Page MenuHomePhabricator

tofu-infra: introduce additional gitlab-ci automation
Closed, DeclinedPublic

Description

We have discussed the possibility of introducing some gitlab-ci automation for tofu-infra.

In this early stage, we are mostly interested in tofu plan. We have detected an upstream gitlab integration for opentofu that we could reuse/adapt to our own (but not just mirror because that is only possible with GitLab Premium).

As a first step, we should consider generating a new set of credentials for novaobserver to run "tofu plan" from gitlab ci in read-only mode. The credentials will also need to access the Object Storage bucket containing the Tofu state file, so maybe we will need a separate user?

Other ideas to explore:

Details

Related Changes in GitLab:
TitleReferenceAuthorSource BranchDest Branch
tofu-infra: introduce gitlab CI/CD workflowrepos/cloud/cloud-vps/tofu-infra!236aborreroarturo-266-tofu-infra-introducmain
Customize query in GitLab

Event Timeline

One limitation I found with that CI automation: they can't run plan for MR branches, because secrets are required, and they could leak.

One limitation I found with that CI automation: they can't run plan for MR branches, because secrets are required, and they could leak.

I think that for repos/cloud you can limit the secrets exposure to MRs of branches within the repo, so it gets limited to members of the cloud team (we do so in toolforge to push images/charts to toolsbeta-harbor)

Another example repository with a full workflow based on gitlab CI/CD: https://gitlab.wikimedia.org/repos/cloud/cloud-vps/networktests-tofu-provisioning

The tofu apply step is marked as "manual" in the pipeline, so it requires a human clicking the button for infrastructure changes to happen.

taavi subscribed.

I don't think we're interested in pursuing this now.