You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* feat: sync to a bucket unchunked (#997)
* feat: add doc about space module permissions (#1002)
* docs: Update changelog to include enhanced APM error reporting details (#991)
* docs: Update changelog with new features and fixes for Terraform modules and telemetry improvements (#1006)
* feat: add support for OpenTofu 1.11.2 in changelog (#1008)
* adding clarification to the pr delta comment label (#1007)
* feat: add Intent access control docs (#1005)
Add a section to the Intent documentation about access control
explaining how to setup a custom RBAC role to allow managing Intent
projects for users that are not space admins
* Changelog: fix(stacks): exclude modules from state preview query (#1010)
* Update changelog for task 869brcvge
* Update changelog for task 869brcvge
* rename
---------
Co-authored-by: spacelift-flows-gh-changelog[bot] <253729139+spacelift-flows-gh-changelog[bot]@users.noreply.github.com>
Co-authored-by: Krzysztof Niepokojczycki <[email protected]>
* Add EKS upgrade policy documentation (#1014)
Add informational note explaining the eks_upgrade_policy configuration
option in the EKS deployment guide. Clarifies the differences between
STANDARD (automatic upgrades, lower cost) and EXTENDED (manual upgrades,
higher cost) support types, and notes that switching from extended to
standard support is not possible once entered.
* fix: clarify EKS upgrade policy details and implications (#1019)
* Update TF state management page
---------
Co-authored-by: Joey Stout <[email protected]>
Co-authored-by: Elie CHARRA <[email protected]>
Co-authored-by: Peter Deme <[email protected]>
Co-authored-by: Daniellem97 <[email protected]>
Co-authored-by: Andrius <[email protected]>
Co-authored-by: spacelift-flows-gh-changelog[bot] <253729139+spacelift-flows-gh-changelog[bot]@users.noreply.github.com>
Co-authored-by: Krzysztof Niepokojczycki <[email protected]>
For those of you who don't want to manage Terraform state, Spacelift offers an optional sophisticated state backend
4
-
synchronized with the rest of the application to maximize security and convenience. The ability to have Spacelift manage
5
-
the state for you is only available during [stack creation](../../concepts/stack/creating-a-stack.md#terraform).
3
+
Spacelift offers a sophisticated state backend synchronized with the rest of the application to manage your Terraform state and maximize security and convenience.
6
4
7
-
As you can see, it's also possible to import an existing Terraform state at this point, which is useful for users who
8
-
want to upgrade their previous Terraform workflow.
5
+
The option to have Spacelift manage the state for you is only available during [stack creation](../../concepts/stack/creating-a-stack.md#opentofuterraform). You can also import an existing Terraform state at this point, which is useful for users who want to upgrade their previous Terraform workflow.
9
6
10
7
!!! info
11
8
12
9
If you're using Spacelift to manage your stack, do not specify any [Terraform backend](https://www.terraform.io/docs/backends/index.html){: rel="nofollow"} whatsoever. The one-off config will be dynamically injected into every [run](../../concepts/run/README.md) and [task](../../concepts/run/task.md).
13
10
14
-
## Do. Or do not. There is no try.
11
+
## Benefits of Spacelift state management
15
12
16
-
In this section we'd like to give you a few reasons why it could be useful to trust Spacelift to take care of your
17
-
Terraform state. To keep things level, we'll also give you a reason not to.
18
-
19
-
### Do
20
-
21
-
1. It's **super simple** - just two clicks during stack setup. Otherwise there's nothing to set up on your end, so one
22
-
fewer sensitive thing to worry about. Feel free to refer
23
-
to [how it works on our end](state-management.md#how-it-works), but overall we believe it to be a rather sensible and
24
-
secure setup, at least on par with anything you could set up on your end.
25
-
26
-
2. It's **protected against accidental or malicious access**. Again, you can refer to the more technical section on the
27
-
inner workings of the state server, but the gist is that we're able to map state access and state changes to
28
-
legitimate Spacelift runs, thus automatically blocking all other unauthorized traffic. As far as we know, no other
29
-
backend is capable of that, which is one more reason to give us a go.
30
-
31
-
### Don't
32
-
33
-
1. We'll let you in on a little secret now - behind the pixie dust it's still Amazon S3 all the way down, and at this
34
-
stage [we store all our data in Ireland](../../product/security/README.md). If you're not OK with that, you're better off
35
-
managing the state on your end.
13
+
1.**Simple and easy setup:** Allow Spacelift to manage your Terraform state during stack creation and you don't need to set anything up on your end.
14
+
2.**Protected against accidental or malicious access**: Spacelift maps state access and state changes to legitimate Spacelift runs, thus automatically blocking all other unauthorized traffic.
