How to build CICD pipeline for non-interactive cdktf deployment

In a situation whereby my deployment pipeline does not have an interactive shell to run cdktf deploy interactively, how could I get the proper diff/plan of the deployment when running with --auto-approve?

Current approach:
Preview the diff first by running cdktf diff on affected stacks then run deploy with auto approve on all affected stacks.
E.g. stack A depend on stack B depend on stack C.
Want to deploy stack A

  1. Run cdktf synth to get dependency chain of stackA from manifest.json
  2. For each affected stacks in dependency chain, run cdktf diff {stack}
  3. Verify diff. Run cdktf deploy --auto-approve stackA stackB stackC

Problem:
cdktf diff command does not take in multiple stacks as argument and thus unable to resolve dependency. In a situation where you are diffing stack A, if stack A depends on a newly exposed variable on stack B. it would be impossible to diff stack A unless stack B is deployed and exposed the variable first.

One solution for this would be to do a two step deployment and deploy stack B first but I wonder if cdktf is able to resolve this kind of diffing dependency.

Any help or suggestion to craft the deployment pipeline is appreciated. Thanks!

if you are using CI/CD to deploy stacks, you can describe which set of stacks(stackA) to be deployed first and then others(StackB).

QQ: how are you adding dependency in the code so that “stack A depend on stack B depend on stack C.”

I got no issues with deployment as cdktf is smart enough to resolve dependency during deploy but not diff. i.e. cdktf deploy stackA stackB stackC would work in any order of invocation.

There are 2 ways to add dependency in code from what i know. Implicit dependency whereby stack A uses some exposed variables on stack B. Or explicit dependency where you do stackA.addDependency(stackB)

I understand your concern. for me, I resolved it in Ci/CD (I am using github actions) by explicitly defining for which stack it has to do diff in sequential way.

Eg:
terraform diff stackA
terraform diff StackB
terraform diff StackC

I know this is not the most optimum solution but it works for me.

Unable to perform cdktf diff when using multiple stacks with inter-stack dependencies · Issue #2157 · hashicorp/terraform-cdk · GitHub discusses this topic more. Short version is that a stack which is depended upon by others must currently be deployed before dependent stacks can be diffed. There is a possible path towards removing this restriction; however, I don’t believe it is being actively worked on.