Terraform
跳到导航
跳到搜索
ins
wget -c https://releases.hashicorp.com/terraform/0.15.4/terraform_0.15.4_linux_amd64.zip
unzip terraform_0.15.4_linux_amd64.zip
#sudo mv terraform /usr/bin/
mkdir /home/evan/data/apps/terraform && mv terraform /home/evan/data/apps/terraform/
echo 'export PATH=/home/evan/data/apps/terraform:$PATH' >> /etc/profile
echo 'export PATH=/home/evan/data/apps/:$PATH' >> /etc/profile #这个不行 少了一个目录 找不到了
写在你的home ~/.profile 也是可以的 为你本用户使用方便
export PATH=/home/evan/data/apps/terraform:$PATH
#if APT Packages for Debian and Ubuntu
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
216 sudo apt-add-repository "deb [arch=$(dpkg --print-architecture)] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
218 apt update
219 sudo apt install terraform
像 git 一样，每个 Terraform 项目需要自己单独的目录空间，所以我们创建一个 terraform-learning 目录
mkdir terraform-learning
cd terraform-learning
该目录下的所有 *.tf 文件都会被 Terraform 加载，在初始化 Terraform 工作空间之前必须至少要有一个 *.tf 文件。我们这里建立文件 main.tf, 内容如下
terraform的安装和应用
usage
usage on aliyun
以aliyun作为例子
#把相关密码写入 不是写在文本 安全一点吧 export ALICLOUD_ACCESS_KEY="LTAIUrZCw3********" export ALICLOUD_SECRET_KEY="zfwwWAMWIAiooj14GQ2*************" export ALICLOUD_REGION="cn-guangzhou"
evan@myxps:~/.terraform.d$ cat terraform.tf
resource "alicloud_vpc" "vpc" {
vpc_name = "tf_test_foo"
cidr_block = "172.16.0.0/12"
}
resource "alicloud_vswitch" "vsw" {
vpc_id = alicloud_vpc.vpc.id
cidr_block = "172.16.0.0/21"
zone_id = "cn-guangzhou-b"
}
evan@myxps:~/.terraform.d$ terraform init #自动安装了alicloud provider plugis
Initializing the backend...
Initializing provider plugins...
- Finding latest version of hashicorp/alicloud...
- Installing hashicorp/alicloud v1.124.0...
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.
╷
│ Warning: Additional provider information from registry
│
│ The remote registry returned warnings for
│ registry.terraform.io/hashicorp/alicloud:
│ - For users on Terraform 0.13 or greater, this provider has moved to
│ aliyun/alicloud. Please update your source in required_providers.
╵
Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
terraform apply #
evan@myxps:~/.terraform.d$ terraform apply
alicloud_vpc.vpc: Refreshing state... [id=vpc-7xvsw3jjadaf53zjlido6]
Terraform used the selected providers to generate the following execution plan.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# alicloud_vswitch.vsw will be created
+ resource "alicloud_vswitch" "vsw" {
+ availability_zone = (known after apply)
+ cidr_block = "172.16.0.0/21"
+ id = (known after apply)
+ name = (known after apply)
+ status = (known after apply)
+ vpc_id = "vpc-7xvsw3jjadaf53zjlido6"
+ vswitch_name = (known after apply)
+ zone_id = "cn-guangzhou-b"
}
Plan: 1 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
alicloud_vswitch.vsw: Creating...
