思路淺析
在我們分享的 Azure Terraform 系列文中有介紹到關於 Terraform 的狀態文件遠程存儲的問題,我們在 Azure DevOps Pipeline 的 Task Job 加 azure_cli_script 執行內聯腳本(該腳本幫我們創建好 Terraform 狀態文件存儲所需要的 Azure Resource Group、 Azure Storage Account、Azure KeyVault 等資源)。大家需要注意的是,內聯腳本中有使用動態變量,該變量臨時存儲 Azure Storage Account 的 Account Key,如下圖所示:
本篇文章,我繼續帶領大家分析如何在 Azure DevOps Pipeline 運行中創建使用動態臨時變量,使用動態臨時變量替換 Azure Pipeline 管道變量。
項目整體架構圖
Pipeline 變量定義、輸出
在此階段,我們需要利用 azure_cli_script 任務,創建動態臨時變量,輸出參數,其中最主要的是將動態臨時變量輸出,Task yaml 如下所示
輸出的變量用於同一個 stage,不同 job
- stage: script jobs: - job: azure_cli_script steps: - task: AzureCLI@2 displayName: 'Azure CLI :Create Storage Account,Key Vault And Set KeyVault Secret' name: 'output_variable' inputs: azureSubscription: 'Microsoft Azure Subscription(xxxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)' scriptType: 'bash' addSpnToEnvironment: true scriptLocation: 'inlineScript' inlineScript: | # create azure resource group az group create --location eastasia --name $(terraform_rg) # create azure storage account az storage account create --name $(storage_account) --resource-group $(terraform_rg) --location eastasia --sku Standard_LRS # create storage account container for tf state az storage container create --name $(storage_account_container) --account-name $(storage_account) # query storage key and set variable ACCOUNT_KEY=$(az storage account keys list --resource-group $(terraform_rg) --account-name $(storage_account) --query "[?keyName == 'key1'][value]" --output tsv) # create azure keyvault az keyvault create --name $(keyvault) --resource-group $(terraform_rg) --location eastasia --enable-soft-delete false # set keyvault secret,secret value is ACCOUNT_KEY az keyvault secret set --name $(keyvault_sc) --vault-name $(keyvault) --value $ACCOUNT_KEY # set secret varivale and add to environment echo "##vso[task.setvariable variable=ACCOUNT_KEY;isOutput=true]$ACCOUNT_KEY" #echo "##vso[task.setvariable variable=ACCOUNT_KEY;issecret=true;isOutput=true]$ACCOUNT_KEY" - job: same_stage_echo dependsOn: azure_cli_script variables: ACCOUNT_KEY: $[dependencies.azure_cli_script.outputs['output_variable.ACCOUNT_KEY']] steps: - task: Bash@3 displayName: 'Bash :output temporary variables in different jobs on the same stage' inputs: targetType: 'inline' script: | # echo ACCOUNT_KEY echo "ACCOUNT_KEY is $ACCOUNT_KEY"
輸出變量用於不同 stage
- stage: echo_varibale dependsOn: script jobs: - job: different_stage_echo variables: ACCOUNT_KEY: $[stageDependencies.script.azure_cli_script.outputs['output_variable.ACCOUNT_KEY']] steps: - task: Bash@3 displayName: 'Bash :output temporary variables in same jobs on the same stage' inputs: targetType: 'inline' script: | # echo ACCOUNT_KEY echo "ACCOUNT_KEY is $ACCOUNT_KEY"
以下爲完整的 azure-pipelines-1.yaml
