🖼️ See the drawing + lab 🏠 Course home 🌿 Branch on GitHub ✏️ View source

🖼️ आकृती आणि labThe drawing + lab पूर्ण पानावर उघडा ↗Open full page ↗

🔁 धडा 04 — Variables, outputs आणि loops: एक आराखडा, अनेक खोल्या

📍 तुम्ही इथे आहात: धडा 04 / 12 · मागे: lesson-03-plan-apply · पुढे: lesson-05-state

📦 या ब्रँचमध्ये काय आहे

धडे 01–03, आणि आराखडा पुन्हा वापरता येण्याजोगा करणारे भाषेचे भाग: input variables (तुम्ही भरता त्या रिकाम्या जागा), locals (एकदा मोजलेल्या मूल्यांसाठी नावे), outputs (आराखडा परत काय सांगतो) आणि दोन loops, count आणि for_each. मुख्य धडा: count आपल्या प्रतींना जागेनुसार नंबर देतो, for_each नावाने — आणि एखादी प्रत काढल्यावर काय होते ते यावरूनच ठरते. iac/demo.py मधील variables(); iac/engine.py मधील expand() आणि resolve().

🧒 5 वर्षांच्या मुलाला समजावल्यासारखे

Lab च्या आराखड्यात आता रिकाम्या जागा आहेत: "town: ____ · seats: ____". 🖊️ त्या "dev, 30" ने भरा आणि तुम्हाला छोटी lab मिळते. "prod, 40" ने भरा आणि मोठी मिळते. आराखडा तोच.

Lab ला lockers a, b आणि c सुद्धा हवे आहेत. हे लिहून ठेवण्याचे दोन मार्ग आहेत.

मार्ग 1 — नंबर (count). "Locker #0 म्हणजे a, #1 म्हणजे b, #2 म्हणजे c." मग locker b ची गरज संपते. आता यादी "a, c" आहे. म्हणून #0 म्हणजे a, आणि #1 आता c आहे. कंत्राटदार विचार करतो: "#1 वर आधी b लिहिले होते, आता c आहे — लेबल बदला. आणि #2 आता यादीत नाही — तो काढून टाका." पण #2 हा खरा locker c होता, आत कोणाची तरी पुस्तके असलेला! 📚😱

मार्ग 2 — नावे (for_each). "a नावाचा locker, b नावाचा locker, c नावाचा locker." b काढा, आणि कंत्राटदार फक्त locker b काढतो. बाकी काहीच हलत नाही.

🗺️ आकृती

flowchart LR
    subgraph cnt["count = length(var.labels) — by POSITION"]
      c0["row[0] a"] --> c0b["row[0] a ✓"]
      c1["row[1] b"] --> c1b["row[1] c  ~ relabel"]
      c2["row[2] c"] --> c2b["row[2]  - destroy"]
    end
    subgraph fe["for_each = var.labels — by NAME"]
      fa["row[&quot;a&quot;]"] --> fa2["✓"]
      fb["row[&quot;b&quot;]"] --> fb2["- destroy"]
      fc["row[&quot;c&quot;]"] --> fc2["✓"]
    end

🗺️ रेखाटलेली आवृत्ती + एक lab: https://school-edh.pages.dev/terraform/lesson-diagrams.html#l04

❓ काय

Input variable — variable "seats" { default = 30 }, var.seats म्हणून वापरले जाते. ते -var seats=40, .tfvars file (-var-file=prod.tfvars), किंवा environment variable TF_VAR_seats=40 ने ठरवा. Default नसलेले variable देणे आवश्यकच आहे. validation block चुकीची मूल्ये लवकरच नाकारू शकतो.
Local value — locals { prefix = "${var.env}-school" }, local.prefix म्हणून वापरले जाते. एका expression साठी नाव, म्हणजे ते एकदाच लिहावे लागते.
Output — output "lab_name" { value = school_room.lab.name }. Apply नंतर print होते, terraform output ने वाचता येते, आणि module मूल्ये परत देतो तो मार्ग हाच (धडा 07). sensitive = true ते screen वर लपवते (ते काय लपवत नाही ते धडा 05 दाखवतो).
count = N — N प्रती, row[0], row[1], … असे address. count.index हा नंबर.
for_each = map किंवा set — प्रत्येक key साठी एक प्रत, row["a"] असा address. आत each.key आणि each.value. List आधी set मध्ये बदलावी लागते: for_each = toset(var.labels).
Splat — school_locker.row[*].id — सर्व प्रतींच्या ids ची list.
Expression — HCL मध्ये functions (length, lookup, merge, cidrsubnet, …), conditionals (a ? b : c) आणि for expressions असतात. Lab मध्ये एक function आहे, length().

