tfwrapper 0.5.0 → 0.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 73a99a40047a490174b186e5bf5c6b58dedea114
-  data.tar.gz: f64131d4e1a68fae63dc3b86465b64480a3edae3
+SHA256:
+  metadata.gz: d800160edbaa04ea415c64a6153496bc11ac26134f37cdec619ad79f1ac790f7
+  data.tar.gz: 3052aaa38b88c2faaebbbe3e924d693eb2acfed70ed5ea9f201bd1eeebbe8921
 SHA512:
-  metadata.gz: 7e3d6202be5a238dc9a358ed190aa6debbef62e5f56cac5b365935afe407a700e46a3166e24af34640f00a21667dd34adec292bb1c7125fe82129da98eefeeed
-  data.tar.gz: 1b4b83ca1147ae1955d3e571e087467f792db7107b76c2d9f421ff9fd37dd4512860ca719b32a7fd8b56e8861b1785ff45b439eea01faa454e4169b0dd1b040c
+  metadata.gz: 2927add435fcb35ff775884b748a5c1e2ab3c5ae8ab3766dd53c32cae56dcbaba33c80d7d5e39a94133bdad9bb822c32a81bc2c58627872e795fd818c5e151fa
+  data.tar.gz: 2510df4efa55b5f7c304c073afea722ef85a22218c8ad8b6374a4c2f8ca5d903de926be3a4218f7c49e4c6c1a51b05a5c40197f602e8b370e7a4dc4087428245

data/.rubocop.yml

@@ -5,7 +5,7 @@ Metrics/AbcSize:
   Max: 50
 
 Metrics/BlockLength:
-  Max: 1400
+  Max: 1500
 
 Metrics/ClassLength:
   Max: 500

data/.travis.yml

@@ -0,0 +1,62 @@
+---
+dist: xenial
+language: ruby
+cache: bundler
+before_install:
+  - gem uninstall -v '>= 2' -i $(rvm gemdir)@global -ax bundler || true
+  - gem install bundler -v '< 2'
+install: true
+matrix:
+  include:
+  - rvm: ruby
+    install: bundle install --without landscape
+    script: ["bundle exec ruby --version", "bundle exec rake spec:unit"]
+    name: "ruby-latest unit"
+  - rvm: ruby
+    install: bundle install --without landscape
+    script: bundle exec rake rubocop
+    name: "ruby-latest rubocop"
+  - rvm: ruby
+    install: bundle install --without landscape
+    script: bundle exec rake yard:generate
+    name: "ruby-latest yard"
+  - rvm: 2.0
+    install: bundle install --without landscape
+    script: bundle exec rake spec:unit
+    name: "ruby-2.0 unit"
+  - rvm: 2.1
+    install: bundle install --without landscape
+    script: bundle exec rake spec:unit
+    name: "ruby-2.1 unit"
+  - rvm: 2.2
+    install: bundle install --without landscape
+    script: bundle exec rake spec:unit
+    name: "ruby-2.2 unit"
+  - rvm: 2.3
+    install: bundle install --without landscape
+    script: bundle exec rake spec:unit
+    name: "ruby-2.3 unit"
+  - rvm: 2.3
+    install: bundle install
+    script: bundle exec rake spec:acceptance TF_VERSION=0.10.0
+    name: "ruby-2.3 acceptance TF 0.10.0"
+  - rvm: 2.3
+    install: bundle install
+    script: bundle exec rake spec:acceptance TF_VERSION=0.10.2
+    name: "ruby-2.3 acceptance TF 0.10.2"
+  - rvm: 2.3
+    install: bundle install
+    script: bundle exec rake spec:acceptance TF_VERSION=0.11.2
+    name: "ruby-2.3 acceptance TF 0.11.2"
+  - rvm: 2.3
+    install: bundle install
+    script: bundle exec rake spec:acceptance TF_VERSION=0.11.14
+    name: "ruby-2.3 acceptance TF 0.11.14"
+  - rvm: 2.4
+    install: bundle install
+    script: bundle exec rake spec:unit
+    name: "ruby-2.4 unit"
+  - rvm: 2.4
+    install: bundle install
+    script: bundle exec rake spec:acceptance TF_VERSION=0.11.14
+    name: "ruby-2.4 acceptance TF 0.11.14"

data/ChangeLog.md

@@ -1,3 +1,33 @@
+Version 0.6.3
+
+  - Fix bug with ``tf_sensitive_vars``. Prevent values from being printed in ``update_consul_stack_env_vars``.
+
+Version 0.6.2
+
+  - Add ``tf_sensitive_vars`` option.
+
+Version 0.6.1
+
+  - Add ``allowed_empty_vars`` option.
+  - Only support terraform up to 0.11.14.
+
+Version 0.6.0
+
+  - Include full terraform output when a terraform run fails with output including ``hrottling``, ``status code: 403``, or ``status code: 401``. Previously terraform output was suppressed in these cases, which causes confusion with providers other than "aws" that include these strings in their failure output.
+  - In ``Gemfile``, for testing, pin terraform-landscape gem to 0.2.2 for Ruby 2.x compatibility.
+  - Pin ``rb-inotify`` dependency to 0.9.10 to allow build with Ruby < 2.2
+  - Switch testing from circleci.com to travis-ci.org
+  - Pin terraform_landscape dependency to 0.2.2 for compatibility with ruby < 2.5
+  - Acceptance tests:
+    - Use HashiCorp checkpoint API instead of GitHub Releases API to find latest terraform version, to work around query failures
+    - Pin consul provider versions to 1.0.0 to fix intermittent failures
+  - Switch Ruby versions used in tests to latest TravisCI versions
+  - Stop acceptance testing terraform 0.9.x, as newer versions require pinning the consul provider version but 0.9 doesn't support versioned providers.
+
+Version 0.5.1
+
+  - Fix bug where terraform plan errors were suppressed if a plan run with landscape support enabled exited non-zero.
+
 Version 0.5.0
 
