“Terraform”的版本间的差异
(→aws) |
|||
(未显示同一用户的101个中间版本) | |||
第1行: | 第1行: | ||
[[category:ops]] [[category:devops]] | [[category:ops]] [[category:devops]] | ||
+ | =进阶= | ||
+ | [https://learn.hashicorp.com/terraform terraform Get Started] | ||
+ | |||
+ | 以Terraform为代表的资源编排类 | ||
+ | 资源编排工具的 Provisioner | ||
+ | |||
+ | |||
+ | tf 文件在 Vim 中的语法加亮是安装的hashivim/vim-terraform;插件 | ||
+ | |||
+ | Terraform被设计成一个多云基础设施编排工具,不像CloudFormation那样绑定AWS平台,Terraform可以同时编排各种云平台或是其他基础设施的资源。Terraform实现多云编排的方法就是Provider插件机制。 | ||
+ | |||
+ | 几个重要的概念 | ||
+ | resource | ||
+ | 数据源通过一种特殊的资源访问:data资源 | ||
+ | |||
+ | [https://lonegunmanb.github.io/introduction-terraform/ terraform电子书] learning June 2022 基本看完了 | ||
+ | |||
+ | |||
+ | [https://github.com/ryan4yin/knowledge/blob/master/infrastructure/terraform/README.md Terraform - 基础设施配置化] | ||
+ | |||
+ | [https://wsgzao.github.io/post/terraform/ Terraform 学习路径 ] | ||
+ | |||
+ | [https://blog.csdn.net/yejingtao703/article/details/80574363 云平台实例操作神器Terraform] | ||
+ | |||
+ | [https://blog.csdn.net/u011220960/article/details/89704619?utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromMachineLearnPai2%7Edefault-1.control&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromMachineLearnPai2%7Edefault-1.control 基础架构自动化编排工具Terraform安装与使用踩坑记录] | ||
+ | |||
+ | [https://member.selfhostedserver.com/terraform-2/ Terraform:自动化管理云基础设施(2)] | ||
+ | =语法= | ||
+ | |||
+ | 在for_each和count之间选择 | ||
+ | |||
+ | 如果创建的资源实例彼此之间几乎完全一致,那么count比较合适。如果彼此之间的参数差异无法直接从count的下标派生,那么使用for_each会更加安全 | ||
+ | |||
+ | = Deploy and Monitor Applications terraform 部署应用= | ||
+ | |||
+ | https://learn.hashicorp.com/collections/terraform/applications | ||
+ | ==terraform 部署 docker == | ||
+ | <pre> | ||
+ | /home/evan/.terraform# cat main.tf | ||
+ | terraform { | ||
+ | required_providers { | ||
+ | // 声明要用的provider | ||
+ | docker = { | ||
+ | source = "kreuzwerker/docker" | ||
+ | // 要用的版本,不写默认拉取最新的 | ||
+ | version = "3.0.2" | ||
+ | } | ||
+ | } | ||
+ | } | ||
+ | |||
+ | // 语法 resource resource_type name | ||
+ | // 声明docker_image的镜像,nginx只是一个名字,只要符合变量命名规则即可 | ||
+ | resource "docker_image" "nginx" { | ||
+ | // 使用的是镜像名,https://hub.docker.com/layers/nginx/library/nginx/latest/images/sha256-3536d368b898eef291fb1f6d184a95f8bc1a6f863c48457395aab859fda354d1?context=explore | ||
+ | name = "nginx:latest" | ||
+ | } | ||
+ | |||
+ | resource "docker_container" "nginx" { | ||
+ | image = docker_image.nginx.name | ||
+ | name = "nginx_test" | ||
+ | ports { | ||
+ | internal = 80 // docker 内部的端口 | ||
+ | external = 8000 // 对外访问的端口 | ||
+ | } | ||
+ | volumes { | ||
+ | container_path = "/usr/share/nginx/html" | ||
+ | host_path = "/tmp/nginx_home" | ||
+ | } | ||
+ | } | ||
+ | |||
+ | |||
+ | mkdir -p /tmp/nginx_home | ||
+ | vi /tmp/nginx_home/index.html | ||
+ | http://192.168.10.105:8000/ | ||
+ | |||
+ | </pre> | ||
+ | [https://www.cnblogs.com/syavingcs/p/14440548.html terraform 测试docker部署 ] | ||
+ | |||
+ | https://learn.hashicorp.com/tutorials/terraform/docker-build?in=terraform/docker-get-started | ||
+ | |||
+ | [https://juejin.cn/post/7201444843138252837 Terraform入门(Infrastructure as Code) ] | ||
=ins= | =ins= | ||
<pre> | <pre> | ||
+ | |||
+ | #直接 apt kali就直接下载 包啦 | ||
+ | vi ~/.bashrc | ||
+ | alias terraform='~/data/apps/terraform/terraform' | ||
+ | |||
+ | 或者 二进制包 mv到 /usr/local/bin/ or /usr/bin | ||
+ | |||
+ | |||
+ | |||
+ | curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add - | ||
+ | |||
+ | sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | ||
+ | |||
+ | sudo apt-get update && sudo apt-get install terraform | ||
+ | |||
+ | #也可手工加 哈哈 | ||
+ | lsb_release -cs | ||
+ | buster | ||
+ | |||
wget -c https://releases.hashicorp.com/terraform/0.15.4/terraform_0.15.4_linux_amd64.zip | wget -c https://releases.hashicorp.com/terraform/0.15.4/terraform_0.15.4_linux_amd64.zip | ||
第29行: | 第129行: | ||
该目录下的所有 *.tf 文件都会被 Terraform 加载,在初始化 Terraform 工作空间之前必须至少要有一个 *.tf 文件。我们这里建立文件 main.tf, 内容如下 | 该目录下的所有 *.tf 文件都会被 Terraform 加载,在初始化 Terraform 工作空间之前必须至少要有一个 *.tf 文件。我们这里建立文件 main.tf, 内容如下 | ||
+ | |||
+ | 后建议先配置子命令自动补全功能: | ||
+ | |||
+ | terraform -install-autocomplete | ||
</pre> | </pre> | ||
− | + | https://developer.hashicorp.com/terraform/install?product_intent=terraform | |
[https://blog.csdn.net/daiqinge/article/details/103798557?utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromMachineLearnPai2%7Edefault-1.control\&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromMachineLearnPai2%7Edefault-1.control terraform的安装和应用 ] | [https://blog.csdn.net/daiqinge/article/details/103798557?utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromMachineLearnPai2%7Edefault-1.control\&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EBlogCommendFromMachineLearnPai2%7Edefault-1.control terraform的安装和应用 ] | ||
=usage= | =usage= | ||
+ | https://pin-yi.me/blog/terraform/terraform/ | ||
+ | |||
= usage on aliyun= | = usage on aliyun= | ||
以aliyun作为例子 | 以aliyun作为例子 | ||
第260行: | 第366行: | ||
password = "$1234567890" | password = "$1234567890" | ||
} | } | ||
+ | |||
+ | |||
+ | |||
+ | |||
</pre> | </pre> | ||
+ | == R== | ||
+ | 用Module创建多台ECS实例。在本示例中,创建3台ECS实例。 | ||
+ | https://help.aliyun.com/document_detail/95830.html?spm=a2c4g.11186623.6.550.17317c8cNSSlJu | ||
+ | |||
+ | [https://www.yunduan.io/posts/alicloud-terraform-create-ecs-ansible-provision/ 使用terraform创建阿里ecs用ansible完成主机配置] | ||
[https://www.cnblogs.com/rongfengliang/p/7768142.html terraform 阿里云基本使用 ] | [https://www.cnblogs.com/rongfengliang/p/7768142.html terraform 阿里云基本使用 ] | ||
