Order does not matter

In HCL, where a value is read decides which value wins. These two commands differ only in the order of their arguments.

tofu plan -var-file=base.tfvars -var-file=prod.tfvars   # prod.tfvars wins where both set a name
tofu plan -var-file=prod.tfvars -var-file=base.tfvars   # base.tfvars wins

OpenTofu reads variable values from several sources and keeps the last one it reads. The order, from first to last:

1. TF_VAR_ environment variables.
2. terraform.tfvars, then terraform.tfvars.json.
3. *.auto.tfvars and *.auto.tfvars.json files, in file-name order.
4. -var and -var-file options, in the order given.

Override files add a second order for configuration.

CUE has no precedence list. Every line and every file adds constraints, and unification gives the same result in any order. The files of one directory that start with the same package line form one package. pravo evaluates the package as a whole.

Warm-up

Start from the estate

Work in the directory from A3. If you start here, write these two files.

package estate

buckets: {
	logs: {
		name:           "logs"
		versioning:     true // keep old versions
		encrypted:      true
		retention_days: 365
		tags: owner: "platform"
	}
	uploads: {
		name:           "uploads"
		versioning:     false
		encrypted:      true
		retention_days: 30
		tags: owner: "web"
	}
}

rules: {
	https: {
		port:     443
		protocol: "tcp"
	}
	ssh: {
		port:     22
		protocol: "tcp"
	}
}

package estate

buckets: uploads: tags: cost_center: "4711"

buckets: uploads: tags: env: "prod"

Save the output. You compare against it later.

Swap two lines

Add a new field to uploads in a scratch file. One line gives it a type and one line gives it a value.

package estate

buckets: uploads: class: string
buckets: uploads: class: "standard"

"standard"

Swap the two lines.

package estate

buckets: uploads: class: "standard"
buckets: uploads: class: string

"standard"

The value is the same. In HCL, swapping two assignments to one name changes which one wins. In CUE, a type and a value that agree give the value in either order.

Remove the scratch file.

Rename a file

Files behave like lines. pravo reads the files of a directory in the order of their names. Rename estate.cue so that it sorts after team.cue, and compare the output with the output you saved.

same

Put the name back.

Two files that name the same field still have to agree. Order cannot make a conflict disappear.

Predict

365
365
365
365
365
365

Break it

A file that names another package cannot join the estate. Write prod.cue with package prod, as if the package were named after the file.

package prod

buckets: logs: retention_days: >=365

Error: loading .:
prod.cue is package prod; the other files are package estate

Read the error from left to right.

• Stage. loading says that pravo could not assemble the files into one package. It reported the error before it evaluated any value.
• Message. prod.cue is package prod; the other files are package estate names the file, its package and the package of the other files. A directory holds one package.
• Location. The problem is the package line of a whole file, so there is no line number.

Change the first line of prod.cue to package estate.

package estate

buckets: logs: retention_days: >=365

same

The third file adds a bound that logs already meets, so the data is unchanged.

The opposite mistake is reported too. Delete the first line of prod.cue.

buckets: logs: retention_days: >=365

Error: loading .:
prod.cue has no package clause; the other files are package estate

A file without a package line cannot join the estate. pravo names the file and stops before it evaluates a value. Remove the file.

Exercise

[ ! -f estate.cue ] || { echo "estate.cue still exists"; exit 1; }
set -- *.cue
[ $# -eq 3 ] || { echo "expected three .cue files, found $#"; exit 1; }
tmp=$(mktemp -d)
for order in "$1 $2 $3" "$3 $1 $2" "$2 $3 $1"; do
  rm -rf "$tmp/d"; mkdir "$tmp/d"; n=0
  for f in $order; do n=$((n + 1)); cp "$f" "$tmp/d/$n.cue"; done
  if ! pravo -C "$tmp/d" eval | diff before.txt - > /dev/null; then
    echo "different output for the order: $order"; rm -rf "$tmp"; exit 1
  fi
done
rm -rf "$tmp"
echo ok

estate.cue still exists

package estate

buckets: {
	logs: {
		name:           "logs"
		versioning:     true // keep old versions
		encrypted:      true
		retention_days: 365
		tags: owner: "platform"
	}
	uploads: {
		name:           "uploads"
		versioning:     false
		encrypted:      true
		retention_days: 30
		tags: owner: "web"
	}
}

package estate

rules: {
	https: {
		port:     443
		protocol: "tcp"
	}
	ssh: {
		port:     22
		protocol: "tcp"
	}
}

Recap

• Lines and files can come in any order. Unification gives the same value, so there is no precedence list.
• The files of a directory that start with the same package line form one package. A directory holds one package.
• Order can change the order of the printed fields. It cannot change a value.
• A file without a package line, or with another one, is an error that names the file. Start every file with the same package line.

The next lesson turns a rule into a value: a range, or text of a given shape.