Terraform-এর মৌলিক — provider, resource, plan আর apply

terraform {
  required_version = ">= 1.9.0"

  required_providers {
    kubernetes = {
      source  = "hashicorp/kubernetes"
      version = "~> 3.4"
    }
    local = {
      source  = "hashicorp/local"
      version = "~> 2.9"
    }
  }
}

provider "kubernetes" {
  config_path    = "~/.kube/config"
  config_context = "docker-desktop"
}

$ terraform init
Initializing the backend...


Error: Unsupported Terraform Core version

  on v.tf line 2, in terraform:
   2:   required_version = ">= 2.0.0"

This configuration does not support Terraform version 1.17.1. To proceed,
either choose another supported Terraform version or update this version
constraint. …

$ terraform init
Initializing the backend...

Initializing provider plugins...
- Finding hashicorp/kubernetes versions matching "~> 3.4"...
- Finding hashicorp/local versions matching "~> 2.9"...
- Installing hashicorp/kubernetes v3.4.0...
- Installed hashicorp/kubernetes v3.4.0 (signed by HashiCorp)
- Installing hashicorp/local v2.9.1...
- Installed hashicorp/local v2.9.1 (signed by HashiCorp)

Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!
…

$ cat .terraform.lock.hcl
# This file is maintained automatically by "terraform init".
# Manual edits may be lost in future updates.

provider "registry.terraform.io/hashicorp/kubernetes" {
  version     = "3.4.0"
  constraints = "~> 3.4"
  hashes = [
    "h1:iIaKddGgcDoeG/TxxYcIOOnXNm4vkrLoLow3STxfYIs=",
    "zh:02a3156701f8eb7c43acaaf4ac136ddfe55cd86a703a5b2b54c679bf4fe25c02",
    …

$ terraform init
…
Error: Failed to query available provider packages

Could not retrieve the list of available versions for provider
hashicorp/local: locked provider registry.terraform.io/hashicorp/local 2.9.1
does not match configured version constraint ~> 2.8.0; must use terraform
init -upgrade to allow selection of new versions

data "kubernetes_namespace_v1" "team" {
  metadata {
    name = "abcl-tb"
  }
}

locals {
  namespace = data.kubernetes_namespace_v1.team.metadata[0].name
  labels = {
    app        = var.app_name
    managed-by = "terraform"
  }
}

resource "kubernetes_config_map_v1" "settings" {
  metadata {
    name      = "${var.app_name}-settings"
    namespace = local.namespace
    labels    = local.labels
  }

  data = {
    LOG_LEVEL = var.log_level
  }
}

resource "kubernetes_deployment_v1" "web" {
  metadata {
    name      = "${var.app_name}-web"
    namespace = local.namespace
    labels    = local.labels
  }

  spec {
    replicas = var.replicas

    selector {
      match_labels = local.labels
    }

    template {
      metadata {
        labels = local.labels
      }

      spec {
        container {
          name  = "web"
          image = "nginx:1.27-alpine"

          env_from {
            config_map_ref {
              name = kubernetes_config_map_v1.settings.metadata[0].name
            }
          }

          resources {
            requests = { cpu = "10m", memory = "16Mi" }
            limits   = { cpu = "100m", memory = "64Mi" }
          }
        }
      }
    }
  }
}

resource "local_file" "report" {
  filename = "${path.module}/report.txt"
  content  = "settings uid: ${kubernetes_config_map_v1.settings.metadata[0].uid}\n"
}

$ terraform state list
data.kubernetes_namespace_v1.team
kubernetes_config_map_v1.settings
kubernetes_deployment_v1.web
local_file.report

$ terraform state show kubernetes_config_map_v1.settings
# kubernetes_config_map_v1.settings:
resource "kubernetes_config_map_v1" "settings" {
    data      = {
        "LOG_LEVEL" = "info"
    }
    id        = "abcl-tb/bazar-settings"
    immutable = false

    metadata {
        generate_name    = null
        generation       = 0
        labels           = {
            "app"        = "bazar"
            "managed-by" = "terraform"
        }
        name             = "bazar-settings"
        namespace        = "abcl-tb"
        resource_version = "18539"
        uid              = "6523526f-59f7-4f35-a771-ddcbcedd0d6c"
    }
}