第270行: | 第385行: | ||
[https://blog.csdn.net/cr7258/article/details/114555938 Terraform一键部署ECS实例] | [https://blog.csdn.net/cr7258/article/details/114555938 Terraform一键部署ECS实例] | ||
− | + | [https://developer.aliyun.com/article/720970 Terraform 一分钟部署阿里云ECS集群(含视频)] | |
[https://developer.aliyun.com/article/713099 玩转阿里云 Terraform(一):Terraform 是什么] | [https://developer.aliyun.com/article/713099 玩转阿里云 Terraform(一):Terraform 是什么] | ||
[https://www.cnblogs.com/rongfengliang/p/7768142.html terraform 阿里云基本使用] | [https://www.cnblogs.com/rongfengliang/p/7768142.html terraform 阿里云基本使用] | ||
+ | |||
+ | [https://developer.aliyun.com/article/69109 当Terraform遇上ECS(一)——DataSource篇] | ||
进阶 | 进阶 | ||
第281行: | 第398行: | ||
https://registry.terraform.io/modules/alibaba/ecs-instance/alicloud/latest | https://registry.terraform.io/modules/alibaba/ecs-instance/alicloud/latest | ||
+ | |||
=qqcloud= | =qqcloud= | ||
<pre> | <pre> | ||
第311行: | 第429行: | ||
[https://cloud.tencent.com/developer/article/1487537?from=article.detail.1482560 腾讯云Terraform应用指南(四)] | [https://cloud.tencent.com/developer/article/1487537?from=article.detail.1482560 腾讯云Terraform应用指南(四)] | ||
+ | |||
+ | =Google Cloud [[GCP基础#terrafomr]]= | ||
+ | |||
+ | [https://opensofty.com/zh-cn/2020/2/11/%E5%A6%82%E4%BD%95%E5%9C%A8google-cloud-platform%E4%B8%8A%E4%BD%BF%E7%94%A8terraform/ 如何在Google Cloud Platform上使用Terraform] | ||
=aws= | =aws= | ||
+ | <pre> | ||
+ | 关于 Terraform 工作目录中文件命名 | ||
+ | Terraform 运行时会读取工作目录中所有的 *.tf, *.tfvars 文件,所以我们不必把所有的东西都写在单个文件中去,应按职责分列在不同的文件中,例如: | ||
+ | provider.tf -- provider 配置 | ||
+ | terraform.tfvars -- 配置 provider 要用到的变量 | ||
+ | varable.tf -- 通用变量 | ||
+ | resource.tf -- 资源定义 | ||
+ | data.tf -- 包文件定义 | ||
+ | output.tf -- 输出 | ||
− | https://ruby-china.org/topics/37891 运维 用 Terraform 自动化构建基础设施 aws | + | 以此篇最简单的入门出发,以后可以深入了解 Lambda, Lambda 触发器,及 API Gateway, EC2 实例怎么用 Terraform 来管理,也知晓了资源的可用属性应该到哪里去查。 |
+ | |||
+ | 一个小提示:在执行像 terraform plan 或 terraform apply 等命令的时候,可以按下 ctrl + c 让控制台输出详细的日志信息。 | ||
+ | </pre> | ||
+ | |||
+ | ==R == | ||
+ | |||
+ | 原版 https://www.howtoforge.com/what-is-terraform-and-how-to-install-it-on-a-aws-ec2-instance/ | ||
+ | |||
+ | [https://www.wake.wiki/article/2021/3/29/1.html terraform 自动创建一台aws机器,并安装apache2服务,提供80,443端口进行访问脚本--good] | ||
+ | |||
+ | [https://0xzx.com/2021111519501872857.html 什么是 Terraform 以及如何在 AWS EC2 上安装和使用它] | ||
+ | |||
+ | [https://www.jianshu.com/p/d0035b7c3801 使用Terraform在AWS上建立VPC-good] | ||
+ | |||
+ | https://docs.aws.amazon.com/zh_cn/vpc/latest/userguide/VPC_Scenario2.html | ||
+ | |||
+ | [https://blog.csdn.net/qq_38589895/article/details/105835566 使用TerraForm在AWS上创建VPC-详细] | ||
+ | |||
+ | https://github.com/evan886/2022test/tree/main/terraform-aws | ||
+ | |||
+ | https://registry.terraform.io/providers/hashicorp/aws/latest/docs 官方看这个 | ||
+ | |||
+ | [https://shuke163.github.io/2020/06/24/Terraform%E4%B9%8B%E7%94%B3%E8%AF%B7AWS%E7%9A%84EC2/ Terraform之申请AWS的EC2] | ||
+ | |||
+ | |||
+ | [https://blog.csdn.net/shenghuiping2001/article/details/113730460?spm=1001.2101.3001.6650.2&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-2-113730460-blog-105835566.pc_relevant_antiscanv2&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-2-113730460-blog-105835566.pc_relevant_antiscanv2&utm_relevant_index=2 Terraform 快速生成aws 实例+ VPC+ 子网学习用不错 一步步来的] | ||
+ | |||
+ | [https://ruby-china.org/topics/37891 运维 用 Terraform 自动化构建基础设施 aws] | ||
[https://yanbin.blog/terraform-get-started-with-first-sample/#more-8220 Terraform 使用 - 从最简单例子开始] | [https://yanbin.blog/terraform-get-started-with-first-sample/#more-8220 Terraform 使用 - 从最简单例子开始] | ||
+ | |||
+ | [https://github.com/mylamour/blog/issues/31 使用Terraform在AWS多区部署虚拟货币钱包节点 #31 ] | ||
+ | |||
+ | [https://www.5axxw.com/wiki/content/w7o0ob 将现有的AWS资源导出到Terraform样式(tf,tfstate) ] | ||
+ | |||
+ | [https://blog.csdn.net/weixin_26737625/article/details/108866919 terraform s3_使用Terraform自动使用Amazon EC2,EFS,S3,CloudFront启动Wordpress] | ||
+ | |||
+ | [https://www.jianshu.com/p/0dfec32dab65 Terraform 入门教程-001] | ||
+ | |||
+ | [https://blog.csdn.net/Jailman/article/details/117073497 terraform aws入门] | ||
+ | |||
+ | [https://www.cnblogs.com/operationhome/p/11037867.html AWS云创建EC2与使用注意事项-踩坑记录] | ||
+ | |||
+ | [https://www.elastic.co/cn/blog/automate-all-the-things-terraform-ansible-elastic-cloud-enterprise-ecegg 对所有操作进行自动化:Terraform + Ansible + Elastic Cloud Enterprise] | ||
+ | |||
+ | |||
+ | [https://aws.amazon.com/cn/blogs/china/terraform-architecture-practice-introduction-aws-based-environment/ Terraform架构实践(1)- AWS上基础环境介绍] | ||
+ | |||
+ | [https://aws.amazon.com/cn/blogs/china/aws-china-region-guide-series-terraform1/ 使用 Terraform 在 AWS 中国区域实现自动化部署指南系列(一) TERRAFORM 入门] | ||
+ | |||
+ | [https://aws.amazon.com/cn/blogs/china/aws-china-region-guide-series-terraform2/ 使用 Terraform 在 AWS 中国区域实现自动化部署指南系列(二) TERRAFORM 进阶] | ||
+ | |||
+ | =azure= | ||
+ | |||
+ | [https://www.cnblogs.com/sparkdev/p/10052310.html Terraform:简介] | ||
+ | |||
+ | [https://wsgzao.github.io/post/terraform-azure/ Terraform Azure 部署实践 ] | ||
+ | =ucloud= | ||
+ | [https://zhuanlan.zhihu.com/p/58688963 服务器太多了不好管?UCloud基于Terraform的资源编排工具详解] | ||
+ | |||
+ | https://docs.ucloud.cn/terraform/solutions/1 | ||
+ | |||
+ | =terraform-provider-vultr = | ||
+ | [https://github.com/vultr/terraform-provider-vultr/blob/master/website/docs/index.html.markdown vultr / terraform-provider-vultr ] | ||
+ | |||
+ | [https://www.kaifa99.com/GitHub/article_131017 terraform-provider-vultr, 这是Vultr云的terraform提供程序] | ||
