terraform Integration plugin. This is to ensure that you do not encounter scaling or stability issues in production.

Configure Armory CD

Configure Redis

Terraform Integration uses Redis to store Terraform logs and plans.

You can only configure the Terraform Integration feature to use a password with the default Redis user.

Configure Redis settings in your Armory CD configuration and then apply your changes.

• spinnaker-kustomize-patches
• spinnakerservice.yml

profiles:
    redis:
      baseUrl: "<your-redis-url>"
      password: "<your-redis-password>"

spec:
  spinnakerConfig:
    profiles:
      terraformer:
        redis:
          baseUrl: "<your-redis-url>"
          password: "<your-redis-password>"

Configure your artifact account

The Terraform Integration uses the following artifact accounts:

• Git Repo - To fetch the repo housing your main Terraform files.
• GitHub, BitBucket or HTTP - Optional. To fetch single files such as var-files or backend config files.

Spinnaker uses the Git Repo Artifact Provider to download the repo containing your main Terraform templates. For more configuration options, see Configure a Git Repo Artifact Account.

• spinnaker-kustomize-patches
• spinnakerservice.yml

spec:
  spinnakerConfig:
    config:
      armory:
        terraform:
          enabled: true
      artifacts:
        gitrepo:
          enabled: true
          accounts:
            - name: gitrepo
              username: <username> 
              token: <git-token> 
              # password:
              # tokenFile: 
              # usernamePasswordFile: 
              # sshPrivateKeyFilePath:
              # sshPrivateKeyPassphrase:
              # sshKnownHostsFilePath: 
              # sshTrustUnknownHosts: 

spec:
  spinnakerConfig:
    profiles:
      clouddriver:
        artifacts:
          gitRepo:
            enabled: true
            accounts:
            - name: gitrepo
              token: <your-personal-access-token>

Configure additional repos

You need to modify spinnaker-kustomize-patches/armory/features/patch-terraformer.yml. Configure additional artifacts in the spec.spinnakerConfig.config.artifacts section.

This step is optional.

• Configure Optional Repos:
• GitHub
• Bitbucket

spec:
  spinnakerConfig:
    config:
      artifacts:
        github:
          accounts:
          - name: <github-for-terraform> 
            token: <your-github-personal-access-token>
          enabled: true

spec:
  spinnakerConfig:
    config:
      artifacts:
        bitbucket:
          enabled: true
          accounts:
          - name: <bitbucket-for-terraform>
            username: <your-bitbucket-username>
            password: <your-bitbucket-password>

Enable Terraform Integration

• spinnaker-kustomize-patches
• spinnakerservice.yml

patchesStrategicMerge:
  - armory/features/patch-terraformer.yml

spec:
  spinnakerConfig:
    config:
      armory:
        terraform:
          enabled: true

Apply the update

After you finish your Terraform Integration configuration, apply your changes. Confirm that the Terraform Integration service (Terraformer) is deployed with your Armory CD deployment:

kubectl get pods -n <your-spinnaker-namespace>

In the command output, look for a line similar to the following:

spin-terraformer-d4334g795-sv4vz    2/2     Running            0          0d

What’s next

• Configure Terraform Integration optional features
• Use the Terraform Integration stage