§ Reference · Lookup

Not in pravo

The commands, flags, blocks and files of OpenTofu and Terraform that pravo does not have, and what to use in each place.

View as Markdown

On this page

pravo has no workspaces. Select the environment with -t env=prod. Each row below states one absent feature and the replacement. For the full mapping of constructs, commands and functions, see Migrate.

Commands and flags

In OpenTofu or Terraform	In pravo	Use
`workspace`, `terraform.workspace`	Absent.	A tagged field selects the environment: `env: *"dev" \| "prod" @tag(env)` and `-t env=prod`. The state path takes the tag: `$settings: state: path: "state/\(env)"`. See Settings.
`-target`	Absent.	A plan reaches only what a change reaches. `pravo plan --out FILE` and `pravo apply FILE --only ADDR` apply a closed part of a plan that was reviewed whole.
`taint`, `untaint`	Absent.	`pravo plan --replace ADDR` replaces a resource although the specification did not change.
`refresh`, `plan -refresh-only`	Absent.	`pravo drift` reads every resource and reports the ones that changed. `-refresh=all` reads every record in a plan.
`console`	Absent.	`pravo eval -e EXPRESSION` evaluates an expression in the scope of the specification.
`graph`	Absent.	`pravo state graph` prints the edges of the state. `-dot` prints Graphviz.
`force-unlock`	Absent.	`pravo state unlock ADDR` removes the lock or the reservation of one node.
`test`	Absent.	`pravo validate` checks the constraints before a provider starts. `pravo plan --policy FILE` judges a plan.
`login`, `logout`	Absent.	Credentials come from the environment and from the files that each provider documents.
`-var`, `-var-file`, `TF_VAR_*`	Absent.	`-t name=value` fills a field tagged `@tag(name)`. `pravo.#Env` and `pravo.#SecretEnv` read environment variables.
`-lock`, `-lock-timeout`	Absent.	Each node has its own lock. A command that needs a node held by another is rejected.
`-parallelism`	Absent.	Independent nodes run at the same time.
`-input=false`	Absent.	`apply` and `destroy` ask for approval, and `--auto-approve` skips the question. No other command prompts.
`-backend-config`	Absent.	The state settings are CUE. They can depend on a tag.
`output -raw`	Absent.	`pravo output NAME` prints JSON. `pravo output NAME \| jq -r .` prints the bare string.

terminal

$for c in workspace taint untaint console test graph refresh force-unlock login logout; do pravo $c 2>&1 | grep '^Error'; done

$for f in -target=pet -var=a=1 -var-file=x -lock=false -lock-timeout=5s -parallelism=2 -refresh-only -input=false -backend-config=x; do pravo plan $f 2>&1 | grep '^Error'; done

$pravo output --raw 2>&1 | grep '^Error'

Error: unknown command "workspace" for "pravo"
Error: unknown command "taint" for "pravo"
Error: unknown command "untaint" for "pravo"
Error: unknown command "console" for "pravo"
Error: unknown command "test" for "pravo"
Error: unknown command "graph" for "pravo"
Error: unknown command "refresh" for "pravo"
Error: unknown command "force-unlock" for "pravo"
Error: unknown command "login" for "pravo"
Error: unknown command "logout" for "pravo"
Error: unknown flag: --target
Error: unknown flag: --var
Error: unknown flag: --var-file
Error: unknown flag: --lock
Error: unknown flag: --lock-timeout
Error: unknown flag: --parallelism
Error: unknown flag: --refresh-only
Error: unknown flag: --input
Error: unknown flag: --backend-config
Error: unknown flag: --raw

