OpenTofu CI/CD Component

🚨 🚧 NOTE 🚧 🚨

This component is work in progress, where inputs, template names and the entire interface in general may change at any time until version 1.0.0 is reached. From where on this CI/CD component will be versioned using semver 2.0. The progress of implementing such a version can be tracked in https://gitlab.com/groups/gitlab-org/-/epics/12401.

The src/gitlab-tofu.sh script is still merely a copy from gitlab-terraform. Therefore, lots of things in this script and in the templates are still Terraform-related and haven't been changed to their OpenTofu equivalents.

This project is home to the OpenTofu CI/CD component and it's related assets, like the gitlab-tofu wrapper script and OCI images containing that script together with an OpenTofu version.

Read more:

• CI/CD components
• Development guide for GitLab CI/CD components
• CI/CD Catalog

Note: Please make sure to use a released version of this CI/CD component. You find all releases on the Releases Overview Page.

Usage

include:
  - component: gitlab.com/components/opentofu/full-pipeline@<VERSION>
    inputs:
      # The version must currently be specified explicitly as an input,
      # to find the correctly associated images. # This can be removed
      # once https://gitlab.com/gitlab-org/gitlab/-/issues/438275 is solved.
      version: <VERSION>
      opentofu_version: <OPENTOFU_VERSION>

stages: [validate, build, deploy, cleanup]

A concrete example may look like this:

# Using `latest`
include:
  - component: gitlab.com/components/opentofu/full-pipeline@~latest
    inputs:
      # The version must currently be specified explicitly as an input,
      # to find the correctly associated images. # This can be removed
      # once https://gitlab.com/gitlab-org/gitlab/-/issues/438275 is solved.
      version: latest
      opentofu_version: 1.6.1

stages: [validate, build, deploy, cleanup]

---

# ... or using `0.0.0-alpha1`:
include:
  - component: gitlab.com/components/opentofu/full-pipeline@0.0.0-alpha1
    inputs:
      # The version must currently be specified explicitly as an input,
      # to find the correctly associated images. # This can be removed
      # once https://gitlab.com/gitlab-org/gitlab/-/issues/438275 is solved.
      version: 0.0.0-alpha1
      opentofu_version: 1.6.1

stages: [validate, build, deploy, cleanup]

Opinionated Templates

This component repository also provides some templates that may often be used, for example one that only runs validation (fmt and validate), plan and an apply, but no destructive actions.

• validate-plan
• validate-plan-apply

Job Templates

Instead of including the full-pipeline or another opinionated tempalte, it's also possible to include individual jobs and compose your own pipeline, for example, to just run the fmt job you can do:

include:
  - component: gitlab.com/components/opentofu/fmt@latest
    inputs:
      # The version must currently be specified explicitly as an input,
      # to find the correctly associated images. # This can be removed
      # once https://gitlab.com/gitlab-org/gitlab/-/issues/438275 is solved.
      version: latest
      opentofu_version: 1.6.1
      root_dir: tofu/

Have a look at the full-pipeline for how it's constructed.

The following job components exist:

• fmt
• validate
• plan
• apply
• destroy
• delete-state

Have a look at the individual template spec to learn about the available inputs.

Inputs

Available OpenTofu Versions

The following OpenTofu versions are available with this component via the opentofu_version input:

• 1.6.1
• 1.6.0
• 1.6.0-rc1

Releases & Versioning

This project currently releases tagged commits. An overview of releases can be found on the Releases page.

Each release is accessible in the CI/CD Catalog.

Component Versions

The component release versions follow Semantic Versioning 2.0.0.

Image Versions

This project releases multiple OCI image variants that can be used with the component. The intention is that the images used in a component have the same version and or not mixed. Due to the limitations described in https://gitlab.com/gitlab-org/gitlab/-/issues/438275 it's currently required to provide the component version in the component include field and as the version input. Check out the Usage section for examples.

Each component release deploys the following images:

• registry.gitlab.com/components/opentofu/gitlab-opentofu:<VERSION>-opentofu<OPENTOFU_VERSION>
• registry.gitlab.com/components/opentofu/gitlab-opentofu:<VERSION>-opentofu
  • Includes the latest stable OpenTofu version at the time of releasing the component
• registry.gitlab.com/components/opentofu/gitlab-opentofu:<VERSION>
  • Includes the latest stable OpenTofu version at the time of releasing the component

In the above examples <VERSION> references the component version and <OPENTOFU_VERSION> an OpenTofu release, from here.

Note: unfortunately, these image versions are not SemVer compatible, because - indicates a prerelease (which they are not in this case). However, we cannot use the alternative + which would indicate build metadata as we'd like. See https://github.com/distribution/distribution/issues/1201

Usage on self-managed

GitLab CI/CD components are not yet distributed and available on self-managed GitLab instances. (see details here). It's also not possible to just include CI/CD components across instance, thus an include like - component: gitlab.com/components/opentofu/full-pipeline@~latest won't work from a self-managed instance. However, you could mirror this project from GitLab.com onto any self-managed instance using a repository pull mirror. and then use the component as you would from GitLab.com, but change the domain, like so:

include:
  - component: gitlab.example.com/components/opentofu/full-pipeline@~latest
    inputs:
      ...

This example assumes your GitLab instance is hosted on gitlab.example.com and this component project is mirrored in the components/opentofu project.

Contributing

See the CONTRIBUTING.md guide.