“Forking” workspaces in Terraform
Let’s say you have a Terraform configuration only for default workspace and you would like to split it into dev/staging environments.
In order to create a new workspace in Terraform you can simply execute:
$ terraform workspace new devCreated and switched to workspace "dev"!You're now on a new, empty workspace. Workspaces isolate their state,
so if you run "terraform plan" Terraform will not see any existing state
for this configuration.
But notice that it bootstraps a completely new workspace with an empty tfstate. What if you would like to migrate your existing default state to dev workspace?
Well, there is no built-in migration command in Terrafrom but remember that tfstate is simply a file. default workspace stores its configuration in a file called default.tfstate, for dev workspace it would be dev.tfstate.
So in order to “duplicate” our state into dev workspace, we can simply copy this file with a new name. The copying procedure depends on backend provider. I will provide examples for some of them.
GCP backend:
$ gsutil cp gs://bucket/prefix/default.tfstate gs://bucket/prefix/dev.tfstate# Where
# - bucket is terraform.backend.gcs.bucket
# - prefix is terraform.backend.gcs.prefix# Check dev workspace state# Ensure we are on dev workspace
$ terraform workspace select dev$ terraform plan# Ideally you should see if there were no changes made before copying the file
No changes. Your infrastructure matches the configuration.
S3 backend:
$ aws s3 cp s3://bucket/path/to/terraform.tfstate s3://bucket/env/dev/path/to/terraform.tfstate# Where
# - bucket - is terraform.backend.s3.bucket
# - dev - is our workspace
# - path/to/terraform.tfstate - is terraform.backend.s3.key# Check dev workspace state# Ensure we are on dev workspace
$ terraform workspace select dev$ terraform plan# Ideally you should see if there were no changes made before copying the file
No changes. Your infrastructure matches the configuration.
Local:
$ cp terraform.tfstate terraform.tfstate.d/dev/terraform.tfstate# Where
# - dev - is our workspace# Check dev workspace state# Ensure we are on dev workspace
$ terraform workspace select dev
$ terraform plan# Ideally you should see if there were no changes made before copying the file
No changes. Your infrastructure matches the configuration.
⚠️ Important
Please notice that synchronizing tfstate files in such a way bypasses the locking mechanism that Terraform provides. See this comment for details. But either if you are the only owner of Terraform configuration or you are sure that there won’t be any concurrent changes then you are safe.
I have shown examples for creating dev workspace. For proceeding to create stage workspace you have two options: either “fork” default or dev workspace. Then you can parameterize your configuration with per workspace variables, e.g. vars/{dev,stage}.tfvars files.
If you would like to avoid applying terraform changes on wrong environment then checkout the tool I’ve created for this purpose: https://github.com/aaabramov/goal