   - Add support for using terraform_landscape gem, if present, to reformat plan output; see README for usage.

data/Gemfile

@@ -4,5 +4,5 @@ source 'https://rubygems.org'
 gemspec
 
 group :landscape do
-  gem 'terraform_landscape'
+  gem 'terraform_landscape', '0.2.2'
 end

data/README.md

@@ -1,10 +1,10 @@
 # tfwrapper
 
-Build of master branch: [![CircleCI](https://circleci.com/gh/manheim/tfwrapper.svg?style=svg)](https://circleci.com/gh/manheim/tfwrapper)
+Build of master branch: [![TravisCI](https://api.travis-ci.org/manheim/tfwrapper.svg?branch=master)](https://travis-ci.org/manheim/tfwrapper)
 
 Documentation: [http://www.rubydoc.info/gems/tfwrapper/](http://www.rubydoc.info/gems/tfwrapper/)
 
-tfwrapper provides Rake tasks for working with [Hashicorp Terraform](https://www.terraform.io/) 0.9+, ensuring proper initialization and passing in variables from the environment or Ruby, as well as optionally pushing some information to Consul. tfwrapper also attempts to detect and retry
+tfwrapper provides Rake tasks for working with [Hashicorp Terraform](https://www.terraform.io/) 0.9 through 0.11, ensuring proper initialization and passing in variables from the environment or Ruby, as well as optionally pushing some information to Consul. tfwrapper also attempts to detect and retry
 failed runs due to AWS throttling or access denied errors.
 
 ## Overview
@@ -44,12 +44,12 @@ with 1.9.3 is simply too high to justify.
 Add to your ``Gemfile``:
 
 ```ruby
-gem 'tfwrapper', '~> 0.5.0'
+gem 'tfwrapper', '~> 0.6.1'
 ```
 
 ### Supported Terraform Versions
 
-tfwrapper only supports terraform 0.9+. It is tested against multiple versions from 0.9.2 to 0.10.2 and the current release.
+tfwrapper only supports terraform 0.9-0.11. It is tested against multiple versions from 0.9.2 to 0.11.14.
 
 ### Terraform Landscape
 
@@ -147,6 +147,10 @@ TFWrapper::RakeTasks.install_tasks(
 )
 ```
 
+These variables are tested to be set in the environment with a non-empty value, and will raise an error if any are
+missing or empty. If some should be allowed to be missing or empty empty, pass a ``allowed_empty_vars`` list with
+their environment variable names.
+
 ### Ruby Variables to Terraform Variables
 
 If you wish to explicitly bind values from your Ruby code to terraform variables, you can do this with
@@ -326,6 +330,26 @@ $ consul kv get terraform/inputs/foo
 {"FOO":"one", "BAR":"two"}
 ```
 
+### Sensitive Environment Variables
+If you wish for certain variables to be marked as "redacted", use the ``tf_sensitive_vars`` option. This is an array of variables that will not be printed.
+
+Note: ``aws_access_key`` and ``aws_secret_key`` will always be redacted without requiring configuration.
+
+
+Example to redact the vaule for ``secret``:
+
+Rakefile:
+
+```ruby
+require 'tfwrapper/raketasks'
+
+TFWrapper::RakeTasks.install_tasks(
+  '.',
+  tf_vars_from_env: {'foo' => 'FOO', 'bar' => 'BAR', 'secret' => 'SECRET'},
+  tf_sensitive_vars: ['secret']
+)
+```
+
 ## Development
 
 1. ``bundle install --path vendor``

data/lib/tfwrapper/helpers.rb

@@ -78,9 +78,12 @@ module TFWrapper
     # non-empty. Raise StandardError if any aren't.
     #
     # @param required [Array] list of required environment variables
-    def self.check_env_vars(required)
+    # @param allowed_missing [Array] list of environment variables to allow to
+    #  be empty or missing.
+    def self.check_env_vars(required, allowed_missing)
       missing = []
       required.each do |name|
+        next if allowed_missing.include?(name)
         if !ENV.include?(name)
           puts "ERROR: Environment variable '#{name}' must be set."
           missing << name