Language

In OpenTofu or Terraform	In pravo	Use
`variable` block with `default`, `type` and `validation`	Absent.	A field with a default, a type and a constraint: `retention: *30 \| int & >0 @tag(retention,type=int)`. See Tags and variables.
`locals`	Absent.	Any field. A field that starts with `_` is hidden, and `let` names a value inside a struct.
`count`, `for_each`, `dynamic`	Absent.	A comprehension: `for r in regions {"\(r)": ...}`. The key is the last element of the address. See Resources.
Conditional expression `? :`, `for` expressions	Absent.	`if` and `for` clauses, and CUE disjunctions with defaults.
`depends_on`	`$depends_on`	A list of references, for ordering with no data flow. See Meta fields.
`lifecycle`	`$lifecycle`	`create_before_destroy`, `prevent_destroy`, `ignore_changes` and `refresh`. There is no `replace_triggered_by`: use `--replace`.
`precondition`, `postcondition`, `check`	Absent.	A constraint on a field you write is evaluated before any provider starts. A constraint on a value the provider computes is checked during apply, after the provider has returned it. A rule about a plan is a policy. See Policies.
`moved`, `import`, `removed` blocks	Absent.	`$from` and `$import` on the resource. `pravo state rm ADDR` forgets a record without destroying the object. See Moves and imports.
`module` block, `source`, `version`	Absent.	A definition or a package, instantiated with `&`. A module takes its providers as inputs. See Modules.
`provider` aliases and the `provider` meta-argument	Absent.	A provider struct for each configuration. A resource is built through the one it uses. See Providers.
`data "terraform_remote_state"`	Absent.	`pravo.#RemoteOutputs`. See Environment and remote outputs.
`terraform_data`	Absent.	`null_resource` of `hashicorp/null`.
Built-in functions	Absent.	CUE expressions and the standard library. See the function map.
Provisioners and `connection`	Absent.	Cloud-init through `user_data`, or a resource of a provider that runs commands, such as `scottwinkler/shell`. A provider function or data source reads a value from a script.

Configuration and files

In OpenTofu or Terraform	In pravo	Use
`terraform` block, `required_version`, `required_providers`	Absent.	An import of the generated package of each provider, and `$version` on the provider struct. `pravo version` prints the version.
`backend` block, `cloud` block	Absent.	`$settings: state` with a local directory or an S3 bucket. See Settings.
Encryption of the state	Absent.	Encrypt the bucket or the disk that holds the state directory.
`.terraform.lock.hcl`	Absent.	`pravo.lock.cue`.
`.terraform` directory	Absent.	Providers and schemas are cached in `PRAVO_HOME`, `~/.pravo` by default. The root holds `cue.mod`, `pravo.lock.cue` and the state directory.
`.terraformrc`, `provider_installation`, `plugin_cache_dir`	Absent.	`PRAVO_HOME` selects the cache. A provider can be copied to a container registry with `pravo providers copy`.
`.tfvars` files	Absent.	A `.cue` file of the package that sets the fields.
`terraform.tfstate`	Absent.	The state graph: one file for each node. `pravo state import-tfstate FILE` converts a state file of format version 4 once. See State format.
`TF_LOG`	Absent.	`-v` and `-vv`, or `PRAVO_LOG=debug`.

Not carried over by a conversion

pravo state import-tfstate reads the resources, data sources, attributes, private provider data, dependencies and outputs, with the sensitive mark of each output. It prints a note for what it cannot carry over.

Item	Result
Taint marks	The object is recorded as healthy, and the conversion prints a note. Use `--replace ADDR` to replace it.
Deposed objects	Skipped, with a note. Destroy them with OpenTofu first.
Records of the built-in provider	Skipped, with a note that names the replacement: `pravo.#RemoteOutputs` for `terraform_remote_state`, a `null_resource` of `hashicorp/null` for `terraform_data`.
Instance keys of `count` and `for_each`	The instance is renamed `<name>_<key>`. The conversion lists every rename.
Resources inside modules	The module path becomes a prefix of the name.
Check results	Not carried over.
Serial and lineage	The store has its own lineage.

See Convert the state.

Commands and flags

Language

Configuration and files

Not carried over by a conversion

See also