在 Gitlab CI 管道中的每个环境中使用不同的 Azure 订阅 ID

Question

我们有一个 gitlab 管道，我正在尝试将其配置为在每个环境中使用不同的 Azure 订阅，但运气不佳。

基本上我需要做的是根据正在构建的环境将环境变量ARM_CLIENT_ID 、 ARM_CLIENT_SECRET 、 ARM_SUBSCRIPTION_ID 、 ARM_TENANT_ID为不同的值。

在 cicd 设置中，我为development_ARM_SUBSCRIPTION_ID 、 test_ARM_SUBSCRIPTION_ID等设置了变量，其想法是将这些变量的值分配给管道中的 ARM_CLIENT_ID、ARM_CLIENT_SECRET、ARM_SUBSCRIPTION_ID、ARM_TENANT_ID 变量。

这就是我的管道的样子

stages:
  - infrastructure-validate
  - infrastructure-deploy
  - infrastructure-destroy

variables:
    DESTROY_INFRA: "false"
    development_ARM_SUBSCRIPTION_ID: $development_ARM_SUBSCRIPTION_ID
    development_ARM_TENANT_ID: $development_ARM_TENANT_ID
    development_ARM_CLIENT_ID: $development_ARM_CLIENT_ID
    development_ARM_CLIENT_SECRET: $development_ARM_CLIENT_SECRET

image:
  name: hashicorp/terraform:light
  entrypoint:
    - '/usr/bin/env'
    - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'

before_script:
  - rm -rf .terraform
  - terraform --version
  - terraform init

.terraform-validate:
    script:
        - export ARM_SUB_ID=${CI_ENVIRONMENT_NAME}_ARM_SUBSCRIPTION_ID
        - export ARM_SUBSCRIPTION_ID=${!ARM_SUB_ID}
        - export ARM_CLI_ID=${CI_ENVIRONMENT_NAME}_ARM_CLIENT_ID
        - export ARM_CLIENT_ID=${!ARM_CLI_ID}
        - export ARM_TEN=${CI_ENVIRONMENT_NAME}_ARM_TENANT_ID
        - export ARM_TENANT_ID=${!ARM_TEN_ID}
        - export ARM_CLI_SECRET=${CI_ENVIRONMENT_NAME}_ARM_CLIENT_SECRET
        - export ARM_CLIENT_SECRET=${!ARM_CLI_SECRET")
        - echo $development_ARM_SUBSCRIPTION_ID
        - echo ${ARM_SUBSCRIPTION_ID}
        - terraform workspace select ${CI_ENVIRONMENT_NAME}
        - terraform validate
        - terraform plan -out "terraform-plan-file"
    only:
        variables:
            - $DESTROY_INFRA != "true"

development-validate-and-plan-terraform:
    stage: infrastructure-validate
    environment: development
    extends: .terraform-validate
    only:
        refs:
            - main
            - develop
    artifacts:
        paths:
          - terraform-plan-file

当我在本地测试时变量替换工作正常，但在管道中它失败了

/bin/sh: eval: $ export ARM_SUBSCRIPTION_ID=${!ARM_SUB_ID}
line 139: syntax error: bad substitution

我认为问题是 terraform 图像没有 bash 可用，只有 sh 但我终生无法弄清楚如何在 sh 中进行相同的替换。 如果有人有任何建议，或者知道为管道中的不同环境使用不同 Azure 订阅的更好方法，我将不胜感激。

Answer 1

我将为扩展您的主要.terraform-validate作业模板的每个环境定义不同的作业，并在该作业上定义环境变量。 这样您就不必进行似乎给您带来麻烦的间接替换。 看起来像这样：

.terraform-validate:
  stage: infrastructure-validate
  script:
    - echo ${ARM_SUBSCRIPTION_ID}
    - terraform workspace select ${CI_ENVIRONMENT_NAME}
    - terraform validate
    - terraform plan -out "terraform-plan-file"
  only:
    variables:
      - $DESTROY_INFRA != "true"
  artifacts:
    paths:
      - terraform-plan-file

development-validate-and-plan-terraform:
  extends: .terraform-validate
  environment: development
  only:
    refs:
      - main
      - develop
  variables:
    ARM_SUBSCRIPTION_ID: $development_ARM_SUBSCRIPTION_ID
    ARM_TENANT_ID: $development_ARM_TENANT_ID
    ARM_CLIENT_ID: $development_ARM_CLIENT_ID
    ARM_CLIENT_SECRET: $development_ARM_CLIENT_SECRET

production-validate-and-plan-terraform:
  extends: .terraform-validate
  environment: production
  only:
    refs:
      - main
  variables:
    ARM_SUBSCRIPTION_ID: $production_ARM_SUBSCRIPTION_ID
    ARM_TENANT_ID: $production_ARM_TENANT_ID
    ARM_CLIENT_ID: $production_ARM_CLIENT_ID
    ARM_CLIENT_SECRET: $production_ARM_CLIENT_SECRET

然后在 GitLab CI/CD 设置中定义所有development_*和production_*变量。

请注意，我还移动了stage: infrastructure-validate和artifacts: ...模板的指令，因为我想它们对于所有环境都是相同的。