Infrastructure as code - 尝试Terraform管理vSphere

Terraform is useful for turning repeatable vSphere operations into reviewed configuration. This example focuses on provider configuration, environment selection, and safe host and storage lookups.

Keep credentials outside the configuration

Declare the provider inputs and mark the password as sensitive:

variable "vsphere_user" {
  type = string
}

variable "vsphere_password" {
  type      = string
  sensitive = true
}

variable "environment" {
  type    = string
  default = "lab-primary"

  validation {
    condition = contains(
      ["lab-primary", "lab-secondary", "production", "disaster-recovery"],
      var.environment,
    )
    error_message = "Choose a declared environment."
  }
}

Supply TF_VAR_vsphere_user and TF_VAR_vsphere_password from a protected environment file or secret manager. Do not commit a populated variable file.

Define documentation-only environments

The map below contains four coherent examples across three datacenters. The addresses come from ranges reserved for documentation.

locals {
  environments = {
    lab-primary = {
      server     = "192.0.2.10"
      datacenter = "LAB_DC"
    }
    lab-secondary = {
      server     = "192.0.2.11"
      datacenter = "LAB_DC"
    }
    production = {
      server     = "198.51.100.10"
      datacenter = "PROD_DC"
    }
    disaster-recovery = {
      server     = "203.0.113.10"
      datacenter = "DR_DC"
    }
  }

  selected = local.environments[var.environment]
}

The validation block makes a typo fail before Terraform contacts an endpoint.

Configure the provider with TLS verification

Certificate verification is the default in this example. Each real endpoint should present a trusted certificate whose subject alternative names match the configured server name or address.

terraform {
  required_providers {
    vsphere = {
      source  = "hashicorp/vsphere"
      version = "~> 2.0"
    }
  }
}

provider "vsphere" {
  user                 = var.vsphere_user
  password             = var.vsphere_password
  vsphere_server       = local.selected.server
  allow_unverified_ssl = false
}

Do not make an insecure bypass the normal path. For a lab certificate, install the issuing certificate authority in the runner trust store and keep verification enabled.

Look up a host and datastore

Use explicit data sources rather than embedding managed-object identifiers throughout the configuration:

data "vsphere_datacenter" "selected" {
  name = local.selected.datacenter
}

data "vsphere_host" "example" {
  name          = "esxi-01.example.test"
  datacenter_id = data.vsphere_datacenter.selected.id
}

data "vsphere_datastore" "example" {
  name          = "datastore-lab"
  datacenter_id = data.vsphere_datacenter.selected.id
}

When a workflow must refer to a storage device canonical name, use a clearly synthetic value in documentation:

locals {
  example_storage_device = "naa.example000000000000"
}

Treat real host names, device identifiers, and environment maps as deployment data. Keep them in access-controlled configuration and review changes through the normal infrastructure workflow.

Run the workflow

terraform init
terraform fmt -check
terraform validate
terraform plan -var='environment=lab-primary'

Review the plan before applying. A saved plan may contain infrastructure metadata even when input variables are marked sensitive, so protect plan files and remove them when the workflow is complete.