一，引言
我們都知道在執行部署計劃之後，當前目錄中就產生了名叫 “terraform.states” 的 Terraform 的狀態檔案，該檔案中記錄了已部署資源的狀態。預設情況下，在執行部署計劃後，Terraform 的狀態檔案會儲存在本地，但是這樣往往就造成一些弊端：
（1）不適用團隊之間協助，就好比在資料庫中對同一條資料進行操作時，就會引起異常
（2）狀態檔案中包含一些機密資訊，會造成一定的機密洩露
（3）如果不慎將本地的狀態檔案刪除掉的話，已執行部署計劃的資源的管理將很難在通過 Terraform 進行管理
所以，Terraform 是支援在遠端儲存狀態檔案，也就是在 Azure Storage Account 中儲存遠端狀態檔案，Terraform 狀態的儲存是由一個稱之為Backend的元件決定的，local state使用的是local backend。並且其他所有的Backend在使用之前都需要在模板中顯式定義並通過 terraform init 來實現載入和配置。
--------------------Azure Terraform 系列--------------------
1，Azure Terraform（一）入門簡介
2，Azure Terraform（二）語法詳解
3，Azure Terraform（三）部署 Web 應用程式
4，Azure Terraform（四）狀態檔案儲存
二，正文
1，建立狀態檔案儲存賬戶
轉到Azure Portal 上，點選 “+ Create a resource”，輸入 “Storage account“ 進行搜尋，並且點選 ”create“
輸入以下引數：
Resource group 選擇：”Web_Test_TF_RG“
Storage account name：”cnbateterraformstorage“
Location：”(Asia Pacific) East Asia“
Performance：”Standard“
Account kind （賬戶型別）選擇：”BlobStorage“
Replication （複製）選擇：”Locally-redundant storage（LRS）“ (本地冗餘儲存（LRS）)
點選 ”Review + create“ 進行建立預校驗
校驗完成後，點選 ”Create“ 進行建立操作
稍等片刻，等待建立完成後，點選 ”go to resource“ 跳轉到資源可以檢視建立的資源。
選擇 “Blog service =》Containers”，點選頁面上的 “+ Container” 新增儲存狀態檔案的 Container
Name："terraform-state"
Public access level：“Private（no anonymous access）”
點選 “Create” 進行建立。
可以看到剛剛建立容器
複製儲存賬戶的訪問金鑰，稍後會有用
2，建立 Azure Key Vault（金鑰保管庫）
回到 Azure Portal 首頁，點選 ”+ create a resource“，輸入”Key Vault“ 進行搜尋，點選 ”Create“ 建立
輸入相關引數：
Resource group 選擇：”Web_Test_TF_RG“
Key vault name：”cnbate-terraform-kv“
Region：”East Asia“
Pricing tier：”Standard“
點選 ”Review + create“ ，建立預校驗。
預校驗完成後，點選 ”Create“ 進行建立操作
建立完成後，可以點選 ”Go to resource“ 檢視建立好的資源
選擇 “Settings=》Secrets”，點選 “+ Generate/Import” 建立、或者匯入機密資訊
Upload options：“Manual”（手動）
Name：“terraform-stste-storage-key”
Value：複製貼上剛剛的儲存賬戶訪問金鑰
建立成功，並且可以檢視到剛剛建立的機密資訊
3，配置 Terraform 後端，並且測試遠端 tf 狀態
Terraform 需要配置後端，需要以下引數
（1）storage_account_name ：Azure 儲存賬戶名稱
terraform init -backend-config="access_key=$(az keyvault secret show --name terraform-stste-storage-key --vault-name cnbate-terraform-kv --query value -o tsv)"
（2）container_name：容器名稱
（3）key：儲存狀態檔案的名稱
（4）access_key：儲存賬戶訪問金鑰
大家需要注意的是，我這裡將 “access_key” 也就是儲存賬戶訪問金鑰存放在 Azure Key Vault 中了，想要獲取 “access_key” 就得通過 Azure Key Vault 獲取。
以下是 Terraform 後端配置
terraform {
backend "azurerm" {
storage_account_name = "cnbateterraformstorage"
container_name = "terraform-state"
key = "cnbate.terraform.stats"
}
}
3.1，初始化 Terraform 程式碼
既然我們沒有在 Terraform 後端配置程式碼塊中新增 “access_key” 的資訊，那麼我們就得在初始化的時候對 ”access_key“ 資訊賦值
terraform init -backend-config="access_key=$(az keyvault secret show --name terraform-stste-storage-key --vault-name cnbate-terraform-kv --query value -o tsv)"
然後，我們可以看到執行初始化命令之後的日誌輸出
同時會在儲存賬戶的容器中生成 Blob 塊
並且可以看到當前blob 塊的詳細資訊
LEASE STATUS：解鎖狀態
LEASE STATE：可用狀態
3.2，生成執行計劃
terraform plan
以下是執行後輸入的日誌資訊
從中不難看到，在生成執行計劃之前，先獲取狀態鎖。（注意，生成執行計劃。不會將該執行計劃持久化到遠端狀態儲存）
PS D:\Core\Terraform\Azure\terraform_cnbate_traffic manager> terraform plan Acquiring state lock. This may take a few moments... Refreshing Terraform state in-memory prior to plan... The refreshed state will be used to calculate this plan, but will not be persisted to local or remote state storage. data.azurerm_resource_group.cnbate_resource_group: Refreshing state... ------------------------------------------------------------------------ An execution plan has been generated and is shown below. Resource actions are indicated with the following symbols: + create Terraform will perform the following actions: # azurerm_app_service.cnbate_app_service01 will be created + resource "azurerm_app_service" "cnbate_app_service01" { + app_service_plan_id = (known after apply) + app_settings = { + "ASPNETCORE_ENVIRONMENT" = "Production" } + client_affinity_enabled = false + client_cert_enabled = false + custom_domain_verification_id = (known after apply) + default_site_hostname = (known after apply) + enabled = true + https_only = false + id = (known after apply) + location = "eastasia" + name = "CnBateBlogWeb01" + outbound_ip_address_list = (known after apply) + outbound_ip_addresses = (known after apply) + possible_outbound_ip_address_list = (known after apply) + possible_outbound_ip_addresses = (known after apply) + resource_group_name = "Web_Test_TF_RG" + site_credential = (known after apply) + auth_settings { + additional_login_params = (known after apply) + allowed_external_redirect_urls = (known after apply) + default_provider = (known after apply) + enabled = (known after apply) + issuer = (known after apply) + runtime_version = (known after apply) + token_refresh_extension_hours = (known after apply) + token_store_enabled = (known after apply) + unauthenticated_client_action = (known after apply) + active_directory { + allowed_audiences = (known after apply) + client_id = (known after apply) + client_secret = (sensitive value) } + facebook { + app_id = (known after apply) + app_secret = (sensitive value) + oauth_scopes = (known after apply) } + google { + client_id = (known after apply) + client_secret = (sensitive value) + oauth_scopes = (known after apply) } + microsoft { + client_id = (known after apply) + client_secret = (sensitive value) + oauth_scopes = (known after apply) } + twitter { + consumer_key = (known after apply) + consumer_secret = (sensitive value) } } + connection_string { + name = (known after apply) + type = (known after apply) + value = (sensitive value) } + identity { + identity_ids = (known after apply) + principal_id = (known after apply) + tenant_id = (known after apply) + type = (known after apply) } + logs { + detailed_error_messages_enabled = (known after apply) + failed_request_tracing_enabled = (known after apply) + application_logs { + file_system_level = (known after apply) + azure_blob_storage { + level = (known after apply) + retention_in_days = (known after apply) + sas_url = (sensitive value) } } + http_logs { + azure_blob_storage { + retention_in_days = (known after apply) + sas_url = (sensitive value) } + file_system { + retention_in_days = (known after apply) + retention_in_mb = (known after apply) } } } + site_config { + always_on = (known after apply) + app_command_line = (known after apply) + auto_swap_slot_name = (known after apply) + default_documents = (known after apply) + dotnet_framework_version = (known after apply) + ftps_state = (known after apply) + health_check_path = (known after apply) + http2_enabled = (known after apply) + ip_restriction = (known after apply) + java_container = (known after apply) + java_container_version = (known after apply) + java_version = (known after apply) + linux_fx_version = (known after apply) + local_mysql_enabled = (known after apply) + managed_pipeline_mode = (known after apply) + min_tls_version = (known after apply) + php_version = (known after apply) + python_version = (known after apply) + remote_debugging_enabled = (known after apply) + remote_debugging_version = (known after apply) + scm_ip_restriction = (known after apply) + scm_type = (known after apply) + scm_use_main_ip_restriction = (known after apply) + use_32_bit_worker_process = (known after apply) + websockets_enabled = (known after apply) + windows_fx_version = (known after apply) + cors { + allowed_origins = (known after apply) + support_credentials = (known after apply) } } + source_control { + branch = (known after apply) + manual_integration = (known after apply) + repo_url = (known after apply) + rollback_enabled = (known after apply) + use_mercurial = (known after apply) } + storage_account { + access_key = (sensitive value) + account_name = (known after apply) + mount_path = (known after apply) + name = (known after apply) + share_name = (known after apply) + type = (known after apply) } } # azurerm_app_service.cnbate_app_service02 will be created + resource "azurerm_app_service" "cnbate_app_service02" { + app_service_plan_id = (known after apply) + app_settings = { + "ASPNETCORE_ENVIRONMENT" = "Production" } + client_affinity_enabled = false + client_cert_enabled = false + custom_domain_verification_id = (known after apply) + default_site_hostname = (known after apply) + enabled = true + https_only = false + id = (known after apply) + location = "southeastasia" + name = "CnBateBlogWeb02" + outbound_ip_address_list = (known after apply) + outbound_ip_addresses = (known after apply) + possible_outbound_ip_address_list = (known after apply) + possible_outbound_ip_addresses = (known after apply) + resource_group_name = "Web_Test_TF_RG" + site_credential = (known after apply) + auth_settings { + additional_login_params = (known after apply) + allowed_external_redirect_urls = (known after apply) + default_provider = (known after apply) + enabled = (known after apply) + issuer = (known after apply) + runtime_version = (known after apply) + token_refresh_extension_hours = (known after apply) + token_store_enabled = (known after apply) + unauthenticated_client_action = (known after apply) + active_directory { + allowed_audiences = (known after apply) + client_id = (known after apply) + client_secret = (sensitive value) } + facebook { + app_id = (known after apply) + app_secret = (sensitive value) + oauth_scopes = (known after apply) } + google { + client_id = (known after apply) + client_secret = (sensitive value) + oauth_scopes = (known after apply) } + microsoft { + client_id = (known after apply) + client_secret = (sensitive value) + oauth_scopes = (known after apply) } + twitter { + consumer_key = (known after apply) + consumer_secret = (sensitive value) } } + connection_string { + name = (known after apply) + type = (known after apply) + value = (sensitive value) } + identity { + identity_ids = (known after apply) + principal_id = (known after apply) + tenant_id = (known after apply) + type = (known after apply) } + logs { + detailed_error_messages_enabled = (known after apply) + failed_request_tracing_enabled = (known after apply) + application_logs { + file_system_level = (known after apply) + azure_blob_storage { + level = (known after apply) + retention_in_days = (known after apply) + sas_url = (sensitive value) } } + http_logs { + azure_blob_storage { + retention_in_days = (known after apply) + sas_url = (sensitive value) } + file_system { + retention_in_days = (known after apply) + retention_in_mb = (known after apply) } } } + site_config { + always_on = (known after apply) + app_command_line = (known after apply) + auto_swap_slot_name = (known after apply) + default_documents = (known after apply) + dotnet_framework_version = (known after apply) + ftps_state = (known after apply) + health_check_path = (known after apply) + http2_enabled = (known after apply) + ip_restriction = (known after apply) + java_container = (known after apply) + java_container_version = (known after apply) + java_version = (known after apply) + linux_fx_version = (known after apply) + local_mysql_enabled = (known after apply) + managed_pipeline_mode = (known after apply) + min_tls_version = (known after apply) + php_version = (known after apply) + python_version = (known after apply) + remote_debugging_enabled = (known after apply) + remote_debugging_version = (known after apply) + scm_ip_restriction = (known after apply) + scm_type = (known after apply) + scm_use_main_ip_restriction = (known after apply) + use_32_bit_worker_process = (known after apply) + websockets_enabled = (known after apply) + windows_fx_version = (known after apply) + cors { + allowed_origins = (known after apply) + support_credentials = (known after apply) } } + source_control { + branch = (known after apply) + manual_integration = (known after apply) + repo_url = (known after apply) + rollback_enabled = (known after apply) + use_mercurial = (known after apply) } + storage_account { + access_key = (sensitive value) + account_name = (known after apply) + mount_path = (known after apply) + name = (known after apply) + share_name = (known after apply) + type = (known after apply) } } # azurerm_app_service_plan.cnbate_app_service_plan01 will be created + resource "azurerm_app_service_plan" "cnbate_app_service_plan01" { + id = (known after apply) + kind = "Windows" + location = "eastasia" + maximum_elastic_worker_count = (known after apply) + maximum_number_of_workers = (known after apply) + name = "cnbate_appserviceplan01" + resource_group_name = "Web_Test_TF_RG" + sku { + capacity = (known after apply) + size = "S1" + tier = "Standard" } } # azurerm_app_service_plan.cnbate_app_service_plan02 will be created + resource "azurerm_app_service_plan" "cnbate_app_service_plan02" { + id = (known after apply) + kind = "Windows" + location = "southeastasia" + maximum_elastic_worker_count = (known after apply) + maximum_number_of_workers = (known after apply) + name = "cnbate_appserviceplan02" + resource_group_name = "Web_Test_TF_RG" + sku { + capacity = (known after apply) + size = "S1" + tier = "Standard" } } # azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint01 will be created + resource "azurerm_traffic_manager_endpoint" "cnbate_traffic_manager_endpoint01" { + endpoint_location = (known after apply) + endpoint_monitor_status = (known after apply) + endpoint_status = (known after apply) + geo_mappings = [ + "CN", ] + id = (known after apply) + name = "cnbateblogweb_webapp01_performance" + priority = (known after apply) + profile_name = "cnbateblogweb" + resource_group_name = "Web_Test_TF_RG" + target = (known after apply) + target_resource_id = (known after apply) + type = "azureEndpoints" + weight = (known after apply) } # azurerm_traffic_manager_endpoint.cnbate_traffic_manager_endpoint02 will be created + resource "azurerm_traffic_manager_endpoint" "cnbate_traffic_manager_endpoint02" { + endpoint_location = (known after apply) + endpoint_monitor_status = (known after apply) + endpoint_status = (known after apply) + geo_mappings = [ + "SG", ] + id = (known after apply) + name = "cnbateblogweb_webapp02_performance" + priority = (known after apply) + profile_name = "cnbateblogweb" + resource_group_name = "Web_Test_TF_RG" + target = (known after apply) + target_resource_id = (known after apply) + type = "azureEndpoints" + weight = (known after apply) } # azurerm_traffic_manager_profile.cnbate_traffic_manager_profile will be created + resource "azurerm_traffic_manager_profile" "cnbate_traffic_manager_profile" { + fqdn = (known after apply) + id = (known after apply) + name = "cnbateblogweb" + profile_status = (known after apply) + resource_group_name = "Web_Test_TF_RG" + tags = { + "Environment" = "Production" } + traffic_routing_method = "Geographic" + dns_config { + relative_name = "cnbateblogweb" + ttl = 60 } + monitor_config { + interval_in_seconds = 30 + path = "/" + port = 80 + protocol = "http" + timeout_in_seconds = 10 + tolerated_number_of_failures = 3 } } Plan: 7 to add, 0 to change, 0 to destroy. ------------------------------------------------------------------------ Note: You didn't specify an "-out" parameter to save this plan, so Terraform can't guarantee that exactly these actions will be performed if "terraform apply" is subsequently run. PS D:\Core\Terraform\Azure\terraform_cnbate_traffic manager>
3.3，執行部署計劃
terraform apply
以下是正在執行部署計劃輸入日誌
同樣，也是先獲取狀態鎖
PS D:\Core\Terraform\Azure\terraform_cnbate_traffic manager> terraform plan Acquiring state lock. This may take a few moments... Refreshing Terraform state in-memory prior to plan... The refreshed state will be used to calculate this plan, but will not be persisted to local or remote state storage. data.azurerm_resource_group.cnbate_resource_group: Refreshing state...
在執行的過程中，我們再次登入Azure Portal 中，檢視儲存賬容器中的 Blob 塊的狀態
LEASE STATUS：已鎖定
LEASE STATE：已租用（其實可以理解為 “不可用”）
等待部署計劃執行完畢之後，Blob 塊的狀態又恢復到 “已解鎖，可用”
同時，點選圖中的 “Edit” 可以看到由 terraform 管理的各自資源狀態資訊全部寫到了當前 Blob 塊中
ok，今天的內容就先到此。重要提醒：大家做完測試後，別忘記執行 terraform destroy (銷燬部署計劃)
*★,°*:.☆(￣▽￣)/$:*.°★* 。φ(゜▽゜*)♪是✌✌✌✌✌
三，結尾
將狀態檔案進行遠端存到Azure Storage Account 中，Blob 中儲存的資料會在儲存前進行加密處理，並且一旦配置遠端儲存模式後，狀態檔案永遠不會儲存在本地，這樣更加方面團隊之間的協作。並且遠端儲存帶來的好處是實現了與資源定義模板管理的解耦，可以讓 Terraform 狀態脫離本地磁碟而儲存，提升了資源狀態的安全性。
參考資料：Terraform 官方，azurerm 文件
Terraform_Cnbate_Traffic_Manager github：https://github.com/yunqian44/Terraform_Cnbate_Traffic_Manager
作者：Allen
版權：轉載請在文章明顯位置註明作者及出處。如發現錯誤，歡迎批評指正。