Terragrunt+HashiCorp Vault无法从根目录初始化依赖，需单独在子目录操作

背景 #

我是Terraform和Terragrunt新手，使用HashiCorp Vault存储Azure服务主体，通过Terragrunt部署基础设施。

资源与依赖关系 #

• 涉及模块：资源组（RG）、VM、VNET、Vault
• 依赖链：
  • RG 依赖 Vault
  • VNet 依赖 RG
  • VM 依赖 RG 和 VNet

当前问题 #

在根目录执行terragrunt init时会卡在「initialising state」状态，原因是无法获取Vault模块的输出；但先在Vault-tf子目录执行terragrunt init和apply后，根目录的terragrunt init和apply即可正常执行，成功创建所有Azure资源。

仓库结构 #

（原提问附有仓库结构示意图）

配置代码 #

根目录terragrunt.hcl #

dependency "credentials" {
config_path = "/root/terragrunt-new/BaseConfig/Vault-tf"

mock_outputs = {
tenant_id = "temp-tenant-id"
client_id = "temp-client-id"
client_secret = "temp-secret-id"
subscription_id = "temp-subscription-id"
}
}

terraform {
source = "git::https://git link to modules//"

extra_arguments "force_subscription" {
    commands = [
    "init",
    "apply",
    "destroy",
    "refresh",
    "import",
    "plan",
    "taint",
    "untaint"
    ]
env_vars = {
     ARM_TENANT_ID     = dependency.credentials.outputs.tenant_id
     ARM_CLIENT_ID     = dependency.credentials.outputs.client_id
     ARM_CLIENT_SECRET = dependency.credentials.outputs.client_secret
     ARM_SUBSCRIPTION_ID = dependency.credentials.outputs.subscription_id
    }
}
}

inputs = {
prefix = "terragrunt-nbux"
location = "centralus"
}

locals {
subscription_id = "xxxxxxxxxx-cc3e-4014-a891-xxxxxxxxxx"
}

generate "versions" {
path = "versions_override.tf"
if_exists = "overwrite_terragrunt"
contents = <<EOF
terraform {
required_providers {
azurerm = {
source = "hashicorp/azurerm"
version = "3.9.0"
}
vault = {
source = "hashicorp/vault"
version = "3.7.0"
}
}
}

provider "vault" {
   address = "http://xx.xx.xx.xx:8200"
   skip_tls_verify = true
   token = "hvs.xxxxxxxxxxxxxxxxx"
}

provider "azurerm" {
    features {}
}
EOF
}

remote_state {
backend = "azurerm"
config = {
subscription_id = "${local.subscription_id}"
key = "${path_relative_to_include()}/terraform.tfstate"
resource_group_name = "rg-terragrunt-vault"
storage_account_name = "terragruntnbuxstorage"
container_name = "base-config-tfstate"
}
generate = {
path = "backend.tf"
if_exists = "overwrite_terragrunt"
}
}

Vault-tf子目录terragrunt.hcl #

terraform {
  source = "git::https:path/terragrunt-new//Modules/Vault"
}

generate "versions" {
  path      = "versions_override.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
    terraform {
      required_providers {
      
        vault = {
          source = "hashicorp/vault"
          version = "3.7.0"
        }
      }
    }
    
    provider "vault" {
       address = "http://xx.xx.xx.xx:8200"
       skip_tls_verify = true
       token = "hvs.xxxxxxxxxxxxxxxxxxxxI"
    }
EOF
}

内容的提问来源于stack exchange，提问作者Ruta Borkar