🤔 का

कारण variables शिवाय dev आणि prod चे आराखडे दोन प्रती असतात ज्या हळूहळू वेगळ्या होतात. Loops शिवाय वीस lockers म्हणजे copy केलेले वीस blocks. आणि count व for_each यांतील निवड म्हणजे "मधली item काढणे" हा छोटा बदल ठरणे आणि चुकीच्या objects ची लेबले बदलणारी, त्यांना पुन्हा बांधणारी किंवा destroy करणारी उलथापालथ ठरणे यांतील फरक. Data असलेल्या खऱ्या objects साठी — disks, users, DNS records — ती उलथापालथ म्हणजे outage.

🔧 कसे (या repo मध्ये)

iac/engine.py मधील expand() आधी variable वाचते (default आणि ऐच्छिक validation सह), मग locals, मग प्रत्येक resource. count असलेल्या block चे instances [0], [1], … होतात; for_each सह instances ["key"]. resolve() ${var.x}, ${local.x}, ${count.index}, ${each.key}, ${var.labels[count.index]}, ${length(var.labels)} आणि references भरते. Outputs apply नंतर resolve होतात; show_outputs() ते terraform output सारखे print करते.

🧪 करून पाहा

python3 iac/demo.py variables
python3 - <<'EOF'
import sys; sys.path.insert(0, "iac")
from cloud import FakeCloud
from engine import plan, apply, ConfigError
def cfg(kind):
    lock = ({"count": "${length(var.labels)}", "label": "${var.labels[count.index]}"} if kind == "count"
            else {"for_each": "${var.labels}", "label": "${each.key}"})
    return {"variable": {"labels": {"default": ["a", "b", "c", "d"]},
                         "seats": {"default": 30, "validation": (lambda v: 10 <= v <= 60, "seats must be between 10 and 60")}},
            "resource": {"school_room": {"lab": {"name": "lab", "seats": "${var.seats}"}},
                         "school_locker": {"row": dict(lock, room_id="${school_room.lab.id}")}}}
for kind in ("count", "for_each"):
    cloud = FakeCloud(); st, _, _ = apply(plan(cfg(kind), None, cloud), cloud)
    p = plan(cfg(kind), st, cloud, vars={"labels": ["b", "c", "d"]})
    print(f"{kind:<8} remove 'a' → {p.summary()}")
    for line in p.lines(): print("        ", line.strip())
try: plan(cfg("count"), None, FakeCloud(), vars={"seats": 500})
except ConfigError as e: print("seats=500 →", e)
EOF

✅ तपासा — तुम्हाला काय दिसायला हवे

variables असे print करते:

   output lab_name = "dev-school-lab"
   output locker_ids = ["locker-01", "locker-02", "locker-03"]
── -var env=prod -var seats=40 → ~ school_room.lab  name: 'dev-school-lab' → 'prod-school-lab' · seats: 30 → 40
── count: remove 'b' from [a, b, c] → ~ school_locker.row[1]  label: 'b' → 'c' · - school_locker.row[2] (destroy) → Plan: 0 to add, 1 to change, 1 to destroy.
── for_each: remove 'b' → - school_locker.row["b"] (destroy) → Plan: 0 to add, 0 to change, 1 to destroy.

