如何在DevOps构建YAML中自动调用Terraform输出变量？

问题描述 #

我尝试为以下Terraform输出创建变量，以便在构建定义YAML中使用。我可以手动获取SPN appID和存储访问密钥，但希望将其作为Terraform部署流程的一部分自动获取。使用如下硬编码默认值的变量定义方式不可行，是否有其他实现方法？

variable "client_id" {
  type        = string
  default     = ""
  description = "description"
}

Terraform输出配置 #

服务主体ID输出 #

output "appid_tfazsp" {
  value     = data.azurerm_client_config.current.client_id
  sensitive = true
}

服务主体密码输出 #

output "pass_tfazsp" {
  value     = azuread_service_principal_password.tfazsp.value
  sensitive = true
}

存储账户访问密钥输出 #

data "azurerm_storage_account" "SASPass" {
  name                = var.storageAccount_name
  resource_group_name = azurerm_resource_group.rg_name.name
}

output "storage_account_SASPass" {
  value     = data.azurerm_storage_account.stg.primary_access_key
  sensitive = true
}

原始Azure DevOps构建定义（YAML） #

trigger:
  branches:
    include:
      - main

  paths:
    include:
      - /Azure-Terraform/variables.tf
      - /Azure-Terraform/main.tf
        /Azure-Terraform/ado_variables.tf


pool:
  vmImage: "ubuntu-latest"

variables:
  - group: hawaVB
  - name: state_file
    value: tf-statefile.state

steps:
  - task: ms-devlabs.custom-terraform-tasks.custom-terraform-installer-task.TerraformInstaller@0
    displayName: 'Install Terraform'
  - script: terraform version
    displayName: Terraform Version
  - script:  az login --service-principal -u $(application_id) -p $(SPNPass) --tenant $(tenant_id)
    displayName: 'Log Into Azure'
  - script: terraform init -backend-config=resource_group_name=$(rg_name) -backend-config="storage_account_name=$(storageAccount_name)" -backend-config="container_name=$(cont_name)" -backend-config="access_key=$(SASPass)" -backend-config="key=$(state_file)"
    displayName: "Terraform Init"
    workingDirectory: $(System.DefaultWorkingDirectory)/Azure-Terraform
  - script: terraform plan -var="client_id=$(application_id)" -var="SPNPass=$(SPNPass)" -var="tenant_id=$(tenant_id)" -var="subscription_id=$(subscription_id)" -var="VmAdminPass=$(VmAdminPass)" -out="out.plan"
    displayName: Terraform Plan
    workingDirectory: $(System.DefaultWorkingDirectory)/Azure-Terraform
  - script: terraform apply out.plan
    displayName: 'Terraform Apply'
    workingDirectory: $(System.DefaultWorkingDirectory)/Azure-Terraform

尝试更新后的Pipeline配置 #

trigger:
  branches:
    include:
      - main

  paths:
    include:
      - /TFAZ/variables.tf
      - /TFAZ/main.tf

pool:
  vmImage: "windows-latest"

variables:
  - group: hawaVB
  
steps:
  - task: ms-devlabs.custom-terraform-tasks.custom-terraform-installer-task.TerraformInstaller@0
    displayName: 'Install Terraform'
  - script: terraform version
    displayName: Terraform Version
  - task: PowerShell@1
    inputs:
      targetType: 'inline'
      script: |
        Write-Host "##vso[task.setvariable variable=storage_account_SASPass;isOutput=true]$(terraform output -raw outputvar)"
        
        Write-Host "##vso[task.setvariable variable=pass_tfazsp;isOutput=true]$(terraform output -raw outputvar)"
        
        Write-Host "##vso[task.setvariable variable=appid_tfazsp;isOutput=true]$(terraform output -raw outputvar)"
      workingDirectory: $(System.DefaultWorkingDirectory)/TFAZ

  - script: az login --service-principal -u $(appid_tfazsp) -p $(pass_tfazsp) --tenant $(tenant_id)
    displayName: 'Log Into Azure'
  - script: terraform init -backend-config=resource_group_name=$(rg_name) -backend-config="storage_account_name=$(storageAccount_name)" -backend-config="container_name=$(cont_name)" -backend-config="access_key=$(storage_account_SASPass)" -backend-config="key=$(state_file)"
    displayName: "Terraform Init"
    workingDirectory: $(System.DefaultWorkingDirectory)/TFAZ
  - script: terraform plan -var=$(appid_tfazsp) -var="$(pass_tfazsp)" -var="tenant_id=$(tenant_id)" -var="subscription_id=$(subscription_id)" -var=$(VMAdminPass) -out="out.plan"
    displayName: Terraform Plan
    workingDirectory: $(System.DefaultWorkingDirectory)/TFAZ
  - script: terraform apply out.plan
    displayName: 'Terraform Apply'
    workingDirectory: $(System.DefaultWorkingDirectory)/TFAZ

内容的提问来源于stack exchange，提问作者HSar