feat: add tfstate_enabled toggle to gate module-managed state backend - #4
Merged
Merged
Conversation
Gates the module-managed Terraform state backend (resource group, storage account, container, deployer role assignment, and the optional tfstate private endpoint) behind var.tfstate_enabled (default true). Default true preserves the existing self-bootstrap pattern, so current consumers are unaffected. Set false when the backend lives in an external, pre-provisioned storage account (e.g. a central bootstrap layer) — this avoids an orphaned tfstate storage account per workload. The shared random_string.storage_suffix (in main.tf) is untouched, so Key Vault / Velero / cost-export / ACR names do not change when disabled. Dependent satellites (resource lock, blob diagnostic settings, and the tfstate_storage_account_name output) are gated/one()-guarded accordingly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
var.tfstate_enabled(defaulttrue) to gate the module-managed Terraform state backend, so a workload can point its backend at an external, pre-provisioned storage account (e.g. a central bootstrap layer) instead of always creating its own — eliminating an orphaned tfstate storage account per cluster.Motivation
When a downstream repo sets its
backend "azurerm"to a pre-declared container in a shared bootstrap storage account, the module still created its ownrg-<base>-tfstate+ storage account + container unconditionally (no toggle existed up to v3.4.1). That storage account was never used as a backend and sat orphaned. This adds the missing switch.Changes
var.tfstate_enabled(bool, defaulttrue).tfstate.tf:countonazurerm_resource_group.tfstate,azurerm_storage_account.tfstate,azurerm_storage_container.tfstate,azurerm_role_assignment.tfstate_deployer; internal refs indexed[0]. The tfstate private endpoint now requirestfstate_enabled && tfstate_private_endpoint_enabled.locks.tf,diagnostics.tf: the SA's own lock + two blob diagnostic settings gated with&& var.tfstate_enabled; refs indexed[0].outputs.tf:tfstate_storage_account_name→one(azurerm_storage_account.tfstate[*].name)(null when disabled).CHANGELOG.md:[3.5.0].Backward compatibility
Default
true→ no change for existing consumers.random_string.storage_suffixlives inmain.tfand is untouched, so Key Vault / Velero / cost-export / ACR names are unchanged when the toggle is off.Validation
terraform fmt -check -recursive→ exit 0terraform init -backend=false→ okterraform validate→ Success! The configuration is valid.