Azure Terraform（四）狀態檔案儲存

一，引言

　　我們都知道在執行部署計劃之後，當前目錄中就產生了名叫 “terraform.states” 的 Terraform 的狀態檔案，該檔案中記錄了已部署資源的狀態。預設情況下，在執行部署計劃後，Terraform 的狀態檔案會儲存在本地，但是這樣往往就造成一些弊端：

（1）不適用團隊之間協助，就好比在資料庫中對同一條資料進行操作時，就會引起異常

（2）狀態檔案中包含一些機密資訊，會造成一定的機密洩露

（3）如果不慎將本地的狀態檔案刪除掉的話，已執行部署計劃的資源的管理將很難在通過 Terraform 進行管理

所以，Terraform 是支援在遠端儲存狀態檔案，也就是在 Azure Storage Account 中儲存遠端狀態檔案，Terraform 狀態的儲存是由一個稱之為Backend的元件決定的，local state使用的是local backend。並且其他所有的Backend在使用之前都需要在模板中顯式定義並通過 terraform init 來實現載入和配置。

--------------------Azure Terraform 系列--------------------

1，Azure Terraform（一）入門簡介

2，Azure Terraform（二）語法詳解

3，Azure Terraform（三）部署 Web 應用程式

4，Azure Terraform（四）狀態檔案儲存

二，正文

1，建立狀態檔案儲存賬戶

轉到Azure Portal 上，點選 “+ Create a resource”，輸入 “Storage account“ 進行搜尋，並且點選 ”create“

輸入以下引數：

Resource group 選擇：”Web_Test_TF_RG“

Storage account name：”cnbateterraformstorage“

Location：”(Asia Pacific) East Asia“

Performance：”Standard“

Account kind （賬戶型別）選擇：”BlobStorage“

Replication （複製）選擇：”Locally-redundant storage（LRS）“ (本地冗餘儲存（LRS）)

點選 ”Review + create“ 進行建立預校驗

校驗完成後，點選 ”Create“ 進行建立操作

稍等片刻，等待建立完成後，點選 ”go to resource“ 跳轉到資源可以檢視建立的資源。

選擇 “Blog service =》Containers”，點選頁面上的 “+ Container” 新增儲存狀態檔案的 Container

Name："terraform-state"

Public access level：“Private（no anonymous access）”

點選 “Create” 進行建立。

可以看到剛剛建立容器

複製儲存賬戶的訪問金鑰，稍後會有用

2，建立 Azure Key Vault（金鑰保管庫）

回到 Azure Portal 首頁，點選 ”+ create a resource“，輸入”Key Vault“ 進行搜尋，點選 ”Create“ 建立

輸入相關引數：

Resource group 選擇：”Web_Test_TF_RG“

Key vault name：”cnbate-terraform-kv“

Region：”East Asia“

Pricing tier：”Standard“

點選 ”Review + create“ ，建立預校驗。

預校驗完成後，點選 ”Create“ 進行建立操作

建立完成後，可以點選 ”Go to resource“ 檢視建立好的資源

選擇 “Settings=》Secrets”，點選 “+ Generate/Import” 建立、或者匯入機密資訊

Upload options：“Manual”（手動）

Name：“terraform-stste-storage-key”

Value：複製貼上剛剛的儲存賬戶訪問金鑰

建立成功，並且可以檢視到剛剛建立的機密資訊

3，配置 Terraform 後端，並且測試遠端 tf 狀態

Terraform 需要配置後端，需要以下引數

（1）storage_account_name ：Azure 儲存賬戶名稱

terraform init -backend-config="access_key=$(az keyvault secret show --name terraform-stste-storage-key --vault-name cnbate-terraform-kv --query value -o tsv)"

（2）container_name：容器名稱

（3）key：儲存狀態檔案的名稱

（4）access_key：儲存賬戶訪問金鑰

大家需要注意的是，我這裡將 “access_key” 也就是儲存賬戶訪問金鑰存放在 Azure Key Vault 中了，想要獲取 “access_key” 就得通過 Azure Key Vault 獲取。

