Add Azure (miniblue) version of terraform-cli-import scenario

Agent-Logs-Url: https://github.com/lonegunmanb/terraform-tutorial/sessions/3c1d9ae3-896c-41ac-8b41-0f34fd9a8fa1

Co-authored-by: lonegunmanb <2233414+lonegunmanb@users.noreply.github.com>

Author: Copilot

docs/terraform-cli-import.md

@@ -135,4 +135,10 @@ shell 中使用 `for_each` 的 key 时，注意引号的转义。Linux/macOS 中
 - 导入后务必运行 `terraform plan` 验证配置与实际状态的一致性。plan 有差异时应补全配置，否则下一次 apply 可能会修改或销毁已导入的资源。
 - provider 配置不能依赖 data source 的输出。
 
-<KillercodaEmbed src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-import" />
+<KillercodaEmbed src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-import" title="实验环境（AWS / LocalStack 版）" />
+
+<KillercodaEmbed
+  src="https://killercoda.com/lonegunman-terraform-tutorial/course/terraform-tutorial/terraform-cli-import-azure"
+  title="实验环境（Azure / miniblue 版）"
+  desc="点击下方按钮在新标签页中打开 Azure 版 Killercoda 实验环境，预装了 Terraform + miniblue（Azure 本地模拟器），所有 import 子命令与 AWS 版完全一致。"
+/>

terraform-tutorial/structure.json

@@ -30,6 +30,7 @@
     { "path": "terraform-cli-show" },
     { "path": "terraform-cli-output" },
     { "path": "terraform-cli-import" },
+    { "path": "terraform-cli-import-azure" },
     { "path": "terraform-cli-providers" },
     { "path": "terraform-cli-state" },
     { "path": "terraform-cli-workspace" },

terraform-tutorial/terraform-cli-import-azure/assets/docker-compose.yml

@@ -0,0 +1,10 @@
+services:
+  miniblue:
+    image: ghcr.io/lonegunmanb/miniblue:sha-8cc1c25
+    ports:
+      - "4566:4566"
+      - "4567:4567"
+    deploy:
+      resources:
+        limits:
+          memory: 512M

terraform-tutorial/terraform-cli-import-azure/assets/foreach.tf

@@ -0,0 +1,15 @@
+# 用于 Step 2：for_each 导入
+variable "rg_envs" {
+  type    = set(string)
+  default = ["dev", "staging"]
+}
+
+resource "azurerm_resource_group" "per_env" {
+  for_each = var.rg_envs
+  name     = "app-${each.key}-rg"
+  location = "East US"
+  tags = {
+    Environment = each.key
+    ManagedBy   = "Terraform"
+  }
+}

terraform-tutorial/terraform-cli-import-azure/assets/main.tf

@@ -0,0 +1,23 @@
+terraform {
+  required_version = ">= 1.0"
+  required_providers {
+    azurerm = {
+      source  = "hashicorp/azurerm"
+      version = "~> 4.0"
+    }
+  }
+}
+
+provider "azurerm" {
+  features {}
+
+  # miniblue HTTPS metadata endpoint
+  metadata_host                   = "localhost:4567"
+  resource_provider_registrations = "none"
+
+  # miniblue 接受任意凭据
+  subscription_id = "00000000-0000-0000-0000-000000000000"
+  tenant_id       = "00000000-0000-0000-0000-000000000001"
+  client_id       = "miniblue"
+  client_secret   = "miniblue"
+}

