Add terraform-cli-plan-azure scenario and Azure button on plan docs

Agent-Logs-Url: https://github.com/lonegunmanb/terraform-tutorial/sessions/2e7df53d-7a6e-4759-9041-b48b6124a1ce

Co-authored-by: lonegunmanb <2233414+lonegunmanb@users.noreply.github.com>

Author: Copilot

docs/terraform-cli-plan.md

@@ -204,4 +204,10 @@ terraform plan -parallelism=5
 
 `-json`、`-no-color`、`-input`、`-lock`、`-lock-timeout` 等通用参数同样适用于 `terraform plan`。详见 [CLI 基础命令 — 跨命令通用参数](/terraform-cli-basic#跨命令通用参数)。
 
-<KillercodaEmbed src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-plan" />
+<KillercodaEmbed src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-plan" title="实验环境（AWS / LocalStack 版）" />
+
+<KillercodaEmbed
+  src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-plan-azure"
+  title="实验环境（Azure / miniblue 版）"
+  desc="点击下方按钮在新标签页中打开 Azure 版 Killercoda 实验环境，预装了 Terraform + miniblue（Azure 本地模拟器），所有 plan 子命令与 AWS 版完全一致。"
+/>

terraform-tutorial/structure.json

@@ -23,6 +23,7 @@
     { "path": "terraform-cli-init" },
     { "path": "terraform-cli-init-azure" },
     { "path": "terraform-cli-plan" },
+    { "path": "terraform-cli-plan-azure" },
     { "path": "terraform-cli-apply" },
     { "path": "terraform-cli-apply-azure" },
     { "path": "terraform-cli-destroy" },

terraform-tutorial/terraform-cli-plan-azure/assets/dev.tfvars

@@ -0,0 +1,3 @@
+environment = "dev"
+app_name    = "myapp"
+suffix      = "lab"

terraform-tutorial/terraform-cli-plan-azure/assets/docker-compose.yml

@@ -0,0 +1,11 @@
+services:
+  miniblue:
+    # 使用 fork 后的镜像（修复了 ARM 路由大小写敏感与 vnet privateEndpointVNetPolicies 不回传问题，兼容 azurerm v4），版本锁定
+    image: ghcr.io/lonegunmanb/miniblue:sha-8cc1c25
+    ports:
+      - "4566:4566"
+      - "4567:4567"
+    deploy:
+      resources:
+        limits:
+          memory: 512M

terraform-tutorial/terraform-cli-plan-azure/assets/main.tf

@@ -0,0 +1,91 @@
+terraform {
+  required_version = ">= 1.0"
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 4.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+
+  # miniblue HTTPS metadata endpoint
+  metadata_host                   = "localhost:4567"
+  resource_provider_registrations = "none"
+
+  # miniblue 接受任意凭据
+  subscription_id = "00000000-0000-0000-0000-000000000000"
+  tenant_id       = "00000000-0000-0000-0000-000000000001"
+  client_id       = "miniblue"
+  client_secret   = "miniblue"
+}
+
+variable "environment" {
+  type        = string
+  default     = "dev"
+  description = "部署环境"
+}
+
+variable "app_name" {
+  type        = string
+  default     = "myapp"
+  description = "应用名称"
+}
+
+variable "suffix" {
+  type        = string
+  default     = "lab"
+  description = "资源名称后缀，用于避免命名冲突"
+}
+
+locals {
+  common_tags = {
+    Environment = var.environment
+    App         = var.app_name
+    ManagedBy   = "Terraform"
+  }
+}
+
+resource "azurerm_resource_group" "main" {
+  name     = "${var.app_name}-${var.environment}-rg-${var.suffix}"
+  location = "East US"
+  tags     = local.common_tags
+}
+
+resource "azurerm_dns_zone" "app" {
+  name                = "${var.app_name}-${var.environment}-app-${var.suffix}.local"
+  resource_group_name = azurerm_resource_group.main.name
+  tags                = local.common_tags
+}
+
+resource "azurerm_dns_zone" "logs" {
+  name                = "${var.app_name}-${var.environment}-logs-${var.suffix}.local"
+  resource_group_name = azurerm_resource_group.main.name
+  tags                = local.common_tags
+}
+
+resource "azurerm_virtual_network" "net" {
+  name                = "${var.app_name}-${var.environment}-vnet-${var.suffix}"
+  address_space       = ["10.0.0.0/16"]
+  location            = azurerm_resource_group.main.location
+  resource_group_name = azurerm_resource_group.main.name
+  tags                = local.common_tags
+}
+
+output "resource_group" {
+  value = azurerm_resource_group.main.name
+}
+
+output "app_dns_zone" {
+  value = azurerm_dns_zone.app.name
+}
+
+output "logs_dns_zone" {
+  value = azurerm_dns_zone.logs.name
+}
+
+output "vnet" {
+  value = azurerm_virtual_network.net.name
+}

terraform-tutorial/terraform-cli-plan-azure/assets/prod.tfvars

@@ -0,0 +1,3 @@
+environment = "prod"
+app_name    = "myapp"
+suffix      = "lab"

