From a4e0a60db7d23528cbad6132f7aba744c9dd625d Mon Sep 17 00:00:00 2001
From: "kochetkov.s" <kochetkov.s@sarex.io>
Date: Fri, 23 Jan 2026 16:27:57 +0300
Subject: [PATCH] change pipeline generation + add tf dockerfile

---
 .gitlab-ci.yml               |  3 ++
 .gitlab-ci.yml.bak           | 30 -----------------
 Dockerfile                   | 38 +++++++++++++++++++++
 scripts/generate-pipeline.sh | 64 ++++++++++++++++--------------------
 4 files changed, 69 insertions(+), 66 deletions(-)
 delete mode 100644 .gitlab-ci.yml.bak
 create mode 100644 Dockerfile

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b8cea7a..5001511 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,6 +2,9 @@ stages:
   - generate
   - trigger
 
+variables:
+  TERRAFORM_IMAGE_NAME: cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v0.9.8
+
 generate-pipeline:
   stage: generate
   image: alpine:latest
diff --git a/.gitlab-ci.yml.bak b/.gitlab-ci.yml.bak
deleted file mode 100644
index e59e5e0..0000000
--- a/.gitlab-ci.yml.bak
+++ /dev/null
@@ -1,30 +0,0 @@
-stages:
-  - generate
-  - trigger
-
-generate-pipeline:
-  stage: generate
-  image: alpine:latest
-  before_script:
-    - apk add --no-cache bash findutils
-  script:
-    - ./scripts/generate-pipeline.sh
-  artifacts:
-    paths:
-      - .gitlab-ci.generated.yml
-    expire_in: 1 hour
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-    - if: '$CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"'
-    - if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
-
-trigger-downstream:
-  stage: trigger
-  trigger:
-    include:
-      - artifact: .gitlab-ci.generated.yml
-        job: generate-pipeline
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-    - if: '$CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"'
-    - if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..88afff8
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,38 @@
+FROM alpine:latest
+
+RUN apk add --no-cache curl unzip bash git
+
+ARG TERRAFORM_VERSION=1.14.3
+RUN curl -fsSL https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip -o terraform.zip && \
+    unzip terraform.zip -d /usr/local/bin/ && \
+    chmod +x /usr/local/bin/terraform && \
+    rm -f terraform.zip
+
+ARG TERRAGRUNT_VERSION=0.98.0
+RUN curl -fsSL https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64 -o /usr/local/bin/terragrunt && \
+    chmod +x /usr/local/bin/terragrunt
+
+RUN mkdir -p /root/.terraform.d/plugins/registry.terraform.io
+
+RUN mkdir -p /root/.terraform.d/plugins/registry.terraform.io/yandex-cloud/yandex/0.100.0/linux_amd64 && \
+    curl -fsSL https://releases.hashicorp.com/terraform-provider-yandex/0.100.0/terraform-provider-yandex_0.100.0_linux_amd64.zip -o /tmp/yandex.zip && \
+    unzip -q /tmp/yandex.zip -d /root/.terraform.d/plugins/registry.terraform.io/yandex-cloud/yandex/0.100.0/linux_amd64 && \
