infrastructure-as-code

IaC (Terraform / OpenTofu)

适用场景

• 基础设施即代码编写与管理。
• Terraform state 问题排查。
• Module 设计与版本管理。
• CI/CD 中的 plan/apply 流程。
• IaC 安全扫描。

不适用

• K8s manifest → k8sops。
• 云控制台手动操作。
• Ansible (配置管理, 非 IaC 声明式)。

HCL 基础

# Provider
terraform {
  required_version = ">= 1.7"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "us-east-1"
    dynamodb_table = "terraform-locks"     # state locking
    encrypt        = true
  }
}

provider "aws" {
  region = var.region
  default_tags {
    tags = {
      Environment = var.environment
      ManagedBy   = "terraform"
    }
  }
}

# Variables
variable "region" {
  type        = string
  default     = "us-east-1"
  description = "AWS region"
}

variable "environment" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Must be dev, staging, or prod."
  }
}

# Resources
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  tags = { Name = "${var.environment}-vpc" }
}

resource "aws_subnet" "public" {
  count             = 3
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(aws_vpc.main.cidr_block, 8, count.index)
  availability_zone = data.aws_availability_zones.available.names[count.index]
  tags = { Name = "${var.environment}-public-${count.index}" }
}

# Data source
data "aws_availability_zones" "available" {
  state = "available"
}

# Output
output "vpc_id" {
  value       = aws_vpc.main.id
  description = "VPC ID"
}

# Locals
locals {
  common_tags = {
    Project = "myapp"
    Team    = "platform"
  }
}

State 管理

# 查看
terraform state list                       # 列出所有资源
terraform state show aws_vpc.main          # 查看具体资源

# 移动 (重构)
terraform state mv aws_vpc.main module.network.aws_vpc.main

# 移除 (不再管理, 不删除实际资源)
terraform state rm aws_vpc.main

# 导入 (已有资源纳入管理)
terraform import aws_vpc.main vpc-12345678
# Terraform 1.5+: import block
import {
  to = aws_vpc.main
  id = "vpc-12345678"
}

# 强制解锁 (小心!)
terraform force-unlock <lock-id>

# State 迁移 (本地→远端)
terraform init -migrate-state