terraform-tutorial/terraform-cli-import-azure/assets/setup-common.sh

@@ -0,0 +1,194 @@
+#!/bin/bash
+# ─────────────────────────────────────────────────────────
+# setup-common.sh — shared setup functions for Killercoda scenarios
+#
+# This file is the SINGLE SOURCE OF TRUTH for common setup logic.
+# It is copied into each scenario's assets/ directory by:
+#   npm run sync-setup  (or automatically via prebuild)
+#
+# Usage in background.sh:
+#   source /root/setup-common.sh
+#   install_terraform
+#   install_awscli        # optional — AWS CLI v2 + awslocal wrapper
+#   install_tflint        # optional — only in scenarios that need it
+#   start_localstack
+#   install_theia_plugin
+#   finish_setup
+# ─────────────────────────────────────────────────────────
+
+TERRAFORM_VERSION="${TERRAFORM_VERSION:-1.14.8}"
+TFLINT_VERSION="${TFLINT_VERSION:-v0.61.0}"
+TERRAGRUNT_VERSION="${TERRAGRUNT_VERSION:-0.77.5}"
+# Note: the miniblue container image tag is pinned in scripts/miniblue-image.mjs
+# and propagated into every docker-compose.yml by `npm run sync-miniblue`.
+# There is no shell-side miniblue version variable — start_miniblue just runs
+# `docker compose up -d` against the pinned compose file.
+
+install_terraform() {
+  if ! command -v unzip > /dev/null 2>&1; then
+    apt-get update -qq && apt-get install -y -qq unzip > /dev/null 2>&1
+  fi
+
+  # Install Docker Compose v2 plugin (binary download — apt package not available on Killercoda)
+  if ! docker compose version > /dev/null 2>&1; then
+    mkdir -p /usr/local/lib/docker/cli-plugins
+    curl --connect-timeout 10 --max-time 120 -fsSL \
+      "https://github.com/docker/compose/releases/latest/download/docker-compose-linux-x86_64" \
+      -o /usr/local/lib/docker/cli-plugins/docker-compose
+    chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
+  fi
+
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip" \
+    -o /tmp/terraform.zip \
+    && unzip -o -q /tmp/terraform.zip -d /usr/local/bin/ \
+    && chmod +x /usr/local/bin/terraform \
+    && rm -f /tmp/terraform.zip
+
+  terraform version || echo "WARNING: terraform install failed"
+}
+
+install_tflint() {
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://github.com/terraform-linters/tflint/releases/download/${TFLINT_VERSION}/tflint_linux_amd64.zip" \
+    -o /tmp/tflint.zip \
+    && unzip -o -q /tmp/tflint.zip -d /usr/local/bin/ \
+    && chmod +x /usr/local/bin/tflint \
+    && rm -f /tmp/tflint.zip
+
+  tflint --version || echo "WARNING: tflint install failed"
+}
+
+install_terragrunt() {
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://github.com/gruntwork-io/terragrunt/releases/download/v${TERRAGRUNT_VERSION}/terragrunt_linux_amd64" \
+    -o /usr/local/bin/terragrunt \
+    && chmod +x /usr/local/bin/terragrunt
+
+  terragrunt --version || echo "WARNING: terragrunt install failed"
+}
+
+install_awscli() {
+  # Install AWS CLI v2 (official binary)
+  curl --connect-timeout 10 --max-time 120 -fsSL \
+    "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \
+    -o /tmp/awscliv2.zip \
+    && unzip -o -q /tmp/awscliv2.zip -d /tmp/ \
+    && /tmp/aws/install --update > /dev/null 2>&1 \
+    && rm -rf /tmp/awscliv2.zip /tmp/aws
+
+  aws --version || echo "WARNING: awscli install failed"
+
+  # Disable AWS CLI pager globally so output prints directly
+  mkdir -p /root/.aws
+  cat > /root/.aws/config <<'AWSCFG'
+[default]
+region = us-east-1
+output = json
+cli_pager =
+AWSCFG
+
+  # Install awscli-local (provides the 'awslocal' command)
+  pip3 install --break-system-packages awscli-local > /dev/null 2>&1 \
+    || {
+      # Fallback: create a shell wrapper if pip fails
+      cat > /usr/local/bin/awslocal <<'WRAPPER'
+#!/bin/bash
+export AWS_PAGER=""
+exec aws --endpoint-url=http://localhost:4566 --region us-east-1 "$@"
+WRAPPER
+      chmod +x /usr/local/bin/awslocal
+    }
+
+  awslocal --version || echo "WARNING: awslocal install failed"
+}
+
+start_localstack() {
+  cd /root/workspace
+  docker compose up -d
+
+  echo "Waiting for LocalStack to be ready..."
+  for i in $(seq 1 60); do
+    if curl -sf http://localhost:4566/_localstack/health > /dev/null 2>&1; then
+      echo "LocalStack is ready."
+      return 0
+    fi
+    sleep 2
+  done
+  echo "WARNING: LocalStack did not become healthy within 120 seconds"
+  docker compose logs
+}
+
+start_miniblue() {
+  cd /root/workspace
+  mkdir -p /root/.miniblue
+  docker compose up -d
+
+  echo "Waiting for miniblue to be ready..."
+  for i in $(seq 1 60); do
+    if curl -sf http://localhost:4566/health > /dev/null 2>&1; then
+      echo "miniblue is ready."
+      # Trigger an HTTPS request so miniblue generates its self-signed cert.
+      curl -sk https://localhost:4567/health > /dev/null 2>&1 || true
+
+      # Locate cert inside the container and copy to host.
+      # The miniblue image is distroless (no shell), so we can't `docker exec`
+      # to probe — `docker cp` itself is sufficient and silently fails on
+      # missing paths. Try known paths in order.
+      local cid
+      cid=$(docker compose ps -q miniblue 2>/dev/null)
+      for j in $(seq 1 30); do
+        if [ -n "$cid" ]; then
+          for p in /home/nonroot/.miniblue/cert.pem /root/.miniblue/cert.pem /app/.miniblue/cert.pem; do
+            if docker cp "$cid:$p" /root/.miniblue/cert.pem 2>/dev/null; then
+              break 2
+            fi
+          done
+        fi
+        sleep 1
+      done
+
+      if [ ! -f /root/.miniblue/cert.pem ]; then
+        echo "WARNING: failed to copy miniblue cert.pem out of container"
+      else
+        chmod 644 /root/.miniblue/cert.pem
+      fi
+
+      # Make SSL_CERT_FILE available for all interactive shells
+      cat > /etc/profile.d/miniblue.sh <<'PROF'
+export SSL_CERT_FILE=/root/.miniblue/cert.pem
+PROF
+      chmod +x /etc/profile.d/miniblue.sh
+      # Killercoda terminals are non-login interactive shells — they only source
+      # ~/.bashrc, not /etc/profile.d/*. Append the export there too (idempotent).
+      if ! grep -q 'SSL_CERT_FILE=/root/.miniblue/cert.pem' /root/.bashrc 2>/dev/null; then
+        echo 'export SSL_CERT_FILE=/root/.miniblue/cert.pem' >> /root/.bashrc
+      fi
+      export SSL_CERT_FILE=/root/.miniblue/cert.pem
+      return 0
+    fi
+    sleep 2
+  done
+  echo "WARNING: miniblue did not become healthy within 120 seconds"
+  docker compose logs
+}
+
+finish_setup() {
+  touch /tmp/.setup-done
+}
+
+install_azlocal() {
+  # azlocal is a standalone Go CLI bundled inside the miniblue image at /azlocal
+  # (analogous to awslocal for LocalStack). It uses HTTP on port 4566 and needs
+  # no certificate or az CLI. Requires miniblue to be running.
+  local cid
+  cid=$(docker compose ps -q miniblue 2>/dev/null)
+  if [ -z "$cid" ]; then
+    cid=$(docker ps -q --filter "name=miniblue" | head -1)
+  fi
+  if [ -n "$cid" ]; then
+    docker cp "$cid:/azlocal" /usr/local/bin/azlocal 2>/dev/null \
+      && chmod +x /usr/local/bin/azlocal
+  fi
+  azlocal --help > /dev/null 2>&1 || echo "WARNING: azlocal install failed"
+}

