unkin-agent
b315698634
The provider api_url was hardcoded to the derived environment URL, leaving CI no way to point a plan at a different endpoint. The rancher2 constraint of >= 5.0.0 also permitted nine majors of drift against the 14.1.1 the lockfile resolves. - Add a generated variable "rancher_url" defaulting to the same https://${path_relative_to_include()} expression; the provider now reads var.rancher_url, so TF_VAR_rancher_url overrides without changing defaults. - Pin rancher/rancher2 to ~> 14.0 in modules/rancher/versions.tf.
43 lines
1.1 KiB
HCL
43 lines
1.1 KiB
HCL
generate "backend" {
|
|
path = "backend.tf"
|
|
if_exists = "overwrite"
|
|
contents = <<EOF
|
|
provider "rancher2" {
|
|
api_url = var.rancher_url
|
|
token_key = var.rancher_token
|
|
}
|
|
|
|
# Reads the OAuth client secret seeded in Vault (kv-v2). Auth via VAULT_ADDR +
|
|
# VAULT_TOKEN from the environment (set by the Makefile vault_env helper).
|
|
# skip_child_token is required because the short-lived CI token cannot create
|
|
# child tokens.
|
|
provider "vault" {
|
|
skip_child_token = true
|
|
}
|
|
|
|
variable "rancher_token" {
|
|
type = string
|
|
sensitive = true
|
|
}
|
|
|
|
# Defaults to the environment's public URL; an exported TF_VAR_rancher_url
|
|
# takes precedence over terragrunt inputs.
|
|
variable "rancher_url" {
|
|
type = string
|
|
default = "https://${path_relative_to_include()}"
|
|
}
|
|
|
|
terraform {
|
|
backend "consul" {
|
|
address = "https://consul.service.consul"
|
|
path = "infra/terraform/rancher/${path_relative_to_include()}/state"
|
|
scheme = "https"
|
|
lock = true
|
|
ca_file = "/etc/pki/tls/certs/ca-bundle.crt"
|
|
}
|
|
required_version = ">= 1.10"
|
|
# required_providers are declared in the module's versions.tf.
|
|
}
|
|
EOF
|
|
}
|