Terraform 扩展

alden_ygq2024-04-10 22:46

Terraform 扩展

Terraform Meta-Arguments 元参数

  • count 创建相似的资源
  • for_each 创建相似的资源
  • depends_on 定义资源或者模块的依赖
  • provider 定义provider选项
  • lifecycle 资源的生命周期行为
参数 使用范围 备注
count resource module 适用于创建多个相似的资源，使用索引count.index作为参数引用。如果资源存在区别，建议使用 for_each
for_each resource module for_each 它只能用于set(string) 或者map(string)
depends_on resource module 处理 Terraform 无法自动推断的资源或模块之间的依赖关系
provider resource module 在资源中定义供应商，通常是 . ，模块中，如果子模块未定义providers则继承父模块
lifecycle resource module 生命周期行为定义

Count 创建资源副本

  • count = num数值类型， 可以通过 length() 计算数量；
  • count.index 索引来遍历列表

示例： 创建三条 DNS 记录

Terraform 配置
## count.tf

locals {
    zone = "evescn.com"
    records = ["devops1","devops2","devops3"]
}

resource "alicloud_dns_record" "record" {
  count = length(local.records)
  name        = local.zone
  host_record = local.records[count.index]
  type        = "A"
  value       = "192.168.1.1"
}

## count.tf

locals {
    zone = "evescn.com"
    records = ["devops1","devops2","devops3"]
}

resource "alicloud_dns_record" "record" {
  count = length(local.records)
  name        = local.zone
  host_record = local.records[count.index]
  type        = "A"
  value       = "192.168.1.1"
}
创建 DNS 解析
evescn@evescndeMacBook-Pro count % terraform init

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/alicloud versions matching "1.164.0"...
- Installing hashicorp/alicloud v1.164.0...
- Installed hashicorp/alicloud v1.164.0 (signed by HashiCorp)

Terraform has been successfully initialized!

evescn@evescndeMacBook-Pro count % terraform fmt 
count.tf

evescn@evescndeMacBook-Pro count % terraform validate
Success! The configuration is valid.

evescn@evescndeMacBook-Pro count % terraform plan    

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # alicloud_dns_record.record[0] will be created
  + resource "alicloud_dns_record" "record" {
      + host_record = "devops1"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

  # alicloud_dns_record.record[1] will be created
  + resource "alicloud_dns_record" "record" {
      + host_record = "devops2"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

  # alicloud_dns_record.record[2] will be created
  + resource "alicloud_dns_record" "record" {
      + host_record = "devops3"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

Plan: 3 to add, 0 to change, 0 to destroy.


evescn@evescndeMacBook-Pro count % terraform apply --auto-approve

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # alicloud_dns_record.record[0] will be created
  + resource "alicloud_dns_record" "record" {
      + host_record = "devops1"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

  # alicloud_dns_record.record[1] will be created
  + resource "alicloud_dns_record" "record" {
      + host_record = "devops2"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

  # alicloud_dns_record.record[2] will be created
  + resource "alicloud_dns_record" "record" {
      + host_record = "devops3"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

Plan: 3 to add, 0 to change, 0 to destroy.
alicloud_dns_record.record[1]: Creating...
alicloud_dns_record.record[0]: Creating...
alicloud_dns_record.record[2]: Creating...
alicloud_dns_record.record[0]: Creation complete after 1s [id=843289465596745728]
alicloud_dns_record.record[1]: Creation complete after 1s [id=843289465605112832]
alicloud_dns_record.record[2]: Creation complete after 1s [id=843289465619789824]

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

删除 devops2 记录，会成功运行？

locals {
  zone    = "evescn.com"
  # records = ["devops1", "devops2", "devops3"]
  records = ["devops1", "devops3"]
}

resource "alicloud_dns_record" "record" {
  count       = length(local.records)
  name        = local.zone
  host_record = local.records[count.index]
  type        = "A"
  value       = "192.168.1.1"
}

执行部署

evescn@evescndeMacBook-Pro count % terraform plan                
alicloud_dns_record.record[0]: Refreshing state... [id=843289465596745728]
alicloud_dns_record.record[2]: Refreshing state... [id=843289465619789824]
alicloud_dns_record.record[1]: Refreshing state... [id=843289465605112832]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # alicloud_dns_record.record[1] will be updated in-place
  ~ resource "alicloud_dns_record" "record" {
      ~ host_record = "devops2" -> "devops3"
        id          = "843289465605112832"
        name        = "evescn.com"
        # (7 unchanged attributes hidden)
    }

