2. Keep configuration explicit and secrets out of artifacts

Objective & prerequisites

Validate an environment contract before a process performs work. Prerequisites: Python functions, JSON, basic SQL, Git and the existing software/testing workshops. Extract the full kit and open a terminal in cloud-operations-kit. Python 3.10+ with its standard SQLite module is sufficient for the executed labs; no cloud account, credentials, package installation or network is needed. All data and prices are invented teaching fixtures. The runnable drills use new temporary folders and databases, never the website or hosting. These free companions retain existing course progress/access. Payments and public registration remain disabled.

python3 lab.py
python3 -m unittest discover -s tests -v

Understand the concept

Configuration should distinguish environments without embedding private credentials in source or release archives. Treat environment values as strings until deliberately parsed; the string "false" is not the boolean False. Validate required fields, supported values and resource limits before starting work. This lab accepts only a closed local-lab contract with one to four workers, one to three total attempts and a bounded timeout. It refuses unknown fields and enabled launch gates. Those are teaching constraints; this file is not the production website configuration. Real secrets belong in an appropriately restricted secret facility or private configuration, with rotation and owner-controlled access. Avoid printing full environment dumps or source records in error logs.

Worked example

The supplied JSON specifies two workers, three maximum total attempts and five-second timeout. A misspelled key, API-key field, boolean worker count or string launch flag fails. The validator returns only the known safe fields. It does not read the machine’s environment, change Aruba credentials or start actual workers. A bounds check is not proof that a real scheduler respects the same limits; connect and test that behavior separately.

from lab import config,load
value=load("config.json")
assert config(value)["max_attempts"]==3
try:
    config({**value,"workers":True})
except ValueError:
    pass
else:
    raise AssertionError("Boolean worker count must fail")

Try it yourself

In copies, set workers to 0, True and 8; replace false with the string "false"; add a secret-like field. Predict the rejection category. Draft a deployment configuration checklist separating public values, private values and operational ownership without inserting any real secret. Predict the result first, keep the original fixture, and record the exact command and observed outcome from your practice copy.

Knowledge check

Is storing a password in an environment variable by itself a complete secrets-management policy?

Evidence, mistakes & handover

State whether an activity was executed locally, reviewed as a design, or left unexecuted. A successful local drill does not verify a cloud provider, container, hosted pipeline or production recovery. Keep an owner, acceptance criteria, known failures and rollback/cleanup evidence with the work. The download includes source fixtures, runnable drills/tests, separate exercises and solutions, a runbook, a resource plan, an optional container/CI review pack and a capstone rubric. Credit the teaching baseline and your own contribution; no certification, commercial service or employment guarantee follows.

Authoritative reference

Read the official reference ↗

— primary/official reference for the mechanism. Lesson explanations and fictional cases are original. Provider details can differ; this lesson does not configure or provision an account. No production access, payment, public registration or live deployment is activated.