GCP 范围的 Terraform 变量

Question

我想为各种 GCP 范围创建一个变量，然后在创建 GCP 计算实例时使用该变量（范围）。

https://cloud.google.com/sdk/gcloud/reference/alpha/compute/instances/set-scopes#--scopes

换句话说，我想避免在我们创建每个新实例时都写出这些长长的 URL。使用 Terraform 执行此操作的最佳方法是什么？

service_account {

        scopes               = ["https://www.googleapis.com/auth/devstorage.read_only",
                                "https://www.googleapis.com/auth/logging.write",
                                "https://www.googleapis.com/auth/monitoring.write",
                                "https://www.googleapis.com/auth/pubsub",
                                "https://www.googleapis.com/auth/service.management.readonly",
                                "https://www.googleapis.com/auth/servicecontrol",
                                "https://www.googleapis.com/auth/trace.append",
                                "https://www.googleapis.com/auth/cloud-platform",
                                "https://www.googleapis.com/auth/cloud-platform.read-only",
                                "https://www.googleapis.com/auth/cloudplatformprojects",
                                "https://www.googleapis.com/auth/cloudplatformprojects.readonly"]

    }

terraform --version Terraform v0.12.12 + provider.google v2.17.0

Answer 1

假设 Terraform 0.12.x 您可以使用列表类型变量来执行此操作（参考：https://www.terraform.io/docs/configuration/variables.html）

在您的 main.tf（或您正在使用的任何 Terraform 文件）中：

variable "account_scopes" {
    default = []
    type = list(string)
    description = "List of service account scopes"
}

resource "google_compute_instance" "default" {
    name         = "Hostname"
    machine_type = "n1-standard-2"
    zone         = "us-central1-b"

    boot_disk {
        initialize_params {
            image = "projects/centos-cloud/global/images/centos-8-v20191018"
        }
    }

    scratch_disk {
    }

    network_interface {
        network = "default"
    }

    service_account {
        scopes = var.account_scopes
    }
}

terraform.auto.tfvars

account_scopes = [
                  "https://www.googleapis.com/auth/devstorage.read_only",
                  "https://www.googleapis.com/auth/logging.write",
                  "https://www.googleapis.com/auth/monitoring.write",
                  "https://www.googleapis.com/auth/pubsub",
                  "https://www.googleapis.com/auth/service.management.readonly",
                  "https://www.googleapis.com/auth/servicecontrol",
                  "https://www.googleapis.com/auth/trace.append",
                  "https://www.googleapis.com/auth/cloud-platform",
                  "https://www.googleapis.com/auth/cloud-platform.read-only",
                  "https://www.googleapis.com/auth/cloudplatformprojects",
                  "https://www.googleapis.com/auth/cloudplatformprojects.readonly"
                  ]