Lesson 2 · Terraform fundamentals
Providers & resources
The two nouns of Terraform — how to talk to a cloud, and how to declare one thing in it.
Your win: read a Terraform config — the provider that connects
to a cloud API and the resource blocks that declare infrastructure — and know how
this repo wires up the google provider.
Providers — the plug into a platform's API
Terraform itself knows nothing about GCP or Cloudflare. A provider is a
plugin that teaches it to talk to one platform's API.1
There are 1,000+ (AWS, Azure, GCP, Kubernetes, Cloudflare, GitHub…). You declare which ones you
need; terraform init downloads them.
google and google-beta providers
(plus Cloudflare and GitHub in the relevant modules). Because it's generated in one place,
every one of the ~180 leaf configs gets the same provider setup for free — you'll see how in
Lesson 5.
Resources — one piece of infrastructure
A resource is the core building block: one thing the provider can manage —
a cluster, a database, a bucket, a service account.2
A resource block names its type and gives its desired config:
resource "google_service_account" "bob" { account_id = "stag-bob" display_name = "bob service account" project = var.project_id }
google_service_account is the type (provider + resource kind);
bob is the local name you reference it by
(google_service_account.bob.email). The arguments are the desired state; Terraform
creates/updates the real SA to match.
data "..." "..." {})
reads existing infrastructure instead of creating it. This repo's
modules/postgresql uses a data source to reference an already-created Cloud SQL
instance, then manages databases inside it — resources create, data sources look up.
google_container_cluster (the GKE cluster, via a module,
modules/platforms/gke.tf),
google_service_account + google_service_account_iam_member (the
Workload Identity binding, modules/apps/stag/sa_identity_namespaces.tf,
Lesson 9), google_sql_database_instance (Cloud SQL),
google_kms_key_ring (the SOPS keys), cloudflare_record (DNS). Learn
to read a resource block and you can read the whole terraform/ tree.
Terraform — Providers & Resources + the google provider
How providers plug in, the resource block, and the GCP resource reference.
→ hashicorp — Providers ·
Resources
→ registry — google provider
Check yourself (from memory)
Q1. A Terraform provider is…
Q2. In resource "google_service_account" "bob", bob is…
google_service_account; local name =
bob (used as google_service_account.bob.email).
Q3. To reference infra that already exists (not create it), you use…
data "..." "..." {} reads existing infra;
resource creates/manages it. Repo: modules/postgresql reads the
instance, manages DBs in it.
terraform init downloads them. RESOURCE = the
core building block — one piece of infra: resource "TYPE" "LOCALNAME" { args }
(e.g. google_service_account); args = desired state, referenced as
TYPE.LOCALNAME.attr. DATA SOURCE (data "..." "..." {}) = READ existing
infra instead of creating it. REPO: root.hcl generates the provider config once (TF ≥1.9,
google + google-beta); resources everywhere — google_container_cluster (GKE),
google_service_account_iam_member (WI binding), google_sql_database_instance,
google_kms_key_ring, cloudflare_record.google and google-beta? Ask me.