· about 35 minutes · runs on ubuntu-26.04-devops · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
/srv/infra is the Terraform configuration for the shop's local settings: a generated session key,
/etc/shop/app.env built from it, and the web server's site file /etc/shop/nginx-site.conf. Its
state is the local terraform.tfstate in the same directory.
A pull request renamed the resources to the names the team agreed on — random_password.session_key
and local_file.app_env. The first terraform plan after the merge wants to destroy and recreate
the session key, which would log out every customer. Nobody has applied it. The plan also wants to
replace the site file, which someone edited by hand on this machine during an incident.
What is expected, and graded:
terraform plan in /srv/infra reports no changes./etc/shop/app.env. The new resource names stay.Terraform's providers are already on the machine; there is no internet access. You have root through
sudo. Everything must still hold after a reboot.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_plan_is_clean | Bring drifted infrastructure back to its configuration |
| 02_session_key_kept | Refactor Terraform configuration without replacing what already exists |
| 03_state_protected | Protect a state file that holds secrets |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
A resource block is renamed from `hcloud_volume.logs` to `hcloud_volume.access_logs` with no other change. What does the next plan propose?
Destroy the volume at the old address and create one at the new address
Terraform tracks objects by address. The old address is in state but not in configuration, the new one is in configuration but not in state. A moved block, or terraform state mv, tells Terraform they are the same object.
https://developer.hashicorp.com/terraform/language/modules/develop/refactoring
What does `terraform plan -detailed-exitcode` exit with when the plan has changes to make?
2
0 means no changes, 1 means an error, and 2 means a successful plan with changes. Without the flag, a successful plan exits 0 whether or not it has changes.
https://developer.hashicorp.com/terraform/cli/commands/plan#detailed-exitcode
A `random_password` is declared with its value marked sensitive. Where can its generated value still be read in plain text?
In the state file and its backup
Sensitive only redacts plan and output display. State records every attribute, and terraform.tfstate.backup keeps the previous state, so both must be protected like the secret.
https://developer.hashicorp.com/terraform/language/state/sensitive-data