Jérôme Dx

Posted on May 21 • Edited on Oct 22

Github Actions to deploy your Terraform code

#cicd #terraform #googlecloud

If you have chosen to host some of your codebases on Github, you should know that there is a built-in tool allowing you to implement CI/CD workflows, called Github Actions.

My goal in this article is to show you that with just a few clicks and writing yaml, you can properly deploy your Terraform code on your favorite cloud provider (in this example we will use Google Cloud).

Why CI/CD

In short, the main advantages that I see of going through a CI/CD pattern (Continuous Integration / Continuous Deployment), rather than deploying the code directly from your computer, are :

Maintenance : Your deployment code will be reproducible and versioned
Traceability : You will have a history of different deployments and past errors
Teamwork : Deployment will be accessible to all those included in the project, without complicated configuration

For a more exhaustive explanation, I refer you to the reference which is the 12factor app.

Why Github Actions

Github Actions has many competitors in its category that allow you to run all kinds of code running on containers, such as Gitlab, Jenkins, CircleCI, etc.

There are also more specialized tools in deploying IaC code, such as: HCP Terraform, Atlantis, Terramate, etc.

My choice fell on Github Actions, aiming to have the lightest footprint possible.

Since my code is already on the Github platform, this gives me the ability to execute code, without having to connect to an additional tool. The possibilities are extensive, I can run all kinds of containers, whether for infrastructure or not.

It is also a tool with a strong community, which can be frequently encountered on consulting missions.

Pricing

Considering the billing documention, for personal use, you can use it free of charge within certain limitations per month for private repositories (2000 minutes of build and 500 Mo of package storage, by month). You also have the possibility to connect your own agents in addition.

Good news is that Github encourages open-source by offering unlimited use for publicly exposed repositories.

If you want to extend the possibilities of your personal account, you can take Github Pro, for $4/month.

If the company you work for has subscribed to Github, you probably benefit from a more substantial offer with additional features (GitHub Team or GitHub Enterprise).

Let’s do the demo

In our example, I only selected the basic features available in the free offer, which can therefore be used in all contexts.

Here is the Terraform code you can use to create a Cloud function on Google Cloud :

# main.tf
resource "**google_storage_bucket_object**" "object" {
  name   = "functions/test1.zip"
  bucket = var.bucket_name
  source = "./functions/test1.zip" # Local path to the zipped function source code
}

resource "google_cloudfunctions2_function" "function" {
  name        = "mycorp-test1"
  location    = var.region
  description = "Test1 function"

  build_config {
    runtime     = "python312"
    entry_point = "main"
    source {
      storage_source {
        bucket = var.bucket_name
        object = google_storage_bucket_object.object.name
      }
    }
  }

  service_config {
    max_instance_count = 1
    available_memory   = "256M"
    timeout_seconds    = 60
  }
}

# output.tf
output "function_uri" {
  value = google_cloudfunctions2_function.function.service_config[0].uri
}

# provider.tf
provider "google" {
  credentials = file("credentials.json")

  project = var.project_name
  region  = var.region
  zone    = var.zone
}

terraform {
  backend "gcs" {
    bucket      = "infra-mycorp-terraform-states"
    prefix      = "gha-demo"
    credentials = "credentials.json"
  }
  required_version = ">=1.7.0"
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">=4.0.0"
    }
  }
}

# variables.tf
variable "region" {
  type        = string
  default     = "europe-west1"
  description = "GCP Region"
}

variable "zone" {
  type        = string
  default     = "europe-west1-c"
  description = "GCP Zone"
}

variable "project_name" {
  type        = string
  default     = "infra-mycorp"
  description = "GCP Project Name"
}

variable "bucket_name" {
  type        = string
  default     = "mycorp-packages"
  description = "Bucket name"
}

You may also generate a json key for your Service Account.

Here is the Python code you can use to create an example package for your Cloud Function, to store on a Cloud Storage bucket :

import functions_framework

@functions_framework.http
def main(request):
    """HTTP Cloud Function.
    Args:
        request (flask.Request): The request object.
        <https://flask.palletsprojects.com/en/1.1.x/api/#incoming-request-data>
    Returns:
        The response text, or any set of values that can be turned into a
        Response object using `make_response`
        <https://flask.palletsprojects.com/en/1.1.x/api/#flask.make_response>.
    """
    request_json = request.get_json(silent=True)
    request_args = request.args

    if request_json and 'name' in request_json:
        name = request_json['name']
    elif request_args and 'name' in request_args:
        name = request_args['name']
    else:
        name = 'World'
    return 'Hello {}!'.format(name)

And here the Github Actions workflows to execute your Terraform code :

