Jenkins and Infrastructure as Code

// Jenkinsfile for a Terraform infrastructure pipeline
// Pattern: PR → Plan (auto) → Review → Approve → Apply (main only)
pipeline {
    agent {
        docker {
            // Use the official Terraform Docker image — no installation needed on agents
            image 'hashicorp/terraform:1.7'
            args  '-v /tmp/terraform-plugins:/root/.terraform.d/plugins'
        }
    }

    environment {
        // AWS credentials from Jenkins credential store — never hardcoded
        AWS_ACCESS_KEY_ID     = credentials('aws-terraform-access-key')
        AWS_SECRET_ACCESS_KEY = credentials('aws-terraform-secret-key')
        // Or better: use an IAM role on the agent and skip these entirely

        // Terraform state backend — S3 bucket and DynamoDB lock table
        TF_STATE_BUCKET  = 'acmecorp-terraform-state'
        TF_LOCK_TABLE    = 'acmecorp-terraform-locks'
        TF_VAR_env       = 'production'
    }

    stages {

        stage('Checkout') {
            steps { checkout scm }
        }

        stage('Terraform Init') {
            steps {
                sh '''
                    terraform init \
                      -backend-config="bucket=${TF_STATE_BUCKET}" \
                      -backend-config="dynamodb_table=${TF_LOCK_TABLE}" \
                      -backend-config="region=eu-west-1" \
                      -input=false
                '''
            }
        }

        stage('Terraform Validate') {
            steps {
                // Validate syntax before running a plan — catches .tf file errors fast
                sh 'terraform validate'
            }
        }

        stage('Terraform Plan') {
            steps {
                script {
                    // -detailed-exitcode: 0=no changes, 1=error, 2=changes pending
                    def exitCode = sh(
                        script: 'terraform plan -out=tfplan -detailed-exitcode -input=false',
                        returnStatus: true
                    )

                    if (exitCode == 0) {
                        echo "No infrastructure changes — skipping apply"
                        currentBuild.description = "No changes"
                        env.SKIP_APPLY = 'true'
                    } else if (exitCode == 2) {
                        echo "Infrastructure changes detected — plan saved"
                        env.SKIP_APPLY = 'false'
                        // Show the plan in the Jenkins console for reviewers
                        sh 'terraform show tfplan'
                    } else {
                        error('terraform plan failed')
                    }
                }
            }
            // Archive the plan file so reviewers can inspect it
            post {
                always {
                    archiveArtifacts artifacts: 'tfplan', allowEmptyArchive: true
                }
            }
        }

        stage('Approval Gate') {
            // Only gate on main branch — PR builds plan without applying
            when {
                allOf {
                    branch 'main'
                    expression { return env.SKIP_APPLY == 'false' }
                }
            }
            steps {
                // Human must approve before infrastructure is changed
                input(
                    message: 'Review the Terraform plan above. Apply to production?',
                    ok: 'Apply Infrastructure Changes',
                    submitter: 'platform-engineers,infra-leads'
                )
            }
        }

        stage('Terraform Apply') {
            when {
                allOf {
                    branch 'main'
                    expression { return env.SKIP_APPLY == 'false' }
                }
            }
            steps {
                sh '''
                    # Apply the SAVED plan — not a fresh plan
                    # This ensures exactly what was reviewed gets applied
                    terraform apply -input=false tfplan
                '''
            }
        }

    }

    post {
        success {
            slackSend(channel: '#infra-changes', color: 'good',
                message: "✅ Terraform applied to production — <${env.BUILD_URL}|Build #${BUILD_NUMBER}>")
        }
        failure {
            slackSend(channel: '#infra-changes', color: 'danger',
                message: "❌ Terraform pipeline failed — <${env.BUILD_URL}|Build #${BUILD_NUMBER}>")
        }
        always { cleanWs() }
    }
}

// Ansible stage — runs after Terraform has provisioned the servers
// Uses the Ansible plugin (ansible) from the Jenkins Plugin Manager
stage('Configure Servers') {
    steps {
        // ansiblePlaybook is a step from the Ansible plugin
        ansiblePlaybook(
            playbook: 'ansible/site.yml',
            inventory: 'ansible/inventory/production',
            credentialsId: 'ansible-ssh-key',   // SSH key to connect to servers
            colorized: true,                     // coloured output in console
            disableHostKeyChecking: true,
            extraVars: [
                app_version: "${BUILD_NUMBER}",
                deploy_env:  "production"
            ]
        )
    }
}

// Alternatively — run ansible-playbook directly as a shell command
// Gives more control but requires Ansible installed on the agent
stage('Configure Servers — Shell') {
    steps {
        withCredentials([sshUserPrivateKey(
            credentialsId: 'ansible-ssh-key',
            keyFileVariable: 'SSH_KEY'
        )]) {
            sh """
                ansible-playbook ansible/site.yml \
                  -i ansible/inventory/production \
                  --private-key=${SSH_KEY} \
                  --extra-vars "app_version=${BUILD_NUMBER} deploy_env=production" \
                  --diff          # shows what changed on each server
            """
        }
    }
}