तुमचा snippet असे print करतो:

count    remove 'a' → Plan: 0 to add, 3 to change, 1 to destroy.
         ~ school_locker.row[0]  label: 'a' → 'b'
         ~ school_locker.row[1]  label: 'b' → 'c'
         ~ school_locker.row[2]  label: 'c' → 'd'
         - school_locker.row[3] (destroy)
for_each remove 'a' → Plan: 0 to add, 0 to change, 1 to destroy.
         - school_locker.row["a"] (destroy)
seats=500 → Invalid value for variable "seats": seats must be between 10 and 60

🏁 तुम्ही आत्ताच काय सिद्ध केले

count सह चार lockers पैकी पहिला काढल्यावर चारही addresses ना धक्का लागला: तीन लेबल-बदल आणि एक destroy — आणि destroy झालेला object खरा locker d होता, a नाही. for_each सह तोच बदल म्हणजे नेमका row["a"] चा एक destroy. या campus मध्ये लेबल बदलणे जागीच update आहे; सरकलेल्या field मध्ये ForceNew argument असता तर प्रत्येक लेबल-बदल replace ठरला असता. Validation ने कोणताही plan बनण्याआधीच seats = 500 थांबवले.

⚠️ नेहमीच्या चुका

स्वतःची ओळख असलेल्या गोष्टींच्या list वर count (users, buckets, disks) — for_each वापरा
साध्या list वर for_each — Terraform ला map किंवा set हवा: toset(var.labels)
फक्त apply नंतर कळणाऱ्या मूल्यावरून (एक id) बनवलेले count किंवा for_each — Terraform नकार देते: plan च्या वेळीच keys माहीत असायला हव्यात
सगळ्यासाठी एकच प्रचंड variable object, types किंवा validation शिवाय
git मध्ये variable defaults म्हणून secrets — ते secret store मधून द्या (आणि धडा 05 पाहा)

🏭 प्रत्यक्ष वापरात

खऱ्या account वर — validation असलेले typed variables, एक .tfvars file, आणि map वर for_each:

variable "env" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.env)
    error_message = "env must be dev, staging or prod."
  }
}

variable "lockers" {
  type    = map(object({ size = string }))
  default = { a = { size = "m" }, b = { size = "s" } }
}

locals {
  prefix = "${var.env}-school"
}

resource "aws_s3_bucket" "locker" {
  for_each = var.lockers
  bucket   = "${local.prefix}-locker-${each.key}"
  tags     = { size = each.value.size }
}

output "locker_buckets" {
  value = { for k, b in aws_s3_bucket.locker : k => b.arn }
}

terraform plan -var-file=prod.tfvars           # prod.tfvars:  env = "prod"
TF_VAR_env=dev terraform plan                  # the same through an environment variable
terraform output -json                         # outputs for scripts
terraform console                              # try expressions: > length(var.lockers)

आधीच count वापरले आहे आणि बदलायचे आहे? moved block (धडा 09) aws_s3_bucket.locker[0] चे aws_s3_bucket.locker["a"] असे नाव पुन्हा न बांधता बदलतो.

🏭 प्रत्यक्ष वापरात हे का महत्त्वाचे: data किंवा ओळख असलेल्या resources वरील count = साठी तुमचा code grep करा. प्रत्येक जण भविष्यातील "मधली item काढा" incident आहे; list अजून लहान असतानाच त्यांना moved blocks सह for_each वर हलवा.

⏭️ पुढे

कंत्राटदार गुपचूप एक वही ठेवत आला आहे: कोणता address कोणता खरा object आहे. पुढे: state — ती काय आहे, आणि तिचे संरक्षण का करायलाच हवे.

git checkout lesson-05-state

🔁 Lesson 04 — Variables, outputs & loops: one set of plans, many rooms

📍 You are here: Lesson 04 of 12 · Previous: lesson-03-plan-apply · Next: lesson-05-state

📦 What's in this branch

Lessons 01–03, plus the parts of the language that make plans reusable: input variables (blanks you fill in), locals (names for values you compute once), outputs (what the plans report back) and the two loops, count and for_each. The key lesson: count numbers its copies by position, for_each by name — and that decides what happens when you remove one. variables() in iac/demo.py; expand() and resolve() in iac/engine.py.