data/lib/tfwrapper/raketasks.rb

@@ -55,8 +55,12 @@ module TFWrapper
     #   configurations in the same Rakefile.
     # @option opts [Hash] :tf_vars_from_env hash of Terraform variables to the
     #   (required) environment variables to populate their values from
+    # @option opts [Hash] :allowed_empty_vars array of environment variable
+    #   names (specified in :tf_vars_from_env) to allow to be empty or missing.
     # @option opts [Hash] :tf_extra_vars hash of Terraform variables to their
     #   values; overrides any same-named keys in ``tf_vars_from_env``
+    # @option opts [Array] :tf_sensitive_vars list of Terraform variables
+    #   which should not be printed
     # @option opts [String] :consul_url URL to access Consul at, for the
     #   ``:consul_env_vars_prefix`` option.
     # @option opts [String] :consul_env_vars_prefix if specified and not nil,
@@ -96,6 +100,8 @@ module TFWrapper
       @ns_prefix = opts.fetch(:namespace_prefix, nil)
       @consul_env_vars_prefix = opts.fetch(:consul_env_vars_prefix, nil)
       @tf_vars_from_env = opts.fetch(:tf_vars_from_env, {})
+      @allowed_empty_vars = opts.fetch(:allowed_empty_vars, [])
+      @tf_sensitive_vars = opts.fetch(:tf_sensitive_vars, [])
       @tf_extra_vars = opts.fetch(:tf_extra_vars, {})
       @backend_config = opts.fetch(:backend_config, {})
       @consul_url = opts.fetch(:consul_url, nil)
@@ -162,7 +168,9 @@ module TFWrapper
         desc 'Run terraform init with appropriate arguments'
         task :init do |t|
           @before_proc.call(t.name, @tf_dir) unless @before_proc.nil?
-          TFWrapper::Helpers.check_env_vars(@tf_vars_from_env.values)
+          TFWrapper::Helpers.check_env_vars(
+            @tf_vars_from_env.values, @allowed_empty_vars
+          )
           @tf_version = check_tf_version
           cmd = [
             'terraform',
@@ -314,7 +322,9 @@ module TFWrapper
           tf_vars = terraform_vars
           puts 'Terraform vars:'
           tf_vars.sort.map do |k, v|
-            if %w[aws_access_key aws_secret_key].include?(k)
+            redacted_list = (%w[aws_access_key aws_secret_key] +
+                             @tf_sensitive_vars)
+            if redacted_list.include?(k)
               puts "#{k} => (redacted)"
             else
               puts "#{k} => #{v}"
@@ -391,19 +401,21 @@ module TFWrapper
           cmd, @tf_dir, progress: stream_type
         )
         if status != 0 && out_err.include?('hrottling')
-          raise StandardError, 'Terraform hit AWS API rate limiting'
+          raise StandardError, "#{out_err}\nTerraform hit AWS API rate limiting"
         end
         if status != 0 && out_err.include?('status code: 403')
-          raise StandardError, 'Terraform command got 403 error - access ' \
-            'denied or credentials not propagated'
+          raise StandardError, "#{out_err}\nTerraform command got 403 error " \
+            '- access denied or credentials not propagated'
         end
         if status != 0 && out_err.include?('status code: 401')
-          raise StandardError, 'Terraform command got 401 error - access ' \
-            'denied or credentials not propagated'
+          raise StandardError, "#{out_err}\nTerraform command got 401 error " \
+            '- access denied or credentials not propagated'
         end
       end
       # end exponential backoff
       unless status.zero?
+        # if we weren't streaming output, send it now
+        STDERR.puts out_err unless stream_type == :stream
         raise StandardError, "Errors have occurred executing: '#{cmd}' " \
           "(exited #{status})"
       end
@@ -456,7 +468,16 @@ module TFWrapper
 
       puts "Writing stack information to #{@consul_url} at: "\
         "#{@consul_env_vars_prefix}"
-      puts JSON.pretty_generate(data)
+
+      redacted_list = (%w[aws_access_key aws_secret_key] +
+        @tf_sensitive_vars)
+      sanitized_data = data.clone
+      @tf_vars_from_env.each do |k, v|
+        # We are trying to determine which ENV var maps
+        #   to the sensitive terraform variable
+        sanitized_data[v] = '(redacted)' if redacted_list.include?(k)
+      end
+      puts JSON.pretty_generate(sanitized_data)
       raw = JSON.generate(data)
       Diplomat::Kv.put(@consul_env_vars_prefix, raw)
     end

data/lib/tfwrapper/version.rb

@@ -4,5 +4,5 @@ module TFWrapper
   # version of the Gem/module; used in the gemspec and in messages.
   # NOTE: When updating this, also update the version in the "Installation"
   # section of README.md
-  VERSION = '0.5.0'
+  VERSION = '0.6.3'
 end

data/spec/acceptance/acceptance_helpers.rb

@@ -3,6 +3,7 @@
 require 'ffi'
 require 'faraday'
 require 'json'
+require 'retries'
 
 def fixture_dir
   File.absolute_path(
@@ -28,9 +29,9 @@ def desired_tf_version
 end
 
 def latest_tf_version
-  resp = Faraday.get('https://api.github.com/repos/hashicorp/terraform/releases/latest')
-  rel = JSON.parse(resp.body)['tag_name'].sub(/^v/, '')
-  puts "Found latest terraform release on GitHub: #{rel}"
+  resp = Faraday.get('https://checkpoint-api.hashicorp.com/v1/check/terraform')
+  rel = JSON.parse(resp.body)['current_version']
+  puts "Found latest terraform release as: #{rel}"
   rel
 end
 

data/spec/acceptance/acceptance_spec.rb

@@ -922,6 +922,45 @@ describe 'tfwrapper' do
           end
         end
       end
+      context 'when terraform fails' do
+        describe 'failing_tf:plan' do
+          before(:all) do
+            @out_err, @ecode = Open3.capture2e(
+              'timeout -k 60 45 bundle exec rake failing_tf:plan',
+              chdir: @fixturepath
+            )
+            @varpath = File.join(@fixturepath, 'failing_build.tfvars.json')
+          end
+          after(:all) do
+            File.delete(@varpath) if File.file?(@varpath)
+          end
+          it 'does not time out' do
+            expect(@ecode.exitstatus).to_not eq(124)
+            expect(@ecode.exitstatus).to_not eq(137)
+          end
+          it 'exits 1' do
+            expect(@ecode.exitstatus).to eq(1)
+          end
+          it 'returns the terraform output' do
+            expect(@out_err).to match(
+              /Terraform\sv0\.11\.2.*
+               terraform_runner\scommand:\s'terraform\sinit\s-input=false'.*
+               Running\swith:\sTerraform\sv0\.11\.2.*
+               Initializing\sthe\sbackend\.\.\..*
+               Successfully\sconfigured\sthe\sbackend\s"consul".*
+               Terraform\shas\sbeen\ssuccessfully\sinitialized.*
+               terraform_runner\scommand\s'terraform\sinit\s-input=false'\s
+               finished\sand\sexited\s0.*
+               consul_key_prefix\.landscapeTest:\s"path_prefix":\srequired\s
+               field\sis\snot\sset.*
+               rake\saborted.*
+               StandardError:\sErrors\shave\soccurred\sexecuting:\s
+               'terraform\splan\s-var-file.*
+               Tasks:\sTOP\s=>\sfailing_tf:plan.*/xm
+            )
+          end
+        end
+      end
     end
   end
 end

