Terraform module — variable, output, reuse আর environment

locals {
  full_name = "${var.name}-${var.environment}"
  labels = {
    app = local.full_name
    env = var.environment
  }
}

resource "kubernetes_deployment_v1" "app" {
  metadata {
    name      = local.full_name
    namespace = var.namespace
    labels    = local.labels
  }

  spec {
    replicas = var.replicas

    selector {
      match_labels = local.labels
    }

    template {
      metadata {
        labels = local.labels
      }

      spec {
        container {
          name  = "web"
          image = var.image

          resources {
            requests = { cpu = "10m", memory = "16Mi" }
            limits   = { memory = var.memory_limit }
          }
        }
      }
    }
  }
}

resource "kubernetes_service_v1" "app" {
  metadata {
    name      = local.full_name
    namespace = var.namespace
    labels    = local.labels
  }

  spec {
    type     = var.service_type
    selector = local.labels

    port {
      port        = 80
      target_port = 80
    }
  }
}

output "service_name" {
  value       = kubernetes_service_v1.app.metadata[0].name
  description = "Service name."
}

output "service_url" {
  value       = "http://${kubernetes_service_v1.app.metadata[0].name}.${var.namespace}.svc.cluster.local"
  description = "In-cluster URL."
}

output "cluster_ip" {
  value       = kubernetes_service_v1.app.spec[0].cluster_ip
  description = "Virtual IP of the Service, known only after apply."
}

module "web_dev" {
  source = "../modules/web-app"

  name        = "shop"
  environment = "dev"
  namespace   = "abcl-tm"
  image       = "nginx:1.27-alpine"
}

module "web_prod" {
  source = "../modules/web-app"

  name         = "shop"
  environment  = "prod"
  namespace    = "abcl-tm"
  image        = "nginx:1.27-alpine"
  replicas     = 3
  memory_limit = "64Mi"
}

$ terraform apply tfplan
module.web_prod.kubernetes_service_v1.app: Creation complete after 0s [id=abcl-tm/shop-prod]
module.web_dev.kubernetes_service_v1.app: Creation complete after 0s [id=abcl-tm/shop-dev]
module.web_dev.kubernetes_deployment_v1.app: Creation complete after 4s [id=abcl-tm/shop-dev]
module.web_prod.kubernetes_deployment_v1.app: Creation complete after 4s [id=abcl-tm/shop-prod]

Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

Outputs:

dev_url = "http://shop-dev.abcl-tm.svc.cluster.local"
prod_url = "http://shop-prod.abcl-tm.svc.cluster.local"

$ kubectl -n abcl-tm get deploy
NAME        READY   UP-TO-DATE   AVAILABLE   AGE
shop-dev    1/1     1            1           4s
shop-prod   3/3     3            3           4s

variable "environment" {
  type        = string
  description = "One of dev, staging, prod."

  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "environment must be dev, staging or prod."
  }
}

variable "image" {
  type        = string
  description = "Container image with a fixed tag."

  validation {
    condition     = !endswith(var.image, ":latest") && strcontains(var.image, ":")
    error_message = "image must carry a fixed tag, not latest."
  }
}

variable "replicas" {
  type        = number
  default     = 1
  description = "Number of pods."

  validation {
    condition     = var.replicas >= 1 && var.replicas <= 6
    error_message = "replicas must be between 1 and 6."
  }
}

$ cat main.tf
module "web" {
  source = "../modules/web-app"

  name        = "shop"
  environment = "production"
  namespace   = "abcl-tm"
  image       = "nginx:latest"
  replicas    = 20
}

$ terraform plan

Error: Invalid value for variable

  on main.tf line 5, in module "web":
   5:   environment = "production"
    ├────────────────
    │ var.environment is "production"

environment must be dev, staging or prod.

This was checked by the validation rule at
..\modules\web-app\variables.tf:10,3-13.