🧒 Explain like I'm 5

The lab plans now have blanks: "town: ____ · seats: ____". 🖊️ Fill them in with "dev, 30" and you get a small lab. Fill them in with "prod, 40" and you get a big one. Same plans.

The lab also needs lockers a, b and c. There are two ways to write that down.

Way 1 — numbers (count). "Locker #0 is a, #1 is b, #2 is c." Then locker b is no longer needed. Now the list is "a, c". So #0 is a, and #1 is now c. The contractor thinks: "#1 used to say b, now it says c — relabel it. And #2 is not on the list any more — take it away." But #2 was the real locker c, with someone's books inside! 📚😱

Way 2 — names (for_each). "Locker called a, locker called b, locker called c." Remove b, and the contractor removes only locker b. Nothing else moves.

🗺️ Diagram

flowchart LR
    subgraph cnt["count = length(var.labels) — by POSITION"]
      c0["row[0] a"] --> c0b["row[0] a ✓"]
      c1["row[1] b"] --> c1b["row[1] c  ~ relabel"]
      c2["row[2] c"] --> c2b["row[2]  - destroy"]
    end
    subgraph fe["for_each = var.labels — by NAME"]
      fa["row[&quot;a&quot;]"] --> fa2["✓"]
      fb["row[&quot;b&quot;]"] --> fb2["- destroy"]
      fc["row[&quot;c&quot;]"] --> fc2["✓"]
    end

🗺️ Drawn version + a lab: https://school-edh.pages.dev/terraform/lesson-diagrams.html#l04

❓ What

Input variable — variable "seats" { default = 30 }, used as var.seats. Set it with -var seats=40, a .tfvars file (-var-file=prod.tfvars), or an environment variable TF_VAR_seats=40. A variable with no default must be given. A validation block can reject bad values early.
Local value — locals { prefix = "${var.env}-school" }, used as local.prefix. A name for an expression, so you write it once.
Output — output "lab_name" { value = school_room.lab.name }. Printed after apply, readable with terraform output, and the way a module hands values back (lesson 07). sensitive = true hides it on screen (lesson 05 shows what it does not hide).
count = N — N copies, addressed row[0], row[1], … count.index is the number.
for_each = map or set — one copy per key, addressed row["a"]. each.key and each.value inside. A list must be turned into a set first: for_each = toset(var.labels).
Splat — school_locker.row[*].id — the list of all copies' ids.
Expression — HCL has functions (length, lookup, merge, cidrsubnet, …), conditionals (a ? b : c) and for expressions. The lab has one function, length().

🤔 Why

Because without variables, dev and prod plans are two copies that drift apart. Without loops, twenty lockers are twenty copied blocks. And the choice between count and for_each is the difference between "remove the middle item" being a small change and being a shuffle that relabels, rebuilds or destroys the wrong objects. For real objects with data — disks, users, DNS records — that shuffle is an outage.

🔧 How (in this repo)

expand() in iac/engine.py reads variable (with default and an optional validation), then locals, then each resource. A block with count becomes instances [0], [1], …; with for_each, instances ["key"]. resolve() fills in ${var.x}, ${local.x}, ${count.index}, ${each.key}, ${var.labels[count.index]}, ${length(var.labels)} and references. Outputs are resolved after apply; show_outputs() prints them like terraform output.

🧪 Try it

python3 iac/demo.py variables
python3 - <<'EOF'
import sys; sys.path.insert(0, "iac")
from cloud import FakeCloud
from engine import plan, apply, ConfigError
def cfg(kind):
    lock = ({"count": "${length(var.labels)}", "label": "${var.labels[count.index]}"} if kind == "count"
            else {"for_each": "${var.labels}", "label": "${each.key}"})
    return {"variable": {"labels": {"default": ["a", "b", "c", "d"]},
                         "seats": {"default": 30, "validation": (lambda v: 10 <= v <= 60, "seats must be between 10 and 60")}},
            "resource": {"school_room": {"lab": {"name": "lab", "seats": "${var.seats}"}},
                         "school_locker": {"row": dict(lock, room_id="${school_room.lab.id}")}}}
for kind in ("count", "for_each"):
    cloud = FakeCloud(); st, _, _ = apply(plan(cfg(kind), None, cloud), cloud)
    p = plan(cfg(kind), st, cloud, vars={"labels": ["b", "c", "d"]})
    print(f"{kind:<8} remove 'a' → {p.summary()}")
    for line in p.lines(): print("        ", line.strip())
try: plan(cfg("count"), None, FakeCloud(), vars={"seats": 500})
except ConfigError as e: print("seats=500 →", e)
EOF

