Control order, lifecycle and custom conditions

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Afhankelijkheden, lifecycle en eigen condities

Know implicit dependencies

A reference (azurerm_subnet.web.id) makes an implicit dependency: the subnet is created first, destroyed last.

$terraform graph | grep -- '->' | head

6.2

Add explicit dependencies

depends_on forces an order when there is no reference — for example, a VM extension that needs a firewall rule created first.

app.tf

resource "azurerm_linux_virtual_machine" "app" {
  # ...
  depends_on = [azurerm_network_security_rule.allow_outbound_repo]
}

Onthoud

Use depends_on only when a hidden dependency exists. Too many explicit dependencies slow the plan and hide the real design.

6.3

Change behaviour with lifecycle

The lifecycle block changes how Terraform creates, replaces and deletes a resource.

db.tf

resource "azurerm_postgresql_flexible_server" "db" {
  # ...
  lifecycle {
    prevent_destroy       = true
    create_before_destroy = false
    ignore_changes        = [tags["last_backup"]]
    replace_triggered_by  = [terraform_data.db_version]
  }
}

Setting	Effect
`create_before_destroy`	Make the new resource first, then delete the old (less downtime)
`prevent_destroy`	Any plan that would destroy it fails
`ignore_changes`	Do not "fix" changes made outside Terraform to these attributes
`replace_triggered_by`	Replace this resource when another one changes

6.4

Check values with custom conditions

Validation checks variables. Preconditions and postconditions check resources and data before or after they are used. A check block reports problems without stopping the apply.

conditions.tf

variable "vm_size" {
  type = string
  validation {
    condition     = can(regex("^Standard_(B|D)", var.vm_size))
    error_message = "Only B and D series sizes are allowed."
  }
}
 
data "azurerm_subnet" "web" {
  name                 = "snet-web"
  virtual_network_name = "vnet-app"
  resource_group_name  = "rg-shared"
  lifecycle {
    postcondition {
      condition     = self.address_prefixes[0] != "10.0.0.0/24"
      error_message = "This subnet uses a reserved range."
    }
  }
}
 
check "site_up" {
  data "http" "shop" {
    url = "https://shop.example.com/health"
  }
  assert {
    condition     = data.http.shop.status_code == 200
    error_message = "The shop health check does not return 200."
  }
}

Kind	Where	Failure
`validation`	In a variable	Stops the plan
`precondition` / `postcondition`	In `lifecycle` of a resource, data source or output	Stops the plan or apply
`check` block	Top level	Only a warning

Examentip

Know the difference: conditions block a run; a check block only warns.

Alle commando's in dit hoofdstuk