📜 शाळेच्या पद्धतीने Terraform शिका

# the 60-second wow — one set of plans, one register, one contractor:
git clone https://github.com/BaluRaut/learn-terraform-school.git && cd learn-terraform-school
python3 iac/demo.py               # 12 lessons: plans, diffs, registers, locks, drift, pipelines
python3 iac/test_iac.py           # 12 checks across the lessons

तुम्हाला काय दिसायला हवे (छाटलेले — यश असे दिसते):

═══ why ═══
── the works office builds the same campus 3 times BY HAND (8 fields per site, 10% chance of a slip per field)
   dev      8 fields typed · 5 objects · slips: none
   staging  8 fields typed · 5 objects · slips: none
   prod     8 fields typed · 5 objects · slips: floor typed 20 instead of 2
   do the 3 hand-built sites match? False
── the same campus from WRITTEN PLANS (a config), applied to 3 empty sites
   each site: Apply complete! Resources: 5 added, 0 changed, 0 destroyed.
   do the 3 plan-built sites match? True
── apply the same plans to the dev site again → No changes. Your infrastructure matches the configuration.
   plans are text: reviewed in a pull request, kept in git, repeatable — clicks are none of these

═══ resources ═══
── the plans, in HCL (the lab keeps the same thing as a Python dict):
   resource "school_room" "lab" {
     name = "chem-lab"
     floor = 2
     seats = 30
   }
── the provider's schema for school_room (what the plans may say, and what the campus fills in):
   name   required · string
   floor  default 1 · number · forces a new room if changed
   seats  default 30 · number
   tags   default {} · map
   id     computed · string
── apply → Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
   the provider called the campus API: ['POST /rooms → room-01']
   school_room.lab is now id room-01 · attributes {'name': 'chem-lab', 'floor': 2, 'seats': 30, 'tags': {}, 'id': 'room-01'}

═══ plan ═══
── version 1 of the plans: lab, art room, main gate → Apply complete! Resources: 3 added, 0 changed, 0 destroyed.
── version 2: lab seats 30 → 40 · art room moves to floor 3 · the gate is removed · a library is added
     ~ school_room.lab  seats: 30 → 40
   -/+ school_room.art  floor: 1 → 3  # forces replacement
     + school_room.library (create)
     - school_gate.main (destroy)
   Plan: 2 to add, 1 to change, 2 to destroy.
── apply → Apply complete! Resources: 2 added, 1 changed, 2 destroyed.
   the art room is a NEW object: room-02 → room-03 · the lab kept its id room-01
   ~ update in place keeps the object · -/+ replace destroys it and builds a new one (floor is ForceNew)

═══ variables ═══
── defaults (env=dev, seats=30) → Apply complete! Resources: 4 added, 0 changed, 0 destroyed.
   output lab_name = "dev-school-lab"
   output locker_ids = ["locker-01", "locker-02", "locker-03"]
── -var env=prod -var seats=40 → ~ school_room.lab  name: 'dev-school-lab' → 'prod-school-lab' · seats: 30 → 40
── count: remove 'b' from [a, b, c] → ~ school_locker.row[1]  label: 'b' → 'c' · - school_locker.row[2] (destroy) → Plan: 0 to add, 1 to change, 1 to destroy.
── for_each over [a, b, c] makes school_locker.row["a"], school_locker.row["b"], school_locker.row["c"]
── for_each: remove 'b' → - school_locker.row["b"] (destroy) → Plan: 0 to add, 0 to change, 1 to destroy.
   count keys by POSITION, so removing the middle item shifts the rest · for_each keys by NAME

═══ state ═══
── apply the campus → Apply complete! Resources: 5 added, 0 changed, 0 destroyed.
   output lab_id = "room-01"
   output code_a = <sensitive>
── the register (state): version 4 · serial 1 · lineage campus-3f9a · 5 resources
   {"school_locker.a": {"type": "school_locker", "id": "locker-01", "attrs": {"room_id": "room-01", "label": "a", "size": "m", "id": "locker-01", "combination": "6872"}, "deps": ["school_room.lab"]}}
   search the state for 'combination' → ['school_locker.a: 6872', 'school_locker.b: 4434', 'school_locker.c: 4123']
   sensitive = true hides a value in plan and output — the state still holds it in plain text
── the register is lost; plan with an empty one → Plan: 5 to add, 0 to change, 0 to destroy.
   after apply the campus has 2 rooms named ['chem-lab'] and 10 objects — duplicates, not the same campus

═══ graph ═══
── edges (a → b means a must exist first):
   school_room.lab → school_gate.main
   school_room.lab → school_locker.row[0]
   school_room.library → school_gate.back
   school_gate.main → school_gate.back   (explicit depends_on)
   school_room.lab → school_locker.row[1..3]   (same as row[0])
── parallelism 10: 3 steps for 8 resources → [2, 5, 1] per step
   step 1: school_room.lab, school_room.library
   step 2: school_gate.main, school_locker.row[0], school_locker.row[1], school_locker.row[2], school_locker.row[3]
   step 3: school_gate.back
── parallelism  2: 4 steps for 8 resources → [2, 2, 2, 2] per step
── parallelism  1: 8 steps for 8 resources
── destroy runs the graph backwards:
   step 1: school_locker.row[0], school_locker.row[1], school_locker.row[2], school_locker.row[3], school_gate.back
   step 2: school_room.library, school_gate.main
   step 3: school_room.lab
── a gate that needs a locker that needs the gate → Error: Cycle: school_gate.g, school_locker.l