以下是 Terraform 後端配置

terraform {
  backend "azurerm" {
    storage_account_name = "cnbateterraformstorage"
    container_name       = "terraform-state"
    key                  = "cnbate.terraform.stats"
  }
}

3.1，初始化 Terraform 程式碼

既然我們沒有在 Terraform 後端配置程式碼塊中新增 “access_key” 的資訊，那麼我們就得在初始化的時候對 ”access_key“ 資訊賦值

terraform init -backend-config="access_key=$(az keyvault secret show --name terraform-stste-storage-key --vault-name cnbate-terraform-kv --query value -o tsv)"

然後，我們可以看到執行初始化命令之後的日誌輸出

同時會在儲存賬戶的容器中生成 Blob 塊

並且可以看到當前blob 塊的詳細資訊

LEASE STATUS：解鎖狀態

LEASE STATE：可用狀態

3.2，生成執行計劃

terraform plan

以下是執行後輸入的日誌資訊

從中不難看到，在生成執行計劃之前，先獲取狀態鎖。（注意，生成執行計劃。不會將該執行計劃持久化到遠端狀態儲存）

PS D:\Core\Terraform\Azure\terraform_cnbate_traffic manager> terraform plan
Acquiring state lock. This may take a few moments...
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.azurerm_resource_group.cnbate_resource_group: Refreshing state...

------------------------------------------------------------------------

An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # azurerm_app_service.cnbate_app_service01 will be created
  + resource "azurerm_app_service" "cnbate_app_service01" {
      + app_service_plan_id               = (known after apply)
      + app_settings                      = {
          + "ASPNETCORE_ENVIRONMENT" = "Production"
        }
      + client_affinity_enabled           = false
      + client_cert_enabled               = false
      + custom_domain_verification_id     = (known after apply)
      + default_site_hostname             = (known after apply)
      + enabled                           = true
      + https_only                        = false
      + id                                = (known after apply)
      + location                          = "eastasia"
      + name                              = "CnBateBlogWeb01"
      + outbound_ip_address_list          = (known after apply)
      + outbound_ip_addresses             = (known after apply)
      + possible_outbound_ip_address_list = (known after apply)
      + possible_outbound_ip_addresses    = (known after apply)
      + resource_group_name               = "Web_Test_TF_RG"
      + site_credential                   = (known after apply)

      + auth_settings {
          + additional_login_params        = (known after apply)
          + allowed_external_redirect_urls = (known after apply)
          + default_provider               = (known after apply)
          + enabled                        = (known after apply)
          + issuer                         = (known after apply)
          + runtime_version                = (known after apply)
          + token_refresh_extension_hours  = (known after apply)
          + token_store_enabled            = (known after apply)
          + unauthenticated_client_action  = (known after apply)

          + active_directory {
              + allowed_audiences = (known after apply)
              + client_id         = (known after apply)
              + client_secret     = (sensitive value)
            }

          + facebook {
              + app_id       = (known after apply)
              + app_secret   = (sensitive value)
              + oauth_scopes = (known after apply)
            }

          + google {
              + client_id     = (known after apply)
              + client_secret = (sensitive value)
              + oauth_scopes  = (known after apply)
            }

          + microsoft {
              + client_id     = (known after apply)
              + client_secret = (sensitive value)
              + oauth_scopes  = (known after apply)
            }

          + twitter {
              + consumer_key    = (known after apply)
              + consumer_secret = (sensitive value)
            }
        }

      + connection_string {
          + name  = (known after apply)
          + type  = (known after apply)
          + value = (sensitive value)
        }

      + identity {
          + identity_ids = (known after apply)
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
          + type         = (known after apply)
        }

      + logs {
          + detailed_error_messages_enabled = (known after apply)
          + failed_request_tracing_enabled  = (known after apply)

          + application_logs {
              + file_system_level = (known after apply)

              + azure_blob_storage {
                  + level             = (known after apply)
                  + retention_in_days = (known after apply)
                  + sas_url           = (sensitive value)
                }
            }

          + http_logs {
              + azure_blob_storage {
                  + retention_in_days = (known after apply)
                  + sas_url           = (sensitive value)
                }

