My Azure pipeline is timing out on terraform plan/apply when I add variable groups.
The variables
Variable group
I tried to do some research but to no avail.
yml
When running Terraform in a pipeline you need to pass the parameter -input-false. This will cause Terraform to immediately output the error and I suspect it's saying something like the input variable vnet_name is not set because you have not explained how you are joining the variable group to Terraform. It is not enough to simply add the pipeline variables, you must also pass them into Terraform.
There are a number of ways of passing values into Terraform as described in this page here: https://www.terraform.io/language/values/variables#assigning-values-to-root-module-variables
The most common method I have seen used is to create an environment.tfvars file. This is a simple key:pair value of variables which you can hard-code variables into which you then pass into Terraform like terraform apply -var-file="environment.tfvars"
If you have values in Azure Pipelines that you want to place there, you can use the Azure Replace Tokens tasks. (https://marketplace.visualstudio.com/items?itemName=qetza.replacetokens)
In which case your environment.tfvars will look like this:
vnet_name = #{vnet_name}#
The Replace Token Task will replace the Azure Pipeline variable vnet_name with the value described in your variable group.
Related
We are looking for a solution how to move the non-secret variables from the Variable groups into the code repositories.
We would like to have the possibilities:
to track the changes of all the settings in the code repository
version value of the variable together with the source code, pipeline code version
Problem:
We have over 100 variable groups defined which are referenced by over 100 YAML pipelines.
They are injected at different pipeline/stage/job levels depends on the environment/component/stage they are operating on.
Example problems:
some variable can change their name, some variable can be removed and in the pipeline which targets the PROD environment it is still referenced, and on the pipeline which deploys on DEV it is not there
particular pipeline run used the version of the variables at some date in the past, it is good to know with what set of settings it had been deployed in the past
Possible solutions:
It should be possible to use the simple yaml template variables file to mimic the variable groups and just include the yaml templates with variable groups into the main yamls using this approach: Variable reuse.
# File: variable-group-component.yml
variables:
myComponentVariable: 'SomeVal'
# File: variable-group-environment.yml
variables:
myEnvVariable: 'DEV'
# File: azure-pipelines.yml
variables:
- template: variable-group-component.yml # Template reference
- template: variable-group-environment.yml # Template reference
#some stages/jobs/steps:
In theory, it should be easy to transform the variable groups to the YAML template files and reference them from YAML instead of using a reference to the variable group.
# Current reference we use
variables:
- group: "Current classical variable group"
However, even without implementing this approach, we hit the following limit in our pipelines: "No more than 100 separate YAML files may be included (directly or indirectly)"
YAML templates limits
Taking into consideration the requirement that we would like to have the variable groups logically granulated and separated and not stored in one big yml file (in order to not hit another limit with the number of variables in a job agent) we cannot go this way.
The second approach would be to add a simple script (PowerShell?) which will consume some key/value metadata file with variables (variableName/variableValue) records and just execute job step with a command to
##vso[task.setvariable variable=one]secondValue.
But it could be only done at the initial job level, as a first step, and it looks like the re-engineering variable groups mechanism provided natively in Azure DevOps.
We are not sure that this approach will work everywhere in the YAML pipelines when the variables are currently used. Somewhere they are passed as arguments to the tasks. Etc.
Move all the variables into the key vault secrets? We abandoned this option at the beginning as the key vault is a place to store sensitive data and not the settings which could be visible by anyone. Moreover storing it in secrets cause the pipeline logs to put * instead of real configuration setting and obfuscate the pipeline run log information.
Questions:
Q1. Do you have any other propositions/alternatives on how the variables versioning/changes tracking could be achieved in Azure DevOps YAML pipelines?
Q2. Do you see any problems in the 2. possible solution, or have better ideas?
You can consider this as alternative:
Store your non-secrets variable in json file in a repository
Create a pipeline to push variables to App Configuration (instead a Vault)
Then if you need this settings in your app make sure that you reference to app configuration from the app instead running replacement task in Azure Devops. Or if you need this settings directly by pipelines Pull them from App Configuration
Drawbacks:
the same as one mentioned by you in Powershell case. You need to do it job level
What you get:
track in repo
track in App Configuration and all benefits of App Configuration
Is there an IConfiguration provider for Azure Devops pipeline variables?
I googled this for about 15 minutes but could not find anything.
