🏗️ Provisioners & null_resource

local-exec, remote-exec, file provisioner, terraform_data

Terraform Associate · TF-Associate · ⏱️ 16 min · ❓ 3 savol

⚠️ Provisioner nima va qachon?

Provisioner — resurs yaratilgandan (yoki o'chirilgandan) keyin buyruq/skript ishlatish. Terraform ideologiyasiga zid: muvaffaqiyatsiz bo'lsa resurs "tainted" holga tushadi. Faqat boshqa yechim yo'qda ishlatiladi. Cloud-init, user_data — afzal alternativa.

💻 local-exec & remote-exec

local-exec: buyruqni Terraform ishlatilayotgan mashinada ishlatadi (AWS CLI, script trigger). remote-exec: resurs ichida (EC2 da SSH/WinRM orqali) buyruq ishlatadi. connection block kerak: host, user, private_key.

📁 file Provisioner

Local mashinadan remote mashinaga fayl nusxalash. SSH yoki WinRM orqali. `source` (local path) → `destination` (remote path). Odatda `remote-exec` bilan birga: fayl yuklash + ishlatish.

🔧 null_resource & terraform_data

null_resource — hech qanday real resurs yaratmaydi, faqat provisioner yoki trigger uchun. `triggers` map — qachon qayta run qilish. terraform_data (Terraform 1.4+) — null_resource replacement, native provider kerak emas.

💡 Asosiy nuqtalar

Provisioner = last resort, mumkin bo'lsa ishlatmang
local-exec: lokal mashina. remote-exec: remote VM
null_resource: real infra yo'q, faqat provisioner uchun
terraform_data: null_resource o'rniga (1.4+)
Failure: resurs tainted → qayta yaratiladi

📋 Kod misoli

# local-exec: resurs yaratilgandan keyin lokal script
resource "aws_instance" "web" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t3.micro"

  provisioner "local-exec" {
    command = "echo ${self.public_ip} >> inventory.txt"
  }
}

# null_resource: haqiqiy infra yaratmasdan trigger
resource "null_resource" "run_ansible" {
  triggers = {
    instance_id = aws_instance.web.id
  }

  provisioner "local-exec" {
    command = "ansible-playbook -i ${aws_instance.web.public_ip}, playbook.yml"
  }
}

# terraform_data (Terraform 1.4+)
resource "terraform_data" "bootstrap" {
  triggers_replace = [aws_instance.web.id]

  provisioner "local-exec" {
    command = "bash setup.sh ${aws_instance.web.public_ip}"
  }
}

🎯 Imtihon maslahatlari

Provisioner muvaffaqiyatsiz bo'lsa resurs "tainted" — keyingi plan da destroy+recreate
user_data (EC2 bootstrap script) — provisioner dan afzal va declarative
local-exec: API call trigger, Ansible playbook ishga tushirish uchun
null_resource triggers: map o'zgarganda qayta run qiladi
Terraform 1.4+: `terraform_data` hashicorp/null provideriga bog'liq emas

⚠️ Ko'p adashadigan

Provisioner = normal IaC pattern deb o'ylash — Terraform anti-pattern, faqat oxirgi chora
remote-exec connection block unutish — SSH credentials ko'rsatmasdan ishlashini kutish
null_resource triggers o'zgarmaganda provisioner qayta ishlamasligini kutmaslik

🧠 Eslab qolish: "Provisioner = Plastir" — muammo uchun vaqtinchalik yechim, lekin yara uchun jarrohliq (cloud-init, user_data) afzal