Production deployment: CICD pipelines

[crileroro]

First of all, thanks for this great tool. I've been trying it out and like all functionalities!
Secondly, I would like to know some best practices to deploy from test -> production using terramate in a CICD pipeline (Github Actions).

Roughly, my monorepo is as follows (very standard):

|- AWS
  |-- prod
     |-- network
          - main.tf
          -  stack.tm.hcl
     |-- databases
          - main.tf
          -  stack.tm.hcl
  |-- test
     |-- network
          - main.tf
          -  stack.tm.hcl
     |-- databases
          - main.tf
          -  stack.tm.hcl
|- helper
  |- network.tm.hcl 

I have 2 accounts: test and production. Let's assume that in the stacks network I have an import function that imports the creation of the main.tf file from the helper network.tm.hcl. If I change something in that helper file and do terramate generate, it will modify the content of the main.tf in both test and prod environments. If I want to apply these changes, I do terramate run --changed -- terraform apply -input=false -auto-approve. I can use in the stacks the before/after functionality so that prod is run just after test. Here is my situation: I would like to run test, check that my change is good in that environment, and just after that run the change in prod.

I am not using terraform modules so I can't make use of globals to update first test and later prod in a different PR. Do you have any best practice/advice on how I can achieve my goal using Terramate in CICD pipelines?

Thanks!

[soerenmartius]

Hi @crileroro,

Thanks for reaching out! We have some content scheduled over the next few weeks to further elaborate on CI/CD. However, I will discuss your use-case with the team and get back to you with an example GitHub Actions in a little bit!

[crileroro]

Thanks @soerenmartius! In the meantime, I have been looking into some examples and Terramate functionalities without getting a good answer for my use case.
To give a bit more context, if different stacks are importing the same generated file using the Terramate import functionality, and a change happens inside the generate_hcl block of the imported file, terramate generate will affect at the same time all stacks importing the mentioned file. This could affect drastically the deployment workflow up to production. Unfortunately, I could not find a way to filter stacks or similar when using terramate generate (something along the lines of terramate generate --tags test).
Another approach is to avoid the use of import, copy the same content in different stacks (test, prod) and control the deployment by changing the content in test and then in prod. However, this approach is suboptimal as it totally defeats one of the great features and purposes of Terramate: being DRY.
I was wondering what is the best approach in Terramate for this standard use case, or how you guys handle this.

[macalac]

If it were me, I would be using the pipeline steps:

• plan-test
• deploy-to-test
• plan-staging
• deploy-to-staging
• plan-prod
• deploy-to-prod

And each would do terramate run --changed --tags=ENV.

Have you tried that? Would be interested to hear what other solutions people have.