  # alicloud_dns_record.record[2] will be destroyed
  # (because index [2] is out of range for count)
  - resource "alicloud_dns_record" "record" {
      - host_record = "devops3" -> null
      - id          = "843289465619789824" -> null
      - locked      = false -> null
      - name        = "evescn.com" -> null
      - priority    = 0 -> null
      - routing     = "default" -> null
      - status      = "ENABLE" -> null
      - ttl         = 600 -> null
      - type        = "A" -> null
      - value       = "192.168.1.1" -> null
    }

Plan: 0 to add, 1 to change, 1 to destroy.

evescn@evescndeMacBook-Pro count % terraform apply --auto-approve
alicloud_dns_record.record[1]: Refreshing state... [id=843289465605112832]
alicloud_dns_record.record[0]: Refreshing state... [id=843289465596745728]
alicloud_dns_record.record[2]: Refreshing state... [id=843289465619789824]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # alicloud_dns_record.record[1] will be updated in-place
  ~ resource "alicloud_dns_record" "record" {
      ~ host_record = "devops2" -> "devops3"
        id          = "843289465605112832"
        name        = "evescn.com"
        # (7 unchanged attributes hidden)
    }

  # alicloud_dns_record.record[2] will be destroyed
  # (because index [2] is out of range for count)
  - resource "alicloud_dns_record" "record" {
      - host_record = "devops3" -> null
      - id          = "843289465619789824" -> null
      - locked      = false -> null
      - name        = "evescn.com" -> null
      - priority    = 0 -> null
      - routing     = "default" -> null
      - status      = "ENABLE" -> null
      - ttl         = 600 -> null
      - type        = "A" -> null
      - value       = "192.168.1.1" -> null
    }

Plan: 0 to add, 1 to change, 1 to destroy.
alicloud_dns_record.record[2]: Destroying... [id=843289465619789824]
alicloud_dns_record.record[1]: Modifying... [id=843289465605112832]
alicloud_dns_record.record[2]: Destruction complete after 1s
╷
│ Error: [ERROR] terraform-provider-alicloud/alicloud/resource_alicloud_dns_record.go:138: Resource 843289465605112832 UpdateDomainRecord Failed!!! [SDK alibaba-cloud-sdk-go ERROR]:
│ SDK.ServerError
│ ErrorCode: DomainRecordDuplicate
│ Recommend: https://api.aliyun.com/troubleshoot?q=DomainRecordDuplicate&product=Alidns
│ RequestId: 17F3D4A1-6E02-5F4E-AEA0-C04C583B9A9E
│ Message: The DNS record already exists.
│ RespHeaders: map[Access-Control-Allow-Origin:[*] Access-Control-Expose-Headers:[*] Connection:[keep-alive] Content-Length:[246] Content-Type:[application/json;charset=utf-8] Date:[Wed, 02 Aug 2023 03:39:11 GMT] Keep-Alive:[timeout=25] X-Acs-Request-Id:[17F3D4A1-6E02-5F4E-AEA0-C04C583B9A9E] X-Acs-Trace-Id:[df248ca1dac580f3e90c12bf599c4e1a]]
│ 
│   with alicloud_dns_record.record[1],
│   on count.tf line 7, in resource "alicloud_dns_record" "record":
│    7: resource "alicloud_dns_record" "record" {
│

从 terraform 看，程序执行的操作步骤如下：

  • update： server2 > server3
  • destroy： server3

但是在执行过程中 count = length(local.records) 命令获取不了 [2] 这个下标程序出错，看看 DNS 解析记录

for_each 创建资源副本

  • for_each = set(string) map(string)

  • for_each 只能用于 set(string) 或者 map(string)，可以使用 toset 转换 list 为 set 数据

  • for_each = set(string)

    • each.key = each.value

  • for_each = map(string)

    • each.key = key
    • each.value = value

示例： 创建三条 DNS 记录

Terraform 配置
## version.tf

terraform {
  required_version = ">=1.1.9"
  required_providers {
    alicloud = {
      source  = "hashicorp/alicloud"
      version = "1.164.0"
    }
  }
}

# Configure the Alicloud Provider
provider "alicloud" {
  access_key = "xxxxxxxx"
  secret_key = "xxxxxxxx"
}

## for_each.tf

locals {
  zone = "evescn.com"
  # records = ["devops1", "devops2", "devops3"]
  records = ["devops1", "devops3"]
}

resource "alicloud_dns_record" "eachrecord" {
  for_each    = toset(local.records)
  name        = local.zone
  host_record = each.value
  type        = "A"
  value       = "192.168.1.1"
}
创建 DNS 解析
evescn@evescndeMacBook-Pro for_each % terraform init

Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/alicloud versions matching "1.164.0"...
- Installing hashicorp/alicloud v1.164.0...
- Installed hashicorp/alicloud v1.164.0 (signed by HashiCorp)

Terraform has been successfully initialized!

evescn@evescndeMacBook-Pro for_each % terraform fmt 
for_each.tf

evescn@evescndeMacBook-Pro for_each % terraform validate
Success! The configuration is valid.

evescn@evescndeMacBook-Pro for_each % terraform apply   

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # alicloud_dns_record.eachrecord["devops1"] will be created
  + resource "alicloud_dns_record" "eachrecord" {
      + host_record = "devops1"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

  # alicloud_dns_record.eachrecord["devops2"] will be created
  + resource "alicloud_dns_record" "eachrecord" {
      + host_record = "devops2"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

  # alicloud_dns_record.eachrecord["devops3"] will be created
  + resource "alicloud_dns_record" "eachrecord" {
      + host_record = "devops3"
      + id          = (known after apply)
      + locked      = (known after apply)
      + name        = "evescn.com"
      + routing     = "default"
      + status      = (known after apply)
      + ttl         = 600
      + type        = "A"
      + value       = "192.168.1.1"
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_dns_record.eachrecord["devops1"]: Creating...
alicloud_dns_record.eachrecord["devops2"]: Creating...
alicloud_dns_record.eachrecord["devops3"]: Creating...
alicloud_dns_record.eachrecord["devops2"]: Creation complete after 0s [id=843317481926367232]
alicloud_dns_record.eachrecord["devops3"]: Creation complete after 0s [id=843317481928446976]
alicloud_dns_record.eachrecord["devops1"]: Creation complete after 0s [id=843317481953598464]

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

删除 devops2 记录，重新执行

## for_each.tf

locals {
  zone = "evescn.com"
  # records = ["devops1", "devops2", "devops3"]
  records = ["devops1", "devops3"]
}

resource "alicloud_dns_record" "eachrecord" {
  for_each    = toset(local.records)
  name        = local.zone
  host_record = each.value
  type        = "A"
  value       = "192.168.1.1"
}

执行部署

evescn@evescndeMacBook-Pro for_each % terraform apply
alicloud_dns_record.eachrecord["devops2"]: Refreshing state... [id=843317481926367232]
alicloud_dns_record.eachrecord["devops3"]: Refreshing state... [id=843317481928446976]
alicloud_dns_record.eachrecord["devops1"]: Refreshing state... [id=843317481953598464]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  - destroy

Terraform will perform the following actions:

  # alicloud_dns_record.eachrecord["devops2"] will be destroyed
  # (because key ["devops2"] is not in for_each map)
  - resource "alicloud_dns_record" "eachrecord" {
      - host_record = "devops2" -> null
      - id          = "843317481926367232" -> null
      - locked      = false -> null
      - name        = "evescn.com" -> null
      - priority    = 0 -> null
      - routing     = "default" -> null
      - status      = "ENABLE" -> null
      - ttl         = 600 -> null
      - type        = "A" -> null
      - value       = "192.168.1.1" -> null
    }

Plan: 0 to add, 0 to change, 1 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_dns_record.eachrecord["devops2"]: Destroying... [id=843317481926367232]
alicloud_dns_record.eachrecord["devops2"]: Destruction complete after 0s

Apply complete! Resources: 0 added, 0 changed, 1 destroyed.

dynamic 动态的内联块

  • dynamic : 定义动态资源块，后面是 label， 默认为生成的语句块名称；

  • for_each : 要进行迭代循环的对象（map、list、set）;

  • iterator : 临时的变量名称，如果未定义则使用 label 即 ports ；

  • content : 要生成的语句块的内容部分；

    dynamic "label" {
    # 支持 map list set 等数据
    for_each = map | list | set
    iterator = iterator_name
    content {
    key = iterator_name.value
    }
    }

    dynamic "ports" {
    for_each = local.jenkins_ports
    content {
    internal = ports.value.internal
    external = ports.value.external
    ip = "0.0.0.0"
    protocol = "tcp"
    }
    }

Docker 中的 ports{}

resource "docker_container" "jenkins" {

  ports {
    internal = 8080
    external = 8080
    ip       = "0.0.0.0"
    protocol = "tcp"
  }
  
  ports {
    internal = 50000
    external = 50000
    ip       = "0.0.0.0"
    protocol = "tcp"
  }
}