+ | |||
=terraform local= | =terraform local= | ||
第329行: | 第525行: | ||
[https://blog.csdn.net/yu15050186065/article/details/108796789?utm_medium=distribute.pc_relevant_download.none-task-blog-2~default~BlogCommendFromBaidu~default-1.nonecase&depth_1-utm_source=distribute.pc_relevant_download.none-task-blog-2~default~BlogCommendFromBaidu~default-1.nonecas terraform local] | [https://blog.csdn.net/yu15050186065/article/details/108796789?utm_medium=distribute.pc_relevant_download.none-task-blog-2~default~BlogCommendFromBaidu~default-1.nonecase&depth_1-utm_source=distribute.pc_relevant_download.none-task-blog-2~default~BlogCommendFromBaidu~default-1.nonecas terraform local] | ||
− | = | + | https://github.com/hashicorp/terraform-provider-local |
+ | |||
+ | = terraform-localstack:使用Groovy测试Terraform集成-源码= | ||
+ | |||
+ | = proxmox terraform-provider-proxmox = | ||
+ | |||
+ | [[terraform-provider-proxmox]] | ||
+ | |||
+ | https://registry.terraform.io/providers/Telmate/proxmox/latest/docs | ||
+ | |||
+ | 1. Proxmox-Provider | ||
+ | |||
+ | 目前社区主要有两个 provider: | ||
+ | |||
+ | Telmate/terraform-provider-proxmox: 用户最多,但是只支持管理虚拟机资源。 | ||
+ | danitso/terraform-provider-proxmox: stars 少,但是可以管理 PVE 的大部分资源,包括节点、用户、资源池、TLS证书等等。 | ||
+ | 代码更顺眼,但是作者忙,没时间合并 pr,导致 Bug 更多一些。 | ||
+ | 不能设置虚拟机开机自启(onboot),而且目前不支持 disk resize | ||
+ | |||
+ | PVE 虚拟机的创建/修改/销毁:pve-vm.tf | ||
+ | |||
+ | |||
+ | [https://developer.aliyun.com/article/770934 使用terraform管理Proxmox VE资源 ] | ||
+ | |||
+ | https://github.com/ryan4yin/knowledge/blob/master/infrastructure/terraform/README.md | ||
+ | |||
+ | https://github.com/Telmate/terraform-provider-proxmox/blob/master/docs/index.md | ||
+ | |||
+ | evan@myxps:~/.terraform.d/plugins$ mv terraform-provider-proxmox_v0.1.0_x4 terraform-provider-proxmox | ||
+ | |||
+ | =terraform virtualbox= | ||
+ | =book= | ||
+ | <pre> | ||
+ | ➜ localfile cat main.tf | ||
+ | terraform { | ||
+ | required_version = ">= 0.15" | ||
+ | required_providers { | ||
+ | local = { | ||
+ | source = "hashicorp/local" | ||
+ | version = "2.2.3" | ||
+ | } | ||
+ | } | ||
+ | } | ||
+ | |||
+ | resource "local_file" "literature" { | ||
+ | filename = "art_of_war.txt" | ||
+ | content = <<-EOT | ||
+ | Sun Tzu said: The art of war is of vital importance to the State. | ||
+ | |||
+ | It is a matter of life and death, a road either to safety or to | ||
+ | ruin. Hence it is a subject of inquiry which can on no account be | ||
+ | neglected. | ||
+ | EOT | ||
+ | } | ||
+ | |||
+ | </pre> | ||
+ | |||
+ | =基础知识点= | ||
+ | ==状态管理(多人协同使用terraform) == | ||
+ | 远程状态 | ||
+ | |||
+ | 状态文件默认是在本地目录上的terraform.tfstate文件,在团队使用中,每个人的电脑环境独立的,那么需要保证每个人当前的状态文件都是最新且与现实资源真实对应,简直是天方夜谭。而状态不一致所带的灾难也是极其可怕的。所以,状态文件最好是要存储在一个独立的大家可共同访问的位置。对于状态的管理的配置,Terraform称之为Backends | ||
+ | ===oss=== | ||
+ | ====利用 terraform 创建oss bucket ==== | ||
+ | <pre> | ||
+ | oss_backend# cat providers.tf | ||
+ | terraform { | ||
+ | required_providers { | ||
+ | alicloud = { | ||
+ | source = "aliyun/alicloud" | ||
+ | version = "1.230.1" | ||
+ | } | ||
+ | } | ||
+ | } | ||
+ | |||
+ | provider "alicloud" { | ||
+ | access_key = "xTAIxxxxxxxxxxxx" | ||
+ | secret_key = "xj6xxxxx" | ||
+ | region = "cn-guangzhou" | ||
+ | } | ||
+ | |||
+ | oss_backend# cat terraform.tf | ||
+ | # 创建用户 | ||
+ | resource "alicloud_ram_user" "user" { | ||
+ | name = "user_iac_evan" | ||
+ | display_name = "iac_evan" | ||
+ | mobile = "86-18520124008" | ||
+ | email = "[email protected]" | ||
+ | comments = "this is a user for iac: evan" | ||
+ | force = true | ||
+ | } | ||
+ | |||
+ | # 创建用户组 | ||
+ | resource "alicloud_ram_group" "group" { | ||
+ | name = "group-tf" | ||
+ | comments = "this is a group for tf" | ||
+ | force = true | ||
+ | } | ||
+ | |||
+ | # 将用户加入组 | ||
+ | resource "alicloud_ram_group_membership" "membership" { | ||
+ | group_name = alicloud_ram_group.group.name | ||
+ | user_names = [alicloud_ram_user.user.name] | ||
+ | } | ||
+ | |||
+ | # 创建bucket | ||
+ | resource "alicloud_oss_bucket" "bucket" { | ||
+ | bucket = "iac-evan-oss-backend" | ||
+ | acl = "private" | ||
+ | } | ||
+ | |||
+ | # 创建拥有指定oss bucket 的权限 | ||
+ | resource "alicloud_ram_policy" "policy" { | ||
+ | policy_name = "iac-evan-oss-backend" | ||
+ | policy_document = <<EOF | ||
+ | { | ||
+ | "Statement": [ | ||
+ | { | ||
+ | "Action": [ | ||
+ | "oss:*" | ||
+ | ], | ||
+ | "Effect": "Allow", | ||
+ | "Resource": [ | ||
+ | "acs:oss:*:*:${alicloud_oss_bucket.bucket.bucket}", | ||
+ | "acs:oss:*:*:${alicloud_oss_bucket.bucket.bucket}/*" | ||
+ | ] | ||
+ | } | ||
+ | ], | ||
+ | "Version": "1" | ||
+ | } | ||
+ | EOF | ||
+ | description = "this is a policy for tf oss backend" | ||
+ | force = true | ||
+ | } | ||
+ | |||
+ | # 策略绑定到组上 | ||
+ | resource "alicloud_ram_group_policy_attachment" "attach" { | ||
+ | policy_name = alicloud_ram_policy.policy.name | ||
+ | policy_type = alicloud_ram_policy.policy.type | ||
+ | group_name = alicloud_ram_group.group.name | ||
+ | } | ||
+ | |||
+ | # 获取该ram ak/sk并输出到文件中,ak/sk只输出一次,将文件删除后也不会再生成,只有重建该资源 | ||
+ | resource "alicloud_ram_access_key" "ak" { | ||
+ | user_name = alicloud_ram_user.user.name | ||
+ | secret_file = "aksk.txt" | ||
+ | } | ||
+ | |||
+ | |||
+ | </pre> | ||
+ | ====创建资源 ==== | ||
+ | terraform init | ||
+ | terraform apply | ||
+ | |||
+ | ====将state保存至oss ==== | ||
+ | <pre> | ||
+ | 添加 backend "oss" | ||
+ | 在terraform块中增加backend块,指定刚才创建的oss bucket,ak/sk也是用上面创建的,注意这里和我们原来provides块的ak/sk是可以不一样的 | ||
+ | |||
+ | |||
+ | |||
+ | cp providers.tf providers.tfbak | ||