Error: Invalid value for variable

  on main.tf line 7, in module "web":
   7:   image       = "nginx:latest"
    ├────────────────
    │ var.image is "nginx:latest"

image must carry a fixed tag, not latest.
…
Error: Invalid value for variable

  on main.tf line 8, in module "web":
   8:   replicas    = 20
    ├────────────────
    │ var.replicas is 20

replicas must be between 1 and 6.
…

// Module input resolver: required, default, override, type, validation.
const schema = {
  name: { type: "string" },
  environment: { type: "string", check: v => ["dev", "staging", "prod"].includes(v),
    msg: "environment must be dev, staging or prod" },
  image: { type: "string", check: v => v.includes(":") && !v.endsWith(":latest"),
    msg: "image must carry a fixed tag, not latest" },
  replicas: { type: "number", default: 1, check: v => v >= 1 && v <= 6,
    msg: "replicas must be between 1 and 6" },
  memory_limit: { type: "string", default: "32Mi" },
};
function resolve(call) {
  const out = [], errors = [];
  for (const key in call) if (!(key in schema)) errors.push(`unsupported argument "${key}"`);
  for (const [key, s] of Object.entries(schema)) {
    const given = key in call;
    if (!given && !("default" in s)) { errors.push(`missing required "${key}"`); continue; }
    const value = given ? call[key] : s.default;
    if (typeof value !== s.type) { errors.push(`${key}: expected ${s.type}`); continue; }
    if (s.check && !s.check(value)) errors.push(s.msg);
    out.push(`${key}=${value} (${given ? "caller" : "default"})`);
  }
  return { out, errors };
}
const base = { name: "shop", image: "nginx:1.27-alpine" };
const calls = {
  dev: { ...base, environment: "dev" },
  prod: { ...base, environment: "prod", replicas: 3, memory_limit: "64Mi" },
  typo: { ...base, environment: "prod", replica: 3 },
  bad: { name: "shop", environment: "production", image: "nginx:latest", replicas: 20 },
};
for (const [label, call] of Object.entries(calls)) {
  const { out, errors } = resolve(call);
  console.log(`--- ${label}: ${errors.length ? "REJECTED" : "ok"}\n  ` + (errors.length ? errors : out).join("\n  "));
}

variable "scaling" {
  type = object({
    min = number
    max = optional(number, 6)
  })
  default = { min = 1 }
}

locals {
  environments = {
    dev  = { replicas = 1, memory_limit = "32Mi" }
    prod = { replicas = 3, memory_limit = "64Mi" }
  }
}

module "web" {
  source   = "../modules/web-app"
  for_each = local.environments

  name         = "shop"
  environment  = each.key
  namespace    = "abcl-tm"
  image        = "nginx:1.27-alpine"
  replicas     = each.value.replicas
  memory_limit = each.value.memory_limit
}

output "urls" {
  value = { for env, app in module.web : env => app.service_url }
}

$ terraform state list
module.web["dev"].kubernetes_deployment_v1.app
module.web["dev"].kubernetes_service_v1.app
module.web["prod"].kubernetes_deployment_v1.app
module.web["prod"].kubernetes_service_v1.app

# map-এ staging = { replicas = 2, memory_limit = "32Mi" } যোগ করার পরে
$ terraform plan
  # module.web["staging"].kubernetes_deployment_v1.app will be created
  # module.web["staging"].kubernetes_service_v1.app will be created
Plan: 2 to add, 0 to change, 0 to destroy.

# 1. Local path: same repository, no version of its own
module "web_local" {
  source = "../modules/web-app"
  # ...
}

# 2. Git: an exact tag (or a commit id) after ?ref=
module "web_git" {
  source = "git::https://example.com/platform/tf-modules.git//web-app?ref=v2.0.1"
  # ...
}

# 3. Registry: namespace/name/provider, with a version constraint
module "web_registry" {
  source  = "example-org/web-app/kubernetes"
  version = "~> 1.4"
  # ...
}

$ terraform init
Initializing modules...
Downloading git::file:///…?ref=v1.0.0 for web...
- web in .terraform\modules\web\web-app
…
$ ls .terraform/modules
modules.json  web

infra/
├── modules/
│   └── web-app/        # child module
└── envs/
    ├── dev/            # root module, own state
    │   ├── main.tf
    │   └── versions.tf
    └── prod/           # root module, own state
        ├── main.tf
        └── versions.tf

