Zenn
Open7

tfactionsの導入

GitHub Actions
Terraform
CI/CD
ei-showei-show

導入にあたってやったこと(GCP編)

  1. Workload Identityの設定
  2. GitHub APPの設定
  3. templateの設定
  4. workflowの設定
  5. scan(work dirの作成)
  6. pull request(動作確認)
ei-showei-show

templateの設定

スキャンフォールディングしたときにワーキングディレクトリが自動で作成されます。
その際、templateを設定しておくことで必要なファイル郡が自動でコピーされます。
例えばprovider.tfやbackend.tfなどがコピーされるイメージです。
https://suzuki-shunsuke.github.io/tfaction/docs/feature/scaffold-working-dir

私はtfaction-getting-startedを参考にしました。
https://github.com/suzuki-shunsuke/tfaction-getting-started/tree/main/templates/github

tfaction-root.yamlも必要になります。
https://suzuki-shunsuke.github.io/tfaction/docs/config/add-working-directory/#gcp

tfaction-root.yaml
---
target_groups:
- working_directory: dev
  target: dev
  gcs_bucket_name_plan_file: 'GCS_BACKET_NAME'
  gcs_bucket_name_tfmigrate_history: 'GCS_BACKET_NAME'
  template_dir: templates/gcp

  terraform_plan_config:
    gcp_service_account: terraform-plan@my-project.iam.gserviceaccount.com
    gcp_workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
  tfmigrate_plan_config:
    gcp_service_account: terraform-plan@my-project.iam.gserviceaccount.com
    gcp_workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
  terraform_apply_config:
    gcp_service_account: terraform-plan@my-project.iam.gserviceaccount.com
    gcp_workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
  tfmigrate_apply_config:
    gcp_service_account: terraform-plan@my-project.iam.gserviceaccount.com
    gcp_workload_identity_provider: 'projects/123456789/locations/global/workloadIdentityPools/my-pool/providers/my-provider'
ei-showei-show

次のファイルを準備する

tfaction-getting-startedではPersonal Access Tokenを使用するが、推奨はGitHub Appなのでyamlを修正する
https://suzuki-shunsuke.github.io/tfaction/docs/config/github-token

apply.yaml
      # We recommend using GitHub App Token instead of personal access token,
      # but in this getting started let's use personal access token.
-     # - name: Generate token
-     #   id: generate_token
-     #   uses: tibdex/github-app-token@v1
-     #   with:
-     #     app_id: ${{ secrets.APP_ID }}
-     #     private_key: ${{ secrets.APP_PRIVATE_KEY }}
+    - name: Generate token
+      id: generate_token
+      uses: tibdex/github-app-token@v1
+      with:
+        app_id: ${{ secrets.APP_ID }}
+        private_key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: aquaproj/aqua-installer@v1.1.2
        with:
          aqua_version: v1.25.0

      - uses: suzuki-shunsuke/tfaction/export-secrets@v0.5.19
        with:
          secrets: ${{ toJSON(secrets) }}

      - uses: suzuki-shunsuke/tfaction/setup@v0.5.19
        id: setup
        with:
-         github_app_token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+         github_app_token: ${{ secrets.steps.generate_token.outputs.token}}
          ssh_key: ${{ secrets.TERRAFORM_PRIVATE_MODULE_SSH_KEY }} # This isn't needed if you don't use SSH key to checkout private Terraform Modules

      - uses: suzuki-shunsuke/tfaction/tfmigrate-apply@v0.5.19
        with:
-         github_app_token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+         github_app_token: ${{ secrets.steps.generate_token.outputs.token}}

      - uses: suzuki-shunsuke/tfaction/create-follow-up-pr@v0.5.19
        if: failure()
        with:
-         github_app_token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+         github_app_token: ${{ secrets.steps.generate_token.outputs.token}}