Include test automatization for terraform

[Tansito]

What is the expected enhancement?

I would like to introduce tests in our terraform configuration to ensure overall that with new changes the configuration continues working.

[Tansito]

Resources that I found interesting for this:

• https://www.hashicorp.com/blog/testing-hashicorp-terraform
• https://medium.com/codex/terraform-best-practices-testing-your-code-f25053b06c4c

Tools:

• https://terratest.gruntwork.io/
• https://github.com/newcontext-oss/kitchen-terraform
• https://github.com/terraform-linters/tflint

At starting point I think is interesting to start working with the next commands:

• terraform fmt -check -recursive: to review the format
• terraform validate: to validate the configuration
• tflint --recursive: to lint errors

Apart from this commands like terraform plan and tools may require connectivity to a cluster for testing.

[psschwei]

I think that makes sense as a starting point.

[psschwei]

FWIW, I tried running terraform validate and got a few errors:

$ pwd
/home/paulschw/quantum/quantum-serverless/infrastructure/terraform/ibm

$ terraform validate
╷
│ Error: Module not installed
│ 
│   on cluster.tf line 5:
│    5: module "vpc_kubernetes_cluster" {
│ 
│ This module is not yet installed. Run "terraform init" to install all modules required by this configuration.
╵
╷
│ Error: Module not installed
│ 
│   on vpc.tf line 5:
│    5: module "vpc" {
│ 
│ This module is not yet installed. Run "terraform init" to install all modules required by this configuration.
╵

$ terraform init
Initializing modules...
Downloading registry.terraform.io/terraform-ibm-modules/vpc/ibm 1.1.1 for vpc...
- vpc in .terraform/modules/vpc/modules/vpc
Downloading registry.terraform.io/terraform-ibm-modules/cluster/ibm 1.5.0 for vpc_kubernetes_cluster...
- vpc_kubernetes_cluster in .terraform/modules/vpc_kubernetes_cluster/modules/vpc-kubernetes

Initializing the backend...

Initializing provider plugins...
- Reusing previous version of hashicorp/helm from the dependency lock file
- Reusing previous version of ibm-cloud/ibm from the dependency lock file
- Installing hashicorp/helm v2.9.0...
- Installed hashicorp/helm v2.9.0 (signed by HashiCorp)
- Installing ibm-cloud/ibm v1.50.0...
╷
│ Error: Failed to install provider
│ 
│ Error while installing ibm-cloud/ibm v1.50.0: the current package for registry.terraform.io/ibm-cloud/ibm 1.50.0
│ doesn't match any of the checksums previously recorded in the dependency lock file; for more information:
│ https://www.terraform.io/language/provider-checksum-verification
╵

[psschwei]

If I delete the hashes, then the init works...

$ tail .terraform.lock.hcl  -n 5

provider "registry.terraform.io/ibm-cloud/ibm" {
  version     = "1.50.0"
  constraints = ">= 1.50.0"
}

$ terraform init
Initializing modules...

Initializing the backend...

Initializing provider plugins...
- Reusing previous version of ibm-cloud/ibm from the dependency lock file
- Reusing previous version of hashicorp/helm from the dependency lock file
- Installing ibm-cloud/ibm v1.50.0...
- Installed ibm-cloud/ibm v1.50.0 (self-signed, key ID AAD3B791C49CC253)
- Using previously-installed hashicorp/helm v2.9.0

Partner and community providers are signed by their developers.
If you'd like to know more about provider signing, you can read about it here:
https://www.terraform.io/docs/cli/plugins/signing.html

Terraform has made some changes to the provider dependency selections recorded
in the .terraform.lock.hcl file. Review those changes and commit them to your
version control system if they represent changes you intended to make.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

$ tail .terraform.lock.hcl -n 15
}

provider "registry.terraform.io/ibm-cloud/ibm" {
  version     = "1.50.0"
  constraints = ">= 1.50.0"
  hashes = [
    "h1:dzDm/Y+XET9keTcgpzcTYctT/7jKqbTTM14kTRVMoxI=",
    "zh:053b1481267b41278600121b0e326e338bbc52eab51b12054ff0f25ba11796ba",
    "zh:3e1165f6344647f274d48d6c21d097c209ed3669425a05a8591a714983ca3556",
    "zh:4bff4b86edfda1443cbd2c9481dcba3d8ff08963a67a7071150cfac212c3f6a5",
    "zh:83c7572a2a194100435ee35a399a209ec048474dd4460a4603fff93b4b2c7684",
    "zh:a6abd7638a879975e3e107a38d7d4cae4250f26d3759f9908eab1111aa653b22",
    "zh:fa8d07768ca035348778edce0817bc9ed8a922ca39b3f5389a4cfdd5425254c5",
  ]
}

[Tansito]

Yeah, for aws everything works as expected but it seems that for ibm doesn't like the h1 dependencies and may use zh (info here). The problem is that renovate regenerates the lock with h1 so I'm just investigating how to solve the problem.

[Tansito]

From #625 I agree with @psschwei and nearer than later we are going to be able to remove terraform from the project. I'm closing this issue to emphasize that the support to terraform is going to be reduced from now on in advantage of other development workloads.

(opposing views are welcome @IceKhan13 , @pacomf as always)