Terraform terraform

The terraform resource allows Terraform configurations to be executed inside a Docker container. The resource runs terraform init, terraform apply, and captures any outputs defined in the Terraform configuration, making them available to other Jumppad resources.

Terraform state is persisted between runs, and the resource will re-apply if changes to the source directory are detected.

Properties

  • Name
    source
    Type
    (string: "")
    Required
    required
    Readonly
    Description

    The source directory containing the Terraform configuration files. Can be specified as a relative or absolute path. Relative paths are resolved relative to the file declaring the resource.

    resource "terraform" "example" {
  source = "./terraform_config"
}
  • Name
    version
    Type
    (string: 1.14.8)
    Required
    Readonly
    Description

    The version of Terraform to use.

  • Name
    working_directory
    Type
    (string: ./)
    Required
    Readonly
    Description

    The working directory to run Terraform commands in. If not an absolute path, it will be prefixed with /.

  • Name
    environment
    Type
    (map[string]string: map[]{})
    Required
    Readonly
    Description

    Environment variables to set when executing Terraform. Useful for passing provider credentials or configuration.

    resource "terraform" "example" {
  environment = {
    VAULT_TOKEN = "root"
    VAULT_ADDR  = "http://vault:8200"
  }

  source = "./workspace"
}
  • Name
    variables
    Type
    (map: )
    Required
    Readonly
    Description

    Variables to pass to the Terraform configuration. These are written to a terraform.tfvars file and passed via -var-file. Variables can be simple values or complex nested structures.

    resource "terraform" "example" {
  variables = {
    name  = "example"
    count = 3
    config = {
      enabled = true
      region  = "us-east-1"
    }
  }

  source = "./workspace"
}
  • Name
    network
    Type
    (network_attachment: {})
    Required
    Readonly
    Description

    Network to attach the Terraform container to. This allows Terraform to communicate with other resources on the same network.

  • Name
    volume
    Type
    (volume: {})
    Required
    Readonly
    Description

    Volumes to mount into the Terraform container.

  • Name
    output
    Type
    (object: )
    Required
    Readonly
    readonly
    Description

    Output values returned from the Terraform execution. These correspond to output blocks defined in the Terraform configuration and can be referenced by other Jumppad resources.

    output "my_value" {
  value = resource.terraform.example.output.my_key
}
  • Name
    apply_output
    Type
    (string: "")
    Required
    Readonly
    readonly
    Description

    The raw output from the terraform apply command.

network_attachment

Network attachment defines a network to which the container is attached.

  • Name
    id
    Type
    (string: "")
    Required
    required
    Readonly
    Description

    ID of the network to attach the container to, specified in reference format. e.g. to attach to a network called cloud

    network {
  id = "network.cloud"
}
  • Name
    ip_address
    Type
    (string: "")
    Required
    Readonly
    Description

    Static IP address to assign container for the network, the ip address must be within range defined by the network subnet. If this parameter is omitted an IP address will be automatically assigned.

  • Name
    aliases
    Type
    ([]string: [])
    Required
    Readonly
    Description

    Aliases allow alternate names to specified for the container. Aliases can be used to reference a container across the network, the container will respond to ping and other network resolution using the primary assigned name [name].container.local.jmpd.in and the aliases.

    network {
  name    = "network.cloud"
  aliases = [
    "alt1.container.local.jmpd.in", 
    "alt2.container.local.jmpd.in"
  ]
}
  • Name
    name
    Type
    (string: "")
    Required
    Readonly
    readonly
    Description

    Name will equal the name of the network as created by jumppad.

  • Name
    assigned_address
    Type
    (string: "")
    Required
    Readonly
    readonly
    Description

    assigned_address will equal the assigned IP address for the network. This will equal ip_address if set; otherwise, this is the automatically assigned ip_address.

volume

A volume type allows the specification of an attached volume.

  • Name
    source
    Type
    (string: "")
    Required
    required
    Readonly
    Description

    The source volume to mount in the container, can be specified as a relative ./ or absolute path /usr/local/bin. Relative paths are relative to the file declaring the container.

  • Name
    destination
    Type
    (string: "")
    Required
    required
    Readonly
    Description

    The destination in the container to mount the volume to, must be an absolute path.

  • Name
    type
    Type
    (string: bind)
    Required
    Readonly
    Description

    The type of the mount, can be one of the following values:

    • bind: bind the source path to the destination path in the container
    • volume: source is a Docker volume
    • tmpfs: create a temporary filesystem
  • Name
    read_only
    Type
    (bool: false)
    Required
    Readonly
    Description

    Mount the volume as read-only.

  • Name
    bind_propagation
    Type
    (string: rprivate)
    Required
    Readonly
    Description

    Configures bind propagation for Docker volume mounts, only applies to bind mounts, can be one of the following values:

    • shared
    • slave
    • private
    • rslave
    • rprivate

    For more information please see the Docker documentation https://docs.docker.com/storage/bind-mounts/#configure-bind-propagation

  • Name
    bind_propagation_non_recursive
    Type
    (boolean: false)
    Required
    Readonly
    Description

    Configures recursiveness of the bind mount. By default Docker mounts with the equivalent of mount --rbind meaning that mounts below the the source directory are visible in the container. For instance running docker run --rm --mount type=bind,src=/,target=/host,readonly busybox will make /run of the host available as /host/run in the container -- and to make matters even worse it will be writable (since only the toplevel bind is set readonly, not the children). If bind_propagation_non_recursive is set to true then the container will only see an empty /host/run, meaning the tmpfs which is typically mounted to /run on the host is not propagated into the container.

  • Name
    selinux_relabel
    Type
    (string: "")
    Required
    Readonly
    Description

    Configures Selinux relabeling for the container (usually specified as :z or :Z) and can be one of the following values:

    • shared (Equivalent to :z)
    • private (Equivalent to :Z)

Meta Properties

In addition to the main properties, all resources have meta properties, such as the id of the resource. To see the list of these properties please see the Meta Properties section in the documentation /docs/resources/meta.

Examples

Minimal Example

resource "terraform" "example" {
  source = "./workspace"

  variables = {
    name = "test"
  }
}

output "result" {
  value = resource.terraform.example.output.name
}

Full Example with Network and Environment

resource "network" "main" {
  subnet = "10.10.0.0/16"
}

resource "container" "vault" {
  image {
    name = "vault:1.13.3"
  }

  network {
    id = resource.network.main.meta.id
  }

  port {
    local = 8200
    host  = 8200
  }

  environment = {
    VAULT_DEV_ROOT_TOKEN_ID = "root"
  }
}

resource "terraform" "configure_vault" {
  network {
    id = resource.network.main.meta.id
  }

  environment = {
    VAULT_TOKEN = "root"
    VAULT_ADDR  = "http://${resource.container.vault.container_name}:8200"
  }

  variables = {
    first  = "one"
    second = 2
    third = {
      x = 3
      y = 4
    }
  }

  source            = "./workspace"
  working_directory = "/"
  version           = "1.14.8"
}

output "first" {
  value = resource.terraform.configure_vault.output.first
}

output "vault_secret" {
  value = resource.terraform.configure_vault.output.vault_secret
}