← All courses

🏗️ Terraform & Pulumi

Describing the database, the bucket and the credentials your data work runs on — the plan and the symbol that means replacement, state and why it holds your password, drift, adopting what already exists, and a closing series on OpenTofu and Pulumi.

No lessons published yet — this is the roadmap, so you can see exactly what the course will cover before it lands.

Before you start: Data Ops — Series 1, and Series 1 · 46 and Series 1 · 47 in particular. You cannot describe infrastructure you have never rented. Those two episodes are where a machine, a bucket, egress and a lifecycle rule stop being words, and this course assumes all of it.

Short on time? The 14 episodes marked core are the shortest path to being productive at work. Start there and pick up the rest whenever a job asks for them.

Series 1 · Describing Infrastructure

the language, the plan, and the state file everything depends on

  1. 01

    Infrastructure as Code — The Click You Cannot Repeat, Review or Diff

    coreintermediatecoming soon
  2. 02

    Providers, Resources and the First apply — Declaring, Not Scripting

    coreintermediatecoming soon
  3. 03

    plan, apply, destroy — and Why -/+ Is the Symbol to Fear

    coreintermediatecoming soon
  4. 04

    Variables, Outputs and for_each — Writing It Once Instead of Five Times

    intermediatecoming soon
  5. 05

    State — What Terraform Believes Exists, and Why It Is Not Your Infrastructure

    coreintermediatecoming soon
  6. 06

    Remote State and Locking — the Moment a Second Person Runs apply

    coreintermediatecoming soon
  7. 07

    Project — A Managed Database and a Bucket, From an Empty Directory

    coreintermediate#projectcoming soon

Series 2 · The Resources a Data Person Provisions

a database, a bucket, credentials, and the second environment

  1. 01

    A Managed Database in Code — Parameters, Versions, and the Plan That Says Replace

    coreintermediatecoming soon
  2. 02

    Buckets, Lifecycle Rules and Versioning — Storage Policy as Code

    coreintermediatecoming soon
  3. 03

    Credentials for a Pipeline — Least Privilege When It Is a Diff Instead of a Form

    coreintermediatecoming soon
  4. 04

    Networking, Just Enough — Reaching the Database Without Publishing It

    intermediatecoming soon
  5. 05

    A Warehouse in Code — Compute, Schemas and Grants That Can Be Reviewed

    intermediatecoming soon
  6. 06

    Modules — Describing an Environment Once and Calling It Twice

    coreintermediatecoming soon
  7. 07

    dev, staging and prod — Workspaces Against Directories, and Which Is Safer

    intermediatecoming soon
  8. 08

    Project — Stand Up a Second Environment That Actually Matches the First

    coreintermediate#projectcoming soon

Series 3 · Living With It

drift, adoption, destruction, and Terraform in CI

  1. 01

    Drift — What Changed Outside Terraform, and Deciding Which Side Is Right

    coreadvancedcoming soon
  2. 02

    import and moved — Adopting Infrastructure That Already Exists

    advancedcoming soon
  3. 03

    The Destructive Plan — Reading for Replacement Before You Lose the Rows

    coreadvancedcoming soon
  4. 04

    Secrets — Why the State File Contains Your Database Password

    coreadvancedcoming soon
  5. 05

    Terraform in CI — plan on the Pull Request, apply on Merge

    advancedcoming soon
  6. 06

    validate, tflint and Policy as Code — Enforcing the Rules You Keep Forgetting

    advancedcoming soon

Series 4 · The Alternatives

OpenTofu, Pulumi, and choosing between them honestly

  1. 01

    OpenTofu — the Fork, What Actually Differs, and What Migrating Costs

    advancedcoming soon
  2. 02

    Pulumi — the Same Model in a Language You Already Write

    advancedcoming soon
  3. 03

    Stacks and Encrypted State — Where Pulumi Is Genuinely Different

    advancedcoming soon
  4. 04

    Choosing — and the Case for None of Them

    advancedcoming soon

Not here, on purpose

  • What a VPS, a managed database or a bucket actually is, and how to size one — covered in Data Ops, Series 1 · 46 for the machine and Data Ops, Series 1 · 47 for the bucket. This course describes those decisions in code; it does not re-argue them
  • Operating the machine once it exists — covered in Data Ops. Terraform creates a server; it has no opinion about what runs on it afterwards
  • Running workloads on a cluster — covered in Kubernetes for Data Workloads. This course can create a cluster and stops at its edge
  • Kubernetes manifests and Helm releases managed through Terraform — not covered, deliberately. It is possible and it is usually a mistake — two state models fighting over the same objects. Kubernetes for Data Workloads, Series 3 · 15 owns Helm
  • Building a reusable module library for a platform team — not covered; this track is for the person who needs the same environment twice, not for the person publishing modules to a registry. Series 2 · 25 teaches modules only as far as that goes