Automation and Infrastructure as Code
Automation and Infrastructure as Code
This domain tests reproducible provisioning and change delivery on IBM Cloud, especially Terraform through IBM Cloud Schematics and pipeline automation.
Core rules
- Treat infrastructure as code: versioned, reviewed, idempotent, and applied through a pipeline. IBM Cloud Schematics runs Terraform workspaces and can detect drift.
- Keep Terraform state remote and locked; store it in IBM Cloud Object Storage with access controls. Never commit state or secrets to Git.
- Use variables and modules for repeatability across accounts, resource groups, and regions.
- Automate build, test, scan, plan, and apply. Require a plan review before apply for production.
- Use immutable images and blue/green or canary deployment to reduce change risk. IBM Cloud Code Engine and Tekton pipelines can run containerized jobs.
Worked example
A team needs a VPC, subnets in three zones, and an IBM Cloud Kubernetes Service cluster. They write a Terraform module with variables for region and resource group, store state in Object Storage, and run terraform plan in Schematics. The plan shows a subnet CIDR change that would recreate the cluster. The reviewer rejects the apply and splits the change into a new subnet plus migration. Reasoning: plan output exposes destructive changes before production impact.
Traps
Console changes create drift and snowflakes. Storing API keys in Git or pipeline logs leaks credentials. Applying without a saved plan can change resources unexpectedly. Ignoring state locking causes concurrent applies and corruption. Do not assume Terraform can manage every IBM Cloud service equally; verify provider coverage.