I have posted an opinion question but was told that SO favours more specific question hence why I’m asking a more specific as a followup:
Let’s say that I have two terraform projects, vpc, and k8s cluster:
# vpc/main.tf
resource "aws_vpc" "main" {
cidr_block = "10.0.0.0/16"
}
resource "aws_subnet" "main1" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.1.0/24"
tags = {
Name = "Main1"
}
}
resource "aws_subnet" "main2" {
vpc_id = aws_vpc.main.id
cidr_block = "10.0.2.0/24"
tags = {
Name = "Main2"
}
}
output "vpc_id" {
value = aws_vpc.main.id
}
output "subnet_1_id" {
value = aws_subnet.main1.id
}
output "subnet_2_id" {
value = aws_subnet.main1.id
}
In the cluster project:
# eks/main.tf
variable "subnet_1_id" {}
variable "subnet_2_id" {}
resource "aws_eks_cluster" "example" {
name = "example"
role_arn = "arn:myawsrole/accnt"
vpc_config {
subnet_ids = [var.subnet_1_id, var.subnet_2_id]
}
# Ensure that IAM Role permissions are created before and deleted after EKS Cluster handling.
# Otherwise, EKS will not be able to properly delete EKS managed EC2 infrastructure such as Security Groups.
depends_on = [
aws_iam_role_policy_attachment.example-AmazonEKSClusterPolicy,
aws_iam_role_policy_attachment.example-AmazonEKSVPCResourceController,
]
}
output "endpoint" {
value = aws_eks_cluster.example.endpoint
}
output "kubeconfig-certificate-authority-data" {
value = aws_eks_cluster.example.certificate_authority[0].data
}
Let’s say I want the EKS module to be fed the inputs from vpc/main.tf but I want them to be applied independently to limit the blast radius. How do I manage these projects in pure terraform. I don’t want to use terragrunt/terrateam since they are overkill for my case I feel. Here are approaches I have considered:
- Using terraform remote_state data source
- Writing to another source such as aws_ssm or vault and reading those from that source
Note that I also want to be able to detect when these outputs have changed to trigger updates in dependant projects as well and I want to do this in a pipeline so I need a way to track changes in thes outputs