We have a series of net5.0 projects with corresponding unit and integrations tests that rely in pipeline variables as follows:
Tests use an IConfigurationBuilder, including environment variables
Variables are added to an Azure Devops Pipeline
Modify the pipeline yaml to map the pipeline variables to environment variables
This is fairly straight forward. For each configuration setting that needs to be driven by a pipeline variable, we:
Create the pipeline variable
Modify the pipeline yaml to map the variable to an environment variable
on rare occasions, transform the value via powershell
I'd prefer to do something like:
var config = new ConfigurationBuilder()
.AddEnvironmentVariables(...)
.AddPipelineVariables(...) // considering writing this; don't what to reinvent the wheel
and skip the modifications to the pipeline yaml.
In the classic release pipeline when you rerun a release build the same variables that were used when the release was initially created were used. In multi stage pipeline I am seeing the value is picked freshly/newly when even when we rerun the existing deployed stage.
Expected: Use the same variable which was used in the initial run rather than using the new one.
The variable which I am referring being overridden is read from Keyvault which is kept in the Azure DevOps variable group.
https://github.com/MicrosoftDocs/azure-devops-docs/issues/7663
Any changes made centrally to a variable group, such as a change in the value of a variable or the addition of new variables, will automatically be made available to all the definitions or stages to which the variable group is linked. In YAML pipeline, to use a variable from a variable group, you need to add a reference to the group in your YAML file:
variables:
- group: my-variable-group
So each time you run or rerun a YAML pipeline, it will get the variables from the variable group. If there is any changes made to variable group, the pipeline will get the new changes.
While in the classic release pipeline, the variables won't change in the variable group linked to an existing release, so when you redeploy the pipeline or stages, you can still use the original variables.
It's the default behavior of classic release pipeline and YAML pipeline, we can not change it.
I have a pipeline defined of two steps:
one building a combined helm chart from two separate artifacts
two deploying this chart to a cluster
Both stages first load a secret and then run a bash script to do the work, as shown in the following image.
My challenge now is, to submit the helm chart name and its version from the Build stage to the Deploy one. So that the 2 step can fetch the right chart.
How can I achieve this?
Trial 1: Using ##vso[task.setvariable - Did not work from the script
echo "##vso[task.setvariable variable=HELM_CHART_NAME]$HELM_CHART_NAME"
echo "##vso[task.setvariable variable=HELM_CHART_VERSION]$HELM_CHART_VERSION"
Using ##vso[task.setvariable - Did not work from the script
This caused by different stages using different agents, and the dynamic variable which set by ##vso[task.setvariable is just a agent-scoped one. Its life cycle equal with agent, so it will disappear once one agent job finished.
For the solution which can help you achieve pass variable from Build stage to Deploy stage, you'd better store these variables in one storage. Such as store it in Azure Key vault with the task Azure Key Vault actions or Write Secrets to Key Vault.
Another way is use rest api to add it as the release variable with powershell script:
PUT https://vsrm.dev.azure.com/{organization}/{project}/_apis/release/releases/{releaseId}?api-version=5.0
Then, in next stage, it can access and get variable from Release Variables.
I'm using Azure DevOps on a vs2017-win2016 build agent to provision some infrastructure using Terraform.
What I want to know is it possible to pass the Terraform Output of a hosts dynamically assigned IP address to a
2nd Job running a different build agent.
I'm able to pass these to build variables in the first Job
BASTION_PRIV_IP=x.x.x.x
BASTION_PUB_IP=1.1.1.1
But un-able to get these variables to appear to be consumed with the second build agent running ubuntu-16.04
I am able to pass any static defined parameters like Azure Resource Group name that I define before the job start, its just the
dynamically assigned ones.
This is pretty easily done when you are using the YAML based builds.
It's important to know that variables are only available within the scope of current job by default.
However you can set a variable as an output variable for your job.
This output variable can then be mapped to a variable within second job (do note that you need to set the first job as a dependency for the second job).
Please see the following link for an example of how to get this to work
https://learn.microsoft.com/en-us/azure/devops/pipelines/process/variables?view=azure-devops&tabs=yaml%2Cbatch#set-a-multi-job-output-variable
It may also be doable in the visual designer type of build, but i couldn't get that to work in the quick test i did, maybe you can get something to work inspired on the linked example.