Simulator: practise for $0

Why a simulator?

An EKS environment costs money every hour (control plane, NAT gateway, nodes, load balancers). Most of the skills in this course (writing modules, structuring state, reading plans, running the platform layer, following playbooks) can be practised without it.

1. Unit-test Terraform with mock providers

Terraform 1.7+ can replace a provider with a mock in tests, so plans run without credentials:

# modules/eks-network/main.tf (simplified)
variable "azs"          { type = list(string) }
variable "cluster_name" { type = string }

resource "aws_vpc" "this" { cidr_block = "10.20.0.0/16" }

resource "aws_subnet" "private" {
  count             = length(var.azs)
  vpc_id            = aws_vpc.this.id
  availability_zone = var.azs[count.index]
  cidr_block        = cidrsubnet("10.20.0.0/16", 8, count.index + 1)
  tags = {
    "kubernetes.io/role/internal-elb" = "1"
    "Name"                            = "${var.cluster_name}-private-${var.azs[count.index]}"
  }
}

# modules/eks-network/tests/network.tftest.hcl
mock_provider "aws" {}

variables {
  cluster_name = "sim"
  azs          = [ "eu-west-1a", "eu-west-1b", "eu-west-1c" ]
}

run "one_private_subnet_per_az" {
  command = plan
  assert {
    condition     = length(aws_subnet.private) == 3
    error_message = "expected one private subnet per AZ"
  }
}

run "subnets_tagged_for_internal_lbs" {
  command = plan
  assert {
    condition     = alltrue([for s in aws_subnet.private : s.tags["kubernetes.io/role/internal-elb"] == "1"])
    error_message = "private subnets must carry the internal-elb tag"
  }
}

$ cd modules/eks-network && terraform init && terraform test

Good for: tags, counts, naming, conditionals, variable validation, outputs. Not for: whether AWS accepts it.

2. LocalStack for the state backend and basic VPC work

LocalStack emulates many AWS APIs locally. Its free edition covers services such as S3, DynamoDB, IAM and basic EC2/VPC calls; EKS emulation is not part of the free tier (check LocalStack's feature coverage for your version).

terraform {
  backend "s3" {
    bucket                      = "tfstate-sim"
    key                         = "eks/sim/network/terraform.tfstate"
    region                      = "us-east-1"
    endpoints                   = { s3 = "http://localhost:4566", dynamodb = "http://localhost:4566" }
    use_path_style              = true
    skip_credentials_validation = true
    skip_requesting_account_id  = true
    skip_metadata_api_check     = true
    access_key                  = "test"
    secret_key                  = "test"
  }
}

(Backend option names changed in Terraform 1.6; the tflocal wrapper from LocalStack can configure endpoints for you.) Practise: remote state, locking, state pull, restoring an S3 object version (lesson 17, RB-2), and applying a small VPC.

3. kind for the platform layer

Create a kind cluster and point the platform layer's helm/kubernetes providers (or Argo CD) at it:

Practise the creation playbook's Phase 4 and 5 gates, Argo CD syncs, rollbacks and the day-2 procedures that are pure Kubernetes.

4. Plan-reading drills

Take real plans (from a colleague, or your own sandbox runs, sanitised) and practise spotting: must be replaced, unexpected deletes, changes in the wrong environment, and drift. Five minutes a day builds the reflex that prevents most Terraform incidents.

5. The real session: short and budgeted

When you need real EKS (control plane, node groups, Karpenter, ALB, IAM end to end):

• Set an AWS Budgets alert first.
• Use the creation playbook (lesson 13), do the exercise, then the safe teardown (lesson 14) the same day.
• Keep a checklist of exactly what you want to test, so the session is focused.

Command summary

terraform fmt -check && terraform validate
terraform test                                   # with mock_provider "aws" in tests/*.tftest.hcl
docker run -d -p 4566:4566 localstack/localstack
terraform init   # backend "s3" with LocalStack endpoints
aws --endpoint-url http://localhost:4566 s3api list-object-versions --bucket tfstate-sim
kind create cluster --name eks-sim ; kubectl cluster-info --context kind-eks-sim

Recap

• terraform test + mock providers unit-test module logic without an account.
• LocalStack covers the state backend and basic AWS resources (not EKS in the free edition).
• kind rehearses the platform layer with stand-ins for AWS-specific parts.
• Practise plan reading; keep real AWS sessions short, budgeted and torn down.