+ | cat providers.tf | ||
+ | terraform { | ||
+ | backend "oss" { | ||
+ | profile = "terraform" | ||
+ | bucket = "iac-evan-oss-backend" | ||
+ | prefix = "projectA/env_dev/" | ||
+ | access_key = "LTAxxx" | ||
+ | secret_key = "kj6xxx" | ||
+ | region = "cn-guangzhou" | ||
+ | } | ||
+ | |||
+ | |||
+ | required_providers { | ||
+ | alicloud = { | ||
+ | source = "aliyun/alicloud" | ||
+ | #source = "local-registry/aliyun/alicloud" | ||
+ | version = "1.230.1" | ||
+ | } | ||
+ | } | ||
+ | } | ||
+ | |||
+ | provider "alicloud" { | ||
+ | access_key = "Lxxx" | ||
+ | secret_key = "kjxxxf" | ||
+ | region = "cn-guangzhou" | ||
+ | } | ||
+ | |||
+ | |||
+ | |||
+ | 重新init该工程 | ||
+ | |||
+ | terraform init | ||
+ | |||
+ | Initializing the backend... | ||
+ | Do you want to copy existing state to the new backend? | ||
+ | Pre-existing state was found while migrating the previous "local" backend to the | ||
+ | newly configured "oss" backend. An existing non-empty state already exists in | ||
+ | the new backend. The two states have been saved to temporary files that will be | ||
+ | removed after responding to this query. | ||
+ | |||
+ | Previous (type "local"): /tmp/terraform3485871911/1-local.tfstate | ||
+ | New (type "oss"): /tmp/terraform3485871911/2-oss.tfstate | ||
+ | |||
+ | Do you want to overwrite the state in the new backend with the previous state? | ||
+ | Enter "yes" to copy and "no" to start with the existing state in the newly | ||
+ | configured "oss" backend. | ||
+ | |||
+ | oss bucket中就会有个state文件terraform.tfstate,而我们本地的state文件则为空 | ||
+ | 这时只需要有providers.tf、terraform.tf这两个文件就可在别的地方重用state了 | ||
+ | </pre> | ||
+ | |||
+ | === consul=== | ||
+ | <pre> | ||
+ | consul US: [ˈkɑns(ə)l] n.领事 Web执政官;公使;总督表 | ||
+ | 安装请看官网非常容易的 | ||
+ | |||
+ | consul agent -dev -client 0.0.0.0 -ui | ||
+ | |||
+ | terraform code | ||
+ | |||
+ | backend-ubuntu cat main.tf | ||
+ | terraform { | ||
+ | required_providers { | ||
+ | proxmox = { | ||
+ | source = "Telmate/proxmox" | ||
+ | version = "2.9.11" | ||
+ | } | ||
+ | } | ||
+ | |||
+ | |||
+ | backend "consul" { | ||
+ | address = "192.168.10.22:8500" | ||
+ | scheme = "http" | ||
+ | path = "my-consul-project" | ||
+ | } | ||
+ | } | ||
+ | 中间省 | ||
+ | provisioner "local-exec" { | ||
+ | command = "sleep 1000" | ||
+ | } | ||
+ | |||
+ | } | ||
+ | |||
+ | |||
+ | |||
+ | |||
+ | http://192.168.10.22:8500/ui/dc1/services | ||
+ | |||
+ | http://192.168.10.22:8500/ui/dc1/kv | ||
+ | |||
+ | Consul中可以看到名为my-consul-project的键 | ||
+ | |||
+ | 可以看到,原本保存在工作目录下的tfstate文件的内容,被保存在了Consul的名为my-consul-project的键下。 | ||
+ | |||
+ | 让我们执行terraform destroy后,重新访问 | ||
+ | |||
+ | 最后的效果 | ||
+ | |||
+ | backend-ubuntu terraform apply | ||
+ | Acquiring state lock. This may take a few moments... | ||
+ | ╷ | ||
+ | │ Error: Error acquiring the state lock | ||
+ | │ | ||
+ | │ Error message: Lock Info: | ||
+ | │ ID: bc4b35c4-a8a2-1467-a1e6-3a2fea0dfb39 | ||
+ | │ Path: my-consul-project | ||
+ | │ Operation: OperationTypeApply | ||
+ | │ Who: evan@myxps | ||
+ | │ Version: 1.4.0 | ||
+ | │ Created: 2023-04-14 09:38:38.938683897 +0000 UTC | ||
+ | │ Info: consul session: bc4b35c4-a8a2-1467-a1e6-3a2fea0dfb39 | ||
+ | │ | ||
+ | │ | ||
+ | │ Terraform acquires a state lock to protect the state from being written | ||
+ | │ by multiple users at the same time. Please resolve the issue above and try | ||
+ | │ again. For most commands, you can disable locking with the "-lock=false" | ||
+ | │ flag, but this is not recommended. | ||
+ | |||
+ | </pre> | ||
+ | |||
+ | ====consul 安全相关 ==== | ||
+ | <pre> | ||
+ | |||
+ | 明天补上 在22机器上 | ||
+ | |||
+ | 安装这些可以省略的 | ||
+ | ubuntu-2004-vm-2-Kuboard:~# apt install nginx | ||
+ | |||
+ | cat /etc/nginx/conf.d/consul.db | ||
+ | evan:$apr1$ybLIEYPk$3gzs.8FIPdE.8m/6pQU/L/ | ||
+ | |||
+ | vi /etc/nginx/nginx.conf | ||
+ | ## evan | ||
+ | |||
+ | server { | ||
+ | listen 85; | ||
+ | # # 认证提示名称 | ||
+ | auth_basic "Authentication"; | ||
+ | auth_basic_user_file conf.d/consul.db; | ||
+ | location / { | ||
+ | # ## 代理地址,$host表示获取访问IP,可写为127.0.0.1 | ||
+ | #proxy_pass http://$host:8500; | ||
+ | #proxy_pass http://127.0.0.1:8500; | ||
+ | proxy_pass http://127.0.0.1:8500 ; | ||
+ | proxy_http_version 1.1; | ||
+ | proxy_set_header Upgrade $http_upgrade; | ||
+ | proxy_set_header Connection keep-alive; | ||
+ | proxy_set_header Host $http_host; | ||
+ | proxy_set_header X-Real-IP $remote_addr; | ||
+ | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
+ | proxy_cache_bypass $http_upgrade; | ||
+ | } | ||
+ | } | ||
+ | ##evan | ||
+ | |||
+ | 过程上的 502 不太明白 哪里的问题 | ||
+ | |||
+ | 安全加强后的代码 | ||
+ | |||
+ | ➜ backend-ubuntu cat main.tf | ||
+ | terraform { | ||
+ | required_providers { | ||
+ | proxmox = { | ||
+ | source = "Telmate/proxmox" | ||
+ | version = "2.9.11" | ||
+ | } | ||
+ | } | ||
+ | |||
+ | |||
+ | backend "consul" { | ||
+ | address = "192.168.10.22:85" | ||
+ | scheme = "http" | ||
+ | http_auth = "evan:123456789" | ||
+ | path = "my-consul-project" | ||
+ | } | ||
+ | } | ||
+ | 中间省略 | ||
+ | |||
+ | provisioner "local-exec" { | ||
+ | command = "sleep 10000" | ||
+ | } | ||
+ | |||
+ | } | ||
+ | |||
+ | |||
+ | |||
+ | consul ui没有访问权限,所有人都可以修改key/value,不安全。所以,发现了Consul Manager这个开源的dashboard可以通过权限管理,还可以为不同的角色设置的不同的权限 | ||
+ | </pre> | ||
+ | [https://tool.oschina.net/htpasswd 在线 htpasswd 生成器 Feedback] | ||
+ | |||
+ | ==== 参考==== | ||
+ | https://developer.hashicorp.com/terraform/language/settings/backends/consul | ||
+ | |||