═══ modules ═══
── one module (modules/wing: a hall, a gate, N lockers), called twice:
   module "east" { source = "./modules/wing", wing = "east" }
   module "west" { source = "./modules/wing", wing = "west", lockers = 3 }
   output "east_gate" { value = module.east.gate_id }
   output "west_hall" { value = module.west.hall_id }
   Plan: 9 to add, 0 to change, 0 to destroy.
   module.east: school_room.this, school_gate.this, school_locker.row[0], school_locker.row[1]
   module.west: school_room.this, school_gate.this, school_locker.row[0], school_locker.row[1], school_locker.row[2]
── apply → Apply complete! Resources: 9 added, 0 changed, 0 destroyed.
   output east_gate = "gate-01"
   output west_hall = "room-02"
── west asks for 4 lockers → + module.west.school_locker.row[3] (create) → Plan: 1 to add, 0 to change, 0 to destroy.
   the module is written once; each call gets its own inputs, addresses and outputs

═══ locking ═══
── NO lock · the register holds the lab (serial 1) · Katrina adds a gym, Dipika adds a library, at the same time
   both read serial 1 · Katrina: Plan: 1 to add, 0 to change, 0 to destroy. · Dipika: Plan: 1 to add, 0 to change, 0 to destroy.
   both wrote serial 2; Dipika wrote last → the register knows ['school_room.lab', 'school_room.library']
   the campus has 3 rooms, the register knows 2 → orphan: ['gym'] — built, paid for, managed by nobody
── WITH lock · the register holds the lab (serial 1) · Katrina adds a gym, Dipika adds a library, at the same time
   Katrina takes the lock (lock-0001) and plans + applies
   Dipika → Error acquiring the state lock · Lock Info: ID lock-0001 · Path campus.tfstate · Operation OperationTypeApply · Who katrina@works-office
   Katrina is done (serial 2); Dipika gets lock-0002, reads the NEW register → Plan: 1 to add, 0 to change, 1 to destroy.  ← her branch lacks the gym
   she pulls Katrina's change first → Plan: 1 to add, 0 to change, 0 to destroy.
   Apply complete! Resources: 1 added, 0 changed, 0 destroyed. serial 3 · campus rooms 3 = register 3
   one register in one shared place, one writer at a time

═══ drift ═══
── Dipika clicks in the console: room-01 seats 30 → 45 (no plans changed, no register changed)
   plan -refresh-only → ['school_room.lab has changed outside of Terraform: seats 30 → 45']
   plan → ~ school_room.lab  seats: 45 → 30 → Plan: 0 to add, 1 to change, 0 to destroy.
   with lifecycle ignore_changes = [seats] → No changes. Your infrastructure matches the configuration.
   apply the plan → Apply complete! Resources: 0 added, 1 changed, 0 destroyed. · seats are 30 again
── someone built a back gate by hand: gate-02 — the register has never heard of it
   plan with the gate in the plans but no import → Plan: 1 to add, 0 to change, 0 to destroy.  (a second gate)
   add an import block → ← school_gate.back will be imported (id gate-02)
   Plan: 1 to import, 0 to add, 0 to change, 0 to destroy.
   Apply complete! Resources: 1 imported, 0 added, 0 changed, 0 destroyed.
── rename school_room.lab → school_room.science in the plans
   without a moved block → Plan: 3 to add, 0 to change, 3 to destroy.  (the lab AND both gates would be rebuilt)
   with moved { from = school_room.lab, to = school_room.science } → school_room.lab has moved to school_room.science · Plan: 0 to add, 0 to change, 0 to destroy.

═══ environments ═══
── one set of plans, two workspaces, one .tfvars file each
   workspace dev  + dev.tfvars {'seats': 10, 'lockers': 1} → Apply complete! Resources: 2 added, 0 changed, 0 destroyed. → register at env:/dev/campus.tfstate
   workspace prod + prod.tfvars {'seats': 40, 'lockers': 3} → Apply complete! Resources: 4 added, 0 changed, 0 destroyed. → register at env:/prod/campus.tfstate
   the backend now holds ['env:/dev/campus.tfstate', 'env:/prod/campus.tfstate'] · the campus has 6 objects
── Katrina forgets `workspace select dev` and plans with dev.tfvars while prod is selected:
     ~ school_room.lab  seats: 40 → 10
     - school_locker.row[1] (destroy)
     - school_locker.row[2] (destroy)
   Plan: 0 to add, 1 to change, 2 to destroy.  ← prod shrinks to dev's size
── three ways to keep environments apart:
   workspaces   same code, same backend, a state per workspace · quick, but one wrong select hits prod
   directories  envs/dev and envs/prod call the same modules, each with its own backend key · clear, a little copying
   accounts     separate cloud accounts + separate state + separate CI roles · the strongest wall between dev and prod