$ terraform graph
digraph G {
  rankdir = "RL";
  node [shape = rect, fontname = "sans-serif"];
  "data.kubernetes_namespace_v1.team" [label="data.kubernetes_namespace_v1.team"];
  "kubernetes_config_map_v1.settings" [label="kubernetes_config_map_v1.settings"];
  "kubernetes_deployment_v1.web" [label="kubernetes_deployment_v1.web"];
  "local_file.report" [label="local_file.report"];
  "kubernetes_config_map_v1.settings" -> "data.kubernetes_namespace_v1.team";
  "kubernetes_deployment_v1.web" -> "kubernetes_config_map_v1.settings";
  "local_file.report" -> "kubernetes_config_map_v1.settings";
}

resource "local_file" "release_note" {
  filename = "${path.module}/release.txt"
  content  = "web rollout finished\n"

  depends_on = [kubernetes_deployment_v1.web]
}

$ terraform apply -auto-approve
…
kubernetes_config_map_v1.settings: Creating...
kubernetes_config_map_v1.settings: Creation complete after 0s [id=abcl-tb/bazar-config-v2]
local_file.report: Creating...
local_file.report: Creation complete after 0s [id=879646a5fbcd5f724b1e6eda0721cf68c2edd43c]
kubernetes_deployment_v1.web: Creating...
kubernetes_deployment_v1.web: Creation complete after 2s [id=abcl-tb/bazar-web]
local_file.release_note: Creating...
local_file.release_note: Creation complete after 0s [id=0f62f7c476fe14dc3358807cec29ff55214f0e5a]
Apply complete! Resources: 4 added, 0 changed, 0 destroyed.

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

variable "image_id" {
  type    = string
  default = "ami-0123456789abcdef0" # fake id, use a real image
}

resource "aws_vpc" "main" {
  cidr_block = "10.20.0.0/16"
}

resource "aws_subnet" "app" {
  vpc_id     = aws_vpc.main.id
  cidr_block = "10.20.1.0/24"
}

resource "aws_instance" "web" {
  ami           = var.image_id
  instance_type = "t3.micro"
  subnet_id     = aws_subnet.app.id
}

variable "app_name" {
  type        = string
  description = "Short name of the app"
  default     = "bazar"
}

variable "replicas" {
  type    = number
  default = 1

  validation {
    condition     = var.replicas >= 1 && var.replicas <= 6
    error_message = "replicas must be between 1 and 6."
  }
}

variable "log_level" {
  type    = string
  default = "info"
}

output "deployment_name" {
  description = "Name of the web Deployment"
  value       = kubernetes_deployment_v1.web.metadata[0].name
}

output "settings_uid" {
  value = kubernetes_config_map_v1.settings.metadata[0].uid
}

$ terraform plan -input=false
Error: No value for required variable

  on main.tf line 21:
  21: variable "tier" {

The root module input variable "tier" is not set, and has no default value.
Use a -var or -var-file command line argument to provide a value for this
variable.

$ terraform plan -var replicas=three
…
Error: Invalid value for input variable

  on main.tf line 6:
   6: variable "replicas" {

Unsuitable value for var.replicas set using -var="replicas=...": a number is
required.

$ terraform plan -var replicas=9
…
Error: Invalid value for variable

  on main.tf line 6:
   6: variable "replicas" {
    ├────────────────
    │ var.replicas is 9

replicas must be between 1 and 6.

This was checked by the validation rule at main.tf:10,3-13.

variable "api_token" {
  type      = string
  sensitive = true
  default   = "fake-token-123"
}

output "token_for_tool" {
  value     = var.api_token
  sensitive = true
}

$ terraform output
token_for_tool = <sensitive>

$ grep -n 'fake-token' terraform.tfstate
8:      "value": "fake-token-123",

// Which value does one variable get? Later in this order wins.
// rank: default 0, env 1, terraform.tfvars 2, .tfvars.json 3,
//       *.auto.tfvars 4 (sorted by file name), command line 5.
const RANK = { default: 0, env: 1, tfvars: 2, tfvarsJson: 3, auto: 4, cli: 5 };

function resolve(sources) {
  const sorted = sources
    .map((s, i) => ({ ...s, i }))
    .sort((a, b) => RANK[a.kind] - RANK[b.kind]
      || (a.kind === "auto" ? a.file.localeCompare(b.file) : a.i - b.i));
  return sorted[sorted.length - 1];
}
const d = { kind: "default", value: "from-default" };
const env = { kind: "env", value: "from-env" };
const tf = { kind: "tfvars", value: "from-tfvars" };
const js = { kind: "tfvarsJson", value: "from-tfvars-json" };
const a = { kind: "auto", file: "a.auto.tfvars", value: "from-a-auto" };
const b = { kind: "auto", file: "b.auto.tfvars", value: "from-b-auto" };
const cli = { kind: "cli", value: "from-cli" };
const file = { kind: "cli", value: "from-prod-file" };

const CASES = [
  ["default only", [d]],
  ["env added", [d, env]],
  ["env + tfvars", [d, env, tf]],
  ["env + tfvars + json", [d, env, tf, js]],
  ["two auto files", [d, env, tf, js, b, a]],
  ["-var-file then -var", [d, env, b, file, cli]],
  ["-var then -var-file", [d, env, b, cli, file]],
];
for (const [name, sources] of CASES) {
  console.log(name.padEnd(24) + resolve(sources).value);
}

