Skip to content

Latest commit

 

History

History
45 lines (29 loc) · 2.39 KB

README.md

File metadata and controls

45 lines (29 loc) · 2.39 KB
Raw

Bazel rules for Hashicorp Terraform

Design

This follows a similar pattern to my Please Terraform rules repository which builds upon years of Terraform experience, with GitOps principals and enabling further declarative configuration beyond Terraform via a build system, in this case Bazel.

This repository and Bazel configuration is based upon bazel_terraform which I've used to learn how to write a Bazel module.

Features

  • Multiple versions of Terraform simultaneously throughout your repositories.
    • This helps you migrate to/support newer Terraform versions if you have more than one terraform_root rule.
  • Creating re-usable Terraform modules via the terraform_module rule.
  • Using common state configuration to create unique Terraform states based on the Bazel Label for the terraform_root rule.
  • Extending these rules to support declarative authentication.
  • Extending these rules to support OPA policy evaluation on Terraform plans.

See the ./examples folder for example uses of all of the above features.

TODO

  • Downloading third-party modules via Bazel rules to add Bazel integrity checking.
  • Downloading providers via Bazel rules to add Bazel integrity checking.
  • Uploading terraform_module to a Terraform registry.

Installation

See the install instructions on the release notes: https://github.com/VJftw/bazel_terraform/releases

To use a commit rather than a release, you can point at any SHA of the repo.

With bzlmod, you can use archive_override or git_override. For WORKSPACE, you modify the http_archive call; for example to use commit abc123 with a WORKSPACE file:

  1. Replace url = "https://github.com/VJftw/bazel_terraform/releases/download/v0.1.0/bazel_terraform-v0.1.0.tar.gz" with a GitHub-provided source archive like url = "https://github.com/VJftw/bazel_terraform/archive/abc123.tar.gz"
  2. Replace strip_prefix = "bazel_terraform-0.1.0" with strip_prefix = "bazel_terraform-abc123"
  3. Update the sha256. The easiest way to do this is to comment out the line, then Bazel will print a message with the correct value.

Note that GitHub source archives don't have a strong guarantee on the sha256 stability, see https://github.blog/2023-02-21-update-on-the-future-stability-of-source-code-archives-and-hashes

Usage

See ./examples folder.