IaC

Functions of the tools module at v0.5.0. Each returns what a command runs in; import it with import * as tools from "tools".

terraform.env

Terraform, configured by its parameters.

terraform.env(
  --image: Environment = #hashicorp/terraform:1.16.4,
  --workspace: String | Null = null,
  --log: String | Null = null,
  --variables: Map<String> = {},
  --cache_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

The image is #hashicorp/terraform:1.16.4 unless --image names another. lask sync pulls and pins whichever image is used (lask spec 10.3); a run never pulls.

Nothing waits on a prompt (TF_INPUT=0), and Terraform leaves out the hints it gives a person at a terminal (TF_IN_AUTOMATION=1). A provider's credentials come in through --with: the AWS provider takes with = [aws.setup(...)]. Secrets for input variables go through --variables as TF_VAR_* variables of the container, never on the command line; bind them with !! where they come from, and they are masked.

Parameters

• --image The image to run; another release is passed as image = #hashicorp/terraform:<tag>.
• --workspace TF_WORKSPACE.
• --log TF_LOG, e.g. "DEBUG".
• --variables Input variables, each set as TF_VAR_<name>.
• --cache_dir Host directory mounted at /cache and used as the plugin cache itself (TF_PLUGIN_CACHE_DIR), e.g. home(".terraform.d/plugin-cache"). terraform init reports an error for a cache directory that does not exist yet, so the cache is the mount point, which always does.
• --with Setups of other tools this environment should also carry: a provider's credentials.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "terraform" } on ... or $[...].

Image hashicorp/terraform:1.16.4

lask eval terraform.env --workspace staging

lib/terraform.lask

tofu.env

OpenTofu, configured by the parameters of terraform.

tofu.env(
  --image: Environment = #ghcr.io/opentofu/opentofu:1.12.6,
  --workspace: String | Null = null,
  --log: String | Null = null,
  --variables: Map<String> = {},
  --cache_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

The image is #ghcr.io/opentofu/opentofu:1.12.6 unless --image names another. OpenTofu reads Terraform's variables, so every parameter means what it means for terraform: TF_INPUT=0, TF_IN_AUTOMATION=1, TF_VAR_* from --variables, the plugin cache at the /cache mount point. lask sync pulls and pins whichever image is used (lask spec 10.3); a run never pulls.

Parameters

• --image The image to run; another release is passed as image = #ghcr.io/opentofu/opentofu:<tag>.
• --workspace TF_WORKSPACE.
• --log TF_LOG, e.g. "DEBUG".
• --variables Input variables, each set as TF_VAR_<name>.
• --cache_dir Host directory mounted at /cache and used as the plugin cache itself (TF_PLUGIN_CACHE_DIR).
• --with Setups of other tools this environment should also carry: a provider's credentials.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "tofu" } on ... or $[...].

Image ghcr.io/opentofu/opentofu:1.12.6

lask eval tofu.env --workspace staging

lib/tofu.lask

ansible.env

ansible-core, configured by its parameters.

ansible.env(
  --config: String | Null = null,
  --inventory: String | Null = null,
  --host_key_checking: Bool | Null = null,
  --vault_password_file: String | Null = null,
  --ssh_dir: String | Null = null,
  --ssh_agent_socket: String | Null = null,
  --cache_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

There is no official image, so the image is built from lib/images/ansible/Dockerfile: ansible-core 2.21.4 on the Python image of python.env(), with the SSH client. Its versions are fixed in the recipe, so it takes no --image, and lask sync builds it once per machine (lask spec 10.3). A run never builds.

Output reaches the command log as it happens (PYTHONUNBUFFERED=1). A collection a playbook needs is installed with ansible-galaxy collection install -r requirements.yml in the same command, or kept under --cache_dir.

Parameters

• --config ANSIBLE_CONFIG: an ansible.cfg in the project.
• --inventory ANSIBLE_INVENTORY.
• --host_key_checking ANSIBLE_HOST_KEY_CHECKING.
• --vault_password_file Host path of the vault password file, mounted read-only at /run/secrets/vault-password (ANSIBLE_VAULT_PASSWORD_FILE).
• --ssh_dir Host directory mounted read-only at /root/.ssh; see ssh_setup.
• --ssh_agent_socket Host path of an SSH agent socket (SSH_AUTH_SOCK); see ssh_setup.
• --cache_dir Host directory mounted at /cache; collections and roles are installed under /cache/ansible (ANSIBLE_COLLECTIONS_PATH, ANSIBLE_ROLES_PATH).
• --with Setups of other tools this environment should also carry: a cloud's credentials for a dynamic inventory.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "ansible-playbook" } on ... or $[...].

Image recipe lib/images/ansible/Dockerfile

lask eval ansible.env --inventory inventory.ini --host_key_checking false

lib/ansible.lask

packer.env

Packer, configured by its parameters.

packer.env(
  --image: Environment = #hashicorp/packer:1.16.1,
  --log: String | Null = null,
  --variables: Map<String> = {},
  --cache_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

The image is #hashicorp/packer:1.16.1 unless --image names another. lask sync pulls and pins whichever image is used (lask spec 10.3); a run never pulls.

Packer does not call home (CHECKPOINT_DISABLE=1). A builder's credentials come in through --with: aws_setup for amazon-ebs, gcloud_setup for googlecompute, azure_setup for azure-arm.

Parameters

• --image The image to run; another release is passed as image = #hashicorp/packer:<tag>.
• --log PACKER_LOG, "1" for a verbose log.
• --variables Input variables, each set as PKR_VAR_<name>.
• --cache_dir Host directory mounted at /cache; plugins go in /cache/plugins (PACKER_PLUGIN_PATH) and downloads in /cache/packer_cache (PACKER_CACHE_DIR).
• --with Setups of other tools this environment should also carry: a builder's credentials.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "packer" } on ... or $[...].

Image hashicorp/packer:1.16.1

lask eval packer.env --variables '{"region": "ap-northeast-1"}'

lib/packer.lask

pulumi.env

Pulumi, with the runtime of one language, configured by its parameters.

pulumi.env(
  --image: Environment = #pulumi/pulumi-nodejs:3.265.0,
  --access_token: String | Null = <secret>,
  --backend_url: String | Null = null,
  --config_passphrase: String | Null = <secret>,
  --cache_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

The image is #pulumi/pulumi-nodejs:3.265.0 unless --image names another. Another language's runtime is another image of the same release, passed the same way: image = #pulumi/pulumi-python:3.265.0, or pulumi-go, pulumi-dotnet or pulumi-java; pulumi/pulumi holds every runtime and is several times the size. lask sync pulls and pins whichever image is used (lask spec 10.3); a run never pulls.

Pulumi checks for no update (PULUMI_SKIP_UPDATE_CHECK=true). A provider's credentials come in through --with, as for terraform.

Parameters

• --image The image to run; another release is passed as image = #pulumi/pulumi-nodejs:<tag>.
• --access_token!! PULUMI_ACCESS_TOKEN, for Pulumi Cloud; masked in the command log.
• --backend_url PULUMI_BACKEND_URL, e.g. "s3://my-state" or "file:///work/.pulumi".
• --config_passphrase!! PULUMI_CONFIG_PASSPHRASE, for a passphrase-encrypted stack; masked in the command log.
• --cache_dir Host directory mounted at /cache; Pulumi's home, with its plugins, is /cache/pulumi (PULUMI_HOME).
• --with Setups of other tools this environment should also carry: a provider's credentials.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "pulumi" } on ... or $[...].

Image pulumi/pulumi-nodejs:3.265.0

lask eval pulumi.env --backend_url file:///work/.pulumi

lib/pulumi.lask