+ | [https://blog.csdn.net/qq_28808029/article/details/113266533 Consul Web添加访问认证] | ||
+ | |||
+ | [https://kingfree.gitbook.io/consul/ Consul 中文文档] | ||
+ | |||
+ | [https://www.cnblogs.com/ruanyifeng/p/5550102.html Consul入门] | ||
+ | |||
+ | [https://zhuanlan.zhihu.com/p/122340918 带你入门consul] | ||
+ | |||
+ | [https://cloud.tencent.com/developer/article/1402481 consul安全加固] | ||
+ | |||
+ | [https://blog.csdn.net/zhengpeitao/article/details/54691563 consul ACL配置使用] | ||
+ | |||
+ | [https://book-consul-guide.vnzmi.com/09_webui.html WEB管理界面] | ||
+ | |||
+ | [https://lonegunmanb.github.io/introduction-terraform/2.2.Terraform%E5%9F%BA%E7%A1%80%E6%A6%82%E5%BF%B5%E2%80%94%E2%80%94%E7%8A%B6%E6%80%81%E7%AE%A1%E7%90%86.html Terraform基础概念——状态管理] | ||
+ | |||
+ | ==States状态管理 == | ||
+ | 状态管理命令 | ||
+ | <pre> | ||
+ | 显示状态列表: | ||
+ | root@myxps:/home/evan/terraformtest# terraform state list | ||
+ | local_file.terraform-introduction | ||
+ | |||
+ | 查看具体资源的状态信息: | ||
+ | # local_file.terraform-introduction: | ||
+ | resource "local_file" "terraform-introduction" { | ||
+ | content = "https://www.pkslow.com" | ||
+ | content_base64sha256 = "YEhk4qqVC6gaCW3ftlu6GxKyT9ItPAg6cRnk0/GDg0s=" | ||
+ | content_base64sha512 = "J2l3gvL3vvZF9JZWYgKNYDT4p2PBeFwRb1oYJEo94P4t4qhLIP3Tlf1qpwNcRMY/FuqpjOxBj/CT9YJkNHy4Dw==" | ||
+ | content_md5 = "90e7a137c76fe406e1b7bdf8ad4dbc07" | ||
+ | content_sha1 = "6db7ad1bbf57df0c859cd5fc62ff5408515b5fc1" | ||
+ | content_sha256 = "604864e2aa950ba81a096ddfb65bba1b12b24fd22d3c083a7119e4d3f183834b" | ||
+ | content_sha512 = "27697782f2f7bef645f4965662028d6034f8a763c1785c116f5a18244a3de0fe2de2a84b20fdd395fd6aa7035c44c63f16eaa98cec418ff093f58264347cb80f" | ||
+ | directory_permission = "0777" | ||
+ | file_permission = "0777" | ||
+ | filename = "./terraform-guides-by-pkslow.txt" | ||
+ | id = "6db7ad1bbf57df0c859cd5fc62ff5408515b5fc1" | ||
+ | } | ||
+ | |||
+ | 显示当前状态信息: | ||
+ | |||
+ | $ terraform state pull | ||
+ | |||
+ | </pre> | ||
+ | |||
+ | =references= | ||
+ | [https://www.cnblogs.com/occl/p/14738236.html terraform入门操作指南] | ||
+ | |||
+ | |||
+ | [https://www.xadocker.cn/archives/975.html 远程管理Terraform的state] | ||
+ | |||
+ | https://www.cnblogs.com/syavingcs/tag/Terraform/ | ||
+ | |||
+ | [https://liupeng0518.github.io/2019/10/05/k8s/%E7%BC%96%E6%8E%92/%E6%B7%B7%E5%90%88%E4%BA%91%E7%BC%96%E6%8E%92%E5%B7%A5%E5%85%B7terrafrom/ 混合云编排工具terraform] | ||
+ | |||
+ | |||
[https://help.aliyun.com/document_detail/145531.html?spm=a2c4g.11186623.6.573.13b13c3dRRN1oU Terraform常用命令] | [https://help.aliyun.com/document_detail/145531.html?spm=a2c4g.11186623.6.573.13b13c3dRRN1oU Terraform常用命令] | ||
+ | |||
+ | [https://blog.csdn.net/newtyun/article/details/106435754 Terraform有多重要,能否代替] | ||
+ | [[category:terraform]] | ||
=使用实例标识 image-id etc= | =使用实例标识 image-id etc= |
2024年10月3日 (四) 09:25的最新版本
目录
- 1 进阶
- 2 语法
- 3 Deploy and Monitor Applications terraform 部署应用
- 4 ins
- 5 usage
- 6 usage on aliyun
- 7 qqcloud
- 8 Google Cloud GCP基础#terrafomr
- 9 aws
- 10 azure
- 11 ucloud
- 12 terraform-provider-vultr
- 13 terraform local
- 14 terraform-localstack:使用Groovy测试Terraform集成-源码
- 15 proxmox terraform-provider-proxmox
- 16 terraform virtualbox
- 17 book
- 18 基础知识点
- 19 references
- 20 使用实例标识 image-id etc
进阶
以Terraform为代表的资源编排类 资源编排工具的 Provisioner
tf 文件在 Vim 中的语法加亮是安装的hashivim/vim-terraform;插件
Terraform被设计成一个多云基础设施编排工具,不像CloudFormation那样绑定AWS平台,Terraform可以同时编排各种云平台或是其他基础设施的资源。Terraform实现多云编排的方法就是Provider插件机制。
几个重要的概念 resource 数据源通过一种特殊的资源访问:data资源
terraform电子书 learning June 2022 基本看完了
语法
在for_each和count之间选择
如果创建的资源实例彼此之间几乎完全一致,那么count比较合适。如果彼此之间的参数差异无法直接从count的下标派生,那么使用for_each会更加安全
Deploy and Monitor Applications terraform 部署应用
https://learn.hashicorp.com/collections/terraform/applications
terraform 部署 docker
/home/evan/.terraform# cat main.tf terraform { required_providers { // 声明要用的provider docker = { source = "kreuzwerker/docker" // 要用的版本,不写默认拉取最新的 version = "3.0.2" } } } // 语法 resource resource_type name // 声明docker_image的镜像,nginx只是一个名字,只要符合变量命名规则即可 resource "docker_image" "nginx" { // 使用的是镜像名,https://hub.docker.com/layers/nginx/library/nginx/latest/images/sha256-3536d368b898eef291fb1f6d184a95f8bc1a6f863c48457395aab859fda354d1?context=explore name = "nginx:latest" } resource "docker_container" "nginx" { image = docker_image.nginx.name name = "nginx_test" ports { internal = 80 // docker 内部的端口 external = 8000 // 对外访问的端口 } volumes { container_path = "/usr/share/nginx/html" host_path = "/tmp/nginx_home" } } mkdir -p /tmp/nginx_home vi /tmp/nginx_home/index.html http://192.168.10.105:8000/
https://learn.hashicorp.com/tutorials/terraform/docker-build?in=terraform/docker-get-started
Terraform入门(Infrastructure as Code)
ins
#直接 apt kali就直接下载 包啦 vi ~/.bashrc alias terraform='~/data/apps/terraform/terraform' 或者 二进制包 mv到 /usr/local/bin/ or /usr/bin curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add - sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main" sudo apt-get update && sudo apt-get install terraform #也可手工加 哈哈 lsb_release -cs buster wget -c https://releases.hashicorp.com/terraform/0.15.4/terraform_0.15.4_linux_amd64.zip unzip terraform_0.15.4_linux_amd64.zip #sudo mv terraform /usr/bin/ mkdir /home/evan/data/apps/terraform && mv terraform /home/evan/data/apps/terraform/ echo 'export PATH=/home/evan/data/apps/terraform:$PATH' >> /etc/profile echo 'export PATH=/home/evan/data/apps/:$PATH' >> /etc/profile #这个不行 少了一个目录 找不到了 写在你的home ~/.profile 也是可以的 为你本用户使用方便 export PATH=/home/evan/data/apps/terraform:$PATH #if APT Packages for Debian and Ubuntu curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add - 216 sudo apt-add-repository "deb [arch=$(dpkg --print-architecture)] https://apt.releases.hashicorp.com $(lsb_release -cs) main" 218 apt update 219 sudo apt install terraform 像 git 一样,每个 Terraform 项目需要自己单独的目录空间,所以我们创建一个 terraform-learning 目录 mkdir terraform-learning cd terraform-learning 该目录下的所有 *.tf 文件都会被 Terraform 加载,在初始化 Terraform 工作空间之前必须至少要有一个 *.tf 文件。我们这里建立文件 main.tf, 内容如下 后建议先配置子命令自动补全功能: terraform -install-autocomplete