              + file_system {
                  + retention_in_days = (known after apply)
                  + retention_in_mb   = (known after apply)
                }
            }
        }

      + site_config {
          + always_on                   = (known after apply)
          + app_command_line            = (known after apply)
          + auto_swap_slot_name         = (known after apply)
          + default_documents           = (known after apply)
          + dotnet_framework_version    = (known after apply)
          + ftps_state                  = (known after apply)
          + health_check_path           = (known after apply)
          + http2_enabled               = (known after apply)
          + ip_restriction              = (known after apply)
          + java_container              = (known after apply)
          + java_container_version      = (known after apply)
          + java_version                = (known after apply)
          + linux_fx_version            = (known after apply)
          + local_mysql_enabled         = (known after apply)
          + managed_pipeline_mode       = (known after apply)
          + min_tls_version             = (known after apply)
          + php_version                 = (known after apply)
          + python_version              = (known after apply)
          + remote_debugging_enabled    = (known after apply)
          + remote_debugging_version    = (known after apply)
          + scm_ip_restriction          = (known after apply)
          + scm_type                    = (known after apply)
          + scm_use_main_ip_restriction = (known after apply)
          + use_32_bit_worker_process   = (known after apply)
          + websockets_enabled          = (known after apply)
          + windows_fx_version          = (known after apply)

          + cors {
              + allowed_origins     = (known after apply)
              + support_credentials = (known after apply)
            }
        }

      + source_control {
          + branch             = (known after apply)
          + manual_integration = (known after apply)
          + repo_url           = (known after apply)
          + rollback_enabled   = (known after apply)
          + use_mercurial      = (known after apply)
        }

      + storage_account {
          + access_key   = (sensitive value)
          + account_name = (known after apply)
          + mount_path   = (known after apply)
          + name         = (known after apply)
          + share_name   = (known after apply)
          + type         = (known after apply)
        }
    }

  # azurerm_app_service.cnbate_app_service02 will be created
  + resource "azurerm_app_service" "cnbate_app_service02" {
      + app_service_plan_id               = (known after apply)
      + app_settings                      = {
          + "ASPNETCORE_ENVIRONMENT" = "Production"
        }
      + client_affinity_enabled           = false
      + client_cert_enabled               = false
      + custom_domain_verification_id     = (known after apply)
      + default_site_hostname             = (known after apply)
      + enabled                           = true
      + https_only                        = false
      + id                                = (known after apply)
      + location                          = "southeastasia"
      + name                              = "CnBateBlogWeb02"
      + outbound_ip_address_list          = (known after apply)
      + outbound_ip_addresses             = (known after apply)
      + possible_outbound_ip_address_list = (known after apply)
      + possible_outbound_ip_addresses    = (known after apply)
      + resource_group_name               = "Web_Test_TF_RG"
      + site_credential                   = (known after apply)

      + auth_settings {
          + additional_login_params        = (known after apply)
          + allowed_external_redirect_urls = (known after apply)
          + default_provider               = (known after apply)
          + enabled                        = (known after apply)
          + issuer                         = (known after apply)
          + runtime_version                = (known after apply)
          + token_refresh_extension_hours  = (known after apply)
          + token_store_enabled            = (known after apply)
          + unauthenticated_client_action  = (known after apply)

          + active_directory {
              + allowed_audiences = (known after apply)
              + client_id         = (known after apply)
              + client_secret     = (sensitive value)
            }

          + facebook {
              + app_id       = (known after apply)
              + app_secret   = (sensitive value)
              + oauth_scopes = (known after apply)
            }

          + google {
              + client_id     = (known after apply)
              + client_secret = (sensitive value)
              + oauth_scopes  = (known after apply)
            }

          + microsoft {
              + client_id     = (known after apply)
              + client_secret = (sensitive value)
              + oauth_scopes  = (known after apply)
            }

          + twitter {
              + consumer_key    = (known after apply)
              + consumer_secret = (sensitive value)
            }
        }

