Use the core workflow from init to destroy

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

init, validate, plan, apply, destroy en fmt

Know the workflow

Write the code, preview the changes, apply them — in a team through pull requests.

Step	Command	Does
Write	(editor)	Describe the wanted infrastructure
Init	`terraform init`	Download providers and modules, set up the backend
Validate	`terraform validate`	Check syntax and references
Plan	`terraform plan`	Show what would change
Apply	`terraform apply`	Make the changes
Destroy	`terraform destroy`	Delete everything in this configuration

3.2

Initialise a working directory

init prepares the folder. Run it first, and again after you add providers, modules or change the backend.

$terraform init
Initializing the backend...
Initializing provider plugins...
- Installing hashicorp/azurerm v4.20.0...
Terraform has been successfully initialized!
$terraform init -upgrade
$terraform init -reconfigure
$terraform init -migrate-state
$ls -a
.terraform  .terraform.lock.hcl  main.tf  variables.tf

Option	Use
`-upgrade`	Get newer provider/module versions within the constraints
`-reconfigure`	Use the backend settings again, ignore the saved ones
`-migrate-state`	Move existing state to a new backend
`-backend-config=FILE`	Give backend settings from a file (partial configuration)

3.3

Validate and format

validate finds errors without contacting the cloud. fmt rewrites files in the standard style.

$terraform fmt
$terraform fmt -recursive
$terraform fmt -check -diff
$terraform validate
Success! The configuration is valid.

Op het werk

In CI, run terraform fmt -check and terraform validate on every pull request — they fail the pipeline when someone forgot.

3.4

Plan the changes

plan compares code, state and the real world, and lists every change: + create, ~ update in place, -/+ replace, - destroy.

$terraform plan
  # azurerm_resource_group.web will be created
  + resource "azurerm_resource_group" "web" {
      + location = "westeurope"
      + name     = "rg-web-dev"
    }
Plan: 1 to add, 0 to change, 0 to destroy.
$terraform plan -out=tfplan
$terraform plan -var-file=prod.tfvars
$terraform plan -target=azurerm_resource_group.web
$terraform plan -refresh-only
$terraform plan -destroy

Let op

Read every -/+ (replace) line. Replacing a database or a disk means the old one is deleted.

3.5

Apply the changes

apply runs a plan and asks for yes. Applying a saved plan file runs exactly that plan, without asking.

$terraform apply
$terraform apply tfplan
$terraform apply -auto-approve
$terraform apply -replace=azurerm_linux_virtual_machine.web
$terraform output

Onthoud

In pipelines: plan -out=tfplan in one step (a person reviews it), then apply tfplan in the next — what was approved is what is applied.

3.6

Destroy infrastructure

destroy deletes all resources in the state of this configuration.

$terraform plan -destroy
$terraform destroy
$terraform destroy -target=azurerm_linux_virtual_machine.test

Op het werk

Use prevent_destroy = true in the lifecycle block of critical resources (databases, key vaults). Terraform then refuses to plan their deletion.

3.7

Use the CLI helpers

A few more commands help every day.

$terraform console
> cidrsubnet("10.20.0.0/16", 8, 2)
"10.20.2.0/24"
$terraform graph | dot -Tpng > graph.png
$terraform show tfplan
$terraform show -json tfplan | jq '.resource_changes[].change.actions'

Alle commando's in dit hoofdstuk