https://developer.hashicorp.com/terraform/install?product_intent=terraform terraform的安装和应用
usage
https://pin-yi.me/blog/terraform/terraform/
usage on aliyun
以aliyun作为例子
#把相关密码写入 不是写在文本 安全一点吧 export ALICLOUD_ACCESS_KEY="LTAIUrZCw3********" export ALICLOUD_SECRET_KEY="zfwwWAMWIAiooj14GQ2*************" export ALICLOUD_REGION="cn-guangzhou"
evan@myxps:~/.terraform.d$ cat terraform.tf resource "alicloud_vpc" "vpc" { vpc_name = "tf_test_foo" cidr_block = "172.16.0.0/12" } resource "alicloud_vswitch" "vsw" { vpc_id = alicloud_vpc.vpc.id cidr_block = "172.16.0.0/21" zone_id = "cn-guangzhou-b" } evan@myxps:~/.terraform.d$ terraform init #自动安装了alicloud provider plugis Initializing the backend... Initializing provider plugins... - Finding latest version of hashicorp/alicloud... - Installing hashicorp/alicloud v1.124.0... Terraform has created a lock file .terraform.lock.hcl to record the provider selections it made above. Include this file in your version control repository so that Terraform can guarantee to make the same selections by default when you run "terraform init" in the future. ╷ │ Warning: Additional provider information from registry │ │ The remote registry returned warnings for │ registry.terraform.io/hashicorp/alicloud: │ - For users on Terraform 0.13 or greater, this provider has moved to │ aliyun/alicloud. Please update your source in required_providers. ╵ Terraform has been successfully initialized! You may now begin working with Terraform. Try running "terraform plan" to see any changes that are required for your infrastructure. All Terraform commands should now work. If you ever set or change modules or backend configuration for Terraform, rerun this command to reinitialize your working directory. If you forget, other commands will detect it and remind you to do so if necessary. terraform apply # evan@myxps:~/.terraform.d$ terraform apply alicloud_vpc.vpc: Refreshing state... [id=vpc-7xvsw3jjadaf53zjlido6] Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # alicloud_vswitch.vsw will be created + resource "alicloud_vswitch" "vsw" { + availability_zone = (known after apply) + cidr_block = "172.16.0.0/21" + id = (known after apply) + name = (known after apply) + status = (known after apply) + vpc_id = "vpc-7xvsw3jjadaf53zjlido6" + vswitch_name = (known after apply) + zone_id = "cn-guangzhou-b" } Plan: 1 to add, 0 to change, 0 to destroy. Do you want to perform these actions? Terraform will perform the actions described above. Only 'yes' will be accepted to approve. Enter a value: yes alicloud_vswitch.vsw: Creating... alicloud_vswitch.vsw: Creation complete after 6s [id=vsw-7xvwa2oq0fsjm3xuhv9ss] Apply complete! Resources: 1 added, 0 changed, 0 destroyed. https://vpc.console.aliyun.com/vpc/cn-guangzhou/vpcs 打开 web 有了 terraform show ##查看已创建的专有网络和交换机 # alicloud_vpc.vpc: resource "alicloud_vpc" "vpc" { cidr_block = "172.16.0.0/12" id = "vpc-7xvsw3jjadaf53zjlido6" name = "tf_test_foo" route_table_id = "vtb-7xvjpppz3q8kin5vi081k" router_id = "vrt-7xvi5nvfqmvg0mox9rj5j" router_table_id = "vtb-7xvjpppz3q8kin5vi081k" secondary_cidr_blocks = [] status = "Available" user_cidrs = [] vpc_name = "tf_test_foo" } # alicloud_vswitch.vsw: resource "alicloud_vswitch" "vsw" { availability_zone = "cn-guangzhou-b" cidr_block = "172.16.0.0/21" id = "vsw-7xvwa2oq0fsjm3xuhv9ss" status = "Available" vpc_id = "vpc-7xvsw3jjadaf53zjlido6" zone_id = "cn-guangzhou-b" } 2 在上一步创建的专有网络中创建一个安全组,并添加一个允许任何地址访问的安全组规则。 在terraform.tf文件中增加以下内容。 resource "alicloud_security_group" "default" { name = "default" vpc_id = alicloud_vpc.vpc.id } resource "alicloud_security_group_rule" "allow_all_tcp" { type = "ingress" ip_protocol = "tcp" nic_type = "intranet" policy = "accept" port_range = "1/65535" priority = 1 security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } 运行terraform apply #开始创建。 有时time out 再来一次就好了 运行terraform show查看已创建的安全组和安全组规则。 您也可以登录ECS控制台查看安全组和安全组规则。 https://ecs.console.aliyun.com/?spm=5176.10483814.recommend.decs.78e6124322cN4j#/securityGroup/region/cn-guangzhou 3.创建ECS实例。 在terraform.tf文件中增加以下内容。 resource "alicloud_instance" "instance" { # cn-beijing availability_zone = "cn-beijing-b" security_groups = alicloud_security_group.default.*.id # series III 能找个最小的么 ecs.s6-c1m1.small instance_type = "ecs.s6-c1m1.small" #instance_type = "ecs.n2.small" system_disk_category = "cloud_efficiency" image_id = "ubuntu_18_04_64_20G_alibase_20190624.vhd" instance_name = "test_foo" vswitch_id = alicloud_vswitch.vsw.id internet_max_bandwidth_out =10 password = "$Eevan2240881" } 说明 在上述示例中,指定了internet_max_bandwidth_out= 10,因此会自动为实例分配一个公网IP。 详细的参数解释请参见 image_id 指定ubuntu_16_0402_32,最终会匹配ubuntu_16_0402_32_40G_alibase_20170711.vhd。
最终比较完整的配置文件