$ terraform fmt -diff
main.tf
--- old/main.tf
+++ new/main.tf
@@ -1,4 +1,4 @@
 resource "local_file" "note" {
-filename="${path.module}/note.txt"
-    content = "hello"
+  filename = "${path.module}/note.txt"
+  content  = "hello"
 }

$ terraform validate             # filename-এর বানান ভুল করে লেখা হয়েছে
Error: Missing required argument
…
Error: Unsupported argument

  on main.tf line 2, in resource "local_file" "note":
   2:   filenam = "${path.module}/note.txt"

An argument named "filenam" is not expected here. Did you mean "filename"?

$ terraform plan -out=up.tfplan
…
Plan: 0 to add, 1 to change, 0 to destroy.

$ terraform apply -auto-approve -var replicas=1
…
Apply complete! Resources: 0 added, 1 changed, 0 destroyed.

$ terraform apply up.tfplan

Error: Saved plan is stale

The given plan file can no longer be applied because the state was changed by
another operation after the plan was created.

$ terraform apply -auto-approve
…
Plan: 2 to add, 0 to change, 0 to destroy.
kubernetes_config_map_v1.first: Creating...
kubernetes_config_map_v1.first: Creation complete after 0s [id=abcl-tb/demo-first]
kubernetes_config_map_v1.second: Creating...

Error: configmaps "demo-second" already exists

  with kubernetes_config_map_v1.second,
  on main.tf line 8, in resource "kubernetes_config_map_v1" "second":
   8: resource "kubernetes_config_map_v1" "second" {

$ terraform state list
kubernetes_config_map_v1.first

// Reads the action symbol of each resource line in a plan.
// Paste header lines from a plan; the sample is shortened.
const planText = `
  + resource "kubernetes_config_map_v1" "ledger" {
  ~ resource "kubernetes_deployment_v1" "web" {
-/+ resource "kubernetes_config_map_v1" "settings" {
+/- resource "kubernetes_service_v1" "api" {
  - resource "local_file" "release_note" {
 <= data "kubernetes_namespace_v1" "team" {
`;
const MEAN = {
  "+":   ["create", 1, 0, 0],
  "~":   ["update in-place", 0, 1, 0],
  "-":   ["destroy", 0, 0, 1],
  "-/+": ["destroy, then create", 1, 0, 1],
  "+/-": ["create, then destroy", 1, 0, 1],
  "<=":  ["read only", 0, 0, 0],
};
const WATCH = ["ledger", "database", "volume"]; // never lose these

let add = 0, change = 0, destroy = 0;
for (const line of planText.split("\n")) {
  const m = line.match(/^\s*(\S+)\s+(?:resource|data)\s+"(\S+)"\s+"(\S+)"/);
  if (!m || !MEAN[m[1]]) continue;
  const [text, a, c, d] = MEAN[m[1]];
  add += a; change += c; destroy += d;
  const risky = d > 0 && WATCH.some(w => m[3].includes(w));
  console.log(m[1].padEnd(4) + (m[2] + "." + m[3]).padEnd(42) + text +
    (risky ? "  << STOP, stateful" : ""));
}
console.log("Plan: " + add + " to add, " + change + " to change, " + destroy + " to destroy.");

$ terraform plan
…
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # kubernetes_config_map_v1.settings must be replaced
-/+ resource "kubernetes_config_map_v1" "settings" {
      - binary_data = {} -> null
      ~ id          = "abcl-tb/bazar-settings" -> (known after apply)
      - immutable   = false -> null
        # (1 unchanged attribute hidden)

      ~ metadata {
          - annotations      = {} -> null
          ~ generation       = 0 -> (known after apply)
          ~ name             = "bazar-settings" -> "bazar-config" # forces replacement
          ~ resource_version = "18680" -> (known after apply)
          ~ uid              = "6523526f-59f7-4f35-a771-ddcbcedd0d6c" -> (known after apply)
            # (3 unchanged attributes hidden)
        }
    }
…
Plan: 2 to add, 1 to change, 2 to destroy.