data/spec/fixtures/landscapeTest/Rakefile

@@ -30,3 +30,9 @@ TFWrapper::RakeTasks.install_tasks(
   namespace_prefix: 'lines',
   landscape_progress: :lines
 )
+
+TFWrapper::RakeTasks.install_tasks(
+  'failingTerraform/',
+  namespace_prefix: 'failing',
+  landscape_progress: :dots
+)

data/spec/fixtures/landscapeTest/failingTerraform/main.tf

@@ -0,0 +1,28 @@
+terraform {
+  required_version = "> 0.9.0"
+  backend "consul" {
+    address = "127.0.0.1:8500"
+    path    = "terraform/landscapeTestFailure"
+  }
+}
+
+provider "consul" {
+  address = "127.0.0.1:8500"
+  version = "1.0.0"
+}
+
+locals {
+  keys = {
+    foo = "foo2val"
+    bar = "bar2val"
+    baz = "baz2val"
+  }
+}
+
+variable "foo" { default = "bar" }
+
+resource "consul_key_prefix" "landscapeTest" {
+  invalid_param = "whoCares"
+}
+
+output "foo_variable" { value = "${var.foo}" }

data/spec/fixtures/landscapeTest/main.tf

@@ -8,7 +8,7 @@ terraform {
 
 provider "consul" {
   address = "127.0.0.1:8500"
-  version = "~> 1.0"
+  version = "1.0.0"
 }
 
 locals {

data/spec/fixtures/landscapeTest/with_landscape_dots.out

@@ -1,12 +1,12 @@
 Terraform v0.11.2
 
 Your version of Terraform is out of date! The latest version
-is 0.11.5. You can update by downloading from www.terraform.io/downloads.html
-terraform_runner command: 'terraform init -input=false' (in /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest)
+is %%TF_LATEST_VER%%. You can update by downloading from www.terraform.io/downloads.html
+terraform_runner command: 'terraform init -input=false' (in %%FIXTUREPATH%%)
 Running with: Terraform v0.11.2
 
 Your version of Terraform is out of date! The latest version
-is 0.11.5. You can update by downloading from www.terraform.io/downloads.html
+is %%TF_LATEST_VER%%. You can update by downloading from www.terraform.io/downloads.html
 
 Initializing the backend...
 
@@ -27,10 +27,10 @@ If you ever set or change modules or backend configuration for Terraform,
 rerun this command to reinitialize your working directory. If you forget, other
 commands will detect it and remind you to do so if necessary.
 terraform_runner command 'terraform init -input=false' finished and exited 0
-Terraform vars written to: /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest/dots_build.tfvars.json
-terraform_runner command: 'terraform plan -var-file /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest/dots_build.tfvars.json' (in /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest)
+Terraform vars written to: %%FIXTUREPATH%%/dots_build.tfvars.json
+terraform_runner command: 'terraform plan -var-file %%FIXTUREPATH%%/dots_build.tfvars.json' (in %%FIXTUREPATH%%)
 Terraform vars:
-..........................terraform_runner command 'terraform plan -var-file /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest/dots_build.tfvars.json' finished and exited 0
+..........................terraform_runner command 'terraform plan -var-file %%FIXTUREPATH%%/dots_build.tfvars.json' finished and exited 0
 
 ~ consul_key_prefix.landscapeTest
     subkeys.foo:   {
@@ -43,4 +43,3 @@ Terraform vars:
                     }
 
 Plan: 0 to add, 1 to change, 0 to destroy.
-

data/spec/fixtures/landscapeTest/with_landscape_lines.out

@@ -1,12 +1,12 @@
 Terraform v0.11.2
 
 Your version of Terraform is out of date! The latest version
-is 0.11.5. You can update by downloading from www.terraform.io/downloads.html
-terraform_runner command: 'terraform init -input=false' (in /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest)
+is %%TF_LATEST_VER%%. You can update by downloading from www.terraform.io/downloads.html
+terraform_runner command: 'terraform init -input=false' (in %%FIXTUREPATH%%)
 Running with: Terraform v0.11.2
 
 Your version of Terraform is out of date! The latest version
-is 0.11.5. You can update by downloading from www.terraform.io/downloads.html
+is %%TF_LATEST_VER%%. You can update by downloading from www.terraform.io/downloads.html
 
 Initializing the backend...
 
