如何测试Terraform文件

Question

我在Terraform文件中定义我的基础设施.我非常喜欢Terraform,但我很难弄清楚如何测试.我有awspec,这非常好,并且通过AWS API对您的构建结果运行类似RSpec的测试.但有没有办法进行单元测试,比如结果terraform plan？其他人使用Terraform的工作流程是什么？

Answer 1

我将使用有关 Kitchen-Terraform 的更多信息来扩展 Begin 的回答。

Kitchen-Terraform is a set of open source plugins that run within Test-Kitchen, these are supposed to go into your Terraform module repository to test that module's functionality before being used in a repository that creates the resources. Please feel free to check the documentation of those two projects for more details, but I will go through my recommendations for integration testing your Terraform code.

Install Ruby, Terraform For this example, the Terraform module repo will be called: my_terraform_module

mkdir -p my_terraform_module
cd my_terraform_module

mkdir -p test/integration/kt_suite/controls \
         test/fixtures/tf_module/

Create a Gemfile:

source "https://rubygems.org/" do
  gem "kitchen-terraform"
end

Install the necessary components (uses the Gemfile for the dependencies of kitchen-terraform)

gem install bundler
bundle install

Create the Test-Kitchen file .kitchen.yml - this brings together the testing frame, Test-Kitchen and Kitchen-Terraform

---
driver:
  name: terraform
  root_module_directory: test/fixtures/tf_module
  parallelism: 4

provisioner:
  name: terraform

transport:
  name: ssh

verifier:
  name: terraform
  groups:
    - name: basic
      controls:
        - file_check
        - state_file

platforms:
  - name: terraform

suites:
  - name: kt_suite

Your Terraform code should be at the root of the Terraform module repository such as:

my_terraform_module/
  |-- main.tf

Example code that can go in main.tf

resource "null_resource" "create_file" {
  provisioner "local-exec" {
    command = "echo 'this is my first test' > foobar"
  }
}

Then we reference the Terraform module just like we would in Terraform live repos - but in a test fixture instead in this file: test/fixtures/tf_module/main.tf

module "kt_test" {
  source = "../../.."
}

Then from there, you can run Terraform apply, but it's done a little differently with Kitchen-Terraform and Test-Kitchen, you run a converge which helps keep track of state and a couple other items.

bundle exec kitchen converge

Now you've seen your Terraform code do an apply, we need to test it. We can test the actual resources that were created, which would be like an integration test, but we can also test the state file, which is a semi unit test, but I am not aware of anything that can currently do unit tests against the HCL code of Terraform.

Create an inspec default profile file: test/integration/kt_suite/inspec.yml

---
name: default

Create an Inspec control for your integration testing: test/integration/kt_suite/controls/basic.rb - I'm using a test for the example Terraform code I used earlier for the main.tf

# frozen_string_literal: true

control "file_check" do
  describe file('.kitchen/kitchen-terraform/kt-suite-terraform/foobar') do
    it { should exist }
  end
end

And this is an example test of pulling information from the state file and testing if something exists in it. This is a basic one, but you can definitely exand on this example.

# frozen_string_literal: true

terraform_state = attribute "terraform_state", {}

control "state_file" do
  describe "the Terraform state file" do
    subject do json(terraform_state).terraform_version end

    it "is accessible" do is_expected.to match /\d+\.\d+\.\d+/ end
  end
end

Then run Inspec controls with Test-Kitchen and Kitchen-Terraform:

bundle exec kitchen verify

I took a lot of this from the getting started guide and some of the tutorials over here: https://newcontext-oss.github.io/kitchen-terraform/getting_started.html

Answer 2

我们最近开源Terratest,我们的瑞士军刀用于测试基础设施代码.

今天,您可能通过部署,验证和取消部署来手动测试所有基础架构代码.Terratest可帮助您自动完成此过程:

1. 在Go中编写测试.
2. 在Terratest中使用帮助程序来执行您的真实IaC工具(例如,Terraform,Packer等),以在真实环境(例如,AWS)中部署真实基础架构(例如,服务器).
3. 在Terratest中使用帮助程序通过发出HTTP请求,API调用,SSH连接等来验证基础结构在该环境中是否正常工作.
4. 在Terratest中使用帮助程序在测试结束时取消部署所有内容.

以下是一些Terraform代码的示例测试:

terraformOptions := &terraform.Options {
  // The path to where your Terraform code is located
  TerraformDir: "../examples/terraform-basic-example",
}

// This will run `terraform init` and `terraform apply` and fail the test if there are any errors
terraform.InitAndApply(t, terraformOptions)

// At the end of the test, run `terraform destroy` to clean up any resources that were created
defer terraform.Destroy(t, terraformOptions)

// Run `terraform output` to get the value of an output variable
instanceUrl := terraform.Output(t, terraformOptions, "instance_url")

// Verify that we get back a 200 OK with the expected text
// It can take a minute or so for the Instance to boot up, so retry a few times
expected := "Hello, World"
maxRetries := 15
timeBetweenRetries := 5 * time.Second
http_helper.HttpGetWithRetry(t, instanceUrl, 200, expected, maxRetries, timeBetweenRetries)

这些是集成测试,根据您正在测试的内容,可能需要5到50分钟.它并不快(虽然使用Docker和测试阶段,你可以加速一些事情),你必须努力使测试可靠,但它是值得的时间.

查看Terratest repo for docs和各种类型的基础设施代码的示例以及相应的测试.