# .github/workflows/1_plan.yml
name: 1. Plan
run-name: Run Workflow ${{ github.run_id }} 🚀
on:
  workflow_dispatch:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "🚀 Plan launched"
      - name: Install packages
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential python3
      - name: Install Homebrew
        run: |
          /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
          rc=/tmp/rcfile && touch $rc
          echo 'eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv)' >> $rc
      - name: Install Terraform
        run: |
          source /tmp/rcfile
          brew install tfenv
          tfenv install 1.8.3
          tfenv use 1.8.3
          terraform version
      - name: Load credentials
        run: |
          echo -n '${{ secrets.GOOGLE_CREDENTIALS }}' | base64 -d > credentials.json
      - name: Terraform Init
        run: |
          terraform init -get=true -upgrade
          terraform workspace new ${{ vars.WORKSPACE_DEV }} || true
          terraform workspace select ${{ vars.WORKSPACE_DEV }}
      - name: Terraform Format
        run: |
          terraform fmt
      - name: Terraform Plan
        run: |
          terraform plan
      - run: echo "🍏 The job's status is ${{ job.status }}."

# .github/workflows/2_apply.yml
name: 2. Apply
run-name: Run Workflow ${{ github.run_id }} 🚀
on:
  workflow_dispatch:
jobs:
  apply:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "🚀 Plan launched"
      - name: Install packages
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential python3
      - name: Install Homebrew
        run: |
          /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
          rc=/tmp/rcfile && touch $rc
          echo 'eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv)' >> $rc
      - name: Install Terraform
        run: |
          source /tmp/rcfile
          brew install tfenv
          tfenv install 1.8.3
          tfenv use 1.8.3
          terraform version
      - name: Load credentials
        run: |
          echo -n '${{ secrets.GOOGLE_CREDENTIALS }}' | base64 -d > credentials.json
      - name: Terraform Init
        run: |
          terraform init -get=true -upgrade
          terraform workspace new ${{ vars.WORKSPACE_DEV }} || true
          terraform workspace select ${{ vars.WORKSPACE_DEV }}
      - name: Terraform Apply
        run: |
          terraform apply -auto-approve
      - run: echo "🍏 The job's status is ${{ job.status }}."

# .github/workflows/3_destroy.yml
name: 3. Destroy
run-name: Run Workflow ${{ github.run_id }} 🚀
on:
  workflow_dispatch:
jobs:
  destroy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "🚀 Plan launched"
      - name: Install packages
        run: |
          sudo apt-get update
          sudo apt-get install -y build-essential python3
      - name: Install Homebrew
        run: |
          /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
          rc=/tmp/rcfile && touch $rc
          echo 'eval $(/home/linuxbrew/.linuxbrew/bin/brew shellenv)' >> $rc
      - name: Install Terraform
        run: |
          source /tmp/rcfile
          brew install tfenv
          tfenv install 1.8.3
          tfenv use 1.8.3
          terraform version
      - name: Load credentials
        run: |
          echo -n '${{ secrets.GOOGLE_CREDENTIALS }}' | base64 -d > credentials.json
      - name: Terraform Init
        run: |
          terraform init -get=true -upgrade
          terraform workspace new ${{ vars.WORKSPACE_DEV }} || true
          terraform workspace select ${{ vars.WORKSPACE_DEV }}
      - name: Terraform Destroy
        run: |
          terraform apply -destroy -auto-approve
      - run: echo "🍏 The job's status is ${{ job.status }}."

Some explanations on the workflows

Triggers

In the “on:” section, I created a rule to execute the “Plan” workflow, when there is a commit or a pull request on the “main” branch.

I created 3 files (one file for each workflow, inside the “./.github/workflows” folder), with the “workflow_dispatch:” section, we have the possibility to trigger manually an “apply” or a “delete”, once the plan is done (or to relaunch the plan).

Note that I didn’t use the manual approval feature, to set manual validation inside a workflow, because it isn’t available in the free features.

Here is what shows the interface for a basic plan :

Checkout

Ensure you have the step “uses: actions/checkout”, because it is required if you want to have your code inside your container.

Variables & secrets

Go in the Settings of your project, to consult variables and secrets you want to store for your workflow. Then you can call them with the “var.” and “secrets.” prefixes.

There are some restrictions for secrets, once copied, you can’t consult them again from the interface.

Another thing is that you a restricted to a certain number of characters for the value of your secret, a common trick I used is to encode it in base64, and decode it directly in the workflow.

Packaging

I used the “ubuntu-latest” image which is Debian-based (with apt) and commonly available in the Github Actions workers, so it deploys very fast.

I chose to install HomeBrew, because there are a lot of tools I like available on this package manager, including tfenv, which allows me to install any version of Terraform very easily.

Validations and workspaces

The only validation I have installed is the Terraform Format command, which indicates if the code is written according to the recommended formalism. It is of course possible and encouraged to install other validations.

The workspace for Terraform allows you to compartmentalize the code according to different spaces and environments.

To conclude

Here is a very simple way to deploy infrastructure on Google Cloud with a Github free account and some Terraform code.

You can use as you wish and improve according to your preferences and needs.

It is also possible to interact Github Actions with a more specialized tool (like HCP Terraform or Terramate), which could be the subject of a future article.