Pulling in private terraform modules during porter build

[obowersa]

Hey folk,

We're beginning to evaluate moving over to porter, but we've got a use case which I'm not sure how best to address.

The intent is to make use of porter internally. One of our requirements is the ability to pull in terraform modules from a private git repo as part of the porter build. At the moment we make use of an SSH key + the ssh terraform module reference.

As part of the porter dockerfile template, I'm struggling to figure out how to achieve this in a way which doesn't involve storing the SSH key within the git repo and without storing the key within the built image.

With pure docker I'd probably pass it through as a build arg and use a multistage build, only publishing the final image.

Wondering if anyone has any tips/suggestions on how to achieve something similar.

[carolynvs]

Hey @obowersa, in the v1 alpha of Porter we now have support for Docker buildkit. You should be able to use a ssh mount to load your private repos and then perform any additional steps in a custom dockerfile for porter.

[obowersa]

Thanks @carolynvs , that did the trick.

Something I was wondering is if my initial approach could end up being a bit of an anti-pattern. Essentially the line between using terraform to pull in the modules or modelling the modules as a CNAB then using them as dependencies. Might make more sense for our use case the more I think about it as we have various post TF steps for some of the modules which need run.

Either way, thanks for the info! Gonna have a play around and see what works out best.

[carolynvs]

If you would like immutable bundles, where the bundle will still work even when external resources are unavailable, then building the terraform modules into the bundle during build is the recommended approach. Not everyone cares about their bundle grabbing external resources just in time, so it's a "whatever works for you" situation.