terraform-tutorial/terraform-cli-plan-azure/assets/setup-common.sh

@@ -0,0 +1,194 @@
+#!/bin/bash
+# ─────────────────────────────────────────────────────────
+# setup-common.sh — shared setup functions for Killercoda scenarios
+#
+# This file is the SINGLE SOURCE OF TRUTH for common setup logic.
+# It is copied into each scenario's assets/ directory by:
+#   npm run sync-setup  (or automatically via prebuild)
+#
+# Usage in background.sh:
+#   source /root/setup-common.sh
+#   install_terraform
+#   install_awscli        # optional — AWS CLI v2 + awslocal wrapper
+#   install_tflint        # optional — only in scenarios that need it
+#   start_localstack
+#   install_theia_plugin
+#   finish_setup
+# ─────────────────────────────────────────────────────────
+
+TERRAFORM_VERSION="${TERRAFORM_VERSION:-1.14.8}"
+TFLINT_VERSION="${TFLINT_VERSION:-v0.61.0}"
+TERRAGRUNT_VERSION="${TERRAGRUNT_VERSION:-0.77.5}"
+# Note: the miniblue container image tag is pinned in scripts/miniblue-image.mjs
+# and propagated into every docker-compose.yml by `npm run sync-miniblue`.
+# There is no shell-side miniblue version variable — start_miniblue just runs
+# `docker compose up -d` against the pinned compose file.
+
+install_terraform() {
+  if ! command -v unzip > /dev/null 2>&1; then
+    apt-get update -qq && apt-get install -y -qq unzip > /dev/null 2>&1
+  fi
+
+  # Install Docker Compose v2 plugin (binary download — apt package not available on Killercoda)
+  if ! docker compose version > /dev/null 2>&1; then
+    mkdir -p /usr/local/lib/docker/cli-plugins
+    curl --connect-timeout 10 --max-time 120 -fsSL \
+      "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64" \
+      -o /usr/local/lib/docker/cli-plugins/docker-compose
+    chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+  fi
+
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
+    -o /tmp/terraform.zip \
+    && unzip -o -q /tmp/terraform.zip -d /usr/local/bin/ \
+    && chmod +x /usr/local/bin/terraform \
+    && rm -f /tmp/terraform.zip
+
+  terraform version || echo "WARNING: terraform install failed"
+}
+
+install_tflint() {
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://github.com/terraform-linters/tflint/releases/download/${TFLINT_VERSION}/tflint_linux_amd64.zip" \
+    -o /tmp/tflint.zip \
+    && unzip -o -q /tmp/tflint.zip -d /usr/local/bin/ \
+    && chmod +x /usr/local/bin/tflint \
+    && rm -f /tmp/tflint.zip
+
+  tflint --version || echo "WARNING: tflint install failed"
+}
+
+install_terragrunt() {
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64" \
+    -o /usr/local/bin/terragrunt \
+    && chmod +x /usr/local/bin/terragrunt
+
+  terragrunt --version || echo "WARNING: terragrunt install failed"
+}
+
+install_awscli() {
+  # Install AWS CLI v2 (official binary)
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
+    -o /tmp/awscliv2.zip \
+    && unzip -o -q /tmp/awscliv2.zip -d /tmp/ \
+    && /tmp/aws/install --update > /dev/null 2>&1 \
+    && rm -rf /tmp/awscliv2.zip /tmp/aws
+
+  aws --version || echo "WARNING: awscli install failed"
+
+  # Disable AWS CLI pager globally so output prints directly
+  mkdir -p /root/.aws
+  cat > /root/.aws/config <<'AWSCFG'
+[default]
+region = us-east-1
+output = json
+cli_pager =
+AWSCFG
+
+  # Install awscli-local (provides the 'awslocal' command)
+  pip3 install --break-system-packages awscli-local > /dev/null 2>&1 \
+    || {
+      # Fallback: create a shell wrapper if pip fails
+      cat > /usr/local/bin/awslocal <<'WRAPPER'
+#!/bin/bash
+export AWS_PAGER=""
+exec aws --endpoint-url=http://localhost:4566 --region us-east-1 "$@"
+WRAPPER
+      chmod +x /usr/local/bin/awslocal
+    }
+
+  awslocal --version || echo "WARNING: awslocal install failed"
+}
+
+start_localstack() {
+  cd /root/workspace
+  docker compose up -d
+
+  echo "Waiting for LocalStack to be ready..."
+  for i in $(seq 1 60); do
+    if curl -sf http://localhost:4566/_localstack/health > /dev/null 2>&1; then
+      echo "LocalStack is ready."
+      return 0
+    fi
+    sleep 2
+  done
+  echo "WARNING: LocalStack did not become healthy within 120 seconds"
+  docker compose logs
+}
+
+start_miniblue() {
+  cd /root/workspace
+  mkdir -p /root/.miniblue
+  docker compose up -d
+
+  echo "Waiting for miniblue to be ready..."
+  for i in $(seq 1 60); do
+    if curl -sf http://localhost:4566/health > /dev/null 2>&1; then
+      echo "miniblue is ready."
+      # Trigger an HTTPS request so miniblue generates its self-signed cert.
+      curl -sk https://localhost:4567/health > /dev/null 2>&1 || true
+
+      # Locate cert inside the container and copy to host.
+      # The miniblue image is distroless (no shell), so we can't `docker exec`
+      # to probe — `docker cp` itself is sufficient and silently fails on
+      # missing paths. Try known paths in order.
+      local cid
+      cid=$(docker compose ps -q miniblue 2>/dev/null)
+      for j in $(seq 1 30); do
+        if [ -n "$cid" ]; then
+          for p in /home/nonroot/.miniblue/cert.pem /root/.miniblue/cert.pem /app/.miniblue/cert.pem; do
+            if docker cp "$cid:$p" /root/.miniblue/cert.pem 2>/dev/null; then
+              break 2
+            fi
+          done
+        fi
+        sleep 1
+      done
+
+      if [ ! -f /root/.miniblue/cert.pem ]; then
+        echo "WARNING: failed to copy miniblue cert.pem out of container"
+      else
+        chmod 644 /root/.miniblue/cert.pem
+      fi
+
+      # Make SSL_CERT_FILE available for all interactive shells
+      cat > /etc/profile.d/miniblue.sh <<'PROF'
+export SSL_CERT_FILE=/root/.miniblue/cert.pem
+PROF
+      chmod +x /etc/profile.d/miniblue.sh
+      # Killercoda terminals are non-login interactive shells — they only source
+      # ~/.bashrc, not /etc/profile.d/*. Append the export there too (idempotent).
+      if ! grep -q 'SSL_CERT_FILE=/root/.miniblue/cert.pem' /root/.bashrc 2>/dev/null; then
+        echo 'export SSL_CERT_FILE=/root/.miniblue/cert.pem' >> /root/.bashrc
+      fi
+      export SSL_CERT_FILE=/root/.miniblue/cert.pem
+      return 0
+    fi
+    sleep 2
+  done
+  echo "WARNING: miniblue did not become healthy within 120 seconds"
+  docker compose logs
+}
+
+finish_setup() {
+  touch /tmp/.setup-done
+}
+
+install_azlocal() {
+  # azlocal is a standalone Go CLI bundled inside the miniblue image at /azlocal
+  # (analogous to awslocal for LocalStack). It uses HTTP on port 4566 and needs
+  # no certificate or az CLI. Requires miniblue to be running.
+  local cid
+  cid=$(docker compose ps -q miniblue 2>/dev/null)
+  if [ -z "$cid" ]; then
+    cid=$(docker ps -q --filter "name=miniblue" | head -1)
+  fi
+  if [ -n "$cid" ]; then
+    docker cp "$cid:/azlocal" /usr/local/bin/azlocal 2>/dev/null \
+      && chmod +x /usr/local/bin/azlocal
+  fi
+  azlocal --help > /dev/null 2>&1 || echo "WARNING: azlocal install failed"
+}

