Seven tracks

Each track is a question the plan already answers and almost nobody reads the answer to. Prose on one side, a configuration, a state file and a planner on the other, and every claim a plan you can run.

• The plan as a document

  3 lessons

  Can you find the one line that matters in four hundred?

  The symbols and what each one costs. +, ~, -, -/+ and +/-, and why the last two are the only ones worth slowing down for. known after apply and what it hides. Reading a long plan in thirty seconds without reading all of it.

  • The five symbols, and what each one costs
  • known after apply, and what it hides
  • Four hundred lines in thirty seconds

• The graph

  1 lesson

  Why did it do them in that order?

  References make edges, and the edges make the order. Building the DAG, walking it, and where the parallelism comes from. Cycles and how to break one. depends_on as a confession that a reference you should have made is missing.

  • References make edges

• Replacement

  2 lessons

  Which attribute is about to destroy your database?

  ForceNew and what carries it, read off the provider schema rather than guessed. create_before_destroy and the trap it sets with unique names. prevent_destroy as a seatbelt and as an obstruction. ignore_changes and the drift it silently accumulates.

  • ForceNew, and what carries it
  • create_before_destroy, and the trap it sets

• State

  1 lesson

  What does it think it already has?

  The state file as the truth, and what happens when reality disagrees. Drift and refresh. import and moved. Locking, and the two-people-applying disaster. Secrets in state, in the clear, because that is where they are.

  • The state file is the truth, and it is often wrong

• Modules and iteration

  1 lesson

  Why did removing one instance destroy three?

  count against for_each, and the index shift that turns a one-line deletion into three replacements. Variable validation as a guard rather than a comment. Outputs as an interface other configurations depend on.

  • count against for_each, and the index shift

• When apply fails

  1 lesson

  What is in reality, and what is in the file?

  Half a state: some resources created, one failed, the rest never attempted. Converging on the target without destroying what already works. The taint-and-reapply reflex, and the cases where it is exactly wrong.

  • Half an apply, and what to do about it
  /recover/the-half-replaced-database

• Reading a generated plan

  /audit

  An agent wrote this. What does it actually do?

  The track the rest exists for. A diff, the plan it produces, and the question of what it really does — the credential rotation that replaces the database, the subnet edit that cascades, the for_each key rename, the tag that was not just a tag, and the plan whose destroy is only visible because a count went from three to two.

  /audit