# Starter pipeline # Start with a minimal pipeline that you can customize to build and deploy your code. # Add steps that build, run tests, deploy, and more: # https://aka.ms/yaml trigger: - remote_stats pool: vmImage: ubuntu-latest stages: - stage: script jobs: - job: azure_cli_script steps: - task: AzureCLI@2 displayName: 'Azure CLI :Create Storage Account,Key Vault And Set KeyVault Secret' name: 'output_variable' inputs: azureSubscription: 'Microsoft Azure Subscription(xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx)' scriptType: 'bash' addSpnToEnvironment: true scriptLocation: 'inlineScript' inlineScript: | # create azure resource group az group create --location eastasia --name $(terraform_rg) # create azure storage account az storage account create --name $(storage_account) --resource-group $(terraform_rg) --location eastasia --sku Standard_LRS # create storage account container for tf state az storage container create --name $(storage_account_container) --account-name $(storage_account) # query storage key and set variable ACCOUNT_KEY=$(az storage account keys list --resource-group $(terraform_rg) --account-name $(storage_account) --query "[?keyName == 'key1'][value]" --output tsv) # create azure keyvault az keyvault create --name $(keyvault) --resource-group $(terraform_rg) --location eastasia --enable-soft-delete false # set keyvault secret,secret value is ACCOUNT_KEY az keyvault secret set --name $(keyvault_sc) --vault-name $(keyvault) --value $ACCOUNT_KEY # set secret varivale and add to environment echo "##vso[task.setvariable variable=ACCOUNT_KEY;isOutput=true]$ACCOUNT_KEY" #echo "##vso[task.setvariable variable=ACCOUNT_KEY;issecret=true;isOutput=true]$ACCOUNT_KEY" - job: same_stage_echo dependsOn: azure_cli_script variables: ACCOUNT_KEY: $[dependencies.azure_cli_script.outputs['output_variable.ACCOUNT_KEY']] steps: - task: Bash@3 displayName: 'Bash :output temporary variables in different jobs on the same stage' inputs: targetType: 'inline' script: | # echo ACCOUNT_KEY echo "ACCOUNT_KEY is $ACCOUNT_KEY" - stage: echo_varibale dependsOn: script jobs: - job: different_stage_echo variables: ACCOUNT_KEY: $[stageDependencies.script.azure_cli_script.outputs['output_variable.ACCOUNT_KEY']] steps: - task: Bash@3 displayName: 'Bash :output temporary variables in same jobs on the same stage' inputs: targetType: 'inline' script: | # echo ACCOUNT_KEY echo "ACCOUNT_KEY is $ACCOUNT_KEY"
*****重點*****:管道內變量與動態臨時變量使用區別
Pipeline 管道內使用方式:$(變量名稱)
動態臨時變量使用方式:$變量名稱
配置 Pipeline 管道變量
使用 Azure CLI 創建 Azure Storage Account、Azure Key Vault 的內聯腳本中使用管理內變量控制參數
變量名 | 變量值 |
terraform_rg | Web_Test_TF_RG |
storage_account | cnbatetfstorage |
storage_account_container | tf-state |
keyvault | cnbate-terraform-kv |
keyvault_sc | terraform-stste-storage-key |
container_key | cnbate.tf.stats |
運行 Pipeline,查看配置輸出
由於我們已經在 azure-pipelines-1.yaml 文件中指定了工作分支 “remote_stats”,當我們只要觸發 “remote_stats” 分支的 “push” 或者 “pull_request” 動作都會觸發 Azure DevOps Pipeline 的運行。
相同 stage 內的 job 輸出
不同 stage 的 job 輸出
總結
本期實驗,我們學習瞭如何在 Azure DevOps Pipeline 運行期間創建的動態臨時變量以及變量的輸出,使得我們更加靈活的在任意 job 中聲明自定義的動態臨時變量,並將動態臨時變量應用到任意的 job 中,這種方式有區別與Pipeline 管道內變量,尤其是在定義階段和使用語法上,詳細內容參考官方文檔。
在腳本中設置變量:https://docs.microsoft.com/en-us/azure/devops/pipelines/process/set-variables-scripts
github 代碼地址:https://github.com/yunqian44/Terraform_Cnbate_Traffic_Manager
Terraform 在 Azure DevOps 中的使用系列:https://www.cnblogs.com/AllenMaster/category/1876925.html