Skip to content
Open

Dev #21

Show file tree
Hide file tree
Changes from 6 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 69 additions & 0 deletions Jenkinsfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
pipeline {
agent any

parameters {
choice(name: 'ACTION', choices: ['apply', 'destroy'], description: 'Choose whether to apply or destroy the Terraform EKS module')
}

environment {
TF_DIR = 'eks-install'
AWS_CREDENTIALS_ID = 'your-aws-credentials-id'
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
AWS_DEFAULT_REGION = 'ap-south-1'
}

stages {
stage('Checkout Code') {
steps {
checkout scm
}
}

stage('Terraform Init') {
steps {
dir("${env.TF_DIR}") {
withCredentials([[$class: 'AmazonWebServicesCredentialsBinding', credentialsId: "${AWS_CREDENTIALS_ID}", accessKeyVariable: 'AWS_ACCESS_KEY_ID', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY']]) {
sh 'terraform init'
}
}
}
}

stage('Terraform Plan') {
steps {
dir("${env.TF_DIR}") {
withCredentials([[$class: 'AmazonWebServicesCredentialsBinding', credentialsId: "${AWS_CREDENTIALS_ID}", accessKeyVariable: 'AWS_ACCESS_KEY_ID', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY']]) {
sh "terraform plan ${params.ACTION == 'destroy' ? '-destroy' : ''} -out=tfplan"
}
}
}
}

stage('Manual Approval') {
steps {
input message: "Review plan for folder '${env.TF_DIR}'. Proceed with ${params.ACTION}?", ok: 'Proceed'
}
}

stage('Terraform Execute') {
steps {
dir("${env.TF_DIR}") {
withCredentials([[$class: 'AmazonWebServicesCredentialsBinding', credentialsId: "${AWS_CREDENTIALS_ID}", accessKeyVariable: 'AWS_ACCESS_KEY_ID', secretKeyVariable: 'AWS_SECRET_ACCESS_KEY']]) {
script {
if (params.ACTION == 'apply') {
sh 'terraform apply -auto-approve tfplan'
} else if (params.ACTION == 'destroy') {
sh 'terraform apply -destroy -auto-approve'

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

sed -n '31,57p' Jenkinsfile

Repository: iam-veeramalla/ultimate-devops-project-aws

Length of output: 1558


🌐 Web query:

Terraform apply -destroy option plan file saved with -destroy applies that plan documentation

💡 Result:

To apply a saved Terraform plan file, you provide the path to the plan file as an argument to the terraform apply command [1][2]. Usage: terraform apply [plan file] Key details of this workflow: - Creation: You first generate the plan file using the -out option with the terraform plan command (e.g., terraform plan -out=tfplan) [3][4]. - Execution: When you pass a saved plan file to terraform apply, Terraform executes the exact operations recorded in that file [1][4]. - No Confirmation Required: Terraform interprets the use of a saved plan file as explicit approval; therefore, it does not prompt for confirmation or require the -auto-approve flag [1][2][4]. - Restriction on Options: When using a saved plan file, you cannot specify additional planning options or modes (such as -var, -replace, -destroy, or -refresh-only) [1][4]. The plan file already contains the finalized set of actions, and these options only apply when Terraform is generating a new plan [1]. - Automation: This two-step workflow (plan then apply) is recommended for automation and CI/CD pipelines to ensure that the infrastructure changes applied are exactly those that were previously reviewed [3][2][5]. It is recommended to use the terraform show command to inspect the contents of a saved plan file before applying it [1][6]. Additionally, be aware that saved plan files may contain sensitive information in cleartext if your configuration or variables include sensitive data [3][5].

