---
kind: pipeline
type: kubernetes
name: Terraform root module

trigger:
  event:
  - cron
  - push
  branch:
  - main

steps:
- name: terraform init
  image: hashicorp/terraform:1.1.8
  commands:
    - mkdir -p ~/.ssh
    - chmod 755 ~/.ssh
    - echo "$${CI_SSH_KEY}" | base64 -d > ~/.ssh/id_rsa
    - chmod 600 ~/.ssh/id_rsa
    - terraform init
  environment:
    GIT_SSH_COMMAND: "ssh -o StrictHostKeyChecking=no"
    CI_SSH_KEY:
      from_secret: ci-ssh-key
    AWS_ACCESS_KEY_ID:
      from_secret: terraform-aws-key-id
    AWS_SECRET_ACCESS_KEY:
      from_secret: terraform-aws-secret-access-key

- name: terraform plan
  image: hashicorp/terraform:1.1.8
  commands:
  - terraform plan -out .tfplan
  environment:
    AWS_ACCESS_KEY_ID:
      from_secret: terraform-aws-key-id
    AWS_SECRET_ACCESS_KEY:
      from_secret: terraform-aws-secret-access-key

- name: terraform apply
  when:
    when:
      branch:
      - main
      event:
      - push
  image: hashicorp/terraform:1.1.8
  commands:
    - terraform show -plan .tfplan
    # - terraform apply -plan .tfplan -auto-approve
---
kind: signature
hmac: 749e0dee63c0fa75bf15a7c3cf4cf0880acc60dc0ac417d2283a12f45216a7aa

...