如何用Terraform激活GitLab项目CI/CD并配置环境变量？

问题描述 #

我对GitLab CI/CD和Terraform尚不熟悉，目标是通过Terraform创建一个GitLab项目，完成配置后可运行流水线，且需为流水线配置环境变量。编写的Terraform代码如下：

# CONFIGURE GITLAB PROVIDER
terraform {
  required_providers {
    gitlab = {
      source  = "gitlabhq/gitlab"
      version = "15.9.0"
    }
  }
}

provider "gitlab" {
  token    = var.gitlab_token
  base_url = var.gitlab_base_url
}

# ADD PROJECT OWNED BY USER
resource "gitlab_project" "example" {
  name                        = "example-project"
  description                 = "Example project created with Terraform"
}

# ENVIRONMENT VARIABLES
resource "gitlab_project_variable" "ARM_CLIENT_ID" {
  project           = gitlab_project.example.id
  key               = "ARM_CLIENT_ID"
  value             = var.azure_client_id
  protected         = false
  environment_scope = "*"
  masked            = true
  depends_on = [
    gitlab_project.example
  ]
}

执行后项目可正常创建，但环境变量创建失败，报错信息：

│ Error: POST https://gitlab.***.de/api/v4/projects/8917/variables: 403 {message: 403 Forbidden}
│ 
│   with gitlab_project_variable.ARM_CLIENT_ID,
│   on gitlab_project.tf line 41, in resource "gitlab_project_variable" "ARM_CLIENT_ID":
│   41: resource "gitlab_project_variable" "ARM_CLIENT_ID" {

只有手动激活该项目的CI/CD选项后，才能成功创建CI/CD环境变量。请问是否可以通过Terraform激活GitLab项目的CI/CD功能？

解决方法 #

可以通过Terraform直接激活GitLab项目的CI/CD功能，只需在gitlab_project资源中添加builds_enabled = true参数即可。

修改后的项目资源代码如下：

# ADD PROJECT OWNED BY USER
resource "gitlab_project" "example" {
  name                        = "example-project"
  description                 = "Example project created with Terraform"
  builds_enabled              = true # 开启CI/CD构建功能
}

原理说明 #

GitLab项目默认情况下CI/CD构建功能是关闭的（builds_enabled参数默认值为false），此时调用API创建CI/CD环境变量会因权限限制返回403错误。添加builds_enabled = true后，Terraform会在创建项目时自动开启CI/CD功能，后续的环境变量资源就能正常创建，无需手动操作。

另外，gitlab_project_variable资源通过project = gitlab_project.example.id已经隐式依赖了项目资源，所以可以删除depends_on块，Terraform会自动按依赖顺序执行创建流程。

内容的提问来源于stack exchange，提问作者JayDi