$ find . -name '*.tfstate'
./dev/terraform.tfstate
./prod/terraform.tfstate

$ diff -u dev/main.tf prod/main.tf
…
-  name        = "shop"
-  environment = "dev"
-  namespace   = "abcl-tm"
-  image       = "nginx:1.27-alpine"
+  name         = "shop"
+  environment  = "prod"
+  namespace    = "abcl-tm"
+  image        = "nginx:1.27-alpine"
+  replicas     = 3
+  memory_limit = "64Mi"
 }

variable "replicas" {
  type = number
}

variable "memory_limit" {
  type = string
}

module "web" {
  source = "../modules/web-app"

  name         = "shop"
  environment  = terraform.workspace
  namespace    = "abcl-tm"
  image        = "nginx:1.27-alpine"
  replicas     = var.replicas
  memory_limit = var.memory_limit
}

$ terraform workspace show
default
$ terraform workspace new dev
Created and switched to workspace "dev"!
…
$ terraform apply -var-file=dev.tfvars
…
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
$ terraform workspace new prod
Created and switched to workspace "prod"!
…
$ terraform apply -var-file=prod.tfvars
…
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
$ terraform workspace list
  default
  dev
* prod

$ find . -name '*.tfstate'
./terraform.tfstate.d/dev/terraform.tfstate
./terraform.tfstate.d/prod/terraform.tfstate

variable "env_of_tfvars" {
  type        = string
  description = "Which environment this tfvars file belongs to."

  validation {
    condition     = var.env_of_tfvars == terraform.workspace
    error_message = "tfvars file does not match the selected workspace."
  }
}

$ terraform workspace show
prod
$ terraform plan -var-file=dev.tfvars

Error: Invalid value for variable

  on dev.tfvars line 3:
   3: env_of_tfvars = "dev"
    ├────────────────
    │ terraform.workspace is "prod"
    │ var.env_of_tfvars is "dev"

tfvars file does not match the selected workspace.

This was checked by the validation rule at guard.tf:5,3-13.

// Environment diff: which dev/prod differences are planned, which are a surprise?
const dev = { module_version: "2.0.1", image: "shop:1.8.2", replicas: 1,
  memory_limit: "32Mi", db_size: "small", multi_az: false,
  public_db: false, log_days: 7 };
const prod = { module_version: "1.9.0", image: "shop:1.8.2", replicas: 3,
  memory_limit: "64Mi", db_size: "large", multi_az: true,
  public_db: true, log_days: 90 };
// Sizing may differ on purpose. Everything else must match or follow a rule.
const sizing = new Set(["replicas", "memory_limit", "db_size", "multi_az", "log_days"]);
const rules = { public_db: v => v === false };
let same = 0, planned = 0, surprises = [];
for (const key of Object.keys(dev)) {
  const a = dev[key], b = prod[key];
  const broken = rules[key] && !(rules[key](a) && rules[key](b));
  if (a === b && !broken) { same++; continue; }
  let kind = "planned";
  if (broken) kind = "RULE BROKEN";
  else if (!sizing.has(key)) kind = "SURPRISE";
  if (kind === "planned") planned++; else surprises.push(key);
  console.log(`${key.padEnd(15)} ${String(a).padEnd(8)} ${String(b).padEnd(8)} ${kind}`);
}
console.log(`\nsame=${same} planned=${planned} to_review=${surprises.length}`);
console.log("review before apply: " + surprises.join(", "));

include "root" {
  path = find_in_parent_folders("root.hcl")
}

terraform {
  source = "../../modules/web-app"
}

inputs = {
  environment = "prod"
  replicas    = 3
}

module "api" {
  source = "../modules/web-app"

  name        = "api"
  environment = "dev"
  namespace   = "abcl-tm"
  image       = "nginx:1.27-alpine"
}

module "frontend_config" {
  source = "../modules/app-config"

  name        = "frontend"
  namespace   = "abcl-tm"
  api_address = module.api.cluster_ip
}

