如何在VSCode中用Terraform实现含AWS、K8S的CI/CD流水线及单HCL执行

VSCode环境准备 #

• 安装Terraform官方插件：在VSCode扩展市场搜索「Terraform」，安装HashiCorp发布的版本，提供语法高亮、格式化、实时错误提示，降低HCL编写出错概率
• 配置AWS凭证：本地创建~/.aws/credentials文件（Linux/macOS）或C:\Users\<用户名>\.aws\credentials（Windows），填入你的AWS密钥对；也可通过终端设置环境变量：

  export AWS_ACCESS_KEY_ID="你的密钥ID"
  export AWS_SECRET_ACCESS_KEY="你的密钥"
  

• 验证Terraform CLI：本地安装对应系统的Terraform版本，添加到系统PATH，在VSCode终端执行terraform version，确认版本正常输出

单文件HCL编写思路（一键apply实现） #

将所有资源定义在单个main.tf文件中，按逻辑分组编写，以下是核心模块示例：

1. 配置Provider #

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 2.0"
    }
    null = {
      source  = "hashicorp/null"
      version = "~> 3.0"
    }
  }
}

provider "aws" {
  region = "us-east-1" # 替换为你的目标AWS区域
}

# 配置Kubernetes Provider，自动获取EKS集群凭证
data "aws_eks_cluster" "eks" {
  name = "ci-cd-eks-cluster"
}

provider "kubernetes" {
  host                   = data.aws_eks_cluster.eks.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.eks.token
}

data "aws_eks_cluster_auth" "eks" {
  name = data.aws_eks_cluster.eks.name
}

2. AWS基础设施（VPC、EKS、S3、IAM） #

# 创建VPC（简化示例，可按需扩展子网、路由表）
resource "aws_vpc" "ci_cd_vpc" {
  cidr_block = "10.0.0.0/16"
  tags = {
    Name = "ci-cd-vpc"
  }
}

# 创建EKS集群
resource "aws_eks_cluster" "eks" {
  name     = "ci-cd-eks-cluster"
  role_arn = aws_iam_role.eks_cluster_role.arn

  vpc_config {
    subnet_ids = [aws_subnet.ci_cd_subnet.id] # 需提前创建子网或引用现有子网
  }

  tags = {
    Name = "ci-cd-eks-cluster"
  }
}

# 创建EKS节点组
resource "aws_eks_node_group" "eks_nodes" {
  cluster_name    = aws_eks_cluster.eks.name
  node_group_name = "ci-cd-eks-nodes"
  node_role_arn   = aws_iam_role.eks_node_role.arn
  subnet_ids      = [aws_subnet.ci_cd_subnet.id]
  instance_types  = ["t3.medium"]
  desired_size    = 2

  tags = {
    Name = "ci-cd-eks-nodes"
  }
}

# 创建S3桶存储构建产物
resource "aws_s3_bucket" "build_artifacts" {
  bucket = "ci-cd-build-artifacts-${random_string.suffix.result}" # 确保桶名唯一
  tags = {
    Name = "ci-cd-build-artifacts"
  }
}

resource "random_string" "suffix" {
  length  = 5
  special = false
  upper   = false
}

3. K8S部署Jenkins #

# 部署Jenkins Deployment
resource "kubernetes_deployment" "jenkins" {
  metadata {
    name      = "jenkins"
    namespace = "default"
    labels = {
      app = "jenkins"
    }
  }

  spec {
    replicas = 1
    selector {
      match_labels = {
        app = "jenkins"
      }
    }
    template {
      metadata {
        labels = {
          app = "jenkins"
        }
      }
      spec {
        container {
          image = "jenkins/jenkins:lts"
          name  = "jenkins"
          port {
            container_port = 8080
          }
          volume_mount {
            name       = "jenkins-home"
            mount_path = "/var/jenkins_home"
          }
        }
        volume {
          name = "jenkins-home"
          persistent_volume_claim {
            claim_name = "jenkins-pvc"
          }
        }
      }
    }
  }
}

# 创建Jenkins Service（LoadBalancer类型，对外暴露）
resource "kubernetes_service" "jenkins" {
  metadata {
    name      = "jenkins"
    namespace = "default"
  }
  spec {
    selector = {
      app = "jenkins"
    }
    port {
      port        = 8080
      target_port = 8080
    }
    type = "LoadBalancer"
  }
}

4. 触发CI/CD初始化（用null_resource执行命令） #

# 执行Maven打包命令（假设代码在本地路径）
resource "null_resource" "maven_build" {
  provisioner "local-exec" {
    command = "cd /path/to/your/maven-project && mvn clean package"
  }
  depends_on = [kubernetes_service.jenkins]
}

# 用Ansible配置Jenkins插件和流水线任务
resource "null_resource" "ansible_config_jenkins" {
  provisioner "local-exec" {
    command = "ansible-playbook -i ${aws_instance.jenkins.private_ip}, jenkins-config-playbook.yml"
  }
  depends_on = [null_resource.maven_build]
}

VSCode中运行Terraform步骤 #

1. 在VSCode中新建文件，命名为main.tf，粘贴上述代码并替换占位内容（如AWS区域、代码路径等）
2. 打开VSCode内置终端，执行：

   terraform init
   

   初始化项目，下载所需的Terraform Provider
3. 执行预览命令，检查资源创建计划：

   terraform plan
   

4. 确认计划无误后，执行一键部署：

   terraform apply
   

   输入yes确认，等待所有资源创建完成

常见问题排查 #

• HCL CLI执行失败：检查Terraform版本与Provider版本兼容性，用aws sts get-caller-identity验证AWS凭证是否有效
• Jenkins无法访问：检查AWS安全组是否开放8080端口，K8S Service的LoadBalancer是否分配了公网IP，EKS节点子网是否开启公网访问
• 单文件代码维护问题：若后续需要扩展，可将不同模块拆分到单独文件（如aws.tf、k8s.tf），Terraform会自动合并所有.tf文件的配置

内容的提问来源于stack exchange，提问作者Malachi