A best practices guide for Terraform CI/CD workflows>
– Daniel Ring
The passage discusses various practices and tools for improving Terraform code quality, governance and compliance, build environment preparation, shared plugin cache, approval gates, and managing CI/CD with Terraform.
The key points mentioned are:
1. Enforcing code quality with formatting, linting, and validation:
– Use built-in Terraform CLI methods like `terraform fmt` and `terraform validate`.
– Extend linting and validation with tools like tflint, tfsec, and checkov.
2. Using policies for governance and compliance:
– Use tools like Open Policy Agent (OPA) to codify and automate policies.
– Preemptively catch violations and ensure compliance with organizational and regulatory standards.
3. Preparing the build environment:
– Install build dependencies and required command-line tools in advance.
– Build machine/container images used in CI/CD pipelines and fetch up-to-date clones of git repositories.
– Pre-fetch Terraform providers and plugins with `terraform init` for faster job execution.
4. Using a shared plugin cache:
– Specify a shared plugin cache directory using the TF_PLUGIN_CACHE_DIR environment variable.
– Reduce plugin download time by sharing plugin binaries across multiple Terraform workloads on the same machine.
5. Approval gates:
– Combine branch protection rules with CI/CD pipeline approvals for adaptable and situationally-responsive gating.
– Use approvals for sensitive infrastructure changes, resource cost implications, production deployments, stateful operations, complex multi-service deployments, regulatory compliance, incident response/outages, maintenance windows, and validation of external resources.
6. Managing CI/CD with Terraform:
– Utilize Terraform to manage CI/CD pipelines, teams, clusters, etc., for a unified and version-controlled approach.
– Consider using the official Buildkite provider in the Terraform Registry.
It is important to note that while these practices and tools are valuable, not all of them need to be adopted simultaneously.
Teams should choose the ones that fit their specific needs and evolve their workflows over time.
Link: https://buildkite.com/blog/best-practices-for-terraform-ci-cd