Skip to content
apply.yml 4.12 KiB
Newer Older
Timo Furrer's avatar
Timo Furrer committed
spec:
  inputs:
    # Job and Stage name
    as:
      default: 'apply'
      description: 'Defines the name of this job.'
    stage:
      default: 'deploy'
      description: 'Defines the stage that this job will belong to.'

    # Versions
    # This version is only required, because we cannot access the context of the component,
    # see https://gitlab.com/gitlab-org/gitlab/-/issues/438275
    version:
      default: 'latest'
      description: 'Version of this component. Has to be the same as the one in the component include entry.'
    base_os:
      default: 'alpine'
      options:
        - 'alpine'
        - 'debian'
        - '$GITLAB_OPENTOFU_BASE_IMAGE_OS'
      description: 'Base OS of GitLab OpenTofu image.'

Timo Furrer's avatar
Timo Furrer committed
    opentofu_version:
Timo Furrer's avatar
Timo Furrer committed
      options:
Timo Furrer's avatar
Timo Furrer committed
        - '1.7.1'
Ben Brown's avatar
Ben Brown committed
        - '1.7.0'
        - '1.7.0-alpha1'
Timo Furrer's avatar
Timo Furrer committed
        - '1.6.2'
Timo Furrer's avatar
Timo Furrer committed
        - '1.6.1'
Timo Furrer's avatar
Timo Furrer committed
        - '1.6.0'
        - '$OPENTOFU_VERSION'
Timo Furrer's avatar
Timo Furrer committed
      description: 'OpenTofu version that should be used.'

    # Images
    image_registry_base:
      default: '$CI_TEMPLATE_REGISTRY_HOST/components/opentofu'
      description: 'Host URI to the job images. Will be combined with `image_name` to construct the actual image URI.'
Timo Furrer's avatar
Timo Furrer committed
    # FIXME: not yet possible because of https://gitlab.com/gitlab-org/gitlab/-/issues/438722
    # gitlab_opentofu_image:
    #   # FIXME: This should reference the component tag that is used.
    #   #        Currently, blocked by https://gitlab.com/gitlab-org/gitlab/-/issues/438275
    #   # default: '$CI_TEMPLATE_REGISTRY_HOST/components/opentofu/gitlab-opentofu:$[[ inputs.opentofu_version ]]'
    #   default: '$CI_TEMPLATE_REGISTRY_HOST/components/opentofu/gitlab-opentofu:$[[ inputs.version ]]-opentofu$[[ inputs.opentofu_version ]]'
Timo Furrer's avatar
Timo Furrer committed
    #   description: 'Tag of the gitlab-opentofu image.'
    image_name:
      default: 'gitlab-opentofu'
      description: 'Image name for the job images. Hosted under `image_registry_base`.'

    image_digest:
      default: ''
      # FIXME: we cannot use regex yet because of a bug that rejects
      # empty strings from ever being checked against the regex.
      # see https://gitlab.com/gitlab-org/gitlab/-/issues/477707
      # regex: '^(@sha256:[a-z0-9]{64})?$'
      description: 'Image digest of the image you want to use. The format must be `@<image_digest>`, e.g. `@sha256:abc..`, see regex of this input. Please consult the release page at https://gitlab.com/components/opentofu/-/releases to obtain the image digests.'

Timo Furrer's avatar
Timo Furrer committed
    # Configuration
    root_dir:
Timo Furrer's avatar
Timo Furrer committed
      default: ${CI_PROJECT_DIR}
      description: 'Root directory for the OpenTofu project.'
    state_name:
      default: default
      description: 'Remote OpenTofu state name.'
    no_plan:
      default: false
      type: boolean
      description: 'Whether a plan file should be used.'
Timo Furrer's avatar
Timo Furrer committed
    plan_name:
      default: 'plan'
      description: 'The name of the plan file to use. Will be used for TF_PLAN_CACHE and TF_PLAN_JSON.'
Timo Furrer's avatar
Timo Furrer committed
    auto_apply:
      default: false
      type: boolean
Timo Furrer's avatar
Timo Furrer committed
      description: 'Whether the apply job is manual or automatically run.'

---

'$[[ inputs.as ]]':
  stage: $[[ inputs.stage ]]
  environment:
    name: $TF_STATE_NAME
Timo Furrer's avatar
Timo Furrer committed
    action: start
  resource_group: $TF_STATE_NAME
Timo Furrer's avatar
Timo Furrer committed
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && "$[[ inputs.auto_apply ]]" == "true"'
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual
  cache:
    key: "$__CACHE_KEY_HACK"
Timo Furrer's avatar
Timo Furrer committed
    paths:
      - $TF_ROOT/.terraform/
Timo Furrer's avatar
Timo Furrer committed
  variables:
    # FIXME: work around to make slashes work in `cache:key`. see https://gitlab.com/gitlab-org/gitlab/-/issues/439898
    __CACHE_KEY_HACK: "$[[ inputs.root_dir ]]"
Timo Furrer's avatar
Timo Furrer committed
    TF_ROOT: $[[ inputs.root_dir ]]
    TF_STATE_NAME: $[[ inputs.state_name ]]
    TF_APPLY_NO_PLAN: $[[ inputs.no_plan ]]
Timo Furrer's avatar
Timo Furrer committed
    TF_PLAN_NAME: $[[ inputs.plan_name ]]
Timo Furrer's avatar
Timo Furrer committed
  image:
    name: '$[[ inputs.image_registry_base ]]/$[[ inputs.image_name ]]:$[[ inputs.version ]]-opentofu$[[ inputs.opentofu_version ]]-$[[ inputs.base_os ]]$[[ inputs.image_digest ]]$[[ inputs.image_digest ]]'
Timo Furrer's avatar
Timo Furrer committed
  script:
    - gitlab-tofu apply