@@ -27,8 +27,8 @@ If you ever set or change modules or backend configuration for Terraform,
 rerun this command to reinitialize your working directory. If you forget, other
 commands will detect it and remind you to do so if necessary.
 terraform_runner command 'terraform init -input=false' finished and exited 0
-Terraform vars written to: /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest/lines_build.tfvars.json
-terraform_runner command: 'terraform plan -var-file /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest/lines_build.tfvars.json' (in /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest)
+Terraform vars written to: %%FIXTUREPATH%%/lines_build.tfvars.json
+terraform_runner command: 'terraform plan -var-file %%FIXTUREPATH%%/lines_build.tfvars.json' (in %%FIXTUREPATH%%)
 Terraform vars:
 .
 .
@@ -56,7 +56,7 @@ Terraform vars:
 .
 .
 .
-terraform_runner command 'terraform plan -var-file /home/jantman/manheim/git/github_dot_com/tfwrapper/spec/fixtures/landscapeTest/lines_build.tfvars.json' finished and exited 0
+terraform_runner command 'terraform plan -var-file %%FIXTUREPATH%%/lines_build.tfvars.json' finished and exited 0
 ~ consul_key_prefix.landscapeTest
     subkeys.foo:   {
                    -  "bar": "barval",
@@ -68,4 +68,3 @@ terraform_runner command 'terraform plan -var-file /home/jantman/manheim/git/git
                     }
 
 Plan: 0 to add, 1 to change, 0 to destroy.
-

data/spec/fixtures/testOne.tf

@@ -8,6 +8,7 @@ terraform {
 
 provider "consul" {
   address = "127.0.0.1:8500"
+  version = "1.0.0"
 }
 
 variable "foo" { default = "bar" }

data/spec/fixtures/testThree/bar/testThreeBar.tf

@@ -8,6 +8,7 @@ terraform {
 
 provider "consul" {
   address = "127.0.0.1:8500"
+  version = "1.0.0"
 }
 
 variable "foo" {}

data/spec/fixtures/testThree/baz/testThreeBaz.tf

@@ -8,6 +8,7 @@ terraform {
 
 provider "consul" {
   address = "127.0.0.1:8500"
+  version = "1.0.0"
 }
 
 variable "foo" {}

data/spec/fixtures/testThree/foo/testThreeFoo.tf

@@ -7,6 +7,7 @@ terraform {
 
 provider "consul" {
   address = "127.0.0.1:8500"
+  version = "1.0.0"
 }
 
 variable "foo" {}

data/spec/fixtures/testTwo/foo/bar/testTwo.tf

@@ -7,6 +7,7 @@ terraform {
 
 provider "consul" {
   address = "127.0.0.1:8500"
+  version = "1.0.0"
 }
 
 variable "foo" {}

data/spec/unit/helpers_spec.rb

@@ -213,10 +213,16 @@ describe TFWrapper::Helpers do
     it 'returns nil if vars present' do
       ENV['foo'] = 'fooval'
       ENV['bar'] = 'barval'
-      expect(TFWrapper::Helpers.check_env_vars(%w[foo bar])).to be_nil
+      expect(TFWrapper::Helpers.check_env_vars(%w[foo bar], [])).to be_nil
       ENV.delete('foo')
       ENV.delete('bar')
     end
+    it 'returns nil if vars ignored' do
+      ENV['foo'] = ''
+      expect(TFWrapper::Helpers.check_env_vars(%w[foo bar], %w[foo bar]))
+        .to be_nil
+      ENV.delete('foo')
+    end
     it 'exits if not present' do
       ENV.delete('foo')
       ENV.delete('bar')
@@ -224,7 +230,7 @@ describe TFWrapper::Helpers do
         .with('ERROR: Environment variable \'foo\' must be set.')
       expect(STDOUT).to receive(:puts)
         .with('ERROR: Environment variable \'bar\' must be set.')
-      expect { TFWrapper::Helpers.check_env_vars(%w[foo bar]) }
+      expect { TFWrapper::Helpers.check_env_vars(%w[foo bar], %w[baz]) }
         .to raise_error StandardError, 'Missing or empty environment ' \
           'variables: ["foo", "bar"]'
     end
@@ -235,11 +241,31 @@ describe TFWrapper::Helpers do
         .with("ERROR: Environment variable 'foo' must not be empty.")
       expect(STDOUT).to receive(:puts)
         .with("ERROR: Environment variable 'bar' must not be empty.")
-      expect { TFWrapper::Helpers.check_env_vars(%w[foo bar]) }
+      expect { TFWrapper::Helpers.check_env_vars(%w[foo bar], %w[baz]) }
         .to raise_error StandardError, 'Missing or empty environment ' \
           'variables: ["foo", "bar"]'
       ENV.delete('foo')
       ENV.delete('bar')
     end
+    it 'exits if not present and partially ignored' do
+      ENV.delete('foo')
+      ENV.delete('bar')
+      expect(STDOUT).to receive(:puts)
+        .with('ERROR: Environment variable \'foo\' must be set.')
+      expect { TFWrapper::Helpers.check_env_vars(%w[foo bar], %w[bar]) }
+        .to raise_error StandardError, 'Missing or empty environment ' \
+          'variables: ["foo"]'
+    end
+    it 'exits if empty and partially ignored' do
+      ENV['foo'] = ''
+      ENV['bar'] = '    '
+      expect(STDOUT).to receive(:puts)
+        .with("ERROR: Environment variable 'foo' must not be empty.")
+      expect { TFWrapper::Helpers.check_env_vars(%w[foo bar], %w[bar]) }
+        .to raise_error StandardError, 'Missing or empty environment ' \
+          'variables: ["foo"]'
+      ENV.delete('foo')
+      ENV.delete('bar')
+    end
   end
 end

