-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Store TF Vars in a Storage Container
- Loading branch information
1 parent
63e805b
commit 316dfca
Showing
7 changed files
with
201 additions
and
14 deletions.
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| #!/bin/bash | ||
|
|
||
| # exit on failures | ||
| set -e | ||
| set -o pipefail | ||
|
|
||
| usage() { | ||
| echo "Usage: $(basename "$0") [OPTIONS]" 1>&2 | ||
| echo " -h - help" | ||
| echo " -a <storage_account> - Azure Storage Account name" | ||
| echo " -c <storage_container> - Azure Storage Container name" | ||
| echo " -f <tfvars_filename> - Name of the tfvars file with file extension" | ||
| exit 1 | ||
| } | ||
|
|
||
| # if there are not arguments passed exit with usage | ||
| if [ $# -eq 0 ] | ||
| then | ||
| usage | ||
| fi | ||
|
|
||
| while getopts "a:c:f:h" opt; do | ||
| case $opt in | ||
| a) | ||
| STORAGE_ACCOUNT_NAME=$OPTARG | ||
| ;; | ||
| c) | ||
| STORAGE_CONTAINER_NAME=$OPTARG | ||
| ;; | ||
| f) | ||
| TFVARS_FILE_NAME=$OPTARG | ||
| ;; | ||
| h) | ||
| usage | ||
| ;; | ||
| *) | ||
| usage | ||
| ;; | ||
| esac | ||
| done | ||
|
|
||
| if [[ | ||
| -z "$STORAGE_ACCOUNT_NAME" || | ||
| -z "$STORAGE_CONTAINER_NAME" || | ||
| -z "$TFVARS_FILE_NAME" | ||
| ]] | ||
| then | ||
| usage | ||
| fi | ||
|
|
||
| set +e | ||
| STORAGE_CHECK=$(az storage blob list --account-name "$STORAGE_ACCOUNT_NAME" --container-name "$STORAGE_CONTAINER_NAME" 2>&1) | ||
| set -e | ||
|
|
||
| if ! jq -r >/dev/null 2>&1 <<< "$STORAGE_CHECK" | ||
| then | ||
| exit 0 | ||
| fi | ||
|
|
||
| LAST_UPDATED=$(jq -r \ | ||
| --arg name "$TFVARS_FILE_NAME" \ | ||
| '.[] | select(.name==$name) | .properties.lastModified' \ | ||
| <<< "$STORAGE_CHECK") | ||
|
|
||
| if [ -z "$LAST_UPDATED" ] | ||
| then | ||
| exit 0 | ||
| fi | ||
|
|
||
| LAST_UPDATED=$(echo "$LAST_UPDATED" | cut -d'+' -f1) | ||
| LAST_UPDATED_SECONDS=$(date -j -f "%Y-%m-%dT%H:%M:%S" "$LAST_UPDATED" "+%s") | ||
|
|
||
| if [ "$LAST_UPDATED_SECONDS" -gt "$(date -r "$TFVARS_FILE_NAME" +%s)" ] | ||
| then | ||
| echo "" | ||
| echo "" | ||
| echo "Error: Your local tfvars file is older than the remote!" | ||
| echo "" | ||
| echo "Ensure you have the latest tfvars by running:" | ||
| echo "" | ||
| echo " mv $TFVARS_FILE_NAME $TFVARS_FILE_NAME.old" | ||
| echo " az storage blob download \\" | ||
| echo " --file $TFVARS_FILE_NAME \\" | ||
| echo " --container-name $STORAGE_CONTAINER_NAME \\" | ||
| echo " --account-name $STORAGE_ACCOUNT_NAME \\" | ||
| echo " --name $TFVARS_FILE_NAME" | ||
| echo "" | ||
| echo "Or if you are sure your local tfvars are correct, just update the modified time by running:" | ||
| echo "" | ||
| echo " touch $TFVARS_FILE_NAME" | ||
| echo "" | ||
| exit 1 | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| resource "azurerm_storage_account" "tfvars" { | ||
| name = "${replace(local.resource_prefix, "-", "")}tfvars" | ||
| resource_group_name = local.resource_prefix | ||
| location = local.azure_location | ||
| account_tier = "Standard" | ||
| account_replication_type = "LRS" | ||
| min_tls_version = "TLS1_2" | ||
| enable_https_traffic_only = true | ||
| public_network_access_enabled = true | ||
|
|
||
| tags = local.tags | ||
| } | ||
|
|
||
| resource "azurerm_storage_container" "tfvars" { | ||
| name = "${local.resource_prefix}-tfvars" | ||
| storage_account_name = azurerm_storage_account.tfvars.name | ||
| container_access_type = "private" | ||
| } | ||
|
|
||
| resource "azurerm_storage_blob" "tfvars" { | ||
| name = local.tfvars_filename | ||
| storage_account_name = azurerm_storage_account.tfvars.name | ||
| storage_container_name = azurerm_storage_container.tfvars.name | ||
| type = "Block" | ||
| source = local.tfvars_filename | ||
| content_md5 = filemd5(local.tfvars_filename) | ||
| access_tier = "Cool" | ||
| } | ||
|
|
||
| resource "azurerm_storage_account_network_rules" "tfvars" { | ||
| storage_account_id = azurerm_storage_account.tfvars.id | ||
| default_action = length(local.tfvars_access_ipv4) > 0 ? "Deny" : "Allow" | ||
| bypass = [] | ||
| virtual_network_subnet_ids = [] | ||
| ip_rules = local.tfvars_access_ipv4 | ||
| } | ||
|
|
||
| resource "null_resource" "tfvars" { | ||
| provisioner "local-exec" { | ||
| interpreter = ["/bin/bash", "-c"] | ||
| command = "./scripts/check-tfvars-against-remote.sh -c \"${azurerm_storage_container.tfvars.name}\" -a \"${azurerm_storage_account.tfvars.name}\" -f \"${local.tfvars_filename}\"" | ||
| } | ||
|
|
||
| triggers = { | ||
| tfvar_file_md5 = filemd5(local.tfvars_filename) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters