Say it once, build it every time
A school wants the same ten computers in every classroom, set up the same way. Doing it by hand ten times gives ten slightly different rooms. Infrastructure as code writes the rooms down in a file instead, and a tool makes what the file describes, as many times as you like, and shows you what it will change before it changes it.
By the end of this lesson
Note
I can say what a plan is, what the state is for, and why a tool plans before it changes anything.
Key words
- OpenTofu: a free, open source tool that reads files and makes what they describe.
- Resource: one thing a file describes. Here it holds a value; with a provider it could be a server.
- Plan: the list of changes OpenTofu would make, shown before it makes them.
- Apply: making the changes the plan listed.
- State: the file where OpenTofu records what it has already made.
- Provider: a plug-in that talks to a real cloud. This machine cannot download one.
Starter: what you already know
Note
Answer in your head. 1. What is a variable in a program? 2. If you ask for a cup of tea twice, do you get one cup or two? 3. What does a to-do list let you do the next day? You will meet all three in a moment.
Before you start
Note
Press Start the lab on the bar at the top of this lesson. This lab is a whole Ubuntu machine of your own, so it takes a little longer to come up than a container, and it downloads OpenTofu the first time, so you need a free account. Each Run button types its command into the machine's terminal, one after another in the same session. If one says the machine is still starting, wait a few seconds and press it again. To watch them, or to type your own, press Open terminal on the bar.
A project is a folder of files
The lab gives you a smallest project in ~/tofu-lab/hello. cd goes there. The file main.tf holds one resource called hello of the built-in kind terraform_data. It stores the value "hello" as its input and gives it back as its output. A second block prints that output. Nothing is made outside OpenTofu: the lab has no cloud to make things in.
cd ~/tofu-lab/helloShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
cat main.tfShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Plan: look before you change anything
tofu init prepares the folder. A real project downloads its providers here, and this one has none to fetch, so it takes no time. tofu plan then compares the file with the state and prints what it would do. A + means create, and the last line adds it up: Plan: 1 to add, 0 to change, 0 to destroy. A plan changes nothing.
tofu initShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
tofu planShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Apply: make it so, and let it remember
tofu apply makes what the plan listed. Without -auto-approve it asks you to type yes first; the lab passes it so that the button can do it for you. It ends Apply complete! Resources: 1 added, 0 changed, 0 destroyed. The resource is now recorded in the state. tofu state list shows what the state holds.
tofu apply -auto-approveShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
tofu state listShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Check
Tip
Which command changes something, and which only tells you what it would change? Answer: tofu apply changes, tofu plan only tells. What does the plan say if you run it again straight away? Answer: No changes. Your infrastructure matches the configuration., because the state already holds what the file describes. Try it.
A common mistake
Warning
Many people think OpenTofu looks at the world each time and works out what is there. It does not: it compares your files with its state, its own record. Whatever the state says exists is what it believes exists, so the state is worth as much as the infrastructure it describes.
Change one value and read the plan
The next command changes "hello" to "goodbye" in the file with sed, a find-and-replace. Then tofu plan has to tell the difference between something new and something changed. A ~ means change in place, the old value and the new one are shown side by side, and the last line says Plan: 0 to add, 1 to change, 0 to destroy. You read the plan before you apply: that is the habit this tool is for.
sed -i 's/input = "hello"/input = "goodbye"/' main.tfShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
tofu planShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
The state is a file, and without it OpenTofu forgets
In this folder the state is a plain file, terraform.tfstate. Delete it and OpenTofu has lost its record. The plan then says 1 to add, a resource it has already made, because as far as it knows nothing exists. With a real cloud that would make a second copy of everything. That is why real teams keep the state somewhere safe and never edit it by hand. Afterwards sudo tofulab reset hello puts this folder back as it was given.
rm terraform.tfstateShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
tofu planShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Exit check
Tip
Answer without looking back. 1. What does tofu plan change? 2. What does the state record? 3. What does the plan say if you run it a second time after an apply? 4. Why can this machine not make a real server? Answers: nothing; what OpenTofu has already made; nothing to do; it has no provider, and a provider is what talks to a cloud. When you are ready, read your lab: run cat ~/README.md in the terminal.
For teachers
Tip
This lesson is a small example of a lesson worked in a lab: the steps and the Run buttons are the lesson, and the lab is each student's own copy. This lesson is worked in a VM lab: each student has an Ubuntu machine of their own with OpenTofu installed, and a Run types into its terminal and shows what it printed. It needs a free account (the machine downloads OpenTofu from GitHub). Key learning points: 1. A plan shows changes before anything is changed. 2. The state is OpenTofu's record of what it made. 3. The same file can be applied again and changes nothing. Common mistake: believing OpenTofu looks at the real world instead of its state. The lab uses only the built-in terraform_data resource, so nothing real is created; real providers need a network the lab does not have. After the lesson, sudo tofulab reset hello restores the folder. The lab itself has a check that plans and applies the student's project with its own values. Copy it into your own module and change it, or build one from scratch with the Lab menu in the lesson builder.