طريقة البحث

الكلمات العادية تجد الأسماء والنصوص والأمثلة.
"كلمتان" تجد العبارة بالضبط.
--name أو -x تجد خيارًا.
#كلمة تبحث داخل الأوامر فقط.
@grep تجد الدروس والمعامل التي تستخدم grep.
الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

`terraform`

Describe cloud and on-prem infrastructure in code (HCL), see the plan, and apply it the same way every time.

المستوى: خدمة DevSecOps
المجموعة: البنية التحتية ككود والسحابة
يحتاج root: لا
الحزمة: terraform

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

Terraform reads .tf files, compares them with the state (what it built before) and the real world, and makes a plan: what to create, change or destroy. apply runs the plan through providers (azurerm, aws, kubernetes, github, …). The same code builds dev, test and prod. OpenTofu (tofu) is the open-source fork with the same commands.

The state file holds every resource ID and often secrets; keep it in a remote backend (Azure Storage, S3, HCP Terraform) with locking — never in Git.

طريقة الكتابة

terraform [-chdir=DIR] COMMAND [OPTIONS]
terraform init && terraform plan -out tfplan && terraform apply tfplan

الأجزاء الرئيسية

Main commands

init: Download providers and modules, set up the backend.
fmt [-recursive]: Format the code.
validate: Check syntax and types.
plan [-out FILE]: Show what will change.
apply [FILE]: Make the changes.
destroy: Delete everything in this configuration.
output [NAME]: Show output values.
state list|show|mv|rm: Read or change the state.
import ADDR ID: Bring an existing resource under Terraform.
workspace new|select|list: Several states for one configuration.
providers lock: Write provider hashes for more platforms.
console: Try expressions.
graph: Dependency graph (DOT format).
force-unlock ID: Remove a stuck state lock (careful).
test: Run .tftest.hcl tests.

الخيارات 10

الأكثر استخدامًا

Common flags

-var 'name=value' / -var-file=FILE: Set input variables.
-out=FILE: Save the plan to apply exactly that later.
-target=ADDR: Work on one resource only (emergencies).
-replace=ADDR: Force re-creation of one resource.
-refresh-only: Only update the state from the real world (drift).
-auto-approve: No question (CI only, after a reviewed plan).
-upgrade: Update providers within the version limits (init).
-backend-config=FILE: Backend settings (init).
-detailed-exitcode: Exit 2 when the plan has changes (CI drift checks).
-json: Machine-readable output.

أمثلة 11

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1The daily loop

$terraform init
$terraform fmt -recursive
$terraform validate
$terraform plan -out tfplan
$terraform apply tfplan

2A small Azure configuration

$cat main.tf
terraform {
  required_version = ">= 1.9"
  required_providers {
    azurerm = { source = "hashicorp/azurerm", version = "~> 4.0" }
  }
  backend "azurerm" {
    resource_group_name  = "rg-tfstate"
    storage_account_name = "sts0statfstate"
    container_name       = "tfstate"
    key                  = "lab.tfstate"
  }
}
provider "azurerm" { features {} }
resource "azurerm_resource_group" "lab" {
  name     = "rg-lab-weu"
  location = "westeurope"
  tags     = { owner = "s0sta", env = "lab" }
}

3Use variables per environment

$cat prod.tfvars
location = "westeurope"
vm_size  = "Standard_B2s"
$terraform plan -var-file=prod.tfvars -out tfplan

4Read outputs

$terraform output
$terraform output -raw vm_public_ip

5Look into the state

$terraform state list
$terraform state show azurerm_resource_group.lab

6Rename a resource without destroying it

$cat moved.tf
moved {
  from = azurerm_resource_group.lab
  to   = azurerm_resource_group.main
}
$terraform plan

7Import an existing resource

$cat import.tf
import {
  to = azurerm_resource_group.old
  id = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-old"
}
$terraform plan -generate-config-out=generated.tf

8Find drift in CI
```
$terraform plan -detailed-exitcode -lock=false
$echo $?
2
```
0 = no changes, 1 = error, 2 = changes (drift or new code).

9Use a module

$cat network.tf
module "vnet" {
  source  = "Azure/avm-res-network-virtualnetwork/azurerm"
  version = "0.7.1"
  name                = "vnet-lab"
  resource_group_name = azurerm_resource_group.lab.name
  location            = "westeurope"
  address_space       = ["10.20.0.0/16"]
}

10Scan the code for security problems
```
$trivy config .
$checkov -d .
```
11Clean up a lab
```
$terraform destroy -var-file=lab.tfvars
```

انتبه

Never commit *.tfstate, .terraform/ or *.tfvars with secrets; add them to .gitignore.
Commit .terraform.lock.hcl — it pins provider versions and hashes.
Review every plan: a changed name can mean "destroy and create" (data loss).
Mark secret variables and outputs sensitive = true (they are still in the state in clear text).

الملفات

*.tf: The configuration.
terraform.tfstate: Local state (use a remote backend instead).
.terraform.lock.hcl: Provider versions and hashes (commit it).
.terraform/: Downloaded providers and modules (do not commit).
~/.terraformrc: CLI settings (plugin cache, credentials).

نصائح للحفظ

In CI: plan on every PR (post it as a comment), apply the saved plan only after merge and approval.
Use OIDC (workload identity federation) for CI logins to Azure — no client secrets.

رموز الخروج

`0`	Success (no changes with -detailed-exitcode).
`1`	Error.
`2`	Plan has changes (only with -detailed-exitcode).

الدليل الكامل

هذه الصفحة تشرح الأمر بكلمات بسيطة. الدليل الأصلي فيه كل التفاصيل.

في الطرفية: man terraform

افتح صفحة man (linux.die.net)developer.hashicorp.com

terraform