How to pass docker swarm join-token using Terraform

Heya,

an update on an old question in case anyone stumbles upon it

In order to get the join token from the manager node and use it for the worker node in Terraform, you can use the Terraform’s null_resource and the local-exec provisioner along with the remote-exec provisioner.

The local-exec provisioner invokes a local executable after a resource is created and the remote-exec provisioner invokes a remote command. This can be used to extract the swarm join token from the manager node and store it as a file.

Here’s how you can do it:

1. First, get the join token from the manager node and store it in a file.

resource "null_resource" "get_swarm_token" {
  depends_on = [digitalocean_droplet.manager1]

  provisioner "remote-exec" {
    inline = ["docker swarm join-token worker -q | tee swarm-worker-token.txt"]
    connection {
      host        = digitalocean_droplet.manager1.ipv4_address
      type        = "ssh"
      user        = "root"
      private_key = file("~/.ssh/id_rsa")
    }
  }
}

2. Next, use the local-exec provisioner to read the token from the file and store it in an environment variable. Then use that environment variable in the remote-exec for the worker node.

resource "digitalocean_droplet" "worker1" {
  image  = "docker-20-04"
  name   = "worker1"
  region = "nyc1"
  size   = "s-1vcpu-1gb"
  ssh_keys = [
    var.ssh_fingerprint
  ]

  provisioner "local-exec" {
    command = "export WORKER_TOKEN=$(cat swarm-worker-token.txt)"
  }

  provisioner "remote-exec" {
    inline = [
      "sudo ufw allow 2377,7946/tcp",
      "sudo ufw allow 4789,7946/udp",
      "docker swarm join --token $WORKER_TOKEN ${digitalocean_droplet.manager1.ipv4_address_private}:2377"
    ]
  }
}

Please replace the connection parameters and other specifics with your own.

This method will work if the Terraform script is being run on the same machine as the manager node. If you’re running Terraform from a different machine, you’ll need to adjust the solution to copy the token file to that machine using scp or another method.