terraform-tutorial/terraform-cli-plan-azure/finish/finish.md

@@ -0,0 +1,30 @@
+# 恭喜完成 terraform plan 实战练习（Azure 版）！
+
+## 知识总结
+
+| 功能 | 命令 / 参数 | 核心场景 |
+|------|------------|---------|
+| 预览变更 | terraform plan | 日常开发前的必做步骤 |
+| 无变更检测 | Plan: 0 to add... | 确认配置与远端一致 |
+| 预览全量销毁 | terraform plan -destroy | 执行 destroy 前的安全确认 |
+| 对齐带外变更 | terraform plan -refresh-only | 有人在 Terraform 外手动变更了资源 |
+| 保存计划文件 | terraform plan -out=tfplan | CI/CD 两步工作流（plan → approve → apply） |
+| 查看计划文件 | terraform show tfplan | 以可读格式查看已保存的计划 |
+| 定向规划 | terraform plan -target=ADDR | 故障恢复等特殊场景，非常规使用 |
+| 强制重建 | terraform plan -replace=ADDR | 替代 terraform taint |
+| 命令行变量 | terraform plan -var 'k=v' | 临时覆盖单个变量 |
+| 变量文件 | terraform plan -var-file=f.tfvars | 多变量批量注入 |
+| 三态退出码 | terraform plan -detailed-exitcode | 脚本化判断是否有变更 |
+
+## Azure 版要点回顾
+
+- 本课程用 [miniblue](https://miniblue.io/) 在本地完整模拟 Azure REST API，无需真实订阅
+- azurerm provider 通过 `metadata_host = "localhost:4567"` 指向 miniblue 的 HTTPS 端点
+- `azlocal` CLI 走 HTTP 4566，无需证书，类似 `awslocal`，用于校验资源
+- 所有 plan 子命令、参数、工作流与 AWS / LocalStack 版完全一致——这正是 Terraform 多云抽象的价值所在
+
+## 重要提醒
+
+- 计划文件（-out 产生的文件）包含完整的变量值（含敏感数据），请视为敏感制品
+- -target 是应急手段，不是日常工具
+- 在 CI 中推荐组合：terraform plan -out=tfplan -input=false -no-color -detailed-exitcode