stok

Stok

Supercharge Terraform On Kubernetes (or more accurately, a poor man's Terraform Enterprise)

Requirements

• A kubernetes cluster

Install

Download and install the CLI from releases.

Deploy CRDs and the operator to your cluster:

stok generate crds | kubectl create -f -
stok generate operator | kubectl apply -f -

First run

Ensure you're in a directory containing terraform configuration:

$ cat random.tf
resource "random_id" "test" {
  byte_length = 2
}

Create a workspace:

stok workspace new default/default

Run terraform commands:

stok init
stok validate
stok plan
stok apply

Usage

Usage is similar to the terraform CLI:

Usage: stok [command]

Terraform Commands:
  apply		destroy		force-unlock
  get		import		init
  output	plan		refresh
  show		state		taint
  untaint	validate	

Stok Commands:
  generate     Generate deployment resources
  sh           Run shell commands in workspace
  workspace    Stok workspace management

Flags:
      --debug     Enable debug logging
  -h, --help      help for stok
  -v, --version   version for stok

Use "stok [command] --help" for more information about a command.

Commands such as terraform fmt or terraform console have been left out because there is no purpose to running them on kubernetes.

RBAC

TODO

Identity

• GCP Workload Identity
• AWS IAM roles for service accounts

Credentials

Place any credentials inside a kubernetes secret named stok. For example, to set credentials for the AWS provider:

kubectl create secret generic stok \
  --from-literal=AWS_ACCESS_KEY_ID="youraccesskeyid"  \
  --from-literal=AWS_SECRET_ACCESS_KEY="yoursecretaccesskey"

AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are then made available as environment variables.

Specific support is provided for the GCP provider. The environment variable GOOGLE_APPLICATION_CREDENTIALS is set to the file google-credentials.json. To populate that file, create a secret like so:

kubectl create secret generic stok --from-file=google-credentials.json=[path to service account key]