terraform-tutorial/terraform-cli-import-azure/finish/finish.md

@@ -0,0 +1,31 @@
+# 恭喜完成 terraform import 实战练习（Azure 版）！
+
+## 知识总结
+
+| 功能 | 方式 | 核心场景 |
+|------|------|---------|
+| 导入单个资源 | terraform import ADDR ID | 临时导入、快速接管 |
+| 导入到 count 资源 | terraform import 'ADDR[0]' ID | 多实例资源按索引导入 |
+| 导入到 for_each 资源 | terraform import 'ADDR["key"]' ID | 多实例资源按 key 导入 |
+
+## Azure 版要点回顾
+
+- azurerm 资源的 ID 是完整的 Azure Resource ID（形如 /subscriptions/{sub}/resourceGroups/{name}/providers/...），与 AWS 的简短 ID（桶名、实例 ID）不同
+- 本课程用 [miniblue](https://miniblue.io/) 在本地完整模拟 Azure REST API，无需真实订阅
+- 所有 import 子命令、参数、工作流与 AWS / LocalStack 版完全一致——这正是 Terraform 多云抽象的价值所在
+
+## 导入工作流
+
+```
+1. 在配置中声明 resource 块（可以是空的）
+2. 执行 terraform import
+3. 运行 terraform plan 查看差异
+4. 补全配置直到 plan 显示 No changes
+```
+
+## 关键要点
+
+- terraform import 不会自动生成配置，需要手动编写 resource 块
+- 每个远端资源只能导入到一个 Terraform 资源地址
+- 导入后务必运行 terraform plan 验证一致性
+- 声明式 import 块的用法请参考代码重构章节

terraform-tutorial/terraform-cli-import-azure/index.json

@@ -0,0 +1,38 @@
+{
+  "title": "terraform import（Azure / miniblue 版）：导入已有基础设施",
+  "description": "通过 miniblue 模拟的 Azure 资源（Resource Group），掌握 terraform import 命令导入单个资源、补全配置、导入到 for_each 资源等核心能力",
+  "details": {
+    "intro": {
+      "text": "init/init.md",
+      "background": "init/background.sh",
+      "foreground": "init/foreground.sh"
+    },
+    "steps": [
+      {
+        "title": "terraform import 命令：手动导入单个资源",
+        "text": "step1/text.md"
+      },
+      {
+        "title": "导入到 for_each 资源",
+        "text": "step2/text.md"
+      }
+    ],
+    "finish": {
+      "text": "finish/finish.md"
+    },
+    "assets": {
+      "host01": [
+        {"file": "setup-common.sh", "target": "/root", "chmod": "+x"},
+        {"file": "main.tf", "target": "/root/workspace"},
+        {"file": "docker-compose.yml", "target": "/root/workspace"},
+        {"file": "foreach.tf", "target": "/root"}
+      ]
+    }
+  },
+  "backend": {
+    "imageid": "ubuntu"
+  },
+  "interface": {
+    "layout": "editor-terminal"
+  }
+}