Azure DevOps YAML流水线多环境触发配置：Sandbox自动触发，Test/Prod手动部署

核心思路 #

• 限制自动触发仅针对master分支，且仅运行Sandbox环境部署
• 通过流水线参数让手动触发时可选择是否部署Test/Prod环境
• 为每个环境的部署阶段添加条件判断，区分自动/手动触发场景

完整YAML配置示例 #

# 流水线名称
name: Infra-Deployment

# 触发规则：仅master分支自动触发
trigger:
  branches:
    include:
      - master
  paths:
    include:
      - terraform/** # 根据实际Terraform代码路径调整

# 手动触发时的参数配置，让用户选择要部署的环境
parameters:
  - name: deploySandbox
    displayName: Deploy to Sandbox?
    type: boolean
    default: true
  - name: deployTest
    displayName: Deploy to Test?
    type: boolean
    default: false
  - name: deployProd
    displayName: Deploy to Prod?
    type: boolean
    default: false

# 变量：可根据环境定义Terraform变量，这里示例用变量组或直接定义
variables:
  - group: Infra-Variables # 假设包含各环境通用变量
  - name: terraformWorkingDir
    value: 'terraform'

stages:
  # Sandbox环境部署阶段
  - stage: Deploy_Sandbox
    displayName: Deploy to Sandbox
    condition: |
      or(
        # 自动触发（master分支合并）时自动运行
        and(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(variables['Build.Reason'], 'IndividualCI')),
        # 手动触发时，如果选中deploySandbox则运行
        and(eq(variables['Build.Reason'], 'Manual'), eq(parameters.deploySandbox, true))
      )
    jobs:
      - job: Terraform_Deploy_Sandbox
        displayName: Terraform Deploy Sandbox
        steps:
          - task: TerraformInstaller@0
            inputs:
              terraformVersion: 'latest'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'init'
              workingDirectory: $(terraformWorkingDir)
              backendServiceArm: 'Azure-Service-Connection' # 替换为你的Azure服务连接
              backendAzureRmResourceGroupName: 'rg-terraform-state' # 替换为你的状态存储资源组
              backendAzureRmStorageAccountName: 'stterraformstate' # 替换为你的状态存储账户
              backendAzureRmContainerName: 'tfstate'
              backendAzureRmKey: 'sandbox.tfstate'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'plan'
              workingDirectory: $(terraformWorkingDir)
              environmentServiceNameAzureRM: 'Azure-Service-Connection'
              commandOptions: '-var-file="sandbox.tfvars"' # 替换为你的Sandbox变量文件

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'apply'
              workingDirectory: $(terraformWorkingDir)
              environmentServiceNameAzureRM: 'Azure-Service-Connection'
              commandOptions: '-var-file="sandbox.tfvars" -auto-approve'

  # Test环境部署阶段
  - stage: Deploy_Test
    displayName: Deploy to Test
    condition: |
      # 仅手动触发且选中deployTest时运行
      and(eq(variables['Build.Reason'], 'Manual'), eq(parameters.deployTest, true))
    jobs:
      - job: Terraform_Deploy_Test
        displayName: Terraform Deploy Test
        steps:
          # 同Sandbox的Terraform步骤，替换对应的变量文件和状态键
          - task: TerraformInstaller@0
            inputs:
              terraformVersion: 'latest'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'init'
              workingDirectory: $(terraformWorkingDir)
              backendServiceArm: 'Azure-Service-Connection'
              backendAzureRmResourceGroupName: 'rg-terraform-state'
              backendAzureRmStorageAccountName: 'stterraformstate'
              backendAzureRmContainerName: 'tfstate'
              backendAzureRmKey: 'test.tfstate'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'plan'
              workingDirectory: $(terraformWorkingDir)
              environmentServiceNameAzureRM: 'Azure-Service-Connection'
              commandOptions: '-var-file="test.tfvars"'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'apply'
              workingDirectory: $(terraformWorkingDir)
              environmentServiceNameAzureRM: 'Azure-Service-Connection'
              commandOptions: '-var-file="test.tfvars" -auto-approve'

  # Prod环境部署阶段
  - stage: Deploy_Prod
    displayName: Deploy to Prod
    condition: |
      # 仅手动触发且选中deployProd时运行
      and(eq(variables['Build.Reason'], 'Manual'), eq(parameters.deployProd, true))
    jobs:
      - job: Terraform_Deploy_Prod
        displayName: Terraform Deploy Prod
        steps:
          # 同Sandbox的Terraform步骤，替换对应的变量文件和状态键
          - task: TerraformInstaller@0
            inputs:
              terraformVersion: 'latest'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'init'
              workingDirectory: $(terraformWorkingDir)
              backendServiceArm: 'Azure-Service-Connection'
              backendAzureRmResourceGroupName: 'rg-terraform-state'
              backendAzureRmStorageAccountName: 'stterraformstate'
              backendAzureRmContainerName: 'tfstate'
              backendAzureRmKey: 'prod.tfstate'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'plan'
              workingDirectory: $(terraformWorkingDir)
              environmentServiceNameAzureRM: 'Azure-Service-Connection'
              commandOptions: '-var-file="prod.tfvars"'

          - task: TerraformTaskV4@4
            inputs:
              provider: 'azurerm'
              command: 'apply'
              workingDirectory: $(terraformWorkingDir)
              environmentServiceNameAzureRM: 'Azure-Service-Connection'
              commandOptions: '-var-file="prod.tfvars" -auto-approve'

关键配置说明 #

1. 触发规则：trigger块仅包含master分支，确保只有代码合并到master时自动触发流水线。
2. 手动参数：parameters定义了三个布尔参数，手动触发流水线时会弹出选项，让用户选择要部署的环境。Test和Prod默认不选中，避免误操作。
3. 阶段条件：
   • Sandbox阶段：两种场景下运行：一是master分支自动触发（代码合并），二是手动触发且用户选中了部署Sandbox。
   • Test/Prod阶段：仅在手动触发且用户明确选中对应参数时才运行，彻底杜绝自动部署到生产类环境。
4. Terraform配置：每个环境使用独立的状态文件（backendAzureRmKey）和变量文件（-var-file），避免环境间状态污染。

额外安全建议 #

为Test/Prod环境添加手动审批，即使手动触发，也需要负责人审批后才能部署，进一步降低风险：

- stage: Deploy_Prod
  displayName: Deploy to Prod
  condition: |
    and(eq(variables['Build.Reason'], 'Manual'), eq(parameters.deployProd, true))
  jobs:
    - deployment: Terraform_Deploy_Prod
      displayName: Terraform Deploy Prod
      environment: 'Prod' # 提前在Azure DevOps中创建Prod环境并配置审批人
      strategy:
        runOnce:
          deploy:
            steps:
              # 这里放Prod的Terraform步骤

内容的提问来源于stack exchange，提问作者itye1970