+    chmod +x /root/.terraform.d/plugins/registry.terraform.io/yandex-cloud/yandex/0.100.0/linux_amd64/terraform-provider-yandex_* && \
+    rm -f /tmp/yandex.zip
+
+RUN mkdir -p /root/.terraform.d/plugins/registry.terraform.io/hashicorp/kubernetes/2.23.0/linux_amd64 && \
+    curl -fsSL https://releases.hashicorp.com/terraform-provider-kubernetes/2.23.0/terraform-provider-kubernetes_2.23.0_linux_amd64.zip -o /tmp/kubernetes.zip && \
+    unzip -q /tmp/kubernetes.zip -d /root/.terraform.d/plugins/registry.terraform.io/hashicorp/kubernetes/2.23.0/linux_amd64 && \
+    chmod +x /root/.terraform.d/plugins/registry.terraform.io/hashicorp/kubernetes/2.23.0/linux_amd64/terraform-provider-kubernetes_* && \
+    rm -f /tmp/kubernetes.zip
+
+RUN mkdir -p /root/.terraform.d/plugins/registry.terraform.io/hashicorp/random/3.1.0/linux_amd64 && \
+    curl -fsSL https://releases.hashicorp.com/terraform-provider-random/3.1.0/terraform-provider-random_3.1.0_linux_amd64.zip -o /tmp/random.zip && \
+    unzip -q /tmp/random.zip -d /root/.terraform.d/plugins/registry.terraform.io/hashicorp/random/3.1.0/linux_amd64 && \
+    chmod +x /root/.terraform.d/plugins/registry.terraform.io/hashicorp/random/3.1.0/linux_amd64/terraform-provider-random_* && \
+    rm -f /tmp/random.zip
+
+ENV TF_PLUGIN_CACHE_DIR=/root/.terraform.d/plugins
+ENV TERRAGRUNT_TFPATH=/usr/local/bin/terraform
+
+WORKDIR /workspace
diff --git a/scripts/generate-pipeline.sh b/scripts/generate-pipeline.sh
index 565a9ec..013637b 100755
--- a/scripts/generate-pipeline.sh
+++ b/scripts/generate-pipeline.sh
@@ -17,6 +17,16 @@ workflow:
     - if: '$CI_PIPELINE_SOURCE == "pipeline"'
     - when: always
 
+variables:
+  TERRAFORM_IMAGE_NAME: ${TERRAFORM_IMAGE_NAME}
+  YC_IAM_TOKEN: ${YC_IAM_TOKEN}
+  YC_STAGE_FOLDER_ID: ${YC_STAGE_FOLDER_ID}
+  YC_PROD_FOLDER_ID: ${YC_PROD_FOLDER_ID}
+  YC_PREPROD_FOLDER_ID: ${YC_PREPROD_FOLDER_ID}
+  S3_ACCESS_KEY: ${S3_ACCESS_KEY}
+  S3_SECRET_KEY: ${S3_SECRET_KEY}
+  S3_STATE_BUCKET: ${S3_STATE_BUCKET}
+
 stages:
   - validate
   - plan
@@ -56,23 +66,17 @@ find live -name "terragrunt.hcl" -not -path "*/.terragrunt-cache/*" | sort | whi
   cat >> "$OUTPUT_FILE" << EOF
 validate-${job_prefix}:
   stage: validate
+  image: \${TERRAFORM_IMAGE_NAME}
   variables:
     TG_ROOT: "${component_dir}"
     ENVIRONMENT: "${env}"
     YC_FOLDER_ID: "\${${folder_var}}"
+    YC_TOKEN: "\${YC_IAM_TOKEN}"
+    S3_ACCESS_KEY: "\${S3_ACCESS_KEY}"
+    S3_SECRET_KEY: "\${S3_SECRET_KEY}"
+    S3_STATE_BUCKET: "\${S3_STATE_BUCKET}"
+    TERRAGRUNT_TFPATH: "/usr/local/bin/terraform"
   before_script:
-    - apk add --no-cache curl unzip
-    - |
-      if [ ! -f /usr/local/bin/terragrunt ]; then
-        TERRAFORM_VERSION=1.6.0
-        TERRAGRUNT_VERSION=0.50.0
-        curl -fsSL https://releases.hashicorp.com/terraform/\${TERRAFORM_VERSION}/terraform_\${TERRAFORM_VERSION}_linux_amd64.zip -o terraform.zip