$ terraform apply -auto-approve
module.api.kubernetes_service_v1.app: Creating...
module.api.kubernetes_deployment_v1.app: Creating...
module.api.kubernetes_service_v1.app: Creation complete after 0s [id=abcl-tm/api-dev]
module.frontend_config.kubernetes_config_map_v1.this: Creating...
module.frontend_config.kubernetes_config_map_v1.this: Creation complete after 0s [id=abcl-tm/frontend-config]
module.api.kubernetes_deployment_v1.app: Creation complete after 1s [id=abcl-tm/api-dev]
Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

$ kubectl -n abcl-tm get configmap frontend-config -o jsonpath='{.data.API_ADDRESS}'
10.107.14.17
$ kubectl -n abcl-tm get svc api-dev
NAME      TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
api-dev   ClusterIP   10.107.14.17   <none>        80/TCP    2s

$ terraform graph | grep 'frontend_config.*api'
  "module.frontend_config.kubernetes_config_map_v1.this" -> "module.api.kubernetes_service_v1.app";

// Modules wired by outputs: find the apply order, spot a cycle.
function plan(mods) {
  const done = {}, order = [];
  const ready = m => m.needs.every(n => n.split(".")[0] in done);
  while (order.length < Object.keys(mods).length) {
    const next = Object.keys(mods).find(k => !(k in done) && ready(mods[k]));
    if (!next) {
      const stuck = Object.keys(mods).filter(k => !(k in done));
      return `CYCLE: cannot order ${stuck.join(", ")}`;
    }
    const inputs = mods[next].needs.map(n => {
      const [m, o] = n.split(".");
      return `${o}=${done[m][o]}`;
    });
    done[next] = mods[next].make();
    order.push(`${order.length + 1}. ${next}` +
      (inputs.length ? `  <- ${inputs.join(", ")}` : "  (no module inputs)"));
  }
  return order.join("\n");
}
const stack = {
  compute: { needs: ["network.subnet_id", "data.db_host"], make: () => ({ url: "http://app.example" }) },
  data:    { needs: ["network.subnet_id"], make: () => ({ db_host: "db-7.internal" }) },
  network: { needs: [], make: () => ({ subnet_id: "subnet-0a1" }) },
};
console.log("stack:\n" + plan(stack));
const loop = {
  ...stack,
  network: { needs: ["compute.url"], make: () => ({ subnet_id: "subnet-0a1" }) },
};
console.log("\nafter network starts reading compute.url:\n" + plan(loop));

module "network" {
  source     = "./modules/network"
  name       = "shop-prod"
  cidr_block = "10.20.0.0/16"
}

module "data" {
  source     = "./modules/data"
  name       = "shop-prod"
  subnet_ids = module.network.private_subnet_ids
  db_size    = "large"
}

module "compute" {
  source      = "./modules/compute"
  name        = "shop-prod"
  subnet_ids  = module.network.private_subnet_ids
  db_endpoint = module.data.endpoint
  min_size    = 3
}

# modules/network/main.tf (excerpt)
resource "aws_vpc" "this" {
  cidr_block = var.cidr_block
}

moved {
  from = kubernetes_deployment_v1.app
  to   = kubernetes_deployment_v1.this
}

moved {
  from = kubernetes_service_v1.app
  to   = kubernetes_service_v1.this
}

# moved ছাড়া: module.web_dev → module.web["dev"]
Plan: 4 to add, 0 to change, 4 to destroy.

# নিচের দুই block যোগ করার পরে
#   moved { from = module.web_dev   to = module.web["dev"] }
#   moved { from = module.web_prod  to = module.web["prod"] }
  # module.web_dev.kubernetes_deployment_v1.app has moved to module.web["dev"].kubernetes_deployment_v1.app
  …
Plan: 0 to add, 0 to change, 0 to destroy.

variable "replicas" {
  type        = number
  default     = null
  description = "Deprecated, use replica_count."
  deprecated  = "replicas is deprecated, use replica_count."
}

variable "replica_count" {
  type        = number
  default     = null
  description = "Number of pods."
}

locals {
  replicas = coalesce(var.replica_count, var.replicas, 1)
}

$ terraform validate
Warning: Deprecated variable got a value

  on main.tf line 3, in module "web":
   3:   replicas = 3

replicas is deprecated, use replica_count.
Success! The configuration is valid, but there were some validation warnings
as shown above.