data/spec/unit/raketasks_spec.rb

@@ -59,6 +59,8 @@ describe TFWrapper::RakeTasks do
       expect(cls.instance_variable_get('@tf_dir')).to eq('/rake/dir/tfdir')
       expect(cls.instance_variable_get('@consul_env_vars_prefix')).to eq(nil)
       expect(cls.instance_variable_get('@tf_vars_from_env')).to eq({})
+      expect(cls.instance_variable_get('@allowed_empty_vars')).to eq([])
+      expect(cls.instance_variable_get('@tf_sensitive_vars')).to eq([])
       expect(cls.instance_variable_get('@tf_extra_vars')).to eq({})
       expect(cls.instance_variable_get('@backend_config')).to eq({})
       expect(cls.instance_variable_get('@consul_url')).to eq(nil)
@@ -87,6 +89,8 @@ describe TFWrapper::RakeTasks do
         'tf/dir',
         consul_env_vars_prefix: 'cvprefix',
         tf_vars_from_env: { 'foo' => 'bar' },
+        allowed_empty_vars: %w[bar blam],
+        tf_sensitive_vars: %w[secret],
         tf_extra_vars: { 'baz' => 'blam' },
         consul_url: 'foobar',
         before_proc: bproc,
@@ -100,6 +104,10 @@ describe TFWrapper::RakeTasks do
         .to eq('cvprefix')
       expect(cls.instance_variable_get('@tf_vars_from_env'))
         .to eq('foo' => 'bar')
+      expect(cls.instance_variable_get('@allowed_empty_vars'))
+        .to eq(%w[bar blam])
+      expect(cls.instance_variable_get('@tf_sensitive_vars'))
+        .to eq(%w[secret])
       expect(cls.instance_variable_get('@tf_extra_vars'))
         .to eq('baz' => 'blam')
       expect(cls.instance_variable_get('@backend_config')).to eq({})
@@ -317,6 +325,7 @@ describe TFWrapper::RakeTasks do
         .to eq(Gem::Version.new('0.0.0'))
       vars = { foo: 'bar', baz: 'blam' }
       subject.instance_variable_set('@tf_vars_from_env', vars)
+      subject.instance_variable_set('@allowed_empty_vars', ['bar'])
       allow(TFWrapper::Helpers).to receive(:check_env_vars)
       allow(ENV).to receive(:[])
       subject.instance_variable_set(
@@ -329,7 +338,7 @@ describe TFWrapper::RakeTasks do
       allow(subject).to receive(:check_tf_version)
         .and_return(Gem::Version.new('0.9.5'))
       expect(TFWrapper::Helpers)
-        .to receive(:check_env_vars).once.ordered.with(vars.values)
+        .to receive(:check_env_vars).once.ordered.with(vars.values, ['bar'])
       expect(subject).to receive(:check_tf_version).once.ordered
       expect(subject).to receive(:terraform_runner).once.ordered
         .with('terraform init -input=false '\
@@ -351,7 +360,7 @@ describe TFWrapper::RakeTasks do
       allow(subject).to receive(:check_tf_version)
         .and_return(Gem::Version.new('0.10.2'))
       expect(TFWrapper::Helpers)
-        .to receive(:check_env_vars).once.ordered.with(vars.values)
+        .to receive(:check_env_vars).once.ordered.with(vars.values, [])
       expect(subject).to receive(:check_tf_version).once.ordered
       expect(subject).to receive(:terraform_runner).once.ordered
         .with('terraform init -input=false')
@@ -827,6 +836,7 @@ describe TFWrapper::RakeTasks do
         Rake.application = rake_application
       end
       before do
+        subject.instance_variable_set('@tf_sensitive_vars', ['secret'])
         subject.install_write_tf_vars
       end
 