-        unzip terraform.zip -d /usr/local/bin/
-        chmod +x /usr/local/bin/terraform
-        curl -fsSL https://github.com/gruntwork-io/terragrunt/releases/download/v\${TERRAGRUNT_VERSION}/terragrunt_linux_amd64 -o /usr/local/bin/terragrunt
-        chmod +x /usr/local/bin/terragrunt
-        rm -f terraform.zip
-      fi
     - cd \${TG_ROOT}
   script:
     - terragrunt init -reconfigure -input=false --terragrunt-non-interactive
@@ -90,23 +94,17 @@ EOF
   cat >> "$OUTPUT_FILE" << EOF
 plan-${job_prefix}:
   stage: plan
+  image: \${TERRAFORM_IMAGE_NAME}
   variables:
     TG_ROOT: "${component_dir}"
     ENVIRONMENT: "${env}"
     YC_FOLDER_ID: "\${${folder_var}}"
+    YC_TOKEN: "\${YC_IAM_TOKEN}"
+    S3_ACCESS_KEY: "\${S3_ACCESS_KEY}"
+    S3_SECRET_KEY: "\${S3_SECRET_KEY}"
+    S3_STATE_BUCKET: "\${S3_STATE_BUCKET}"
+    TERRAGRUNT_TFPATH: "/usr/local/bin/terraform"
   before_script:
-    - apk add --no-cache curl unzip
-    - |
-      if [ ! -f /usr/local/bin/terragrunt ]; then
-        TERRAFORM_VERSION=1.6.0
-        TERRAGRUNT_VERSION=0.50.0
-        curl -fsSL https://releases.hashicorp.com/terraform/\${TERRAFORM_VERSION}/terraform_\${TERRAFORM_VERSION}_linux_amd64.zip -o terraform.zip
-        unzip terraform.zip -d /usr/local/bin/
-        chmod +x /usr/local/bin/terraform
-        curl -fsSL https://github.com/gruntwork-io/terragrunt/releases/download/v\${TERRAGRUNT_VERSION}/terragrunt_linux_amd64 -o /usr/local/bin/terragrunt
-        chmod +x /usr/local/bin/terragrunt
-        rm -f terraform.zip
-      fi
     - cd \${TG_ROOT}
   script:
     - terragrunt init -reconfigure -input=false --terragrunt-non-interactive
@@ -135,23 +133,17 @@ EOF
   cat >> "$OUTPUT_FILE" << EOF
 apply-${job_prefix}:
   stage: apply
+  image: \${TERRAFORM_IMAGE_NAME}
   variables:
     TG_ROOT: "${component_dir}"
     ENVIRONMENT: "${env}"
     YC_FOLDER_ID: "\${${folder_var}}"
+    YC_TOKEN: "\${YC_IAM_TOKEN}"
+    S3_ACCESS_KEY: "\${S3_ACCESS_KEY}"
+    S3_SECRET_KEY: "\${S3_SECRET_KEY}"
+    S3_STATE_BUCKET: "\${S3_STATE_BUCKET}"
+    TERRAGRUNT_TFPATH: "/usr/local/bin/terraform"
   before_script:
-    - apk add --no-cache curl unzip
-    - |
-      if [ ! -f /usr/local/bin/terragrunt ]; then
-        TERRAFORM_VERSION=1.6.0
-        TERRAGRUNT_VERSION=0.50.0
-        curl -fsSL https://releases.hashicorp.com/terraform/\${TERRAFORM_VERSION}/terraform_\${TERRAFORM_VERSION}_linux_amd64.zip -o terraform.zip
-        unzip terraform.zip -d /usr/local/bin/
-        chmod +x /usr/local/bin/terraform
-        curl -fsSL https://github.com/gruntwork-io/terragrunt/releases/download/v\${TERRAGRUNT_VERSION}/terragrunt_linux_amd64 -o /usr/local/bin/terragrunt
-        chmod +x /usr/local/bin/terragrunt
-        rm -f terraform.zip
-      fi
     - cd \${TG_ROOT}
   script:
     - terragrunt init -reconfigure -input=false --terragrunt-non-interactive