Managing multiple organizations

[lmilbaum]

i'd like to manage multiple organizations. How do I go about it without duplicating the code?

[dion-gionet]

If you want to use mostly the same code you can use Terraform workspaces with tfvars to configure the github provider owner per organization

[lmilbaum]

Thanks @dion-gionet for your suggestion. This option was considered. Eventually I have used the alias feature.

[testworksau]

I'm quite curious about this too; we are on GitHub Enterprise Cloud (GHEC) and would like to set up different organisations underneath the Enterprise, each with a common set of teams (eg. infosec and admins) and other teams that would only exist in a given org.

I'd like to have one deployment repo with the relevant, shared terraform inside.

I can create multiple resource "github_enterprise_organization" blocks but other resources like teams don't seem to be tied to a given organisation.

Is the recommended approach to structure the code with an alias per organisation and a module per github provider alias?

[testworksau]

@lmilbaum would you mind sharing a little more about how you tackled this, & how you landed on alias being a better fit?

[veronluc-ansys]

@testworksau I am curious. Is github_enterprise_organization compatible with github enterprise cloud? Did you manage to make organization management with it in the end?

[testworksau]

Hi @veronluc-ansys 👋🏼

Yes, it's compatible with GHEC however it doesn't work particularly well:

#1695

We ended up ditching the usage of this resource, opting instead to create our organisations manually, and then adding modules for each organisation with their own github_organization_settings and other entities.

It's a bit of a mess and there's likely a better way, but here's what our config roughly looks like.

provider.tf

terraform {
  required_providers {
    github = {
      source  = "integrations/github"
      version = "~> 6.2.0"
    }
  }
}

# The default provider, which is only used to get the enterprise id
provider "github" {
  token = var.github_access_token
}

# Each module requires its own provider definition to be passed in at
# module initialisation, due to a clash in the provider (it used to be
# in the Hashicorp namespace but is now in the owned by GitHub)
provider "github" {
  alias = "our_sandpit1"
  owner = "our-sandpit1"
  token = var.github_access_token
}

provider "github" {
  alias = "our_sandpit2"
  owner = "our-sandpit2"
  token = var.github_access_token
}

main.tf

module "our-sandpit1" {
  source = "./modules/org-our-sandpit1"

  providers = {
    github = github.our_sandpit1
  }

  github_access_token       = var.github_access_token
  github_org_administrators = var.github_default_administrators
  github_org_billing_email  = var.github_billing_email
}

module "our-sandpit2" {
  source = "./modules/org-our-sandpit2"

  providers = {
    github = github.our_sandpit2
  }

  github_access_token       = var.github_access_token
  github_org_administrators = var.github_default_administrators
  github_org_billing_email  = var.github_billing_email
}

We have a common github settings module for admins, org security managers etc. that we defined under:
modules/common_github_settings/

And then we have the org specific settings defined under modules/org-.

Each module we have redefines the provider.tf:

# When a child module uses a provider outside of the Hashicorp namespace,
# you are required to duplicate the the entire terraform { required_providers { } }
# code block in every module where that provider is used, regardless if it’s already
# in the root module’s main.tf file.

terraform {
  required_providers {
    github = {
      source  = "integrations/github"
      version = "~> 6.2.0"
    }
  }
}

The main.tf in each org specific module loads the common_github_settings module:

module "common_github_settings" {
  source = "../../modules/common_github_settings"

  providers = {
    github = github
  }

  github_enterprise_organization = local.organization_name
  github_access_token            = var.github_access_token
  github_administrators          = var.github_org_administrators
}

Finally each module uses the github tf provider resources etc. as desired.

Hope this helps you / someone as it was a bit of a painful experience getting this sorted.