@@ -839,7 +849,8 @@ describe TFWrapper::RakeTasks do
         vars = {
           'foo' => 'bar',
           'baz' => 'blam',
-          'aws_access_key' => 'ak'
+          'aws_access_key' => 'ak',
+          'secret' => 'abc'
         }
         allow(subject).to receive(:terraform_vars).and_return(vars)
         allow(subject).to receive(:var_file_path).and_return('file.tfvars.json')
@@ -851,6 +862,8 @@ describe TFWrapper::RakeTasks do
         expect(STDOUT).to receive(:puts).once.with('Terraform vars:')
         expect(STDOUT).to receive(:puts)
           .once.with('aws_access_key => (redacted)')
+        expect(STDOUT).to receive(:puts)
+          .once.with('secret => (redacted)')
         expect(STDOUT).to receive(:puts).once.with('baz => blam')
         expect(STDOUT).to receive(:puts).once.with('foo => bar')
         expect(File).to receive(:open).once.with('file.tfvars.json', 'w')
@@ -912,6 +925,7 @@ describe TFWrapper::RakeTasks do
         Rake.application = rake_application
       end
       before do
+        subject.instance_variable_set('@tf_sensitive_vars', ['secret'])
         subject.instance_variable_set('@ns_prefix', 'foo')
         subject.install_write_tf_vars
       end
@@ -925,7 +939,8 @@ describe TFWrapper::RakeTasks do
         vars = {
           'foo' => 'bar',
           'baz' => 'blam',
-          'aws_access_key' => 'ak'
+          'aws_access_key' => 'ak',
+          'secret' => 'abc'
         }
         allow(subject).to receive(:terraform_vars).and_return(vars)
         allow(subject).to receive(:var_file_path)
@@ -938,6 +953,8 @@ describe TFWrapper::RakeTasks do
         expect(STDOUT).to receive(:puts).once.with('Terraform vars:')
         expect(STDOUT).to receive(:puts)
           .once.with('aws_access_key => (redacted)')
+        expect(STDOUT).to receive(:puts)
+          .once.with('secret => (redacted)')
         expect(STDOUT).to receive(:puts).once.with('baz => blam')
         expect(STDOUT).to receive(:puts).once.with('foo => bar')
         expect(File).to receive(:open).once.with('foo_file.tfvars.json', 'w')
@@ -1233,10 +1250,12 @@ describe TFWrapper::RakeTasks do
       expect(STDERR).to receive(:puts).once
         .with("terraform_runner command: 'foo' (in tfdir)")
       expect(STDERR).to receive(:puts).once
-        .with(/terraform_runner\sfailed\swith\sTerraform\shit\sAWS\sAPI\srate\s
+        .with(/terraform_runner\sfailed\swith\sfoo\sThrottling\sbar\s+
+          Terraform\shit\sAWS\sAPI\srate\s
           limiting;\sretry\sattempt\s1;\s.+\sseconds\shave\spassed\./x)
       expect(STDERR).to receive(:puts).once
-        .with(/terraform_runner\sfailed\swith\sTerraform\shit\sAWS\sAPI\srate\s
+        .with(/terraform_runner\sfailed\swith\sfoo\sThrottling\sbar\s+
+          Terraform\shit\sAWS\sAPI\srate\s
           limiting;\sretry\sattempt\s2;\s.+\sseconds\shave\spassed\./x)
       expect(STDERR).to receive(:puts).once
         .with("terraform_runner command 'foo' finished and exited 0")
@@ -1258,11 +1277,13 @@ describe TFWrapper::RakeTasks do
       expect(STDERR).to receive(:puts).once
         .with("terraform_runner command: 'foo' (in tfdir)")
       expect(STDERR).to receive(:puts).once
-        .with(/terraform_runner\sfailed\swith\sTerraform\scommand\sgot\s403\s
+        .with(/terraform_runner\sfailed\swith\sfoo\sstatus\scode:\s403\sbar\s+
+          Terraform\scommand\sgot\s403\s
         error\s-\saccess\sdenied\sor\scredentials\snot\spropagated;\sretry\s
         attempt\s1;\s.+\sseconds\shave\spassed\./x)
       expect(STDERR).to receive(:puts).once
-        .with(/terraform_runner\sfailed\swith\sTerraform\scommand\sgot\s403\s
+        .with(/terraform_runner\sfailed\swith\sfoo\sstatus\scode:\s403\sbar\s+
+          Terraform\scommand\sgot\s403\s
         error\s-\saccess\sdenied\sor\scredentials\snot\spropagated;\sretry\s
         attempt\s2;\s.+\sseconds\shave\spassed\./x)
       expect(STDERR).to receive(:puts).once
@@ -1285,11 +1306,13 @@ describe TFWrapper::RakeTasks do
       expect(STDERR).to receive(:puts).once
         .with("terraform_runner command: 'foo' (in tfdir)")
       expect(STDERR).to receive(:puts).once
-        .with(/terraform_runner\sfailed\swith\sTerraform\scommand\sgot\s401\s
+        .with(/terraform_runner\sfailed\swith\sfoo\sstatus\scode:\s401\sbar\s+
+        Terraform\scommand\sgot\s401\s
         error\s-\saccess\sdenied\sor\scredentials\snot\spropagated;\sretry\s
         attempt\s1;\s.+\sseconds\shave\spassed\./x)
       expect(STDERR).to receive(:puts).once
-        .with(/terraform_runner\sfailed\swith\sTerraform\scommand\sgot\s401\s
+        .with(/terraform_runner\sfailed\swith\sfoo\sstatus\scode:\s401\sbar\s+
+        Terraform\scommand\sgot\s401\s
         error\s-\saccess\sdenied\sor\scredentials\snot\spropagated;\sretry\s
         attempt\s2;\s.+\sseconds\shave\spassed\./x)
       expect(STDERR).to receive(:puts).once
@@ -1306,6 +1329,18 @@ describe TFWrapper::RakeTasks do
       expect { subject.terraform_runner('foo') }
         .to raise_error('Errors have occurred executing: \'foo\' (exited 1)')
     end
+    it 'prints output to STDERR if plan exits non-zero and not :stream' do
+      allow(TFWrapper::Helpers).to receive(:run_cmd_stream_output)
+        .and_return(['myoutput', 1])
+      expect(TFWrapper::Helpers).to receive(:run_cmd_stream_output).once
+        .with('foo', 'tfdir', progress: :dots)
+      expect(STDERR).to receive(:puts).once
+        .with('terraform_runner command: \'foo\' (in tfdir)')
+      expect(STDERR).to receive(:puts).once
+        .with('myoutput')
+      expect { subject.terraform_runner('foo', progress: :dots) }
+        .to raise_error('Errors have occurred executing: \'foo\' (exited 1)')
+    end
     it 'raises an error if the progress option is invalid' do
       allow(TFWrapper::Helpers).to receive(:run_cmd_stream_output)
         .and_return(['', 1])
@@ -1386,21 +1421,28 @@ describe TFWrapper::RakeTasks do
   describe '#update_consul_stack_env_vars' do
     context 'when @consul_url and @consul_env_vars_prefix are specified' do
       it 'saves the variables in Consul' do
-        vars = { 'foo' => 'bar', 'baz' => 'blam' }
-        expected = { 'bar' => 'barVal', 'blam' => 'blamVal' }
+        vars = { 'foo' => 'bar', 'baz' => 'blam', 'secret' => 'SECRET' }
+        expected = { 'bar' => 'barVal',
+                     'blam' => 'blamVal',
+                     'SECRET' => 'abc' }
+        sanitized = { 'bar' => 'barVal',
+                      'blam' => 'blamVal',
+                      'SECRET' => '(redacted)' }
         subject.instance_variable_set('@tf_vars_from_env', vars)
         subject.instance_variable_set('@consul_url', 'foo://bar')
         subject.instance_variable_set('@consul_env_vars_prefix', 'my/prefix')
+        subject.instance_variable_set('@tf_sensitive_vars', ['secret'])
         allow(ENV).to receive(:[])
         allow(ENV).to receive(:[]).with('CONSUL_HOST').and_return('chost')
         allow(ENV).to receive(:[]).with('bar').and_return('barVal')
         allow(ENV).to receive(:[]).with('blam').and_return('blamVal')
+        allow(ENV).to receive(:[]).with('SECRET').and_return('abc')
         allow(Diplomat::Kv).to receive(:put)
 
