Styjun

I am working on a declarative Jenkins pipeline for Terraform deployments. I want to have the terraform init / select workspace / plan in one stage, ask for approval in another stage, and then do the apply in another stage. I have the agent at the top set to none and then using a kubernetes agent for a docker image we created that has packages we need for the stages. I am declaring those images in each stage. When I execute the pipeline, I get an error that I need to reinitialize Terraform in the apply stage even though I initialized in the init/plan stage. I figure this is nature of the stages running in different nodes.

I have it working by doing init / plan and stashing the plan. In the apply stage, it unstashes the plan, calls init / select workspace again, and then finally applies the unstashed plan.

I realize I could set the agent at the top, but according to Jenkins documentation, that is bad practice, as waiting for user input will block the execution.

I feel like there has to be a way to do this more elegantly. Any suggestions?

Here's my code:

def repositoryURL = env.gitlabSourceRepoHttpUrl != null && env.gitlabSourceRepoHttpUrl != "" ? env.gitlabSourceRepoHttpUrl : env.RepoURL
def repositoryBranch = env.gitlabTargetBranch != null && env.gitlabTargetBranch != "" ? env.gitlabTargetBranch : env.RepoBranch
def notificationEmail = env.gitlabUserEmail != null && env.gitlabUserEmail != "" ? env.gitlabSourceRepoHttpUrl : env.Email
def projectName = env.ProjectName
def deployAccountId = env.AccountId

pipeline 
 agent none
 stages 
 stage("Checkout") 
 agent any
 steps 
 git branch: "$repositoryBranch", credentialsId: '...', url: "$repositoryURL"
 stash name: 'tf', useDefaultExcludes: false
 
 
 stage("Terraform Plan") 
 agent 
 kubernetes 
 label 'myagent'
 containerTemplate 
 name 'cis'
 image 'docker-local.myrepo.com/my-image:v2'
 ttyEnabled true
 command 'cat'
 
 
 
 steps 
 container('cis') 
 unstash 'tf'
 script 
 sh "terraform init"

 try 
 sh "terraform workspace select $deployAccountId_$projectName_$repositoryBranch"
 catch (Exception e) 
 sh "terraform workspace new $deployAccountId_$projectName_$repositoryBranch"
 

 sh "terraform plan -out=$deployAccountId_$projectName_$repositoryBranch_plan.tfplan -input=false"

 stash includes: "*.tfplan" name: "tf-plan", useDefaultExcludes: false
 
 
 
 post
 success
 echo "Terraform init complete"
 
 failure
 echo "Terraform init failed"
 
 
 
 stage ("Terraform Plan Approval") 
 agent none
 steps 
 script 
 def userInput = input(id: 'confirm', message: 'Apply Terraform?', parameters: [ [$class: 'BooleanParameterDefinition', defaultValue: false, description: 'Apply terraform', name: 'confirm'] ])
 
 
 
 stage ("Terraform Apply") 
 agent 
 kubernetes 
 label 'myagent'
 containerTemplate 
 name 'cis'
 image 'docker-local.myrepo.com/my-image:v2'
 ttyEnabled true
 command 'cat'
 
 
 
 steps 
 container("cis") 
 withCredentials([[
 $class: 'AmazonWebServicesCredentialsBinding',
 credentialsId: 'my-creds',
 accessKeyVariable: 'AWS_ACCESS_KEY_ID',
 secretKeyVariable: 'AWS_SECRET_ACCESS_KEY'
 ]]) 
 script jq .Credentials.AccessKeyId