Skip to content

Use newer features #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Use newer features #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d0b2ba1
Remove obsolete policy
jmfontaine Jun 1, 2023
d5ca243
Replace Trigger policy with Stack Dependencies
jmfontaine Jun 1, 2023
9dc8e1d
Enable Smart Sanitization
jmfontaine Jun 1, 2023
f4fd30a
Merge remote-tracking branch 'origin/main' into stack-dependencies
michalg9 Sep 12, 2023
7015a0d
Fix main merge
michalg9 Sep 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 0 additions & 16 deletions management/policies.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,3 @@
resource "spacelift_policy" "ignore-outside-project-root" {
name = "Ignore pushes outside of project root - ${random_string.stack_name_suffix.result}"
body = file("${path.module}/policies/ignore-outside-project-root.rego")
type = "GIT_PUSH"

labels = toset(var.spacelift_labels)
}

resource "spacelift_policy" "trigger-dependent-stacks" {
name = "Trigger dependent stacks - ${random_string.stack_name_suffix.result}"
body = file("${path.module}/policies/trigger-dependent-stacks.rego")
type = "TRIGGER"

labels = toset(var.spacelift_labels)
}

resource "spacelift_policy" "warn-on-unreachable-hosts" {
name = "Require manual confirm on unreachable hosts - ${random_string.stack_name_suffix.result}"
body = file("${path.module}/policies/warn-on-unreachable-hosts.rego")
Expand Down
18 changes: 0 additions & 18 deletions management/policies/ignore-outside-project-root.rego
View file
Open in desktop

This file was deleted.

21 changes: 0 additions & 21 deletions management/policies/trigger-dependent-stacks.rego
View file
Open in desktop

This file was deleted.

42 changes: 12 additions & 30 deletions management/stacks.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,12 @@ resource "random_string" "stack_name_suffix" {
special = false
}

data "spacelift_current_stack" "this" {}

data "spacelift_stack" "current_stack" {
stack_id = data.spacelift_current_stack.this.id
}

# Terraform stack
resource "spacelift_stack" "terraform-ansible-workflow-terraform" {
branch = data.spacelift_stack.current_stack.branch
Expand All @@ -12,7 +18,6 @@ resource "spacelift_stack" "terraform-ansible-workflow-terraform" {
labels = toset(var.spacelift_labels)
administrative = true
autodeploy = true
terraform_smart_sanitization = true

dynamic "github_enterprise" {
for_each = var.github_org_name != "" ? [1] : []
Expand All @@ -21,7 +26,8 @@ resource "spacelift_stack" "terraform-ansible-workflow-terraform" {
}
}

terraform_version = "1.2.4"
terraform_version = "1.2.4"
terraform_smart_sanitization = true
}

# Terraform context variable
Expand All @@ -45,23 +51,11 @@ resource "spacelift_aws_role" "terraform-stack" {
role_arn = var.aws_role
}

resource "spacelift_policy_attachment" "ignore-outside-project-root-terraform" {
policy_id = spacelift_policy.ignore-outside-project-root.id
stack_id = spacelift_stack.terraform-ansible-workflow-terraform.id
}

resource "spacelift_policy_attachment" "trigger-dependent-stacks-terraform" {
policy_id = spacelift_policy.trigger-dependent-stacks.id
stack_id = spacelift_stack.terraform-ansible-workflow-terraform.id
}

resource "spacelift_stack_destructor" "terraform-stack" {
depends_on = [
spacelift_environment_variable.ansible_context_id,
spacelift_environment_variable.aws_region,
spacelift_aws_role.terraform-stack,
spacelift_policy_attachment.ignore-outside-project-root-terraform,
spacelift_policy_attachment.trigger-dependent-stacks-terraform,
]

stack_id = spacelift_stack.terraform-ansible-workflow-terraform.id
Expand Down Expand Up @@ -105,26 +99,15 @@ resource "spacelift_aws_role" "ansible-stack" {
role_arn = var.aws_role
}

resource "spacelift_policy_attachment" "ignore-outside-project-root-ansible" {
policy_id = spacelift_policy.ignore-outside-project-root.id
stack_id = spacelift_stack.terraform-ansible-workflow-ansible.id
}

resource "spacelift_policy_attachment" "warn-on-unreachable-hosts-ansible" {
policy_id = spacelift_policy.warn-on-unreachable-hosts.id
stack_id = spacelift_stack.terraform-ansible-workflow-ansible.id
}

# Ignore outside of project root for current stack
data "spacelift_current_stack" "this" {}

data "spacelift_stack" "current_stack" {
stack_id = data.spacelift_current_stack.this.id
}

resource "spacelift_policy_attachment" "ignore-outside-project-root-this" {
policy_id = spacelift_policy.ignore-outside-project-root.id
stack_id = data.spacelift_current_stack.this.id
# The Ansible stack depends on the Terraform one
resource "spacelift_stack_dependency" "terraform-ansible" {
stack_id = spacelift_stack.terraform-ansible-workflow-ansible.id
depends_on_stack_id = spacelift_stack.terraform-ansible-workflow-terraform.id
}

# Trigger a run in terraform stack
Expand All @@ -135,6 +118,5 @@ resource "spacelift_run" "this" {
depends_on = [
spacelift_environment_variable.ansible_context_id,
spacelift_aws_role.ansible-stack,
spacelift_policy_attachment.ignore-outside-project-root-ansible,
]
}