57 lines
2 KiB
YAML
57 lines
2 KiB
YAML
|
steps:
|
||
|
|
- name: gcr.io/cloud-builders/git
|
||
|
|
args:
|
||
|
|
- '-c'
|
||
|
|
- 'git clone ${_GIT_REPO} repo --depth 1'
|
||
|
|
entrypoint: bash
|
||
|
|
- name: hashicorp/terraform
|
||
|
|
args:
|
||
|
|
- init
|
||
|
|
- '-backend-config=bucket=${_TF_BACKEND_BUCKET}'
|
||
|
|
- '-backend-config=prefix=${_TF_BACKEND_PREFIX}'
|
||
|
|
dir: repo/terraform
|
||
|
|
- name: hashicorp/terraform
|
||
|
|
args:
|
||
|
|
- plan
|
||
|
|
- '-var=project-id=${PROJECT_ID}'
|
||
|
|
- '-var=buildkite-api-token-readonly=$$BUILDKITE_API_TOKEN_READONLY'
|
||
|
|
- '-var=buildkite-agent-token=$$BUILDKITE_AGENT_TOKEN'
|
||
|
|
- '-var=conduit-api-token=$$CONDUIT_API_TOKEN'
|
||
|
|
- '-var=git-id-rsa=$$GIT_ID_RSA'
|
||
|
|
- '-var=id-rsa-pub=$$ID_RSA_PUB'
|
||
|
|
- '-var=git-known-hosts=$$GIT_KNOWN_HOSTS'
|
||
|
|
- '-out=/workspace/tfplan-${BUILD_ID}'
|
||
|
|
secretEnv:
|
||
|
|
- 'BUILDKITE_API_TOKEN_READONLY'
|
||
|
|
- 'BUILDKITE_AGENT_TOKEN'
|
||
|
|
- 'CONDUIT_API_TOKEN'
|
||
|
|
- 'GIT_ID_RSA'
|
||
|
|
- 'ID_RSA_PUB'
|
||
|
|
- 'GIT_KNOWN_HOSTS'
|
||
|
|
dir: repo/terraform
|
||
|
|
# - name: hashicorp/terraform
|
||
|
|
# args:
|
||
|
|
# - apply
|
||
|
|
# - '-auto-approve'
|
||
|
|
# - /workspace/tfplan-${BUILD_ID}
|
||
|
|
# dir: repo/terraform
|
||
|
|
substitutions:
|
||
|
|
_GIT_REPO: $(body.project.git_http_url)
|
||
|
|
_TF_BACKEND_BUCKET: 'terraform-state-${PROJECT_ID}'
|
||
|
|
_TF_BACKEND_PREFIX: terraform/state
|
||
|
|
availableSecrets:
|
||
|
|
secretManager:
|
||
|
|
- versionName: 'projects/${PROJECT_ID}/secrets/buildkite-api-token-readonly/versions/latest'
|
||
|
|
env: 'BUILDKITE_API_TOKEN_READONLY'
|
||
|
|
- versionName: 'projects/${PROJECT_ID}/secrets/buildkite-agent-token/versions/latest'
|
||
|
|
env: 'BUILDKITE_AGENT_TOKEN'
|
||
|
|
- versionName: 'projects/${PROJECT_ID}/secrets/conduit-api-token/versions/latest'
|
||
|
|
env: 'CONDUIT_API_TOKEN'
|
||
|
|
- versionName: 'projects/${PROJECT_ID}/secrets/git-id-rsa/versions/latest'
|
||
|
|
env: 'GIT_ID_RSA'
|
||
|
|
- versionName: 'projects/${PROJECT_ID}/secrets/id-rsa-pub/versions/latest'
|
||
|
|
env: 'ID_RSA_PUB'
|
||
|
|
- versionName: 'projects/${PROJECT_ID}/secrets/git-known-hosts/versions/latest'
|
||
|
|
env: 'GIT_KNOWN_HOSTS'
|
||
|
|
options:
|
||
|
|
dynamic_substitutions: true
|