Azure DevOps Pipeline中Terraform共享服务连接配置方案问询

你可以通过以下几种方式，在不合并任务或重复编写SPN变量导出代码的前提下，让Terraform Init、Plan、Apply任务共享所需的ARM环境变量：

方案1：使用Azure DevOps管道变量传递 #

利用Azure DevOps的##vso[task.setvariable]命令，在Terraform Init任务中将SPN变量设置为管道级变量，后续任务直接引用这些变量即可。这种方式支持敏感变量加密存储。

修改Terraform Init任务 #

在inlineScript末尾添加变量设置命令，敏感变量需加上issecret=true：

- task: AzureCLI@2
  displayName: "Terraform Init"
  inputs:
    azureSubscription: "datahub-dev-armsc-01"
    scriptType: "bash"
    scriptLocation: "inlineScript"
    inlineScript: |
      echo "Setting up variables"
      export ARM_CLIENT_ID=$servicePrincipalId
      export ARM_CLIENT_SECRET=$servicePrincipalKey
      export ARM_TENANT_ID=$tenantId
      export ARM_SUBSCRIPTION_ID=$(az account show | jq -r .id)
      # 将变量设置为管道变量
      echo "##vso[task.setvariable variable=ARM_CLIENT_ID;issecret=true]$ARM_CLIENT_ID"
      echo "##vso[task.setvariable variable=ARM_CLIENT_SECRET;issecret=true]$ARM_CLIENT_SECRET"
      echo "##vso[task.setvariable variable=ARM_TENANT_ID]$ARM_TENANT_ID"
      echo "##vso[task.setvariable variable=ARM_SUBSCRIPTION_ID]$ARM_SUBSCRIPTION_ID"
      
      cd $(System.DefaultWorkingDirectory)/$(env)/terraform/init
      terraform init \
        -backend-config="client_id=$ARM_CLIENT_ID" \
        -backend-config="client_secret=$ARM_CLIENT_SECRET" \
        -backend-config="tenant_id=$ARM_TENANT_ID" \
        -backend-config="subscription_id=$ARM_SUBSCRIPTION_ID"
  addSpnToEnvironment: true
  failOnStandardError: true

修改Terraform Plan任务 #

直接引用管道变量导出为环境变量，无需重复获取SPN信息：

- task: AzureCLI@2
  displayName: "Terraform Plan"
  inputs:
    azureSubscription: "datahub-dev-armsc-01"
    scriptType: "bash"
    scriptLocation: "inlineScript"
    inlineScript: |
      # 从管道变量导入环境变量
      export ARM_CLIENT_ID=$(ARM_CLIENT_ID)
      export ARM_CLIENT_SECRET=$(ARM_CLIENT_SECRET)
      export ARM_TENANT_ID=$(ARM_TENANT_ID)
      export ARM_SUBSCRIPTION_ID=$(ARM_SUBSCRIPTION_ID)
      
      cd $(System.DefaultWorkingDirectory)/$(env)/terraform/init
      terraform plan -var 'ssh_key_path=${SSHPubKey.secureFilePath}' \
        -var-file=$(System.DefaultWorkingDirectory)/$(env)/terraform/init/init_$(env).tfvars \
        -out=$(System.DefaultWorkingDirectory)/init.plan
  failOnStandardError: true

方案2：封装Shell脚本复用 #

将SPN变量导出逻辑封装成独立的Shell脚本，存到你的Terraform仓库中，后续任务只需source该脚本即可加载变量。

1. 在仓库中创建脚本文件 #

比如创建scripts/set_arm_env.sh：

#!/bin/bash
export ARM_CLIENT_ID=$servicePrincipalId
export ARM_CLIENT_SECRET=$servicePrincipalKey
export ARM_TENANT_ID=$tenantId
export ARM_SUBSCRIPTION_ID=$(az account show | jq -r .id)

2. 修改任务引用脚本 #

在Terraform Init和Plan任务中，添加source命令加载脚本：

# Terraform Init任务修改
- task: AzureCLI@2
  displayName: "Terraform Init"
  inputs:
    azureSubscription: "datahub-dev-armsc-01"
    scriptType: "bash"
    scriptLocation: "inlineScript"
    inlineScript: |
      echo "Setting up variables"
      source $(System.DefaultWorkingDirectory)/scripts/set_arm_env.sh
      
      cd $(System.DefaultWorkingDirectory)/$(env)/terraform/init
      terraform init \
        -backend-config="client_id=$ARM_CLIENT_ID" \
        -backend-config="client_secret=$ARM_CLIENT_SECRET" \
        -backend-config="tenant_id=$ARM_TENANT_ID" \
        -backend-config="subscription_id=$ARM_SUBSCRIPTION_ID"
  addSpnToEnvironment: true
  failOnStandardError: true

# Terraform Plan任务修改
- task: AzureCLI@2
  displayName: "Terraform Plan"
  inputs:
    azureSubscription: "datahub-dev-armsc-01"
    scriptType: "bash"
    scriptLocation: "inlineScript"
    inlineScript: |
      source $(System.DefaultWorkingDirectory)/scripts/set_arm_env.sh
      
      cd $(System.DefaultWorkingDirectory)/$(env)/terraform/init
      terraform plan -var 'ssh_key_path=${SSHPubKey.secureFilePath}' \
        -var-file=$(System.DefaultWorkingDirectory)/$(env)/terraform/init/init_$(env).tfvars \
        -out=$(System.DefaultWorkingDirectory)/init.plan
  addSpnToEnvironment: true # 必须添加，才能让脚本获取到SPN变量
  failOnStandardError: true

方案3：利用AzureCLI任务的environmentVariables参数 #

AzureCLI@2任务支持通过environmentVariables输入直接定义环境变量，无需在脚本中手动export，后续任务可复用相同配置。

修改Terraform Init任务 #

- task: AzureCLI@2
  displayName: "Terraform Init"
  inputs:
    azureSubscription: "datahub-dev-armsc-01"
    scriptType: "bash"
    scriptLocation: "inlineScript"
    inlineScript: |
      cd $(System.DefaultWorkingDirectory)/$(env)/terraform/init
      terraform init \
        -backend-config="client_id=$ARM_CLIENT_ID" \
        -backend-config="client_secret=$ARM_CLIENT_SECRET" \
        -backend-config="tenant_id=$ARM_TENANT_ID" \
        -backend-config="subscription_id=$ARM_SUBSCRIPTION_ID"
  addSpnToEnvironment: true
  environmentVariables: |
    ARM_CLIENT_ID=$servicePrincipalId
    ARM_CLIENT_SECRET=$servicePrincipalKey
    ARM_TENANT_ID=$tenantId
    ARM_SUBSCRIPTION_ID=$(az account show | jq -r .id)
  failOnStandardError: true

修改Terraform Plan任务 #

直接复用环境变量配置：

- task: AzureCLI@2
  displayName: "Terraform Plan"
  inputs:
    azureSubscription: "datahub-dev-armsc-01"
    scriptType: "bash"
    scriptLocation: "inlineScript"
    inlineScript: |
      cd $(System.DefaultWorkingDirectory)/$(env)/terraform/init
      terraform plan -var 'ssh_key_path=${SSHPubKey.secureFilePath}' \
        -var-file=$(System.DefaultWorkingDirectory)/$(env)/terraform/init/init_$(env).tfvars \
        -out=$(System.DefaultWorkingDirectory)/init.plan
  addSpnToEnvironment: true
  environmentVariables: |
    ARM_CLIENT_ID=$servicePrincipalId
    ARM_CLIENT_SECRET=$servicePrincipalKey
    ARM_TENANT_ID=$tenantId
    ARM_SUBSCRIPTION_ID=$(az account show | jq -r .id)
  failOnStandardError: true

内容的提问来源于stack exchange，提问作者Niviral