- Replaced actions/upload-artifact with direct MinIO upload
- Uses same pattern as terraform plan upload
- Test reports stored in: terraform-tests/{repository}/{run_number}/
- Enhanced test report with repository, run number, and branch info
- Fixes: Gitea Actions artifact upload not supported
AWS CLI is installed and used to upload reports to S3-compatible MinIO
storage, matching the existing terraform plan upload workflow.
- Removed assertions that check resource IDs (not available during plan)
- Kept resource_pool_names output test (based on variables)
- Added verification for expected resource group keys in output
- Fixes: "Unknown condition value" error in verify_outputs test
Resource IDs are only known after apply, so they can't be validated
during plan phase. The remaining tests verify output structure using
variable-based data that is available during plan.
- Changed from mock credentials to actual Vault AppRole secrets
- Added VAULT_ADDR environment variable for Vault connection
- Uses same credentials as terraform-init job (read-only access)
- Fixes: Vault authentication failures in test execution
- Added terraform init -backend=false before running tests
- Tests don't require backend configuration
- Ensures providers are downloaded before test execution
- Fixes: terraform test failing due to missing providers
Issue:
- Cache steps were timing out after ~5 minutes with ETIMEDOUT errors
- Gitea Actions cache server not configured or not responding
- Connection attempts to 172.19.0.3:36175 failing
- Added 8-10 minutes of unnecessary delays to pipeline
Solution:
- Removed 'Cache Terraform Providers' step from terraform-init job
- Removed 'Restore Terraform Cache' step from terraform-apply job
- Terraform init will download providers fresh each time
- No performance degradation since cache was never working
Impact:
- Faster pipeline execution (removes timeout delays)
- No functional changes (cache was never successful)
- Apply job still independent and self-contained
Note: terraform-vsphere-network never had cache steps (copied before caching was added)
Comprehensive documentation of all work completed for the Terraform CI/CD pipeline implementation:
- Backend refactoring with CLI flags
- Vault integration and security improvements
- Complete CI/CD pipeline with quality scanning
- Infrastructure deployment (resource pools)
- Code cleanup and optimization
- Performance improvements with caching
- Safe destroy workflow implementation
- Template replication to other repos
This document can be used to update Taiga user story #18 manually.
Optimizations:
- Added Terraform provider caching to terraform-init job
- Apply job now reuses cached .terraform directory
- Cache persists across workflow runs (keyed by .terraform.lock.hcl)
- Significantly faster init times on subsequent runs
New terraform-destroy job:
- Only triggered on pull requests with 'destroy' label
- Requires manual approval via 'destroy-approval' environment
- Self-contained with fresh init (no cache for safety)
- Clear warnings and authorization verification
- Three-step process: verify → plan → execute
Security features:
- Destroy only runs on labeled pull requests
- Requires environment protection approval
- Fresh terraform init without cache for verification
- Detailed logging of who/what/when/where
- Cannot be triggered on direct push to master
Usage:
1. Create pull request with proposed destroy changes
2. Add 'destroy' label to the PR
3. Approve via Gitea environment protection
4. Review destroy plan in logs
5. Approve destroy-approval environment to execute
Benefits:
- Faster apply workflow (cached providers)
- Safe destroy process with multiple safeguards
- Clear audit trail for destructive operations
- Self-contained destroy for maximum safety
Changes:
- Added default values to datacenter, cluster_name, and environment variables
- Default values match production environment (WBYC-DC01, wbyc-cluster01, prd)
- Updated variable descriptions to note CI/CD secret usage
- terraform.tfvars has been cleaned locally (already in .gitignore)
Benefits:
- No terraform.tfvars file needed for standard deployment
- CI/CD secrets can override defaults when needed
- Cleaner repository without sensitive data
- Variables have sensible defaults for this environment
- New terraform-apply job runs after terraform-init
- Requires manual approval via production environment gate
- Only runs on push to master branch
- Downloads plan file from MinIO
- Applies the exact plan that was reviewed
- Includes all necessary environment variables for Vault and vSphere
- Removed actions/upload-artifact@v4 (not supported in Gitea)
- Added terraform show output to create human-readable plan text
- Upload both binary plan and text version to MinIO
- Plan stored at: s3://bucket/terraform-plans/repo/run-number/
- Uses existing AWS CLI with S3-compatible endpoint
- Added terraform plan step that outputs plan to tfplan file
- Plan includes all required environment variables for Vault and MinIO
- Plan artifact uploaded with 30-day retention for later apply step
- Plan file can be downloaded and used for terraform apply
- Updated backend.tf to use partial configuration
- Modified workflow to pass backend settings via -backend-config flags
- Follows Azure-style pattern with environment variables
- Improves flexibility and keeps configuration out of version control
- Required secrets: MINIO_ENDPOINT, MINIO_BUCKET, MINIO_STATE_KEY
- Enabled Terraform recommended preset
- Added rules for documentation, naming conventions, and unused declarations
- Note: No TFLint plugins available for vsphere or vault providers
- Core Terraform ruleset will still catch syntax errors and best practices
- Added TFLint job to catch Terraform errors and best practices
- TFLint runs before Checkov for early error detection
- Uses latest TFLint version with automatic initialization
- Pipeline flow: TFLint -> Checkov -> SonarQube
- Added Checkov security scan job that runs before SonarQube
- Configured for Terraform-specific IaC compliance checks
- Outputs results in CLI and SARIF formats
- Uploads scan results as artifacts for review
- SonarQube job now depends on Checkov passing
- Renamed workflow to reflect both quality and security scanning
- Updated SonarQube action from kitabisa/sonarqube-action@v1.2.0 to sonarsource/sonarqube-scan-action@v4
- Official action uses Java 17, compatible with SonarQube 25.10
- Added sonar-project.properties with Terraform-specific exclusions
- Fixes: java.lang.UnsupportedClassVersionError (class file version 61.0 vs 55.0)
- Add vSphere resource pool management
- Configure CPU and memory allocation controls
- Implement tagging system for organization
- Add comprehensive documentation