      + connection_string {
          + name  = (known after apply)
          + type  = (known after apply)
          + value = (sensitive value)
        }

      + identity {
          + identity_ids = (known after apply)
          + principal_id = (known after apply)
          + tenant_id    = (known after apply)
          + type         = (known after apply)
        }

      + logs {
          + detailed_error_messages_enabled = (known after apply)
          + failed_request_tracing_enabled  = (known after apply)

          + application_logs {
              + file_system_level = (known after apply)

              + azure_blob_storage {
                  + level             = (known after apply)
                  + retention_in_days = (known after apply)
                  + sas_url           = (sensitive value)
                }
            }

          + http_logs {
              + azure_blob_storage {
                  + retention_in_days = (known after apply)
                  + sas_url           = (sensitive value)
                }

              + file_system {
                  + retention_in_days = (known after apply)
                  + retention_in_mb   = (known after apply)
                }
            }
        }

      + site_config {
          + always_on                   = (known after apply)
          + app_command_line            = (known after apply)
          + auto_swap_slot_name         = (known after apply)
          + default_documents           = (known after apply)
          + dotnet_framework_version    = (known after apply)
          + ftps_state                  = (known after apply)
          + health_check_path           = (known after apply)
          + http2_enabled               = (known after apply)
          + ip_restriction              = (known after apply)
          + java_container              = (known after apply)
          + java_container_version      = (known after apply)
          + java_version                = (known after apply)
          + linux_fx_version            = (known after apply)
          + local_mysql_enabled         = (known after apply)
          + managed_pipeline_mode       = (known after apply)
          + min_tls_version             = (known after apply)
          + php_version                 = (known after apply)
          + python_version              = (known after apply)
          + remote_debugging_enabled    = (known after apply)
          + remote_debugging_version    = (known after apply)
          + scm_ip_restriction          = (known after apply)
          + scm_type                    = (known after apply)
          + scm_use_main_ip_restriction = (known after apply)
          + use_32_bit_worker_process   = (known after apply)
          + websockets_enabled          = (known after apply)
          + windows_fx_version          = (known after apply)

          + cors {
              + allowed_origins     = (known after apply)
              + support_credentials = (known after apply)
            }
        }

      + source_control {
          + branch             = (known after apply)
          + manual_integration = (known after apply)
          + repo_url           = (known after apply)
          + rollback_enabled   = (known after apply)
          + use_mercurial      = (known after apply)
        }

      + storage_account {
          + access_key   = (sensitive value)
          + account_name = (known after apply)
          + mount_path   = (known after apply)
          + name         = (known after apply)
          + share_name   = (known after apply)
          + type         = (known after apply)
        }
    }

  # azurerm_app_service_plan.cnbate_app_service_plan01 will be created
  + resource "azurerm_app_service_plan" "cnbate_app_service_plan01" {
      + id                           = (known after apply)
      + kind                         = "Windows"
      + location                     = "eastasia"
      + maximum_elastic_worker_count = (known after apply)
      + maximum_number_of_workers    = (known after apply)
      + name                         = "cnbate_appserviceplan01"
      + resource_group_name          = "Web_Test_TF_RG"

      + sku {
          + capacity = (known after apply)
          + size     = "S1"
          + tier     = "Standard"
        }
    }

  # azurerm_app_service_plan.cnbate_app_service_plan02 will be created
  + resource "azurerm_app_service_plan" "cnbate_app_service_plan02" {
      + id                           = (known after apply)
      + kind                         = "Windows"
      + location                     = "southeastasia"
      + maximum_elastic_worker_count = (known after apply)
      + maximum_number_of_workers    = (known after apply)
      + name                         = "cnbate_appserviceplan02"
      + resource_group_name          = "Web_Test_TF_RG"

      + sku {
          + capacity = (known after apply)
          + size     = "S1"
          + tier     = "Standard"
        }
    }

  # azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint01 will be created
  + resource "azurerm_traffic_manager_endpoint" "cnbate_traffic_manager_endpoint01" {
      + endpoint_location       = (known after apply)
      + endpoint_monitor_status = (known after apply)
      + endpoint_status         = (known after apply)
      + geo_mappings            = [
          + "CN",
        ]
      + id                      = (known after apply)
      + name                    = "cnbateblogweb_webapp01_performance"
      + priority                = (known after apply)
      + profile_name            = "cnbateblogweb"
      + resource_group_name     = "Web_Test_TF_RG"
      + target                  = (known after apply)
      + target_resource_id      = (known after apply)
      + type                    = "azureEndpoints"
      + weight                  = (known after apply)
    }

  # azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint02 will be created
  + resource "azurerm_traffic_manager_endpoint" "cnbate_traffic_manager_endpoint02" {
      + endpoint_location       = (known after apply)
      + endpoint_monitor_status = (known after apply)
      + endpoint_status         = (known after apply)
      + geo_mappings            = [
          + "SG",
        ]
      + id                      = (known after apply)
      + name                    = "cnbateblogweb_webapp02_performance"
      + priority                = (known after apply)
      + profile_name            = "cnbateblogweb"
      + resource_group_name     = "Web_Test_TF_RG"
      + target                  = (known after apply)
      + target_resource_id      = (known after apply)
      + type                    = "azureEndpoints"
      + weight                  = (known after apply)
    }

  # azurerm_traffic_manager_profile.cnbate_traffic_manager_profile will be created
  + resource "azurerm_traffic_manager_profile" "cnbate_traffic_manager_profile" {
      + fqdn                   = (known after apply)
      + id                     = (known after apply)
      + name                   = "cnbateblogweb"
      + profile_status         = (known after apply)
      + resource_group_name    = "Web_Test_TF_RG"
      + tags                   = {
          + "Environment" = "Production"
        }
      + traffic_routing_method = "Geographic"

      + dns_config {
          + relative_name = "cnbateblogweb"
          + ttl           = 60
        }

      + monitor_config {
          + interval_in_seconds          = 30
          + path                         = "/"
          + port                         = 80
          + protocol                     = "http"
          + timeout_in_seconds           = 10
          + tolerated_number_of_failures = 3
        }
    }

Plan: 7 to add, 0 to change, 0 to destroy.

------------------------------------------------------------------------

Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.

PS D:\Core\Terraform\Azure\terraform_cnbate_traffic manager>

3.3，執行部署計劃

terraform apply

以下是正在執行部署計劃輸入日誌

同樣，也是先獲取狀態鎖

PS D:\Core\Terraform\Azure\terraform_cnbate_traffic manager> terraform plan
Acquiring state lock. This may take a few moments...
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

data.azurerm_resource_group.cnbate_resource_group: Refreshing state...

在執行的過程中，我們再次登入Azure Portal 中，檢視儲存賬容器中的 Blob 塊的狀態

LEASE STATUS：已鎖定

LEASE STATE：已租用（其實可以理解為 “不可用”）

等待部署計劃執行完畢之後，Blob 塊的狀態又恢復到 “已解鎖，可用”

同時，點選圖中的 “Edit” 可以看到由 terraform 管理的各自資源狀態資訊全部寫到了當前 Blob 塊中

ok，今天的內容就先到此。重要提醒：大家做完測試後，別忘記執行 terraform destroy (銷燬部署計劃)

*★,°*:.☆(￣▽￣)/$:*.°★* 。φ(゜▽゜*)♪是✌✌✌✌✌

三，結尾

　　將狀態檔案進行遠端存到Azure Storage Account 中，Blob 中儲存的資料會在儲存前進行加密處理，並且一旦配置遠端儲存模式後，狀態檔案永遠不會儲存在本地，這樣更加方面團隊之間的協作。並且遠端儲存帶來的好處是實現了與資源定義模板管理的解耦，可以讓 Terraform 狀態脫離本地磁碟而儲存，提升了資源狀態的安全性。

參考資料：Terraform 官方，azurerm 文件

Terraform_Cnbate_Traffic_Manager github：https://github.com/yunqian44/Terraform_Cnbate_Traffic_Manager

作者：Allen 

版權：轉載請在文章明顯位置註明作者及出處。如發現錯誤，歡迎批評指正。