Citations:


🌐 Web query:

Terraform documentation apply saved plan file -destroy option cannot specify additional options destroy mode preserved

💡 Result:

When you pass a saved plan file to the terraform apply command, Terraform does not allow you to specify additional planning modes or options [1][2]. The plan file already contains the final results of all planning decisions, including the intended operations, and cannot be modified at the execution stage [1]. Specifically, this means you cannot use options like -destroy, -refresh-only, or -replace when applying a saved plan [1][2]. If you wish to apply a destroy plan, you must specify the -destroy option when creating the plan with terraform plan, save that plan to a file using the -out option, and then pass that saved file to terraform apply [3][2]. In summary, the design of the saved plan workflow is that the plan file encapsulates the entire execution strategy [1]. Any customization of that strategy, including changing the mode of operation (such as destroy mode) or applying resource replacements, must occur during the planning phase, not the application phase [1][4]. Providing additional planning-related flags alongside a saved plan file will cause Terraform to reject the command [1].

Citations:


🌐 Web query:

Terraform apply command plan file without -auto-approve skips confirmation

💡 Result:

When you use a saved plan file with the terraform apply command, Terraform automatically skips the interactive confirmation prompt [1][2][3]. Terraform interprets the act of providing a saved plan file as your approval of the planned operations, so it proceeds to execute the changes immediately [1]. Because this behavior is automatic for saved plans, you do not need—and cannot use—the -auto-approve flag in this context [1]. Terraform will ignore the -auto-approve flag if it is provided alongside a plan file [1]. This workflow is specifically designed for automation, ensuring that the exact changes you reviewed during the plan phase are the ones performed during the apply phase [1][2][3]. To use this workflow: 1. Create a saved plan file: terraform plan -out=tfplan 2. Apply that specific plan file: terraform apply "tfplan" [3]

Citations:


Apply the approved destroy plan instead of generating a new one.

tfplan is already created with terraform plan -destroy -out=tfplan, but the destroy branch runs terraform apply -destroy -auto-approve, which regenerates the plan after approval. The saved plan file already preserves destroy mode, so apply it directly to avoid destroying anything outside the reviewed plan.

Proposed fix
-                            } else if (params.ACTION == 'destroy') {
-                                sh 'terraform apply -destroy -auto-approve'
+                            } else if (params.ACTION == 'destroy') {
+                                sh 'terraform apply tfplan'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
} else if (params.ACTION == 'destroy') {
sh 'terraform apply -destroy -auto-approve'
} else if (params.ACTION == 'destroy') {
sh 'terraform apply tfplan'
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Jenkinsfile` around lines 54 - 55, Update the destroy branch for
params.ACTION == 'destroy' to apply the existing tfplan directly instead of
invoking terraform apply with -destroy -auto-approve. Preserve the previously
generated, reviewed destroy plan by using the saved plan artifact in the shell
command.

}
}
}
}
}
}
}

post {
always {
cleanWs() // Cleans up workspace after execution
}
}
}
2 changes: 1 addition & 1 deletion eks-install/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ terraform {
backend "s3" {
bucket = "demo-terraform-eks-state-s3-bucket"
key = "terraform.tfstate"
region = "us-west-2"
region = "ap-south-1"
Comment thread
coderabbitai[bot] marked this conversation as resolved.
dynamodb_table = "terraform-eks-state-locks"
encrypt = true
}
Expand Down
8 changes: 4 additions & 4 deletions eks-install/variables.tf
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
variable "region" {
description = "AWS region"
type = string
default = "us-west-2"
default = "ap-south-1"
}

variable "vpc_cidr" {
Expand All @@ -13,7 +13,7 @@ variable "vpc_cidr" {
variable "availability_zones" {
description = "Availability zones"
type = list(string)
default = ["us-west-2a", "us-west-2b", "us-west-2c"]
default = ["ap-south-1a", "ap-south-1b", "ap-south-1c"]
}

variable "private_subnet_cidrs" {
Expand Down Expand Up @@ -53,10 +53,10 @@ variable "node_groups" {
}))
default = {
general = {
instance_types = ["t3.medium"]
instance_types = ["c7i-flex.large"]
capacity_type = "ON_DEMAND"
scaling_config = {
desired_size = 2
desired_size = 1
max_size = 4
min_size = 1
}
Expand Down