· about 40 minutes · runs on ubuntu-26.04-devops · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
/srv/sites is the Terraform configuration that generates one web-server virtual host per site into
/etc/nginx-sites/, each with its own port and its own cookie secret. Three sites have been live for
months: shop on 8100, blog on 8101 and docs on 8102.
The blog is being retired. Someone removed "blog" from the list of sites and ran terraform plan.
The plan wanted to rewrite docs with the blog's port and the blog's secret, and delete docs.conf
— so they stopped, and nothing has been applied.
What is expected, and graded:
blog is gone: no blog.conf, and nothing for the blog in the state.shop and docs are exactly as they are now — same ports, same cookie secrets, same files — and
terraform plan reports no changes.Terraform's providers are already on the machine; there is no internet access. You have root through
sudo. Everything must still hold after a reboot.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_blog_retired | Remove one instance of a repeated resource without disturbing the others |
| 02_shop_and_docs_untouched | Remove one instance of a repeated resource without disturbing the others |
| 03_keyed_by_name | Key repeated resources by a stable name instead of a position |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
A resource uses `count = length(var.names)` with `names = ["a", "b", "c"]`. `"a"` is removed. Which instances does the next plan change or destroy?
[0] and [1] change to describe b and c, and [2] is destroyed
count instances are identified by index. Removing the first element shifts every later element down by one, so each remaining index describes a different item, and the last index is out of range.
https://developer.hashicorp.com/terraform/language/meta-arguments/count#when-to-use-for_each-instead-of-count
What are the addresses of the instances of `resource "local_file" "vhost" { for_each = { shop = 8100, docs = 8102 } … }`?
local_file.vhost["docs"] and local_file.vhost["shop"]
for_each over a map addresses instances by key, written in quotes inside brackets. The values are available as each.value but play no part in the address.
https://developer.hashicorp.com/terraform/language/meta-arguments/for_each
A resource changes from `count` to `for_each` and the plan says `x.y[1] will be destroyed (because resource does not use count)`. What does that mean?
An index-addressed instance is still in state and no moved block maps it to a key
After the switch every instance address is key-based. Old index addresses are kept only if a moved block claims them; any that remain unclaimed are planned for destruction, which is the intended outcome only for the instance you are retiring.
https://developer.hashicorp.com/terraform/language/modules/develop/refactoring#enabling-count-or-for_each-for-a-resource