         expect(STDOUT).to receive(:puts).once
           .with('Writing stack information to foo://bar at: my/prefix')
         expect(STDOUT).to receive(:puts).once
-          .with(JSON.pretty_generate(expected))
+          .with(JSON.pretty_generate(sanitized))
         expect(Diplomat::Kv).to receive(:put)
           .once.with('my/prefix', JSON.generate(expected))
         subject.update_consul_stack_env_vars

data/tfwrapper.gemspec

@@ -23,6 +23,7 @@ Gem::Specification.new do |gem|
   # awful, but these are to allow use with ruby 2.1.x
   gem.add_development_dependency 'ruby_dep', '1.3.1'
   gem.add_development_dependency 'listen', '3.0.7'
+  gem.add_development_dependency 'rb-inotify', '0.9.10'
 
   # guard-yard uses Pry which needs readline. If we're in RVM, we'll need this:
   gem.add_development_dependency 'rb-readline', '~> 0.5'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tfwrapper
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.3
 platform: ruby
 authors:
 - jantman
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-03-30 00:00:00.000000000 Z
+date: 2020-09-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: retries
@@ -52,6 +52,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 3.0.7
+- !ruby/object:Gem::Dependency
+  name: rb-inotify
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.9.10
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.9.10
 - !ruby/object:Gem::Dependency
   name: rb-readline
   requirement: !ruby/object:Gem::Requirement
@@ -351,13 +365,13 @@ extra_rdoc_files: []
 files:
 - ".gitignore"
 - ".rubocop.yml"
+- ".travis.yml"
 - ChangeLog.md
 - Gemfile
 - Guardfile
 - LICENSE
 - README.md
 - Rakefile
-- circle.yml
 - lib/tfwrapper.rb
 - lib/tfwrapper/helpers.rb
 - lib/tfwrapper/raketasks.rb
@@ -367,6 +381,7 @@ files:
 - spec/acceptance/consulserver.rb
 - spec/fixtures/Rakefile
 - spec/fixtures/landscapeTest/Rakefile
+- spec/fixtures/landscapeTest/failingTerraform/main.tf
 - spec/fixtures/landscapeTest/main.tf
 - spec/fixtures/landscapeTest/state.json
 - spec/fixtures/landscapeTest/with_landscape_default.out
@@ -406,7 +421,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Rake tasks for running Hashicorp Terraform sanely
@@ -416,6 +431,7 @@ test_files:
 - spec/acceptance/consulserver.rb
 - spec/fixtures/Rakefile
 - spec/fixtures/landscapeTest/Rakefile
+- spec/fixtures/landscapeTest/failingTerraform/main.tf
 - spec/fixtures/landscapeTest/main.tf
 - spec/fixtures/landscapeTest/state.json
 - spec/fixtures/landscapeTest/with_landscape_default.out

data/circle.yml

@@ -1,32 +0,0 @@
-
-dependencies:
-  cache_directories:
-    - "~/.rvm/gems"
-  pre:
-    - sudo add-apt-repository -y ppa:git-core/ppa && sudo apt-get update && sudo apt-get install git
-  override:
-    - 'bundle install --without landscape'
-    - 'rvm 2.0.0-p598 exec bundle install --without landscape'
-    - 'rvm 2.1.8 exec bundle install --without landscape'
-    - 'rvm 2.2.5 exec bundle install --without landscape'
-    - 'rvm 2.3.1 exec bundle install --without landscape'
-    - 'rvm 2.4.1 exec bundle install'
-
-test:
-  override:
-    - 'bundle exec ruby --version'
-    - 'bundle exec rake spec:unit'
-    - 'bundle exec rake rubocop'
-    - 'rvm 2.0.0-p598 exec bundle exec rake spec:unit'
-    - 'rvm 2.1.8 exec bundle exec rake spec:unit'
-    - 'rvm 2.2.5 exec bundle exec rake spec:unit'
-    - 'rvm 2.3.1 exec bundle exec rake spec:unit'
-    - 'rvm 2.4.1 exec bundle exec rake spec:unit'
-    - 'rvm 2.3.1 exec bundle exec rake spec:acceptance TF_VERSION=0.9.2'
-    - 'rvm 2.3.1 exec bundle exec rake spec:acceptance TF_VERSION=0.9.7'
-    - 'rvm 2.3.1 exec bundle exec rake spec:acceptance TF_VERSION=0.10.0'
-    - 'rvm 2.3.1 exec bundle exec rake spec:acceptance TF_VERSION=0.10.2'
-    - 'rvm 2.3.1 exec bundle exec rake spec:acceptance TF_VERSION=0.11.2'
-    - 'rvm 2.3.1 exec bundle exec rake spec:acceptance TF_VERSION=latest'
-    - 'rvm 2.4.1 exec bundle exec rake spec:acceptance TF_VERSION=0.11.2'
-    - 'bundle exec rake yard:generate'