vm

Repository to clone from GitHub

Ref/Branch to checkout - If not specified, defaults to “main”

Kubeconfig for the Harvester cluster the VM is created on.

Name of the VM. Forced into the KCL render as vmName so the manifests and the VMI we poll for can never drift apart.

Namespace for PVC, Secret and VirtualMachine. Forced into the KCL render as namespace for the same reason.

OCI reference of the harvester-vm KCL module.

KCL parameters as a YAML file (imageId, storageClass, storage, cpuCores, memory, networkName, cloudInitSshKey, cloudInitPassword, …).

Prefer this over kclParameters for anything sensitive: the file is mounted into the render container, whereas –kcl-parameters values become operation arguments and are echoed by dagger --progress plain.

KCL parameters as comma-separated key=value pairs. Override the file. Do not put credentials here — see kclParametersFile.

SOPS-encrypted KCL parameters file. Decrypted in-memory and used instead of kclParametersFile; the plaintext never becomes an operation argument.

AGE key for decrypting encryptedFile.

Skip creating the target namespace. By default BakeHarvester creates it (idempotently) first, because kubectl apply does not and a missing namespace is the most common way a bootstrap run dies on line one.

Seconds to wait for the VM to report an IP. Generous by default: the guest has to boot, install/start qemu-guest-agent and get a DHCP lease.

Seconds between VMI polls.

Ansible playbooks to run against the VM, comma-separated. Empty skips the Ansible stage entirely (render + apply + wait only).

Extra environment for the Ansible container, as a secret in dotenv format (NAME=value per line), for playbooks using lookup(‘env’, …).

Seconds to wait for the VMI object to exist at all before giving up. See WaitForVmIp; 0 folds the check back into –wait-timeout.

Seconds to wait after the IP appears before Ansible connects. The agent reports an address slightly before sshd is reliably up.

Inventory type: “simple” (default [all] group) or “cluster”.

e.g., “cpu=4,ram=4096,storage=100”

vaultToken

Extra environment for the Ansible container, as a secret in dotenv format (NAME=value per line), for playbooks using lookup(‘env’, …).

Any value that changes between runs – a timestamp, a CI run id. Threaded down to CreateAnsibleRequirementFiles, where it forces a fresh fetch of the remote requirements instead of a cached render. Leave empty to keep the previous behaviour.

Worth passing from CI: the dagger-labda runner keeps its engine between runs, so without it a merged collection bump can stay invisible to the pipeline indefinitely.

Inventory type: “simple” (default [all] group) or “cluster” (master/worker groups)

Comma-separated list of file paths to export from the Ansible container

AGE public key for SOPS encryption of exported files

File extension for SOPS encryption (e.g., “yaml”, “json”)

SOPS config file (.sops.yaml)

Comma-separated list of target filenames for exported files (maps 1:1 to exportPaths) If not set, original filenames are used

vaultToken

Extra environment for the Ansible container, as a secret in dotenv format (NAME=value per line), for playbooks using lookup(‘env’, …).

Any value that changes between runs – a timestamp, a CI run id. Threaded down to CreateAnsibleRequirementFiles, where it forces a fresh fetch of the remote requirements instead of a cached render.

Deliberately NOT a field in execution.yaml: it is a property of THIS run, not of the VM being built, and committing one would make it stale by definition. pr-vm-deploy.yaml should pass the run id.

Inventory type: “simple” (default [all] group) or “cluster” (master/worker groups)

AGE public key for SOPS encryption of exported files

Directory containing files to commit

Repository in “owner/repo” format

Branch name for git operations

Commit message

Destination path within the repository

GitHub token for authentication

If non-empty, create this branch (from branchName as base) and commit there instead

If true (and createBranch set), open a PR from the new branch back to branchName

Comma-separated list of hosts (e.g., “192.168.1.10,192.168.1.11”) Used to generate inventory if inventory file is not provided

Path to a YAML file containing parameters (lower priority)

Extra environment for the Ansible container, as a secret in dotenv format (NAME=value per line). Needed by playbooks that resolve values with lookup(‘env’, …), which is evaluated on the controller, not the target – e.g. sthings.container.kind_machinery reads SOPS_AGE_KEY that way.

Inventory type: “simple” (default [all] group) or “cluster” (master/worker groups)

Comma-separated list of file paths to export from the Ansible container

Comma-separated list of hosts (e.g., “192.168.1.10,192.168.1.11”)

Extra environment for the Ansible container, as a secret in dotenv format (NAME=value per line). Needed by playbooks that resolve values with lookup(‘env’, …), which is evaluated on the controller, not the target.

Inventory type: “simple” (default [all] group) or “cluster” (master/worker groups)

Any value that changes between runs – a timestamp, a CI run id. Threaded into CreateAnsibleRequirementFiles, where it forces a fresh fetch of the remote requirements instead of a cached render. Leave empty to keep the previous behaviour.

AGE public key for SOPS encryption

File extension for SOPS encryption (e.g., “yaml”, “json”)

SOPS config file (.sops.yaml)

Git repository in “owner/repo” format

Git branch name

Git commit message

Destination path within the git repository

GitHub token for authentication

If non-empty, create this branch (from gitBranch as base) and commit there instead

If true (and gitCreateBranch set), open a PR from the new branch back to gitBranch

PR title (defaults to gitCommitMessage if empty)

Comma-separated list of file paths to export from the Ansible container

Comma-separated list of hosts (e.g., “192.168.1.10,192.168.1.11”) Used to generate inventory if inventory file is not provided

Path to a YAML file containing parameters (lower priority)

Extra environment for the Ansible container, as a secret in dotenv format (NAME=value per line). Needed by playbooks that resolve values with lookup(‘env’, …), which is evaluated on the controller, not the target.

Inventory type: “simple” (default [all] group) or “cluster” (master/worker groups)

Directory containing terraform configurations

Terraform operation to execute

Comma-separated terraform variables (e.g. “name=patrick,food=schnitzel”)

AWS access key ID for S3/MinIO backend

AWS secret access key for S3/MinIO backend

Vault role ID secret

Vault secret ID secret

Vault token secret

AGE key for SOPS decryption of encryptedFiles / encryptedKubeConfig

Comma-separated list of SOPS-encrypted file paths under terraformDir to decrypt (e.g. “terraform.tfvars.sops.json,secrets.sops.yaml”)

Kubeconfig secret for Kubernetes state backend access (plaintext)

Path to mount the kubeconfig inside the container (must match backend config_path in backend.tf)

SOPS-encrypted kubeconfig file; decrypted with sopsAgeKey and used for kubectl

Kubernetes secret name to read (e.g. “vault-root-token”)

Kubernetes namespace for the secret

JSONPath expression to extract from the Kubernetes secret (e.g. “.data.root_token”)

Terraform variable name to set from the Kubernetes secret value (e.g. “vault_token” becomes -var vault_token=)

Directory containing terraform state (output of ExecuteTerraform)

AWS access key ID for S3/MinIO backend

AWS secret access key for S3/MinIO backend

Kubeconfig secret for Kubernetes backend access

Kubeconfig for the cluster running the VM.

VM name (the VMI carries the same name as its VirtualMachine).