Azure Terraform（九）GitHub Actions 实现 Infra 资源的自动化部署

阅读原文时间：2022年01月08日阅读：1

思路浅析

　　使用 Terraform Code 部署 Azure 基础设施资源是特别受欢迎的，我曾经有写文章分享过利用 Azure DevOps 自动部署 Terraform Code 所描述的 Azure 基础设施资源。但是有些人对于Azure DevOps 可能比较陌生，再加上 Azure DevOps 的 Parallel jobs 付费作业。所以作为替代方案，今天给大家分享如何使用 GitHub Actions 部署 Terraform Code。

配置 Azure Service Principal 的凭据到 GitHub 机密库

Terraform Code 以及Azure CLI 会使用 Azure Service Principle 对 Azure 进行身份认证

关于 Azure Service Principle 的创建大家可以参考：

https://www.cnblogs.com/AllenMaster/p/13065643.html

接下来需要添加以下机密信息

　　1）AZURE_AD_CLIENT_ID

　　2）AZURE_AD_CLIENT_SECRET

　　3）AZURE_AD_TENANT_ID

　　4）AZURE_SUBSCRIPTION_ID

5）AZURE_CREDENTIALS

其中 AZURE_CREDENTIALS 格式内容如下所示：

{
"clientId": "XXXX",
"clientSecret": "XXXX",
"subscriptionId": "XXXX",
"tenantId": "XXXX"
}

将上述信息存储到对应名称的 GitHub Secrets。

配置 workflows run 的 yaml

在 Terraform 项目根目录创建 terraform.yaml 并保存在以下目录

terraform.yaml 内容如下

name: " using GitHub Action for Terraform Auto CI/CD"
on:
pull_request:
branches:
- remote_stats
push:
branches:
- remote_stats
env:
tf_version: "latest"
tf_working_dir: "./src/model/"
terraform_rg: "Web_Test_TF_RG"
storage_account: "cnbatestorestatefile004"
storage_account_container: "terraform-state"
key: "cnbate.terraform.stats"
jobs:
terraform_auto_deploy:
name: "Azure CLI Action (secrect created)"
env:
ARM_CLIENT_ID: ${{ secrets.AZURE_AD_CLIENT_ID }}
ARM_CLIENT_SECRET: ${{ secrets.AZURE_AD_CLIENT_SECRET }}
ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
ARM_TENANT_ID: ${{ secrets.AZURE_AD_TENANT_ID }}
runs-on: ubuntu-latest
environment: production

# Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest  
defaults:  
  run:  
    shell: bash  
steps:  
  - name: "Checkout"  
    uses: actions/checkout@master  
  - name: Azure Login  
    uses: azure/login@v1  
    with:  
      creds: ${{ secrets.AZURE\_CREDENTIALS }}  
      enable-AzPSSession: false  
      environment: azurecloud  
      allow-no-subscriptions: false  
  - name: Azure CLI script  
    uses: azure/CLI@v1  
    with:  
      creds: ${{ secrets.AZURE\_CREDENTIALS }}  
      enable-AzPSSession: false  
      environment: azurecloud  
      allow-no-subscriptions: false  
      azcliversion: 2.30.0  
      inlineScript: |

        # create azure resource group  
        az group create --location eastasia --name ${{ env.terraform\_rg }}

        # create azure storage account  
        az storage account create --name ${{ env.storage\_account }} --resource-group ${{ env.terraform\_rg }} --location eastasia --sku Standard\_LRS

        # create storage account container for tf state  
        az storage container create --name ${{ env.storage\_account\_container }} --account-name ${{ env.storage\_account }}

        # query storage key and set variable  
        export ARM\_ACCESS\_KEY=$(az storage account keys list --resource-group ${{env.terraform\_rg}} --account-name ${{ env.storage\_account }} --query "\[?keyName == 'key1'\]\[value\]" --output tsv)

        echo $ARM\_ACCESS\_KEY

  - name: "Terraform init azurerm backend"  
    uses: ahmedig/terraform-azurerm-backend@v1  
    with:  
      azure\_credentials: ${{ secrets.AZURE\_CREDENTIALS }}  
      resource\_group\_name: ${{ env.terraform\_rg }}  
      container\_name: ${{ env.storage\_account\_container }}  
      storage\_account\_name: ${{ env.storage\_account }}  
      file\_name: ${{ env.key }}  
      subscription\_id: ${{ secrets.AZURE\_SUBSCRIPTION\_ID }}  
      tf\_working\_directory: ${{ env.tf\_working\_dir }}

  - name: "Terraform Validate"  
    uses: hashicorp/terraform-github-actions@master  
    with:  
      tf\_actions\_version: ${{ env.tf\_version }}  
      tf\_actions\_subcommand: 'validate'  
      tf\_actions\_working\_dir: ${{ env.tf\_working\_dir }}  
    env:  
      GITHUB\_TOKEN: ${{ secrets.AZURE\_CREDENTIALS }}

  - name: "Terraform Plan"  
    uses: hashicorp/terraform-github-actions@master  
    with:  
      tf\_actions\_version: ${{ env.tf\_version }}  
      tf\_actions\_subcommand: 'plan'  
      tf\_actions\_working\_dir: ${{ env.tf\_working\_dir }}  
    env:  
      GITHUB\_TOKEN: ${{ secrets.AZURE\_CREDENTIALS }}

  - name: "Terraform Deploy"  
    uses: hashicorp/terraform-github-actions@master  
    with:  
      tf\_actions\_version: ${{ env.tf\_version }}  
      tf\_actions\_subcommand: 'apply'  
      tf\_actions\_working\_dir: ${{ env.tf\_working\_dir }}  
    env:  
      GITHUB\_TOKEN: ${{ secrets.AZURE\_CREDENTIALS }}

  - name: "Terraform Destroy"  
    uses: hashicorp/terraform-github-actions@master  
    with:  
      tf\_actions\_version: ${{ env.tf\_version }}  
      tf\_actions\_subcommand: 'destroy'  
      tf\_actions\_working\_dir: ${{ env.tf\_working\_dir }}  
    env:  
      GITHUB\_TOKEN: ${{ secrets.AZURE\_CREDENTIALS }}

3，运行 workflows run

由于我们在 "terraform.yaml" 中指定指定工作分支 “remote_stats”，当 “remote” 分支发生 “push” 或者 “pull_request” 操作就会触发 GitHub Actions 的 workflows 的运行。所以我们直接推送当前已编辑好的 "terraform.yaml" 文件到 “remote_stats” 分支，并在 GitHub 上查看 workflows 运行结果。

如果需要进一步了解每个步骤都执行了那些操作，可以选择当前 workflow runs