Add Azure (miniblue) version of terraform init Killercoda lab

Agent-Logs-Url: https://github.com/lonegunmanb/terraform-tutorial/sessions/152de788-b595-4fa7-8c49-1db7abd60a96

Co-authored-by: lonegunmanb <2233414+lonegunmanb@users.noreply.github.com>

Author: Copilot

docs/terraform-cli-init.md

@@ -188,4 +188,10 @@ terraform init -input=false -lockfile=readonly
 - `-input=false`：禁用交互式输入（CI 中无法交互）
 - `-lockfile=readonly`：防止 CI 意外修改锁文件
 
-<KillercodaEmbed src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-init" />
+<KillercodaEmbed src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-init" title="实验环境（AWS / LocalStack 版）" />
+
+<KillercodaEmbed
+  src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-init-azure"
+  title="实验环境（Azure / miniblue 版）"
+  desc="点击下方按钮在新标签页中打开 Azure 版 Killercoda 实验环境，预装了 Terraform + miniblue（Azure 本地模拟器），所有 init 子命令与参数与 AWS 版完全一致，远端状态存储改用 azurerm backend（Azure Blob Container）。"
+/>

terraform-tutorial/structure.json

@@ -21,6 +21,7 @@
     { "path": "terraform-cli-basics" },
     { "path": "terraform-cli-basics-azure" },
     { "path": "terraform-cli-init" },
+    { "path": "terraform-cli-init-azure" },
     { "path": "terraform-cli-plan" },
     { "path": "terraform-cli-apply" },
     { "path": "terraform-cli-apply-azure" },

terraform-tutorial/terraform-cli-init-azure/assets/docker-compose.yml

@@ -0,0 +1,14 @@
+services:
+  miniblue:
+    # 使用 fork 后的镜像（兼容 azurerm v4），版本通过 SHA tag 锁定
+    image: ghcr.io/lonegunmanb/miniblue:sha-8cc1c25
+    ports:
+      - "4566:4566"
+      - "4567:4567"
+    environment:
+      - MINIBLUE_STORAGE_ENDPOINT=http://localhost:4566
+      - MINIBLUE_DISABLE_SHAREDKEY_AUTH=1
+    deploy:
+      resources:
+        limits:
+          memory: 512M

terraform-tutorial/terraform-cli-init-azure/assets/main.tf

@@ -0,0 +1,43 @@
+terraform {
+  required_version = ">= 1.0"
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 4.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+
+  # miniblue HTTPS metadata endpoint
+  metadata_host                   = "localhost:4567"
+  resource_provider_registrations = "none"
+
+  # miniblue 接受任意凭据
+  subscription_id = "00000000-0000-0000-0000-000000000000"
+  tenant_id       = "00000000-0000-0000-0000-000000000001"
+  client_id       = "miniblue"
+  client_secret   = "miniblue"
+}
+
+variable "environment" {
+  type        = string
+  default     = "dev"
+  description = "部署环境（dev / staging / prod）"
+}
+
+resource "azurerm_resource_group" "demo" {
+  name     = "init-demo-${var.environment}-rg"
+  location = "East US"
+  tags = {
+    Environment = var.environment
+    ManagedBy   = "Terraform"
+  }
+}
+
+output "resource_group" {
+  value       = azurerm_resource_group.demo.name
+  description = "演示用 Resource Group 名称"
+}