evan@myxps:~/.terraform.d$ cat terraform.tf resource "alicloud_vpc" "vpc" { vpc_name = "tf_test_foo" cidr_block = "172.16.0.0/12" } resource "alicloud_vswitch" "vsw" { vpc_id = alicloud_vpc.vpc.id cidr_block = "172.16.0.0/21" zone_id = "cn-guangzhou-b" } resource "alicloud_security_group" "default" { name = "default" vpc_id = alicloud_vpc.vpc.id } resource "alicloud_security_group_rule" "allow_all_tcp" { type = "ingress" ip_protocol = "tcp" nic_type = "intranet" policy = "accept" port_range = "1/65535" priority = 1 security_group_id = alicloud_security_group.default.id cidr_ip = "0.0.0.0/0" } #ec2 create resource "alicloud_instance" "instance" { # cn-beijing availability_zone = "cn-guangzhou-b" security_groups = alicloud_security_group.default.*.id # series III 能找个最小的么 ecs.s6-c1m1.small instance_type = "ecs.s6-c1m1.small" #instance_type = "ecs.n2.small" system_disk_category = "cloud_efficiency" image_id = "centos_7_9_x64_20G_alibase_20201228.vhd" instance_name = "test_foo" vswitch_id = alicloud_vswitch.vsw.id internet_max_bandwidth_out =10 password = "$1234567890" }
R
用Module创建多台ECS实例。在本示例中,创建3台ECS实例。 https://help.aliyun.com/document_detail/95830.html?spm=a2c4g.11186623.6.550.17317c8cNSSlJu
使用terraform创建阿里ecs用ansible完成主机配置
玩转阿里云 Terraform(一):Terraform 是什么
当Terraform遇上ECS(一)——DataSource篇
进阶
terraform-alicloud-modules / terraform-alicloud-ecs-instance官方
https://registry.terraform.io/modules/alibaba/ecs-instance/alicloud/latest
qqcloud
NOTES 将秘钥直接填入到.tf文件中是十分不安全的,在多用户共同管理资源时,不建议把腾讯云API 的秘钥直接写到源代码里,以免一不小心更新到公开的版本中,造成安全风险。 腾讯云提供了另一种更为安全可靠的方式,把秘钥信息放在环境变量中配置 // Configure the secret key in the environment path $ export TENCENTCLOUD_SECRET_ID="your_fancy_accessid" $ export TENCENTCLOUD_SECRET_KEY="your_fancy_accesskey" $ export TENCENTCLOUD_REGION="ap-hongkong" 这样在 provider.tf 文件中就可以省略掉相关信息 $ vim provider.tf // provider.tf provider "tencentcloud" {}
https://cloud.tencent.com/developer/article/1473713
Google Cloud GCP基础#terrafomr
如何在Google Cloud Platform上使用Terraform
aws
关于 Terraform 工作目录中文件命名 Terraform 运行时会读取工作目录中所有的 *.tf, *.tfvars 文件,所以我们不必把所有的东西都写在单个文件中去,应按职责分列在不同的文件中,例如: provider.tf -- provider 配置 terraform.tfvars -- 配置 provider 要用到的变量 varable.tf -- 通用变量 resource.tf -- 资源定义 data.tf -- 包文件定义 output.tf -- 输出 以此篇最简单的入门出发,以后可以深入了解 Lambda, Lambda 触发器,及 API Gateway, EC2 实例怎么用 Terraform 来管理,也知晓了资源的可用属性应该到哪里去查。 一个小提示:在执行像 terraform plan 或 terraform apply 等命令的时候,可以按下 ctrl + c 让控制台输出详细的日志信息。
R
原版 https://www.howtoforge.com/what-is-terraform-and-how-to-install-it-on-a-aws-ec2-instance/
terraform 自动创建一台aws机器,并安装apache2服务,提供80,443端口进行访问脚本--good
什么是 Terraform 以及如何在 AWS EC2 上安装和使用它
https://docs.aws.amazon.com/zh_cn/vpc/latest/userguide/VPC_Scenario2.html
https://github.com/evan886/2022test/tree/main/terraform-aws
https://registry.terraform.io/providers/hashicorp/aws/latest/docs 官方看这个
Terraform 快速生成aws 实例+ VPC+ 子网学习用不错 一步步来的
使用Terraform在AWS多区部署虚拟货币钱包节点 #31
将现有的AWS资源导出到Terraform样式(tf,tfstate)
terraform s3_使用Terraform自动使用Amazon EC2,EFS,S3,CloudFront启动Wordpress
对所有操作进行自动化:Terraform + Ansible + Elastic Cloud Enterprise
使用 Terraform 在 AWS 中国区域实现自动化部署指南系列(一) TERRAFORM 入门
使用 Terraform 在 AWS 中国区域实现自动化部署指南系列(二) TERRAFORM 进阶
azure
ucloud
服务器太多了不好管?UCloud基于Terraform的资源编排工具详解
https://docs.ucloud.cn/terraform/solutions/1
terraform-provider-vultr
vultr / terraform-provider-vultr
terraform-provider-vultr, 这是Vultr云的terraform提供程序
terraform local
ocal 局部变量可以引用variable,resource,data中的一些资源属性,从而拼接改造需要的样式以供一起资源引用,local比variable更灵活,但local不能从外部来赋值。 局部值可能有助于避免在配置中多次重复相同的值或表达式,但是如果过度使用局部值,也可能通过隐藏使用的实际值而使以后的维护人员难以读取配置。 仅在某些地方使用单个值或结果且将来可能会更改该值的情况下,才应适度使用局部值。易于在中心位置更改值的能力是本地值的主要优势。
https://github.com/hashicorp/terraform-provider-local
terraform-localstack:使用Groovy测试Terraform集成-源码
proxmox terraform-provider-proxmox
https://registry.terraform.io/providers/Telmate/proxmox/latest/docs
1. Proxmox-Provider
目前社区主要有两个 provider:
Telmate/terraform-provider-proxmox: 用户最多,但是只支持管理虚拟机资源。 danitso/terraform-provider-proxmox: stars 少,但是可以管理 PVE 的大部分资源,包括节点、用户、资源池、TLS证书等等。 代码更顺眼,但是作者忙,没时间合并 pr,导致 Bug 更多一些。 不能设置虚拟机开机自启(onboot),而且目前不支持 disk resize
PVE 虚拟机的创建/修改/销毁:pve-vm.tf
https://github.com/ryan4yin/knowledge/blob/master/infrastructure/terraform/README.md
https://github.com/Telmate/terraform-provider-proxmox/blob/master/docs/index.md
evan@myxps:~/.terraform.d/plugins$ mv terraform-provider-proxmox_v0.1.0_x4 terraform-provider-proxmox
terraform virtualbox
book
➜ localfile cat main.tf terraform { required_version = ">= 0.15" required_providers { local = { source = "hashicorp/local" version = "2.2.3" } } } resource "local_file" "literature" { filename = "art_of_war.txt" content = <<-EOT Sun Tzu said: The art of war is of vital importance to the State. It is a matter of life and death, a road either to safety or to ruin. Hence it is a subject of inquiry which can on no account be neglected. EOT }
基础知识点
状态管理(多人协同使用terraform)
远程状态
状态文件默认是在本地目录上的terraform.tfstate文件,在团队使用中,每个人的电脑环境独立的,那么需要保证每个人当前的状态文件都是最新且与现实资源真实对应,简直是天方夜谭。而状态不一致所带的灾难也是极其可怕的。所以,状态文件最好是要存储在一个独立的大家可共同访问的位置。对于状态的管理的配置,Terraform称之为Backends
oss
利用 terraform 创建oss bucket
oss_backend# cat providers.tf terraform { required_providers { alicloud = { source = "aliyun/alicloud" version = "1.230.1" } } } provider "alicloud" { access_key = "xTAIxxxxxxxxxxxx" secret_key = "xj6xxxxx" region = "cn-guangzhou" } oss_backend# cat terraform.tf # 创建用户 resource "alicloud_ram_user" "user" { name = "user_iac_evan" display_name = "iac_evan" mobile = "86-18520124008" email = "[email protected]" comments = "this is a user for iac: evan" force = true } # 创建用户组 resource "alicloud_ram_group" "group" { name = "group-tf" comments = "this is a group for tf" force = true } # 将用户加入组 resource "alicloud_ram_group_membership" "membership" { group_name = alicloud_ram_group.group.name user_names = [alicloud_ram_user.user.name] } # 创建bucket resource "alicloud_oss_bucket" "bucket" { bucket = "iac-evan-oss-backend" acl = "private" } # 创建拥有指定oss bucket 的权限 resource "alicloud_ram_policy" "policy" { policy_name = "iac-evan-oss-backend" policy_document = <<EOF { "Statement": [ { "Action": [ "oss:*" ], "Effect": "Allow", "Resource": [ "acs:oss:*:*:${alicloud_oss_bucket.bucket.bucket}", "acs:oss:*:*:${alicloud_oss_bucket.bucket.bucket}/*" ] } ], "Version": "1" } EOF description = "this is a policy for tf oss backend" force = true } # 策略绑定到组上 resource "alicloud_ram_group_policy_attachment" "attach" { policy_name = alicloud_ram_policy.policy.name policy_type = alicloud_ram_policy.policy.type group_name = alicloud_ram_group.group.name } # 获取该ram ak/sk并输出到文件中,ak/sk只输出一次,将文件删除后也不会再生成,只有重建该资源 resource "alicloud_ram_access_key" "ak" { user_name = alicloud_ram_user.user.name secret_file = "aksk.txt" }