15
+
3.**Encrypted data storage:** Spacelift offers several different [regions for data storage](../../product/security/README.md#encryption) with Amazon S3.
36
16
37
17
## How it works
38
18
39
-
S3, like half of the Internet. The pixie dust we're adding on top of it involves generating one-off credentials for
40
-
every [run](../../concepts/run/README.md) and [task](../../concepts/run/task.md) and injecting them directly into the
41
-
root of your Terraform project as a `.tf` file.
19
+
Spacelift state management uses S3, like much of the internet. We generate one-off credentials for every [run](../../concepts/run/README.md) and [task](../../concepts/run/task.md) and injecting them directly into the root of your Terraform project as a `.tf` file.
42
20
43
21
!!! warning
44
22
45
-
If you have some Terraform state backend already specified in your code, the initialization phase will keep failing until you remove it.
23
+
If you have some Terraform state backend already specified in your code, the [initialization](../../concepts/run/README.md#initializing) phase will keep failing until you remove it.
46
24
47
-
The state server is an HTTP endpoint implementing the
48
-
Terraform [standard state management protocol](https://www.terraform.io/docs/backends/types/http.html){: rel="nofollow"}.
49
-
Our backend always ensures that the credentials belong to one of the runs or tasks that are currently marked
50
-
as active on our end, and their state indicates that they should be accessing or modifying the state. Once this is
51
-
established, we just pass the request to S3 with the right parameters.
25
+
The state server is an HTTP endpoint implementing the Terraform [standard state management protocol](https://www.terraform.io/docs/backends/types/http.html){: rel="nofollow"}. Spacelift's backend always ensures:
52
26
53
-
## State history
27
+
- The credentials belong to one of the runs or tasks that are currently marked as active on our end.
28
+
- Their state indicates that they should be accessing or modifying the state.
54
29
55
-
30
+
Once this is established, we pass the request to S3 with the right parameters.
56
31
57
-
If your state is managed by spacelift, you can list all the changes on your state, and eventually rollback to an old
58
-
version if needed.
32
+
## State history
59
33
60
-
34
+
You can view your stack's state history in Spacelift. Navigate to _Ship Infra_ > _Stacks_, click the name of the stack you want to view the history of, and view the **State history** tab. You'll see a list all the changes to your state and can rollback to an old version if needed.
61
35
62
-
!!! info
63
-
Not all runs or tasks will trigger a new state version, so you should not expect to see an exhaustive list of your runs
64
-
and tasks in this list.
65
-
For example runs that produce no Terraform changes do not result in a new state version being created.
36
+
37
+
38
+
Not all runs or tasks will trigger a new state version, so you should not expect to see an exhaustive list of your runs and tasks in this list. For example, runs that produce no Terraform changes do not result in a new state version being created.
66
39
67
40
Non-current state versions are kept for **30 days**.
68
41
69
42
### State rollback
70
43
71
-
In certain unusual scenarios you can end up with a broken or corrupted state being created. This could happen for
72
-
example if there was a bug during a Terraform provider upgrade.
73
-
74
-
State rollback allows you to recover from this by rolling back your state to a previous version.
44
+
Although it's rare, you can sometimes end up with a broken or corrupted state, such as when a bug exists in a Terraform provider upgrade. State rollback allows you to recover from this by rolling back your state to a previous version.
75
45
76
-
Rolling back your state will **not apply any changes to your current infrastructure**. It just reverts your state to an
77
-
older version.
78
-
It's up to you to trigger the proper tasks or runs to fix the state and re-apply the desired Terraform configuration.
46
+
Rolling back your state **will not apply any changes** to your current infrastructure. It just reverts your state to an older version. You must then trigger the proper tasks or runs to fix the state and re-apply the desired Terraform configuration.
79
47
80
48
!!! warning
81
-
You should really understand what you are doing when performing a rollback.
82
49
83
-
State rollback should be used as a break-glass operation just after a corrupted state has been created.
50
+
State rollback should only be used as a break-glass operation just after a corrupted state has been created.
84
51
85
52
If a stack is currently using a rolled-back state, a warning will be shown in the stack header.
86
53
87
-
54
+
88
55
89
-
To be able to roll back a state, the 3 conditions below must be satisfied:
56
+
To roll back a state, these conditions must be satisfied:
90
57
91
-
- You must be a stack admin
92
-
- The stack must be locked
93
-
- The stack must not have any pending runs or tasks
58
+
- You must be a stack admin.
59
+
- The stack must be locked.
60
+
- The stack must not have any pending runs or tasks.
94
61
95
62
If those three conditions are met, you will be able to rollback your stack to a previous version of your state file.