✅ Verify — what you should see

variables prints:

   output lab_name = "dev-school-lab"
   output locker_ids = ["locker-01", "locker-02", "locker-03"]
── -var env=prod -var seats=40 → ~ school_room.lab  name: 'dev-school-lab' → 'prod-school-lab' · seats: 30 → 40
── count: remove 'b' from [a, b, c] → ~ school_locker.row[1]  label: 'b' → 'c' · - school_locker.row[2] (destroy) → Plan: 0 to add, 1 to change, 1 to destroy.
── for_each: remove 'b' → - school_locker.row["b"] (destroy) → Plan: 0 to add, 0 to change, 1 to destroy.

Your snippet prints:

count    remove 'a' → Plan: 0 to add, 3 to change, 1 to destroy.
         ~ school_locker.row[0]  label: 'a' → 'b'
         ~ school_locker.row[1]  label: 'b' → 'c'
         ~ school_locker.row[2]  label: 'c' → 'd'
         - school_locker.row[3] (destroy)
for_each remove 'a' → Plan: 0 to add, 0 to change, 1 to destroy.
         - school_locker.row["a"] (destroy)
seats=500 → Invalid value for variable "seats": seats must be between 10 and 60

🏁 What you just proved

Removing the first of four lockers with count touched all four addresses: three relabels and one destroy — and the destroyed object was the real locker d, not a. With for_each, the same edit was exactly one destroy of row["a"]. In this campus a label is an in-place update; with a ForceNew argument in the shifted field, each relabel would be a replace. The validation stopped seats = 500 before any plan was made.

⚠️ Common mistakes

count over a list of things that have their own identity (users, buckets, disks) — use for_each
for_each over a plain list — Terraform wants a map or a set: toset(var.labels)
count or for_each built from a value only known after apply (an id) — Terraform refuses: it must know the keys at plan time
one huge variable object for everything, with no types or validation
secrets as variable defaults in git — pass them from a secret store (and see lesson 05)

🏭 In production

On a real account — typed variables with validation, a .tfvars file, and for_each over a map:

variable "env" {
  type = string
  validation {
    condition     = contains(["dev", "staging", "prod"], var.env)
    error_message = "env must be dev, staging or prod."
  }
}

variable "lockers" {
  type    = map(object({ size = string }))
  default = { a = { size = "m" }, b = { size = "s" } }
}

locals {
  prefix = "${var.env}-school"
}

resource "aws_s3_bucket" "locker" {
  for_each = var.lockers
  bucket   = "${local.prefix}-locker-${each.key}"
  tags     = { size = each.value.size }
}

output "locker_buckets" {
  value = { for k, b in aws_s3_bucket.locker : k => b.arn }
}

terraform plan -var-file=prod.tfvars           # prod.tfvars:  env = "prod"
TF_VAR_env=dev terraform plan                  # the same through an environment variable
terraform output -json                         # outputs for scripts
terraform console                              # try expressions: > length(var.lockers)

Already used count and need to switch? A moved block (lesson 09) renames aws_s3_bucket.locker[0] to aws_s3_bucket.locker["a"] without a rebuild.

🏭 Why this matters in production: grep your code for count = on resources that hold data or identity. Each one is a future "remove the middle item" incident; move them to for_each with moved blocks while the list is still short.

⏭️ Next

The contractor has been quietly keeping a notebook: which address is which real object. Next: the state — what it is, and why it must be protected.

git checkout lesson-05-state

← Previousplan apply Next →state

This page is the lesson's README from the lesson-04-variables-loops branch, shown here so the whole School stays on one site. Code files open on GitHub at the same branch.