═══ policy ═══
── validate (no campus needed) on a broken config:
   school_room.gym: Inappropriate value for attribute "seats": a number is required.
   school_room.gym: An argument named "colour" is not expected here.
   school_room.gym: The argument "name" is required, but no definition was found.
   school_gate.g: Reference to undeclared resource "school_room.pool".
── plan → Plan: 5 to add, 0 to change, 0 to destroy. · policy check (dev):
   DENY school_room.gym: every room needs an owner tag (tags has no 'owner')
   DENY school_gate.night: gates must close at night (open_hours = '00-24')
   DENY school_locker.big: no xl lockers outside prod (size = 'xl' in dev)
── cost estimate: ₹0/month → ₹2830/month (+2830) — made-up prices, the shape of an Infracost comment
── tests (like `terraform test` with command = plan):
     run "the lab has 30 seats"... pass
     run "the lab gets 2 lockers"... pass
     run "gates close at night"... fail
    Error: Test assertion failed — a gate is open 00-24
   Failure! 2 passed, 1 failed.
   validate checks the plans' SHAPE · tests check what they MEAN · policy checks what is ALLOWED · cost checks what it COSTS

═══ pipeline ═══
── who may do what: the CI job gets a short-lived OIDC token, no stored cloud keys
   pull_request sub=repo:school/campus-infra:pull_request
      → campus-plan: granted, read-only (plan), session 3600 s
      → campus-apply: AccessDenied — sub 'repo:school/campus-infra:pull_request' does not match
   push         sub=repo:school/campus-infra:ref:refs/heads/main
      → campus-plan: granted, read-only (plan), session 3600 s
      → campus-apply: granted, read-write (apply), session 3600 s
   PR #42: campus-plan: granted, read-only (plan), session 3600 s
   PR #42: validate → Success! The configuration is valid.
   PR #42: plan (state serial 1) → Plan: 1 to add, 0 to change, 0 to destroy.
   PR #42: policy → 0 denied
   PR #42: cost → ₹1200/month → ₹2400/month (+1200)
   PR #42: comment posted with the plan · ready for review
   PR #43: campus-plan: granted, read-only (plan), session 3600 s
   PR #43: validate → Success! The configuration is valid.
   PR #43: plan (state serial 1) → Plan: 1 to add, 0 to change, 0 to destroy.
   PR #43: policy → 0 denied
   PR #43: cost → ₹1200/month → ₹1500/month (+300)
   PR #43: comment posted with the plan · ready for review
   merge #43: campus-apply: granted, read-write (apply), session 3600 s
   merge #43: Apply complete! Resources: 1 added, 0 changed, 0 destroyed. (state serial 2)
   merge #42: campus-apply: granted, read-write (apply), session 3600 s
   merge #42: Saved plan is stale: the state was changed by another operation after the plan was created.
   merge #42: re-plan (state serial 2) → Plan: 1 to add, 0 to change, 1 to destroy.
   merge #42: the new plan is NOT the plan that was reviewed → stop, nothing applied
   PR #42 (rebased on main): plan (state serial 2) → Plan: 1 to add, 0 to change, 0 to destroy.
   merge #42: campus-apply: granted, read-write (apply), session 3600 s
   merge #42: Apply complete! Resources: 1 added, 0 changed, 0 destroyed. (state serial 3)
── main = campus: register serial 3 · 3 resources · campus 3 objects
── the whole picture: plans in git → validate, test, policy, cost → plan on the PR → review → apply on merge with OIDC
   → one locked remote register → refresh finds drift → import and moved keep the register honest → the same plans for every site

✅ done — the campus matches the plans

🗺️ संपूर्ण चित्र — एक आकृती, पूर्ण कोर्स

संपूर्ण कोर्स एका कॅनव्हासवर. 4K आवृत्तीसाठी क्लिक करा.

📐 भाग 1 — आराखडे (धडे 1–4)

एक git branch = एक कल्पना; branch 04 मध्ये धडे 01–04 आहेत. iac/ चा प्रत्येक run सारखाच असतो — randomness seeded आहे.

📒 भाग 2 — नोंदवही आणि कंत्राटदार (धडे 5–8)

कंत्राटदार आपण काय बांधले ते कसे लक्षात ठेवतो, कामाचा क्रम कसा ठरवतो, designs पुन्हा कसे वापरतो आणि एकच नोंदवही सुरक्षितपणे कशी वाटून घेतो.

🏘️ भाग 3 — अनेक जागा, सुरक्षितपणे (धडे 9–12)

Drift, environments, checks आणि pipelines: आराखडे खरोखर, अनेक जागांसाठी, एका team सोबत चालवणे.

📐 धड्यांच्या आकृत्या — क्रमांक अनुसरा

प्रत्येक धडा एका क्रमांकित बॉक्स-आणि-बाण आकृतीत — स्वतंत्र पानावरही.