创建资源
terraform init terraform apply
将state保存至oss
添加 backend "oss" 在terraform块中增加backend块,指定刚才创建的oss bucket,ak/sk也是用上面创建的,注意这里和我们原来provides块的ak/sk是可以不一样的 cp providers.tf providers.tfbak cat providers.tf terraform { backend "oss" { profile = "terraform" bucket = "iac-evan-oss-backend" prefix = "projectA/env_dev/" access_key = "LTAxxx" secret_key = "kj6xxx" region = "cn-guangzhou" } required_providers { alicloud = { source = "aliyun/alicloud" #source = "local-registry/aliyun/alicloud" version = "1.230.1" } } } provider "alicloud" { access_key = "Lxxx" secret_key = "kjxxxf" region = "cn-guangzhou" } 重新init该工程 terraform init Initializing the backend... Do you want to copy existing state to the new backend? Pre-existing state was found while migrating the previous "local" backend to the newly configured "oss" backend. An existing non-empty state already exists in the new backend. The two states have been saved to temporary files that will be removed after responding to this query. Previous (type "local"): /tmp/terraform3485871911/1-local.tfstate New (type "oss"): /tmp/terraform3485871911/2-oss.tfstate Do you want to overwrite the state in the new backend with the previous state? Enter "yes" to copy and "no" to start with the existing state in the newly configured "oss" backend. oss bucket中就会有个state文件terraform.tfstate,而我们本地的state文件则为空 这时只需要有providers.tf、terraform.tf这两个文件就可在别的地方重用state了
consul
consul US: [ˈkɑns(ə)l] n.领事 Web执政官;公使;总督表 安装请看官网非常容易的 consul agent -dev -client 0.0.0.0 -ui terraform code backend-ubuntu cat main.tf terraform { required_providers { proxmox = { source = "Telmate/proxmox" version = "2.9.11" } } backend "consul" { address = "192.168.10.22:8500" scheme = "http" path = "my-consul-project" } } 中间省 provisioner "local-exec" { command = "sleep 1000" } } http://192.168.10.22:8500/ui/dc1/services http://192.168.10.22:8500/ui/dc1/kv Consul中可以看到名为my-consul-project的键 可以看到,原本保存在工作目录下的tfstate文件的内容,被保存在了Consul的名为my-consul-project的键下。 让我们执行terraform destroy后,重新访问 最后的效果 backend-ubuntu terraform apply Acquiring state lock. This may take a few moments... ╷ │ Error: Error acquiring the state lock │ │ Error message: Lock Info: │ ID: bc4b35c4-a8a2-1467-a1e6-3a2fea0dfb39 │ Path: my-consul-project │ Operation: OperationTypeApply │ Who: evan@myxps │ Version: 1.4.0 │ Created: 2023-04-14 09:38:38.938683897 +0000 UTC │ Info: consul session: bc4b35c4-a8a2-1467-a1e6-3a2fea0dfb39 │ │ │ Terraform acquires a state lock to protect the state from being written │ by multiple users at the same time. Please resolve the issue above and try │ again. For most commands, you can disable locking with the "-lock=false" │ flag, but this is not recommended.
consul 安全相关
明天补上 在22机器上 安装这些可以省略的 ubuntu-2004-vm-2-Kuboard:~# apt install nginx cat /etc/nginx/conf.d/consul.db evan:$apr1$ybLIEYPk$3gzs.8FIPdE.8m/6pQU/L/ vi /etc/nginx/nginx.conf ## evan server { listen 85; # # 认证提示名称 auth_basic "Authentication"; auth_basic_user_file conf.d/consul.db; location / { # ## 代理地址,$host表示获取访问IP,可写为127.0.0.1 #proxy_pass http://$host:8500; #proxy_pass http://127.0.0.1:8500; proxy_pass http://127.0.0.1:8500 ; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection keep-alive; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_cache_bypass $http_upgrade; } } ##evan 过程上的 502 不太明白 哪里的问题 安全加强后的代码 ➜ backend-ubuntu cat main.tf terraform { required_providers { proxmox = { source = "Telmate/proxmox" version = "2.9.11" } } backend "consul" { address = "192.168.10.22:85" scheme = "http" http_auth = "evan:123456789" path = "my-consul-project" } } 中间省略 provisioner "local-exec" { command = "sleep 10000" } } consul ui没有访问权限,所有人都可以修改key/value,不安全。所以,发现了Consul Manager这个开源的dashboard可以通过权限管理,还可以为不同的角色设置的不同的权限
参考
https://developer.hashicorp.com/terraform/language/settings/backends/consul
States状态管理
状态管理命令
显示状态列表: root@myxps:/home/evan/terraformtest# terraform state list local_file.terraform-introduction 查看具体资源的状态信息: # local_file.terraform-introduction: resource "local_file" "terraform-introduction" { content = "https://www.pkslow.com" content_base64sha256 = "YEhk4qqVC6gaCW3ftlu6GxKyT9ItPAg6cRnk0/GDg0s=" content_base64sha512 = "J2l3gvL3vvZF9JZWYgKNYDT4p2PBeFwRb1oYJEo94P4t4qhLIP3Tlf1qpwNcRMY/FuqpjOxBj/CT9YJkNHy4Dw==" content_md5 = "90e7a137c76fe406e1b7bdf8ad4dbc07" content_sha1 = "6db7ad1bbf57df0c859cd5fc62ff5408515b5fc1" content_sha256 = "604864e2aa950ba81a096ddfb65bba1b12b24fd22d3c083a7119e4d3f183834b" content_sha512 = "27697782f2f7bef645f4965662028d6034f8a763c1785c116f5a18244a3de0fe2de2a84b20fdd395fd6aa7035c44c63f16eaa98cec418ff093f58264347cb80f" directory_permission = "0777" file_permission = "0777" filename = "./terraform-guides-by-pkslow.txt" id = "6db7ad1bbf57df0c859cd5fc62ff5408515b5fc1" } 显示当前状态信息: $ terraform state pull
references
https://www.cnblogs.com/syavingcs/tag/Terraform/