对Terraform中其他模块资源的引用

Question

我的Terraform Cloud git项目中有这样的层次结构：

├── aws
│   ├── flavors
│   │   └── main.tf
│   ├── main.tf
│   ├── security-rules
│   │   └── sec-rule1
│   │       └── main.tf
│   └── vms
│   │   └── vm1
│   │       └── main.tf
└── main.tf

所有主main.tf文件都包含带有子文件夹的模块定义：

/main.tf:

terraform {
required_version = "~> 0.12.0"
backend "remote" {
hostname = "app.terraform.io"    
organization = "foo"
workspaces {
name = "bar"
}
}
required_providers {
openstack = "~> 1.24.0"
}
}
module "aws" {
source = "./aws"
}

/aws/main.tf:

module "security-rules" {
source = "./security-rules"
}
module "flavors" {
source = "./flavors"
}
module "vms" {
source = "./vms"
}

/aws/security-rules/main-tf:

module "sec-rule1" {
source = "./sec-rule1"
}

/aws/vms/main-tf:

module "vm1" {
source = "./vm1"
}

然后我定义了这个安全规则。

/aws/security-rules/sec-rule1/main-tf:

resource "openstack_compute_secgroup_v2" "sec-rule1" {
name        = "sec-rule1"
description = "Allow web port"
rule {
from_port   = 80
to_port     = 80
ip_protocol = "tcp"
cidr        = "0.0.0.0/0"
}
lifecycle {
prevent_destroy = false
}
}

我想从一个或多个虚拟机引用它，但我不知道如何通过资源ID(或名称(引用。我用简单的名字而不是引用。

/aws/vms/vm1/main-tf:

resource "openstack_blockstorage_volume_v3" "vm1_volume" {
name     = "vm1_volume"
size     = 30
image_id = "foo-bar"
}
resource "openstack_compute_instance_v2" "vm1_instance" {
name        = "vm1_instance"
flavor_name = "foo-bar"
key_pair    = "foo-bar keypair"
image_name  = "Ubuntu Server 18.04 LTS Bionic"
block_device {
uuid                  = "${openstack_blockstorage_volume_v3.vm1_volume.id}"
source_type           = "volume"
destination_type      = "volume"
boot_index            = 0
delete_on_termination = false
}
network {
name = "SEG-tenant-net"
}
security_groups = ["default", "sec-rule1"]
config_drive    = true
}
resource "openstack_networking_floatingip_v2" "vm1_fip" {
pool = "foo-bar"
}
resource "openstack_compute_floatingip_associate_v2" "vm1_fip" {
floating_ip = "${openstack_networking_floatingip_v2.vm1_fip.address}"
instance_id = "${openstack_compute_instance_v2.vm1_instance.id}"
}

我想使用按名称或ID引用的安全规则(以及更多内容(，因为这样会更一致。此外，当我创建一个新的安全规则，同时创建一个VM时，Terraform OpenStack提供程序会毫无错误地对其进行规划，但在应用它时，会产生错误，因为VM是先创建的，它没有发现尚未创建的新安全规则。

我该怎么做？

Answer 1

您应该为sec-rule1和security-rules/模块输出sec_rule_allow_web_name，然后将security-rules/模块的输出设置为vm1和vms模块的输入。通过这种方式，您可以保持vm1模块与security_rules输出的依赖关系，称为依赖反转。

# ./security-rules/<example>/outputs.tf
output "sec_rule_allow_web_name" {
value = "<some-resource-to-output>"
}

# ./vms/variables.tf
variable "security_rule_name" {}

前提是输出和输入在正确的模块中定义。

# /aws/main.tf
# best practice to use underscores instead of dashes in names
# so security-roles/ directory is now called security_rules
module "security_rules" {
source = "./security-rules"
}
module "flavors" {
source = "./flavors"
}
module "vms" {
source = "./vms"
security_rule_name = module.security_rules.sec_rule_allow_web_name
}