variable "branches" {
  type    = list(string)
  default = ["dhaka", "khulna", "sylhet"]
}

resource "kubernetes_config_map_v1" "by_count" {
  count = length(var.branches)

  metadata {
    name      = "c-${var.branches[count.index]}"
    namespace = "abcl-tb"
  }

  data = {
    BRANCH = var.branches[count.index]
  }
}

resource "kubernetes_config_map_v1" "by_each" {
  for_each = toset(var.branches)

  metadata {
    name      = "e-${each.key}"
    namespace = "abcl-tb"
  }

  data = {
    BRANCH = each.value
  }
}

variable "branch_replicas" {
  type = map(number)
  default = {
    dhaka  = 3
    khulna = 1
  }
}

resource "local_file" "branch" {
  for_each = var.branch_replicas

  filename = "${path.module}/${each.key}.txt"
  content  = "replicas=${each.value}\n"
}

output "branch_files" {
  value = [for f in local_file.branch : f.filename]
}

$ terraform apply -auto-approve
…
Apply complete! Resources: 2 added, 0 changed, 0 destroyed.

Outputs:

branch_files = [
  "./dhaka.txt",
  "./khulna.txt",
]

$ terraform state list
local_file.branch["dhaka"]
local_file.branch["khulna"]

// count vs for_each: which instances does a list edit touch?
// Edit the two lists and run again.
const before = ["dhaka", "khulna", "sylhet"];
const after  = ["dhaka", "sylhet"];

function countPlan(a, b) {
  const lines = [];
  for (let i = 0; i < Math.max(a.length, b.length); i++) {
    const addr = "by_count[" + i + "]";
    if (i >= b.length) lines.push(["-", addr, a[i] + " (index out of range)"]);
    else if (i >= a.length) lines.push(["+", addr, b[i]]);
    else if (a[i] !== b[i]) lines.push(["-/+", addr, a[i] + " -> " + b[i]]);
  }
  return lines;
}
function eachPlan(a, b) {
  const lines = [];
  for (const k of a) if (!b.includes(k)) lines.push(["-", 'by_each["' + k + '"]', k]);
  for (const k of b) if (!a.includes(k)) lines.push(["+", 'by_each["' + k + '"]', k]);
  return lines;
}
function show(title, lines) {
  let add = 0, del = 0;
  console.log(title);
  for (const [sym, addr, note] of lines) {
    console.log("  " + sym.padEnd(4) + addr.padEnd(22) + note);
    if (sym !== "-") add++;
    if (sym !== "+") del++;
  }
  console.log("  Plan: " + add + " to add, 0 to change, " + del + " to destroy.\n");
}
show("count (identity = position)", countPlan(before, after));
show("for_each (identity = key)", eachPlan(before, after));

resource "kubernetes_config_map_v1" "ledger" {
  metadata {
    name      = "${var.app_name}-ledger"
    namespace = local.namespace
  }

  data = {
    OWNER = "finance"
  }

  lifecycle {
    prevent_destroy = true
  }
}

$ terraform destroy -auto-approve
…
Plan: 0 to add, 0 to change, 5 to destroy.
…
Error: Instance cannot be destroyed

  on main.tf line 80:
  80: resource "kubernetes_config_map_v1" "ledger" {

Resource kubernetes_config_map_v1.ledger has lifecycle.prevent_destroy set,
but the plan calls for this resource to be destroyed. To avoid this error and
continue with the plan, either disable lifecycle.prevent_destroy or reduce
the scope of the plan using the -target option.

$ terraform plan                 # ledger block পুরোটাই ফাইল থেকে মুছে
…
  # kubernetes_config_map_v1.ledger will be destroyed
  # (because kubernetes_config_map_v1.ledger is not in configuration)
…
Plan: 0 to add, 0 to change, 1 to destroy.

$ terraform destroy -auto-approve
…
local_file.report: Destruction complete after 0s
local_file.release_note: Destruction complete after 0s
kubernetes_config_map_v1.ledger: Destruction complete after 0s
kubernetes_deployment_v1.web: Destruction complete after 0s
kubernetes_config_map_v1.settings: Destruction complete after 0s
Destroy complete! Resources: 5 destroyed.

$ terraform plan
…
No changes. Your infrastructure matches the configuration.

$ kubectl get deploy bazar-web
NAME        READY   UP-TO-DATE   AVAILABLE   AGE
bazar-web   1/2     2            1           45s