Run Terraform in HCP Terraform — Terraform Hoofdstuk 11

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Workspaces, projecten, runs, policies en VCS-integratie

Connect a configuration to HCP Terraform

The cloud block (instead of backend) links the folder to an organisation and workspace.

cloud.tf

terraform {
  cloud {
    organization = "s0sta"
    workspaces {
      name = "shop-prod"
    }
  }
}

$terraform login
$terraform init
$terraform plan

With the CLI-driven workflow, plan and apply still start on your machine but run remotely, with the variables and credentials stored in the workspace.

11.2

Organise workspaces and projects

A workspace = one state + its variables + its runs (usually one environment of one component). Projects group workspaces and their access.

Level	Example
Organisation	`s0sta`
Project	`shop` (team access is set here)
Workspace	`shop-network-prod`, `shop-app-prod`, `shop-app-dev`

Onthoud

HCP Terraform workspaces are not the same as CLI workspaces (terraform workspace new). CLI workspaces only keep several states in one backend.

11.3

Choose a run workflow

Three ways to start runs.

Workflow	Runs start when
VCS-driven	A commit or pull request in the linked Git repository (speculative plan on PRs)
CLI-driven	You run `terraform plan/apply` locally
API-driven	A pipeline calls the API

11.4

Use the collaboration and governance features

HCP Terraform adds team controls around runs.

Variables and variable sets: Terraform and environment variables, sensitive ones hidden; one set shared by many workspaces.
Teams and permissions: who may plan, apply, or manage a workspace or project.
Private registry: share approved modules and providers in the organisation.
Policy as code (Sentinel or OPA): checks between plan and apply — "no public IPs", "only these VM sizes", "tags required".
Run tasks: call external tools (security scan, cost check) during a run.
Drift detection and health checks: find changes made outside Terraform.
Audit trail: every run, who approved it, and its plan.

11.5

Integrate with other tools

Link HCP Terraform to Git, to clouds without static keys, and to notifications.

VCS providers: GitHub, GitLab, Azure DevOps, Bitbucket.
Dynamic provider credentials: OIDC trust between HCP Terraform and Azure/AWS/GCP — no stored cloud keys.
Notifications: Slack, Teams, email or webhooks on run events.
**API and the tfe provider**: manage workspaces themselves as code.

Examentip

Know which features are in which tier only roughly; know well what each feature does and where it is configured (organisation, project or workspace).

Alle commando's in dit hoofdstuk

terraform