在 Gitlab CI 管道中的每個環境中使用不同的 Azure 訂閱 ID

Question

我們有一個 gitlab 管道，我正在嘗試將其配置為在每個環境中使用不同的 Azure 訂閱，但運氣不佳。

基本上我需要做的是根據正在構建的環境將環境變量ARM_CLIENT_ID 、 ARM_CLIENT_SECRET 、 ARM_SUBSCRIPTION_ID 、 ARM_TENANT_ID為不同的值。

在 cicd 設置中，我為development_ARM_SUBSCRIPTION_ID 、 test_ARM_SUBSCRIPTION_ID等設置了變量，其想法是將這些變量的值分配給管道中的 ARM_CLIENT_ID、ARM_CLIENT_SECRET、ARM_SUBSCRIPTION_ID、ARM_TENANT_ID 變量。

這就是我的管道的樣子

stages:
  - infrastructure-validate
  - infrastructure-deploy
  - infrastructure-destroy

variables:
    DESTROY_INFRA: "false"
    development_ARM_SUBSCRIPTION_ID: $development_ARM_SUBSCRIPTION_ID
    development_ARM_TENANT_ID: $development_ARM_TENANT_ID
    development_ARM_CLIENT_ID: $development_ARM_CLIENT_ID
    development_ARM_CLIENT_SECRET: $development_ARM_CLIENT_SECRET

image:
  name: hashicorp/terraform:light
  entrypoint:
    - '/usr/bin/env'
    - 'PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'

before_script:
  - rm -rf .terraform
  - terraform --version
  - terraform init

.terraform-validate:
    script:
        - export ARM_SUB_ID=${CI_ENVIRONMENT_NAME}_ARM_SUBSCRIPTION_ID
        - export ARM_SUBSCRIPTION_ID=${!ARM_SUB_ID}
        - export ARM_CLI_ID=${CI_ENVIRONMENT_NAME}_ARM_CLIENT_ID
        - export ARM_CLIENT_ID=${!ARM_CLI_ID}
        - export ARM_TEN=${CI_ENVIRONMENT_NAME}_ARM_TENANT_ID
        - export ARM_TENANT_ID=${!ARM_TEN_ID}
        - export ARM_CLI_SECRET=${CI_ENVIRONMENT_NAME}_ARM_CLIENT_SECRET
        - export ARM_CLIENT_SECRET=${!ARM_CLI_SECRET")
        - echo $development_ARM_SUBSCRIPTION_ID
        - echo ${ARM_SUBSCRIPTION_ID}
        - terraform workspace select ${CI_ENVIRONMENT_NAME}
        - terraform validate
        - terraform plan -out "terraform-plan-file"
    only:
        variables:
            - $DESTROY_INFRA != "true"

development-validate-and-plan-terraform:
    stage: infrastructure-validate
    environment: development
    extends: .terraform-validate
    only:
        refs:
            - main
            - develop
    artifacts:
        paths:
          - terraform-plan-file

當我在本地測試時變量替換工作正常，但在管道中它失敗了

/bin/sh: eval: $ export ARM_SUBSCRIPTION_ID=${!ARM_SUB_ID}
line 139: syntax error: bad substitution

我認為問題是 terraform 圖像沒有 bash 可用，只有 sh 但我終生無法弄清楚如何在 sh 中進行相同的替換。 如果有人有任何建議，或者知道為管道中的不同環境使用不同 Azure 訂閱的更好方法，我將不勝感激。

Answer 1

我將為擴展您的主要.terraform-validate作業模板的每個環境定義不同的作業，並在該作業上定義環境變量。 這樣您就不必進行似乎給您帶來麻煩的間接替換。 看起來像這樣：

.terraform-validate:
  stage: infrastructure-validate
  script:
    - echo ${ARM_SUBSCRIPTION_ID}
    - terraform workspace select ${CI_ENVIRONMENT_NAME}
    - terraform validate
    - terraform plan -out "terraform-plan-file"
  only:
    variables:
      - $DESTROY_INFRA != "true"
  artifacts:
    paths:
      - terraform-plan-file

development-validate-and-plan-terraform:
  extends: .terraform-validate
  environment: development
  only:
    refs:
      - main
      - develop
  variables:
    ARM_SUBSCRIPTION_ID: $development_ARM_SUBSCRIPTION_ID
    ARM_TENANT_ID: $development_ARM_TENANT_ID
    ARM_CLIENT_ID: $development_ARM_CLIENT_ID
    ARM_CLIENT_SECRET: $development_ARM_CLIENT_SECRET

production-validate-and-plan-terraform:
  extends: .terraform-validate
  environment: production
  only:
    refs:
      - main
  variables:
    ARM_SUBSCRIPTION_ID: $production_ARM_SUBSCRIPTION_ID
    ARM_TENANT_ID: $production_ARM_TENANT_ID
    ARM_CLIENT_ID: $production_ARM_CLIENT_ID
    ARM_CLIENT_SECRET: $production_ARM_CLIENT_SECRET

然后在 GitLab CI/CD 設置中定義所有development_*和production_*變量。

請注意，我還移動了stage: infrastructure-validate和artifacts: ...模板的指令，因為我想它們對於所有環境都是相同的。