terraform-tutorial/terraform-cli-init-azure/assets/setup-common.sh

@@ -0,0 +1,194 @@
+#!/bin/bash
+# ─────────────────────────────────────────────────────────
+# setup-common.sh — shared setup functions for Killercoda scenarios
+#
+# This file is the SINGLE SOURCE OF TRUTH for common setup logic.
+# It is copied into each scenario's assets/ directory by:
+#   npm run sync-setup  (or automatically via prebuild)
+#
+# Usage in background.sh:
+#   source /root/setup-common.sh
+#   install_terraform
+#   install_awscli        # optional — AWS CLI v2 + awslocal wrapper
+#   install_tflint        # optional — only in scenarios that need it
+#   start_localstack
+#   install_theia_plugin
+#   finish_setup
+# ─────────────────────────────────────────────────────────
+
+TERRAFORM_VERSION="${TERRAFORM_VERSION:-1.14.8}"
+TFLINT_VERSION="${TFLINT_VERSION:-v0.61.0}"
+TERRAGRUNT_VERSION="${TERRAGRUNT_VERSION:-0.77.5}"
+# Note: the miniblue container image tag is pinned in scripts/miniblue-image.mjs
+# and propagated into every docker-compose.yml by `npm run sync-miniblue`.
+# There is no shell-side miniblue version variable — start_miniblue just runs
+# `docker compose up -d` against the pinned compose file.
+
+install_terraform() {
+  if ! command -v unzip > /dev/null 2>&1; then
+    apt-get update -qq && apt-get install -y -qq unzip > /dev/null 2>&1
+  fi
+
+  # Install Docker Compose v2 plugin (binary download — apt package not available on Killercoda)
+  if ! docker compose version > /dev/null 2>&1; then
+    mkdir -p /usr/local/lib/docker/cli-plugins
+    curl --connect-timeout 10 --max-time 120 -fsSL \
+      "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64" \
+      -o /usr/local/lib/docker/cli-plugins/docker-compose
+    chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+  fi
+
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
+    -o /tmp/terraform.zip \
+    && unzip -o -q /tmp/terraform.zip -d /usr/local/bin/ \
+    && chmod +x /usr/local/bin/terraform \
+    && rm -f /tmp/terraform.zip
+
+  terraform version || echo "WARNING: terraform install failed"
+}
+
+install_tflint() {
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://github.com/terraform-linters/tflint/releases/download/${TFLINT_VERSION}/tflint_linux_amd64.zip" \
+    -o /tmp/tflint.zip \
+    && unzip -o -q /tmp/tflint.zip -d /usr/local/bin/ \
+    && chmod +x /usr/local/bin/tflint \
+    && rm -f /tmp/tflint.zip
+
+  tflint --version || echo "WARNING: tflint install failed"
+}
+
+install_terragrunt() {
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64" \
+    -o /usr/local/bin/terragrunt \
+    && chmod +x /usr/local/bin/terragrunt
+
+  terragrunt --version || echo "WARNING: terragrunt install failed"
+}
+
+install_awscli() {
+  # Install AWS CLI v2 (official binary)
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
+    -o /tmp/awscliv2.zip \
+    && unzip -o -q /tmp/awscliv2.zip -d /tmp/ \
+    && /tmp/aws/install --update > /dev/null 2>&1 \
+    && rm -rf /tmp/awscliv2.zip /tmp/aws
+
+  aws --version || echo "WARNING: awscli install failed"
+
+  # Disable AWS CLI pager globally so output prints directly
+  mkdir -p /root/.aws
+  cat > /root/.aws/config <<'AWSCFG'
+[default]
+region = us-east-1
+output = json
+cli_pager =
+AWSCFG
+
+  # Install awscli-local (provides the 'awslocal' command)
+  pip3 install --break-system-packages awscli-local > /dev/null 2>&1 \
+    || {
+      # Fallback: create a shell wrapper if pip fails
+      cat > /usr/local/bin/awslocal <<'WRAPPER'
+#!/bin/bash
+export AWS_PAGER=""
+exec aws --endpoint-url=http://localhost:4566 --region us-east-1 "$@"
+WRAPPER
+      chmod +x /usr/local/bin/awslocal
+    }
+
+  awslocal --version || echo "WARNING: awslocal install failed"
+}
+
+start_localstack() {
+  cd /root/workspace
+  docker compose up -d
+
+  echo "Waiting for LocalStack to be ready..."
+  for i in $(seq 1 60); do
+    if curl -sf http://localhost:4566/_localstack/health > /dev/null 2>&1; then
+      echo "LocalStack is ready."
+      return 0
+    fi
+    sleep 2
+  done
+  echo "WARNING: LocalStack did not become healthy within 120 seconds"
+  docker compose logs
+}
+
+start_miniblue() {
+  cd /root/workspace
+  mkdir -p /root/.miniblue
+  docker compose up -d
+
+  echo "Waiting for miniblue to be ready..."
+  for i in $(seq 1 60); do
+    if curl -sf http://localhost:4566/health > /dev/null 2>&1; then
+      echo "miniblue is ready."
+      # Trigger an HTTPS request so miniblue generates its self-signed cert.
+      curl -sk https://localhost:4567/health > /dev/null 2>&1 || true
+
+      # Locate cert inside the container and copy to host.
+      # The miniblue image is distroless (no shell), so we can't `docker exec`
+      # to probe — `docker cp` itself is sufficient and silently fails on
+      # missing paths. Try known paths in order.
+      local cid
+      cid=$(docker compose ps -q miniblue 2>/dev/null)
+      for j in $(seq 1 30); do
+        if [ -n "$cid" ]; then
+          for p in /home/nonroot/.miniblue/cert.pem /root/.miniblue/cert.pem /app/.miniblue/cert.pem; do
+            if docker cp "$cid:$p" /root/.miniblue/cert.pem 2>/dev/null; then
+              break 2
+            fi
+          done
+        fi
+        sleep 1
+      done
+
+      if [ ! -f /root/.miniblue/cert.pem ]; then
+        echo "WARNING: failed to copy miniblue cert.pem out of container"
+      else
+        chmod 644 /root/.miniblue/cert.pem
+      fi
+
+      # Make SSL_CERT_FILE available for all interactive shells
+      cat > /etc/profile.d/miniblue.sh <<'PROF'
+export SSL_CERT_FILE=/root/.miniblue/cert.pem
+PROF
+      chmod +x /etc/profile.d/miniblue.sh
+      # Killercoda terminals are non-login interactive shells — they only source
+      # ~/.bashrc, not /etc/profile.d/*. Append the export there too (idempotent).
+      if ! grep -q 'SSL_CERT_FILE=/root/.miniblue/cert.pem' /root/.bashrc 2>/dev/null; then
+        echo 'export SSL_CERT_FILE=/root/.miniblue/cert.pem' >> /root/.bashrc
+      fi
+      export SSL_CERT_FILE=/root/.miniblue/cert.pem
+      return 0
+    fi
+    sleep 2
+  done
+  echo "WARNING: miniblue did not become healthy within 120 seconds"
+  docker compose logs
+}
+
+finish_setup() {
+  touch /tmp/.setup-done
+}
+
+install_azlocal() {
+  # azlocal is a standalone Go CLI bundled inside the miniblue image at /azlocal
+  # (analogous to awslocal for LocalStack). It uses HTTP on port 4566 and needs
+  # no certificate or az CLI. Requires miniblue to be running.
+  local cid
+  cid=$(docker compose ps -q miniblue 2>/dev/null)
+  if [ -z "$cid" ]; then
+    cid=$(docker ps -q --filter "name=miniblue" | head -1)
+  fi
+  if [ -n "$cid" ]; then
+    docker cp "$cid:/azlocal" /usr/local/bin/azlocal 2>/dev/null \
+      && chmod +x /usr/local/bin/azlocal
+  fi
+  azlocal --help > /dev/null 2>&1 || echo "WARNING: azlocal install failed"
+}