alicloud_vswitch.vsw: Creation complete after 6s [id=vsw-7xvwa2oq0fsjm3xuhv9ss]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
https://vpc.console.aliyun.com/vpc/cn-guangzhou/vpcs
打开 web 有了
terraform show ##查看已创建的专有网络和交换机
# alicloud_vpc.vpc:
resource "alicloud_vpc" "vpc" {
cidr_block = "172.16.0.0/12"
id = "vpc-7xvsw3jjadaf53zjlido6"
name = "tf_test_foo"
route_table_id = "vtb-7xvjpppz3q8kin5vi081k"
router_id = "vrt-7xvi5nvfqmvg0mox9rj5j"
router_table_id = "vtb-7xvjpppz3q8kin5vi081k"
secondary_cidr_blocks = []
status = "Available"
user_cidrs = []
vpc_name = "tf_test_foo"
}
# alicloud_vswitch.vsw:
resource "alicloud_vswitch" "vsw" {
availability_zone = "cn-guangzhou-b"
cidr_block = "172.16.0.0/21"
id = "vsw-7xvwa2oq0fsjm3xuhv9ss"
status = "Available"
vpc_id = "vpc-7xvsw3jjadaf53zjlido6"
zone_id = "cn-guangzhou-b"
}
2 在上一步创建的专有网络中创建一个安全组，并添加一个允许任何地址访问的安全组规则。
在terraform.tf文件中增加以下内容。
resource "alicloud_security_group" "default" {
name = "default"
vpc_id = alicloud_vpc.vpc.id
}
resource "alicloud_security_group_rule" "allow_all_tcp" {
type = "ingress"
ip_protocol = "tcp"
nic_type = "intranet"
policy = "accept"
port_range = "1/65535"
priority = 1
security_group_id = alicloud_security_group.default.id
cidr_ip = "0.0.0.0/0"
}
运行terraform apply #开始创建。 有时time out 再来一次就好了
运行terraform show查看已创建的安全组和安全组规则。
您也可以登录ECS控制台查看安全组和安全组规则。
https://ecs.console.aliyun.com/?spm=5176.10483814.recommend.decs.78e6124322cN4j#/securityGroup/region/cn-guangzhou
3.创建ECS实例。
在terraform.tf文件中增加以下内容。
resource "alicloud_instance" "instance" {
# cn-beijing
availability_zone = "cn-beijing-b"
security_groups = alicloud_security_group.default.*.id
# series III 能找个最小的么 ecs.s6-c1m1.small
instance_type = "ecs.s6-c1m1.small"
#instance_type = "ecs.n2.small"
system_disk_category = "cloud_efficiency"
image_id = "ubuntu_18_04_64_20G_alibase_20190624.vhd"
instance_name = "test_foo"
vswitch_id = alicloud_vswitch.vsw.id
internet_max_bandwidth_out =10
password = "$Eevan2240881"
}
说明
在上述示例中，指定了internet_max_bandwidth_out= 10，因此会自动为实例分配一个公网IP。
详细的参数解释请参见
image_id 指定ubuntu_16_0402_32，最终会匹配ubuntu_16_0402_32_40G_alibase_20170711.vhd。
最终比较完整的配置文件
evan@myxps:~/.terraform.d$ cat terraform.tf
resource "alicloud_vpc" "vpc" {
vpc_name = "tf_test_foo"
cidr_block = "172.16.0.0/12"
}
resource "alicloud_vswitch" "vsw" {
vpc_id = alicloud_vpc.vpc.id
cidr_block = "172.16.0.0/21"
zone_id = "cn-guangzhou-b"
}
resource "alicloud_security_group" "default" {
name = "default"
vpc_id = alicloud_vpc.vpc.id
}
resource "alicloud_security_group_rule" "allow_all_tcp" {
type = "ingress"
ip_protocol = "tcp"
nic_type = "intranet"
policy = "accept"
port_range = "1/65535"
priority = 1
security_group_id = alicloud_security_group.default.id
cidr_ip = "0.0.0.0/0"
}
#ec2 create
resource "alicloud_instance" "instance" {
# cn-beijing
availability_zone = "cn-guangzhou-b"
security_groups = alicloud_security_group.default.*.id
# series III 能找个最小的么 ecs.s6-c1m1.small
instance_type = "ecs.s6-c1m1.small"
#instance_type = "ecs.n2.small"
system_disk_category = "cloud_efficiency"
image_id = "centos_7_9_x64_20G_alibase_20201228.vhd"
instance_name = "test_foo"
vswitch_id = alicloud_vswitch.vsw.id
internet_max_bandwidth_out =10
password = "$1234567890"
}
玩转阿里云 Terraform(一)：Terraform 是什么
进阶
terraform-alicloud-modules / terraform-alicloud-ecs-instance官方
https://registry.terraform.io/modules/alibaba/ecs-instance/alicloud/latest
qqcloud
NOTES 将秘钥直接填入到.tf文件中是十分不安全的，在多用户共同管理资源时，不建议把腾讯云API 的秘钥直接写到源代码里，以免一不小心更新到公开的版本中，造成安全风险。
腾讯云提供了另一种更为安全可靠的方式，把秘钥信息放在环境变量中配置
// Configure the secret key in the environment path
$ export TENCENTCLOUD_SECRET_ID="your_fancy_accessid"
$ export TENCENTCLOUD_SECRET_KEY="your_fancy_accesskey"
$ export TENCENTCLOUD_REGION="ap-hongkong"
这样在 provider.tf 文件中就可以省略掉相关信息
$ vim provider.tf
// provider.tf
provider "tencentcloud" {}
https://cloud.tencent.com/developer/article/1473713
aws
https://ruby-china.org/topics/37891 运维 用 Terraform 自动化构建基础设施 aws
