# Lab 2: two applies at once Run three applies against one state while one of them holds a lock. Read the locks and the log afterwards. Level: advanced · Time: 20 minutes · Needs: B7 You will learn: Which applies can run at the same time? What does a refused apply look like, and where is it recorded? Done when: One apply is refused with exit code 4 while another runs, and you can read the lock and the refusal. OpenTofu holds one lock for the whole state. pravo holds one lock for each resource that an apply writes. Two applies that write different resources run at the same time. An apply that needs a resource another process holds is refused. Outputs are one record that each apply updates when it ends: an apply writes the outputs it changed and keeps the rest as recorded. The specification of this lab has no outputs. This lab starts three applies on one state while one of them is busy. It uses a key that takes seconds to generate, which gives the first apply time to hold its lock. The time varies between machines and runs. ## Prepare the plans Work in an empty directory. Start with one file and apply it, so that the state exists. ```cue file=main.cue title="main.cue" package main import ( loc "pravo.dev/providers/hashicorp/local" tlsp "pravo.dev/providers/hashicorp/tls" ) $local: loc.#Provider $tls: tlsp.#Provider base: $local.#Resource.local_file & {filename: "base.txt", content: "base\n"} ``` ```sh run pravo init pravo apply --auto-approve ``` ```text out Configuration does not load yet; generating schemas for the declared providers first. Created cue.mod/module.cue Providers: local = hashicorp/local v2.9.1 tls = hashicorp/tls v4.4.1 ... pravo has been initialised. Run "pravo plan" to see what it would do. ... Apply complete! Resources: 1 added, 0 changed, 0 destroyed. [txn ] ``` Add two resources. `slow` is an RSA key of 8192 bits, which takes seconds to create. `quick` is a file. ```cue file=main.cue title="main.cue" hl="13-14" package main import ( loc "pravo.dev/providers/hashicorp/local" tlsp "pravo.dev/providers/hashicorp/tls" ) $local: loc.#Provider $tls: tlsp.#Provider base: $local.#Resource.local_file & {filename: "base.txt", content: "base\n"} slow: $tls.#Resource.tls_private_key & {algorithm: "RSA", rsa_bits: 8192} quick: $local.#Resource.local_file & {filename: "quick.txt", content: "quick\n"} ``` Save one plan. Three people each get a copy: Ana, Bob and a CI job. ```sh run pravo plan --out all.plan cp all.plan a.plan cp all.plan b.plan cp all.plan c.plan ``` ```text out ... # slow (tls_private_key) will be created + slow: { + algorithm: "RSA" ... + rsa_bits: 8192 } ... Plan: 2 to add, 0 to change, 0 to destroy. Graph: planned 2 of 3, 1 unchanged and skipped, 1 not read. Saved the plan to all.plan. To apply exactly these actions, run: pravo apply all.plan ``` Each copy creates two resources. A plan may be applied in parts, as in [B7](b07-changing-live-infrastructure.md). The parts here are `slow` and `quick`. ## Wait for a lock A script that waits until a resource is locked makes the run repeatable. It asks `pravo state locks` ten times a second. ```sh file=wait-for-lock.sh title="wait-for-lock.sh" for i in $(seq 1 200); do pravo state locks | grep -q "^$1 " && exit 0 sleep 0.1 done exit 1 ``` ## Run three applies :::predict Ana applies slow and holds its lock. While she works, Bob applies quick and the CI job applies slow. Which of the two succeeds? The locks are per resource. Ask what each apply needs to write. ::reveal Bob's apply succeeds, because `quick` is free. The CI job is refused with exit code 4, because `slow` is locked. Nothing waits and nothing queues. ::: Ana starts in the background. The script returns when `slow` is locked. Then the CI job and Bob run, in that order. ```sh run pravo apply a.plan --only slow --actor ana > a.log 2>&1 & ana=$! sh wait-for-lock.sh slow pravo state locks pravo apply c.plan --only slow --actor ci echo "exit $?" pravo apply b.plan --only quick --actor bob echo "exit $?" kill -0 $ana && echo "ana is still running" wait $ana cat a.log ``` ```text out slow locked by ana, pid on since