定义一个local变量；使用dynamic动态内联块

for_each遍历资源；ports.value引用遍历的资源

locals {
  jenkins_ports = [
    {
      internal = 8080
      external = 8080
    },
    {
      internal = 50000
      external = 50000
    }
  ]
}

resource "docker_container" "jenkins" {

  // 使用dynamic来实现动态
  dynamic "ports" {
    for_each = local.jenkins_ports
    content {
      internal = ports.value.internal
      external = ports.value.external
      ip       = "0.0.0.0"
      protocol = "tcp"
    }
  }

depends_on 依赖关系

处理 资源或模块之间的依赖关系。

resource "docker_image" "jenkins" {
  name         = "jenkins/jenkins:2.332.2-centos7-jdk8"
  force_remove = false
  keep_locally = true
}


resource "docker_container" "jenkins" {
  image      = docker_image.jenkins.name
  name       = "jenkins-demo"

  # 依赖 docker_image 资源
  depends_on = [
    docker_image.jenkins
  ]
}

provider 自定义供应商

resource 覆盖资源中的 provider

例如：分别在 cn-beijing 和 cn-shanghai 区域分别创建1个实例。

provider "alicloud" {
  alias  = "north"
  region = "cn-beijing"
  access_key = "AKIR"
  secret_key = "MJy5JXmZn"
}

provider "alicloud" {
  region     = "cn-shanghai"
  access_key = "AK5R"
  secret_key = "MJy5JX6HIqmZn"
}

resource "alicloud_instance" "ecs_demo_north" {
  provider      = alicloud.north
  ...
}

resource "alicloud_instance" "ecs_demo" {
  ...
}

module 默认子模块继承根模块的provider；

  • provider = map()

  • key: provider名称

  • value: <provider>.<alias>

    provider "alicloud" {
    alias = "north"
    region = "cn-beijing"
    }

    provider "alicloud" {
    region = "cn-shanghai"
    }

    module "example" {
    source = "./example"
    # module 中的 provider 配置
    providers = {
    alicloud = alicloud.north
    }
    }

lifecycle 生命周期

标记资源不被删除或者销毁前创建新的资源；

lifecycle {
  xxx
}

  • create_before_destroy 先创建新的对象，再销毁旧的对象；

  • prevent_destroy 防止资源被销毁；

  • ignore_changes 忽略资源的差异；

  • replace_triggered_by 当指定的资源修改后替换当前资源；

  • precondition postcondition 条件检查

    lifecycle {
    create_before_destroy = true
    # prevent_destroy = true
    ignore_changes = [
    tags, instance_name
    ]
    replace_triggered_by = [
    alicloud_vpc.vpc.vpc_name
    ]
    }

相关推荐
爱技术的小伙子21 分钟前
【 云原生应用的监控与日志管理】使用Prometheus、ELK Stack等工具进行云原生应用的监控与日志管理
elk·云原生·prometheus
沓沓7811 小时前
Springsecurity中的Eureka报错：Cannot execute request on any known server
后端·云原生·eureka
G皮T2 小时前
【Kubernetes】K8s 持久化存储方式
云原生·容器·kubernetes·k8s·volume·持久化存储·数据卷
闫利朋2 小时前
ubuntu22.04使用kubeadm部署k8s集群
ubuntu·云原生·容器·kubernetes
xiaogengtongxu2 小时前
k8s中service对象
云原生·容器·kubernetes
梆子井欢喜坨3 小时前
《Cloud Native Data Center Networking》（云原生数据中心网络设计）读书笔记 -- 05网络虚拟化
网络·云原生·php
csdn5659738503 小时前
DBA福利：云原生分布式数据库 PolarDB-X 操作指南
数据库·云原生·dba·polardb-x
leason0016 小时前
Terraform管理云资源实践
云原生·运维开发
acro_097 小时前
企业级web应用服务器之Tomcat
linux·运维·云原生·tomcat
嘉木998 小时前
企业级WEB应用服务器TOMCAT详解
java·linux·运维·服务器·前端·云原生·tomcat
热门推荐
01RAG 实践- Ollama+RagFlow 部署本地知识库02Coze扣子平台完整体验和实践（附国内和国际版对比）032024电赛H题参考方案（+视频演示）——自动行使小车04组基轨迹建模 GBTM的介绍与实现（Stata 或 R）05带你看懂思源字体的各个版本都有什么区别06解决Pycharm下载torch报错：OSError: [WinError 126] 找不到指定的模块。07YzmCMS 7.0任意函数调用RCE 漏洞研究分析08yolov8实战第五天——yolov8+ffmpg实时视频流检测并进行实时推流——（推流，保姆教学）09DSPy实战：三十分钟无痛上手自动化Prompt框架10苍穹外卖面试总结