社区首页 >问答首页 >Terraform将列表/设置从根模块传递到子模块问题

问Terraform将列表/设置从根模块传递到子模块问题
EN

Stack Overflow用户

提问于 2022-10-01 16:58:30

回答 1查看 112关注 0票数 0

我有这个根模块，它调用子模块来创建GCP项目和创建IAM角色绑定。

module "test_project" {
  source         = "terraform.dev.mydomain.com/Dev/sbxprjmodule/google"
  version        = "1.0.3"
  short_name     = "looker-nwtest"
  owner_bindings = ["group:npe-cloud-platformeng-contractors@c.mydomain.com", "group:npe-sbox-rw-tfetraining@c.mydomain.com"]
}

variable "owner_bindings" {
  type    = list(string)
  default = null
}

这是执行分配任务的子模块。

resource "google_project_iam_binding" "g-sbox-iam-owner" {
  count = var.owner_bindings == null ? 0 : length(var.owner_bindings)
  project = "${var.project_id}-${var.short_name}"
  role    = "roles/owner"
  members = [var.owner_bindings[count.index]]
}

variable "owner_bindings" {
  type    = list(string)
  default = null
}
/*

当我做一个地形规划和应用时，它正确地创建了两个绑定，循环了两次。然后，当我再次运行一个地形图并应用时，它将显示下面的更改。

# module.lookernwtest_project.google_project_iam_binding.g-sbox-iam-owner[0] will be updated in-place
  ~ resource "google_project_iam_binding" "g-sbox-iam-owner" {
        id      = "g-prj-npe-sbox-looker-nwtest/roles/owner"
      ~ members = [
          + "group:npe-cloud-platformeng-contractors@c.mydomain.com",
          - "group:npe-sbox-rw-tfetraining@c.mydomain.com",
        ]
        # (3 unchanged attributes hidden)
    }

下一次，当我做一个地形图和申请，它显示如下。然后，在随后的每个计划中，在两个小组之间交替进行并应用。

# module.lookernwtest_project.google_project_iam_binding.g-sbox-iam-owner[1] will be updated in-place
  ~ resource "google_project_iam_binding" "g-sbox-iam-owner" {
        id      = "g-prj-npe-sbox-looker-nwtest/roles/owner"
      ~ members = [
          - "group:npe-cloud-platformeng-contractors@c.relayhealth.com",
          + "group:npe-sbox-rw-tfetraining@c.relayhealth.com",
        ]
        # (3 unchanged attributes hidden)
    }

试图将数据结构从列表更改为set，但问题相同。这些组不被继承，并且也仅在项目级别上应用。所以不知道我做错了什么。

terraform

terraform-provider-gcp

回答 1

Stack Overflow用户

回答已采纳

发布于 2022-10-03 07:45:22

而不是count，您可以使用for_each，更改很简单.

子模块中的资源如下所示：

resource "google_project_iam_binding" "g-sbox-iam-owner" {
  for_each = var.owner_bindings == null ? toset([]) : toset(var.owner_bindings)  
  project  = "${var.project_id}-${var.short_name}"
  role     = "roles/owner"
  members  = [each.value]
}

计数更改for_each，在成员中我们使用each.value

对于状态更改的for_each，您将不再看到数字数组：

# module.lookernwtest_project.google_project_iam_binding.g-sbox-iam-owner[0]
...
# module.lookernwtest_project.google_project_iam_binding.g-sbox-iam-owner[1]

相反，它将有名称，类似于：

# module.lookernwtest_project.google_project_iam_binding.g-sbox-iam-owner["abc"]
...
# module.lookernwtest_project.google_project_iam_binding.g-sbox-iam-owner["def"]

循环或不循环

看了一会儿之后，我想知道为什么我们需要单独的iam_binding，如果他们都有相同的角色，如果所有的成员都有相同的“角色/所有者”，我们就可以这样做：

resource "google_project_iam_binding" "g-sbox-iam-owner" {
  project = "${var.project_id}-${var.short_name}"
  role    = "roles/owner"
  members = [var.owner_bindings]
}