terraform-tutorial/terraform-cli-init-azure/finish/finish.md

@@ -0,0 +1,26 @@
+# 恭喜你完成了 terraform init 实战练习（Azure 版）！
+
+## 你已掌握的知识
+
+| 知识点 | 要点 |
+|--------|------|
+| terraform init 的作用 | 初始化工作目录：backend、模块、provider |
+| .terraform/ 目录 | 缓存已下载的 provider 插件和模块代码 |
+| .terraform.lock.hcl | 锁定 provider 版本和校验和，应提交到代码仓库 |
+| 幂等性 | terraform init 可安全重复执行，不会破坏资源或状态 |
+| -upgrade | 重新检查并升级 provider 到最新兼容版本 |
+| -lockfile=readonly | CI/CD 中禁止修改锁文件，确保版本一致性 |
+| -migrate-state | 切换 backend 时跳过交互式询问并自动迁移状态（等同于自动回答 yes） |
+| -force-copy | 同 -migrate-state，跳过迁移确认；两者效果相同 |
+| -reconfigure | 重置 backend 配置，跳过状态迁移 |
+
+## 关于 azurerm Backend
+
+- 状态以 blob 形式存储在 Azure Storage Account → Container 中（本课程使用 miniblue 模拟）
+- 状态锁通过 Azure Blob 的 lease（租约）机制实现，无需额外的"锁表"
+- backend 块中的 resource_group_name / storage_account_name / container_name / key 四件套定位状态 blob
+- 在真实 Azure 项目中，凭据应通过 ARM_* 环境变量或 -backend-config 文件注入，不应硬编码到代码中
+
+## 下一步
+
+继续阅读 Terraform CLI 章节，学习其他子命令的用法。也可以前往 [Terraform Backend 配置（Azure 版）](https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-backend-azure) 深入学习 azurerm backend 的部分配置、状态锁与 force-unlock 等高级特性。

terraform-tutorial/terraform-cli-init-azure/index.json

@@ -0,0 +1,41 @@
+{
+  "title": "terraform init（Azure / miniblue 版）：初始化工作目录与依赖管理",
+  "description": "通过 miniblue 模拟的 Azure 环境（Storage Account + Blob Container），掌握 terraform init 的三大核心能力：初始化工作目录、管理 Provider 锁文件、切换 Backend 迁移状态",
+  "details": {
+    "intro": {
+      "text": "init/init.md",
+      "background": "init/background.sh",
+      "foreground": "init/foreground.sh"
+    },
+    "steps": [
+      {
+        "title": "初次初始化工作目录：.terraform/ 与 .terraform.lock.hcl",
+        "text": "step1/text.md"
+      },
+      {
+        "title": "Provider 锁文件管理：-upgrade 与 -lockfile=readonly",
+        "text": "step2/text.md"
+      },
+      {
+        "title": "切换 Backend 与状态迁移：-migrate-state 与 -reconfigure",
+        "text": "step3/text.md"
+      }
+    ],
+    "finish": {
+      "text": "finish/finish.md"
+    },
+    "assets": {
+      "host01": [
+        {"file": "setup-common.sh", "target": "/root", "chmod": "+x"},
+        {"file": "main.tf", "target": "/root/workspace"},
+        {"file": "docker-compose.yml", "target": "/root/workspace"}
+      ]
+    }
+  },
+  "backend": {
+    "imageid": "ubuntu"
+  },
+  "interface": {
+    "layout": "editor-terminal"
+  }
+}