After rollback completes successfully, a new version of your state will appear above the other state versions and will be marked as a rollback.
100
67
101
-
102
-
103
-
## Importing resources into your Terraform State
104
-
105
-
So you have an existing resource that was created by other means and would like that resource to be reflected in your
106
-
terraform state. This is an excellent use case for the [terraform import](https://www.terraform.io/cli/import){: rel="nofollow"}
107
-
command. When you're managing your own terraform state, you would typically run this command locally to
108
-
import said resource(s) to your state file, but what do I do when I'm using Spacelift-managed state you might ask?
109
-
Spacelift [Task](../../concepts/run/task.md) to the rescue!
110
-
111
-
To do this, use the following steps:
68
+
112
69
113
-
- Select the Spacelift Stack to which you would like to import state for.
114
-
- Within the navigation, select "Tasks"
70
+
## Importing resources into your Terraform state
115
71
116
-
72
+
If you have an existing resource that was created by other means, and would like that resource to be reflected in your Terraform state, you need to use the [Terraform import](https://www.terraform.io/cli/import){: rel="nofollow"} command. When managing your own Terraform state, you would typically run this command locally to import said resource(s) to your state file.
117
73
118
-
- Run the `terraform import` command needed to import your state file to the Spacelift-managed state by typing the
119
-
command into the text input and clicking the perform button. Note: If you are using Terragrunt on Spacelift, you will
120
-
need to run `terragrunt import`
74
+
When Spacelift is managing your Terraform state, you can import resources with [tasks](../../concepts/run/task.md):
121
75
122
-
76
+
1. Select the Spacelift stack to which you would like to import state for.
77
+
2. Navigate to the **Tasks** tab.
78
+
3. Run the `terraform import` command needed to import your resourcesc by type the `terraform import` command into the text input and click **Perform**.
79
+
80
+
- If you are using Terragrunt on Spacelift, you will need to run `terragrunt import`.
81
+
4. Follow the status of your task's execution to ensure it was executed successfully. When completed, you should see an output like this within the "Performing" step of the task.
82
+
123
83
124
-
- Follow the status of your task's execution to ensure it was executed successfully. When completed, you should see an
125
-
output similar to the following within the "Performing" step of your task.
126
-
127
-
128
-
129
-
## Importing existing state file into your Terraform Stacks
84
+
## Importing existing state file into your Terraform stacks
130
85
131
86
### On an existing stack
132
87
133
-
State import allows you to import a state on top of the latest managed state.
134
-
135
-
!!! warning
136
-
137
-
You should really understand what you are doing when importing a state.
138
-
139
-
To be able to import a state, the 3 conditions below must be satisfied:
88
+
State import allows you to import a state on top of the latest managed state. To be able to import a state, these conditions must be satisfied:
140
89
141
-
- You must be a stack admin
142
-
- The stack must be locked
143
-
- The stack must not have any pending runs or tasks
144
-
145
-
To import a new state you need to go to the state history tab on your stack, and then click on the button to import the state.
If you enable [external state access](external-state-access.md), you can export the stack's state from outside of Spacelift.
191
135
192
-
If a Terraform stack's state is managed by Spacelift and you need to export it you can do so by running the following
193
-
command in a [Task](../../concepts/run/task.md#performing-a-task):
136
+
If a Terraform stack's state is managed by Spacelift and you need to export it, you can run this command in a [task](../../concepts/run/task.md#performing-a-task):
194
137
195
138
```shell
196
139
terraform state pull > terraform.tfstate
197
140
```
198
141
199
-
The local workspace is discarded after the Task has finished so you most likely want to combine this command with
200
-
another one that pushes the `terraform.tfstate` file to some remote location.
201
-
202
-
Here is an example of pushing the state file to an AWS S3 bucket (without using an intermediary file):
142
+
The local workspace is discarded after the task has finished, so you most likely want to combine it with another one that pushes the `terraform.tfstate` file to a remote location. Here is an example of pushing the state file to an AWS S3 bucket (without using an intermediary file):
203
143
204
144
```shell
205
145
terraform state pull | aws s3 cp - s3://example-bucket/folder/sub-folder/terraform.tfstate
206
146
```
207
147
208
-
### Configure terraform plan locking
148
+
### Configure Terraform plan locking
149
+
150
+
By default, `terraform plan` acquires a state lock. If you want to disable such lock during planning, you can pass `SPACELIFT_DISABLE_STATE_LOCK` to the stack _Environment_.
209
151
210
-
By default `terraform plan` acquires a state lock. If you want to disable such lock during planning,
211
-
you can pass `SPACELIFT_DISABLE_STATE_LOCK` to the stack _Environment_.
0 commit comments